# Message Authentication Mechanism and Privacy Protection in the Context of Vehicular Ad Hoc Networks

Authors: Hsin-Te Wu; Alan Dahgwo Yein; Wen-Shyong Hsieh
Journal: Mathematical Problems in Engineering
 (2015)

---

## Abstract

Vehicular ad hoc networks (VANETs) have been widely researched in recent years. VANETs are used mostly for road safety and traffic efficiency; therefore, it is imperative that the communication between vehicles is rapid and secure in a VANET environment. In the present study, bilinear pairings were used to construct a complete message authentication scheme. This scheme provided the following features: (1) vehicle or roadside unit (RSU) parameters were determined via a hierarchical protocol, which prevented potentially a large computational overhead for a single node; (2) message broadcasts and private communications between vehicles in the transmission range of the same RSU were enabled; (3) message broadcasts and private communications between vehicles in the transmission ranges of different RSUs were enabled; (4) a fast handoff mechanism was established for vehicles in the transmission ranges of different RSUs; and (5) mechanisms for message broadcasts and private communication were established for vehicles in areas where RSUs were sparsely located. Based on the experimental results, our scheme was confirmed to be superior to previous schemes. In terms of security, our scheme offered the following features: confidentiality, message integrity, nonrepudiation, conditional anonymity, and conditional untraceability.


---

## Body

## 1. Introduction

Vehicular ad hoc networks (VANETs) have been widely researched in recent years. VANETs are mobile networks in which vehicles equipped with on-board units (OBUs) communicate with each other or roadside units (RSUs) [1, 2]. Vehicles can broadcast traffic information to one another over VANETs [3]. In addition, passengers can communicate with passengers in other vehicles or send electronic mail using hand-held devices over VANETs [4]. VANETs have drawn special attention for traffic safety and management [5, 6]. The information exchanged between vehicles over VANETs enhances road safety and improves traffic efficiency. Generally, there are two different modes in VANETs for sending messages: the message broadcast mode, in which neighboring vehicles may provide one another with up-to-date proximal vehicle state information via message broadcasts, and the one-hop broadcast mode, in which a vehicle can send messages to one other specific vehicle. One-hop broadcasts are mainly used for private communication between vehicles.There are two vehicular communication modes in VANETs [7], vehicle-to-vehicle communication (IVC) and RSU-to-vehicle communication (RVC). IVC allows each vehicle to broadcast information to other vehicles or send information to one specific vehicle via others. RVC allows vehicles to exchange information with one another within the broadcast range or communicate with and obtain information from other vehicles via wireless-device equipped RSUs. VANETs enable vehicles to exchange up-to-date traffic information, which improves the flow of traffic and driving safety. However, if the information is modified or falsified by a malicious vehicle user, serious consequences such as traffic congestion and even a traffic accident can occur. A scheme for ensuring information security is proposed in the present study.A message authentication scheme for VANETs should take the following problems into consideration:(
1
) the exchange of information between vehicles in VANETs is accomplished through wireless communication. Therefore, to be timely, the volume of information cannot be excessively high nor can the method for message authentication be excessively complicated. (
2
) Vehicles should be able to not only broadcast information but additionally communicate privately with other devices. (
3
) Vehicles use a short-range wireless communication technique to communicate with RSUs and are usually moving at high speeds, requiring frequent handoffs with RSUs. Handoff schemes with long computation times adversely affect the communication quality. (4) RSUs may be available only on main roads and not on minor ones.In the present study, a complete message authentication scheme is constructed using the bilinear pairings technique. The encryption scheme from bilinear pairings is appropriate for VANETs. The parameters for each node in this study are generated in a hierarchical way. The long-term parameters for each vehicle are generated by the trusted authority (TA). Vehicles use their long-term parameters to perform identity (ID) authentication with RSUs and then gain trust from them. RSUs then produce short-term parameters for the vehicles that allow them to broadcast information and conduct private communications. When the vehicles are not within the transmission range of any RSUs, they can use their long-term parameters to broadcast information and communicate privately with one another. The trust gained from one RSU enables the vehicle to perform handoffs with other RSUs. Based on the experimental results, the scheme proposed in this study shows excellent performance and is superior to other schemes in the literature.


## 2. Related Works

The conventional public key infrastructure (PKI) scheme was used in [8]. Assuming that a certificate authority (CA) provides each vehicle with a digital certificate of identity, that is, a private key together with its associated public key, the vehicle can then use the asymmetric key for signing and verifying a message. However, the computational complexity increases when a vehicle uses the PKI for message signature and verification, resulting in communication overhead. In addition, for the purposes of privacy and untraceability, a vehicle must constantly change its certificate, which adversely affects the CA overhead.A solution is defined in [9] in which vehicles can generate public/private key pairs on their own. The benefits lie in the fact that a vehicle uses a different key each time it sends a message and that the vehicle is not required to update the related parameters with the CA. Assuming that there is a cryptographic device, or black box, installed in each vehicle and in each black box there are an asymmetric key and a certificate issued by the CA, the black box generates the public/private key pair for the vehicle. However, the public/private key pair is the continuous product of two values, resulting in each key pair having a long message length. This long message length may result in communication overhead when the vehicle is sending messages.The scheme for vehicular communications used in [10] was constructed with a hierarchy in which the keys were generated in a top-to-bottom manner. The hierarchical method allows vehicles to generate parameters such as their IDs through RSUs, which mitigates the key escrow problem in the CA. The generated keys are reliable and nonforgeable. However, this scheme requires the use of vehicle certificates. Thus, the information exchanged between vehicles is verified via the contents of the certificates. The requirement for a certificate with each message may nevertheless result in data packet overhead. In addition, message encryption based on bilinear pairings may result in computation overhead.In [11], to provide network access services, a vehicle must establish a common key with the recipient vehicle via a broadcast message. The common key ensures the security of the subsequent information exchange, authentication, message integrity, and nonrepudiation. However, the common key is established using the identity-based cryptography (IBC) scheme, which is based on bilinear pairings. The establishment of a shared common key with each vehicle may result in vehicle computation overhead. The authors in [11] did not discuss the problems of rekeying and pseudonym changes. These problems are significant in vehicle networks, warranting resolution. A dynamic, privacy-preserving key management scheme for location-based services in VANETs was proposed in [12]. This scheme ensures the anonymous authentication of a vehicle and enables double-registration detection. In addition, each vehicle can use a one-way hash function to update the vehicles new session key. However, the computations for message signature and verification presented in [12] are complicated, and the author did not investigate a private communication scheme.In [13], an elliptic curve digital signature algorithm (ECDSA) was used for message authentication. The current position information is used together with the ECDSA for signing messages from anonymous IDs. Other vehicles do not require a third-party public key certificate for message authentication. However, the authors did not discuss the problems of rekeying and private communication.The delay in long-term verification of centralized AAA architecture in literature [14] has been alleviated. In this paper, a set of network security approaches based on bilinear Diffie-Hellman (BDH) problem are proposed to protect the privacy of vehicles and network security of portable electronic currency in VANETs environment. However, the proposed method requires a key to be generated at regular intervals on each vehicle in advance for privacy, which is a big burden for the vehicle.In literature [15], a set of network security mechanisms based on chameleon hashing was proposed to ensure vehicle privacy and network communications security in VANETs. However, owing to computational complexity and packet length of chameleon hashing, it constitutes a big burden for VANETs.In literature [16], a set of network security mechanisms based on bilinear pairing was proposed. Although it can ensure network communications security of vehicles in VANETs, it does not provide private communications between vehicles. Besides, the changes of relevant parameters for vehicles involved have to be updated via TA. Therefore, it has a centralized authentication issue.


## 3. Background

This section will introduce the technologies used in the method developed in this study. Section3.1 introduces bilinear pairing and hard problems, Section 3.2 discusses Boneh and Franklins ID-based encryption, Section 3.3 discusses Shamirs ID-based cryptosystem, and Section 3.4 covers bilinear Diffie-Hellman message authentication.


### 3.1. Bilinear Pairings and Hard Problems

LetG
1 and G
2 denote an additive and a multiplicative group and both of them with prime order q. Let P be generator of G
1 and let e
:
G
1
×
G
1
→
G
2 be a bilinear mapping with the following properties.(1)
Bilinear:(1)
e
=
(
a
P
,
b
P
)
=
e
P
,
P
a
b
e
a
·
P
+
b
·
P
,
P
=
e
a
·
P
,
P
e
b
·
P
,
P
,
h
h
h
h
h
h
h
h
h
h
h
h
h
h
h
∀
P
∈
G
1
,
a
,
b
∈
Z
q
*
.
(2)
Nondegeneracy:∃
P
∈
G
1 such that e
^
P
,
P
≠
1. That is, the mapping does not send all pairs in G
1
×
G
1 to the identity in G
2.
(3)
Computable: there exists an efficient algorithm to computee
P
,
P for all P
∈
G
1.The bilinear mape can be implemented using the Weil [9] and Tate [10] pairings on elliptic curves. We consider the implementation of a Tate pairing on a Miyaji–Nakabayashi–Takano (MNT) curve [11] with embedding degree 6, where G
1 is represented by 161 bits and the order q is represented by 160 bits.The following part will define and specify various relevant mathematical problems [12] which will be applied in the essay subsequently.Bilinear Diffie-Hellman problem:GivenP
,
a
P
,
b
P
,
c
P
∈
G
1, where a
,
b
,
c
∈
Z
q
*, compute e
=
P
,
P
a
b
c.Elliptic curve discrete logarithm problem (ECDLP):Given two elementsP
,
Q
∈
G
1, find an integer a
∈
Z
q
*, such that Q
=
a
P.


### 3.2. ID-Based Encryption

We used ID-based encryption [17] to encrypt and decrypt messages. A private key generator (PKG) chooses a random number g
PKG
∈
Z
q
* as its master key and selects two distinct hash functions, H
1
:
0,1
*
→
G
1 and H
2
:
G
2
→
0,1
*. Given a user i with an identity ID
i
∈
0,1
*, any party can obtain the user’s public key PU
ID
i
=
H
1
(
ID
i
). The PKG sets the user’s private key P
R
I
D
i
=
g
PKG
·
H
1
(
I
D
i
). User i chooses s
I
D
i
∈
Z
q
* as her/his own secret value and sets D
I
D
i
=
s
I
D
i
·
P. In the final step, the PKG publishes the system parameters q
,
G
1
,
G
2
,
e
^
,
P
,
D
I
D
i
,
I
D
i
,
H
1
,
H
2 and withholds s
I
D
i.Encrypt. To encrypt a message M
∈
0,1
* for the user with identity ID
i is as follows.(1)
Choose a random numberr
∈
Z
P
*.
(2)
Set the cipher textC to be(2)
C
=
E
IBC
r
,
M
,
P
U
I
D
i
,
D
I
D
i
=
r
·
P
,
M
⊕
H
2
e
P
U
I
D
i
,
D
I
D
i
r
.Decryption. Let C
=
U
,
V. To decrypt C using the secret value s
I
D
i, compute D
IBC
(
s
I
D
i
,
C
)
=
V
⊕
H
2
(
e
(
s
I
D
i
P
U
I
D
i
,
U
)
)
=
M, where(3)
V
⊕
H
2
e
s
I
D
i
P
U
I
D
i
,
U
=
M
⊕
H
2
e
^
P
U
I
D
i
,
r
D
I
D
i
⊕
H
2
e
^
s
I
D
i
P
U
I
D
i
,
r
P
=
M
⊕
H
2
e
^
P
U
I
D
i
,
r
s
I
D
i
P
⊕
H
2
e
^
s
I
D
i
P
U
I
D
i
,
r
P
=
M
⊕
H
2
e
^
P
U
I
D
i
,
r
s
I
D
i
P
⊕
H
2
e
^
P
U
I
D
i
,
r
s
I
D
i
P
=
M
.


### 3.3. ID-Based Cryptosystem

The advantage of ID-based cryptosystems [17] is that public key certificates are no longer needless, and this possibly causes a saving of space requirements. Besides, it also reduces the key management cost, which is a heavy burden in conventional public key infrastructure (PKI). However, it has a serious drawback, called key escrow problem. PKG is responsible for generating a user’s private key, so it can decrypt any ciphertext or forge any user’s signature on any message.


### 3.4. Message Authentication Based on the Bilinear Hard Problems (BHD) Method

In this study, message signatures and verification are established based on the BDH method. In this scheme, useri selects a random number h
i
∈
Z
q
* as the secret value, calculates the public value (B
i), and then broadcasts B
i to all other users. Notations of the BDH list the notation used in this study. User i broadcasts message M
i
,
j by executing the following steps.(1)
Useri calculates w
i
,
j
=
H
M
i
,
j
∥
T
j
mod
⁡
p.
(2)
Useri calculates h
i
=
y
i
,
j
*
w
i
,
j
+
r
i
,
j, where y
i
,
j represents the quotient and r
i
,
j represents the remainder.
(3)
Useri broadcasts M
i
,
j
,
y
i
,
j
·
P
,
I
D
i
,
T
j
,
e
^
P
,
r
i
,
j
·
P.Other users can then verify the message upon receipt by executing the following steps.(1)
Calculatew
i
,
j
=
H
M
i
,
j
∥
T
j
mod
⁡
p.
(2)
Check whethere
^
w
i
,
j
·
P
,
y
i
,
j
·
P
+
e
^
P
,
r
i
,
j
·
P
=
e
^
P
,
P
h
i
=
?
B
i.If the equality in step(
2
) is satisfied, then this condition verifies that the user i sent the message. During the verification process, other users receive only y
i
,
j
·
P, e
^
P
,
r
i
,
j
·
P, w
i
,
j and B
i. Based on elliptic curves and the discrete logarithm problem (ECDLP), h
i cannot be calculated without y
i
,
j
·
P and B
i. Therefore, message security is ensured. Furthermore, because h
i belongs to the user alone, nonrepudiation of the message is also ensured.


## 3.1. Bilinear Pairings and Hard Problems

LetG
1 and G
2 denote an additive and a multiplicative group and both of them with prime order q. Let P be generator of G
1 and let e
:
G
1
×
G
1
→
G
2 be a bilinear mapping with the following properties.(1)
Bilinear:(1)
e
=
(
a
P
,
b
P
)
=
e
P
,
P
a
b
e
a
·
P
+
b
·
P
,
P
=
e
a
·
P
,
P
e
b
·
P
,
P
,
h
h
h
h
h
h
h
h
h
h
h
h
h
h
h
∀
P
∈
G
1
,
a
,
b
∈
Z
q
*
.
(2)
Nondegeneracy:∃
P
∈
G
1 such that e
^
P
,
P
≠
1. That is, the mapping does not send all pairs in G
1
×
G
1 to the identity in G
2.
(3)
Computable: there exists an efficient algorithm to computee
P
,
P for all P
∈
G
1.The bilinear mape can be implemented using the Weil [9] and Tate [10] pairings on elliptic curves. We consider the implementation of a Tate pairing on a Miyaji–Nakabayashi–Takano (MNT) curve [11] with embedding degree 6, where G
1 is represented by 161 bits and the order q is represented by 160 bits.The following part will define and specify various relevant mathematical problems [12] which will be applied in the essay subsequently.Bilinear Diffie-Hellman problem:GivenP
,
a
P
,
b
P
,
c
P
∈
G
1, where a
,
b
,
c
∈
Z
q
*, compute e
=
P
,
P
a
b
c.Elliptic curve discrete logarithm problem (ECDLP):Given two elementsP
,
Q
∈
G
1, find an integer a
∈
Z
q
*, such that Q
=
a
P.


## 3.2. ID-Based Encryption

We used ID-based encryption [17] to encrypt and decrypt messages. A private key generator (PKG) chooses a random number g
PKG
∈
Z
q
* as its master key and selects two distinct hash functions, H
1
:
0,1
*
→
G
1 and H
2
:
G
2
→
0,1
*. Given a user i with an identity ID
i
∈
0,1
*, any party can obtain the user’s public key PU
ID
i
=
H
1
(
ID
i
). The PKG sets the user’s private key P
R
I
D
i
=
g
PKG
·
H
1
(
I
D
i
). User i chooses s
I
D
i
∈
Z
q
* as her/his own secret value and sets D
I
D
i
=
s
I
D
i
·
P. In the final step, the PKG publishes the system parameters q
,
G
1
,
G
2
,
e
^
,
P
,
D
I
D
i
,
I
D
i
,
H
1
,
H
2 and withholds s
I
D
i.Encrypt. To encrypt a message M
∈
0,1
* for the user with identity ID
i is as follows.(1)
Choose a random numberr
∈
Z
P
*.
(2)
Set the cipher textC to be(2)
C
=
E
IBC
r
,
M
,
P
U
I
D
i
,
D
I
D
i
=
r
·
P
,
M
⊕
H
2
e
P
U
I
D
i
,
D
I
D
i
r
.Decryption. Let C
=
U
,
V. To decrypt C using the secret value s
I
D
i, compute D
IBC
(
s
I
D
i
,
C
)
=
V
⊕
H
2
(
e
(
s
I
D
i
P
U
I
D
i
,
U
)
)
=
M, where(3)
V
⊕
H
2
e
s
I
D
i
P
U
I
D
i
,
U
=
M
⊕
H
2
e
^
P
U
I
D
i
,
r
D
I
D
i
⊕
H
2
e
^
s
I
D
i
P
U
I
D
i
,
r
P
=
M
⊕
H
2
e
^
P
U
I
D
i
,
r
s
I
D
i
P
⊕
H
2
e
^
s
I
D
i
P
U
I
D
i
,
r
P
=
M
⊕
H
2
e
^
P
U
I
D
i
,
r
s
I
D
i
P
⊕
H
2
e
^
P
U
I
D
i
,
r
s
I
D
i
P
=
M
.


## 3.3. ID-Based Cryptosystem

The advantage of ID-based cryptosystems [17] is that public key certificates are no longer needless, and this possibly causes a saving of space requirements. Besides, it also reduces the key management cost, which is a heavy burden in conventional public key infrastructure (PKI). However, it has a serious drawback, called key escrow problem. PKG is responsible for generating a user’s private key, so it can decrypt any ciphertext or forge any user’s signature on any message.


## 3.4. Message Authentication Based on the Bilinear Hard Problems (BHD) Method

In this study, message signatures and verification are established based on the BDH method. In this scheme, useri selects a random number h
i
∈
Z
q
* as the secret value, calculates the public value (B
i), and then broadcasts B
i to all other users. Notations of the BDH list the notation used in this study. User i broadcasts message M
i
,
j by executing the following steps.(1)
Useri calculates w
i
,
j
=
H
M
i
,
j
∥
T
j
mod
⁡
p.
(2)
Useri calculates h
i
=
y
i
,
j
*
w
i
,
j
+
r
i
,
j, where y
i
,
j represents the quotient and r
i
,
j represents the remainder.
(3)
Useri broadcasts M
i
,
j
,
y
i
,
j
·
P
,
I
D
i
,
T
j
,
e
^
P
,
r
i
,
j
·
P.Other users can then verify the message upon receipt by executing the following steps.(1)
Calculatew
i
,
j
=
H
M
i
,
j
∥
T
j
mod
⁡
p.
(2)
Check whethere
^
w
i
,
j
·
P
,
y
i
,
j
·
P
+
e
^
P
,
r
i
,
j
·
P
=
e
^
P
,
P
h
i
=
?
B
i.If the equality in step(
2
) is satisfied, then this condition verifies that the user i sent the message. During the verification process, other users receive only y
i
,
j
·
P, e
^
P
,
r
i
,
j
·
P, w
i
,
j and B
i. Based on elliptic curves and the discrete logarithm problem (ECDLP), h
i cannot be calculated without y
i
,
j
·
P and B
i. Therefore, message security is ensured. Furthermore, because h
i belongs to the user alone, nonrepudiation of the message is also ensured.


## 4. Message Authentication Scheme

The scheme proposed in this study consists of five parts: (1) system initialization and RSU registration;(
2
) intra-RSU message authentication; (3) inter-RSU message authentication; (4) handoff; and (5) message authentication when RSUs are not available.


### 4.1. System Model

Figure1 shows the system environment used in this study. We assume that the TA is a legal organization and is responsible for the security of the entire network. When there is an attack on the network infrastructure from a malicious node, the TA will broadcast the true identity of the node and take necessary action. We further assume that RSUs are installed on streetlights or traffic signs on main roads and there are no RSUs installed on minor roads. Each vehicle is equipped with an OBU. Communication between the TA and RSUs is via a wired network, whereas communication between OBUs and the TA is via an IEEE 802.11p wireless network. Notation used in this paper lists the notation used in this study.Figure 1
System environment.


### 4.2. System Initialization

Given the bilinear parametersq
,
G
1
,
G
2
,
e
^
,
P as defined in Section 3.1, the TA sets up the system by executing the following steps.(1)
The TA choosesh
I
D
t
,
TA
∈
Z
q
* as its secret value.
(2)
The TA selects three hash functions:H
:
0,1
*
→
Z
q
*, H
1
:
0,1
*
→
G
1, and H
2
:
G
2
→
0,1
*.
(3)
The TA calculatesB
I
D
t
,
TA
=
e
^
h
I
D
t
,
TA
P
,
P as its public value.
(4)
The TA setsD
I
D
t
,
TA
=
h
I
D
t
,
TA
·
P.
(5)
The TA setsP
U
I
D
t
,
TA
=
H
1
I
D
t
,
TA.
(6)
The TA setsP
R
I
D
t
,
TA
=
h
I
D
t
,
TA
H
1
I
D
t
,
TA.The TA broadcasts the parametersI
D
t
,
TA
,
B
I
D
t
,
TA
,
D
I
D
t
,
TA
,
H
,
H
1
,
H
2, while (
P
R
t
,
TA
,
h
I
D
t
,
TA
) remain undisclosed. In addition, the TA sets the related parameters for each RSU by executing the following steps.(1)
The nodeR
R chooses h
I
D
t
,
R
R
∈
Z
q
* as its secret value.
(2)
It calculatesB
I
D
t
,
R
R
=
e
^
h
I
D
t
,
R
R
P
,
P as its public value.
(3)
It setsD
I
D
t
,
R
R
=
h
I
D
t
,
R
R
·
P.
(4)
It setsP
U
I
D
t
,
R
R
=
H
1
I
D
t
,
R
R.The TA sets up the system by executing the following steps.(1)
SetP
R
I
D
t
,
R
R
=
h
I
D
t
,
TA
H
1
I
D
t
,
R
R.
(2)
Calculatew
I
D
t
,
TA
,
j
=
H
(
H
2
(
B
I
D
t
,
R
R
)
∥
I
D
t
,
R
R
∥
T
l
,
I
D
t
,
R
R
)
mod
⁡
p.
(3)
Calculatey
I
D
t
,
TA
,
j
=
h
I
D
t
,
TA
/
w
I
D
t
,
TA
,
j,  e
^
r
I
D
t
,
TA
,
j
·
P
,
P.The RSUR
R broadcasts the parameters (
I
D
t
,
R
R
,
B
I
D
t
,
R
R
,
D
I
D
t
,
R
R
,
e
^
(
r
I
D
t
,
TA
,
j
·
P
,
P
)
,
y
I
D
t
,
TA
P
,
T
l
,
I
D
t
,
R
R
) and does not disclose the parameters (
h
I
D
t
,
R
R
,
P
R
I
D
t
,
R
R
). All nodes can verify the legitimacy of the ID of the RSU by executing the following steps.(1)
Calculatew
I
D
t
,
TA
,
j
=
H
H
2
B
I
D
t
,
R
R
∥
I
D
t
,
R
R
∥
T
l
,
I
D
t
,
R
R
mod
⁡
p.
(2)
CalculateB
I
D
t
,
TA
′
=
e
^
w
I
D
t
,
TA
,
j
·
P
,
y
I
D
t
,
TA
,
j
·
P
+
e
^
P
,
r
I
D
t
,
TA
,
j
·
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(3)
Check ifB
I
D
t
,
TA
=
?
B
I
D
t
,
TA
′The TA generates the related parameters for the vehicle by executing the following steps.(1)
The nodeV chooses h
I
D
i
,
V
∈
Z
q
* as its secret value.
(2)
It calculatesB
I
D
i
,
V
=
e
^
h
I
D
i
,
V
P
,
P as its public value.
(3)
It setsD
I
D
i
,
V
=
h
I
D
i
,
V
·
P.
(4)
It selects an anonymous identityI
D
i, and all users can obtain its public key by computing P
U
I
D
i
,
V
=
H
1
I
D
i
,
V.The TA sets up the system by executing the following steps.(1)
SetP
R
I
D
i
,
V
=
h
I
D
t
,
TA
H
1
I
D
i
,
V.
(2)
Calculatew
I
D
t
,
TA
,
j
=
H
H
2
B
I
D
i
,
V
∥
I
D
i
,
V
∥
T
l
,
I
D
i
,
V
mod
⁡
p.
(3)
Calculatey
I
D
t
,
TA
,
j
=
h
I
D
t
,
TA
/
w
I
D
t
,
TA
,
j,  e
^
r
I
D
i
,
TA
,
j
·
P
,
P.Each vehicle broadcasts the parametersI
D
i
,
V
,
B
I
D
i
,
V
,
D
I
D
i
,
V
,
e
^
r
I
D
t
,
TA
,
j
·
P
,
P
,
y
I
D
t
,
TA
,
j
P
,
T
l
,
I
D
i
,
V and does not disclose the parameters h
I
D
i
,
V
,
P
R
I
D
i
,
V. The TA records the parameters I
D
t
,
V
,
I
D
i
,
V
,
B
I
D
i
,
V
,
D
I
D
i
,
V
,
T
I
D
i
,
V
,
j for each vehicle.Each vehicle or RSU can verify the legitimacy of the vehicle ID by executing the following steps.(1)
Calculatew
I
D
t
,
TA
,
j
=
H
H
2
B
I
D
i
,
V
∥
I
D
i
,
V
∥
T
l
,
I
D
i
,
V
mod
⁡
p.
(2)
CalculateB
I
D
t
,
TA
′
=
e
^
w
I
D
t
,
TA
,
j
·
P
,
y
I
D
t
,
TA
,
j
·
P
+
e
^
P
,
r
I
D
t
,
TA
,
j
·
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(3)
Check ifB
I
D
t
,
TA
=
?
B
I
D
t
,
TA
′. If the equality is satisfied, then the user is legal.


### 4.3. Registration

When a vehicleV
a is within the transmission range of RSU R
1, the vehicle V
a and R
1 will send an ID verification request to each other. After successful verification, RSU R
1 will then generate the short-term parameters for V
a. Vehicle V
a can retain its anonymity and security using the short-term parameters by executing the following steps.(1)
Use the identity-based cryptography (IBC) technique to generatethe common session key for RSUR
1 and vehicle V
a. Vehicle V
a uses its own private key and the public key of RSU R
1 to generate the common session key. The public key of RSU R
1 is calculated from the true ID of RSU R
1. Therefore, vehicle V
a does not require the public key of RSU R
1. The calculation is as follows: (4)
S
K
V
a
-
R
1
=
e
^
P
R
I
D
i
,
V
a
,
P
U
I
D
t
,
R
1
=
e
^
P
U
I
D
i
,
V
a
,
h
I
D
t
,
TA
P
U
I
D
t
,
R
1
=
S
K
R
1
-
V
a
.
Because the TA generates the private keys for both RSUR
1 and vehicle V
a, the common session keys generated from RSU R
1 and vehicle V
a are the same. Therefore, RSU R
1 and vehicle V
a can communicate with each other privately.
(2)
V
a generates the short-term parameters I
D
p
,
V
t, B
I
D
p
,
V
t, and D
I
D
p
,
V
t and uses symmetric encryption to encrypt the common session key (S
K
V
a
-
R
1) as a security key. The encryption is supplemented by the plain-text parameters I
D
i
,
V
a
,
B
I
D
i
,
V
a
,
e
^
r
I
D
t
,
TA
,
j
·
P
,
P
,
y
I
D
t
,
TA
,
j
P
,
T
l
,
I
D
i
,
V
a. The calculation is as follows:(5)
C
=
SE
I
D
p
,
V
t
∥
B
I
D
p
,
V
t
∥
D
I
D
p
,
V
t
∥
T
j
S
K
V
a
-
R
1
.
VehicleV
a sends the message C
∥
I
D
i
,
V
a
∥
B
I
D
i
,
V
a
∥
e
^
r
I
D
t
,
TA
,
j
·
P
,
P
∥
y
I
D
t
,
TA
,
j
P
∥
T
l
,
I
D
i
,
V
a to R
1.
(3)
When RSUR
1 receives the message, R
1 first verifies whether the parameters of vehicle V
a are within the valid limits through the following steps.
(3.1)
Calculatew
I
D
t
,
TA
,
j
=
H
H
2
B
I
D
i
,
V
a
∥
I
D
i
,
V
a
∥
T
l
,
I
D
i
,
V
a
mod
⁡
p.
(3.2)
CalculateB
I
D
t
,
TA
′
=
e
^
w
I
D
t
,
TA
,
j
·
P
,
y
I
D
t
,
TA
,
j
·
P
+
e
^
P
,
r
I
D
t
,
TA
,
j
·
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(3.3)
Check ifB
I
D
t
,
TA
=
?
B
I
D
t
,
TA
′. If the equality is satisfied, then the user is legal.
(4)
To decrypt the encrypted message, RSUR
1 first calculates the common session key shared with vehicle V
a. Then, RSU R
1 uses the common session key to decrypt the message. The calculation is as follows:(6)
S
K
R
1
-
V
a
=
e
^
P
R
I
D
t
,
R
1
,
P
U
I
D
i
,
V
a
=
e
^
P
U
I
D
t
,
R
1
,
h
I
D
t
,
TA
P
U
I
D
i
,
V
a
=
S
K
V
a
-
R
1
.(5)
RSUR
1 calculates the private key, the common secret key, and the signature of V
a. The calculations are as follows.
(5.1)
R
1 calculates P
R
I
D
p
,
V
a as its private key.
(5.2)
R
1 chooses C
I
D
p
,
V
a
∈
Z
q
* as its common secret key.
(5.3)
R
1 calculates y
I
D
t
,
R
1
,
j
=
h
I
D
t
,
R
1
/
w
I
D
t
,
R
1
,
j, e
^
r
I
D
t
,
R
1
,
j
·
P
,
P, w
I
D
t
,
R
2
,
j
=
H
(
H
2
(
B
I
D
p
,
V
a
)
∥
I
D
p
,
V
a
∥
T
l
,
I
D
p
,
V
a
)
mod
⁡
p.
(6)
RSUR
1 encrypts the parameters P
R
I
D
p
,
V
a
,
C
I
D
p
,
V
a using the common session key. The calculation is as follows:(7)
C
=
SE
P
R
I
D
p
,
V
a
∥
C
I
D
p
,
V
a
∥
T
j
S
K
R
1
-
V
a
.
RSUR
1 sends the message C
∥
I
D
i
,
V
a
∥
e
^
r
I
D
t
,
R
1
,
j
·
P
,
P
∥
y
I
D
t
,
R
1
,
j
P
∥
T
l
,
I
D
p
,
V
a to vehicle V
a.
(7)
When vehicleV
a receives the message, the vehicle uses the common session key to decrypt the message.
(8)
R
1 records (
I
D
i
,
V
a
,
I
D
p
,
V
a
,
B
I
D
p
,
V
a
,
D
I
D
p
,
V
a
,
C
I
D
t
,
R
1
,
j
,
T
l
,
I
D
p
,
V
a
) and publishes (
I
D
p
,
V
a
,
B
I
D
p
,
V
a
,
D
I
D
p
,
V
a
,
e
^
r
I
D
t
,
R
1
,
j
·
P
,
P
,
y
I
D
t
,
R
1
,
j
P
,
T
l
,
I
D
p
,
V
a
) to all vehicles in its domain.To improve the efficiency of the handoff process, RSUR
1 generates a common secret key for vehicle V
a and each RSU. RSU R
1 uses a one-way hash chain [13] to generate m keys k
I
D
p
,
V
a
,
R
m
,
k
I
D
p
,
V
a
,
R
m
-
1
,
…
,
k
I
D
p
,
V
a
,
R
1. The method for generating the keys is as follows:(8)
F
C
I
D
p
,
V
a
∥
P
R
I
D
p
,
V
a
=
k
I
D
p
,
V
a
,
R
m
,
F
k
I
D
p
,
V
a
,
R
m
∥
P
R
I
D
p
,
V
a
=
k
I
D
p
,
V
a
,
R
m
-
1
,
…
,
F
k
I
D
p
,
V
a
,
R
2
∥
P
R
I
D
p
,
V
a
=
k
I
D
p
,
V
a
,
R
1
.RSU R
1 uses a one-way hash chain [13] to generate m anonymous IDs I
D
p
,
V
a
′
,
I
D
p
,
V
a
′
′
,
…
,
I
D
p
,
V
a
′
′
′. The method for generating the IDs is as follows: (9)
F
I
D
p
,
V
a
∥
P
R
I
D
p
,
V
a
=
I
D
p
,
V
a
′
,
F
I
D
p
,
V
a
′
∥
P
R
I
D
p
,
V
a
=
I
D
p
,
V
a
′
′
,
…
,
F
I
D
p
,
V
a
′
′
∥
P
R
I
D
p
,
V
a
=
I
D
p
,
V
a
′
′
′
.Each RSU has two tables, an RID-key table and an SID-key table. The RID-key table is used to store the related parameters generated by RSU (Table1). RSU R
1 uses the common session key that it shares with each RSU to encrypt the common secret key that vehicle V
a has with each RSU and the anonymous ID. RSU R
1 then sends the encrypted message to other RSUs. When another RSU receives the encrypted message, that RSU first uses the common session key that it shares with RSU R
1 to decrypt the message and then stores the parameters for vehicle V
a in the table (Table 2). Because vehicle V
a has the related parameters P
R
I
D
p
,
V
a
,
I
D
p
,
V
a
,
C
I
D
p
,
V
a, it can generate a common secret key shared with each RSU and an anonymous ID on its own. The parameters are stored in the table (Table 3). The parameters for vehicle V
a do not permit any one RSU to obtain the parameters that vehicle V
a shares with other RSUs. Because other RSUs cannot obtain the private key and the common secret key of vehicle V
a, the security of vehicle V
a is ensured.Table 1
RID-key table.
ID of RSU
New ID of vehicle (handoff)
ID of vehicle (RSU generate)
ID of vehicle (TA generate)
Common secret key
Expire time of common secret key
BDH value of vehicle
Data key of vehicle
Expire time of key
R
1
ID
p
,
V
a
′
I
D
p
,
V
a
I
D
i
,
V
a
k
I
D
p
,
V
a
,
R
1
T
l
,
ID
p
,
V
a
′
B
I
D
p
,
V
a
D
I
D
p
,
V
a
T
l
,
I
D
p
,
V
a
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
R
m
ID
p
,
V
a
′
′
I
D
p
,
V
a
I
D
i
,
V
a
k
I
D
p
,
V
a
,
R
m
T
l
,
ID
p
,
V
a
′
′
non
non
non
R
1
ID
p
,
V
b
′
I
D
p
,
V
b
I
D
i
,
V
b
k
I
D
p
,
V
b
,
R
1
T
l
,
ID
p
,
V
b
′
B
I
D
p
,
V
b
D
I
D
p
,
V
b
T
l
,
I
D
p
,
V
b
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
R
m
-
1
ID
p
,
V
b
′
′
I
D
p
,
V
b
I
D
i
,
V
b
k
I
D
p
,
V
b
,
R
m
T
l
,
ID
p
,
V
b
′
′
non
non
non
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮Table 2
SID-key table.
New ID of vehicle (handoff)
Informed by RSU
Common secret key
Expire time of common secret key
BDH value of vehicle
Data key of vehicle
Expire time of key
ID
p
,
V
t
′
R
7
k
I
D
p
,
V
t
,
R
1
T
l
,
ID
p
,
V
t
′
non
non
non
⋮
⋮
⋮
⋮
⋮
⋮
⋮
ID
p
,
V
t
-
7
′
′
R
m
k
I
D
p
,
V
t
-
7
,
R
1
T
l
,
ID
p
,
V
t
-
7
′
′
non
non
non
ID
p
,
V
c
′
R
m
-
2
k
I
D
p
,
V
c
,
R
1
T
l
,
ID
p
,
V
c
′
B
I
D
p
,
V
c
D
I
D
p
,
V
c
T
l
,
I
D
p
,
V
c
⋮
⋮
⋮
⋮
⋮
⋮
⋮
ID
p
,
V
d
′
′
R
7
k
I
D
p
,
V
d
,
R
1
T
l
,
ID
p
,
V
d
′
′
B
I
D
p
,
V
d
D
I
D
p
,
V
d
T
l
,
I
D
p
,
V
d
⋮
⋮
⋮
⋮
⋮
⋮
⋮Table 3
SID issue table.
ID of RSU
New ID of vehicle (handoff)
ID of vehicle (RSU generate)
ID of vehicle (TA generate)
Common secret key
Private key (RSU)
Secret value
Expire time of key
R
1
ID
p
,
V
a
′
I
D
p
,
V
a
I
D
i
,
V
a
k
I
D
p
,
V
a
,
R
1
P
R
I
D
p
,
V
a
h
I
D
p
,
V
a
T
l
,
I
D
p
,
V
a
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
R
m
ID
p
,
V
a
′
′
I
D
p
,
V
a
I
D
i
,
V
a
k
I
D
p
,
V
a
,
R
m
non
non
non


### 4.4. Intra-RSU Message Authentication

VehicleV
a broadcasts messages to other vehicles within the transmission range of an RSU. The calculations are as follows.(1)
VehicleV
a uses the BDH method to authorize a message signature. The calculations are as follows.
(1.1)
VehicleV
a calculates w
I
D
p
,
V
a
,
j
=
H
M
I
D
p
,
V
a
,
j
∥
I
D
p
,
V
a
∥
T
j
mod
⁡
p.
(1.2)
VehicleV
a calculates y
I
D
p
,
V
a
,
j
=
h
I
D
p
,
V
a
,
j
/
w
I
D
p
,
V
a
,
j, e
^
r
I
D
p
,
V
a
,
j
·
P
,
P°.
(1.3)
VehicleV
a broadcasts the message M
I
D
p
,
V
a
,
j
,
B
I
D
p
,
V
a
,
D
I
D
p
,
V
a
,
e
^
r
I
D
p
,
V
a
,
j
·
P
,
P
,
y
I
D
p
,
V
a
,
j
P
,
I
D
p
,
V
a
,
T
j to other vehicles within range.
(2)
When other vehicles receive the message, they can verify the authenticity of the message. The calculations are as follows.
(2.1)
Calculatew
I
D
p
,
V
a
,
j
=
H
M
I
D
p
,
V
a
,
j
∥
I
D
p
,
V
a
∥
T
j
mod
⁡
p°.
(2.2)
CalculateB
I
D
p
,
V
a
′
=
e
^
w
I
D
p
,
V
a
,
j
·
P
,
y
I
D
p
,
V
a
,
j
·
P
+
e
^
r
I
D
p
,
V
a
,
j
·
P
,
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(2.3)
Check ifB
I
D
p
,
V
a
=
?
B
I
D
p
,
V
a
′. If the equality is satisfied, then vehicle V
a sent the message.Assuming that two vehicles within the transmission range of a given RSU want to send private messages to each other (Figure1), vehicle V
a and vehicle V
b will calculate their common key. The calculation is as follows:(10)
S
K
V
a
-
V
b
=
e
^
P
R
I
D
p
,
V
a
,
P
U
I
D
p
,
V
b
=
e
^
P
U
I
D
p
,
V
a
,
h
I
D
t
,
R
R
P
U
I
D
p
,
V
b
=
S
K
V
b
-
V
a
.Then, vehicleV
a uses the common session key (S
K
V
a
-
V
b) to first encrypt the message and then send it to vehicle V
a. When V
b receives the encrypted message, the vehicle uses the common session key (S
K
V
b
-
V
a) to decrypt the message and then obtain the contents of the message. The benefits of using IBC lie in the fact that the other vehicle’s public key can be easily calculated based on its ID and that the common session key can be calculated based on the other vehicle’s public key and its own private key. Conversely, the other vehicle can also calculate the common session key because the secret value of the common session key is the same.


### 4.5. Inter-RSU Message Authentication

Assuming that vehicleV
a wants to broadcast a message within the transmission ranges of several RSUs and uses the BDH signature to ensure the security of the message, vehicle V
a will first send the parameters M
I
D
p
,
V
a
,
j
,
e
^
r
I
D
p
,
V
a
,
j
·
P
,
P
,
y
I
D
p
,
V
a
,
j
P
,
B
I
D
p
,
V
a, I
D
p
,
V
a
,
y
I
D
t
,
R
1
,
j
·
P
,
e
^
r
I
D
t
,
R
1
,
j
·
P
,
P
·
T
l
,
I
D
p
,
V
t
,
T
j to nearby RSUs, and then the RSUs will relay the message to other vehicles. Then, other vehicles will first verify the legitimacy of vehicle V
a by calculating w
I
D
t
,
R
1
,
j
=
H
H
2
B
I
D
p
,
V
a
∥
I
D
p
,
V
a
∥
T
l
,
I
D
p
,
V
a
mod
⁡
p and then calculating e
^
w
I
D
t
,
R
1
,
j
P
,
y
I
D
t
,
R
1
,
j
P
+
e
^
r
I
D
t
,
R
1
,
j
P
,
P
=
B
I
D
I
D
t
,
R
1
′. If it is the case, then it proves that vehicle V
a is the legitimate user of RSU R
1.Other vehicles will verify the authenticity of the message from vehicleV
a by first calculating w
I
D
p
,
V
a
,
j
=
H
M
I
D
p
,
V
a
,
j
∥
I
D
p
,
V
a
∥
T
j
mod
⁡
p and then calculating e
^
w
I
D
p
,
V
a
,
j
P
,
y
I
D
p
,
V
a
,
j
P
+
e
^
r
I
D
p
,
V
a
,
j
P
,
P
=
B
I
D
p
,
V
a
,
j
′. If it is the case, then the message was sent from vehicle V
a.In private communications, the secret private key value of each vehicle is different because there are multiple RSUs. Therefore, an ID-based encryption method should be used. Let vehicleV
a and vehicle V
c calculate their common session keys. Assuming that vehicle V
a wants to privately communicate with vehicle V
c, which is within the transmission range of a different RSU, vehicle V
c will first encrypt the message. Vehicle V
a will then calculate the public key using the anonymous ID of vehicle V
c. Upon obtaining the data key for vehicle V
c, vehicle V
a will encrypt the message using the public key and the data key of vehicle V
c. The calculation is as follows:(11)
C
=
E
IBC
r
,
M
,
P
U
I
D
p
,
V
c
,
D
I
D
p
,
V
c
=
r
·
P
,
M
⊕
H
2
e
P
U
I
D
p
,
V
c
,
D
I
D
p
,
V
c
r
,
M
=
e
^
P
R
I
D
p
,
V
a
,
P
U
I
D
p
,
V
c
.Subsequently, vehicleV
c uses the private key to decrypt the message. Equation (2) shows the decryption method. Vehicle V
c then uses ID-based encryption to generate an encrypted message for vehicle V
a. The calculation is as follows:(12)
C
=
E
IBC
r
,
M
,
P
U
I
D
p
,
V
a
,
D
I
D
p
,
V
a
=
r
·
P
,
M
⊕
H
2
e
P
U
I
D
p
,
V
a
,
D
I
D
p
,
V
a
r
,
M
=
e
^
P
R
I
D
p
,
V
a
,
P
U
I
D
p
,
V
c
+
e
^
P
R
I
D
p
,
V
c
,
P
U
I
D
p
,
V
a
.VehicleV
a uses the private key to decrypt the message. Equation (2) shows the decryption method. When vehicle V
a receives thecommon session key that it shares with vehicle V
c, V
a can communicate with vehicle V
c privately. The common session key is(13)
S
K
V
a
-
V
c
=
e
^
P
R
I
D
p
,
V
a
,
P
U
I
D
p
,
V
c
+
e
^
P
R
I
D
p
,
V
c
,
P
U
I
D
p
,
V
a
=
S
K
V
c
-
V
a
.


### 4.6. Handoff Problem

When vehicleV
a comes within the transmission range of the next RSU (R
2), vehicle V
a will first inquire for the common secret key that it shares with RSU R
2 in Table 3 and then initiate the handoff. The calculation is as follows.(1)
VehicleV
a first generates short-term parameters B
I
D
p
,
V
t, D
I
D
p
,
V
t and uses the common secret key (k
I
D
p
,
V
a
,
R
2) to encrypt the parameters. Then, vehicle V
a sends the parameters and its anonymous ID to RSU R
2.
(2)
RSUR
2 inquires for the common secret key and the time of validity that it shares with vehicle V
a in Table 2 based on the anonymous ID of vehicle V
a. If the time of validity has expired, then vehicle V
a will reregister with RSU (Section 4.2). If the time of validity has not expired, R
2 will generate the short-term parameters for vehicle V
a. The calculations are as follows.
(2.1)
R
2 calculates P
R
I
D
p
,
V
a as its private key.
(2.2)
R
2 calculates w
I
D
t
,
R
2
,
j
=
H
H
2
B
I
D
p
,
V
a
∥
I
D
p
,
V
a
∥
T
l
,
I
D
p
,
V
a
mod
⁡
p.
(2.3)
R
2 calculates y
I
D
t
,
R
2
,
j
=
h
I
D
t
,
R
2
/
w
I
D
t
,
R
2
,
j, e
^
r
I
D
t
,
R
2
,
j
·
P
,
P.
(3)
RSUR
1 uses the common secret key to encrypt the parameters P
R
I
D
p
,
V
a
,
C
I
D
p
,
V
a. The calculation is as follows:(14)
C
=
SE
P
R
I
D
p
,
V
a
∥
C
I
D
p
,
V
a
∥
T
j
S
K
R
1
-
V
a
.
RSUR
1 sends the message C
∥
I
D
i
,
V
a
∥
e
^
r
I
D
t
,
R
1
,
j
·
P
,
P
∥
y
I
D
t
,
R
1
,
j
P
∥
T
l
,
I
D
p
,
V
a to vehicle V
a.
(4)
When vehicleV
a receives the message, the vehicle uses the common secret key to decrypt the message.
(5)
R
1 records (
I
D
i
,
V
a
,
I
D
p
,
V
a
,
B
I
D
p
,
V
a
,
D
I
D
p
,
V
a
,
C
I
D
t
,
R
1
,
j, T
l
,
I
D
p
,
V
a
) and publishes (
I
D
p
,
V
a
,
B
I
D
p
,
V
a
,
D
I
D
p
,
V
a
,
e
^
r
I
D
t
,
R
1
,
j
·
P
,
P
,
y
I
D
t
,
R
1
,
j
P
,
T
l
,
I
D
p
,
V
a
) to all vehicles in its domain.


### 4.7. Message Authentication When RSUs Are Not Available

When RSUs are not available, vehicles can broadcast messages and conduct private communications using the parameters generated by the TA by executing the following steps.(1)
VehicleV
d uses the BDH signature method to authorize a message signature. The calculations are as follows.
(1.1)
VehicleV
d calculates w
I
D
i
,
V
d
,
j
=
H
M
I
D
i
,
V
d
,
j
∥
I
D
i
,
V
d
∥
T
j
mod
⁡
p.
(1.2)
VehicleV
d calculates y
I
D
i
,
V
d
,
j
=
h
I
D
i
,
V
d
,
j
/
w
I
D
i
,
V
d
,
j, e
^
r
I
D
i
,
V
d
,
j
·
P
,
P.
(1.3)
VehicleV
d broadcasts the message M
I
D
i
,
V
d
,
j
,
B
I
D
i
,
V
d
,
D
I
D
i
,
V
d, e
^
r
I
D
i
,
V
d
,
j
·
P
,
P
,
y
I
D
i
,
V
d
,
j
P
,
I
D
i
,
V
d
,
T
j, e
^
r
I
D
t
,
TA
,
j
·
P
,
P
,
y
I
D
t
,
TA
,
j
P to other vehicles.
(2)
Other vehicles first verify the ID of vehicleV
d. The calculations are as follows.
(2.1)
Calculatew
I
D
t
,
TA
,
j
=
H
H
2
B
I
D
i
,
V
d
∥
I
D
i
,
V
d
∥
T
l
,
I
D
i
,
V
d
mod
⁡
p.
(2.2)
CalculateB
I
D
t
,
TA
′
=
e
^
w
I
D
t
,
TA
,
j
·
P
,
y
I
D
t
,
TA
,
j
·
P
+
e
^
P
,
r
I
D
t
,
TA
,
j
·
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(2.3)
Check ifB
I
D
t
,
TA
=
?
B
I
D
t
,
TA
′. If the equality is satisfied, then the user is legal.
(3)
Other vehicles then verify the authenticity of the message. The calculations are as follows.
(3.1)
Calculatew
I
D
i
,
V
d
,
j
=
H
M
I
D
i
,
V
d
,
j
∥
I
D
i
,
V
d
∥
T
j
mod
⁡
p.
(3.2)
CalculateB
I
D
i
,
V
d
′
=
e
^
w
I
D
i
,
V
d
,
j
·
P
,
y
I
D
i
,
V
d
,
j
·
P
+
e
^
r
I
D
i
,
V
d
,
j
·
P
,
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(3.3)
Check ifB
I
D
i
,
V
d
=
?
B
I
D
i
,
V
d
′. Satisfaction of the equality is proof that vehicle V
d sent the message.Assuming that two vehicles within the transmission range of the same RSU want to communicate privately with each other (Figure1), vehicle V
d and vehicle V
e will calculate their common key. The calculation is as follows:(15)
S
K
V
d
-
V
e
=
e
^
P
R
I
D
i
,
V
d
,
P
U
I
D
i
,
V
e
=
e
^
P
U
I
D
i
,
V
d
,
h
I
D
t
,
TA
P
U
I
D
i
,
V
e
=
S
K
V
e
-
V
d
.Subsequently, vehicleV
d uses the common session key (S
K
V
d
-
V
e) to encrypt the message and send the message to vehicle V
e. When vehicle V
e receives the encrypted message, it uses the common session key (S
K
V
e
-
V
d) to decrypt the message and obtain the contents of the message.


## 4.1. System Model

Figure1 shows the system environment used in this study. We assume that the TA is a legal organization and is responsible for the security of the entire network. When there is an attack on the network infrastructure from a malicious node, the TA will broadcast the true identity of the node and take necessary action. We further assume that RSUs are installed on streetlights or traffic signs on main roads and there are no RSUs installed on minor roads. Each vehicle is equipped with an OBU. Communication between the TA and RSUs is via a wired network, whereas communication between OBUs and the TA is via an IEEE 802.11p wireless network. Notation used in this paper lists the notation used in this study.Figure 1
System environment.


## 4.2. System Initialization

Given the bilinear parametersq
,
G
1
,
G
2
,
e
^
,
P as defined in Section 3.1, the TA sets up the system by executing the following steps.(1)
The TA choosesh
I
D
t
,
TA
∈
Z
q
* as its secret value.
(2)
The TA selects three hash functions:H
:
0,1
*
→
Z
q
*, H
1
:
0,1
*
→
G
1, and H
2
:
G
2
→
0,1
*.
(3)
The TA calculatesB
I
D
t
,
TA
=
e
^
h
I
D
t
,
TA
P
,
P as its public value.
(4)
The TA setsD
I
D
t
,
TA
=
h
I
D
t
,
TA
·
P.
(5)
The TA setsP
U
I
D
t
,
TA
=
H
1
I
D
t
,
TA.
(6)
The TA setsP
R
I
D
t
,
TA
=
h
I
D
t
,
TA
H
1
I
D
t
,
TA.The TA broadcasts the parametersI
D
t
,
TA
,
B
I
D
t
,
TA
,
D
I
D
t
,
TA
,
H
,
H
1
,
H
2, while (
P
R
t
,
TA
,
h
I
D
t
,
TA
) remain undisclosed. In addition, the TA sets the related parameters for each RSU by executing the following steps.(1)
The nodeR
R chooses h
I
D
t
,
R
R
∈
Z
q
* as its secret value.
(2)
It calculatesB
I
D
t
,
R
R
=
e
^
h
I
D
t
,
R
R
P
,
P as its public value.
(3)
It setsD
I
D
t
,
R
R
=
h
I
D
t
,
R
R
·
P.
(4)
It setsP
U
I
D
t
,
R
R
=
H
1
I
D
t
,
R
R.The TA sets up the system by executing the following steps.(1)
SetP
R
I
D
t
,
R
R
=
h
I
D
t
,
TA
H
1
I
D
t
,
R
R.
(2)
Calculatew
I
D
t
,
TA
,
j
=
H
(
H
2
(
B
I
D
t
,
R
R
)
∥
I
D
t
,
R
R
∥
T
l
,
I
D
t
,
R
R
)
mod
⁡
p.
(3)
Calculatey
I
D
t
,
TA
,
j
=
h
I
D
t
,
TA
/
w
I
D
t
,
TA
,
j,  e
^
r
I
D
t
,
TA
,
j
·
P
,
P.The RSUR
R broadcasts the parameters (
I
D
t
,
R
R
,
B
I
D
t
,
R
R
,
D
I
D
t
,
R
R
,
e
^
(
r
I
D
t
,
TA
,
j
·
P
,
P
)
,
y
I
D
t
,
TA
P
,
T
l
,
I
D
t
,
R
R
) and does not disclose the parameters (
h
I
D
t
,
R
R
,
P
R
I
D
t
,
R
R
). All nodes can verify the legitimacy of the ID of the RSU by executing the following steps.(1)
Calculatew
I
D
t
,
TA
,
j
=
H
H
2
B
I
D
t
,
R
R
∥
I
D
t
,
R
R
∥
T
l
,
I
D
t
,
R
R
mod
⁡
p.
(2)
CalculateB
I
D
t
,
TA
′
=
e
^
w
I
D
t
,
TA
,
j
·
P
,
y
I
D
t
,
TA
,
j
·
P
+
e
^
P
,
r
I
D
t
,
TA
,
j
·
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(3)
Check ifB
I
D
t
,
TA
=
?
B
I
D
t
,
TA
′The TA generates the related parameters for the vehicle by executing the following steps.(1)
The nodeV chooses h
I
D
i
,
V
∈
Z
q
* as its secret value.
(2)
It calculatesB
I
D
i
,
V
=
e
^
h
I
D
i
,
V
P
,
P as its public value.
(3)
It setsD
I
D
i
,
V
=
h
I
D
i
,
V
·
P.
(4)
It selects an anonymous identityI
D
i, and all users can obtain its public key by computing P
U
I
D
i
,
V
=
H
1
I
D
i
,
V.The TA sets up the system by executing the following steps.(1)
SetP
R
I
D
i
,
V
=
h
I
D
t
,
TA
H
1
I
D
i
,
V.
(2)
Calculatew
I
D
t
,
TA
,
j
=
H
H
2
B
I
D
i
,
V
∥
I
D
i
,
V
∥
T
l
,
I
D
i
,
V
mod
⁡
p.
(3)
Calculatey
I
D
t
,
TA
,
j
=
h
I
D
t
,
TA
/
w
I
D
t
,
TA
,
j,  e
^
r
I
D
i
,
TA
,
j
·
P
,
P.Each vehicle broadcasts the parametersI
D
i
,
V
,
B
I
D
i
,
V
,
D
I
D
i
,
V
,
e
^
r
I
D
t
,
TA
,
j
·
P
,
P
,
y
I
D
t
,
TA
,
j
P
,
T
l
,
I
D
i
,
V and does not disclose the parameters h
I
D
i
,
V
,
P
R
I
D
i
,
V. The TA records the parameters I
D
t
,
V
,
I
D
i
,
V
,
B
I
D
i
,
V
,
D
I
D
i
,
V
,
T
I
D
i
,
V
,
j for each vehicle.Each vehicle or RSU can verify the legitimacy of the vehicle ID by executing the following steps.(1)
Calculatew
I
D
t
,
TA
,
j
=
H
H
2
B
I
D
i
,
V
∥
I
D
i
,
V
∥
T
l
,
I
D
i
,
V
mod
⁡
p.
(2)
CalculateB
I
D
t
,
TA
′
=
e
^
w
I
D
t
,
TA
,
j
·
P
,
y
I
D
t
,
TA
,
j
·
P
+
e
^
P
,
r
I
D
t
,
TA
,
j
·
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(3)
Check ifB
I
D
t
,
TA
=
?
B
I
D
t
,
TA
′. If the equality is satisfied, then the user is legal.


## 4.3. Registration

When a vehicleV
a is within the transmission range of RSU R
1, the vehicle V
a and R
1 will send an ID verification request to each other. After successful verification, RSU R
1 will then generate the short-term parameters for V
a. Vehicle V
a can retain its anonymity and security using the short-term parameters by executing the following steps.(1)
Use the identity-based cryptography (IBC) technique to generatethe common session key for RSUR
1 and vehicle V
a. Vehicle V
a uses its own private key and the public key of RSU R
1 to generate the common session key. The public key of RSU R
1 is calculated from the true ID of RSU R
1. Therefore, vehicle V
a does not require the public key of RSU R
1. The calculation is as follows: (4)
S
K
V
a
-
R
1
=
e
^
P
R
I
D
i
,
V
a
,
P
U
I
D
t
,
R
1
=
e
^
P
U
I
D
i
,
V
a
,
h
I
D
t
,
TA
P
U
I
D
t
,
R
1
=
S
K
R
1
-
V
a
.
Because the TA generates the private keys for both RSUR
1 and vehicle V
a, the common session keys generated from RSU R
1 and vehicle V
a are the same. Therefore, RSU R
1 and vehicle V
a can communicate with each other privately.
(2)
V
a generates the short-term parameters I
D
p
,
V
t, B
I
D
p
,
V
t, and D
I
D
p
,
V
t and uses symmetric encryption to encrypt the common session key (S
K
V
a
-
R
1) as a security key. The encryption is supplemented by the plain-text parameters I
D
i
,
V
a
,
B
I
D
i
,
V
a
,
e
^
r
I
D
t
,
TA
,
j
·
P
,
P
,
y
I
D
t
,
TA
,
j
P
,
T
l
,
I
D
i
,
V
a. The calculation is as follows:(5)
C
=
SE
I
D
p
,
V
t
∥
B
I
D
p
,
V
t
∥
D
I
D
p
,
V
t
∥
T
j
S
K
V
a
-
R
1
.
VehicleV
a sends the message C
∥
I
D
i
,
V
a
∥
B
I
D
i
,
V
a
∥
e
^
r
I
D
t
,
TA
,
j
·
P
,
P
∥
y
I
D
t
,
TA
,
j
P
∥
T
l
,
I
D
i
,
V
a to R
1.
(3)
When RSUR
1 receives the message, R
1 first verifies whether the parameters of vehicle V
a are within the valid limits through the following steps.
(3.1)
Calculatew
I
D
t
,
TA
,
j
=
H
H
2
B
I
D
i
,
V
a
∥
I
D
i
,
V
a
∥
T
l
,
I
D
i
,
V
a
mod
⁡
p.
(3.2)
CalculateB
I
D
t
,
TA
′
=
e
^
w
I
D
t
,
TA
,
j
·
P
,
y
I
D
t
,
TA
,
j
·
P
+
e
^
P
,
r
I
D
t
,
TA
,
j
·
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(3.3)
Check ifB
I
D
t
,
TA
=
?
B
I
D
t
,
TA
′. If the equality is satisfied, then the user is legal.
(4)
To decrypt the encrypted message, RSUR
1 first calculates the common session key shared with vehicle V
a. Then, RSU R
1 uses the common session key to decrypt the message. The calculation is as follows:(6)
S
K
R
1
-
V
a
=
e
^
P
R
I
D
t
,
R
1
,
P
U
I
D
i
,
V
a
=
e
^
P
U
I
D
t
,
R
1
,
h
I
D
t
,
TA
P
U
I
D
i
,
V
a
=
S
K
V
a
-
R
1
.(5)
RSUR
1 calculates the private key, the common secret key, and the signature of V
a. The calculations are as follows.
(5.1)
R
1 calculates P
R
I
D
p
,
V
a as its private key.
(5.2)
R
1 chooses C
I
D
p
,
V
a
∈
Z
q
* as its common secret key.
(5.3)
R
1 calculates y
I
D
t
,
R
1
,
j
=
h
I
D
t
,
R
1
/
w
I
D
t
,
R
1
,
j, e
^
r
I
D
t
,
R
1
,
j
·
P
,
P, w
I
D
t
,
R
2
,
j
=
H
(
H
2
(
B
I
D
p
,
V
a
)
∥
I
D
p
,
V
a
∥
T
l
,
I
D
p
,
V
a
)
mod
⁡
p.
(6)
RSUR
1 encrypts the parameters P
R
I
D
p
,
V
a
,
C
I
D
p
,
V
a using the common session key. The calculation is as follows:(7)
C
=
SE
P
R
I
D
p
,
V
a
∥
C
I
D
p
,
V
a
∥
T
j
S
K
R
1
-
V
a
.
RSUR
1 sends the message C
∥
I
D
i
,
V
a
∥
e
^
r
I
D
t
,
R
1
,
j
·
P
,
P
∥
y
I
D
t
,
R
1
,
j
P
∥
T
l
,
I
D
p
,
V
a to vehicle V
a.
(7)
When vehicleV
a receives the message, the vehicle uses the common session key to decrypt the message.
(8)
R
1 records (
I
D
i
,
V
a
,
I
D
p
,
V
a
,
B
I
D
p
,
V
a
,
D
I
D
p
,
V
a
,
C
I
D
t
,
R
1
,
j
,
T
l
,
I
D
p
,
V
a
) and publishes (
I
D
p
,
V
a
,
B
I
D
p
,
V
a
,
D
I
D
p
,
V
a
,
e
^
r
I
D
t
,
R
1
,
j
·
P
,
P
,
y
I
D
t
,
R
1
,
j
P
,
T
l
,
I
D
p
,
V
a
) to all vehicles in its domain.To improve the efficiency of the handoff process, RSUR
1 generates a common secret key for vehicle V
a and each RSU. RSU R
1 uses a one-way hash chain [13] to generate m keys k
I
D
p
,
V
a
,
R
m
,
k
I
D
p
,
V
a
,
R
m
-
1
,
…
,
k
I
D
p
,
V
a
,
R
1. The method for generating the keys is as follows:(8)
F
C
I
D
p
,
V
a
∥
P
R
I
D
p
,
V
a
=
k
I
D
p
,
V
a
,
R
m
,
F
k
I
D
p
,
V
a
,
R
m
∥
P
R
I
D
p
,
V
a
=
k
I
D
p
,
V
a
,
R
m
-
1
,
…
,
F
k
I
D
p
,
V
a
,
R
2
∥
P
R
I
D
p
,
V
a
=
k
I
D
p
,
V
a
,
R
1
.RSU R
1 uses a one-way hash chain [13] to generate m anonymous IDs I
D
p
,
V
a
′
,
I
D
p
,
V
a
′
′
,
…
,
I
D
p
,
V
a
′
′
′. The method for generating the IDs is as follows: (9)
F
I
D
p
,
V
a
∥
P
R
I
D
p
,
V
a
=
I
D
p
,
V
a
′
,
F
I
D
p
,
V
a
′
∥
P
R
I
D
p
,
V
a
=
I
D
p
,
V
a
′
′
,
…
,
F
I
D
p
,
V
a
′
′
∥
P
R
I
D
p
,
V
a
=
I
D
p
,
V
a
′
′
′
.Each RSU has two tables, an RID-key table and an SID-key table. The RID-key table is used to store the related parameters generated by RSU (Table1). RSU R
1 uses the common session key that it shares with each RSU to encrypt the common secret key that vehicle V
a has with each RSU and the anonymous ID. RSU R
1 then sends the encrypted message to other RSUs. When another RSU receives the encrypted message, that RSU first uses the common session key that it shares with RSU R
1 to decrypt the message and then stores the parameters for vehicle V
a in the table (Table 2). Because vehicle V
a has the related parameters P
R
I
D
p
,
V
a
,
I
D
p
,
V
a
,
C
I
D
p
,
V
a, it can generate a common secret key shared with each RSU and an anonymous ID on its own. The parameters are stored in the table (Table 3). The parameters for vehicle V
a do not permit any one RSU to obtain the parameters that vehicle V
a shares with other RSUs. Because other RSUs cannot obtain the private key and the common secret key of vehicle V
a, the security of vehicle V
a is ensured.Table 1
RID-key table.
ID of RSU
New ID of vehicle (handoff)
ID of vehicle (RSU generate)
ID of vehicle (TA generate)
Common secret key
Expire time of common secret key
BDH value of vehicle
Data key of vehicle
Expire time of key
R
1
ID
p
,
V
a
′
I
D
p
,
V
a
I
D
i
,
V
a
k
I
D
p
,
V
a
,
R
1
T
l
,
ID
p
,
V
a
′
B
I
D
p
,
V
a
D
I
D
p
,
V
a
T
l
,
I
D
p
,
V
a
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
R
m
ID
p
,
V
a
′
′
I
D
p
,
V
a
I
D
i
,
V
a
k
I
D
p
,
V
a
,
R
m
T
l
,
ID
p
,
V
a
′
′
non
non
non
R
1
ID
p
,
V
b
′
I
D
p
,
V
b
I
D
i
,
V
b
k
I
D
p
,
V
b
,
R
1
T
l
,
ID
p
,
V
b
′
B
I
D
p
,
V
b
D
I
D
p
,
V
b
T
l
,
I
D
p
,
V
b
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
R
m
-
1
ID
p
,
V
b
′
′
I
D
p
,
V
b
I
D
i
,
V
b
k
I
D
p
,
V
b
,
R
m
T
l
,
ID
p
,
V
b
′
′
non
non
non
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮Table 2
SID-key table.
New ID of vehicle (handoff)
Informed by RSU
Common secret key
Expire time of common secret key
BDH value of vehicle
Data key of vehicle
Expire time of key
ID
p
,
V
t
′
R
7
k
I
D
p
,
V
t
,
R
1
T
l
,
ID
p
,
V
t
′
non
non
non
⋮
⋮
⋮
⋮
⋮
⋮
⋮
ID
p
,
V
t
-
7
′
′
R
m
k
I
D
p
,
V
t
-
7
,
R
1
T
l
,
ID
p
,
V
t
-
7
′
′
non
non
non
ID
p
,
V
c
′
R
m
-
2
k
I
D
p
,
V
c
,
R
1
T
l
,
ID
p
,
V
c
′
B
I
D
p
,
V
c
D
I
D
p
,
V
c
T
l
,
I
D
p
,
V
c
⋮
⋮
⋮
⋮
⋮
⋮
⋮
ID
p
,
V
d
′
′
R
7
k
I
D
p
,
V
d
,
R
1
T
l
,
ID
p
,
V
d
′
′
B
I
D
p
,
V
d
D
I
D
p
,
V
d
T
l
,
I
D
p
,
V
d
⋮
⋮
⋮
⋮
⋮
⋮
⋮Table 3
SID issue table.
ID of RSU
New ID of vehicle (handoff)
ID of vehicle (RSU generate)
ID of vehicle (TA generate)
Common secret key
Private key (RSU)
Secret value
Expire time of key
R
1
ID
p
,
V
a
′
I
D
p
,
V
a
I
D
i
,
V
a
k
I
D
p
,
V
a
,
R
1
P
R
I
D
p
,
V
a
h
I
D
p
,
V
a
T
l
,
I
D
p
,
V
a
⋮
⋮
⋮
⋮
⋮
⋮
⋮
⋮
R
m
ID
p
,
V
a
′
′
I
D
p
,
V
a
I
D
i
,
V
a
k
I
D
p
,
V
a
,
R
m
non
non
non


## 4.4. Intra-RSU Message Authentication

VehicleV
a broadcasts messages to other vehicles within the transmission range of an RSU. The calculations are as follows.(1)
VehicleV
a uses the BDH method to authorize a message signature. The calculations are as follows.
(1.1)
VehicleV
a calculates w
I
D
p
,
V
a
,
j
=
H
M
I
D
p
,
V
a
,
j
∥
I
D
p
,
V
a
∥
T
j
mod
⁡
p.
(1.2)
VehicleV
a calculates y
I
D
p
,
V
a
,
j
=
h
I
D
p
,
V
a
,
j
/
w
I
D
p
,
V
a
,
j, e
^
r
I
D
p
,
V
a
,
j
·
P
,
P°.
(1.3)
VehicleV
a broadcasts the message M
I
D
p
,
V
a
,
j
,
B
I
D
p
,
V
a
,
D
I
D
p
,
V
a
,
e
^
r
I
D
p
,
V
a
,
j
·
P
,
P
,
y
I
D
p
,
V
a
,
j
P
,
I
D
p
,
V
a
,
T
j to other vehicles within range.
(2)
When other vehicles receive the message, they can verify the authenticity of the message. The calculations are as follows.
(2.1)
Calculatew
I
D
p
,
V
a
,
j
=
H
M
I
D
p
,
V
a
,
j
∥
I
D
p
,
V
a
∥
T
j
mod
⁡
p°.
(2.2)
CalculateB
I
D
p
,
V
a
′
=
e
^
w
I
D
p
,
V
a
,
j
·
P
,
y
I
D
p
,
V
a
,
j
·
P
+
e
^
r
I
D
p
,
V
a
,
j
·
P
,
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(2.3)
Check ifB
I
D
p
,
V
a
=
?
B
I
D
p
,
V
a
′. If the equality is satisfied, then vehicle V
a sent the message.Assuming that two vehicles within the transmission range of a given RSU want to send private messages to each other (Figure1), vehicle V
a and vehicle V
b will calculate their common key. The calculation is as follows:(10)
S
K
V
a
-
V
b
=
e
^
P
R
I
D
p
,
V
a
,
P
U
I
D
p
,
V
b
=
e
^
P
U
I
D
p
,
V
a
,
h
I
D
t
,
R
R
P
U
I
D
p
,
V
b
=
S
K
V
b
-
V
a
.Then, vehicleV
a uses the common session key (S
K
V
a
-
V
b) to first encrypt the message and then send it to vehicle V
a. When V
b receives the encrypted message, the vehicle uses the common session key (S
K
V
b
-
V
a) to decrypt the message and then obtain the contents of the message. The benefits of using IBC lie in the fact that the other vehicle’s public key can be easily calculated based on its ID and that the common session key can be calculated based on the other vehicle’s public key and its own private key. Conversely, the other vehicle can also calculate the common session key because the secret value of the common session key is the same.


## 4.5. Inter-RSU Message Authentication

Assuming that vehicleV
a wants to broadcast a message within the transmission ranges of several RSUs and uses the BDH signature to ensure the security of the message, vehicle V
a will first send the parameters M
I
D
p
,
V
a
,
j
,
e
^
r
I
D
p
,
V
a
,
j
·
P
,
P
,
y
I
D
p
,
V
a
,
j
P
,
B
I
D
p
,
V
a, I
D
p
,
V
a
,
y
I
D
t
,
R
1
,
j
·
P
,
e
^
r
I
D
t
,
R
1
,
j
·
P
,
P
·
T
l
,
I
D
p
,
V
t
,
T
j to nearby RSUs, and then the RSUs will relay the message to other vehicles. Then, other vehicles will first verify the legitimacy of vehicle V
a by calculating w
I
D
t
,
R
1
,
j
=
H
H
2
B
I
D
p
,
V
a
∥
I
D
p
,
V
a
∥
T
l
,
I
D
p
,
V
a
mod
⁡
p and then calculating e
^
w
I
D
t
,
R
1
,
j
P
,
y
I
D
t
,
R
1
,
j
P
+
e
^
r
I
D
t
,
R
1
,
j
P
,
P
=
B
I
D
I
D
t
,
R
1
′. If it is the case, then it proves that vehicle V
a is the legitimate user of RSU R
1.Other vehicles will verify the authenticity of the message from vehicleV
a by first calculating w
I
D
p
,
V
a
,
j
=
H
M
I
D
p
,
V
a
,
j
∥
I
D
p
,
V
a
∥
T
j
mod
⁡
p and then calculating e
^
w
I
D
p
,
V
a
,
j
P
,
y
I
D
p
,
V
a
,
j
P
+
e
^
r
I
D
p
,
V
a
,
j
P
,
P
=
B
I
D
p
,
V
a
,
j
′. If it is the case, then the message was sent from vehicle V
a.In private communications, the secret private key value of each vehicle is different because there are multiple RSUs. Therefore, an ID-based encryption method should be used. Let vehicleV
a and vehicle V
c calculate their common session keys. Assuming that vehicle V
a wants to privately communicate with vehicle V
c, which is within the transmission range of a different RSU, vehicle V
c will first encrypt the message. Vehicle V
a will then calculate the public key using the anonymous ID of vehicle V
c. Upon obtaining the data key for vehicle V
c, vehicle V
a will encrypt the message using the public key and the data key of vehicle V
c. The calculation is as follows:(11)
C
=
E
IBC
r
,
M
,
P
U
I
D
p
,
V
c
,
D
I
D
p
,
V
c
=
r
·
P
,
M
⊕
H
2
e
P
U
I
D
p
,
V
c
,
D
I
D
p
,
V
c
r
,
M
=
e
^
P
R
I
D
p
,
V
a
,
P
U
I
D
p
,
V
c
.Subsequently, vehicleV
c uses the private key to decrypt the message. Equation (2) shows the decryption method. Vehicle V
c then uses ID-based encryption to generate an encrypted message for vehicle V
a. The calculation is as follows:(12)
C
=
E
IBC
r
,
M
,
P
U
I
D
p
,
V
a
,
D
I
D
p
,
V
a
=
r
·
P
,
M
⊕
H
2
e
P
U
I
D
p
,
V
a
,
D
I
D
p
,
V
a
r
,
M
=
e
^
P
R
I
D
p
,
V
a
,
P
U
I
D
p
,
V
c
+
e
^
P
R
I
D
p
,
V
c
,
P
U
I
D
p
,
V
a
.VehicleV
a uses the private key to decrypt the message. Equation (2) shows the decryption method. When vehicle V
a receives thecommon session key that it shares with vehicle V
c, V
a can communicate with vehicle V
c privately. The common session key is(13)
S
K
V
a
-
V
c
=
e
^
P
R
I
D
p
,
V
a
,
P
U
I
D
p
,
V
c
+
e
^
P
R
I
D
p
,
V
c
,
P
U
I
D
p
,
V
a
=
S
K
V
c
-
V
a
.


## 4.6. Handoff Problem

When vehicleV
a comes within the transmission range of the next RSU (R
2), vehicle V
a will first inquire for the common secret key that it shares with RSU R
2 in Table 3 and then initiate the handoff. The calculation is as follows.(1)
VehicleV
a first generates short-term parameters B
I
D
p
,
V
t, D
I
D
p
,
V
t and uses the common secret key (k
I
D
p
,
V
a
,
R
2) to encrypt the parameters. Then, vehicle V
a sends the parameters and its anonymous ID to RSU R
2.
(2)
RSUR
2 inquires for the common secret key and the time of validity that it shares with vehicle V
a in Table 2 based on the anonymous ID of vehicle V
a. If the time of validity has expired, then vehicle V
a will reregister with RSU (Section 4.2). If the time of validity has not expired, R
2 will generate the short-term parameters for vehicle V
a. The calculations are as follows.
(2.1)
R
2 calculates P
R
I
D
p
,
V
a as its private key.
(2.2)
R
2 calculates w
I
D
t
,
R
2
,
j
=
H
H
2
B
I
D
p
,
V
a
∥
I
D
p
,
V
a
∥
T
l
,
I
D
p
,
V
a
mod
⁡
p.
(2.3)
R
2 calculates y
I
D
t
,
R
2
,
j
=
h
I
D
t
,
R
2
/
w
I
D
t
,
R
2
,
j, e
^
r
I
D
t
,
R
2
,
j
·
P
,
P.
(3)
RSUR
1 uses the common secret key to encrypt the parameters P
R
I
D
p
,
V
a
,
C
I
D
p
,
V
a. The calculation is as follows:(14)
C
=
SE
P
R
I
D
p
,
V
a
∥
C
I
D
p
,
V
a
∥
T
j
S
K
R
1
-
V
a
.
RSUR
1 sends the message C
∥
I
D
i
,
V
a
∥
e
^
r
I
D
t
,
R
1
,
j
·
P
,
P
∥
y
I
D
t
,
R
1
,
j
P
∥
T
l
,
I
D
p
,
V
a to vehicle V
a.
(4)
When vehicleV
a receives the message, the vehicle uses the common secret key to decrypt the message.
(5)
R
1 records (
I
D
i
,
V
a
,
I
D
p
,
V
a
,
B
I
D
p
,
V
a
,
D
I
D
p
,
V
a
,
C
I
D
t
,
R
1
,
j, T
l
,
I
D
p
,
V
a
) and publishes (
I
D
p
,
V
a
,
B
I
D
p
,
V
a
,
D
I
D
p
,
V
a
,
e
^
r
I
D
t
,
R
1
,
j
·
P
,
P
,
y
I
D
t
,
R
1
,
j
P
,
T
l
,
I
D
p
,
V
a
) to all vehicles in its domain.


## 4.7. Message Authentication When RSUs Are Not Available

When RSUs are not available, vehicles can broadcast messages and conduct private communications using the parameters generated by the TA by executing the following steps.(1)
VehicleV
d uses the BDH signature method to authorize a message signature. The calculations are as follows.
(1.1)
VehicleV
d calculates w
I
D
i
,
V
d
,
j
=
H
M
I
D
i
,
V
d
,
j
∥
I
D
i
,
V
d
∥
T
j
mod
⁡
p.
(1.2)
VehicleV
d calculates y
I
D
i
,
V
d
,
j
=
h
I
D
i
,
V
d
,
j
/
w
I
D
i
,
V
d
,
j, e
^
r
I
D
i
,
V
d
,
j
·
P
,
P.
(1.3)
VehicleV
d broadcasts the message M
I
D
i
,
V
d
,
j
,
B
I
D
i
,
V
d
,
D
I
D
i
,
V
d, e
^
r
I
D
i
,
V
d
,
j
·
P
,
P
,
y
I
D
i
,
V
d
,
j
P
,
I
D
i
,
V
d
,
T
j, e
^
r
I
D
t
,
TA
,
j
·
P
,
P
,
y
I
D
t
,
TA
,
j
P to other vehicles.
(2)
Other vehicles first verify the ID of vehicleV
d. The calculations are as follows.
(2.1)
Calculatew
I
D
t
,
TA
,
j
=
H
H
2
B
I
D
i
,
V
d
∥
I
D
i
,
V
d
∥
T
l
,
I
D
i
,
V
d
mod
⁡
p.
(2.2)
CalculateB
I
D
t
,
TA
′
=
e
^
w
I
D
t
,
TA
,
j
·
P
,
y
I
D
t
,
TA
,
j
·
P
+
e
^
P
,
r
I
D
t
,
TA
,
j
·
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(2.3)
Check ifB
I
D
t
,
TA
=
?
B
I
D
t
,
TA
′. If the equality is satisfied, then the user is legal.
(3)
Other vehicles then verify the authenticity of the message. The calculations are as follows.
(3.1)
Calculatew
I
D
i
,
V
d
,
j
=
H
M
I
D
i
,
V
d
,
j
∥
I
D
i
,
V
d
∥
T
j
mod
⁡
p.
(3.2)
CalculateB
I
D
i
,
V
d
′
=
e
^
w
I
D
i
,
V
d
,
j
·
P
,
y
I
D
i
,
V
d
,
j
·
P
+
e
^
r
I
D
i
,
V
d
,
j
·
P
,
P
=
e
^
P
,
P
h
I
D
t
,
TA.
(3.3)
Check ifB
I
D
i
,
V
d
=
?
B
I
D
i
,
V
d
′. Satisfaction of the equality is proof that vehicle V
d sent the message.Assuming that two vehicles within the transmission range of the same RSU want to communicate privately with each other (Figure1), vehicle V
d and vehicle V
e will calculate their common key. The calculation is as follows:(15)
S
K
V
d
-
V
e
=
e
^
P
R
I
D
i
,
V
d
,
P
U
I
D
i
,
V
e
=
e
^
P
U
I
D
i
,
V
d
,
h
I
D
t
,
TA
P
U
I
D
i
,
V
e
=
S
K
V
e
-
V
d
.Subsequently, vehicleV
d uses the common session key (S
K
V
d
-
V
e) to encrypt the message and send the message to vehicle V
e. When vehicle V
e receives the encrypted message, it uses the common session key (S
K
V
e
-
V
d) to decrypt the message and obtain the contents of the message.


## 5. Security and Performance Analysis

This section gives a security analysis to demonstrate that the method developed in this study can provide confidentiality, authentication, nonrepudiation, conditional anonymity, and conditional untraceability. A performance analysis is conducted by comparing the results of the present study with those in [12–15].


### 5.1. Security Analysis

The following subsections discuss the specific aspects of the security analysis of the proposed method.(1) Confidentiality. Assuming that the ID of every node is not repeated as confidential communications are occurring among vehicles within the range of a single RSU, the property of IBC is used to establish the common session keys. The common session key of a vehicle is calculated based on the bilinear pairings map. According to the elliptic curve discrete logarithm problem (ECDLP), the common session key of a malicious node b and node a is SK
b
-
a. It is difficult for node b to determine a secret value from SK
b
-
a, nodeb’s private key (PR
b) and nodea’s public key (PU
a). Other vehicles are unable to calculate the common session key from their own private keys and the public keys of nodes a and b, and thus the security of confidential communications is ensured.(2) Authentication and Nonrepudiation. As a vehicle registers and gains the trust of an RSU, the RSU will broadcast the vehicle’s G
2 value to all vehicles within range, and that specific G
2 represents the vehicle itself. The parameters M
ID
,
j
,
B
ID
,
D
ID
,
y
ID
,
j
P
,
ID
,
T
j are broadcast as the vehicle is broadcasting messages. Other vehicles will calculate w
ID
,
j
=
H
M
ID
,
j
∥
ID
∥
T
ID
,
j
mod
⁡
p upon receipt of the messages and then calculate B
ID
′
=
e
^
w
ID
,
0
P
,
y
ID
,
j
P
+
e
^
r
ID
,
0
P
,
P
=
e
^
P
,
P
h
ID. Other vehicles are unable to calculate y
ID
,
j from y
ID
,
j
P based on the ECDLP, but r
ID
,
0, y
ID
,
j, and w
ID
,
j can be calculated from the parameters B
ID, y
ID
,
j
P based on the BDH method, provided that the equality B
ID
=
B
ID
′, which is calculated from the messages of the vehicle, is satisfied. Therefore, the vehicle sending the messages achieves undeniability, and the source of the messages is known.(3) Conditional Anonymity. The true ID of a vehicle is known only to the TA. An anonymous ID (ID
i) is used when a vehicle registers with the TA, and this anonymous ID (ID
i) is renewed every time the vehicle registers with the TA. A vehicle will renegotiate a new anonymous ID (ID
p) within the range of every RSU. Therefore, it is difficult for another vehicle to obtain the true ID of the vehicle by tracking ID
i from ID
p because the true IDs of the vehicles are known only to the TA and the individual vehicles bearing those IDs. Every RSU knows the anonymous ID (ID
i) of each vehicle, but each vehicle has a different ID (ID
p) for every RSU, which prevents malicious RSUs from tracking the current location of the vehicle.(4)  Conditional Untraceability. When a vehicle is involved in a criminal act, an RSU is able to trace the anonymous ID (ID
i) from the vehicle’s anonymous ID (ID
p). The RSU transmits ID
i to the TA, which in turn identifies the true ID of the vehicle with the identity ID
i. Every vehicular parameter will eventually expire, therefore ensuring the validity of the anonymous ID of a vehicle.


### 5.2. Performance Analysis

The method developed in this study was compared with those in [12–15] regarding performance, execution time, and data volume. Table 4 compares the results of the present study and those of [12–15], showing that the method developed in the present study is superior to the other methods.Table 4
The comparison of property.
Property
Method
[12]
[13]
[14]
[15]
Proposed method
Security and privacy preservation
YES
YES
YES
YES
YES
Do need the certificate
NO
NO
NO
YES
NO
Do need the help of RSU for authentication
NO
NO
NO
NO
NO
PKI-based system
NO
NO
NO
NO
NO
Communication within different RSU
YES
YES
YES
YES
YES
Privacy communicate
NO
NO
NO
NO
YESTo analyze efficiency, the times required for a message to be broadcast and verified in the present study and in [12–15] were calculated, and the results are listed in Tables 5–7. Table 8 shows the results of the efficiency analysis. The experimental results show that the method proposed in this paper is superior to those in other literatures regardless of computational complexity and packet length. The network security mechanisms proposed in literature [14] and this paper are both based on the use of bilinear pairing, so all the packet lengths are within a reasonable range. However, in computational complexity, the proposed method is superior to that of literature [14]. In literature [15], there are network security mechanisms based on chameleon hashing, which employ exponential calculation. The multiplication result of three values will be huge. Although the computational complexity is not high, the transfer of large amounts of packets will affect network bandwidth and also cause packet losses in VANETs environment.Table 5
Bilinear pairings execution time in milliseconds.
Notations
Descriptions
Execution time (ms)
T
p
Pairing operation
≈4.5
T
m
Point multiplication
≈0.6
T
e
Field exponentiation
≈0.54Table 6
RSA/HMAC execution time in milliseconds.
Notations
Descriptions
Execution time (ms)
ASE
RSA encryption
0.19
ASD
RSA decryption
4.65
HMAC
HMAC
0.002
SE
AES encryption
<0.19
SD
AES decryption
<4.65Table 7
The length of the parameters.
Parameters
Length (bit)
Parameters
Length (bit)
G
1
160
AES
128
G
2
160
Variable
32
HMAC
160
Message (M)
1024
RSA
1024
Random number (r)
128Table 8
Performance analysis.
Property
Method
[12]
[13]
[14]
[15]
Proposed method
The broadcast message
Signing:
5
*
T
m
+
3
*
T
p Verification
4
*
T
m
+
4
*
T
p
Signing:
1
*
T
p Verification
3
*
T
p
Signing:
5
*
T
m Verification
6
*
T
m
+
1
*
T
p
Signing:
2
*
T
m Verification
2
*
T
m
Signing
T
p
+
2
*
T
m Verification
T
p
+
T
m
Spending time
36.4 ms
18 ms
11.1 ms
18 ms
10.8 ms
The length of ciphertext
1112 bits
480 bits
480 bits
(160
*
160) + 320 bits
480 bits
Handoff
3
*
T
p
N/A
4
*
T
m
+
2
*
T
p
5
*
T
m
2 * SE + 2 * SD
Spending time
13.5 ms
N/A
11.4 ms
3 ms
<9.68 ms
The length of ciphertext
480 bits
N/A
1280 bits
160
*
160
*
160 bits
2048 bits
Communication between different RSUs
Signing:
5
*
T
m
+
3
*
T
p Verification
4
*
T
m
+
4
*
T
p
Signing:
1
*
T
p Verification
3
*
T
p
Signing:
5
*
T
m Verification
6
*
T
m
+
1
*
T
p
Signing:
2
*
T
m Verification
2
*
T
m
Signing
T
p
+
2
*
T
m Verification
2
*
T
p
+
2
*
T
m
Spending time
36.4 ms
18 ms
11.1 ms
18 ms
15.9 ms
The length of ciphertext
1112 bits
480 bits
480 bits
(160 * 160) + 320 bits
960 bits
Privacy communicate
N/A
N/A
N/A
N/A
Signing
T
P  + SE Verification
T
p  + SD
Spending time
N/A
N/A
N/A
N/A
<13.84 ms
The length of ciphertext
N/A
N/A
N/A
N/A
1024 bits


## 5.1. Security Analysis

The following subsections discuss the specific aspects of the security analysis of the proposed method.(1) Confidentiality. Assuming that the ID of every node is not repeated as confidential communications are occurring among vehicles within the range of a single RSU, the property of IBC is used to establish the common session keys. The common session key of a vehicle is calculated based on the bilinear pairings map. According to the elliptic curve discrete logarithm problem (ECDLP), the common session key of a malicious node b and node a is SK
b
-
a. It is difficult for node b to determine a secret value from SK
b
-
a, nodeb’s private key (PR
b) and nodea’s public key (PU
a). Other vehicles are unable to calculate the common session key from their own private keys and the public keys of nodes a and b, and thus the security of confidential communications is ensured.(2) Authentication and Nonrepudiation. As a vehicle registers and gains the trust of an RSU, the RSU will broadcast the vehicle’s G
2 value to all vehicles within range, and that specific G
2 represents the vehicle itself. The parameters M
ID
,
j
,
B
ID
,
D
ID
,
y
ID
,
j
P
,
ID
,
T
j are broadcast as the vehicle is broadcasting messages. Other vehicles will calculate w
ID
,
j
=
H
M
ID
,
j
∥
ID
∥
T
ID
,
j
mod
⁡
p upon receipt of the messages and then calculate B
ID
′
=
e
^
w
ID
,
0
P
,
y
ID
,
j
P
+
e
^
r
ID
,
0
P
,
P
=
e
^
P
,
P
h
ID. Other vehicles are unable to calculate y
ID
,
j from y
ID
,
j
P based on the ECDLP, but r
ID
,
0, y
ID
,
j, and w
ID
,
j can be calculated from the parameters B
ID, y
ID
,
j
P based on the BDH method, provided that the equality B
ID
=
B
ID
′, which is calculated from the messages of the vehicle, is satisfied. Therefore, the vehicle sending the messages achieves undeniability, and the source of the messages is known.(3) Conditional Anonymity. The true ID of a vehicle is known only to the TA. An anonymous ID (ID
i) is used when a vehicle registers with the TA, and this anonymous ID (ID
i) is renewed every time the vehicle registers with the TA. A vehicle will renegotiate a new anonymous ID (ID
p) within the range of every RSU. Therefore, it is difficult for another vehicle to obtain the true ID of the vehicle by tracking ID
i from ID
p because the true IDs of the vehicles are known only to the TA and the individual vehicles bearing those IDs. Every RSU knows the anonymous ID (ID
i) of each vehicle, but each vehicle has a different ID (ID
p) for every RSU, which prevents malicious RSUs from tracking the current location of the vehicle.(4)  Conditional Untraceability. When a vehicle is involved in a criminal act, an RSU is able to trace the anonymous ID (ID
i) from the vehicle’s anonymous ID (ID
p). The RSU transmits ID
i to the TA, which in turn identifies the true ID of the vehicle with the identity ID
i. Every vehicular parameter will eventually expire, therefore ensuring the validity of the anonymous ID of a vehicle.


## 5.2. Performance Analysis

The method developed in this study was compared with those in [12–15] regarding performance, execution time, and data volume. Table 4 compares the results of the present study and those of [12–15], showing that the method developed in the present study is superior to the other methods.Table 4
The comparison of property.
Property
Method
[12]
[13]
[14]
[15]
Proposed method
Security and privacy preservation
YES
YES
YES
YES
YES
Do need the certificate
NO
NO
NO
YES
NO
Do need the help of RSU for authentication
NO
NO
NO
NO
NO
PKI-based system
NO
NO
NO
NO
NO
Communication within different RSU
YES
YES
YES
YES
YES
Privacy communicate
NO
NO
NO
NO
YESTo analyze efficiency, the times required for a message to be broadcast and verified in the present study and in [12–15] were calculated, and the results are listed in Tables 5–7. Table 8 shows the results of the efficiency analysis. The experimental results show that the method proposed in this paper is superior to those in other literatures regardless of computational complexity and packet length. The network security mechanisms proposed in literature [14] and this paper are both based on the use of bilinear pairing, so all the packet lengths are within a reasonable range. However, in computational complexity, the proposed method is superior to that of literature [14]. In literature [15], there are network security mechanisms based on chameleon hashing, which employ exponential calculation. The multiplication result of three values will be huge. Although the computational complexity is not high, the transfer of large amounts of packets will affect network bandwidth and also cause packet losses in VANETs environment.Table 5
Bilinear pairings execution time in milliseconds.
Notations
Descriptions
Execution time (ms)
T
p
Pairing operation
≈4.5
T
m
Point multiplication
≈0.6
T
e
Field exponentiation
≈0.54Table 6
RSA/HMAC execution time in milliseconds.
Notations
Descriptions
Execution time (ms)
ASE
RSA encryption
0.19
ASD
RSA decryption
4.65
HMAC
HMAC
0.002
SE
AES encryption
<0.19
SD
AES decryption
<4.65Table 7
The length of the parameters.
Parameters
Length (bit)
Parameters
Length (bit)
G
1
160
AES
128
G
2
160
Variable
32
HMAC
160
Message (M)
1024
RSA
1024
Random number (r)
128Table 8
Performance analysis.
Property
Method
[12]
[13]
[14]
[15]
Proposed method
The broadcast message
Signing:
5
*
T
m
+
3
*
T
p Verification
4
*
T
m
+
4
*
T
p
Signing:
1
*
T
p Verification
3
*
T
p
Signing:
5
*
T
m Verification
6
*
T
m
+
1
*
T
p
Signing:
2
*
T
m Verification
2
*
T
m
Signing
T
p
+
2
*
T
m Verification
T
p
+
T
m
Spending time
36.4 ms
18 ms
11.1 ms
18 ms
10.8 ms
The length of ciphertext
1112 bits
480 bits
480 bits
(160
*
160) + 320 bits
480 bits
Handoff
3
*
T
p
N/A
4
*
T
m
+
2
*
T
p
5
*
T
m
2 * SE + 2 * SD
Spending time
13.5 ms
N/A
11.4 ms
3 ms
<9.68 ms
The length of ciphertext
480 bits
N/A
1280 bits
160
*
160
*
160 bits
2048 bits
Communication between different RSUs
Signing:
5
*
T
m
+
3
*
T
p Verification
4
*
T
m
+
4
*
T
p
Signing:
1
*
T
p Verification
3
*
T
p
Signing:
5
*
T
m Verification
6
*
T
m
+
1
*
T
p
Signing:
2
*
T
m Verification
2
*
T
m
Signing
T
p
+
2
*
T
m Verification
2
*
T
p
+
2
*
T
m
Spending time
36.4 ms
18 ms
11.1 ms
18 ms
15.9 ms
The length of ciphertext
1112 bits
480 bits
480 bits
(160 * 160) + 320 bits
960 bits
Privacy communicate
N/A
N/A
N/A
N/A
Signing
T
P  + SE Verification
T
p  + SD
Spending time
N/A
N/A
N/A
N/A
<13.84 ms
The length of ciphertext
N/A
N/A
N/A
N/A
1024 bits


## 6. Conclusion

VANETs improve transportation safety and efficiency. If the information shared between vehicles is tampered with, there will be dire consequences such as vehicle collisions. The scheme proposed in this study ensures the security of the information shared between vehicles and is superior to other schemes in terms of message verification and handoff. Additionally, in terms of security, the scheme in this study ensures conditional untraceability, conditional anonymity, authentication, and nonrepudiation. Future work will include supplementing the scheme proposed in this study with revocation and trust mechanisms to corroborate the security scheme.



---

*Source: 569526-2015-10-11.xml*