# A Novel Identity-Based Mutual Authentication Scheme for Vehicle Ad Hoc Networks

Authors: Chaofan Di; Wanqing Wu
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

The vehicle ad hoc network (VANET) is an emerging industry that deeply integrates a new generation of network communication technology with automotive and road transportation. As the basic nodes of VANETs, vehicles can communicate and share information with other peer vehicles. However, with the rapid development of the industry, the security risks of VANETs, especially the problem of privacy leakage, have become increasingly prominent. To solve this problem, we propose a novel identity-based mutual authentication scheme (IBMA) for vehicle ad hoc networks. In this scheme, we adopt identity-based cryptography (IBC) to generate keys, which reduces the storage burden of the central authority and eliminates the need to rely on the certificate to distribute the public key. Meanwhile, the key escrow issue can be solved, which is a common problem in IBC. Then, the scheme adjusts central authority to semihonest and realizes unconditional privacy protection. In addition, our scheme achieves complete anonymity, which can prevent any other entities such as peer vehicles and central authorities from tracking vehicles. Finally, our scheme provides efficient traceability while protecting vehicle privacy. Security analysis shows that the proposed scheme satisfies a variety of security requirements such as anonymity, reliability, and nonrepudiation. Performance analysis demonstrates that our proposed scheme is efficient and requires less communication and storage cost compared with related schemes.


---

## Body

## 1. Introduction

In recent years, with the rapid development of wireless communication technology, sensor technology, and mobile computing, vehicular ad hoc network (VANET) [1] has attracted more and more attention from governments, enterprises, and scientific research institutions. VANETs are large-scale mobile self-organizing networks, which are important parts of intelligent transportation systems and autonomous driving. In VANETs, each vehicle is a basic network node that communicates with others to share or exchange data, so that the vehicle can remotely obtain the driving status and road condition information of other vehicles, thereby reducing congestion, avoiding potential traffic accidents, and improving travel efficiency and safety.The VANET can build a network in the form of self-organization to realize self-configuration and self-management without fixed infrastructure and provide services such as access, data exchange, and resource sharing for each vehicle. Because of its numerous nodes and flexible organization, scholars have envisaged a variety of new services for VANETs, such as dynamic route planning [2] and mobile entertainment in-vehicle [3]. For example, drivers can obtain the latest traffic conditions or parking information through VANETs, and passengers can chat or exchange files through VANET, which greatly improves the travel experience of drivers and passengers.While providing convenient services for drivers and passengers, VANETs also bring huge security challenges. The security and privacy issues [4] of VANETs have also received increasing attention. Because the VANETs are deployed in the public network area and transmit messages through a wireless network, it is vulnerable to damage by malicious attackers, such as publishing wrong road condition information and stealing user privacy. The damage directly affects the personal and property security of drivers and passengers. Therefore, the key to comprehensively promoting the VANETs is to solve the problems of information security and privacy protection first.One of the solutions is to authorize all legal vehicles connected to the network and check whether the vehicles are legal through identity authentication before the communication. Illegal identities will be refused to provide services. At the same time, the privacy of vehicle users should be protected during identity authentication. For example, the real identity of the vehicle should be kept secret during authentication, and location information will not be obtained by authentication agencies [5].The current research on vehicle ad hoc networks is mainly based on shared key schemes or public key systems [6, 7]. The shared key scheme relies on key management to a large extent, while the traditional public key infrastructure (PKI) puts forward strict requirements for the large-capacity storage and management of public key certificates. In recent years, many authentication schemes using ID-based encryption have been proposed [8–10]. Identity-based encryption (IBC) [11] was first proposed by Shamir in 1984. The basic idea of IBC is that the entity’s public key is directly derived from its public identity information (such as phone number and email address), and the private key is calculated and distributed by a central authority. IBC completely eliminates the need for traditional PKI to distribute public keys through certificates. However, in IBC, since the user’s private key is completely determined by TA; when the TA is maliciously attacked or the TA itself is not trusted, it will cause an incalculable risk to the system, that is, the key escrow problem [12], which makes it impossible to achieve strong nonrepudiation.In general, traditional VANETs are composed of three components, namely the trusted authority (TA), the roadside unit (RSU), and the vehicles. TA provides various network services to vehicles through RSUs. The RSUs are fixed on both sides of the roads, which are used to connect the vehicles to the TA. There are also some models without RSU [13], where the vehicle communicates directly with the TA.In this paper, we propose a novel identity-based mutual authentication scheme for vehicle ad hoc networks. Compared with the existing VANET authentication schemes, our scheme has many advantages:First, the proposed scheme satisfies various security requirements in the VANET authentication model, such as anonymity, traceability, and nonrepudiation. Meanwhile, it can resist common attacks.Second, we adopted two independent and parallel trusted authorities to reduce the trust level in TAs. We assume thatTAa and TAb are well-known cloud platforms (e.g., IBM Cloud and Microsoft Azure) which are supervised by the government and have no incentive to collude to damage their reputation. Two TAs cooperate with each other to generate a pseudonym (PID) corresponding to the real identity (RID) for the vehicle. Therefore, our scheme maintains traceability while ensuring anonymity.Third, we adopt ID-based encryption to calculate keys, which reduces the storage burden of TA. Besides, we solve the common key escrow problem in the IBC encryption model.The remainder of the paper is organized as follows. Section2 summarizes the related work of the previous literature. Section 3 introduces the parameters. The system model, attack model, and specific scheme of the proposed protocol are presented in Section 4. Section 5 analyzes the security of the proposed scheme. In Section 6, performance analysis is done in terms of communication cost, storage cost, and computational cost. Finally, Section 7 concludes the paper and suggests some future directions.


## 2. Related Work

In this section, we summarize and compare the related work of the previous literature. In recent years, many scholars have researched and explored the problems in the authentication process of vehicle ad hoc networks [14–16].In terms of the realization of privacy protection and anonymous authentication, the existing solutions can be classified into two main categories: pseudonym-based authentication protocols and group-based authentication protocols.Pseudonym-based authentication protocols mean that users use pseudonyms to replace their real identities in the process of access authentication or communication. In 2007, Raya and Hubaux [17] proposed a signature-based authentication scheme. In this scheme, when the vehicle wants to sign a message, it first randomly selects a private key from the certificate distributed by the central authority and signs the message with the private key. The receiver verifies whether the identity of the other party is legal by checking the validity of the certificate, thereby completing identity authentication. The disadvantage of this scheme is that the computational cost is high, and the vehicle has to validate for potential revocation when selecting the certificate, which is not suitable for large-scale networks. In 2011, Studer et al. [18] proposed an anonymous authentication scheme based on temporary keys. The scheme signs messages with a short-term key certified by a central authority and provides an efficient revocation method to prevent attackers from obtaining vehicle location and other private information. However, this scheme requires a central authority to maintain the certificate and allows tracking of the current location of vehicles. Therefore, the privacy of vehicles has not been fully protected. Liu et al. [19] proposed a protocol that uses OBU to generate its own anonymous identity and temporary encryption key for identity verification.In order to further protect the privacy of vehicles, Huang et al. [20] proposed a privacy preservation scheme, namely, the pseudonymous authentication-based conditional privacy. In this scheme, the motor vehicles division (MVD) and roadside units (RSUs) jointly generate pseudonyms for vehicles. MVD generates identification tickets for vehicles, and then, RSU generates pseudonym tickets based on identification tickets. Finally, the vehicle generates its pseudonym based on pseudonym tickets. During the pseudonym generation process, neither MVD nor RSU knows the true identity of the vehicle. The protocol proposed a revocation method; unfortunately, the calculation overhead of the revocation method is high. Wei et al. [21] proposed a random authentication protocol, which divides the central authority into registration server (RS) and verification server (VS). RS generates pseudonyms by homomorphic encryption. VS is responsible for verifying whether the pseudonyms are legal, which improves system security, and the dependence of the whole system on the central authority is reduced. However, this scheme still has the risk of leaking user privacy, and the computational cost is relatively high.The concept of group signature was first proposed by Chaum and Heyst [22] in 1991. The basic idea is that the group manager authenticates the vehicles and divides the vehicles into different groups, so that vehicles within and between groups can realize anonymous communication. The communication party can only determine which group the other party belongs to, whether it is a valid group member, and does not know its real identity. When a dispute occurs, the group manager can reveal the suspect vehicle’s real identity. Lu et al. [23] proposed a conditional privacy protection protocol for vehicle secure communication. The RSU, as a group manager, dynamically generates a short-term group key between vehicle and RSU, achieving anonymity and traceability. In the meantime, the scheme also alleviates the storage burden of the key. However, the security of this scheme is slightly insufficient. When multiple RSUs are damaged, the scheme cannot provide unlinkability and traceability. In order to solve this problem, Jung et al. [24] proposed a robust conditional privacy protection protocol, which improves the robustness without reducing efficiency. When multiple RSUs are compromised, the scheme can also provide unlinkability and traceability. In addition, the scheme adopts multiple anonymous certificates to reduce the computational overhead of RSU. Zakarya et al. [25] proposed a password-based conditional privacy protection authentication protocol and group key agreement protocol. The scheme provides group key generation, user joining, and leaving functions, and it is lightweight in terms of computing and communication.Other schemes are aimed at achieving identity authentication that can be roughly divided into the following three categories: public key-based authentication model, identity-based authentication model, and message authentication code- (MAC-) based authentication model. The public key-based authentication model is the traditional public key infrastructure (PKI) model. PKI provides a series of basic services that support public key cryptographic applications (such as encryption and decryption, signature, and verification signature), and its most basic component is the public key certificate. The user’s private key is kept secretly by itself, and the user’s public key is saved by the certificate which is kept by the central authority. Malik and Pandey [26] proposed a discrete event-based threat-driven authentication scheme. This scheme utilizes asymmetric cryptography, reencrypt key, and time-based arbitrary numbers to provide authentication among vehicles and between vehicles and RSUs. Besides, this scheme also provides privacy protection among vehicles and between vehicles and RSUs, which improves security and can prevent common authentication attacks in VANETs.The main limitation of PKI is the large storage overhead and the difficulty of certificate management. Shamir first proposed the concept of identity-based encryption (IBC) in 1984. The basic idea of IBC is that the public key of the entity participating in the communication comes directly from its public identity information instead of the traditional random number-like string, and the private key is calculated and distributed by the central authority. IBC completely eliminates the need to implement public key distribution through traditional public key certificates. Li et al. [27] proposed an efficient message authentication with an enhanced privacy scheme based on ring signature and identity-based signature. This scheme achieves unconditional privacy and can resist common attacks such as full key exposure attacks and identity attacks. At the same time, this scheme has a lower computational overhead. Alazzawi et al. [28] proposed an identity-based privacy protection authentication scheme, which can meet the security and privacy requirements and can resist various common attacks. However, the identity-based authentication model has the problem of key escrow, and complete privacy protection can only be achieved when the central authority is fully trusted. Based on this problem, Asari et al. [29] proposed a hierarchical authentication protocol. In this scheme, only part of the private key generated by the authority is used as a partial-private key. The combination of the partial-private key and the random number independently selected by the user is the user’s real private key. This means that only legitimate users can obtain the partial-private key, and the key used for communication and signature is only owned by the user, which solves the key escrow problem.Message authentication code (MAC) is a public function of message and key, and its output is a short block of fixed-length data. Asl and Samavi [30] proposed a symmetric nonrepudiation message authentication scheme. This scheme combines symmetric key encryption and digital signature, allowing RSU to verify the authenticity of the information sent by the vehicle, and achieves nonrepudiation. The weakness is that the message verification process relies too much on the RSU. Pandi et al. [31] proposed a dual authentication method based on a hash code. This method uses a hash code (HC) to generate an authentication code (AC) for authentication. However, in this method, the user’s pseudonym is randomly generated and has no calculation relationship with the real identity. Therefore, there is a risk of excessive storage burden and vulnerability to leakage. Benyamina et al. [32] proposed an efficient and lightweight authentication scheme for vehicular ad hoc networks. This scheme adopts MAC functions and XOR operations to sign and verify messages. On the premise of ensuring security and privacy protection, the scheme reduces the computation and communication costs. However, this scheme still has the disadvantage of key escrow and high storage overhead.In addition, there are protocols based on XOR operations [33], which are very fast in the calculation, but they are not sufficiently secure.Compared with most of the existing authentication schemes in the literature, this paper proposes a novel identity-based mutual authentication scheme, which is aimed at strengthening the protection of vehicle user privacy during authentication. In our scheme, the authentication of the vehicle and the TA is two-way, that is, the TA needs to verify the legitimacy of the vehicle’s identity, and the vehicle can also verify the legitimacy of the TA. In addition, we lowered the TA’s trust level and divided the TA into two parts. One receives the real identity information of the vehicle, and the other generates pseudonyms. We also adopt IBC to reduce the storage overhead of TA and solve the key escrow problem in IBC by generating communication keys by the vehicles themselves. Finally, our solution achieves efficient traceability while protecting vehicle privacy.


## 3. Preliminaries

For a better understanding, we first briefly introduce the basic knowledge required for the article.


### 3.1. Bilinear Pairings

LetG1 be an additive group and G2 be a multiplicative group of the order q. Let P be an arbitrary generator of G1. A bilinear pairing can be defined if the mapping e:G1×G1⟶G2 satisfies the following properties:
(i)
Bilinear: for∀P,Q∈G1 and a,b∈Zq∗(1)eaP,bQ=eP,Qab(ii)
Nondegenerate:∀P,Q∈G1,eaP,bQ≠IG2, where IG2 is an arbitrary generator of G2(iii)
Computable: for∀P,Q∈G1, there exists a polynomial time algorithm to compute eP,Q


### 3.2. Security Assumptions

In this section, we define the following security assumptions, which are assumed to be difficult to break by any polynomial time-bounded algorithm.


#### 3.2.1. Definition 1 (Large Integer Factoring Problem (IFP))

(1)
Given two prime numbersp and q, and it is easy to calculate n=p×q(2)
Given an integern, it is difficult to find the prime factors p and q of n satisfying n=p×q


#### 3.2.2. Definition 2 (Elliptic Curve Discrete Logarithm Problem (ECDLP))

Given a random instance<P,Q>, where P∈G1,Q∈G1, it is hard to find x satisfying Q=xP.


### 3.3. Notations and Explanations

The relevant notations and explanations used in our scheme are shown in Table1.Table 1
The notations and explanations.
NationsExplanationsTAaTrusted authorityaTAbTrusted authoritybVVehicleG1,L1Additive groupsG2,L2Multiplicative groupsPa,PbArbitrary generators of the additive groupG1,L1qa,qbOrders of the multiplicative groupG2,L2pka,skaPublic and private key pair ofTAapkb,skbPublic and private key pair ofTAaeBilinear pairHa,HbHash functionsRIDReal identifierPIDPseudo identifierA⟶BMEntityA sends M to entity BE1Public key encryptionE2Symmetric encryptionr,k1,k1Random numbersQV,SVIBC public and private key pair of vehicle Vx,yRSA public and private key pair of vehicle VTValid timeT0,T1,T2Current timestampa,bLarge prime numberscCiphertextmCommunication messageKSession key


## 3.1. Bilinear Pairings

LetG1 be an additive group and G2 be a multiplicative group of the order q. Let P be an arbitrary generator of G1. A bilinear pairing can be defined if the mapping e:G1×G1⟶G2 satisfies the following properties:
(i)
Bilinear: for∀P,Q∈G1 and a,b∈Zq∗(1)eaP,bQ=eP,Qab(ii)
Nondegenerate:∀P,Q∈G1,eaP,bQ≠IG2, where IG2 is an arbitrary generator of G2(iii)
Computable: for∀P,Q∈G1, there exists a polynomial time algorithm to compute eP,Q


## 3.2. Security Assumptions

In this section, we define the following security assumptions, which are assumed to be difficult to break by any polynomial time-bounded algorithm.


### 3.2.1. Definition 1 (Large Integer Factoring Problem (IFP))

(1)
Given two prime numbersp and q, and it is easy to calculate n=p×q(2)
Given an integern, it is difficult to find the prime factors p and q of n satisfying n=p×q


### 3.2.2. Definition 2 (Elliptic Curve Discrete Logarithm Problem (ECDLP))

Given a random instance<P,Q>, where P∈G1,Q∈G1, it is hard to find x satisfying Q=xP.


## 3.2.1. Definition 1 (Large Integer Factoring Problem (IFP))

(1)
Given two prime numbersp and q, and it is easy to calculate n=p×q(2)
Given an integern, it is difficult to find the prime factors p and q of n satisfying n=p×q


## 3.2.2. Definition 2 (Elliptic Curve Discrete Logarithm Problem (ECDLP))

Given a random instance<P,Q>, where P∈G1,Q∈G1, it is hard to find x satisfying Q=xP.


## 3.3. Notations and Explanations

The relevant notations and explanations used in our scheme are shown in Table1.Table 1
The notations and explanations.
NationsExplanationsTAaTrusted authorityaTAbTrusted authoritybVVehicleG1,L1Additive groupsG2,L2Multiplicative groupsPa,PbArbitrary generators of the additive groupG1,L1qa,qbOrders of the multiplicative groupG2,L2pka,skaPublic and private key pair ofTAapkb,skbPublic and private key pair ofTAaeBilinear pairHa,HbHash functionsRIDReal identifierPIDPseudo identifierA⟶BMEntityA sends M to entity BE1Public key encryptionE2Symmetric encryptionr,k1,k1Random numbersQV,SVIBC public and private key pair of vehicle Vx,yRSA public and private key pair of vehicle VTValid timeT0,T1,T2Current timestampa,bLarge prime numberscCiphertextmCommunication messageKSession key


## 4. Authentication Protocol

### 4.1. Overview of the Protocol

VehiclesTAa and TAb are the three components in our proposed system. It consists of a hierarchy of two layers where the vehicles are in lower layer, and TAa and TAb are in a higher layer. Vehicles are the entities that would like to communicate with other peer vehicles via VANETs. Two different authorities are deployed, which are denoted as TAa and TAb, respectively. In our proposed protocol, the TAa and TAb act as a high computational entity with large storage capacity but they are not absolutely trusted. The two authorities collaborate with each other to ensure privacy-preserving vehicle authentications. If one of them was compromised, none of them would be able to track the vehicle alone.


### 4.2. Threat Model

In our scheme, we adopt the following threat or adversary model.(i)
We assume that the two trusted authorities used in our authentication system are semihonest. In other words, they follow the prescriptive procedures of the proposed protocol and do not collude with each other(ii)
Vehicles in VANETs may be malicious. Malicious vehicles may impersonate other vehicles to communicate with other peer vehicles(iii)
We assume that the communication channel is insecure, which means that a powerful attacker can eavesdrop and capture communication information. Besides, we consider a situation that adversaries with high computing power may reveal sensitive information by violent attacks or other methods (such as replay attack [34])


### 4.3. The Proposed Protocol

In this section, we explain the secure authentication scheme for VANETs. The system of the proposed scheme is composed of two independent and parallel trusted authoritiesTAa, TAb, and vehicle V, aiming at achieving secure authentication communication in vehicle ad hoc networks. We assume that the time of all entities in the system is synchronized and the communication between TAa and TAb uses a secure and fast dedicated channel. The proposed authentication protocol is divided into five parts: initialization, vehicle registration, V2V communication, vehicle tracing, and revocation.


#### 4.3.1. Initialization

The initialization phase is the process of generating system parameters of the vehicle ad hoc network. The details are as follows:(i)
TAa: define G1 to be an additive group and G2 to be a multiplicative group with G2=qa. Pa is an arbitrary generator of G1. Let Ha be a cryptography hash function where Ha:0,1∗×G1⟶Zqa∗. TAa chooses a private key ska∈Zqa∗ randomly and computes a corresponding public key:
(2)pka=Pa+Pa+⋯+Pa⏟ska=ska×Pa.Note thatpka is calculated from the private key ska, but according to Definition 2, even if the attacker obtains Pa and pka, it is hard to find ska satisfying pka=ska×Pa.ThenTAa publishes pka and keeps the private key ska secret. Then the public system parameters of TAa are <G1,G2, pka, Pa, qa,Ha>(ii)
TAb: define L1 to be an additive group and L2 to be a multiplicative group with L2=qb. Pb is an arbitrary generator of L1. The pairing e:L1×L1⟶L2. Let Hb be a cryptography hash function where Hb:0,1∗×L1⟶Zqb∗. TAb chooses a private key skb∈Zqb∗ randomly and computes a corresponding public key:
(3)pkb=Pb+Pb+⋯+Pb⏟skb=skb×Pb.ThenTAb publishes pkb and keeps the private key skb secret. Then the public system parameters of TAb are <L1, L2, pkb, Pb, qb, Hb, e>.


#### 4.3.2. Vehicle Registration

The vehicle registration phase is the process in which the vehicle is authenticated by two trusted authorities and obtains a pseudo identifierPID and private key. The registration model is shown in Figure 1. The registration phase is performed as follows:
(1)
The vehicle V encrypts its real identifierRID with TAa’s public key pka and uses pkb to encrypt a random number r which is selected by itself. Then, two ciphertexts are sent together to TAa, summarized as(4)V⟶TAa:Epka1RID,Epkb1r,where E1 is the public key encryption algorithm.
(2)
After receivingEpka1RID,Epkb1r, TAa decrypts Epka1RID with its private key ska to obtain RID. Then TAa executes the following calculations:(5)PID′=RID⊕Haska,where ⊕ denotes as bitwise XOR operations.Figure 1
Registration model.After obtainingPID′, TAa deletes RID and sends PID′ to TAb together with Epkb1r received previously. Since a secure and fast dedicated channel is used between TAa and TAb, the PID′ does not need to be encrypted. That is
(6)TAa⟶TAb:PID′,Epkb1r(3)
TAb gets PID′ and uses its private key skb to decrypt the received message to learn r and then calculates(7)PID=PID′⊕HbskbTT′,(8)SV=skb×HbPID,(9)QV=HbPID.PID is the pseudonym of the vehicle for subsequent communication. T is the valid time of PID, and T′ denotes the generation time of PID. If a vehicle’s pseudonym expires, TAb can regenerate its pseudonym based on the current time. SV and QV are private key and the corresponding public key of the vehicle V, respectively.It is worth noting that in order to reduce the vehicle’s calculation burden,QV is calculated byTAb. TAb takes the random number r as the key of symmetric encryption, encrypts PID, SV, and QV with r, and sends the ciphertext to TAa. Meanwhile, TAb stores the PID, T, and T′ in the database. In the pseudonym generation process, TAa saves the real identifier RID, and TAb saves the pseudo identifier (PID). The sending process can be expressed as
(10)TAb⟶TAa:Er2PID,SV,QV,where E2 is the symmetric encryption algorithm.
(4)
After receivingEr2PID,SV,QV, TAa will forward it to vehicle V without any processing, denoted as(11)TAa⟶V:Er2PID,SV,QV(5)
V decryptsEr2PID,SV,QV with a random number r to obtain PID, SV, and QV when receiving the ciphertext. Then V checks eSV,Pb=?eQV,pkb. If the equation holds, it can prove that the received message is from a valid TAa. After the verification, vehicle V randomly selects two large prime numbers a and b and calculates(12)n=a×b,(13)φn=a−1×b−1,(14)y=QV×Pb.Note thaty and φn should satisfy 1<y<φn and e,φn=1; otherwise, V should reselect a and b. If the constraint is met, V computes x in terms of xy=1modφn.x and y are the private key and public key of vehicle V for subsequent communication, respectively, and the private key x is only owned by vehicle V, thus avoiding the problem of key escrow.


#### 4.3.3. V2V Communication

Vehicle-to-vehicle (V2V) communication phase is the process in which vehicleV1 and other peer vehicle V2 complete authentication to each other and generate session key with the participation of the trusted authority TAb. Figure 2 shows the communication model. A detailed description is as follows:
(1)
V1 searches for the intended vehicle V2 and obtains V2’s pseudonym PID2.(We can search for the intended vehicle based on the deep neural network [35]. The search process is not the focus of this paper, so the detailed search process will not be described here. Then V1 encrypts the pseudonym and current time T0 with TAb’s public key pkb and finally sends it toTAb to determine whether the pseudonym is legal or not. That is to say(15)V1⟶TAb:Epkb1PID2,T0(2)
TAb searches for PID2 in the local database after receiving the message and obtaining PID2, T0. If there is a matching PID2 and it is within the validity time, TAb returns the valid message of pseudoidentifier to V1. Otherwise, an invalid message of pseudoidentifier is returned. Note that if PID2 is a timed-out pseudonym, it is necessary to delete the pseudonym in the database while returning a pseudonym invalid message(3)
V1 believes that V2 is a legal vehicle and then calculates ciphertext c1 and V2’s public key y2:(16)c1=Ex11m1T1k1,(17)y2=QV2×Pb=HbPID2∗Pb.where m1 means the communication message, T1 is the current time, and k1 denotes the random number selected by the vehicle V1. When the calculation is completed, V1 sends ciphertext c1 and its own pseudoidentifier PID1 to V2, both of which are encrypted with V2’s public key pkb. That is
(18)V1⟶V2:Ey21c1,PID1(4)
Upon receiving the message,V2 decrypts the message with its own private key x2 to obtain c1 and PID1. Then V2 encrypts PID1 and current time T2 with TAb’s public key pkb. Finally V2 sends the ciphertext to TAb for verification. That is(19)V2⟶TAb:Epkb1PID1,T2(5)
After gettingPID1 and T2, TAb checks whether PID1 exists in the local database and verifies whether it has expired. If it is legal and valid, TAb returns the valid message of pseudoidentifier to V2. Otherwise, an invalid message pseudoidentifier is returned. (Similarly, if PID1 is a timed-out pseudonym, it should be deleted from the local database while returning a pseudonym invalid message)(6)
AfterV2 confirms that V1 is legitimate, V2 calculates V1’s public key y1 and decrypts the ciphertext c1 to obtain m1, T1, and k1Figure 2
Communication model.First, check whether the timestampT1 is fresh or not. If T1 is fresh, V2 computes
(20)c2=Ex21m2T3k2,(21)K=k1⊕k2,where m2 denotes the communication message, T3 is the current time, and k2 means the random number selected by the vehicle V2. K is the session key for subsequent communication. Then V2 encrypts ciphertext c2 with V1’s public key pk1 and sends the cyphertext to V1. That is
(22)V2⟶V1:Ey11c2(7)
After receiving the message,V1 decrypts the ciphertext c2 and obtains m2, T3, and k2. If T3 is fresh, V1 calculates the session key K=k1⊕k2 for subsequent communication with V2. Otherwise, V2 rejects the messages


#### 4.3.4. Vehicle Tracing

In practical application, disputes may occur from time to time due to various reasons. Sometimes, third-party law enforcement agencies may want to know the real identity of the malicious vehicle immediately. The vehicle tracking phase is a process in whichTAa and TAb cooperate with each other and track the suspect vehicle’s real identifier according to its pseudonym. The tracing model is depicted in Figure 3. And the detailed process is as follows:
(1)
After receiving malicious vehicles’PID from law enforcement agencies, TAb searches the corresponding T, T′, and computes(23)PID′=PID⊕Hbskb∥T∥T′and sends the encrypted PID′ to TAa:
(24)TAb⟶TAa:PID’(2)
TAa extracts RID from the receiving PID′:(25)RID=PID′⊕HaskaFigure 3
Tracing model.Therefore, the real identity is successfully tracked.


#### 4.3.5. Vehicle Revocation

In the revocation phase, when the vehicle is confirmed as a malicious vehicle, or the validity period of its pseudonym expires, the central authority shall remove it from the system in time. WhenTAb gets the pseudoidentifier of the vehicle to be removed, pseudonym information will be deleted from the local database. After that, the authentication request on this pseudonym will fail, because there is no matching legal pseudonym in TAb’s database.


## 4.1. Overview of the Protocol

VehiclesTAa and TAb are the three components in our proposed system. It consists of a hierarchy of two layers where the vehicles are in lower layer, and TAa and TAb are in a higher layer. Vehicles are the entities that would like to communicate with other peer vehicles via VANETs. Two different authorities are deployed, which are denoted as TAa and TAb, respectively. In our proposed protocol, the TAa and TAb act as a high computational entity with large storage capacity but they are not absolutely trusted. The two authorities collaborate with each other to ensure privacy-preserving vehicle authentications. If one of them was compromised, none of them would be able to track the vehicle alone.


## 4.2. Threat Model

In our scheme, we adopt the following threat or adversary model.(i)
We assume that the two trusted authorities used in our authentication system are semihonest. In other words, they follow the prescriptive procedures of the proposed protocol and do not collude with each other(ii)
Vehicles in VANETs may be malicious. Malicious vehicles may impersonate other vehicles to communicate with other peer vehicles(iii)
We assume that the communication channel is insecure, which means that a powerful attacker can eavesdrop and capture communication information. Besides, we consider a situation that adversaries with high computing power may reveal sensitive information by violent attacks or other methods (such as replay attack [34])


## 4.3. The Proposed Protocol

In this section, we explain the secure authentication scheme for VANETs. The system of the proposed scheme is composed of two independent and parallel trusted authoritiesTAa, TAb, and vehicle V, aiming at achieving secure authentication communication in vehicle ad hoc networks. We assume that the time of all entities in the system is synchronized and the communication between TAa and TAb uses a secure and fast dedicated channel. The proposed authentication protocol is divided into five parts: initialization, vehicle registration, V2V communication, vehicle tracing, and revocation.


### 4.3.1. Initialization

The initialization phase is the process of generating system parameters of the vehicle ad hoc network. The details are as follows:(i)
TAa: define G1 to be an additive group and G2 to be a multiplicative group with G2=qa. Pa is an arbitrary generator of G1. Let Ha be a cryptography hash function where Ha:0,1∗×G1⟶Zqa∗. TAa chooses a private key ska∈Zqa∗ randomly and computes a corresponding public key:
(2)pka=Pa+Pa+⋯+Pa⏟ska=ska×Pa.Note thatpka is calculated from the private key ska, but according to Definition 2, even if the attacker obtains Pa and pka, it is hard to find ska satisfying pka=ska×Pa.ThenTAa publishes pka and keeps the private key ska secret. Then the public system parameters of TAa are <G1,G2, pka, Pa, qa,Ha>(ii)
TAb: define L1 to be an additive group and L2 to be a multiplicative group with L2=qb. Pb is an arbitrary generator of L1. The pairing e:L1×L1⟶L2. Let Hb be a cryptography hash function where Hb:0,1∗×L1⟶Zqb∗. TAb chooses a private key skb∈Zqb∗ randomly and computes a corresponding public key:
(3)pkb=Pb+Pb+⋯+Pb⏟skb=skb×Pb.ThenTAb publishes pkb and keeps the private key skb secret. Then the public system parameters of TAb are <L1, L2, pkb, Pb, qb, Hb, e>.


### 4.3.2. Vehicle Registration

The vehicle registration phase is the process in which the vehicle is authenticated by two trusted authorities and obtains a pseudo identifierPID and private key. The registration model is shown in Figure 1. The registration phase is performed as follows:
(1)
The vehicle V encrypts its real identifierRID with TAa’s public key pka and uses pkb to encrypt a random number r which is selected by itself. Then, two ciphertexts are sent together to TAa, summarized as(4)V⟶TAa:Epka1RID,Epkb1r,where E1 is the public key encryption algorithm.
(2)
After receivingEpka1RID,Epkb1r, TAa decrypts Epka1RID with its private key ska to obtain RID. Then TAa executes the following calculations:(5)PID′=RID⊕Haska,where ⊕ denotes as bitwise XOR operations.Figure 1
Registration model.After obtainingPID′, TAa deletes RID and sends PID′ to TAb together with Epkb1r received previously. Since a secure and fast dedicated channel is used between TAa and TAb, the PID′ does not need to be encrypted. That is
(6)TAa⟶TAb:PID′,Epkb1r(3)
TAb gets PID′ and uses its private key skb to decrypt the received message to learn r and then calculates(7)PID=PID′⊕HbskbTT′,(8)SV=skb×HbPID,(9)QV=HbPID.PID is the pseudonym of the vehicle for subsequent communication. T is the valid time of PID, and T′ denotes the generation time of PID. If a vehicle’s pseudonym expires, TAb can regenerate its pseudonym based on the current time. SV and QV are private key and the corresponding public key of the vehicle V, respectively.It is worth noting that in order to reduce the vehicle’s calculation burden,QV is calculated byTAb. TAb takes the random number r as the key of symmetric encryption, encrypts PID, SV, and QV with r, and sends the ciphertext to TAa. Meanwhile, TAb stores the PID, T, and T′ in the database. In the pseudonym generation process, TAa saves the real identifier RID, and TAb saves the pseudo identifier (PID). The sending process can be expressed as
(10)TAb⟶TAa:Er2PID,SV,QV,where E2 is the symmetric encryption algorithm.
(4)
After receivingEr2PID,SV,QV, TAa will forward it to vehicle V without any processing, denoted as(11)TAa⟶V:Er2PID,SV,QV(5)
V decryptsEr2PID,SV,QV with a random number r to obtain PID, SV, and QV when receiving the ciphertext. Then V checks eSV,Pb=?eQV,pkb. If the equation holds, it can prove that the received message is from a valid TAa. After the verification, vehicle V randomly selects two large prime numbers a and b and calculates(12)n=a×b,(13)φn=a−1×b−1,(14)y=QV×Pb.Note thaty and φn should satisfy 1<y<φn and e,φn=1; otherwise, V should reselect a and b. If the constraint is met, V computes x in terms of xy=1modφn.x and y are the private key and public key of vehicle V for subsequent communication, respectively, and the private key x is only owned by vehicle V, thus avoiding the problem of key escrow.


### 4.3.3. V2V Communication

Vehicle-to-vehicle (V2V) communication phase is the process in which vehicleV1 and other peer vehicle V2 complete authentication to each other and generate session key with the participation of the trusted authority TAb. Figure 2 shows the communication model. A detailed description is as follows:
(1)
V1 searches for the intended vehicle V2 and obtains V2’s pseudonym PID2.(We can search for the intended vehicle based on the deep neural network [35]. The search process is not the focus of this paper, so the detailed search process will not be described here. Then V1 encrypts the pseudonym and current time T0 with TAb’s public key pkb and finally sends it toTAb to determine whether the pseudonym is legal or not. That is to say(15)V1⟶TAb:Epkb1PID2,T0(2)
TAb searches for PID2 in the local database after receiving the message and obtaining PID2, T0. If there is a matching PID2 and it is within the validity time, TAb returns the valid message of pseudoidentifier to V1. Otherwise, an invalid message of pseudoidentifier is returned. Note that if PID2 is a timed-out pseudonym, it is necessary to delete the pseudonym in the database while returning a pseudonym invalid message(3)
V1 believes that V2 is a legal vehicle and then calculates ciphertext c1 and V2’s public key y2:(16)c1=Ex11m1T1k1,(17)y2=QV2×Pb=HbPID2∗Pb.where m1 means the communication message, T1 is the current time, and k1 denotes the random number selected by the vehicle V1. When the calculation is completed, V1 sends ciphertext c1 and its own pseudoidentifier PID1 to V2, both of which are encrypted with V2’s public key pkb. That is
(18)V1⟶V2:Ey21c1,PID1(4)
Upon receiving the message,V2 decrypts the message with its own private key x2 to obtain c1 and PID1. Then V2 encrypts PID1 and current time T2 with TAb’s public key pkb. Finally V2 sends the ciphertext to TAb for verification. That is(19)V2⟶TAb:Epkb1PID1,T2(5)
After gettingPID1 and T2, TAb checks whether PID1 exists in the local database and verifies whether it has expired. If it is legal and valid, TAb returns the valid message of pseudoidentifier to V2. Otherwise, an invalid message pseudoidentifier is returned. (Similarly, if PID1 is a timed-out pseudonym, it should be deleted from the local database while returning a pseudonym invalid message)(6)
AfterV2 confirms that V1 is legitimate, V2 calculates V1’s public key y1 and decrypts the ciphertext c1 to obtain m1, T1, and k1Figure 2
Communication model.First, check whether the timestampT1 is fresh or not. If T1 is fresh, V2 computes
(20)c2=Ex21m2T3k2,(21)K=k1⊕k2,where m2 denotes the communication message, T3 is the current time, and k2 means the random number selected by the vehicle V2. K is the session key for subsequent communication. Then V2 encrypts ciphertext c2 with V1’s public key pk1 and sends the cyphertext to V1. That is
(22)V2⟶V1:Ey11c2(7)
After receiving the message,V1 decrypts the ciphertext c2 and obtains m2, T3, and k2. If T3 is fresh, V1 calculates the session key K=k1⊕k2 for subsequent communication with V2. Otherwise, V2 rejects the messages


### 4.3.4. Vehicle Tracing

In practical application, disputes may occur from time to time due to various reasons. Sometimes, third-party law enforcement agencies may want to know the real identity of the malicious vehicle immediately. The vehicle tracking phase is a process in whichTAa and TAb cooperate with each other and track the suspect vehicle’s real identifier according to its pseudonym. The tracing model is depicted in Figure 3. And the detailed process is as follows:
(1)
After receiving malicious vehicles’PID from law enforcement agencies, TAb searches the corresponding T, T′, and computes(23)PID′=PID⊕Hbskb∥T∥T′and sends the encrypted PID′ to TAa:
(24)TAb⟶TAa:PID’(2)
TAa extracts RID from the receiving PID′:(25)RID=PID′⊕HaskaFigure 3
Tracing model.Therefore, the real identity is successfully tracked.


### 4.3.5. Vehicle Revocation

In the revocation phase, when the vehicle is confirmed as a malicious vehicle, or the validity period of its pseudonym expires, the central authority shall remove it from the system in time. WhenTAb gets the pseudoidentifier of the vehicle to be removed, pseudonym information will be deleted from the local database. After that, the authentication request on this pseudonym will fail, because there is no matching legal pseudonym in TAb’s database.


## 4.3.1. Initialization

The initialization phase is the process of generating system parameters of the vehicle ad hoc network. The details are as follows:(i)
TAa: define G1 to be an additive group and G2 to be a multiplicative group with G2=qa. Pa is an arbitrary generator of G1. Let Ha be a cryptography hash function where Ha:0,1∗×G1⟶Zqa∗. TAa chooses a private key ska∈Zqa∗ randomly and computes a corresponding public key:
(2)pka=Pa+Pa+⋯+Pa⏟ska=ska×Pa.Note thatpka is calculated from the private key ska, but according to Definition 2, even if the attacker obtains Pa and pka, it is hard to find ska satisfying pka=ska×Pa.ThenTAa publishes pka and keeps the private key ska secret. Then the public system parameters of TAa are <G1,G2, pka, Pa, qa,Ha>(ii)
TAb: define L1 to be an additive group and L2 to be a multiplicative group with L2=qb. Pb is an arbitrary generator of L1. The pairing e:L1×L1⟶L2. Let Hb be a cryptography hash function where Hb:0,1∗×L1⟶Zqb∗. TAb chooses a private key skb∈Zqb∗ randomly and computes a corresponding public key:
(3)pkb=Pb+Pb+⋯+Pb⏟skb=skb×Pb.ThenTAb publishes pkb and keeps the private key skb secret. Then the public system parameters of TAb are <L1, L2, pkb, Pb, qb, Hb, e>.


## 4.3.2. Vehicle Registration

The vehicle registration phase is the process in which the vehicle is authenticated by two trusted authorities and obtains a pseudo identifierPID and private key. The registration model is shown in Figure 1. The registration phase is performed as follows:
(1)
The vehicle V encrypts its real identifierRID with TAa’s public key pka and uses pkb to encrypt a random number r which is selected by itself. Then, two ciphertexts are sent together to TAa, summarized as(4)V⟶TAa:Epka1RID,Epkb1r,where E1 is the public key encryption algorithm.
(2)
After receivingEpka1RID,Epkb1r, TAa decrypts Epka1RID with its private key ska to obtain RID. Then TAa executes the following calculations:(5)PID′=RID⊕Haska,where ⊕ denotes as bitwise XOR operations.Figure 1
Registration model.After obtainingPID′, TAa deletes RID and sends PID′ to TAb together with Epkb1r received previously. Since a secure and fast dedicated channel is used between TAa and TAb, the PID′ does not need to be encrypted. That is
(6)TAa⟶TAb:PID′,Epkb1r(3)
TAb gets PID′ and uses its private key skb to decrypt the received message to learn r and then calculates(7)PID=PID′⊕HbskbTT′,(8)SV=skb×HbPID,(9)QV=HbPID.PID is the pseudonym of the vehicle for subsequent communication. T is the valid time of PID, and T′ denotes the generation time of PID. If a vehicle’s pseudonym expires, TAb can regenerate its pseudonym based on the current time. SV and QV are private key and the corresponding public key of the vehicle V, respectively.It is worth noting that in order to reduce the vehicle’s calculation burden,QV is calculated byTAb. TAb takes the random number r as the key of symmetric encryption, encrypts PID, SV, and QV with r, and sends the ciphertext to TAa. Meanwhile, TAb stores the PID, T, and T′ in the database. In the pseudonym generation process, TAa saves the real identifier RID, and TAb saves the pseudo identifier (PID). The sending process can be expressed as
(10)TAb⟶TAa:Er2PID,SV,QV,where E2 is the symmetric encryption algorithm.
(4)
After receivingEr2PID,SV,QV, TAa will forward it to vehicle V without any processing, denoted as(11)TAa⟶V:Er2PID,SV,QV(5)
V decryptsEr2PID,SV,QV with a random number r to obtain PID, SV, and QV when receiving the ciphertext. Then V checks eSV,Pb=?eQV,pkb. If the equation holds, it can prove that the received message is from a valid TAa. After the verification, vehicle V randomly selects two large prime numbers a and b and calculates(12)n=a×b,(13)φn=a−1×b−1,(14)y=QV×Pb.Note thaty and φn should satisfy 1<y<φn and e,φn=1; otherwise, V should reselect a and b. If the constraint is met, V computes x in terms of xy=1modφn.x and y are the private key and public key of vehicle V for subsequent communication, respectively, and the private key x is only owned by vehicle V, thus avoiding the problem of key escrow.


## 4.3.3. V2V Communication

Vehicle-to-vehicle (V2V) communication phase is the process in which vehicleV1 and other peer vehicle V2 complete authentication to each other and generate session key with the participation of the trusted authority TAb. Figure 2 shows the communication model. A detailed description is as follows:
(1)
V1 searches for the intended vehicle V2 and obtains V2’s pseudonym PID2.(We can search for the intended vehicle based on the deep neural network [35]. The search process is not the focus of this paper, so the detailed search process will not be described here. Then V1 encrypts the pseudonym and current time T0 with TAb’s public key pkb and finally sends it toTAb to determine whether the pseudonym is legal or not. That is to say(15)V1⟶TAb:Epkb1PID2,T0(2)
TAb searches for PID2 in the local database after receiving the message and obtaining PID2, T0. If there is a matching PID2 and it is within the validity time, TAb returns the valid message of pseudoidentifier to V1. Otherwise, an invalid message of pseudoidentifier is returned. Note that if PID2 is a timed-out pseudonym, it is necessary to delete the pseudonym in the database while returning a pseudonym invalid message(3)
V1 believes that V2 is a legal vehicle and then calculates ciphertext c1 and V2’s public key y2:(16)c1=Ex11m1T1k1,(17)y2=QV2×Pb=HbPID2∗Pb.where m1 means the communication message, T1 is the current time, and k1 denotes the random number selected by the vehicle V1. When the calculation is completed, V1 sends ciphertext c1 and its own pseudoidentifier PID1 to V2, both of which are encrypted with V2’s public key pkb. That is
(18)V1⟶V2:Ey21c1,PID1(4)
Upon receiving the message,V2 decrypts the message with its own private key x2 to obtain c1 and PID1. Then V2 encrypts PID1 and current time T2 with TAb’s public key pkb. Finally V2 sends the ciphertext to TAb for verification. That is(19)V2⟶TAb:Epkb1PID1,T2(5)
After gettingPID1 and T2, TAb checks whether PID1 exists in the local database and verifies whether it has expired. If it is legal and valid, TAb returns the valid message of pseudoidentifier to V2. Otherwise, an invalid message pseudoidentifier is returned. (Similarly, if PID1 is a timed-out pseudonym, it should be deleted from the local database while returning a pseudonym invalid message)(6)
AfterV2 confirms that V1 is legitimate, V2 calculates V1’s public key y1 and decrypts the ciphertext c1 to obtain m1, T1, and k1Figure 2
Communication model.First, check whether the timestampT1 is fresh or not. If T1 is fresh, V2 computes
(20)c2=Ex21m2T3k2,(21)K=k1⊕k2,where m2 denotes the communication message, T3 is the current time, and k2 means the random number selected by the vehicle V2. K is the session key for subsequent communication. Then V2 encrypts ciphertext c2 with V1’s public key pk1 and sends the cyphertext to V1. That is
(22)V2⟶V1:Ey11c2(7)
After receiving the message,V1 decrypts the ciphertext c2 and obtains m2, T3, and k2. If T3 is fresh, V1 calculates the session key K=k1⊕k2 for subsequent communication with V2. Otherwise, V2 rejects the messages


## 4.3.4. Vehicle Tracing

In practical application, disputes may occur from time to time due to various reasons. Sometimes, third-party law enforcement agencies may want to know the real identity of the malicious vehicle immediately. The vehicle tracking phase is a process in whichTAa and TAb cooperate with each other and track the suspect vehicle’s real identifier according to its pseudonym. The tracing model is depicted in Figure 3. And the detailed process is as follows:
(1)
After receiving malicious vehicles’PID from law enforcement agencies, TAb searches the corresponding T, T′, and computes(23)PID′=PID⊕Hbskb∥T∥T′and sends the encrypted PID′ to TAa:
(24)TAb⟶TAa:PID’(2)
TAa extracts RID from the receiving PID′:(25)RID=PID′⊕HaskaFigure 3
Tracing model.Therefore, the real identity is successfully tracked.


## 4.3.5. Vehicle Revocation

In the revocation phase, when the vehicle is confirmed as a malicious vehicle, or the validity period of its pseudonym expires, the central authority shall remove it from the system in time. WhenTAb gets the pseudoidentifier of the vehicle to be removed, pseudonym information will be deleted from the local database. After that, the authentication request on this pseudonym will fail, because there is no matching legal pseudonym in TAb’s database.


## 5. Security Analysis

In this section, we will show that the proposed scheme is correct and secure with respect to the assumption in Section3.2.


### 5.1. Formal Security Analysis

Theorem 1.
The proposed mutual authentication protocol IBMA is secure assuming that (a) the large integer factoring problem (IFP) is computationally hard and (b) the elliptic curve discrete logarithm problem (ECDLP) is difficult to break by any polynomial time-bounded algorithm.Proof.
We start examining the security of the vehicle’s private and public key,x and y, respectively. For every probabilistic polynomial time adversary A, there is a negligible ϵ such that
(26)PrAn∈a,b≤ϵl,where a and b are primes with size l bits and n=a×b.
a and b are two large prime numbers selected by the vehicle. In order to ensure the security, n should be 2048 bits, which is generally used in RSA [36], and the size of a and b should be 1024 bits. There are approximately 21015 prime numbers of size less than 1024 bits according to [37], which makes it computationally hard for an adversary to find a or b.
Based on [38], the most famous heuristic asymptotic running time algorithm of prime number factorization runs on average in time 2Ol1/3·logl2/3 to factor a number of size l bits. Therefore, ϵl=1/2Ol1/3·logl2/3. The above analysis shows that n is secure in our protocol. The same logic as for n works to show that φnφn=a−1×b−1 is also secure.The above implies the security of Theorem1 (a) and proves that the generation of vehicles’ RSA private and public keys is secure.In the proposed protocol, the generation of some public keys (e.g.,pka, pkb) is computed and deduced from the private key. The security of these public and private key pairs is based on the difficulty of the elliptic curve discrete logarithm problem (ECDLP). At present, the best-known algorithm for solving the elliptic curve discrete logarithm problem is the distributed Pollard−ρ method [39], and the computational complexity is Oπn/21/2/m, where n is the largest prime factor of the order of the group and m denotes the number of CPUs used by the distributed algorithm. It can be seen that the elliptic curve cryptography is safe when the prime numbers q and n are large enough. This is the fundamental reason that the order of the elliptic curve solution point group must have a large prime factor. In an ideal situation, the order of the group itself is a large prime number.For common security assumptions (e.g., large integer factorization and discrete logarithm problems), there are algorithms with subexponential complexity for the time being [40], but there is no subexponential algorithm for solving the intended vehicle elliptic curve discrete logarithm problem. Therefore, ECDLP is difficult to break by any polynomial time-bounded algorithm.The above complexity analysis shows the difficulty of ECDLP and proves the security of public key generation in our protocol.


### 5.2. Correctness

The proposed scheme is correct and consistent because of the following reasons:In the registration phase, the vehicle V first sends its real identityRID and random number r to TAa, where RID and r are encrypted with pka and pkb, respectively. Thus, the transmission of RID and r is safe. Attackers cannot reveal RID and r without knowing ska and skb. After receiving RID, TAa calculates PID′ and then sends PID′ and the received ciphertext about r to TAb. Note that in order to further strengthen security, TAa will not store RID but removes it after calculating PID′ to avoid leakage. TAb calculates PID according to the received PID′ and then computes the public and private key pair QV and SV of the vehicle. Finally, TAb sends PID, SV, and QV to TAa. Since r was encrypted with pkb, TAa cannot learn the value of random number r. Therefore, PID, SV, and QV are secret. All TAa can do is to forward the message to the vehicle V.On receiving<PID,SV,QV>, vehicle V computes
(27)eSV,Pb=eskb×QV,Pb=eQV,skb×Pb=eQV,pkb.Because the private keyskb is only held by TAb, no one else can generate the correct public and private key pair QV and SV that satisfies the equation. In other words, the vehicle can verify whether the TAb sent <PID,SV,QV> is a legal TAb according to the equation, thereby verifying the identity of the TAb, realizing mutual authentication.In the V2V communication phase, the vehicleV1 first asks TAb whether the assumed communication vehicle V1’s pseudonym is legal. After receiving a positive reply, V1 generates ciphertext c1 with its own private key x. After that, V1 sends c1 and its own pseudonym PID1 to the assumed communication vehicle V2.Upon receiving the message,V1 enquires TAb whether PID1 is a legal pseudoidentifier. If PID1 is legal, V2 calculates the public key y1 of PID1 to verify ciphertext c1; otherwise, it drops the message.V2 obtains the communication message m, the timestamp T1, and the random number k1 after c1 is successfully decrypted. Note that if the timestamp is not fresh, the message will also be dropped. Then, V2 generates ciphertext c2, which will be sent to V1 together with its pseudonym PID2. V1 verifies the identity of V2 in the same way. After the identity verification is passed, the session key is calculated K=k1⊕k2. k1 is part of the ciphertext c1. Similarly, k2 is part of the ciphertext c2.If the attacker does not have the keyx, it can not generate valid ciphertexts. The vehicle’s public and private key pair x and y are based on the difficulty of factorization of large complex numbers, so no attackers can calculate the private key according to the public key in probabilistic polynomial time. In addition, the ciphertext and pseudonym are protected by the receiver’s public key. No one else can get the ciphertext and pseudonym.


### 5.3. Mutual Authentication

The proposed protocol can realize mutual authentication between vehicles andTAb. TAb uses PID′ sent by TAa to generate pseudonyms PID and public-private key pair QV,SV for vehicles. Vehicles use the public-private key pair sent by TAb to verify TAb. If the public-private key pair QV,SV are not sent by a legal TAb, the equation eSV,Pb=?eQV,pkb will not hold. In conclusion, TAb verifies whether vehicle V has submitted its real identity through PID′, and vehicle V judges whether TA is legal by equation eSV,Pb=?eQV,pkb. Thus, the mutual authentication between vehicles and TAb is achieved.The mutual authentication between vehicles is also achieved. Before V2V communicates, vehicleV1 needs to enquire TAb whether the pseudonym of the communication vehicle V2 is legal. Similarly, V2 confirms the legitimacy of V1 in the same way. Both the receiver vehicle and the sender vehicle need to confirm that the identity of the other party is legal before carrying out subsequent communication to avoid being attacked by attackers. Therefore, the proposed protocol realizes mutual authentication.


### 5.4. Reliability

In the registration phase, when the real identity (RID) is submitted by the vehicle, the communication contents are protected by TAa’s public key. Since the public-private key pair of TAa is secured based on the ECDLP assumption, no adversary can calculate the private key according to the public key in probabilistic polynomial time. Thus, the information submitted by the vehicle will not be stolen. In addition, PID, SV, and QV sent by TAb are encrypted by random number r, which is generated by the vehicle and discarded after being used once. No attacker including TAa can crack it within the effective time. So the registration phase is reliable.In the V2V communication phase, the message is protected by the public-private key pairx and y of the vehicle, and x and y are generated by RSA, which is based on the difficulty of factorization of a large complex number. No attackers can crack the private key x according to the public key y. Both ciphertexts and pseudonyms are well protected. Besides, the session key K is generated by random numbers generated by both communication parties. The random numbers are in the ciphertexts of the sending vehicles, and the ciphertexts are encrypted by the public key of the receiving parties. No attackers can obtain the random numbers. In conclusion, the V2V communication stage is reliable.


### 5.5. Anonymity

During the communication, vehicle always uses pseudonym as its identity. The entity communicating with it can only judge whether the pseudonym is legal but cannot know its real identity. The real identityRID of the vehicle will no longer appear in the communication contents after it is submitted to TAa in the registration phase. TAa will remove RID in time to prevent leakage. TAb calculates PID according to PID′ sent from TAa. PID is used as communication pseudonym of registered vehicles. No one knows the correspondence between pseudonyms and real names, including TAa and TAb. If a vehicle’s pseudonym expires, TAb can regenerate its pseudonym based on the current time.In the existing schemes, most of them store the corresponding relationship betweenPID and RID by a single TA, which has potential safety hazards. Once the TA is compromised, or information leakage occurs in the TA, incalculable hazards will happen. In the proposed scheme, two TAs are in charge of the corresponding relationship. If it is needed to recover the real identifier, two TAs must cooperate with each other. Moreover, there is no information about the real identifier in TA’s database. Even if the information is leaked, the damage is minimal, which greatly improves the security. Therefore, communication anonymity is realized.


### 5.6. Unforgeability

Unforgeability aims that only the intended vehicles can make valid ciphertexts and authentication messages. Attackers cannot forge valid ciphertexts and authentication messages generated by legitimate vehicles.In the vehicle andTAa authentication phase, the vehicle must submit its real identity in order to obtain a pseudo identifier and become a legitimate vehicle.In the V2V authentication, the vehicle must be able to generate a valid ciphertextc. At the same time, its pseudonym should exist in the database. If an attacker wants to impersonate vehicle V for communication, he can easily obtain the pseudonym of the vehicle V, because the pseudonym is public. However, he cannot generate a legal ciphertext to pass the verification. Since the private key x is generated by the vehicle itself based on the RSA algorithm, it is not feasible to calculate the private key x according to the public key y. Therefore, the ciphertext c is unforgeable.


### 5.7. Traceability

Traceability means thatTAa and TAb have the ability to reveal the real identity of a vehicle in VANETs when it is confirmed as a malicious vehicle.At first,TAb obtains the PID of malicious vehicle and calculates the corresponding PID′, where PID′=PID⊕Hbskb∥T∥T′, and then sends PID′ to TAa. TAa will recover the real identifier RID, where RID=PID′⊕Haska. Both TAa and TAb do not know the corresponding relationship between PID and RID. Only when they cooperate with each other can they recover vehicle’s real identity. If an attacker wants to capture the real identity corresponding to a pseudonym illegally, he needs to crack the private keys of TAa and TAb at the same time. Since ska and skb are random numbers in Zqa∗ and Zqb∗, respectively, it is almost impossible to crack them at the same time. Thus, traceability is achieved while improving security.


### 5.8. Nonrepudiation

Nonrepudiation aims that afterTAa traces the real identity of a malicious vehicle, the vehicle cannot deny that it has generate the ciphertext. There is no key escrow problem in the proposed protocol, and the private key x in V2V communication is generated by the vehicle itself. No attacker can calculate x based on the public key y. Therefore, even if TAa and TAb are semihonest, the private key x of the vehicle is only owned by itself, and no one else can obtain the private key x to make a legal ciphertext. In conclusion, the scheme is undeniable.


### 5.9. Related Attack

#### 5.9.1. Replay Attack

A replay attack refers to that a malicious attacker reinjects previously received messages into the VANETs to achieve the purpose of attacking legitimate vehicles. In order to prevent the proposed scheme from replay attacks, we add a timestamp to ciphertexts. The ciphertext can only be made by the sender’s vehicle. No one else can forge a legal ciphertext, nor can it change the content of the ciphertext. This is because the attacker cannot obtain the sender’s private key. The receiving vehicle can decide whether to accept the message according to the freshness of the timestamp, and the replayed message cannot pass the verification. Therefore, the proposed scheme can effectively prevent the replay attacks.


#### 5.9.2. Man-in-the-Middle Attack

In addition to replay attacks, the man-in-the-middle attack is also a common attack method used by attackers. Because VANETs use wireless public channel communication, they cannot completely resist attackers from eavesdropping on data packets. But all communication contents in our scheme are protected by key encryption.In the registration phase, during the submission of the real identity, the contents of the communication are protected by the public keys ofTAa and TAb, and attackers cannot obtain meaningful data even if the message is eavesdropped. In the process of pseudonym and public and private key distribution, the communication contents are encrypted and protected by random number r as a symmetric key. The random number r is generated by the vehicle and discarded after one use. Even if an attacker steals the ciphertext, he cannot infer and modify the content of the plaintext. Therefore, the registration phase can resist the man-in-the-middle attack.In the V2V communication stage, the communication contents are protected by the public key of the receiver vehicle, and the private key of the vehicle is only owned by himself. EvenTAa and TAb cannot know the content of the communication. If an attacker wants to crack the ciphertext, it needs to crack the RSA algorithm within a probabilistic polynomial time, which is impossible. Therefore, the communication phase can resist the man-in-the-middle attack. The security comparison is summarized in Table 2.Table 2
Security comparison.
SchemeReplay attackMan-in-the-middle attackAnonymityForgery attackTraceabilityNonrepudiationKey escrowGISI [6]√√√√√××ACPN [7]√×√√√√×PPDAS [19]√√√√√××VGKM [31]√√√√√××RA [21]√√√√√××ANEL [32]√√√√√√×P2-SHARP [33]√√√×√×/Our scheme√√√√√√√


## 5.1. Formal Security Analysis

Theorem 1.
The proposed mutual authentication protocol IBMA is secure assuming that (a) the large integer factoring problem (IFP) is computationally hard and (b) the elliptic curve discrete logarithm problem (ECDLP) is difficult to break by any polynomial time-bounded algorithm.Proof.
We start examining the security of the vehicle’s private and public key,x and y, respectively. For every probabilistic polynomial time adversary A, there is a negligible ϵ such that
(26)PrAn∈a,b≤ϵl,where a and b are primes with size l bits and n=a×b.
a and b are two large prime numbers selected by the vehicle. In order to ensure the security, n should be 2048 bits, which is generally used in RSA [36], and the size of a and b should be 1024 bits. There are approximately 21015 prime numbers of size less than 1024 bits according to [37], which makes it computationally hard for an adversary to find a or b.
Based on [38], the most famous heuristic asymptotic running time algorithm of prime number factorization runs on average in time 2Ol1/3·logl2/3 to factor a number of size l bits. Therefore, ϵl=1/2Ol1/3·logl2/3. The above analysis shows that n is secure in our protocol. The same logic as for n works to show that φnφn=a−1×b−1 is also secure.The above implies the security of Theorem1 (a) and proves that the generation of vehicles’ RSA private and public keys is secure.In the proposed protocol, the generation of some public keys (e.g.,pka, pkb) is computed and deduced from the private key. The security of these public and private key pairs is based on the difficulty of the elliptic curve discrete logarithm problem (ECDLP). At present, the best-known algorithm for solving the elliptic curve discrete logarithm problem is the distributed Pollard−ρ method [39], and the computational complexity is Oπn/21/2/m, where n is the largest prime factor of the order of the group and m denotes the number of CPUs used by the distributed algorithm. It can be seen that the elliptic curve cryptography is safe when the prime numbers q and n are large enough. This is the fundamental reason that the order of the elliptic curve solution point group must have a large prime factor. In an ideal situation, the order of the group itself is a large prime number.For common security assumptions (e.g., large integer factorization and discrete logarithm problems), there are algorithms with subexponential complexity for the time being [40], but there is no subexponential algorithm for solving the intended vehicle elliptic curve discrete logarithm problem. Therefore, ECDLP is difficult to break by any polynomial time-bounded algorithm.The above complexity analysis shows the difficulty of ECDLP and proves the security of public key generation in our protocol.


## 5.2. Correctness

The proposed scheme is correct and consistent because of the following reasons:In the registration phase, the vehicle V first sends its real identityRID and random number r to TAa, where RID and r are encrypted with pka and pkb, respectively. Thus, the transmission of RID and r is safe. Attackers cannot reveal RID and r without knowing ska and skb. After receiving RID, TAa calculates PID′ and then sends PID′ and the received ciphertext about r to TAb. Note that in order to further strengthen security, TAa will not store RID but removes it after calculating PID′ to avoid leakage. TAb calculates PID according to the received PID′ and then computes the public and private key pair QV and SV of the vehicle. Finally, TAb sends PID, SV, and QV to TAa. Since r was encrypted with pkb, TAa cannot learn the value of random number r. Therefore, PID, SV, and QV are secret. All TAa can do is to forward the message to the vehicle V.On receiving<PID,SV,QV>, vehicle V computes
(27)eSV,Pb=eskb×QV,Pb=eQV,skb×Pb=eQV,pkb.Because the private keyskb is only held by TAb, no one else can generate the correct public and private key pair QV and SV that satisfies the equation. In other words, the vehicle can verify whether the TAb sent <PID,SV,QV> is a legal TAb according to the equation, thereby verifying the identity of the TAb, realizing mutual authentication.In the V2V communication phase, the vehicleV1 first asks TAb whether the assumed communication vehicle V1’s pseudonym is legal. After receiving a positive reply, V1 generates ciphertext c1 with its own private key x. After that, V1 sends c1 and its own pseudonym PID1 to the assumed communication vehicle V2.Upon receiving the message,V1 enquires TAb whether PID1 is a legal pseudoidentifier. If PID1 is legal, V2 calculates the public key y1 of PID1 to verify ciphertext c1; otherwise, it drops the message.V2 obtains the communication message m, the timestamp T1, and the random number k1 after c1 is successfully decrypted. Note that if the timestamp is not fresh, the message will also be dropped. Then, V2 generates ciphertext c2, which will be sent to V1 together with its pseudonym PID2. V1 verifies the identity of V2 in the same way. After the identity verification is passed, the session key is calculated K=k1⊕k2. k1 is part of the ciphertext c1. Similarly, k2 is part of the ciphertext c2.If the attacker does not have the keyx, it can not generate valid ciphertexts. The vehicle’s public and private key pair x and y are based on the difficulty of factorization of large complex numbers, so no attackers can calculate the private key according to the public key in probabilistic polynomial time. In addition, the ciphertext and pseudonym are protected by the receiver’s public key. No one else can get the ciphertext and pseudonym.


## 5.3. Mutual Authentication

The proposed protocol can realize mutual authentication between vehicles andTAb. TAb uses PID′ sent by TAa to generate pseudonyms PID and public-private key pair QV,SV for vehicles. Vehicles use the public-private key pair sent by TAb to verify TAb. If the public-private key pair QV,SV are not sent by a legal TAb, the equation eSV,Pb=?eQV,pkb will not hold. In conclusion, TAb verifies whether vehicle V has submitted its real identity through PID′, and vehicle V judges whether TA is legal by equation eSV,Pb=?eQV,pkb. Thus, the mutual authentication between vehicles and TAb is achieved.The mutual authentication between vehicles is also achieved. Before V2V communicates, vehicleV1 needs to enquire TAb whether the pseudonym of the communication vehicle V2 is legal. Similarly, V2 confirms the legitimacy of V1 in the same way. Both the receiver vehicle and the sender vehicle need to confirm that the identity of the other party is legal before carrying out subsequent communication to avoid being attacked by attackers. Therefore, the proposed protocol realizes mutual authentication.


## 5.4. Reliability

In the registration phase, when the real identity (RID) is submitted by the vehicle, the communication contents are protected by TAa’s public key. Since the public-private key pair of TAa is secured based on the ECDLP assumption, no adversary can calculate the private key according to the public key in probabilistic polynomial time. Thus, the information submitted by the vehicle will not be stolen. In addition, PID, SV, and QV sent by TAb are encrypted by random number r, which is generated by the vehicle and discarded after being used once. No attacker including TAa can crack it within the effective time. So the registration phase is reliable.In the V2V communication phase, the message is protected by the public-private key pairx and y of the vehicle, and x and y are generated by RSA, which is based on the difficulty of factorization of a large complex number. No attackers can crack the private key x according to the public key y. Both ciphertexts and pseudonyms are well protected. Besides, the session key K is generated by random numbers generated by both communication parties. The random numbers are in the ciphertexts of the sending vehicles, and the ciphertexts are encrypted by the public key of the receiving parties. No attackers can obtain the random numbers. In conclusion, the V2V communication stage is reliable.


## 5.5. Anonymity

During the communication, vehicle always uses pseudonym as its identity. The entity communicating with it can only judge whether the pseudonym is legal but cannot know its real identity. The real identityRID of the vehicle will no longer appear in the communication contents after it is submitted to TAa in the registration phase. TAa will remove RID in time to prevent leakage. TAb calculates PID according to PID′ sent from TAa. PID is used as communication pseudonym of registered vehicles. No one knows the correspondence between pseudonyms and real names, including TAa and TAb. If a vehicle’s pseudonym expires, TAb can regenerate its pseudonym based on the current time.In the existing schemes, most of them store the corresponding relationship betweenPID and RID by a single TA, which has potential safety hazards. Once the TA is compromised, or information leakage occurs in the TA, incalculable hazards will happen. In the proposed scheme, two TAs are in charge of the corresponding relationship. If it is needed to recover the real identifier, two TAs must cooperate with each other. Moreover, there is no information about the real identifier in TA’s database. Even if the information is leaked, the damage is minimal, which greatly improves the security. Therefore, communication anonymity is realized.


## 5.6. Unforgeability

Unforgeability aims that only the intended vehicles can make valid ciphertexts and authentication messages. Attackers cannot forge valid ciphertexts and authentication messages generated by legitimate vehicles.In the vehicle andTAa authentication phase, the vehicle must submit its real identity in order to obtain a pseudo identifier and become a legitimate vehicle.In the V2V authentication, the vehicle must be able to generate a valid ciphertextc. At the same time, its pseudonym should exist in the database. If an attacker wants to impersonate vehicle V for communication, he can easily obtain the pseudonym of the vehicle V, because the pseudonym is public. However, he cannot generate a legal ciphertext to pass the verification. Since the private key x is generated by the vehicle itself based on the RSA algorithm, it is not feasible to calculate the private key x according to the public key y. Therefore, the ciphertext c is unforgeable.


## 5.7. Traceability

Traceability means thatTAa and TAb have the ability to reveal the real identity of a vehicle in VANETs when it is confirmed as a malicious vehicle.At first,TAb obtains the PID of malicious vehicle and calculates the corresponding PID′, where PID′=PID⊕Hbskb∥T∥T′, and then sends PID′ to TAa. TAa will recover the real identifier RID, where RID=PID′⊕Haska. Both TAa and TAb do not know the corresponding relationship between PID and RID. Only when they cooperate with each other can they recover vehicle’s real identity. If an attacker wants to capture the real identity corresponding to a pseudonym illegally, he needs to crack the private keys of TAa and TAb at the same time. Since ska and skb are random numbers in Zqa∗ and Zqb∗, respectively, it is almost impossible to crack them at the same time. Thus, traceability is achieved while improving security.


## 5.8. Nonrepudiation

Nonrepudiation aims that afterTAa traces the real identity of a malicious vehicle, the vehicle cannot deny that it has generate the ciphertext. There is no key escrow problem in the proposed protocol, and the private key x in V2V communication is generated by the vehicle itself. No attacker can calculate x based on the public key y. Therefore, even if TAa and TAb are semihonest, the private key x of the vehicle is only owned by itself, and no one else can obtain the private key x to make a legal ciphertext. In conclusion, the scheme is undeniable.


## 5.9. Related Attack

### 5.9.1. Replay Attack

A replay attack refers to that a malicious attacker reinjects previously received messages into the VANETs to achieve the purpose of attacking legitimate vehicles. In order to prevent the proposed scheme from replay attacks, we add a timestamp to ciphertexts. The ciphertext can only be made by the sender’s vehicle. No one else can forge a legal ciphertext, nor can it change the content of the ciphertext. This is because the attacker cannot obtain the sender’s private key. The receiving vehicle can decide whether to accept the message according to the freshness of the timestamp, and the replayed message cannot pass the verification. Therefore, the proposed scheme can effectively prevent the replay attacks.


### 5.9.2. Man-in-the-Middle Attack

In addition to replay attacks, the man-in-the-middle attack is also a common attack method used by attackers. Because VANETs use wireless public channel communication, they cannot completely resist attackers from eavesdropping on data packets. But all communication contents in our scheme are protected by key encryption.In the registration phase, during the submission of the real identity, the contents of the communication are protected by the public keys ofTAa and TAb, and attackers cannot obtain meaningful data even if the message is eavesdropped. In the process of pseudonym and public and private key distribution, the communication contents are encrypted and protected by random number r as a symmetric key. The random number r is generated by the vehicle and discarded after one use. Even if an attacker steals the ciphertext, he cannot infer and modify the content of the plaintext. Therefore, the registration phase can resist the man-in-the-middle attack.In the V2V communication stage, the communication contents are protected by the public key of the receiver vehicle, and the private key of the vehicle is only owned by himself. EvenTAa and TAb cannot know the content of the communication. If an attacker wants to crack the ciphertext, it needs to crack the RSA algorithm within a probabilistic polynomial time, which is impossible. Therefore, the communication phase can resist the man-in-the-middle attack. The security comparison is summarized in Table 2.Table 2
Security comparison.
SchemeReplay attackMan-in-the-middle attackAnonymityForgery attackTraceabilityNonrepudiationKey escrowGISI [6]√√√√√××ACPN [7]√×√√√√×PPDAS [19]√√√√√××VGKM [31]√√√√√××RA [21]√√√√√××ANEL [32]√√√√√√×P2-SHARP [33]√√√×√×/Our scheme√√√√√√√


## 5.9.1. Replay Attack

A replay attack refers to that a malicious attacker reinjects previously received messages into the VANETs to achieve the purpose of attacking legitimate vehicles. In order to prevent the proposed scheme from replay attacks, we add a timestamp to ciphertexts. The ciphertext can only be made by the sender’s vehicle. No one else can forge a legal ciphertext, nor can it change the content of the ciphertext. This is because the attacker cannot obtain the sender’s private key. The receiving vehicle can decide whether to accept the message according to the freshness of the timestamp, and the replayed message cannot pass the verification. Therefore, the proposed scheme can effectively prevent the replay attacks.


## 5.9.2. Man-in-the-Middle Attack

In addition to replay attacks, the man-in-the-middle attack is also a common attack method used by attackers. Because VANETs use wireless public channel communication, they cannot completely resist attackers from eavesdropping on data packets. But all communication contents in our scheme are protected by key encryption.In the registration phase, during the submission of the real identity, the contents of the communication are protected by the public keys ofTAa and TAb, and attackers cannot obtain meaningful data even if the message is eavesdropped. In the process of pseudonym and public and private key distribution, the communication contents are encrypted and protected by random number r as a symmetric key. The random number r is generated by the vehicle and discarded after one use. Even if an attacker steals the ciphertext, he cannot infer and modify the content of the plaintext. Therefore, the registration phase can resist the man-in-the-middle attack.In the V2V communication stage, the communication contents are protected by the public key of the receiver vehicle, and the private key of the vehicle is only owned by himself. EvenTAa and TAb cannot know the content of the communication. If an attacker wants to crack the ciphertext, it needs to crack the RSA algorithm within a probabilistic polynomial time, which is impossible. Therefore, the communication phase can resist the man-in-the-middle attack. The security comparison is summarized in Table 2.Table 2
Security comparison.
SchemeReplay attackMan-in-the-middle attackAnonymityForgery attackTraceabilityNonrepudiationKey escrowGISI [6]√√√√√××ACPN [7]√×√√√√×PPDAS [19]√√√√√××VGKM [31]√√√√√××RA [21]√√√√√××ANEL [32]√√√√√√×P2-SHARP [33]√√√×√×/Our scheme√√√√√√√


## 6. Performance Analysis

In this section, the performance of the proposed protocol will be briefly described. The proposed protocol adopts IBC and RSA encryption. IBC can greatly reduce the amount of computation and save the storage cost, considering that RSA decryption time is relatively long. The hardware decryption method based on the Montgomery algorithm [41] can help to improve the efficiency. Therefore, our protocol is efficient and does not require the vehicle to have high-performance computing equipment. We evaluate the efficiency of the whole authentication process according to communication cost, storage cost, and computational cost. The experimental environment is Intel (R) Core(TM) i7-8700 CPU @ 3.20 GHz, 8 GB RAM with 64-bit Windows 10 operating system.


### 6.1. Communication and Storage Cost

Communication cost refers to the number of bits of content transmitted in the channel, and storage cost is the cost of storing different parameters in the memory of each entity. The proposed scheme adopts IBC encryption technology, which eliminates the difficulty of traditional PKI key storage, and only needs to save a few parameters, greatly reducing the storage overhead compared with the existing schemes. For TA, the storage cost ofTAa only needs to store its private key secretly except for the public parameters, and there is almost no storage overhead. For TAb, the user’s pseudonym, pseudonym generation time, and valid time need to be stored in addition to the public parameter and private key. The storage overhead is directly proportional to the number of registered vehicles. For vehicles, in addition to the two public and private key pairs and their own pseudonyms, no additional data needs to be saved, and it does not change with the number of vehicles in the network.In different protocols, the authors used various variables. Generally speaking, the timestampCTS excepts 8 bytes, the real identifier CRID requires 10 bytes, the pseudonym CPID requires 10 bytes, the multiplication Cmul requires 10 bytes, the symmetric encryption/decryption CSE,CSD takes 16 bytes, the random number CR requires 16 bytes, the hash function Ch requires 32 bytes, and the communication message CM 100 bytes are required; 128 bytes are required for public key encryption and decryption CPE,CPD, 128 bytes are required for homomorphic encryption and decryption CHE,CHD, and 128 bytes are required for modular exponentiation CME; signature algorithm 1 CSIG1 requires 42 bytes, signature algorithm 2 CSIG2 requires 192 bytes, vehicle information Cinfo requires 100 bytes, and communication message CM requires 100 bytes. Besides, n denotes the number of vehicles. The communication and storage overhead are shown in Table 3.Table 3
Communication and storage cost.
SchemeCommunication costStorage costGSIS [6]CSIG25CRID+4CTS+2CM+CSIG1+CSIG2ACPN [7]10CRID+7CTS+7CPE+4CM+7CSIG15CPE+5CPDPPDAS [19]3CRID+6CTS+17Ch+6CPE+4Cmul+3CM5CRID+CTS+7ChVGKM [31]6CPE+CRID+CPID+CTS+CSIG23CR+2CRIDRA [21]CRID+5CPID+2CR+3CHE2CPID+2CR+nCRIDANEL [32]Cinfo+7CR+2CPID+2CRID+CM+Ch+CTS2CPID+CRID+4Ch+7CR+2CTSP2-SHARP [33]-LWN3CRID+4CTS+8Ch5CRID+2ChP2-SHARP [33]-GWNCRID+2CTS+6Ch5CRID+2ChOur schemeCPID+3CPE+2CSE4CR+2CPID+2CTS


### 6.2. Computational Cost

The computational cost refers to the time required for cryptographic operations in the phases of pseudonym generation, public-private key pair generation, identity tracking, etc. Four aspects are mainly involved in the registration phase: pseudonym generation, identity-based public and private key pair generation, bilinear pair verification calculation, and RSA public and private key generation. The pseudonym generation includes two XOR operations and two hash operations. Public and private key generation includes a multiplication operation and a hash operation. When verifying the legality of the TA, a bilinear calculation is performed. The calculation of the bilinear calculation is complicated, but compared with other existing solutions, the verification process of the TA by the vehicle is provided; thus, the mutual authentication is realized, and the security in the registration phase is significantly improved. RSA decryption takes a long time, but fortunately, there are many ways to improve the efficiency of RSA decryption, such as hardware decryption.In the V2V communication phase, in addition to the necessary communication encryption and ciphertext calculation, each vehicle needs to calculate the public keyy of the vehicle communicating with it. The process of calculating the public key y includes a hash operation and a multiplication operation. Although the amount of calculation has been slightly increased, the difficulty of storing traditional PKI public key certificates is eliminated. Now, TAb only needs to store the pseudonym and its validity time locally, and other required content can be calculated based on public parameters, reducing the storage cost of TA. Moreover, the vehicle has to calculate the session key, which requires only one XOR operation.In the tracing phase,TAa and TAb only need to perform a hash operation and an exclusive XOR operation, respectively.Different authors use a variety of operations in their protocols. According to our simulation results, it is measured as follows: one-way hash function operation time:Th=0.0020ms; public key encryption and decryption time: TPE=4.4063ms; TPD=7.7613ms; symmetric encryption and decryption time: TSE=4.4063ms, TSD=7.7613ms; homomorphic encryption and decryption time: THE=1.879ms, THD=1.879ms; signature time and verification signature time: TSIG=24.8351 ms, TSIGV=1.8235 ms, multiplication, division, and addition operation time: Tmul=0.0268ms, Tdiv=0.0012ms, and Tadd=0.0017ms; MAC calculation time: TMAC=0.0097ms; bilinear pairing calculation time: TBP=4.2100ms; and exponential operation time: TE=0.0399ms. Compared with other operations, the time of XOR operation is negligible.It is worth noting that our scheme adopts multiple cryptographic techniques such as public key encryption, symmetric encryption, and bilinear pairing to improve security. As a result, the proposed scheme realizes multiple requirements that cannot be met by existing protocols at the same time, such as mutual authentication, key escrow, and V2V communication issues, which caused our execution running time to be a little long. Specifically, in the pseudonym generation phase, we adopt double TA to generate users’ pseudonyms, and the process of transmitting information is encrypted with public keys. Compared with existing protocols, most of the user’s identity information is transmitted through a secure channel [6, 19, 21, 32, 33], and our scheme is more suitable for real environments. This phase takes about 36.5028 ms. Then, we adopt a bilinear pair to achieve mutual authentication, which is optional. The vehicle can choose whether to verify the identity of TA. It consumes about 4.21 ms. Most of the existing protocols only carry out the identity authentication between vehicles and TA [31–33]. We use three public key encryptions to realize the authentication between vehicles and the generation of the session key. After that, the communication content of the vehicle is protected by the symmetric encryption key. No one else can know the content of the message. The authentication between vehicles consumes about 16.5739 ms. The computational cost is shown in Table 4. If the proposed protocol also adopts a secure channel for registration and only performs authentication between vehicles and TA, it only takes 0.004 ms to complete the registration. The computational cost comparison is shown in Figure 4. Note that in the process of authentication and pseudonym generation, ACPN [7] adopts multiple signature operations, and VGKM [31] uses public key encryption and decryption operations, so their execution time is extremely long compared with other protocols.Table 4
Our computational cost under realistic conditions.
PhaseExecution time (ms)Registration phase (public channel)36.5028Mutual authentication4.2100V2V authentication and communication16.5739Total57.2867Figure 4
Authentication process in a secure channel.


## 6.1. Communication and Storage Cost

Communication cost refers to the number of bits of content transmitted in the channel, and storage cost is the cost of storing different parameters in the memory of each entity. The proposed scheme adopts IBC encryption technology, which eliminates the difficulty of traditional PKI key storage, and only needs to save a few parameters, greatly reducing the storage overhead compared with the existing schemes. For TA, the storage cost ofTAa only needs to store its private key secretly except for the public parameters, and there is almost no storage overhead. For TAb, the user’s pseudonym, pseudonym generation time, and valid time need to be stored in addition to the public parameter and private key. The storage overhead is directly proportional to the number of registered vehicles. For vehicles, in addition to the two public and private key pairs and their own pseudonyms, no additional data needs to be saved, and it does not change with the number of vehicles in the network.In different protocols, the authors used various variables. Generally speaking, the timestampCTS excepts 8 bytes, the real identifier CRID requires 10 bytes, the pseudonym CPID requires 10 bytes, the multiplication Cmul requires 10 bytes, the symmetric encryption/decryption CSE,CSD takes 16 bytes, the random number CR requires 16 bytes, the hash function Ch requires 32 bytes, and the communication message CM 100 bytes are required; 128 bytes are required for public key encryption and decryption CPE,CPD, 128 bytes are required for homomorphic encryption and decryption CHE,CHD, and 128 bytes are required for modular exponentiation CME; signature algorithm 1 CSIG1 requires 42 bytes, signature algorithm 2 CSIG2 requires 192 bytes, vehicle information Cinfo requires 100 bytes, and communication message CM requires 100 bytes. Besides, n denotes the number of vehicles. The communication and storage overhead are shown in Table 3.Table 3
Communication and storage cost.
SchemeCommunication costStorage costGSIS [6]CSIG25CRID+4CTS+2CM+CSIG1+CSIG2ACPN [7]10CRID+7CTS+7CPE+4CM+7CSIG15CPE+5CPDPPDAS [19]3CRID+6CTS+17Ch+6CPE+4Cmul+3CM5CRID+CTS+7ChVGKM [31]6CPE+CRID+CPID+CTS+CSIG23CR+2CRIDRA [21]CRID+5CPID+2CR+3CHE2CPID+2CR+nCRIDANEL [32]Cinfo+7CR+2CPID+2CRID+CM+Ch+CTS2CPID+CRID+4Ch+7CR+2CTSP2-SHARP [33]-LWN3CRID+4CTS+8Ch5CRID+2ChP2-SHARP [33]-GWNCRID+2CTS+6Ch5CRID+2ChOur schemeCPID+3CPE+2CSE4CR+2CPID+2CTS


## 6.2. Computational Cost

The computational cost refers to the time required for cryptographic operations in the phases of pseudonym generation, public-private key pair generation, identity tracking, etc. Four aspects are mainly involved in the registration phase: pseudonym generation, identity-based public and private key pair generation, bilinear pair verification calculation, and RSA public and private key generation. The pseudonym generation includes two XOR operations and two hash operations. Public and private key generation includes a multiplication operation and a hash operation. When verifying the legality of the TA, a bilinear calculation is performed. The calculation of the bilinear calculation is complicated, but compared with other existing solutions, the verification process of the TA by the vehicle is provided; thus, the mutual authentication is realized, and the security in the registration phase is significantly improved. RSA decryption takes a long time, but fortunately, there are many ways to improve the efficiency of RSA decryption, such as hardware decryption.In the V2V communication phase, in addition to the necessary communication encryption and ciphertext calculation, each vehicle needs to calculate the public keyy of the vehicle communicating with it. The process of calculating the public key y includes a hash operation and a multiplication operation. Although the amount of calculation has been slightly increased, the difficulty of storing traditional PKI public key certificates is eliminated. Now, TAb only needs to store the pseudonym and its validity time locally, and other required content can be calculated based on public parameters, reducing the storage cost of TA. Moreover, the vehicle has to calculate the session key, which requires only one XOR operation.In the tracing phase,TAa and TAb only need to perform a hash operation and an exclusive XOR operation, respectively.Different authors use a variety of operations in their protocols. According to our simulation results, it is measured as follows: one-way hash function operation time:Th=0.0020ms; public key encryption and decryption time: TPE=4.4063ms; TPD=7.7613ms; symmetric encryption and decryption time: TSE=4.4063ms, TSD=7.7613ms; homomorphic encryption and decryption time: THE=1.879ms, THD=1.879ms; signature time and verification signature time: TSIG=24.8351 ms, TSIGV=1.8235 ms, multiplication, division, and addition operation time: Tmul=0.0268ms, Tdiv=0.0012ms, and Tadd=0.0017ms; MAC calculation time: TMAC=0.0097ms; bilinear pairing calculation time: TBP=4.2100ms; and exponential operation time: TE=0.0399ms. Compared with other operations, the time of XOR operation is negligible.It is worth noting that our scheme adopts multiple cryptographic techniques such as public key encryption, symmetric encryption, and bilinear pairing to improve security. As a result, the proposed scheme realizes multiple requirements that cannot be met by existing protocols at the same time, such as mutual authentication, key escrow, and V2V communication issues, which caused our execution running time to be a little long. Specifically, in the pseudonym generation phase, we adopt double TA to generate users’ pseudonyms, and the process of transmitting information is encrypted with public keys. Compared with existing protocols, most of the user’s identity information is transmitted through a secure channel [6, 19, 21, 32, 33], and our scheme is more suitable for real environments. This phase takes about 36.5028 ms. Then, we adopt a bilinear pair to achieve mutual authentication, which is optional. The vehicle can choose whether to verify the identity of TA. It consumes about 4.21 ms. Most of the existing protocols only carry out the identity authentication between vehicles and TA [31–33]. We use three public key encryptions to realize the authentication between vehicles and the generation of the session key. After that, the communication content of the vehicle is protected by the symmetric encryption key. No one else can know the content of the message. The authentication between vehicles consumes about 16.5739 ms. The computational cost is shown in Table 4. If the proposed protocol also adopts a secure channel for registration and only performs authentication between vehicles and TA, it only takes 0.004 ms to complete the registration. The computational cost comparison is shown in Figure 4. Note that in the process of authentication and pseudonym generation, ACPN [7] adopts multiple signature operations, and VGKM [31] uses public key encryption and decryption operations, so their execution time is extremely long compared with other protocols.Table 4
Our computational cost under realistic conditions.
PhaseExecution time (ms)Registration phase (public channel)36.5028Mutual authentication4.2100V2V authentication and communication16.5739Total57.2867Figure 4
Authentication process in a secure channel.


## 7. Conclusion

In this paper, we propose an identity-based mutual authentication model for improving the security and privacy of communication vehicles in VANETs. IBMA is an identity-based anonymous authentication scheme which adopts identity-based encryption to reduce the storage cost of the system and solves the common key escrow problems in identity-based encryption. In addition, in order to further protect the sensitive and private information of vehicles, the central authority in this scheme is semitrusted rather than completely trusted. IBMA achieves a set of desired properties, such as mutual authentication, vehicle-to-vehicle communication, identity tracing, and resistance to various attacks. In our future work, we will explore more efficient encryption algorithms and key generation algorithms to further improve the efficiency of IBMA.



---

*Source: 7881079-2022-04-19.xml*