# A Certificateless Pairing-Free Authentication Scheme for Unmanned Aerial Vehicle Networks

Authors: Jingyi Li; Yujue Wang; Yong Ding; Wanqing Wu; Chunhai Li; Huiyong Wang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

In unmanned aerial vehicle networks (UAVNs), unmanned aerial vehicles with restricted computing and communication capabilities can perform tasks in collaborative manner. However, communications in UAVN confront many security issues, for example, malicious entities may launch impersonate attacks. In UAVN, the command center (CMC) needs to perform mutual authentication with unmanned aerial vehicles in clusters. The aggregator (AGT) can verify the authenticity of authentication request from CMC; then, the attested authentication request is broadcasted to the reconnaissance unmanned aerial vehicle (UAV) in the same cluster. The authentication responses from UAVs can be verified and aggregated by AGT before being sent to CMC for validation. Also, existing solutions cannot resist malicious key generation center (KGC). To address these issues, this paper proposes a pairing-free authentication scheme (CLAS) for UAVNs based on the certificateless signature technology, which supports batch verification at both AGT and CMC sides so that the verification efficiency can be improved greatly. Security analysis shows that our CLAS scheme can guarantee the unforgeability for (attested) authentication request and (aggregate) responses in all phases. Performance analysis indicates that our CLAS scheme enjoys practical efficiency.


---

## Body

## 1. Introduction

Unmanned aerial vehicles in UAVN have been widely used in many civilian and military fields, for example, data collection, communication relay, and military electronic reconnaissance [1]. Unmanned aerial vehicles can be classified into three categories according to the working mode, namely, unmanned aerial vehicles under the control of a remote operator, under the supervision of a remote supervisor, and without an operator and supervisor. UAVNs can be deployed in mesh topology or multistar topology [2]. With the mesh topology, all unmanned aerial vehicles are connected to CMC directly, where all communication between unmanned aerial vehicles and CMC may cause network congestion. Although with the mesh topology, each unmanned aerial vehicle can communicate with each other, it is hard to be expanded and controlled [3]. With the multistar topology, each unmanned aerial vehicle is connected to CMC; thus, any illegal requests or responses in UAVNs can be easily detected.However, when deployed in an open communication environment, the UAVN system confronts many security issues [4, 5]. Due to multiple connections among unmanned aerial vehicles, a malicious entity may control some unmanned aerial vehicle or launch impersonate attacks. Thus, it is important to enforce a secure and efficient authentication mechanism in UAVNs [6, 7]. Recently, Wang et al. [8] proposed an identity-based authentication scheme, which did not consider the verification mechanisms at the AGT side for validating the real sources of the authentication request from CMC and responses from UAVs. Li et al. [9] designed an identity-based aggregate authentication framework in bilinear groups, where the private keys of UAVs are generated by KGC. Thus, malicious KGC may launch attacks by sending illegal authentication request to AGTs and UAVs.


### 1.1. Our Contributions

To address the abovementioned issues, this paper proposes a certificateless pairing-free aggregate authentication scheme (CLAS) for UAVNs. In CLAS, KGC is responsible for generating partial private keys for all entities including CMC, AGTs, and UAVs. Each AGT acts as the cluster head of some cluster and plays the role of an intermediate between CMC and UAVs in the respective cluster. Each authentication request from CMC can be validated by AGT, which is then attested and broadcasted to UAVs in its administrative domain. A verification process can be run by each UAV so that the true source of the (forwarded) authentication request can be validated. AGT can aggregate all responses of UAVs in its administrative cluster before performing verification procedure in batch. Then, the response of AGT is further combined with the aggregated responses of UAVs, which can be validated by CMC in batch to complete the authentication process.This paper describes a concrete CLAS construction based on the certificateless signature technology. Security analysis shows that our CLAS construction can protect malicious entity from forging the authentication request and responses of others and can resist against the malicious KGC. Performance comparison shows that our CLAS construction enjoys better computational efficiency compared with Wang et al.’s scheme [8] and Li et al.’s scheme [9].


### 1.2. Related Works

Taking advantages of recent advancement and development in information and communication technology, unmanned aerial vehicles have been employed to perform some special tasks in real-world applications [10]. In [11], Islam and Shin proposed a blockchain-based solution for safe healthcare, which uses the unmanned aerial vehicle (UAV) to collect health data (HD) from users. Liu et al. [1] presented a detailed survey on the opportunities and challenges of IoE supported by unmanned aerial vehicles. Jiang et al. [12] proposed a trust-based energy efficient data collection with the unmanned aerial vehicle (TEEDC-UAV) scheme, which can prolong lifetime in a trusted way. In the TEEDC-UAV scheme, an ant colony-based unmanned aerial vehicle (UAV) trajectory optimization algorithm was proposed, which constituted the most data anchor points in the working field with the shortest trajectory possible. In view of the untrusted broadcast features and wireless transmission of UAV networks, a novel privacy-preserving secure spectrum trading and sharing scheme based on blockchain technology is proposed in [13].For the Internet of Drones (IoD) infrastructure, Cho et al. [14] proposed a framework called SENTINEL (Secure and Efficient autheNTIcation for uNmanned aErial vehicLes). Khanh et al. [15] presented a safe and effective authentication mechanism suitable for the dynamic environment of the unmanned aerial vehicle. In order to solve the information security problem of unmanned aerial vehicle ad-hoc network communication, Sun et al. [2] introduced an efficient and energy-saving distributed network architecture based on clustering stratification. Owing to the unreliable wireless channel and high-dynamic topology of Unmanned Aerial Vehicles Ad-Hoc Network (UAANET), the loss of some certain group key broadcast messages by nodes occurs frequently. Therefore, Li et al. [16] proposed a mutual-healing group key distribution scheme based on the blockchain. Yang et al. [17] investigated degradation-of-QoS attacks in vehicular ad hoc networks, where the attacker is able to relay the authentication exchanges but cannot relay the service afterwards. In [18], Gope et al. proposed a novel anonymous authentication scheme for RFID-enabled UAV applications using Physically Unclonable Functions (PUF).Al-Riyami et al. [19] first introduced and made concrete the concept of certificateless public key cryptography (CL-PKC), a model for the use of public key cryptography which avoids the inherent escrow of identity-based cryptography. Baek et al. [20] considered a relaxation of the original model of CLPKE and proposed a new CLPKE scheme that does not depend on the bilinear pairings. In order to ensure security for interactions between these smart things, Yeh et al. [21] presented a certificateless signature scheme for smart objects in IoT-based pervasive computing environments. Jia et al. [22] made an improvement on the scheme of Yeh et al.’s certificateless signature scheme; they presented an improved scheme and demonstrated its unforgeability against superadversaries in the random oracle model. Zhao et al. [23] presented an advanced efficient CLAS scheme with elliptic curve cryptography for the IoV environment. Furthermore, their scheme used pseudonyms in communications to prevent vehicles from revealing their identity. Shu et al. [24] presented a certificateless aggregate signature scheme for blockchain-based MCPS, which can realize the authentication of related medical staffs, medical equipment, and medical apps, ensure the integrity of medical records, and support the secure storage and sharing of medical information.


### 1.3. Paper Organization

The structure of this paper is organized as follows. In Section2, we introduce the system architecture and system requirements for CLAS. A concrete CLAS construction is presented in Section 3, followed by its security and efficiency analysis in Section 4. Finally, Section 5 concludes the paper.


## 1.1. Our Contributions

To address the abovementioned issues, this paper proposes a certificateless pairing-free aggregate authentication scheme (CLAS) for UAVNs. In CLAS, KGC is responsible for generating partial private keys for all entities including CMC, AGTs, and UAVs. Each AGT acts as the cluster head of some cluster and plays the role of an intermediate between CMC and UAVs in the respective cluster. Each authentication request from CMC can be validated by AGT, which is then attested and broadcasted to UAVs in its administrative domain. A verification process can be run by each UAV so that the true source of the (forwarded) authentication request can be validated. AGT can aggregate all responses of UAVs in its administrative cluster before performing verification procedure in batch. Then, the response of AGT is further combined with the aggregated responses of UAVs, which can be validated by CMC in batch to complete the authentication process.This paper describes a concrete CLAS construction based on the certificateless signature technology. Security analysis shows that our CLAS construction can protect malicious entity from forging the authentication request and responses of others and can resist against the malicious KGC. Performance comparison shows that our CLAS construction enjoys better computational efficiency compared with Wang et al.’s scheme [8] and Li et al.’s scheme [9].


## 1.2. Related Works

Taking advantages of recent advancement and development in information and communication technology, unmanned aerial vehicles have been employed to perform some special tasks in real-world applications [10]. In [11], Islam and Shin proposed a blockchain-based solution for safe healthcare, which uses the unmanned aerial vehicle (UAV) to collect health data (HD) from users. Liu et al. [1] presented a detailed survey on the opportunities and challenges of IoE supported by unmanned aerial vehicles. Jiang et al. [12] proposed a trust-based energy efficient data collection with the unmanned aerial vehicle (TEEDC-UAV) scheme, which can prolong lifetime in a trusted way. In the TEEDC-UAV scheme, an ant colony-based unmanned aerial vehicle (UAV) trajectory optimization algorithm was proposed, which constituted the most data anchor points in the working field with the shortest trajectory possible. In view of the untrusted broadcast features and wireless transmission of UAV networks, a novel privacy-preserving secure spectrum trading and sharing scheme based on blockchain technology is proposed in [13].For the Internet of Drones (IoD) infrastructure, Cho et al. [14] proposed a framework called SENTINEL (Secure and Efficient autheNTIcation for uNmanned aErial vehicLes). Khanh et al. [15] presented a safe and effective authentication mechanism suitable for the dynamic environment of the unmanned aerial vehicle. In order to solve the information security problem of unmanned aerial vehicle ad-hoc network communication, Sun et al. [2] introduced an efficient and energy-saving distributed network architecture based on clustering stratification. Owing to the unreliable wireless channel and high-dynamic topology of Unmanned Aerial Vehicles Ad-Hoc Network (UAANET), the loss of some certain group key broadcast messages by nodes occurs frequently. Therefore, Li et al. [16] proposed a mutual-healing group key distribution scheme based on the blockchain. Yang et al. [17] investigated degradation-of-QoS attacks in vehicular ad hoc networks, where the attacker is able to relay the authentication exchanges but cannot relay the service afterwards. In [18], Gope et al. proposed a novel anonymous authentication scheme for RFID-enabled UAV applications using Physically Unclonable Functions (PUF).Al-Riyami et al. [19] first introduced and made concrete the concept of certificateless public key cryptography (CL-PKC), a model for the use of public key cryptography which avoids the inherent escrow of identity-based cryptography. Baek et al. [20] considered a relaxation of the original model of CLPKE and proposed a new CLPKE scheme that does not depend on the bilinear pairings. In order to ensure security for interactions between these smart things, Yeh et al. [21] presented a certificateless signature scheme for smart objects in IoT-based pervasive computing environments. Jia et al. [22] made an improvement on the scheme of Yeh et al.’s certificateless signature scheme; they presented an improved scheme and demonstrated its unforgeability against superadversaries in the random oracle model. Zhao et al. [23] presented an advanced efficient CLAS scheme with elliptic curve cryptography for the IoV environment. Furthermore, their scheme used pseudonyms in communications to prevent vehicles from revealing their identity. Shu et al. [24] presented a certificateless aggregate signature scheme for blockchain-based MCPS, which can realize the authentication of related medical staffs, medical equipment, and medical apps, ensure the integrity of medical records, and support the secure storage and sharing of medical information.


## 1.3. Paper Organization

The structure of this paper is organized as follows. In Section2, we introduce the system architecture and system requirements for CLAS. A concrete CLAS construction is presented in Section 3, followed by its security and efficiency analysis in Section 4. Finally, Section 5 concludes the paper.


## 2. System Architecture and Requirements

This section formalizes the architecture of CLAS and summarizes its system requirements.


### 2.1. System Architecture

As shown in Figure1, there are four types of entities in a CLAS system, namely, key generation center (KGC), command center (CMC), reconnaissance unmanned aerial vehicles (UAVs), and aggregators (AGTs). KGC is assumed to be fully trusted by all the entities, which is responsible for initializing the CLAS system by generating system public parameters and producing partial private keys for all entities in UAVNs. After system initialization, CMC performs the mutual authentication process with unmanned aerial vehicles before assigning tasks. CMC initializes the authentication process so that AGT can validate, attest, and broadcast authentication request to its administrated UAVs.Figure 1
CLAS model for UAVNs.As the intermediary between CMC and UAV, AGT has the computing and communication capabilities to manage its UAV cluster. UAV only has limited short-distance communication capability; thus, its communication with CMC is performed via the AGT in the cluster. Before responding to the authentication request of CMC, each UAV can verify its true source and the attested request. The responses of UAVs in the same cluster can be validated by AGT in batch. Then, the response of AGT can be further combined with that of UAVs so that the aggregated response is sent to CMC for validation.


### 2.2. System Requirements

Similar to [25], we define two types of adversaries for the CLAS system, namely, Type-I adversary and Type-II adversary. A Type-I adversary acts as an outsider who can replace the public keys of CMC, AGT, and UAV but cannot access the master secret key, whereas a Type-II adversary acts as the KGC that can access the master secret key but cannot replace the public keys of CMC, AGT, and UAV. A CLAS system must satisfy the following system requirements.Unforgeability of authentication request: in the authentication process, for the authentication request generated by CMC, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating CMC to forge an authentication request.Unforgeability of attested request: for the attested authentication request of AGT, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating AGT to forge an attested authentication request.Unforgeability of response: for the responses from UAVs in its administrative cluster of AGT, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating some UAV to forge a response.Unforgeability of aggregate response: for the attested authentication request of some AGT, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating AGT to forge an aggregate response.Resistance against malicious KGC: for the whole authentication procedure, it should be guaranteed that it is existentially unforgeable against Type-II adversary. That is, malicious KGC cannot forge a valid signature of CMC, AGT, or UAV.Acorrect CLAS construction should satisfy the following conditions:(1)
For the partial private key sent by KGC, it can be successfully verified by respective entity including CMC, AGTs, and UAVs(2)
For the authentication request generated by CMC, it can be successfully validated by AGTs(3)
For the attested authentication request forwarded by AGT, it can be successfully validated by UAVs in the same cluster(4)
For the responses of UAVs, they can be validated by AGT in the same cluster(5)
For the aggregate response from AGT, it can be successfully validated by CMC


## 2.1. System Architecture

As shown in Figure1, there are four types of entities in a CLAS system, namely, key generation center (KGC), command center (CMC), reconnaissance unmanned aerial vehicles (UAVs), and aggregators (AGTs). KGC is assumed to be fully trusted by all the entities, which is responsible for initializing the CLAS system by generating system public parameters and producing partial private keys for all entities in UAVNs. After system initialization, CMC performs the mutual authentication process with unmanned aerial vehicles before assigning tasks. CMC initializes the authentication process so that AGT can validate, attest, and broadcast authentication request to its administrated UAVs.Figure 1
CLAS model for UAVNs.As the intermediary between CMC and UAV, AGT has the computing and communication capabilities to manage its UAV cluster. UAV only has limited short-distance communication capability; thus, its communication with CMC is performed via the AGT in the cluster. Before responding to the authentication request of CMC, each UAV can verify its true source and the attested request. The responses of UAVs in the same cluster can be validated by AGT in batch. Then, the response of AGT can be further combined with that of UAVs so that the aggregated response is sent to CMC for validation.


## 2.2. System Requirements

Similar to [25], we define two types of adversaries for the CLAS system, namely, Type-I adversary and Type-II adversary. A Type-I adversary acts as an outsider who can replace the public keys of CMC, AGT, and UAV but cannot access the master secret key, whereas a Type-II adversary acts as the KGC that can access the master secret key but cannot replace the public keys of CMC, AGT, and UAV. A CLAS system must satisfy the following system requirements.Unforgeability of authentication request: in the authentication process, for the authentication request generated by CMC, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating CMC to forge an authentication request.Unforgeability of attested request: for the attested authentication request of AGT, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating AGT to forge an attested authentication request.Unforgeability of response: for the responses from UAVs in its administrative cluster of AGT, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating some UAV to forge a response.Unforgeability of aggregate response: for the attested authentication request of some AGT, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating AGT to forge an aggregate response.Resistance against malicious KGC: for the whole authentication procedure, it should be guaranteed that it is existentially unforgeable against Type-II adversary. That is, malicious KGC cannot forge a valid signature of CMC, AGT, or UAV.Acorrect CLAS construction should satisfy the following conditions:(1)
For the partial private key sent by KGC, it can be successfully verified by respective entity including CMC, AGTs, and UAVs(2)
For the authentication request generated by CMC, it can be successfully validated by AGTs(3)
For the attested authentication request forwarded by AGT, it can be successfully validated by UAVs in the same cluster(4)
For the responses of UAVs, they can be validated by AGT in the same cluster(5)
For the aggregate response from AGT, it can be successfully validated by CMC


## 3. CLAS Construction

This section describes our concrete CLAS construction. The authentication process in UAVNs is shown in Figure2.Figure 2
A procedure of authentication in our CLAS construction.The Discrete Logarithm Assumption in Elliptic Curve (ECDLP): letG be an elliptic curve group with prime order q. Given PandQ∈G, any probabilistic polynomial time algorithm ξ would have negligible probability in computing x∈Zq∗ such that Q=xP.


### 3.1. System Setup

On inputting a security parameterl∈Z+, KGC chooses an additive group G with prime order q on some elliptic curve, where P is a generator of G. Then, KGC chooses b∈Zq∗ randomly and computes(1)B=bP.KGC continues to choose four collision-resistant hash functionsHi:0,1∗⟶Zq∗ for i=1,2,3,and4. Finally, KGC publishes the system parameters params=q,G,P,H1,H2,H3,H4,B and keeps the master secret key msk=b secret.


### 3.2. Key Generation for CMC

KGC sets the partial private key for the control center as follows. KGC chooses a random numbere∈Zq∗ and computes(2)A=eP,(3)a=e+bH1CMCABmodq.Then, KGC sends the partial private keya,A to CMC through a secure channel. CMC can validate the partial private key as follows:(4)aP=?A+H1CMCABB.CMC sets a secret value and generates its public keyPKc and private key SKc as follows. CMC chooses a random number s∈Zq∗ and computes(5)F=sP,(6)M=A+H2CMC‖FF.Then, CMC setsPKc=A,M and SKc=a,s.


### 3.3. Key Generation for Unmanned Aerial Vehicles

LetWi be an unmanned aerial vehicle. For the ease of representation, let Wn be an AGT and W1,…,Wn−1 be UAVs in the administration domain of Wn. KGC sets a partial private key for unmanned aerial vehicles as follows.KGC chooses a random numberdi∈Zq∗ and computes(7)Yi=diP,(8)yi=di+bh1,imodq,where(9)h1,i=H1WiYiB.Then, KGC sends the partial private keyyi,Yi to Wi through a secure channel. The unmanned aerial vehicle Wi can validate the partial private key as follows:(10)yiP=?Yi+h1,iB.The unmanned aerial vehicleWi sets a secret value and generates its public key PKi and private key SKi as follows. Wi chooses a random number ci∈Zq∗ and computes(11)Ci=ciP,(12)Qi=Yi+h2,iCi,where(13)h2,i=H2Wi‖Ci.Then, the unmanned aerial vehicleWi sets PKi=Yi,Qi and SKi=yi,ci.


### 3.4. Authentication Request

LetT∈0,1∗ denote the request information chosen by CMC, which contains the timestamp. CMC randomly picks k∈Zq∗ and computes(14)δ=kP,(15)θ=k+H3TδCMC‖PKca+H2CMC‖Fsmodq.Then, CMC sends the authentication requestT,δ,θ to AGTs.


### 3.5. Request Forwarding

After receiving the requestT,δ,θ from CMC, each AGT Wn validates its authenticity by checking the following equality:(16)θP=?δ+H3TδCMC‖PKcM+H1CMCABB.If it holds, then AGTWn accepts the authentication request from CMC, otherwise terminates. AGT Wn randomly chooses rn∈Zq∗ and computes(17)Rn=rnP,(18)Sn=θ+rn+h4,nyn+h2,ncnmodq,where(19)h4,n=H4TδWn‖PKn‖Rn,(20)h2,n=H2Wn‖Cn.At last, AGTWn broadcasts the tuple of attested authentication request T,δ,Rn,Sn to all UAVs Wii=1,2,…,n−1 in its administrative domain.


### 3.6. UAV Response

Once receivedT,δ,Rn,Sn from AGT Wn, each UAV Wii=1,2,…,n−1 verifies its authenticity by checking the following equality:(21)SnP=?δ+Rn+h4,nQn+h1,nB+H3TδCMC‖PKcM+H1CMCAB,where(22)h1,n=H1WnYnB,(23)h4,n=H4TδWnPKnRn.If it holds, then UAVWi accepts the authentication request from CMC, otherwise terminates. Wi randomly picks fi∈Zq∗ and computes(24)Vi=fiP,(25)Li=fi+h^4,iyi+h2,icimodq,where(26)h^4,i=H4TδWiPKiVi,(27)h2,i=H2Wi‖Ci.Then, UAVWi sends the response tuple σi=Vi,Li to AGT Wn.


### 3.7. AGT Aggregation

Upon receiving the response tuplesVi,Lii=1n−1 from the controlled UAVs Wii=1,2,…,n−1, AGT Wn computes(28)Xn−1=∑i=1n−1Vi,(29)Zn−1=∑i=1n−1Limodq.Then, AGTWn verifies the authenticity of the received response tuples in a batch as follows:(30)Zn−1P=?Xn−1+∑i=1n−1h^4,ih1,iB+∑i=1n−1h^4,iQi,where(31)h^4,i=H4TδWiPKiVi,(32)h1,i=H1WiYiB.If it holds, then all response tuples ofWii=1,2,…,n−1 are valid; otherwise, Wn validates each response tuple in individual to find the invalid one. AGT Wn continues to pick a random element fn∈Zq∗ and compute(33)Xn=Xn−1+fnP,(34)Zn=Zn−1+Lnmodq,where(35)Ln=fn+h^4,nyn+h2,ncnmodq,h^4,n=H4TδWnPKnfnP,(36)h2,n=H2Wn‖Cn.Then, AGTWn sends the aggregate response Xn,Zn to CMC.


### 3.8. CMC Verification

Once received the aggregate responseXn,Zn from AGT Wn, CMC validates its authenticity by checking the following equality:(37)ZnP=?Xn+∑i=1nh^4,ih1,iB+∑i=1nh^4,iQi,where(38)h^4,i=H4T‖δ‖Wi‖PKi‖Vi,(39)h1,i=H1WiYiB.If it holds, then AGTWn and UAVs Wii=1,2,…,n−1 are all accepted as legitimate.Theorem 1.
The proposed CLAS construction is correct.Proof 1.
To prove the correctness of the proposed CLAS construction, it only needs to show that equalities (16), (21), (30), and (37) are satisfied.(1)
For the authentication requestT,δ,θ generated by CMC, equality (16) satisfies as follows:(40)θP=kP+H3TδCMCKca+H2CMCFsP=δ+H3TδCMCPKcA+H2CMCFF+H1CMCA‖BB=δ+H3TδCMCPKcM+H1CMCA‖BB.(2)
For the attested authentication requestT,δ,Rn,Sn from AGT Wn, equality (21) satisfies as follows:(41)SnP=θP+rnP+h4,nyi+h2,ncnP=δ+Rn+h4,nQn+h1,nB+H3TδCMCPKcM+H1CMCABB.(3)
For the response tuplesVi,Lii=1n−1 from the controlled UAVs Wii=1,2,…,n−1, equality (30) holds as follows:(42)Zn−1P=∑i=1n−1LiP=∑i=1n−1fiP+h^4,iyi+h2,iciP=Xn−1+∑i=1n−1h^4,iYi+h1,iB+h2,iCi=Xn−1+∑i=1n−1h^4,ih1,iB+∑i=1n−1h^4,iQi.(4)
For the aggregate response tupleVn,Ln from AGT Wn, equality (37) holds as follows:(43)ZnP=∑i=1nLiP=∑i=1nfiP+h^4,iyi+h2,iciP=Xn+∑i=1nh^4,iYi+h1,iB+h2,iCi=Xn+∑i=1nh^4,ih1,iB+∑i=1nh^4,iQi.
Thus, the proposed CLAS construction is correct.


## 3.1. System Setup

On inputting a security parameterl∈Z+, KGC chooses an additive group G with prime order q on some elliptic curve, where P is a generator of G. Then, KGC chooses b∈Zq∗ randomly and computes(1)B=bP.KGC continues to choose four collision-resistant hash functionsHi:0,1∗⟶Zq∗ for i=1,2,3,and4. Finally, KGC publishes the system parameters params=q,G,P,H1,H2,H3,H4,B and keeps the master secret key msk=b secret.


## 3.2. Key Generation for CMC

KGC sets the partial private key for the control center as follows. KGC chooses a random numbere∈Zq∗ and computes(2)A=eP,(3)a=e+bH1CMCABmodq.Then, KGC sends the partial private keya,A to CMC through a secure channel. CMC can validate the partial private key as follows:(4)aP=?A+H1CMCABB.CMC sets a secret value and generates its public keyPKc and private key SKc as follows. CMC chooses a random number s∈Zq∗ and computes(5)F=sP,(6)M=A+H2CMC‖FF.Then, CMC setsPKc=A,M and SKc=a,s.


## 3.3. Key Generation for Unmanned Aerial Vehicles

LetWi be an unmanned aerial vehicle. For the ease of representation, let Wn be an AGT and W1,…,Wn−1 be UAVs in the administration domain of Wn. KGC sets a partial private key for unmanned aerial vehicles as follows.KGC chooses a random numberdi∈Zq∗ and computes(7)Yi=diP,(8)yi=di+bh1,imodq,where(9)h1,i=H1WiYiB.Then, KGC sends the partial private keyyi,Yi to Wi through a secure channel. The unmanned aerial vehicle Wi can validate the partial private key as follows:(10)yiP=?Yi+h1,iB.The unmanned aerial vehicleWi sets a secret value and generates its public key PKi and private key SKi as follows. Wi chooses a random number ci∈Zq∗ and computes(11)Ci=ciP,(12)Qi=Yi+h2,iCi,where(13)h2,i=H2Wi‖Ci.Then, the unmanned aerial vehicleWi sets PKi=Yi,Qi and SKi=yi,ci.


## 3.4. Authentication Request

LetT∈0,1∗ denote the request information chosen by CMC, which contains the timestamp. CMC randomly picks k∈Zq∗ and computes(14)δ=kP,(15)θ=k+H3TδCMC‖PKca+H2CMC‖Fsmodq.Then, CMC sends the authentication requestT,δ,θ to AGTs.


## 3.5. Request Forwarding

After receiving the requestT,δ,θ from CMC, each AGT Wn validates its authenticity by checking the following equality:(16)θP=?δ+H3TδCMC‖PKcM+H1CMCABB.If it holds, then AGTWn accepts the authentication request from CMC, otherwise terminates. AGT Wn randomly chooses rn∈Zq∗ and computes(17)Rn=rnP,(18)Sn=θ+rn+h4,nyn+h2,ncnmodq,where(19)h4,n=H4TδWn‖PKn‖Rn,(20)h2,n=H2Wn‖Cn.At last, AGTWn broadcasts the tuple of attested authentication request T,δ,Rn,Sn to all UAVs Wii=1,2,…,n−1 in its administrative domain.


## 3.6. UAV Response

Once receivedT,δ,Rn,Sn from AGT Wn, each UAV Wii=1,2,…,n−1 verifies its authenticity by checking the following equality:(21)SnP=?δ+Rn+h4,nQn+h1,nB+H3TδCMC‖PKcM+H1CMCAB,where(22)h1,n=H1WnYnB,(23)h4,n=H4TδWnPKnRn.If it holds, then UAVWi accepts the authentication request from CMC, otherwise terminates. Wi randomly picks fi∈Zq∗ and computes(24)Vi=fiP,(25)Li=fi+h^4,iyi+h2,icimodq,where(26)h^4,i=H4TδWiPKiVi,(27)h2,i=H2Wi‖Ci.Then, UAVWi sends the response tuple σi=Vi,Li to AGT Wn.


## 3.7. AGT Aggregation

Upon receiving the response tuplesVi,Lii=1n−1 from the controlled UAVs Wii=1,2,…,n−1, AGT Wn computes(28)Xn−1=∑i=1n−1Vi,(29)Zn−1=∑i=1n−1Limodq.Then, AGTWn verifies the authenticity of the received response tuples in a batch as follows:(30)Zn−1P=?Xn−1+∑i=1n−1h^4,ih1,iB+∑i=1n−1h^4,iQi,where(31)h^4,i=H4TδWiPKiVi,(32)h1,i=H1WiYiB.If it holds, then all response tuples ofWii=1,2,…,n−1 are valid; otherwise, Wn validates each response tuple in individual to find the invalid one. AGT Wn continues to pick a random element fn∈Zq∗ and compute(33)Xn=Xn−1+fnP,(34)Zn=Zn−1+Lnmodq,where(35)Ln=fn+h^4,nyn+h2,ncnmodq,h^4,n=H4TδWnPKnfnP,(36)h2,n=H2Wn‖Cn.Then, AGTWn sends the aggregate response Xn,Zn to CMC.


## 3.8. CMC Verification

Once received the aggregate responseXn,Zn from AGT Wn, CMC validates its authenticity by checking the following equality:(37)ZnP=?Xn+∑i=1nh^4,ih1,iB+∑i=1nh^4,iQi,where(38)h^4,i=H4T‖δ‖Wi‖PKi‖Vi,(39)h1,i=H1WiYiB.If it holds, then AGTWn and UAVs Wii=1,2,…,n−1 are all accepted as legitimate.Theorem 1.
The proposed CLAS construction is correct.Proof 1.
To prove the correctness of the proposed CLAS construction, it only needs to show that equalities (16), (21), (30), and (37) are satisfied.(1)
For the authentication requestT,δ,θ generated by CMC, equality (16) satisfies as follows:(40)θP=kP+H3TδCMCKca+H2CMCFsP=δ+H3TδCMCPKcA+H2CMCFF+H1CMCA‖BB=δ+H3TδCMCPKcM+H1CMCA‖BB.(2)
For the attested authentication requestT,δ,Rn,Sn from AGT Wn, equality (21) satisfies as follows:(41)SnP=θP+rnP+h4,nyi+h2,ncnP=δ+Rn+h4,nQn+h1,nB+H3TδCMCPKcM+H1CMCABB.(3)
For the response tuplesVi,Lii=1n−1 from the controlled UAVs Wii=1,2,…,n−1, equality (30) holds as follows:(42)Zn−1P=∑i=1n−1LiP=∑i=1n−1fiP+h^4,iyi+h2,iciP=Xn−1+∑i=1n−1h^4,iYi+h1,iB+h2,iCi=Xn−1+∑i=1n−1h^4,ih1,iB+∑i=1n−1h^4,iQi.(4)
For the aggregate response tupleVn,Ln from AGT Wn, equality (37) holds as follows:(43)ZnP=∑i=1nLiP=∑i=1nfiP+h^4,iyi+h2,iciP=Xn+∑i=1nh^4,iYi+h1,iB+h2,iCi=Xn+∑i=1nh^4,ih1,iB+∑i=1nh^4,iQi.
Thus, the proposed CLAS construction is correct.


## 4. System Analysis

This section analyzes the security and performance of the proposed CLAS construction.


### 4.1. Security Analysis

Theorem 2.
Assume that the ECDLP assumption holds in cyclic groupG. The proposed CLAS construction can guarantee the unforgeability of the authentication request from CMC.Proof 2.
In the authentication requestT,δ,θ generated by CMC, the element θ is considered to be a certificateless signature of TδCMC‖PKc. It can be seen that θ can serve as the common signature vi in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes that the ECDLP assumption holds in additive group G of elliptic curve points. Therefore, any attacker cannot forge a valid authentication request of CMC without knowing public key PKc, which implies the unforgeability of the authentication request from CMC can be guaranteed.Theorem 3.
Assume that the ECDLP assumption holds in cyclic groupG. The proposed CLAS construction can guarantee the unforgeability of the attested authentication request from AGT.Proof 3.
In the attested requestT,δ,Rn,Sn generated by AGT, the element Sn is considered to be a certificateless signature on θ. It can be seen that Sn can serve as the common signature vi in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes that the ECDLP assumption holds in additive group G of elliptic curve points. Therefore, any attacker cannot forge a valid attested request or response of AGT without knowing public key PKn, which implies the unforgeability of the attested authentication request from AGT can be guaranteed.Theorem 4.
Assume that the ECDLP assumption holds in cyclic groupG. The proposed CLAS construction can guarantee the unforgeability of the responses from UAVs.Proof 4.
For the response tupleVi,Li generated by UAV Wi, it is considered to be a certificateless signature on T‖δ. It can be seen that Vi,Li can serve as the common signature vi in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes that the ECDLP assumption holds in additive group G of elliptic curve points. Therefore, any attacker cannot forge a valid authentication response of UAV without knowing public key PKi, which implies the unforgeability of the responses from UAVs can be guaranteed.Theorem 5.
Assume that the ECDLP assumption holds in cyclic groupG. The proposed CLAS construction can guarantee the unforgeability of the aggregate response from AGT.Proof 5.
For the aggregate response tupleXn,Zn generated by CMC, it is considered as the aggregate signature on n individual responses. It can be seen that Xn,Zn can serve as the common signature vi in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes the ECDLP assumption holds in additive group G of elliptic curve points. Therefore, any attacker cannot forge a valid aggregate response of AGT without knowing public key PKi, which implies the unforgeability of the aggregate response from AGT can be guaranteed.Theorem 6.
Assume that the ECDLP assumption holds in cyclic groupG. The proposed CLAS construction can be resistant to malicious KGC.Proof 6.
For the partial private keyyi,Yi generated by KGC, it is considered as a Schnorr signature [27] on Wi. It can be seen that yi,Yi can serve as the common signature Di in [26]. As proved in Theorem 2 in [26], their scheme is existentially unforgeable against Type-II adversary, which assumes that the ECDLP assumption holds in additive group G of elliptic curve points. Therefore, any malicious KGC cannot forge valid partial private key of UAVs without knowing master secret key b; thus, the authenticity of KGC can be guaranteed in producing a partial private key.


### 4.2. Functional Comparison

Wang et al. [8] proposed an identity-based aggregate authentication scheme for UAVNs in bilinear groups. In [8], all UAVs are able to communicate with the CMC through their respective AGTs in the cluster, to perform valid authentication. There is no mechanism for AGT to validate the authenticity of CMC before forwarding authentication request to UAVs in its administrative domain. Furthermore, when individual responses are aggregated from UAVs in the respective cluster, the AGT does not verify the authenticity of those responses.Li et al. [9] proposed an aggregate authentication scheme, where the above two mechanisms are introduced to enhance the security of authentication in UAVNs. Note that CMC may be malicious in generating keys for UAVs, which means their scheme cannot resistant against malicious KGC. While in our CLAS construction, the partial private key for UAVs are generated by KGC. The detailed comparison on the functionalities among Wang et al.’s proposal [8], Li et al.’s proposal [9], and our CLAS construction is summarized in Table 1.Table 1
Functional comparison.
Request verificationRequest attestationAggregate verificationResistant to malicious KGCBy AGTBy CMCOur scheme√√√√√Li et al. [9]√√√√×Wang et al. [8]√××√×


### 4.3. Theoretical Comparison

LetTSM be the time of one scalar point multiplication and TBP be one bilinear pairing operation. For the key generation procedure, Wang et al.’s scheme [8] and Li et al.’s scheme [9] require n and 2n scalar point multiplications for n entities, respectively. In the request verification procedure, 2 bilinear pairing operations are both required in Wang et al.’s scheme [8] and Li et al.’s scheme [9]. For the aggregate verification by AGT procedure, Li et al.’s scheme [9] requires n−1 scalar point multiplications and 3 bilinear pairing operations. In the aggregate verification by CMC procedure, compared with Li et al.’s scheme [9], our scheme requires only n+2 scalar point multiplications. More details for comparsion on computation costs are summarized in Table 2.Table 2
Theoretical comparison.
Key generationRequest verificationRequest attestationAggregate verificationBy AGTBy CMCOur scheme3nTSM3TSM1TSMn+1TSMn+2TSMLi et al. [9]2nTSM2TBP2TSMn−1TSM+3TBPnTSM+3TBPWang et al. [8]nTSM2TBP——nTSM+3TBP


### 4.4. Experimental Performance

To evaluate the computation cost of our CLAS construction, we conduct experiments using the Java Pairing-Based Cryptography Library (JPBC,http://gas.dia.unisa.it/projects/jpbc/), on a platform with Microsoft Windows 10 operating system, Intel(R) Core(TM) i5-6500 CPU @ 3.20 GHz, and 12 GB RAM. The elliptic curve is of Type A y2=x3+x such that q is a 160 bit prime, and the element size in group G is 512 bits.The performance of the procedures of our CLAS construction is depicted in Figure3, which are system setup (Setup), key generation (SUMkgen), authentication request generation (REQgen) and attestation (REQfwd), and RAV response (UAVresp). The SUMkgen stage consists of three algorithms, partial key generation for UAV (KGCkgen), key verification for UAV (UAVerify), and key generation for UAV (UAVkgen). The setup algorithm is used to initialize the CLAS system. We can see that the majority of the computation depends on B, which takes roughly 144 msec. The SUMkgen algorithm is used to generate public and private keys for UAVs, which efficiency depends on the UAVerify and the UAVkgen algorithms. Since the partial private key is generated by KGC, the time for UAVs to generate public and private keys is reduced, which is approximately 24 msec in experiments.Figure 3
Performance evaluation of the setup, key generation, request generation, forwarding, and UAV response procedures.The REQgen algorithm can be run to generate authentication request. Its performance mainly depends on the computation ofδ, requiring one scalar point multiplication, whereas Wang et al.’s scheme [8] and Li et al.’s scheme [9] both cost two scalar point multiplications. As depicted in Figure 3, an authentication request is able to be transmitted in less than 24 msec. In the stage of REQfwd, before producing attested request, AGT verifies the authenticity of the authentication request from CMC by checking equality (16), which takes two scalar point multiplications. It requires AGT to forward the request in roughly 0.07 seconds. Before generating a response, each UAV validates the authenticity of the attested request received from its administrative AGT, requiring 5 scalar point multiplications. As a result, it takes about 0.15 seconds for each UAV to run the response procedure, while Li et al.’s scheme [9] requires more computational costs, i.e., 4 bilinear pairing operations.In the response aggregation procedure, AGT needs to aggregate the elementsVi,Li in the received response tuples. It can be seen that prior to the batch verification of these responses, only n+1 scalar point multiplications are required in equality (30), as compared to Li et al.’scheme [9]. In the simulation, a variety of scenarios for the number of unmanned aerial vehicles are considered, that is, n=10,20,…,100, and the amount of UAVs consists of one AGT and n−1 UAVs. AGT aggregates and verifies n−1 response tuples of UAVs and further aggregates all the response tuples including its response. The experimental results are shown in Figure 4, which indicates a linear correlation between the computation time of this process and the number of unmanned aerial vehicles in a single cluster.Figure 4
Performance evaluation of the AGT aggregation procedure.For the process of aggregating verification by CMC, Figure5 shows the computation time that the CMC verifies the aggregate response from AGT for a single cluster. We also consider multiple cases where the number of unmanned aerial vehicles in a single cluster are n=10,20,…,100, respectively. As shown in equality (37), CMC is required to compute n+2 scalar point multiplications. It can be seen from Figure 5 that there is also a linear correlation between the computation time of this process and the number of unmanned aerial vehicles in a single cluster.Figure 5
Performance evaluation of the CMC verification procedure.


## 4.1. Security Analysis

Theorem 2.
Assume that the ECDLP assumption holds in cyclic groupG. The proposed CLAS construction can guarantee the unforgeability of the authentication request from CMC.Proof 2.
In the authentication requestT,δ,θ generated by CMC, the element θ is considered to be a certificateless signature of TδCMC‖PKc. It can be seen that θ can serve as the common signature vi in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes that the ECDLP assumption holds in additive group G of elliptic curve points. Therefore, any attacker cannot forge a valid authentication request of CMC without knowing public key PKc, which implies the unforgeability of the authentication request from CMC can be guaranteed.Theorem 3.
Assume that the ECDLP assumption holds in cyclic groupG. The proposed CLAS construction can guarantee the unforgeability of the attested authentication request from AGT.Proof 3.
In the attested requestT,δ,Rn,Sn generated by AGT, the element Sn is considered to be a certificateless signature on θ. It can be seen that Sn can serve as the common signature vi in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes that the ECDLP assumption holds in additive group G of elliptic curve points. Therefore, any attacker cannot forge a valid attested request or response of AGT without knowing public key PKn, which implies the unforgeability of the attested authentication request from AGT can be guaranteed.Theorem 4.
Assume that the ECDLP assumption holds in cyclic groupG. The proposed CLAS construction can guarantee the unforgeability of the responses from UAVs.Proof 4.
For the response tupleVi,Li generated by UAV Wi, it is considered to be a certificateless signature on T‖δ. It can be seen that Vi,Li can serve as the common signature vi in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes that the ECDLP assumption holds in additive group G of elliptic curve points. Therefore, any attacker cannot forge a valid authentication response of UAV without knowing public key PKi, which implies the unforgeability of the responses from UAVs can be guaranteed.Theorem 5.
Assume that the ECDLP assumption holds in cyclic groupG. The proposed CLAS construction can guarantee the unforgeability of the aggregate response from AGT.Proof 5.
For the aggregate response tupleXn,Zn generated by CMC, it is considered as the aggregate signature on n individual responses. It can be seen that Xn,Zn can serve as the common signature vi in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes the ECDLP assumption holds in additive group G of elliptic curve points. Therefore, any attacker cannot forge a valid aggregate response of AGT without knowing public key PKi, which implies the unforgeability of the aggregate response from AGT can be guaranteed.Theorem 6.
Assume that the ECDLP assumption holds in cyclic groupG. The proposed CLAS construction can be resistant to malicious KGC.Proof 6.
For the partial private keyyi,Yi generated by KGC, it is considered as a Schnorr signature [27] on Wi. It can be seen that yi,Yi can serve as the common signature Di in [26]. As proved in Theorem 2 in [26], their scheme is existentially unforgeable against Type-II adversary, which assumes that the ECDLP assumption holds in additive group G of elliptic curve points. Therefore, any malicious KGC cannot forge valid partial private key of UAVs without knowing master secret key b; thus, the authenticity of KGC can be guaranteed in producing a partial private key.


## 4.2. Functional Comparison

Wang et al. [8] proposed an identity-based aggregate authentication scheme for UAVNs in bilinear groups. In [8], all UAVs are able to communicate with the CMC through their respective AGTs in the cluster, to perform valid authentication. There is no mechanism for AGT to validate the authenticity of CMC before forwarding authentication request to UAVs in its administrative domain. Furthermore, when individual responses are aggregated from UAVs in the respective cluster, the AGT does not verify the authenticity of those responses.Li et al. [9] proposed an aggregate authentication scheme, where the above two mechanisms are introduced to enhance the security of authentication in UAVNs. Note that CMC may be malicious in generating keys for UAVs, which means their scheme cannot resistant against malicious KGC. While in our CLAS construction, the partial private key for UAVs are generated by KGC. The detailed comparison on the functionalities among Wang et al.’s proposal [8], Li et al.’s proposal [9], and our CLAS construction is summarized in Table 1.Table 1
Functional comparison.
Request verificationRequest attestationAggregate verificationResistant to malicious KGCBy AGTBy CMCOur scheme√√√√√Li et al. [9]√√√√×Wang et al. [8]√××√×


## 4.3. Theoretical Comparison

LetTSM be the time of one scalar point multiplication and TBP be one bilinear pairing operation. For the key generation procedure, Wang et al.’s scheme [8] and Li et al.’s scheme [9] require n and 2n scalar point multiplications for n entities, respectively. In the request verification procedure, 2 bilinear pairing operations are both required in Wang et al.’s scheme [8] and Li et al.’s scheme [9]. For the aggregate verification by AGT procedure, Li et al.’s scheme [9] requires n−1 scalar point multiplications and 3 bilinear pairing operations. In the aggregate verification by CMC procedure, compared with Li et al.’s scheme [9], our scheme requires only n+2 scalar point multiplications. More details for comparsion on computation costs are summarized in Table 2.Table 2
Theoretical comparison.
Key generationRequest verificationRequest attestationAggregate verificationBy AGTBy CMCOur scheme3nTSM3TSM1TSMn+1TSMn+2TSMLi et al. [9]2nTSM2TBP2TSMn−1TSM+3TBPnTSM+3TBPWang et al. [8]nTSM2TBP——nTSM+3TBP


## 4.4. Experimental Performance

To evaluate the computation cost of our CLAS construction, we conduct experiments using the Java Pairing-Based Cryptography Library (JPBC,http://gas.dia.unisa.it/projects/jpbc/), on a platform with Microsoft Windows 10 operating system, Intel(R) Core(TM) i5-6500 CPU @ 3.20 GHz, and 12 GB RAM. The elliptic curve is of Type A y2=x3+x such that q is a 160 bit prime, and the element size in group G is 512 bits.The performance of the procedures of our CLAS construction is depicted in Figure3, which are system setup (Setup), key generation (SUMkgen), authentication request generation (REQgen) and attestation (REQfwd), and RAV response (UAVresp). The SUMkgen stage consists of three algorithms, partial key generation for UAV (KGCkgen), key verification for UAV (UAVerify), and key generation for UAV (UAVkgen). The setup algorithm is used to initialize the CLAS system. We can see that the majority of the computation depends on B, which takes roughly 144 msec. The SUMkgen algorithm is used to generate public and private keys for UAVs, which efficiency depends on the UAVerify and the UAVkgen algorithms. Since the partial private key is generated by KGC, the time for UAVs to generate public and private keys is reduced, which is approximately 24 msec in experiments.Figure 3
Performance evaluation of the setup, key generation, request generation, forwarding, and UAV response procedures.The REQgen algorithm can be run to generate authentication request. Its performance mainly depends on the computation ofδ, requiring one scalar point multiplication, whereas Wang et al.’s scheme [8] and Li et al.’s scheme [9] both cost two scalar point multiplications. As depicted in Figure 3, an authentication request is able to be transmitted in less than 24 msec. In the stage of REQfwd, before producing attested request, AGT verifies the authenticity of the authentication request from CMC by checking equality (16), which takes two scalar point multiplications. It requires AGT to forward the request in roughly 0.07 seconds. Before generating a response, each UAV validates the authenticity of the attested request received from its administrative AGT, requiring 5 scalar point multiplications. As a result, it takes about 0.15 seconds for each UAV to run the response procedure, while Li et al.’s scheme [9] requires more computational costs, i.e., 4 bilinear pairing operations.In the response aggregation procedure, AGT needs to aggregate the elementsVi,Li in the received response tuples. It can be seen that prior to the batch verification of these responses, only n+1 scalar point multiplications are required in equality (30), as compared to Li et al.’scheme [9]. In the simulation, a variety of scenarios for the number of unmanned aerial vehicles are considered, that is, n=10,20,…,100, and the amount of UAVs consists of one AGT and n−1 UAVs. AGT aggregates and verifies n−1 response tuples of UAVs and further aggregates all the response tuples including its response. The experimental results are shown in Figure 4, which indicates a linear correlation between the computation time of this process and the number of unmanned aerial vehicles in a single cluster.Figure 4
Performance evaluation of the AGT aggregation procedure.For the process of aggregating verification by CMC, Figure5 shows the computation time that the CMC verifies the aggregate response from AGT for a single cluster. We also consider multiple cases where the number of unmanned aerial vehicles in a single cluster are n=10,20,…,100, respectively. As shown in equality (37), CMC is required to compute n+2 scalar point multiplications. It can be seen from Figure 5 that there is also a linear correlation between the computation time of this process and the number of unmanned aerial vehicles in a single cluster.Figure 5
Performance evaluation of the CMC verification procedure.


## 5. Conclusion

To address the security problems in UAVNs, this paper proposed a CLAS construction without bilinear groups to realize efficient mutual authentication between control center and unmanned aerial vehicles. After the system is initialized, KGC produces the partial private key for each entity. CMC sends the authentication request to AGT; then, AGT forwards the attested request to UAVs in its adminstrative cluster. All response tuples of UAVs are validated by the cluster head AGT and then forwarded to CMC for further verificaton. Security analysis showed that our CLAS construction can not only provide unforgeability for (attested) authentication request and (aggregate) responses but also can resist malicious KGC. Experimental analysis demonstrated that the proposed CLAS construction enjoys practical performance.



---

*Source: 9463606-2021-09-11.xml*