# Trust-Based Certificateless Privacy-Preserving Authentication in Internet of Vehicles

Authors: Chang Yu; Kezhong Lu
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Owing to the security requirements of Internet of vehicles (IOV), it is necessary to design a secure privacy-preserving scheme for communication. Traditional privacy-preserving schemes have two deficiencies. One is the high cost of computation and communication. Another is the inability to prevent the spread of malicious or modified messages. Motivated by those facts, we proposed a trust-based authentication scheme for certificateless privacy-preserving of IOV, based on the advantages of the short key, fast speed, and high security performance of elliptic curve cryptography (ECC). We proposed a method to replace the revocation list by authenticating trust to prevent broadcasting fake and altered massages. Our scheme can encrypt the message sent by the node while adopting a certificateless authentication method to complete the anonymous authentication function, which protects the privacy of the node information and effectively reduces the system storage load. In addition, aggregate signatures can effectively reduce computational and communication overhead. It is proven theoretically that the proposed scheme can satisfy correctness, anonymity, confidentiality of messages, and unforgeability of signatures. Therefore, this scheme is more suitable for the deployment and application of physical IOV.


---

## Body

## 1. Introduction

Internet of vehicles (IOV) are applications of mobile ad hoc networks (MANETs) and wireless sensor networks in the field of intelligent transportation to implement the communication between intelligent vehicles and increase the safety and efficiency of road traffic. The key features that distinguish IOV from other MANETs are vehicle density, self-organization, multihop, rapid change of network topology, limited network capacity, no power and storage constraints, predictable node mobility patterns owing to fixed roads and lanes, and a large number of nodes in urban traffic [1]. A typical IOV architecture usually includes three components: service center, road side unit (RSU), and a vehicle node that configures the onboard unit (OBU), where the OBU is mounted on the vehicle to provide wireless communication capabilities. The RSU is used to provide a wireless and radio-covered vehicle interface [2]. As networks become more common, there is a growing need for vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communications [3], and the communication between V2V and V2I is realized by dedicated short range communication (DSRC) [4] systems. Most importantly, the IOV is a promising technology for providing effective traffic management solutions, navigation-based services, infotainment, and vehicle safety.Privacy and security issues in IOV have attracted a significant amount of attention. Since IOV supports emergent real-time applications and processes vital message, relevant schemes should meet security requirements such as privacy, confidentiality, integrity, and nonrepudiation to provide secure communication to attackers and malicious nodes [5]. All Kinds of security attacks such as denial of service (DOS), Sybil attack, illusion attack, and wormhole attack will affect the privacy of the vehicle and possibly lead to traffic congestion, misinformation dissemination, positioning and identity leakage, disguise or forgery of data, and intrusion of private information. Therefore, data security and privacy-preserving issues in the IOV environment have become the focus of attention [2, 6].A number of asymmetric cryptography-based security authentication schemes have been proposed to prevent such attacks. Anonymous authentication is one of the basic methods used for preserving privacy. The typical anonymous authentication mechanisms in IOV include pseudonyms, random silence, group signatures, ring signatures, blind signatures, and smart cards. In recent years, scholars have proposed a variety of anonymous schemes for IOV security authentication, such as digital signature scheme [7] and group signature scheme [8] based on public key infrastructure (PKI). However, these traditional anonymous authentication schemes have the following disadvantages. (1) The computational and communication costs of message authentication are large. In the case of high traffic density, there will be more delay, and a large number of messages will get lost. (2) Requirement for vehicle to store a large number of certificates and dependence on the revocation list to achieve vehicles revocation. It results in a large storage overhead of the system. Therefore, improving the efficiency of anonymous authentication based on ensuring security is also one of the principal challenges facing IOV [9].Except for efficiency issues, authentication mechanism also has a major limitation, as it only ensures that the messages are transmitted from a legitimate sender, and does not prevent legitimate senders from maliciously spreading false or modified information to other vehicles. False or altered messages can reduce traffic efficiency and, at worst, threaten people’s lives. The question to be considered is how a vehicle decides whether to believe a message sent by a dependable vehicle. In order to prevent the above problems from causing improper behavior of the vehicle, misconduct detection mechanisms [10] and reputation systems [11] have been put forward. Trust vehicles can be distinguished from untrusted vehicles by building trust relationships and detecting malicious behavior in IOV, thereby preventing the vehicle from being misdirected by other malicious vehicles. Therefore, trust is essential to protect IOV. Anonymous authentication trust is becoming a compelling method of preserving privacy in IOV. Nevertheless, there is a lack of research on this topic, especially for the IOV system. Trust management of IOV [12] has been studied and attempted.In this study, we propose a certificateless anonymous authentication scheme based on the trust of the IOV. In our scheme, the trust value is combined with the traditional encryption scheme for preserving privacy. Only if the vehicle generating the message has a certain trust value, the message is thought to be reliable. The proposed method can not only ensure the effective communication of vehicles in the vehicle network but also make sure the vehicles receive information that is reliable. The basic principle of the scheme is to allow a trusted authority (TA) or authorized parties (AP) to announce the latest aggregate list of integrated node trust (INT) and verify the node trust without certificates. In our proposed scheme, a TA updates the trust value of each vehicle, stores the values in the trust value table using hashing techniques, and then broadcasts the trust value table. Thus, all vehicles can obtain the trust value of the adjacent vehicle by querying the trust value table to strengthen security. Depending upon the location of the trust value in the INT aggregation list, the receiving node can verify the sender’s message anonymously and without a certificate, and aggregate signatures can effectively reduce the computational costs and communication overhead. Furthermore, multiple APs may flexibly coordinated to achieve trust authentication while supporting aggregation signature verification. The method can provide fast, anonymous authentication and preserve privacy, and can ensure the reliability of the message of V2V communication.


### 1.1. Our Contributions

The main contributions of the proposed scheme are summarized:(i)
We propose a scheme to guarantee the security of communication and the reliability of messages in IOV by combining trust with traditional privacy-preserving encryption scheme. We demonstrated that the proposed method was secure, and evaluated the performance by analyzing the proposed scheme.(ii)
We propose a method to replace the revocation list by authenticating trust, and our scheme does not involve PKI certificates, thus reducing the storage burden of the system vehicles. It also does not involve complex bilinear pairing operations, which effectively improves authentication efficiency.


### 1.2. Organization

The rest of this article is arranged as following: Section2 describes the related work of the proposed scheme. Section 3 introduces preliminaries and background information. In Section 4, we described the proposed scheme in detail. Section 5 gives a proof of the security in the random oracle model under ECDLP. Security analysis and performance evaluation are described in detail in Section 6. Finally, Section 7 summarizes the future work of this paper.


## 1.1. Our Contributions

The main contributions of the proposed scheme are summarized:(i)
We propose a scheme to guarantee the security of communication and the reliability of messages in IOV by combining trust with traditional privacy-preserving encryption scheme. We demonstrated that the proposed method was secure, and evaluated the performance by analyzing the proposed scheme.(ii)
We propose a method to replace the revocation list by authenticating trust, and our scheme does not involve PKI certificates, thus reducing the storage burden of the system vehicles. It also does not involve complex bilinear pairing operations, which effectively improves authentication efficiency.


## 1.2. Organization

The rest of this article is arranged as following: Section2 describes the related work of the proposed scheme. Section 3 introduces preliminaries and background information. In Section 4, we described the proposed scheme in detail. Section 5 gives a proof of the security in the random oracle model under ECDLP. Security analysis and performance evaluation are described in detail in Section 6. Finally, Section 7 summarizes the future work of this paper.


## 2. Related Work

In the last several years, scholars have done a lot of research on the preserving privacy and data security of nodes in IOV.


### 2.1. Anonymous Authentication

Many anonymous authentication schemes have been proposed for IOV, which can be divided into five categories based on the encryption mechanism employed: public key infrastructure (PKI), certificateless signature, symmetric cryptography, identity-based signature, and group signature.To realize preserving privacy and security in IOV, in 2007, Raya and Hubaux [13] used anonymous certificates to hide the identity of users and a PKI-based scheme is proposed. Raya advises to store huge amounts of public/private keys and corresponding certificates in each vehicle, and the vehicle randomly selects the certificate to sign the message. The privacy of the vehicle is protected by regular replacement of keys and certificates. In 2008, Lu et al. [2] proposed an efficient conditional privacy preservation (ECPP) protocol based on bilinear mapping. The main limitation of ECPP is the large latency of RSU in generating pseudonym. In 2012, Shim proposed an identity-based signature scheme [14], which stores the master key in the vehicle’s tamper-proof device. The vehicle can use the system master key to generate pseudo-names and other information. In 2013, Horng et al. proposed a scheme [15] to use RSU to generate different pseudo-names for vehicles to generate a distinctive anonymous authentication scheme, avoiding the use of a great deal of public and private key pairs by using pseudonym communication. However, guaranteeing the security of the RSU is also a problem. Shao et al. [16] through the use of the new group signature scheme proposed new IOV authentication protocol. However, it can cause random tracking, which reduces user privacy. In 2018, Li et al. [17] proposed an anonymous conditional privacy-preserving authentication scheme based on pseudoidentity method. Each OBU should prestore pseudoidentity in order to maintain their identity privacy. Liu et al. [18] designed a distributed MAC layer antiattack pseudonym scheme. In 2019, Liu et al. [19] designed an anonymous authentication scheme based on group signature, where area TA provided anonymous authentication services. Boualouache et al. [20] proposed an effective pseudonym changing and management framework. This approach can keep the message integrity, and the sender’s privacy, but it also has some disadvantages. When the vehicle’s private key has been revoked, the system needs to be updated regularly for vehicle certificate; it may take time. Key distribution, management, and storage are challenges. To solve these problems, Du et al. [21] designed a certificateless signature scheme combined with certificateless public key cryptography. Zhong et al. [22] presented a full aggregation authentication scheme for VANETs, which achieved conditional privacy protection by using pseudonyms. In 2020, Bayat et al. [23] proposed a new security and privacy protection scheme based on RSU. In this scheme, the TA stored the master key in the temper-proof device of the RSU, and the verifier used the public key of the RSU instead of the system to check whether the signature is valid. Therefore, vehicles cannot check the signatures of other vehicles on the road from other RSUs. However, bilinear pairing and map-to-point operations are used in the scheme, which results in high computational overhead. Verma et al. [24] proposed the pairing-free certificate-based aggregated signature scheme. Xu et al. [25] proposed a certificateless signature scheme based on the CDH assumption. However, the scheme utilized the expensive map-to-point hash function, which also increased computational and communication overhead. To reduce computational and bandwidth costs, Mei et al. [26] proposed a conditional privacy certificateless signature scheme, which achieved full aggregation. But the scheme is also based on bilinear pairing. To further reduce the overhead of the vehicle, Chen et al. [27] designed a certificateless aggregated signature scheme without the expensive map-to-point hash function and bilinear pairing operations. Ali et al. [28] proposed a certificateless short signature-based conditional privacy-preserving authentication scheme based on ECC, which supported the batch signature verification method. Table 1 provides the nature of the above scheme for the sake of clarity.Table 1
Properties of related IOV schemes.
SchemeCrypto.primitiveComp.&comm.costRaya and Hubaux [13]PKIHighLu et al. [2]Group signatureMediumShim [14]ID basedLowShao et al. [16]Group signatureMediumHowever, only anonymity is not sufficient to prevent an attacker from illegally tracking, even if the broadcast message remains completely anonymous [29]. In addition, traditional public key infrastructure (PKI) guarantees user identity authentication in IOV; however, PKI cannot distinguish untrustworthy information from authorized users. Therefore, a trust evaluation is necessary to guarantee the trustworthiness of information by distinguishing malicious users from networks.


### 2.2. Trust

The issue of trust stems from the field of security and social psychology. In the past decade, the concept of trust has been suggested to introduce information and communication technology (ICT). There is little research about trust management of IOV during the preceding years. In 2014, MC Chuang and Lee [30] proposed a lightweight authentication scheme for distributed trust extension, called trust extension authentication mechanism, applicable to the vehicle network, with good anonymity and security. In fact, they are designed to further enhance the performance of the authentication process by using the concept of passing trust relationships. Nevertheless, because of the selfish and malicious nodes, the security of mobile ad hoc networks has been greatly reduced. Then, Sugumar et al. [31] proposed a trust-based authentication protocol for cluster-based IOV in 2016. The vehicles are clustered and the trust level of each node is estimated. Inspired by the estimated trust, the cluster head is selected. Because the CRL check requires time, the group signature-based scheme has a long computing delay. In 2018, Yan et al. [32] proposed a scheme to anonymously verify the trust of pervasive social networking (PSN) nodes in a semi-distributed way. It was emphasized that trust plays an important role in maintaining pervasive social networking. It can be seen that anonymous authentication of trust is emerging as a novel way to ensure privacy. In 2020, Liang et al. [33] proposed a reputation scheme based on implicit generalized mixed transition distribution model, which can evaluate the credibility of neighbor vehicles. Begriche et al. [34] proposed a vehicle-mounted network reputation system node based on Bayesian statistical filter that would establish a profile based on the behavior of its neighbors. However, there are only two categories of vehicle states. In the same year, Awan et al. [35] proposed a centralized trust-based clustering mechanism, using multiple parameters to select reliable cluster head and a backup cluster head, thus improving network security. In addition, the method selects a backup cluster head to achieve stable clusters. However, the scheme relies on the RSU. Alnasser et al. [36] proposed a recommendation-based trust model. The trust of this model comes from two methods: direct trust and indirect trust, but the trust value is calculated in the way of weighted sum, which cannot resist collusion attacks. Chen et al. [37] proposed a decentralized trust management system based on blockchain. The trust model only allows trusted nodes to participate in the verification and consensus process, and a trusted execution environment is applied to protect the trust evaluation process and an incentive model for incentivizing more participation and punishing malicious behavior. Gao [38] proposed a trust management scheme. In the scheme, the trust of nodes includes direct trust and recommendation trust. Direct trust is computed dynamically through history and Bayesian inference. Recommendation trust takes into account the trust and reputation of other nodes and their reputation. Ahmad et al. [39] proposed a hybrid trust management scheme called NOTRINO, which calculates the trust value of nodes at the transport layer and calculates the trust value of data at the application layer.Unlike all the previous work, this paper combines IOV application scenarios based on the research trust-based [32] and encryption scheme [40], a certificateless anonymous authentication scheme suitable for preserving privacy is proposed for IOV.


## 2.1. Anonymous Authentication

Many anonymous authentication schemes have been proposed for IOV, which can be divided into five categories based on the encryption mechanism employed: public key infrastructure (PKI), certificateless signature, symmetric cryptography, identity-based signature, and group signature.To realize preserving privacy and security in IOV, in 2007, Raya and Hubaux [13] used anonymous certificates to hide the identity of users and a PKI-based scheme is proposed. Raya advises to store huge amounts of public/private keys and corresponding certificates in each vehicle, and the vehicle randomly selects the certificate to sign the message. The privacy of the vehicle is protected by regular replacement of keys and certificates. In 2008, Lu et al. [2] proposed an efficient conditional privacy preservation (ECPP) protocol based on bilinear mapping. The main limitation of ECPP is the large latency of RSU in generating pseudonym. In 2012, Shim proposed an identity-based signature scheme [14], which stores the master key in the vehicle’s tamper-proof device. The vehicle can use the system master key to generate pseudo-names and other information. In 2013, Horng et al. proposed a scheme [15] to use RSU to generate different pseudo-names for vehicles to generate a distinctive anonymous authentication scheme, avoiding the use of a great deal of public and private key pairs by using pseudonym communication. However, guaranteeing the security of the RSU is also a problem. Shao et al. [16] through the use of the new group signature scheme proposed new IOV authentication protocol. However, it can cause random tracking, which reduces user privacy. In 2018, Li et al. [17] proposed an anonymous conditional privacy-preserving authentication scheme based on pseudoidentity method. Each OBU should prestore pseudoidentity in order to maintain their identity privacy. Liu et al. [18] designed a distributed MAC layer antiattack pseudonym scheme. In 2019, Liu et al. [19] designed an anonymous authentication scheme based on group signature, where area TA provided anonymous authentication services. Boualouache et al. [20] proposed an effective pseudonym changing and management framework. This approach can keep the message integrity, and the sender’s privacy, but it also has some disadvantages. When the vehicle’s private key has been revoked, the system needs to be updated regularly for vehicle certificate; it may take time. Key distribution, management, and storage are challenges. To solve these problems, Du et al. [21] designed a certificateless signature scheme combined with certificateless public key cryptography. Zhong et al. [22] presented a full aggregation authentication scheme for VANETs, which achieved conditional privacy protection by using pseudonyms. In 2020, Bayat et al. [23] proposed a new security and privacy protection scheme based on RSU. In this scheme, the TA stored the master key in the temper-proof device of the RSU, and the verifier used the public key of the RSU instead of the system to check whether the signature is valid. Therefore, vehicles cannot check the signatures of other vehicles on the road from other RSUs. However, bilinear pairing and map-to-point operations are used in the scheme, which results in high computational overhead. Verma et al. [24] proposed the pairing-free certificate-based aggregated signature scheme. Xu et al. [25] proposed a certificateless signature scheme based on the CDH assumption. However, the scheme utilized the expensive map-to-point hash function, which also increased computational and communication overhead. To reduce computational and bandwidth costs, Mei et al. [26] proposed a conditional privacy certificateless signature scheme, which achieved full aggregation. But the scheme is also based on bilinear pairing. To further reduce the overhead of the vehicle, Chen et al. [27] designed a certificateless aggregated signature scheme without the expensive map-to-point hash function and bilinear pairing operations. Ali et al. [28] proposed a certificateless short signature-based conditional privacy-preserving authentication scheme based on ECC, which supported the batch signature verification method. Table 1 provides the nature of the above scheme for the sake of clarity.Table 1
Properties of related IOV schemes.
SchemeCrypto.primitiveComp.&comm.costRaya and Hubaux [13]PKIHighLu et al. [2]Group signatureMediumShim [14]ID basedLowShao et al. [16]Group signatureMediumHowever, only anonymity is not sufficient to prevent an attacker from illegally tracking, even if the broadcast message remains completely anonymous [29]. In addition, traditional public key infrastructure (PKI) guarantees user identity authentication in IOV; however, PKI cannot distinguish untrustworthy information from authorized users. Therefore, a trust evaluation is necessary to guarantee the trustworthiness of information by distinguishing malicious users from networks.


## 2.2. Trust

The issue of trust stems from the field of security and social psychology. In the past decade, the concept of trust has been suggested to introduce information and communication technology (ICT). There is little research about trust management of IOV during the preceding years. In 2014, MC Chuang and Lee [30] proposed a lightweight authentication scheme for distributed trust extension, called trust extension authentication mechanism, applicable to the vehicle network, with good anonymity and security. In fact, they are designed to further enhance the performance of the authentication process by using the concept of passing trust relationships. Nevertheless, because of the selfish and malicious nodes, the security of mobile ad hoc networks has been greatly reduced. Then, Sugumar et al. [31] proposed a trust-based authentication protocol for cluster-based IOV in 2016. The vehicles are clustered and the trust level of each node is estimated. Inspired by the estimated trust, the cluster head is selected. Because the CRL check requires time, the group signature-based scheme has a long computing delay. In 2018, Yan et al. [32] proposed a scheme to anonymously verify the trust of pervasive social networking (PSN) nodes in a semi-distributed way. It was emphasized that trust plays an important role in maintaining pervasive social networking. It can be seen that anonymous authentication of trust is emerging as a novel way to ensure privacy. In 2020, Liang et al. [33] proposed a reputation scheme based on implicit generalized mixed transition distribution model, which can evaluate the credibility of neighbor vehicles. Begriche et al. [34] proposed a vehicle-mounted network reputation system node based on Bayesian statistical filter that would establish a profile based on the behavior of its neighbors. However, there are only two categories of vehicle states. In the same year, Awan et al. [35] proposed a centralized trust-based clustering mechanism, using multiple parameters to select reliable cluster head and a backup cluster head, thus improving network security. In addition, the method selects a backup cluster head to achieve stable clusters. However, the scheme relies on the RSU. Alnasser et al. [36] proposed a recommendation-based trust model. The trust of this model comes from two methods: direct trust and indirect trust, but the trust value is calculated in the way of weighted sum, which cannot resist collusion attacks. Chen et al. [37] proposed a decentralized trust management system based on blockchain. The trust model only allows trusted nodes to participate in the verification and consensus process, and a trusted execution environment is applied to protect the trust evaluation process and an incentive model for incentivizing more participation and punishing malicious behavior. Gao [38] proposed a trust management scheme. In the scheme, the trust of nodes includes direct trust and recommendation trust. Direct trust is computed dynamically through history and Bayesian inference. Recommendation trust takes into account the trust and reputation of other nodes and their reputation. Ahmad et al. [39] proposed a hybrid trust management scheme called NOTRINO, which calculates the trust value of nodes at the transport layer and calculates the trust value of data at the application layer.Unlike all the previous work, this paper combines IOV application scenarios based on the research trust-based [32] and encryption scheme [40], a certificateless anonymous authentication scheme suitable for preserving privacy is proposed for IOV.


## 3. Preliminaries

In this section, we will briefly cover the mathematical foundations, system model, security and authentication requirements.


### 3.1. Mathematical Foundations

This subsection describes some of the basics associated with anonymous authentication protocols, namely, elliptic curve cryptography (ECC) and mathematical assumptions.


#### 3.1.1. Elliptic Curve Cryptography (ECC)

After elliptic curve cryptography was proposed by Koblitz [41] and Miller [42] in 1986, respectively, ECC began to be commonly used in security-related fields such as encryption and protocols. In the following sections, we briefly introduce elliptic curve cryptography, which is extensively used to design many encryption and security schemes because of its availability in computing and communication costs. In the case that the safety strength provided is the same as that of the discrete logarithm system, the parameters required by ECC are far less than those of the discrete log-based system [43]. The elliptic curve can be characterized by the set of solutions of a two element equation.If the groupG is a finite cyclic group on the elliptic curve E, its order is p and the generator is P. Let p be a prime number greater than 3, and the elliptic curve y2=x3+ax+b on Zp consist of a group of solutions x,y∈Zp×Zp based on congruence y2≡x3+ax+bmodp and an exceptional point o called infinite point, where a,b∈Zp comprises two constants satisfying 4a3+27b2≠0modp. In addition, G has two rules of operation:(1)
Addition±: let P,Q∈G, if P≠Q, R=P+Q, then R is the point where the line crosses P and Q and E; if P=Q , R=P+Q, then R is the intersection of the tangent of E and PQ; if P=−Q, there is P+Q=P−P=O.(2)
Scalar multiplication⋅: let P∈G, m∈Zq∗, and P have a scalar multiplication of m⋅P=P+P+⋯+P (m times in total).


#### 3.1.2. Difficult Problem

LetG be a finite cyclic group with large prime q on an elliptic curve and P be a generator. To demonstrate the security of our scheme, two difficult problems are defined. The mathematical difficulties of participating in the proposed scheme are shown.Definition 1.
Elliptic curve discrete logarithm problem (ECDLP): random pointP,Q∈G on E are presented, and Q=xP, output x∈Zq∗.Definition 2.
Computation of Diffie–Hellman problem (CDHP): givenP,aP,bP∈G, where a,b∈Zq∗, calculate abP.If the algorithm of the ECDLP or the CDHP on the groupG cannot be solved by a nonnegligible probability ε within the time τ, then the ECDLP or the CDHP is difficult in the group G.


### 3.2. System Model

We describe the system model of the proposed anonymous authentication scheme in Figure1. The trusted authority (TA) has adequacy functions and is trusted to provide identity management and trust management. What is more, TA or IOV nodes that are more stable and dependable than other vehicle nodes (for example, wi-fi access points and base stations) can act as authorizers (AP). AP uses adequate information about nodes to estimate the trust value of the node. In order to achieve instant communication, the nodes interact with each other. Because message integrity and privacy are important, it is necessary to verify node trust anonymously for reliable communication and preserving privacy. TA is used by vehicle nodes to manage the correspondence among real identity, pseudonym, key and trust in the cloud to save computing and storage costs. When the TA is inaccessible, the IOV node can use some of the IOV nodes as APs to correspond to each other.(1)
Trusted authority (TA): it is based on the assumption that TA is fully trusted and has sufficient computing and storage capacity. Through a secure channel, entities (vehicles and RSU) must register with the TA using some personal credentials that uniquely identify the entity. TA is responsible for the registration of fixed RSU on the roadside and mobile OBU installed on vehicles and can reveal the true OBU identity of secure messages.(2)
Road side units (RSU): suppose the RSUs are widely deployed on the road and can be viewed as the router between the TA and vehicle nodes. RSU are not entirely credible, so they have to be supervised by TA.(3)
Vehicles (OBU): each vehicle is equipped with OBU which has a shorter communication range and less computing power than RSU. With the built-in OBU and DSRC protocols, each vehicle can communicate with neighboring vehicles, RSU and TA. The real identity of the vehicle and some secret information about the operation are stored in the OBU.Figure 1
The system model of IOV.


### 3.3. Security Requirements

Because messages are transported in an open access environment, security and privacy issues related to IOV must be considered. For anonymous authentication on trust in IOV, the following safety requirements must be met [6]:


#### 3.3.1. Authentication

This requirement consists of vehicle authentication and message integrity. Vehicle authentication allows the receiver to verify the authenticity of the sender, and the message integrity ensures that the message is not changed during the transmission.


#### 3.3.2. Anonymity

The system proposed in this scheme is shown in Figure1. No entity other than TA can know any information about the real identity of the vehicle, that is, only TA can reveal the real identity of the participating vehicle.


#### 3.3.3. Traceability

This function is used to identify malicious vehicles that may transmit false messages. Vehicles and RSU have no way to know the real sender of the received message, but TA can recover the true identity of the sender in case of an accident, which is called conditional traceability in IOV.


#### 3.3.4. Unlinkability

The user’s unlinkability means that the attacker could not judge whether any two messages are from the same vehicle.


#### 3.3.5. Replaying Resistance

Malicious vehicles cannot collect and send messages that have been received by the recipient.


### 3.4. Authentication Requirements

In order to ensure the safety of IOV communication, the following authentication requirements must be met:(1)
The computational and communication overhead of digital signatures must be low(2)
Authentication should be robust and extensible(3)
The process of reauthentication and revocation should be provided


## 3.1. Mathematical Foundations

This subsection describes some of the basics associated with anonymous authentication protocols, namely, elliptic curve cryptography (ECC) and mathematical assumptions.


### 3.1.1. Elliptic Curve Cryptography (ECC)

After elliptic curve cryptography was proposed by Koblitz [41] and Miller [42] in 1986, respectively, ECC began to be commonly used in security-related fields such as encryption and protocols. In the following sections, we briefly introduce elliptic curve cryptography, which is extensively used to design many encryption and security schemes because of its availability in computing and communication costs. In the case that the safety strength provided is the same as that of the discrete logarithm system, the parameters required by ECC are far less than those of the discrete log-based system [43]. The elliptic curve can be characterized by the set of solutions of a two element equation.If the groupG is a finite cyclic group on the elliptic curve E, its order is p and the generator is P. Let p be a prime number greater than 3, and the elliptic curve y2=x3+ax+b on Zp consist of a group of solutions x,y∈Zp×Zp based on congruence y2≡x3+ax+bmodp and an exceptional point o called infinite point, where a,b∈Zp comprises two constants satisfying 4a3+27b2≠0modp. In addition, G has two rules of operation:(1)
Addition±: let P,Q∈G, if P≠Q, R=P+Q, then R is the point where the line crosses P and Q and E; if P=Q , R=P+Q, then R is the intersection of the tangent of E and PQ; if P=−Q, there is P+Q=P−P=O.(2)
Scalar multiplication⋅: let P∈G, m∈Zq∗, and P have a scalar multiplication of m⋅P=P+P+⋯+P (m times in total).


### 3.1.2. Difficult Problem

LetG be a finite cyclic group with large prime q on an elliptic curve and P be a generator. To demonstrate the security of our scheme, two difficult problems are defined. The mathematical difficulties of participating in the proposed scheme are shown.Definition 1.
Elliptic curve discrete logarithm problem (ECDLP): random pointP,Q∈G on E are presented, and Q=xP, output x∈Zq∗.Definition 2.
Computation of Diffie–Hellman problem (CDHP): givenP,aP,bP∈G, where a,b∈Zq∗, calculate abP.If the algorithm of the ECDLP or the CDHP on the groupG cannot be solved by a nonnegligible probability ε within the time τ, then the ECDLP or the CDHP is difficult in the group G.


## 3.1.1. Elliptic Curve Cryptography (ECC)

After elliptic curve cryptography was proposed by Koblitz [41] and Miller [42] in 1986, respectively, ECC began to be commonly used in security-related fields such as encryption and protocols. In the following sections, we briefly introduce elliptic curve cryptography, which is extensively used to design many encryption and security schemes because of its availability in computing and communication costs. In the case that the safety strength provided is the same as that of the discrete logarithm system, the parameters required by ECC are far less than those of the discrete log-based system [43]. The elliptic curve can be characterized by the set of solutions of a two element equation.If the groupG is a finite cyclic group on the elliptic curve E, its order is p and the generator is P. Let p be a prime number greater than 3, and the elliptic curve y2=x3+ax+b on Zp consist of a group of solutions x,y∈Zp×Zp based on congruence y2≡x3+ax+bmodp and an exceptional point o called infinite point, where a,b∈Zp comprises two constants satisfying 4a3+27b2≠0modp. In addition, G has two rules of operation:(1)
Addition±: let P,Q∈G, if P≠Q, R=P+Q, then R is the point where the line crosses P and Q and E; if P=Q , R=P+Q, then R is the intersection of the tangent of E and PQ; if P=−Q, there is P+Q=P−P=O.(2)
Scalar multiplication⋅: let P∈G, m∈Zq∗, and P have a scalar multiplication of m⋅P=P+P+⋯+P (m times in total).


## 3.1.2. Difficult Problem

LetG be a finite cyclic group with large prime q on an elliptic curve and P be a generator. To demonstrate the security of our scheme, two difficult problems are defined. The mathematical difficulties of participating in the proposed scheme are shown.Definition 1.
Elliptic curve discrete logarithm problem (ECDLP): random pointP,Q∈G on E are presented, and Q=xP, output x∈Zq∗.Definition 2.
Computation of Diffie–Hellman problem (CDHP): givenP,aP,bP∈G, where a,b∈Zq∗, calculate abP.If the algorithm of the ECDLP or the CDHP on the groupG cannot be solved by a nonnegligible probability ε within the time τ, then the ECDLP or the CDHP is difficult in the group G.


## 3.2. System Model

We describe the system model of the proposed anonymous authentication scheme in Figure1. The trusted authority (TA) has adequacy functions and is trusted to provide identity management and trust management. What is more, TA or IOV nodes that are more stable and dependable than other vehicle nodes (for example, wi-fi access points and base stations) can act as authorizers (AP). AP uses adequate information about nodes to estimate the trust value of the node. In order to achieve instant communication, the nodes interact with each other. Because message integrity and privacy are important, it is necessary to verify node trust anonymously for reliable communication and preserving privacy. TA is used by vehicle nodes to manage the correspondence among real identity, pseudonym, key and trust in the cloud to save computing and storage costs. When the TA is inaccessible, the IOV node can use some of the IOV nodes as APs to correspond to each other.(1)
Trusted authority (TA): it is based on the assumption that TA is fully trusted and has sufficient computing and storage capacity. Through a secure channel, entities (vehicles and RSU) must register with the TA using some personal credentials that uniquely identify the entity. TA is responsible for the registration of fixed RSU on the roadside and mobile OBU installed on vehicles and can reveal the true OBU identity of secure messages.(2)
Road side units (RSU): suppose the RSUs are widely deployed on the road and can be viewed as the router between the TA and vehicle nodes. RSU are not entirely credible, so they have to be supervised by TA.(3)
Vehicles (OBU): each vehicle is equipped with OBU which has a shorter communication range and less computing power than RSU. With the built-in OBU and DSRC protocols, each vehicle can communicate with neighboring vehicles, RSU and TA. The real identity of the vehicle and some secret information about the operation are stored in the OBU.Figure 1
The system model of IOV.


## 3.3. Security Requirements

Because messages are transported in an open access environment, security and privacy issues related to IOV must be considered. For anonymous authentication on trust in IOV, the following safety requirements must be met [6]:


### 3.3.1. Authentication

This requirement consists of vehicle authentication and message integrity. Vehicle authentication allows the receiver to verify the authenticity of the sender, and the message integrity ensures that the message is not changed during the transmission.


### 3.3.2. Anonymity

The system proposed in this scheme is shown in Figure1. No entity other than TA can know any information about the real identity of the vehicle, that is, only TA can reveal the real identity of the participating vehicle.


### 3.3.3. Traceability

This function is used to identify malicious vehicles that may transmit false messages. Vehicles and RSU have no way to know the real sender of the received message, but TA can recover the true identity of the sender in case of an accident, which is called conditional traceability in IOV.


### 3.3.4. Unlinkability

The user’s unlinkability means that the attacker could not judge whether any two messages are from the same vehicle.


### 3.3.5. Replaying Resistance

Malicious vehicles cannot collect and send messages that have been received by the recipient.


## 3.3.1. Authentication

This requirement consists of vehicle authentication and message integrity. Vehicle authentication allows the receiver to verify the authenticity of the sender, and the message integrity ensures that the message is not changed during the transmission.


## 3.3.2. Anonymity

The system proposed in this scheme is shown in Figure1. No entity other than TA can know any information about the real identity of the vehicle, that is, only TA can reveal the real identity of the participating vehicle.


## 3.3.3. Traceability

This function is used to identify malicious vehicles that may transmit false messages. Vehicles and RSU have no way to know the real sender of the received message, but TA can recover the true identity of the sender in case of an accident, which is called conditional traceability in IOV.


## 3.3.4. Unlinkability

The user’s unlinkability means that the attacker could not judge whether any two messages are from the same vehicle.


## 3.3.5. Replaying Resistance

Malicious vehicles cannot collect and send messages that have been received by the recipient.


## 3.4. Authentication Requirements

In order to ensure the safety of IOV communication, the following authentication requirements must be met:(1)
The computational and communication overhead of digital signatures must be low(2)
Authentication should be robust and extensible(3)
The process of reauthentication and revocation should be provided


## 4. The Proposed Scheme

In this section, we describe a trust-based authentication scheme proposed in this paper, which can authenticate node trust and verify node signature by anonymous method, which is suitable for secure V2V communication in IOV. Specifically, after system settings and node registration, authorized parties (AP) issue aggregated lists of INT values and INT hash (in short, aggregated lists) to each IOV node. On the basis of INT, nodes generate their one-time key pairs to sign their messages. Based on previous research on trust in IOV, we can assume that the trust of a node is a specific value, such as context-aware trust generation [12].The scheme is divided into seven phases: system initialization, node registration, issue trust value, aggregate list, one-off key pair generation, signature generation, and verification. The symbols used in the proposed scheme are given in Table2. Detailed procedures for the proposed scheme are as follows:Table 2
System notations.
NotationsDescriptionViTheith vehicleMMessages from vehiclestiTiA timestampTViThe short-lived trust value ofViT_TViThe validity period ofTViAC_TViThe authentication code ofTViCertiThe certificate ofIDi issued by TAPpub,PpubThe public key pair of KGC and TRARIDiThe real identity ofViUi,ViThe one-off public/private pair key ofTVisigniThe signature fromViGA cycle additive groupPA generator of the groupGqThe order ofGH⋅A MapToPoint hash functionh⋅The hash functionTATrusted authorityCRLCertificate revocation listOBUOn board unitRSURoad side unit


### 4.1. System Initialization

In this subsection, TA generates system parameters and loads them to the vehicle node. The system initialization of the scheme is the responsibility of TA, which consists of two parts, namely, key generation center (KGC) and tracing authorization (TRA), assuming that both parties have enough storage space and computing capacity. Since we assume that TA is reliable in this paper, we can conclude that KGC and TRA are also reliable.(1)
Given the safety parameterℓ, TAs use two large prime numbers p, q and an elliptic curve defined by y2=x3+ax+bmodp,a,b∈Fp.(2)
The KGC chooses pointP from E and generates group G through P. KGC selects the random number α∈Zq∗ and calculates(1)Ppub=αP,whereα is the secret value stored in KGC and is the master key used to extract part of the key.(3)
The TRA picks pointP from E and produces the group G through P. TRA selects the random number β∈Zq∗ and calculates(2)Tpub=βP,whereβ is the secret value stored in TRA and the master key for traceability.(4)
TAs choose four secure hash functionsH1:G⟶Zq∗, H2:0,1∗⟶G, H3:0,1∗⟶G, h1:0,1∗⟶0,1n, h2:0,1∗⟶Zq∗.(5)
They publish the system parametersPara:(3)Para=P,p,q,E,G,H1,H2,H3,h1,h2,Ppub,Tpub.When the system is initialized, these public system parameters,Para, are reloaded into the tamper-proof device in the vehicle node.


### 4.2. Node Registration

In this subsection, when each vehicle nodeVi registers with the system (TA), it needs to rely on its unique real identity (RIDi. In addition, the public key can be authenticated using the aggregation list distributed by AP, thus achieving certificateless, trust-based authentication. Therefore, the proposed scheme does not need the public key certificate (Figure2).(1)
The vehicleVi selects a random number ki∈Zq∗ and calculates(4)IDi,1=kiP.TRA receivesRIDi,IDi,1 from the vehicle, and the communication channel between the two parties is safe, where the vehicle node Vi can be uniquely identified through RIDi.(2)
When TRA receivesRIDi from vehicle Vi, where RIDi is the real identity of Vi, it first checks for RIDi and then calculates(5)IDi,2=RIDi⊕H1β⋅IDi,1,Ti,Tpub, where Ti indicates the validity period of this pseudoidentity. The TAs choose random ui∈Zq, TAs also provide certificate Certi=uiP. The node uses this certificate to request its trust value from TAs. Going down this, KGC can receive pseudoidentity IDi and Certi in a secure manner.(6)IDi=IDi,1,IDi,2,Ti.(3)
When KGC obtains the pseudoidentityIDi, it calculates part of the private key pskIDi after selecting a random number di∈Zq∗ and computing QIDi=diP.(7)pskIDi=di+h2IDi,QIDi×αmodq.The vehicle receivesIDi,pskIDi,Certi,QIDi from KGC in a secure manner, including the pseudoidentity, partial private key, and certificate.Figure 2
Registration of vehicle node.


### 4.3. Issue Trust Value and Aggregate List

First of all, each AP (executed by TA or IOV nodes) delivers an original trust value with a valid period and the aggregate list of INT hashes for nodeVi in the system; the AP then notifies all vehicle nodes of the newly generated aggregation list. The AP first inspects the validity of the previous trust value before deciding whether to reissue the trust value. In this subsection, one of its essential components is nodes to verify the trust values of other nodes during communication. Nodes request and receive INT in a trustworthy way. In addition, AP will use its signature to distribute the latest INT summary list. Based on its current INT, the trusted processor can produce a one-time public and private key pair.The trust value of the vehicle can be obtained by analyzing the message records issued by the vehicle collected by AP. At AP, the information collector saves the results in a database after collecting and processing message records from the vehicle nodes. The trust evaluator is used to evaluate the trust value of the vehicle node and detect the malicious vehicle node. The trusted publisher issues an aggregated list of INT hash values for all nodes on the IOV node on a regular or per request basis. When a vehicle node is registered, TAs issue an original trust value on the basis of the behavior of the vehicle node. The TAs collaborate with APs to determine the node’s INT and track its true identity without revealing the node’s true identity to any other IOV node. The TA database also holds the trust value of each node and its true identity. The AP can communicate with the TA more stably and reliably than a normal node.After the AP reevaluates the trust, a new trust value is obtained, and it then stores the hash value of the new INT value to the appropriate location ofHa or Ha_APj. When the value of trust expires, the trust value is re-requested, and the AP deletes the old value. Its corresponding INT is saved to the appropriate location in the latest aggregation list. The AP then publishes the updated list to all vehicle nodes. All AP simultaneously broadcasts its latest INT summary list. The value of the node’s trust can be verified through the presence and location h1Qi‖h1ni or h1Qi‖h1ni_APj of the aggregation list (Ha or Ha_APj). Because INT values are sorted in the list (for example, in ascending order), the node during the message authentication is easy to compare trust value. The following will be described separately in two cases, as described in detail below.(1)
AP is executed by TAs: in this phase, based on the true identity of the vehicle, the TAs construct an original or new INT value for the vehicle node. When the current period of trust value expires, a new trust value is requested, at which point TA reevaluates the trust value ofVi and publishes it to Vi using the authentication code AC_TVi. The vehicle node transmits a random number d1 and its certificate Certi to TAs to request a trust value. The shared session key between TA and Vi is established using the Diffie–Hellman key agreement protocol, and d2 is selected by TA. Afterwards TAs transmit parameters: h1TVi‖AC_TVi,T_TVi,si,Qi=si⋅P, where TVi is due at T_TVi. The list Ha of INT hashes is produced periodically by TAs: Ha=h1Q1‖h1n1,⋅,h1Qi‖h1ni,⋅, where ni=h1TVi‖AC_TVi. And then all the nodes will receive Ha‖signTSHa from TAs.(2)
AP is carried out by the IOV node: APAPj can be played by node Vj to assess the others’ trust value in IOV. In the same way, Diffie–Hellman key agreement protocol is adopted to establish the shared session key between AP and Vi. Afterwards APj transmits parameters: h1TVi_APj‖AC_TVi_APj,T_TVi_APj to Vi, where TVi_APj is due at T_TVi_APj. In this case, Vj also can be authenticated with by node Vi. If there are multiple APs, Ha_APj is produced periodically by APj. And publish it to all nodes after signing: Ha_APj‖signAPjHa_APj with his private key. Of which(8)Ha_APj=h1Q1‖h1n1_APj,…h1Qi‖h1ni_APj,….


### 4.4. One-Off Key Pair Generation

In this subsection, vehicle nodes can construct its one-off key pair on INT to sign the messages it sends. Receivers can verify received messages individually or aggregately.Be based onni=h1TVi‖AC_TVi, one-off anonymous public and private key pairs (Yi and ri) can be constructed by Vi. The production of one-off anonymous key pairs is depicted in Algorithm 1. By randomly changing the nonce a, Vi can produce a distinctive key pair for a new one-off public and private key pair. Therefore, if ni is the same, different key pairs can be generated to achieve advanced privacy.Algorithm 1: Generation of one-off anonymous key pairs.
Require:ni=h1TVi‖AC_TViEnsure:(1)
YiY1iandY2i and rir1iandr2i(2)
(i) The one-off public keyYi can be calculated as:(3)
Y1i=ni⋅a⋅Qi; Y2i=h1ni⊕H1ni⋅a⋅Qi(4)
Whereα is a random number and ⊕ represent an XOR operation;(5)
(ii) The private keyri can be calculated as(6)
r1i=Y1i⋅si; r2i=H2Y1i‖Y2i⋅si


### 4.5. Signature Generation

In this subsection, the vehicle must sign the message with the one-off private key before sending the message, in order to authenticate and preserve the integrity of a message. VehicleVi first randomly selects pseudo IDi from memory and selects the latest timestamp ti. The updated timestamp ti protects signature messages from replay attacks. Given the signature key pskIDi,ri and message Mi, the following steps will be performed by vehicle Vi.(1)
The node sends the messageMi by calculating hi and signing on Mi using the private key Yi.(9)hi=H3Mi,IDi,Yi,tisigniMi=hi⋅si+pskIDimodq.(2)
After that,Vi outputs the final message and uses the following format to send msg to other nodes(10)msg=IDi,Yi,signi,Mi,ti,Qi.


### 4.6. Aggregate

If different nodes send many messages to the same node over a period of time, we can calculate multiple signature combinations asS=∑i=1nsigniMi for getting a collection of individual certificateless signatures at a receiver.


### 4.7. Verification

When adjacent vehicles communicate with each other and send messages, the receiving vehicle needs to check the signature of the message to ensure that the corresponding vehicle does not attempt to propagate a false message (Figure3).(1)
Individual verify: when the node receives the message, the receiver first extractedh1ni from Yi:(11)h1ni=Y2i⊕H1Y1i,and calculatesh1Qi‖h1ni to verify the trust value of Vi according to the location in the list. Once the authenticity of the sender’s trust value is verified, the recipient performs signature verification. The receiver uses system common parameters to validate the sender’s signature by computing hi,2=h2IDi,QIDi and hi=H3Mi,IDi,Yi,ti, then checks if the following equation is met, signiMi⋅P=hi⋅Qi+QIDi+hi,2⋅Ppub, and if satisfied, the recipient accepts this certificateless signature. Since Ppub=αP, pskIDi=di+h2IDi,QIDi×αmodq, QIDi=diP, Qi=si⋅P, and signiMi=hi⋅si+pskIDimodq. We obtain(12)signiMi⋅P=hi⋅si+pskIDi⋅P=hi⋅si⋅P+di+hi,2×α⋅P=hi⋅Qi+QIDi+hi,2⋅Ppub.(2)
Aggregate verify: when the node receives the message, the receiver first calculates:(13)h1ni=Y2i⊕H1Y1i.Extract fromYi and calculate h1Qi‖h1ni to verify the trust value of Vi according to the location in the list, in which i=,1,2,…,n. Once the authenticity of the sender’s trust value is verified, the recipient performs signature verification. The receiver uses system common parameters to validate the sender’s signature by computing hi,2=h2IDi,QIDi and hi=H3Mi,IDi,Yi,ti, which i=,1,2,…,n, then check that the following equation is met, signiMi⋅P=∑i=1nhi⋅Qi+∑i=1nQIDi+∑i=1nhi,2⋅Ppub, and if satisfied, the recipient accepts this certificateless signature. Since Ppub=αP, QIDi=diP, pskIDi=di+h2IDi,QIDi×αmodq, Qi=si⋅P, and signiMi=hi⋅si+pskIDimodq. We can get(14)S⋅P=∑i=1nsigniMi⋅P=∑i=1nhi⋅si+pskIDi⋅P=∑i=1nhi⋅si⋅P+∑i=1ndi+hi,2×α⋅P=∑i=1nhi⋅Qi+∑i=1nQIDi+∑i=1nhi,2Ppub.Figure 3
Anonymous authentication process based on trust.


### 4.8. Identity Tracking

Once a vehicle sends a malicious message, the TRA can track the identity of the vehicle. Through the pseudoidentityIDi=IDi,1,IDi,2,Ti, TRA calculates the equation RIDi=IDi,2⊕H1β⋅IDi,1,Ti,Tpub to trace the vehicle’s true identity. At the same time, the AP will reevaluate the trust of the vehicle and publish the updated list to all vehicle nodes. In addition, TA will update its database.


## 4.1. System Initialization

In this subsection, TA generates system parameters and loads them to the vehicle node. The system initialization of the scheme is the responsibility of TA, which consists of two parts, namely, key generation center (KGC) and tracing authorization (TRA), assuming that both parties have enough storage space and computing capacity. Since we assume that TA is reliable in this paper, we can conclude that KGC and TRA are also reliable.(1)
Given the safety parameterℓ, TAs use two large prime numbers p, q and an elliptic curve defined by y2=x3+ax+bmodp,a,b∈Fp.(2)
The KGC chooses pointP from E and generates group G through P. KGC selects the random number α∈Zq∗ and calculates(1)Ppub=αP,whereα is the secret value stored in KGC and is the master key used to extract part of the key.(3)
The TRA picks pointP from E and produces the group G through P. TRA selects the random number β∈Zq∗ and calculates(2)Tpub=βP,whereβ is the secret value stored in TRA and the master key for traceability.(4)
TAs choose four secure hash functionsH1:G⟶Zq∗, H2:0,1∗⟶G, H3:0,1∗⟶G, h1:0,1∗⟶0,1n, h2:0,1∗⟶Zq∗.(5)
They publish the system parametersPara:(3)Para=P,p,q,E,G,H1,H2,H3,h1,h2,Ppub,Tpub.When the system is initialized, these public system parameters,Para, are reloaded into the tamper-proof device in the vehicle node.


## 4.2. Node Registration

In this subsection, when each vehicle nodeVi registers with the system (TA), it needs to rely on its unique real identity (RIDi. In addition, the public key can be authenticated using the aggregation list distributed by AP, thus achieving certificateless, trust-based authentication. Therefore, the proposed scheme does not need the public key certificate (Figure2).(1)
The vehicleVi selects a random number ki∈Zq∗ and calculates(4)IDi,1=kiP.TRA receivesRIDi,IDi,1 from the vehicle, and the communication channel between the two parties is safe, where the vehicle node Vi can be uniquely identified through RIDi.(2)
When TRA receivesRIDi from vehicle Vi, where RIDi is the real identity of Vi, it first checks for RIDi and then calculates(5)IDi,2=RIDi⊕H1β⋅IDi,1,Ti,Tpub, where Ti indicates the validity period of this pseudoidentity. The TAs choose random ui∈Zq, TAs also provide certificate Certi=uiP. The node uses this certificate to request its trust value from TAs. Going down this, KGC can receive pseudoidentity IDi and Certi in a secure manner.(6)IDi=IDi,1,IDi,2,Ti.(3)
When KGC obtains the pseudoidentityIDi, it calculates part of the private key pskIDi after selecting a random number di∈Zq∗ and computing QIDi=diP.(7)pskIDi=di+h2IDi,QIDi×αmodq.The vehicle receivesIDi,pskIDi,Certi,QIDi from KGC in a secure manner, including the pseudoidentity, partial private key, and certificate.Figure 2
Registration of vehicle node.


## 4.3. Issue Trust Value and Aggregate List

First of all, each AP (executed by TA or IOV nodes) delivers an original trust value with a valid period and the aggregate list of INT hashes for nodeVi in the system; the AP then notifies all vehicle nodes of the newly generated aggregation list. The AP first inspects the validity of the previous trust value before deciding whether to reissue the trust value. In this subsection, one of its essential components is nodes to verify the trust values of other nodes during communication. Nodes request and receive INT in a trustworthy way. In addition, AP will use its signature to distribute the latest INT summary list. Based on its current INT, the trusted processor can produce a one-time public and private key pair.The trust value of the vehicle can be obtained by analyzing the message records issued by the vehicle collected by AP. At AP, the information collector saves the results in a database after collecting and processing message records from the vehicle nodes. The trust evaluator is used to evaluate the trust value of the vehicle node and detect the malicious vehicle node. The trusted publisher issues an aggregated list of INT hash values for all nodes on the IOV node on a regular or per request basis. When a vehicle node is registered, TAs issue an original trust value on the basis of the behavior of the vehicle node. The TAs collaborate with APs to determine the node’s INT and track its true identity without revealing the node’s true identity to any other IOV node. The TA database also holds the trust value of each node and its true identity. The AP can communicate with the TA more stably and reliably than a normal node.After the AP reevaluates the trust, a new trust value is obtained, and it then stores the hash value of the new INT value to the appropriate location ofHa or Ha_APj. When the value of trust expires, the trust value is re-requested, and the AP deletes the old value. Its corresponding INT is saved to the appropriate location in the latest aggregation list. The AP then publishes the updated list to all vehicle nodes. All AP simultaneously broadcasts its latest INT summary list. The value of the node’s trust can be verified through the presence and location h1Qi‖h1ni or h1Qi‖h1ni_APj of the aggregation list (Ha or Ha_APj). Because INT values are sorted in the list (for example, in ascending order), the node during the message authentication is easy to compare trust value. The following will be described separately in two cases, as described in detail below.(1)
AP is executed by TAs: in this phase, based on the true identity of the vehicle, the TAs construct an original or new INT value for the vehicle node. When the current period of trust value expires, a new trust value is requested, at which point TA reevaluates the trust value ofVi and publishes it to Vi using the authentication code AC_TVi. The vehicle node transmits a random number d1 and its certificate Certi to TAs to request a trust value. The shared session key between TA and Vi is established using the Diffie–Hellman key agreement protocol, and d2 is selected by TA. Afterwards TAs transmit parameters: h1TVi‖AC_TVi,T_TVi,si,Qi=si⋅P, where TVi is due at T_TVi. The list Ha of INT hashes is produced periodically by TAs: Ha=h1Q1‖h1n1,⋅,h1Qi‖h1ni,⋅, where ni=h1TVi‖AC_TVi. And then all the nodes will receive Ha‖signTSHa from TAs.(2)
AP is carried out by the IOV node: APAPj can be played by node Vj to assess the others’ trust value in IOV. In the same way, Diffie–Hellman key agreement protocol is adopted to establish the shared session key between AP and Vi. Afterwards APj transmits parameters: h1TVi_APj‖AC_TVi_APj,T_TVi_APj to Vi, where TVi_APj is due at T_TVi_APj. In this case, Vj also can be authenticated with by node Vi. If there are multiple APs, Ha_APj is produced periodically by APj. And publish it to all nodes after signing: Ha_APj‖signAPjHa_APj with his private key. Of which(8)Ha_APj=h1Q1‖h1n1_APj,…h1Qi‖h1ni_APj,….


## 4.4. One-Off Key Pair Generation

In this subsection, vehicle nodes can construct its one-off key pair on INT to sign the messages it sends. Receivers can verify received messages individually or aggregately.Be based onni=h1TVi‖AC_TVi, one-off anonymous public and private key pairs (Yi and ri) can be constructed by Vi. The production of one-off anonymous key pairs is depicted in Algorithm 1. By randomly changing the nonce a, Vi can produce a distinctive key pair for a new one-off public and private key pair. Therefore, if ni is the same, different key pairs can be generated to achieve advanced privacy.Algorithm 1: Generation of one-off anonymous key pairs.
Require:ni=h1TVi‖AC_TViEnsure:(1)
YiY1iandY2i and rir1iandr2i(2)
(i) The one-off public keyYi can be calculated as:(3)
Y1i=ni⋅a⋅Qi; Y2i=h1ni⊕H1ni⋅a⋅Qi(4)
Whereα is a random number and ⊕ represent an XOR operation;(5)
(ii) The private keyri can be calculated as(6)
r1i=Y1i⋅si; r2i=H2Y1i‖Y2i⋅si


## 4.5. Signature Generation

In this subsection, the vehicle must sign the message with the one-off private key before sending the message, in order to authenticate and preserve the integrity of a message. VehicleVi first randomly selects pseudo IDi from memory and selects the latest timestamp ti. The updated timestamp ti protects signature messages from replay attacks. Given the signature key pskIDi,ri and message Mi, the following steps will be performed by vehicle Vi.(1)
The node sends the messageMi by calculating hi and signing on Mi using the private key Yi.(9)hi=H3Mi,IDi,Yi,tisigniMi=hi⋅si+pskIDimodq.(2)
After that,Vi outputs the final message and uses the following format to send msg to other nodes(10)msg=IDi,Yi,signi,Mi,ti,Qi.


## 4.6. Aggregate

If different nodes send many messages to the same node over a period of time, we can calculate multiple signature combinations asS=∑i=1nsigniMi for getting a collection of individual certificateless signatures at a receiver.


## 4.7. Verification

When adjacent vehicles communicate with each other and send messages, the receiving vehicle needs to check the signature of the message to ensure that the corresponding vehicle does not attempt to propagate a false message (Figure3).(1)
Individual verify: when the node receives the message, the receiver first extractedh1ni from Yi:(11)h1ni=Y2i⊕H1Y1i,and calculatesh1Qi‖h1ni to verify the trust value of Vi according to the location in the list. Once the authenticity of the sender’s trust value is verified, the recipient performs signature verification. The receiver uses system common parameters to validate the sender’s signature by computing hi,2=h2IDi,QIDi and hi=H3Mi,IDi,Yi,ti, then checks if the following equation is met, signiMi⋅P=hi⋅Qi+QIDi+hi,2⋅Ppub, and if satisfied, the recipient accepts this certificateless signature. Since Ppub=αP, pskIDi=di+h2IDi,QIDi×αmodq, QIDi=diP, Qi=si⋅P, and signiMi=hi⋅si+pskIDimodq. We obtain(12)signiMi⋅P=hi⋅si+pskIDi⋅P=hi⋅si⋅P+di+hi,2×α⋅P=hi⋅Qi+QIDi+hi,2⋅Ppub.(2)
Aggregate verify: when the node receives the message, the receiver first calculates:(13)h1ni=Y2i⊕H1Y1i.Extract fromYi and calculate h1Qi‖h1ni to verify the trust value of Vi according to the location in the list, in which i=,1,2,…,n. Once the authenticity of the sender’s trust value is verified, the recipient performs signature verification. The receiver uses system common parameters to validate the sender’s signature by computing hi,2=h2IDi,QIDi and hi=H3Mi,IDi,Yi,ti, which i=,1,2,…,n, then check that the following equation is met, signiMi⋅P=∑i=1nhi⋅Qi+∑i=1nQIDi+∑i=1nhi,2⋅Ppub, and if satisfied, the recipient accepts this certificateless signature. Since Ppub=αP, QIDi=diP, pskIDi=di+h2IDi,QIDi×αmodq, Qi=si⋅P, and signiMi=hi⋅si+pskIDimodq. We can get(14)S⋅P=∑i=1nsigniMi⋅P=∑i=1nhi⋅si+pskIDi⋅P=∑i=1nhi⋅si⋅P+∑i=1ndi+hi,2×α⋅P=∑i=1nhi⋅Qi+∑i=1nQIDi+∑i=1nhi,2Ppub.Figure 3
Anonymous authentication process based on trust.


## 4.8. Identity Tracking

Once a vehicle sends a malicious message, the TRA can track the identity of the vehicle. Through the pseudoidentityIDi=IDi,1,IDi,2,Ti, TRA calculates the equation RIDi=IDi,2⊕H1β⋅IDi,1,Ti,Tpub to trace the vehicle’s true identity. At the same time, the AP will reevaluate the trust of the vehicle and publish the updated list to all vehicle nodes. In addition, TA will update its database.


## 5. Security Proof and Analysis

Before we show that the proposed scheme has the security and privacy requirements, existential unforgeability of the signature,signiMi, is proved in the random oracle model.


### 5.1. Security Model

The security model of the proposed scheme is to design a game between challengerC and adversary A, that is, whether adversary A can win the challenge given by challenger C in polynomial time with a nonnegligible probability. Adversary A performs the query described below in the game.(i)
Setup: challenger C creates the public key and gives it to A.(ii)
h2⋅queries: in this query, challenger C chooses a random vi∈Zq∗ and then adds IDi,QIDi,vi into the hash list h2list. Finally, C sends vi=h2IDi,QIDi to A.(iii)
Y⋅queries: challenger C picks random xi∈Zq∗, inserts tuple Y1i, Y2i, xi into Ylist and responds to A with Y1i, Y2i in query i.(iv)
H2⋅queries: in this query, challenger C picks random yi∈Zq∗, inserts the tuples Y1j, Y2i, yi, H2i into Ylist and responds to A with H2i in query i.(v)
H3⋅queries: in this query, challenger C picks random ui∈Zq∗, inserts the tuple ui, mi, H3i to H3list and responds to A with H3mi,IDi,Yi,ti=H3i.(vi)
Partial private key queries: in this query, challenger C calculates pskIDi and then the value pskIDi is outputted to A.(vii)
Sign queries: after receiving the message Mi, C generates the request message IDi,Yi,signi,Mi,ti,Qi and sends it to A.The probability thatA may violate the authentication of proposed scheme Γ is expressed as AdvΓAuthA.Definition 3.
The proposed schemeΓ for IOV is secure if AdvΓAuthA is negligible for any polynomial adversary A.


### 5.2. Security Proof

In this subsection, to prove unforgeability of the proposed scheme, we need to show that it is unforgeable against adversaryA. If and only if CDHP is difficult, our scheme is safe under adaptive selective message attack in the random prediction model.Theorem 1.
Unforgeability: make the prime order groupG into τ,t′,ε′− CDH group, which implies that no challenger Ct′,ε′ can destroy CDHP on it. Therefore, the proposal is that the existence of an attack on adaptive selection is t,ε,qY,qh2,qH2,qH3,qpk,qS-secure, and ε=eqSε′, and cC and t=t′−cCqY+qh2+qH2+qH3+qpk+qS is constant, where e is the basis of the natural logarithm.Game: adversary A has the advantage of ε and time t. Suppose A queries qY times for Yqueries, qh2 times for h2queries, qH2 times for H2queries, qH3 times for H3queries, qpk times for Partial private key queries, and qS times for Sign queries. And then, a challenger C who has the advantage of at least ε/eqS and runtime:(15)t+cCqY+qh2+qH2+qH3+qpk+qS,to solve CDHP.Proof.
ChallengerC gives parameters q, G, e and random instance of CDHP, which is P, aP, bP, whereas P is a random generator of G with order q, a and b are random in Zq∗. Let D=abP∈G be the solution for CDHP. Challenger C interacts with A to find the solution through the following query.
Setup: challenger C creates Kpub=q,G,P,h2,H2,H3 and gives it to A. This is h2, H2, and H3, which is a random oracle controlled by C, as follows:
h2⋅queries: when A makes a h2 query with parameter IDi,QIDi, C checks whether tuples already exist in the hash list h2list. In that case, C transfers vi=h2IDi,QIDi to A. If not, C selects a random vi∈Zq∗ and then adds IDi,QIDi,vi into the hash list h2list. Finally, C sends vi=h2IDi,QIDi to A.
Y⋅queries: challenger C can query the public key Y. In response to queries, challenger C keeps tuple list Y1j, Y2j, xj called Ylist. At first, it was empty. C selects random xi∈Zq∗, Y2i∈0,1n and calculates Y1j=xiP⋅aP. It then adds the tuples Y1i, Y2i, xi into Ylist and when querying i, it responds to A with Y1i and Y2i.
H2⋅queries: in response to queries, challenger C maintains list H2list in tuple Y1j, Y2j, yj, H2j. C picks random yi∈Zq∗ and sets H2i=H2Y1i‖Y2i=yiP. Then, it adds the tuples Y1j, Y2i, yi, H2i into Ylist and when querying i, it responds to A with H2i.
H3⋅queries: in response to queries, challenger C keeps tuple list uj, mj, H3j, called H3list. At first, it was empty. To respond to the query mi, challenger C will do the following:(1)
If it already exists in the tupleui, mi, H3i in H3list when mi is queried, C responds to H3mi,IDi,Yi,ti=H3i(2)
Otherwise,C only produces random bit ib∈0,1, which will be determined later for ξ in Prbi=1=ξ(3)
C selects random number ui∈Zq∗. If bi=0, it then sets H3mi,IDi,Yi,ti=H3i=uiP. If bi=1, it then sets H3mi,IDi,Yi,ti=H3i=bP⋅uiP. Afterwards, C adds the tuple ui, mi, H3i to H3list and responds to A with H3mi,IDi,Yi,ti=H3i. Note that H3i is homogeneous in G and independent of A.
Partial private key queries: A queries partial private key for pseudoidentity IDi, C calculates QIDi=diP and then examines if the tuple IDi,QIDi,vi already exists in the hash list h2list, where di is a random number. When the corresponding tuple IDi,QIDi,viC is not found, C will output a failure and stop because the query cannot be answered coherently. Or else C evaluates pskIDi=di+h2IDi,QIDi×αmodq and outputs pskIDi to A. It is worth noting that by calling this part of the partial private key query, A cannot obtain the pskIDj of the target user through IDj.
Sign queries: the signature oracle is simulated by maintaining the list of tuples mj, H3j, σj in response to any message mj signature query. We call this list Slist, which was initially empty. When A uses the message mi to query oracle Sign, C responds to the query.(1)
If the querymi already exists in the tuple mi, H3i, σi in Slist, challenger C responds with σi.(2)
Besides,C inspects whether ui,mi,H3i, Y1i,Y2i,xi, IDi,QIDi,vi, and Y1i,Y2i,yi,H2i exist. Otherwise, C executes h2-queries to obtain IDi,QIDi,vi, Y-queries to gain Y1i,Y2i,xi, H2-queries to obtain Y1i,Y2i,yi,H2i, and H3-queries to gain ui,mi,H3i. Next, C picks two random numbers ri and hi. If bi=0, σi=hi⋅ri+pskIDimodq. If bi=1, it sets σi=∗, value of placeholder. Finally, it adds tuple mi,H3i,σi to list Slist and replies to σi.
Challenge: challenger C publishes the signature query mi. Challenger C obtains σi∈G by running the above algorithm in response to Sign queries. Note that C can use the public key Kpub to run A to obtain P, aP, H3i, σi, which can be converted into a valid Diffie–Hellman tuple.
Claim: A stops, admit defeat, or forged signature m′, σ′, where m′=mi∗, for some i∗ where A does not query the signature. If A is successfully forged, it means that CDHP is solved. At this time, C outputs “success.” Otherwise, the C output “fails.” A performed exactly as expected in the game model. Thus,(16)AdvC=PrCAP,aP,bP=success:a,b∈Zq∗=VerifyY,m′,σ′=valid:m′,σ′←AYY,r←OneoffKeyGen=ε.
By modifying, ifA cannot create forgery, C will also fail. But if A finds mi∗’s forgery successfully, C claims success only at bi∗=1, and A use index i1,i2,…,iqS to qS sign oracle query for messages with bi=0 (for bi=1, A will stop immediately after the failure is declared), then AdvC′=AdvC⋅Prbi∗=1⋅Prbij=0,j=1,2,…,qS=ξ1−ξqSε.
Therefore, challengerC uses signature forger A to solve CDHP, which has the advantage of ε′ and time t′. The maximization of function ξ1−ξqSε is at ξ=1/1+qS, of which it has the following values:(17)11+qS1−11+qSqS⋅ε=1qS1−11+qSqS+1⋅ε.
For largeqS, 1−1/1+qSqS+1≈1/e.
Meanwhile,C’s running time consists of A’s running time and the additional overhead, in which the group multiplication to evaluate each signature and hash request from C is the main part. Any such multiplication can be done by using up to cC time units on G. C may have to answer a request like qY+qh2+qH2+qH3+qpk+qS. Therefore, its overall runtime is t+cCqY+qh2+qH2+qH3+qpk+qS.
If there is a forgeryC that t,ε,qY,qh2,qH2,qH3,qpk,qS breaks our proposed scheme on G, then there is a challenger Ct′,ε′ that can destroy CDHP, where ε′=ε/eqS and t′=t+cCqY+qh2+qH2+qH3+qpk+qS. On the contrary, if the group G is a τ,t′,ε′-CDH group, no challenger could break the proposed scheme, where t=t′−cCqY+qh2+qH2+qH3+qpk+qS and ε=eqSε′.


### 5.3. Security Analysis

We demonstrate that our proposal complies with all security and privacy requirements described in Section3.3. As summarized by the comparison results in Table 3, we compared the proposal with other schemes for meeting security requirements, where SR1, SR2, SR3, SR4, and SR5, respectively, represent the authentication, anonymity, traceability, unlinkability, and replaying resistance. The comparison results show that the proposed scheme is superior. The security requirements of the proposed scheme are analyzed next.Table 3
Comparison of security between related schemes and ours.
Scheme[15][44][45]ProposedSR1√√√√SR2√√√√SR3√√√√SR4√√√SR5√


#### 5.3.1. Authentication

For the following reasons, the proposed scheme provides message integrity and validity of sender identity: signaturesigniMi⋅P is used to verify the authenticity of the message sent from vehicle to verifier vehicle. And, as shown in Theorem 1, in the random oracle model, signature signiMi⋅P is nonforgery for adaptive selection message and identity attack under the difficulty of CDHP.


#### 5.3.2. Anonymity

The INT valueni given by AP (node or TAs) produces the one-off public key Yi used in message authentication, which cannot be linked to the real identity. Moreover, in order to distinguish a one-off key pair for each message, Vi changes the random number each time Yi,ri is produced. Therefore, for the reason that TA is completely trusted, node privacy can be securely protected. For trust-based anonymous authentication, TA periodically distributes Ha to IOV nodes and uses its private key to sign. Ha’s internal position on behalf of the trust value of Vi, however, does not link to the real identity of Vi and the true value of trust. Therefore, the proposed scheme provides anonymous authentication of identity privacy-preserving based on trust.


#### 5.3.3. Traceability

Through the equationRIDi=IDi,2⊕H1β⋅IDi,1,Ti,Tpub, TRA can track the identity of a malicious vehicle. Accordingly, when a vehicle is marked as controversial, TRA can track malicious vehicles to meet traceability requirements. Hence, our proposed scheme provides conditional privacy-preserving authentication.


#### 5.3.4. Unlinkability

In our proposal, the INT values in aggregated lists (Ha or Ha_APj) are broken down into different levels. According to the INT value published by AP, each node generates ni. We can set up an INT value range ni=h1TVi‖AC_TVi to represent a set of nodes that have the same trust level. Therefore, the trust value of many nodes may belong to the same level of trust. Even if the message receiver validates that the same ni exists in Ha or Ha_APj, if during the period of authentication from the same node sent two or more messages, message receiver is indistinguishable. Specific vehicles cannot be linked to any two signatures, so the proposed scheme supports unlinkability.


#### 5.3.5. Replaying Resistance

The time stampti in the message IDi,Yi,signi,Mi,ti,Qi is used to keep the message fresh. Vehicles will check the timestamp ti freshness, so that they can detect the replay message. Therefore, our proposed scheme for IOV provides resistance against the replay attack.


## 5.1. Security Model

The security model of the proposed scheme is to design a game between challengerC and adversary A, that is, whether adversary A can win the challenge given by challenger C in polynomial time with a nonnegligible probability. Adversary A performs the query described below in the game.(i)
Setup: challenger C creates the public key and gives it to A.(ii)
h2⋅queries: in this query, challenger C chooses a random vi∈Zq∗ and then adds IDi,QIDi,vi into the hash list h2list. Finally, C sends vi=h2IDi,QIDi to A.(iii)
Y⋅queries: challenger C picks random xi∈Zq∗, inserts tuple Y1i, Y2i, xi into Ylist and responds to A with Y1i, Y2i in query i.(iv)
H2⋅queries: in this query, challenger C picks random yi∈Zq∗, inserts the tuples Y1j, Y2i, yi, H2i into Ylist and responds to A with H2i in query i.(v)
H3⋅queries: in this query, challenger C picks random ui∈Zq∗, inserts the tuple ui, mi, H3i to H3list and responds to A with H3mi,IDi,Yi,ti=H3i.(vi)
Partial private key queries: in this query, challenger C calculates pskIDi and then the value pskIDi is outputted to A.(vii)
Sign queries: after receiving the message Mi, C generates the request message IDi,Yi,signi,Mi,ti,Qi and sends it to A.The probability thatA may violate the authentication of proposed scheme Γ is expressed as AdvΓAuthA.Definition 3.
The proposed schemeΓ for IOV is secure if AdvΓAuthA is negligible for any polynomial adversary A.


## 5.2. Security Proof

In this subsection, to prove unforgeability of the proposed scheme, we need to show that it is unforgeable against adversaryA. If and only if CDHP is difficult, our scheme is safe under adaptive selective message attack in the random prediction model.Theorem 1.
Unforgeability: make the prime order groupG into τ,t′,ε′− CDH group, which implies that no challenger Ct′,ε′ can destroy CDHP on it. Therefore, the proposal is that the existence of an attack on adaptive selection is t,ε,qY,qh2,qH2,qH3,qpk,qS-secure, and ε=eqSε′, and cC and t=t′−cCqY+qh2+qH2+qH3+qpk+qS is constant, where e is the basis of the natural logarithm.Game: adversary A has the advantage of ε and time t. Suppose A queries qY times for Yqueries, qh2 times for h2queries, qH2 times for H2queries, qH3 times for H3queries, qpk times for Partial private key queries, and qS times for Sign queries. And then, a challenger C who has the advantage of at least ε/eqS and runtime:(15)t+cCqY+qh2+qH2+qH3+qpk+qS,to solve CDHP.Proof.
ChallengerC gives parameters q, G, e and random instance of CDHP, which is P, aP, bP, whereas P is a random generator of G with order q, a and b are random in Zq∗. Let D=abP∈G be the solution for CDHP. Challenger C interacts with A to find the solution through the following query.
Setup: challenger C creates Kpub=q,G,P,h2,H2,H3 and gives it to A. This is h2, H2, and H3, which is a random oracle controlled by C, as follows:
h2⋅queries: when A makes a h2 query with parameter IDi,QIDi, C checks whether tuples already exist in the hash list h2list. In that case, C transfers vi=h2IDi,QIDi to A. If not, C selects a random vi∈Zq∗ and then adds IDi,QIDi,vi into the hash list h2list. Finally, C sends vi=h2IDi,QIDi to A.
Y⋅queries: challenger C can query the public key Y. In response to queries, challenger C keeps tuple list Y1j, Y2j, xj called Ylist. At first, it was empty. C selects random xi∈Zq∗, Y2i∈0,1n and calculates Y1j=xiP⋅aP. It then adds the tuples Y1i, Y2i, xi into Ylist and when querying i, it responds to A with Y1i and Y2i.
H2⋅queries: in response to queries, challenger C maintains list H2list in tuple Y1j, Y2j, yj, H2j. C picks random yi∈Zq∗ and sets H2i=H2Y1i‖Y2i=yiP. Then, it adds the tuples Y1j, Y2i, yi, H2i into Ylist and when querying i, it responds to A with H2i.
H3⋅queries: in response to queries, challenger C keeps tuple list uj, mj, H3j, called H3list. At first, it was empty. To respond to the query mi, challenger C will do the following:(1)
If it already exists in the tupleui, mi, H3i in H3list when mi is queried, C responds to H3mi,IDi,Yi,ti=H3i(2)
Otherwise,C only produces random bit ib∈0,1, which will be determined later for ξ in Prbi=1=ξ(3)
C selects random number ui∈Zq∗. If bi=0, it then sets H3mi,IDi,Yi,ti=H3i=uiP. If bi=1, it then sets H3mi,IDi,Yi,ti=H3i=bP⋅uiP. Afterwards, C adds the tuple ui, mi, H3i to H3list and responds to A with H3mi,IDi,Yi,ti=H3i. Note that H3i is homogeneous in G and independent of A.
Partial private key queries: A queries partial private key for pseudoidentity IDi, C calculates QIDi=diP and then examines if the tuple IDi,QIDi,vi already exists in the hash list h2list, where di is a random number. When the corresponding tuple IDi,QIDi,viC is not found, C will output a failure and stop because the query cannot be answered coherently. Or else C evaluates pskIDi=di+h2IDi,QIDi×αmodq and outputs pskIDi to A. It is worth noting that by calling this part of the partial private key query, A cannot obtain the pskIDj of the target user through IDj.
Sign queries: the signature oracle is simulated by maintaining the list of tuples mj, H3j, σj in response to any message mj signature query. We call this list Slist, which was initially empty. When A uses the message mi to query oracle Sign, C responds to the query.(1)
If the querymi already exists in the tuple mi, H3i, σi in Slist, challenger C responds with σi.(2)
Besides,C inspects whether ui,mi,H3i, Y1i,Y2i,xi, IDi,QIDi,vi, and Y1i,Y2i,yi,H2i exist. Otherwise, C executes h2-queries to obtain IDi,QIDi,vi, Y-queries to gain Y1i,Y2i,xi, H2-queries to obtain Y1i,Y2i,yi,H2i, and H3-queries to gain ui,mi,H3i. Next, C picks two random numbers ri and hi. If bi=0, σi=hi⋅ri+pskIDimodq. If bi=1, it sets σi=∗, value of placeholder. Finally, it adds tuple mi,H3i,σi to list Slist and replies to σi.
Challenge: challenger C publishes the signature query mi. Challenger C obtains σi∈G by running the above algorithm in response to Sign queries. Note that C can use the public key Kpub to run A to obtain P, aP, H3i, σi, which can be converted into a valid Diffie–Hellman tuple.
Claim: A stops, admit defeat, or forged signature m′, σ′, where m′=mi∗, for some i∗ where A does not query the signature. If A is successfully forged, it means that CDHP is solved. At this time, C outputs “success.” Otherwise, the C output “fails.” A performed exactly as expected in the game model. Thus,(16)AdvC=PrCAP,aP,bP=success:a,b∈Zq∗=VerifyY,m′,σ′=valid:m′,σ′←AYY,r←OneoffKeyGen=ε.
By modifying, ifA cannot create forgery, C will also fail. But if A finds mi∗’s forgery successfully, C claims success only at bi∗=1, and A use index i1,i2,…,iqS to qS sign oracle query for messages with bi=0 (for bi=1, A will stop immediately after the failure is declared), then AdvC′=AdvC⋅Prbi∗=1⋅Prbij=0,j=1,2,…,qS=ξ1−ξqSε.
Therefore, challengerC uses signature forger A to solve CDHP, which has the advantage of ε′ and time t′. The maximization of function ξ1−ξqSε is at ξ=1/1+qS, of which it has the following values:(17)11+qS1−11+qSqS⋅ε=1qS1−11+qSqS+1⋅ε.
For largeqS, 1−1/1+qSqS+1≈1/e.
Meanwhile,C’s running time consists of A’s running time and the additional overhead, in which the group multiplication to evaluate each signature and hash request from C is the main part. Any such multiplication can be done by using up to cC time units on G. C may have to answer a request like qY+qh2+qH2+qH3+qpk+qS. Therefore, its overall runtime is t+cCqY+qh2+qH2+qH3+qpk+qS.
If there is a forgeryC that t,ε,qY,qh2,qH2,qH3,qpk,qS breaks our proposed scheme on G, then there is a challenger Ct′,ε′ that can destroy CDHP, where ε′=ε/eqS and t′=t+cCqY+qh2+qH2+qH3+qpk+qS. On the contrary, if the group G is a τ,t′,ε′-CDH group, no challenger could break the proposed scheme, where t=t′−cCqY+qh2+qH2+qH3+qpk+qS and ε=eqSε′.


## 5.3. Security Analysis

We demonstrate that our proposal complies with all security and privacy requirements described in Section3.3. As summarized by the comparison results in Table 3, we compared the proposal with other schemes for meeting security requirements, where SR1, SR2, SR3, SR4, and SR5, respectively, represent the authentication, anonymity, traceability, unlinkability, and replaying resistance. The comparison results show that the proposed scheme is superior. The security requirements of the proposed scheme are analyzed next.Table 3
Comparison of security between related schemes and ours.
Scheme[15][44][45]ProposedSR1√√√√SR2√√√√SR3√√√√SR4√√√SR5√


### 5.3.1. Authentication

For the following reasons, the proposed scheme provides message integrity and validity of sender identity: signaturesigniMi⋅P is used to verify the authenticity of the message sent from vehicle to verifier vehicle. And, as shown in Theorem 1, in the random oracle model, signature signiMi⋅P is nonforgery for adaptive selection message and identity attack under the difficulty of CDHP.


### 5.3.2. Anonymity

The INT valueni given by AP (node or TAs) produces the one-off public key Yi used in message authentication, which cannot be linked to the real identity. Moreover, in order to distinguish a one-off key pair for each message, Vi changes the random number each time Yi,ri is produced. Therefore, for the reason that TA is completely trusted, node privacy can be securely protected. For trust-based anonymous authentication, TA periodically distributes Ha to IOV nodes and uses its private key to sign. Ha’s internal position on behalf of the trust value of Vi, however, does not link to the real identity of Vi and the true value of trust. Therefore, the proposed scheme provides anonymous authentication of identity privacy-preserving based on trust.


### 5.3.3. Traceability

Through the equationRIDi=IDi,2⊕H1β⋅IDi,1,Ti,Tpub, TRA can track the identity of a malicious vehicle. Accordingly, when a vehicle is marked as controversial, TRA can track malicious vehicles to meet traceability requirements. Hence, our proposed scheme provides conditional privacy-preserving authentication.


### 5.3.4. Unlinkability

In our proposal, the INT values in aggregated lists (Ha or Ha_APj) are broken down into different levels. According to the INT value published by AP, each node generates ni. We can set up an INT value range ni=h1TVi‖AC_TVi to represent a set of nodes that have the same trust level. Therefore, the trust value of many nodes may belong to the same level of trust. Even if the message receiver validates that the same ni exists in Ha or Ha_APj, if during the period of authentication from the same node sent two or more messages, message receiver is indistinguishable. Specific vehicles cannot be linked to any two signatures, so the proposed scheme supports unlinkability.


### 5.3.5. Replaying Resistance

The time stampti in the message IDi,Yi,signi,Mi,ti,Qi is used to keep the message fresh. Vehicles will check the timestamp ti freshness, so that they can detect the replay message. Therefore, our proposed scheme for IOV provides resistance against the replay attack.


## 5.3.1. Authentication

For the following reasons, the proposed scheme provides message integrity and validity of sender identity: signaturesigniMi⋅P is used to verify the authenticity of the message sent from vehicle to verifier vehicle. And, as shown in Theorem 1, in the random oracle model, signature signiMi⋅P is nonforgery for adaptive selection message and identity attack under the difficulty of CDHP.


## 5.3.2. Anonymity

The INT valueni given by AP (node or TAs) produces the one-off public key Yi used in message authentication, which cannot be linked to the real identity. Moreover, in order to distinguish a one-off key pair for each message, Vi changes the random number each time Yi,ri is produced. Therefore, for the reason that TA is completely trusted, node privacy can be securely protected. For trust-based anonymous authentication, TA periodically distributes Ha to IOV nodes and uses its private key to sign. Ha’s internal position on behalf of the trust value of Vi, however, does not link to the real identity of Vi and the true value of trust. Therefore, the proposed scheme provides anonymous authentication of identity privacy-preserving based on trust.


## 5.3.3. Traceability

Through the equationRIDi=IDi,2⊕H1β⋅IDi,1,Ti,Tpub, TRA can track the identity of a malicious vehicle. Accordingly, when a vehicle is marked as controversial, TRA can track malicious vehicles to meet traceability requirements. Hence, our proposed scheme provides conditional privacy-preserving authentication.


## 5.3.4. Unlinkability

In our proposal, the INT values in aggregated lists (Ha or Ha_APj) are broken down into different levels. According to the INT value published by AP, each node generates ni. We can set up an INT value range ni=h1TVi‖AC_TVi to represent a set of nodes that have the same trust level. Therefore, the trust value of many nodes may belong to the same level of trust. Even if the message receiver validates that the same ni exists in Ha or Ha_APj, if during the period of authentication from the same node sent two or more messages, message receiver is indistinguishable. Specific vehicles cannot be linked to any two signatures, so the proposed scheme supports unlinkability.


## 5.3.5. Replaying Resistance

The time stampti in the message IDi,Yi,signi,Mi,ti,Qi is used to keep the message fresh. Vehicles will check the timestamp ti freshness, so that they can detect the replay message. Therefore, our proposed scheme for IOV provides resistance against the replay attack.


## 6. Performance Evaluation

In this section, we will analyze the performance of the proposed scheme and compare it with the existing schemes proposed by Horng et al. [15], Bayat et al. [44], and Zhang et al. [45], respectively. The analysis of computation cost and communication overhead is highlighted below.


### 6.1. Computation Overhead and Comparison

The computational cost refers to the computational overhead of each entity in the authentication process. Table4provides the main operations of the four schemes in signing messages and authenticating a single signature, respectively.Table 4
Comparison of computation cost.
SchemeSigningVerificationHorng et al. [15]4Tsm−bp+1Tmtp2Tbp+2Tsm−bp+1TmtpBayat et al. [44]5Tsm−bp+1Tmtp3Tbp+1TmtpZhang et al. [45]2Tmtp2Tbp+2nTsm−bp+2nTmtpProposed scheme1Tmtp+1Tsm−ecc3Tsm−ecc+1TmtpThe crypto-operations of Horng et al.’s scheme [15], Bayat et al.’s scheme [44] and Zhang et al.’s scheme [45] are established on bilinear pairings. Furthermore, the crypto-operations of the proposed scheme are established on ECC. In order to reach the 80-bit security level, we consider various parameters in pairing and ECC-based schemes, as given in Table 5.Table 5
Length of the group in bilinear pairing and ECC.
Type of the systemType of curveCyclic groupp−pGLength of elements of the groupBilinear pairingE:y2=x3+xmodp,a,b∈FpG1Pp−=512 bits (64 bytes)q=160 bitsG1=1024 bitsECCE:y2=x3+ax+bmodp,a,b∈FpGPp=160 bits (20 bytes)q=160 bitsG=320 bitsBefore the analysis of the computation cost, we define the time required for each cryptographic-related operation for signature and verification; a few notes to be used in comparison will be described below. In this paper, we use the experiment in Ref. [40] to learn the execution time of the basic cryptographic operation by using the MIRACL library, running on the platform of 3.4 GHZ i7-4770. The following results are obtained from [40]: Tsm−ecc is 0.442 ms, Tsm−ecc−s is 0.0276 ms, Tsm−bp is 1.709 ms, Tmtp is 4.406 ms, and Tbp is 4.211 ms. As a result of these, operating mainly determines the speed of signature verification, We’re just going to talk about these five operations and ignore others, such as addition and one-way hash function.(i)
Tsm−ecc: the execution time of a scale multiplication operation x⋅P associated with ECC, where x∈Zq∗ and P∈G(ii)
Tsm−ecc−s: the execution time of a small scale multiplication operation vi⋅p used in the small exponential test technique, where P∈G, vi is a small random integer in 1,2t and t is a small integer(iii)
Tsm−bp: the execution time of a scale multiplication operation x⋅P associated with the bilinear pairing, where x∈Zq∗ and P∈G(iv)
Tmtp: the execution time of a hash-to-point operation associated with the bilinear pairing, where the hash function maps a string to a point of G(v)
Tbp: the execution time of a bilinear pairing operation eS,T, where S,T∈GFirst, we review the message signature time overhead. For Horng et al.’s b-SPECS + scheme [15], the vehicle needs to perform four scalar multiplication operations and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 4Tsm−bp+1Tmtp. For Bayat et al.’s scheme [44], the vehicle is required to perform five scalar multiplication operations and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 5Tsm−bp+1Tmtp. For Zhang et al.’s scheme [45], the vehicle needs to perform two hash-to-point operations related to the bilinear pairing. To sum up, the time overhead for this scheme is 2Tmtp. For the proposed scheme, the vehicle needs to perform one scalar multiplication operation associated with the ECC and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 1Tsm−ecc+1Tmtp.We observe the verification time of the signature through the verification equation. For Horng et al.’s scheme [15], the verifier is required to perform two bilinear pairing operations, two scalar multiplication operations, and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 2Tbp+2Tsm−bp+1Tmtp. For Bayat et al.’s scheme [44], the verifier is required to perform three bilinear pairing operations, one scalar multiplication operation, and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 3Tbp+1Tmtp. For Zhang et al.’s scheme [45], the verifier is required to perform two bilinear pairing operations, two hash-to-point operations associated with the bilinear pairing, and two scalar multiplication operations. To sum up, the time overhead for this scheme is 2Tbp+2Tsm−bp+2Tmtp. In our scheme, we evaluate the operation time of two parts of verification: trust authentication and signature verification. Thus, the verifier needs to perform three scalar multiplication operations associated with the ECC and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 3Tsm−ecc+1Tmtp.The number of signatures during verification is then denoted byn. By batch verification of the equation, we can obtain that the verification time of n different signatures is 2Tbp+2nTsm−bp+nTmtp=7.824n+8.422ms for Horng et al.’s scheme [15], 3Tbp+nTmtp=4.406n+12.633ms for Bayat et al.’s scheme [44], and 2Tbp+2nTsm−bp+2nTmtp=12.23n+8.422ms for Zhang et al.’s scheme [45], respectively. For the authentication phase of n signatures of our proposed scheme, the execution time of the phase is 3nTsm−ecc+nTmtp=5.732nms.Figure4 shows the computational overhead of signing messages in each scheme. The linear relationship between the computation cost and the number of messages of four authentication schemes is given. Our proposed scheme has a slightly better performance time than Refs. [15, 44, 45]. The computational efficiency of our second scheme in this phase has been improved by 56.88% than Horng et al.’s scheme [15], by 62.57% than Bayat et al.’s scheme [44], and by 40.30% than Zhang et al.’s scheme [45].Figure 4
Delay in signing messages with respect to the number of messages.Figure5 shows the total execution time for verifying n messages, as the number of vehicles in each scenario is increasing. We can see from the figure that Bayat et al.’s scheme’s [44] execution time is less than Horng et al.’s scheme [15], Zhang et al.’s scheme [45], and our scheme in the authentication phase.Figure 5
Delay in verifying messages with respect to the number of messages.


### 6.2. Communication Overhead

In this subsection, we compare the communication overhead of the proposed scheme with other schemes, as given in Table6.Table 6
Comparison of communication cost.
SchemeMessageLength (byte)Horng et al. [15]IDi,Mi,σi63Bayat et al. [44]AIDi,Ti,Ui388Zhang et al. [45]mi,PPIDi,t,σi,t148Proposed schemeIDi,Yi,signi,Mi,ti,Qi228According to the analysis in Section 6.1,p− and p are 64 and 20 bytes, respectively. Consequently, bytes of elements in group G1 and group G are 128 bytes and 40 bytes, respectively. Assuming that the number of bytes of message time ti is 4 bytes, the number of bytes of RID is 20 bytes, and the number of bytes of the general hash function’s output is 20 bytes, the communication overhead of a complete verification in the authentication scheme of IOV usually consists of vehicle signatures, pseudoidentities, current time stamps, and public keys, while the message itself is not considered.Because of identity-based encryption, Horng et al.’s scheme [15] does not require any signing certificate together with the message to send. Instead, send a 42 byte pseudoidentity, i.e., IDi=IDi1+IDi2=42 bytes, and the length of a signature is 21 bytes. Thus, the total transmission overhead is 42+21=63 bytes. In Bayat et al.’s scheme [44], the verifier receives the broadcast anonymous identity and signature AIDi,Ti,Ui from the vehicle, where AIDi=AIDi1,AIDi2,AIDi1,AIDi2,Ui∈G1 and Ti is the timestamp. To sum up, the communication cost is 128 × 3 + 4 = 388 bytes. In Zhang et al.’s scheme [45], the vehicle signs the message as mi,PPIDi,t,σi,t. The overhead of communication can also be calculated using the method shown above. For our proposed scheme, the vehicle signs the message as IDi,Yi,signi,M,ti,Qi and broadcasts it to the verifier, where IDi=IDi,1,IDi,2,Ti, Qi, signi both are elements in G. Yi=Y1i,Y2i where Y1i is an element in G, and Y2i is an array of 20 bytes. Ti and ti are the timestamp. Thus, the proposed scheme has a communication overhead of 40 × 5 + 20 +4 × 2 = 228 bytes.


## 6.1. Computation Overhead and Comparison

The computational cost refers to the computational overhead of each entity in the authentication process. Table4provides the main operations of the four schemes in signing messages and authenticating a single signature, respectively.Table 4
Comparison of computation cost.
SchemeSigningVerificationHorng et al. [15]4Tsm−bp+1Tmtp2Tbp+2Tsm−bp+1TmtpBayat et al. [44]5Tsm−bp+1Tmtp3Tbp+1TmtpZhang et al. [45]2Tmtp2Tbp+2nTsm−bp+2nTmtpProposed scheme1Tmtp+1Tsm−ecc3Tsm−ecc+1TmtpThe crypto-operations of Horng et al.’s scheme [15], Bayat et al.’s scheme [44] and Zhang et al.’s scheme [45] are established on bilinear pairings. Furthermore, the crypto-operations of the proposed scheme are established on ECC. In order to reach the 80-bit security level, we consider various parameters in pairing and ECC-based schemes, as given in Table 5.Table 5
Length of the group in bilinear pairing and ECC.
Type of the systemType of curveCyclic groupp−pGLength of elements of the groupBilinear pairingE:y2=x3+xmodp,a,b∈FpG1Pp−=512 bits (64 bytes)q=160 bitsG1=1024 bitsECCE:y2=x3+ax+bmodp,a,b∈FpGPp=160 bits (20 bytes)q=160 bitsG=320 bitsBefore the analysis of the computation cost, we define the time required for each cryptographic-related operation for signature and verification; a few notes to be used in comparison will be described below. In this paper, we use the experiment in Ref. [40] to learn the execution time of the basic cryptographic operation by using the MIRACL library, running on the platform of 3.4 GHZ i7-4770. The following results are obtained from [40]: Tsm−ecc is 0.442 ms, Tsm−ecc−s is 0.0276 ms, Tsm−bp is 1.709 ms, Tmtp is 4.406 ms, and Tbp is 4.211 ms. As a result of these, operating mainly determines the speed of signature verification, We’re just going to talk about these five operations and ignore others, such as addition and one-way hash function.(i)
Tsm−ecc: the execution time of a scale multiplication operation x⋅P associated with ECC, where x∈Zq∗ and P∈G(ii)
Tsm−ecc−s: the execution time of a small scale multiplication operation vi⋅p used in the small exponential test technique, where P∈G, vi is a small random integer in 1,2t and t is a small integer(iii)
Tsm−bp: the execution time of a scale multiplication operation x⋅P associated with the bilinear pairing, where x∈Zq∗ and P∈G(iv)
Tmtp: the execution time of a hash-to-point operation associated with the bilinear pairing, where the hash function maps a string to a point of G(v)
Tbp: the execution time of a bilinear pairing operation eS,T, where S,T∈GFirst, we review the message signature time overhead. For Horng et al.’s b-SPECS + scheme [15], the vehicle needs to perform four scalar multiplication operations and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 4Tsm−bp+1Tmtp. For Bayat et al.’s scheme [44], the vehicle is required to perform five scalar multiplication operations and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 5Tsm−bp+1Tmtp. For Zhang et al.’s scheme [45], the vehicle needs to perform two hash-to-point operations related to the bilinear pairing. To sum up, the time overhead for this scheme is 2Tmtp. For the proposed scheme, the vehicle needs to perform one scalar multiplication operation associated with the ECC and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 1Tsm−ecc+1Tmtp.We observe the verification time of the signature through the verification equation. For Horng et al.’s scheme [15], the verifier is required to perform two bilinear pairing operations, two scalar multiplication operations, and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 2Tbp+2Tsm−bp+1Tmtp. For Bayat et al.’s scheme [44], the verifier is required to perform three bilinear pairing operations, one scalar multiplication operation, and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 3Tbp+1Tmtp. For Zhang et al.’s scheme [45], the verifier is required to perform two bilinear pairing operations, two hash-to-point operations associated with the bilinear pairing, and two scalar multiplication operations. To sum up, the time overhead for this scheme is 2Tbp+2Tsm−bp+2Tmtp. In our scheme, we evaluate the operation time of two parts of verification: trust authentication and signature verification. Thus, the verifier needs to perform three scalar multiplication operations associated with the ECC and one hash-to-point operation associated with the bilinear pairing. To sum up, the time overhead for this scheme is 3Tsm−ecc+1Tmtp.The number of signatures during verification is then denoted byn. By batch verification of the equation, we can obtain that the verification time of n different signatures is 2Tbp+2nTsm−bp+nTmtp=7.824n+8.422ms for Horng et al.’s scheme [15], 3Tbp+nTmtp=4.406n+12.633ms for Bayat et al.’s scheme [44], and 2Tbp+2nTsm−bp+2nTmtp=12.23n+8.422ms for Zhang et al.’s scheme [45], respectively. For the authentication phase of n signatures of our proposed scheme, the execution time of the phase is 3nTsm−ecc+nTmtp=5.732nms.Figure4 shows the computational overhead of signing messages in each scheme. The linear relationship between the computation cost and the number of messages of four authentication schemes is given. Our proposed scheme has a slightly better performance time than Refs. [15, 44, 45]. The computational efficiency of our second scheme in this phase has been improved by 56.88% than Horng et al.’s scheme [15], by 62.57% than Bayat et al.’s scheme [44], and by 40.30% than Zhang et al.’s scheme [45].Figure 4
Delay in signing messages with respect to the number of messages.Figure5 shows the total execution time for verifying n messages, as the number of vehicles in each scenario is increasing. We can see from the figure that Bayat et al.’s scheme’s [44] execution time is less than Horng et al.’s scheme [15], Zhang et al.’s scheme [45], and our scheme in the authentication phase.Figure 5
Delay in verifying messages with respect to the number of messages.


## 6.2. Communication Overhead

In this subsection, we compare the communication overhead of the proposed scheme with other schemes, as given in Table6.Table 6
Comparison of communication cost.
SchemeMessageLength (byte)Horng et al. [15]IDi,Mi,σi63Bayat et al. [44]AIDi,Ti,Ui388Zhang et al. [45]mi,PPIDi,t,σi,t148Proposed schemeIDi,Yi,signi,Mi,ti,Qi228According to the analysis in Section 6.1,p− and p are 64 and 20 bytes, respectively. Consequently, bytes of elements in group G1 and group G are 128 bytes and 40 bytes, respectively. Assuming that the number of bytes of message time ti is 4 bytes, the number of bytes of RID is 20 bytes, and the number of bytes of the general hash function’s output is 20 bytes, the communication overhead of a complete verification in the authentication scheme of IOV usually consists of vehicle signatures, pseudoidentities, current time stamps, and public keys, while the message itself is not considered.Because of identity-based encryption, Horng et al.’s scheme [15] does not require any signing certificate together with the message to send. Instead, send a 42 byte pseudoidentity, i.e., IDi=IDi1+IDi2=42 bytes, and the length of a signature is 21 bytes. Thus, the total transmission overhead is 42+21=63 bytes. In Bayat et al.’s scheme [44], the verifier receives the broadcast anonymous identity and signature AIDi,Ti,Ui from the vehicle, where AIDi=AIDi1,AIDi2,AIDi1,AIDi2,Ui∈G1 and Ti is the timestamp. To sum up, the communication cost is 128 × 3 + 4 = 388 bytes. In Zhang et al.’s scheme [45], the vehicle signs the message as mi,PPIDi,t,σi,t. The overhead of communication can also be calculated using the method shown above. For our proposed scheme, the vehicle signs the message as IDi,Yi,signi,M,ti,Qi and broadcasts it to the verifier, where IDi=IDi,1,IDi,2,Ti, Qi, signi both are elements in G. Yi=Y1i,Y2i where Y1i is an element in G, and Y2i is an array of 20 bytes. Ti and ti are the timestamp. Thus, the proposed scheme has a communication overhead of 40 × 5 + 20 +4 × 2 = 228 bytes.


## 7. Conclusion and Future Work

In the proposal, we proposed a scheme to authenticate the trust of vehicle nodes in IOV. First, our scheme not only provided anonymous authentication of trust but also an effective conditional privacy tracking mechanism, which achieved identity authentication and conditional preserving of privacy, and improved the reliability of V2V communication messages. Next, our proposed scheme realized efficient certificateless authentication, which is based on ECC and replaced the trust on revocation list. Furthermore, we also proved that the proposed scheme is secure against existential forgery in the random oracle model under the CDHP. In future work, we will further consider the characteristics of IOV to design a more efficient scheme, such as high dynamics. In addition, testing the efficiency, adaptability, and robustness of the scheme in a real environment is also an issue to be addressed in the future.



---

*Source: 8758156-2022-08-18.xml*