EPAS: Efficient Privacy-preserving Authentication Scheme for VANETs-based Emergency Communication

Transcription

1 94 JOURNAL OF SOFTWARE, VOL. 8, NO. 8, AUGUST 03 EPAS: Effcent Prvacy-preservng Authentcaton Scheme for VANETs-based Emergency Communcaton Xuedan Ja School of Computer Scence and Telecommuncaton Engneerng, Jangsu Unversty, Zhenjang, Chna Emal: Xaopeng Yuan, Lxa Meng 3, Langmn Wang, 3 School of Electronc Engneerng and Optoelectronc Technques, NUST, Nanjng, Chna 3 Key Laboratory of Intellgent Computng & Sgnal Processng, MOE, Anhu Unversty, Hefe, Chna Emal: (wanglm@ujs.edu.cn) Abstract Vehcular Ad Hoc Networks (VANETs) can provde partcpants wth securty servces and entertanment nformaton durng the drvng. To guarantee correct and smooth operatons of VANETs, t s necessary to acheve effcent authentcaton wth user prvacy preservng. Current solutons ether cannot satsfy prvacy requrements, or are not effcent n message verfcaton. Moreover, all the exstng schemes are RSU-based. We, for the frst tme, apply VANETs to emergency communcaton durng dsaster rescue, and effectve authentcaton scheme s proposed n accordance wth the actual envronment, where there s no fxed road-sde unt (RSU). In ths paper, we present an effcent dentty based sgnature scheme EPAS, whch satsfes condtonal prvacy requrements through software soluton. In aspect of effcency, both lghtweght sgnature and batch verfcaton are employed to provde effectve authentcaton. Extensve theoretcal and expermental analyses demonstrate the securty and effcency of EPAS n terms of prvacy-preservng and low authentcaton delay. Index Terms Vehcular Ad Hoc Networks; Emergency Communcaton; Condtonal Prvacy Preservng; Batch Verfcaton I. INTRODUCTION Vehcular ad hoc networks (VANETs) are a knd of specfc wreless sensor networks of vehcles, equpped wth wreless communcaton devces. The vehcles can communcate wth each other (VV) and wth the roadsde unts RSUs (VR) by means of the Dedcated Short- Range Communcaton protocol (DSRC) [] provdng drvers wth traffc nformaton for drvng safety [], and nfotanment nformaton to mprove the drvng experence [3]. Accordng to DSRC, vehcles broadcast traffc safety message every ms. In hgh traffc densty scenaro, verfyng every message wll brng great computaton overhead. In addton to computatonal effcency, prvacy requrements are also essental as the safety packet contans prvacy-related nformaton about user s geographcal locaton and personal predlecton. To make VANETs practcal n use, securty and prvacy requrements must be guaranteed frst of all other ssues. Lots of schemes [4-5] have been devoted to solve the above problems wth [4][5][0-3] dedcated to drvng safety assurance, and [4] for entertanment servces, respectvely. But all these schemes are based on the assumpton that RSUs cover the entre network, whch s unrealstc durng the ntal deployment of VANETs and napplcable to emergency communcaton n dsaster condtons. Recently, large-scale natural dsasters have occurred frequently over the world. Takng Wenchuan earthquake [6] as an example, the dsaster-affected area was an solated sland to some extent as nfrastructures ncludng communcaton, transportaton, and power facltes were destroyed. Wreless emergency communcaton system s mperatve to collect real-tme nformaton and gve feedbacks. There have been researches dedcated to routng [7] n ad hoc networks, and vehcle routng [8][9], but no emergency communcaton scheme based on VANETs has been proposed. We, for the frst tme, apply VANETs to emergency communcaton durng dsaster rescue. A specfc network model s proposed, as shown n Fg.. Durng Fgure. Network model do:0.4304/jsw

2 JOURNAL OF SOFTWARE, VOL. 8, NO. 8, AUGUST emergency communcaton, no fxed nfrastructure exstng, vehcles n the dsaster area need to regster tmely wth the authorty for subsequent communcaton. Therefore, secure and effcent scheme s needed for vehcle regstraton and communcaton n the absence of fxed RSU. In addton, prvacy requrements and authentcaton effcency should be guaranteed. Thus, an Effcent Prvacy-preservng Authentcaton Scheme (EPAS) s proposed based on the network model. We assume the dsaster relef authorty (DRA) and emergency communcaton cars (ambulances or fre trucks, AMBs for short) enter the dsaster-affected area. Vehcles n the area can regster themselves wth DRA va AMB for subsequent rescue communcaton. II. RELATED WORKS Researches n secure authentcaton and prvacy protecton have been qute actve n recent years. Numbers of schemes have been proposed. Accordng to the pattern n whch messages are verfed, these exstng authentcaton schemes can be classfed nto two categores,.e., one-by-one message verfcaton [9]-[] and batch verfcaton [3]-[5] schemes. In addton, there are many schemes dedcated to prvacy problem [4]-[8]. For prvacy protecton n VANETs, there are two knds of commonly used technque, group sgnature and Mx-zone pseudonym-changng pseudonym wthn specfed regon. TACK [4] and TARI [5] both adopted [6], a group sgnature mechansm whch supported trackng and revocaton of anonymous sgnature, to obtan short-term anonymous certfcates. For exstence of group managers, a rng sgnature scheme [7] was proposed to meet prvacy protecton wthout group manager. Reference [8] amed to establsh Mx-zones at socal ponts to acheve prvacy protecton. However, Mx-zone pseudonym scheme s vulnerable to terran-based montorng technologes, whle both group sgnature and rng sgnature are tme consumng n verfcaton. The one-by-one verfcaton schemes are characterzed by smple to use and large verfcaton delay. In 007, Raya, etc. proposed [9] to realze authentcty and prvacy. However, publc key nfrastructure (PKI) based scheme has the problem of certfcates transmsson and management. Subsequently, Ln et al. proposed a group sgnature scheme GSIS [0], elmnatng the publc key certfcates. RAISE [] was a RSU-asssted verfcaton scheme. Secret key shared between vehcle and RSU was used to generate message authentcaton code (MAC). Nevertheless, RSU authentcated message one by one and broadcasted 8B hash value for each vald message, whch brought heavy communcaton burden. CMAP [] embraced cooperaton verfcaton dea to mprove effcency. Verfers were chosen based on locaton, and non-verfers wated for the verfer s results. Due to the uncertanty of the vehcle speed and road condtons, the scalablty and practcalty of CMAP are facng questonng. All the above schemes are not effcent as the number of messages can be very large n VANETs. IBV [3] devsed dentty based (ID-based) sgnature to realze batch verfcaton. IBV s major flaw s that any malcous vehcle V j can easly forge the sgnature of V. In addton, t can t detect nvald sgnatures. If the verfcaton fals, all messages wll be dscarded. ABAKA [4] was merely devsed to entertanment servce. CPAS [5], adopted pseudonyms to protect prvacy and realze batch verfcaton between the vehcle and the RSU. But the Prvate Key Generator (PKG) s essental to generate user prvate key,.e. key escrow. In addton, sgnature verfcaton s based on blnear parng operaton whch s of large computatonal overhead. The comparson of the aforementoned programs s shown as Table Ⅰ, from whch we can see they are all not applcable to emergency communcaton, as roadsde nfrastructures are assumed to cover the entre network n all the schemes. To apply VANETs to emergency communcaton, we present an Effcent Prvacy-preservng Authentcaton Scheme (EPAS) n ths paper. In alluson to the condtonal prvacy problem, an exclusve secret key s establshed between the vehcle and DRA, only allowng DRA to track malcous vehcles from the pseudonyms. In addton, lghtweght sgnature and batch verfcaton are combned to reduce computaton and communcaton cost, provdng fast and effcent authentcaton. In addton, for vehcle group communcaton, a group formaton scheme s presented to allow vehcles to effcently authentcate each other n the same group. Schemes Communcaton patterns TABLE I. COMPARISON OF RELATED WORKS Cryptographc bass Condtonal prvacy preservng Batch verfcaton Emergency communcaton No Vehcle group RSU communcaton TACK[4] VR Group Sgnature GSIS[0] VV & VR Group & ID-based Sgnature RAISE[] RSU-based VV PKI Sgnature & MAC Code CMAP[] VV Group Sgnature IBV[3] VR ID-based Sgnature CPAS[5] VR ID-based Sgnature wth PKG

3 96 JOURNAL OF SOFTWARE, VOL. 8, NO. 8, AUGUST 03 III. SYSTEM MODEL AND PRELIMINARIES VANETs for emergency rescue are dfferent from the ordnary network model, as the RSUs are serously damaged. We propose an approprate network model and an effcent authentcaton scheme sutable for ths model. To facltate the specfcaton of our scheme, we frst brefly descrbe the system model, the desgn objectves and the basc presuppostons. A. System Model The actual crcumstance we consder s emergency communcaton n dsasters relef. Accordng to the accurate envronment, a two-layer network model s proposed, as shown n Fg.. The upper layer comprses the Trust Authorty (TA) and the dsaster relef authorty DRA, whle the lower layer s composed of vehcles and AMBs. TA s responsble for ssung real dentfcaton RID to vehcles and prvate/publc key pars to all partes. Most mportantly, TA s always trusted and can never be compromsed. So s DRA, who has made contract and can communcate securely wth TA. AMBs are equpped wth powerful devces of stronger computaton and communcaton capablty than regular vehcles. The communcaton range of AMB can be larger than that of ordnary vehcles. Wthn ts communcaton range, AMB s responsble for forwardng n-tme regstraton messages from vehcles to the DRA and assstng group formaton. AMBs communcate securely wth DRA. In Fg., the dotted lne ndcates the communcaton range of a group, n whch vehcles communcate wth each other based on the wreless communcaton standard IEEE 80.p. There are two types of communcaton n our model: the vehcle to DRA communcaton (VD) and the vehcle group communcaton (VV). DRA verfes vehcle messages n batch to save the computatonal overhead, and takes comprehensve data analyss for reasonable rescue plans. B. Desgn Objectves In vehcular ad hoc networks for emergency communcaton, an effcent authentcaton scheme needs to satsfy the followng sx goals: regstraton wthout RSU, sender authentcaton and message ntegrty, condtonal prvacy, revocablty, low communcaton overhead and fast verfcaton, and nternal attacks preventon, whch are further dscussed as below. Regstraton wthout RSU: There s no RSU n the emergency communcaton. Effcent vehcle regstraton scheme s needed for vehcles wthout RSUs, as they can authentcate each other only after regstraton. Sender authentcaton and message ntegrty: The recevers need to authentcate that the messages are ndeed sent by legtmate enttes and are not tampered durng the transmsson. Ths s enforced by sgnatures. Condtonal prvacy: A secure scheme must prevent eavesdroppers from gettng the prvate key of vehcles or lnkng to the vehcle s real dentty from the messages. On the other hand, when the malcous vehcles are found or vehcles are n dspute for an emergency accdent, t s necessary to allow the TA to trace back to the vehcle s real dentty. Revocablty: When vehcles are n dspute or the content of a message s bogus, the authorty should be able to retreve the real dentty and revoke t from the network. The authorty notfes the network of llegal vehcles n tme, preventng the revoked vehcle from partcpatng n the communcatons. Low communcaton overhead and fast verfcaton: Due to the urgent tme requrement of message authentcaton and lmted bandwdth, safety verfcaton program should also consder the effcency requrements n terms of low communcaton overhead and fast authentcaton. Internal attacks preventon: Legtmate vehcles cannot get the key nformaton of other vehcle, or forge a legal sgnature of the other vehcle. Even f some vehcles are captured by the attacker, the attacker can t obtan other legtmate vehcle s prvate key wth the captured vehcles. C. Basc Presuppostons An ellptc curve s a cubc equaton of the form y +axy+by=x 3 +cx +dx+e, where a, b, c, d, and e are all real numbers. In an ellptc curve cryptography (ECC) system, the ellptc curve equaton s defned as the form of Eq(a, b): y =x 3 +ax+b (mod q), over a prme fnte feld F q, where a, b F q, q>3, and 4a 3 +7b 0(mod q) [0]. In general, the securty of ECC depends on the dffcultes of the followng problems [][]. Defnton. Ellptc Curve Dscrete Logarthm Problem (ECDLP) Gven two ponts P and Q over Eq(a, b), the ellptc curve dscrete logarthm problem (ECDLP) fnds an nteger x Fq such that x P=Q. Defnton. Computatonal Dffe-Hellman Problem (CDHP) Gven three ponts P, sp and tp over Eq(a, b) for s, t F q, the computatonal Dffe-Hellman problem fnds the pont (st)p over Eq(a, b). IV. EPAS The proposed Effcent Prvacy-preservng Authentcaton Scheme (EPAS) employs dentty based cryptography. Thus, there s no delvery and management of certfcates. In consderaton of computatonal overhead, pont multplcatons nstead of blnear operatons are used to generate lghtweght sgnature. Thus the computaton overhead and communcaton overhead are largely saved. Specfc to the prvacy destructon problem caused by key preload, sesson key agreement protocol s proposed to establsh an ndvdual sesson key between vehcle and the credble authorty DRA durng vehcle regstraton. Ths sncerely guarantees the condtonal prvacy protecton requrements. The Effectve Prvacy-preservng Authentcaton Scheme (EPAS) s composed of two sub-schemes: Scheme and Scheme, for vehcle to DRA communcaton and vehcle group communcaton respectvely. The

4 JOURNAL OF SOFTWARE, VOL. 8, NO. 8, AUGUST prme symbols used n the paper are defned as the followng Table Ⅱ. TABLE II. NOTATION Notaton Descrpton TA Trust Authorty DRA Dsaster Relef Authorty AMB Emergency Communcaton Car V Vehcle RID Real Identty of Vehcle PK DRA / SK DRA Publc/Prvate Key of DRA PK / SK Publc/Prvate Key of V h One-way Hash Functon h:{0,} * Z * q H Map to Pont Functon H: {0,} * G k Shared Secret between V and DRA ID Pseudonym of V CSK Correspondng Prvate Key of ID GPK Group Publc Key of V GSK Group Secret Key Concatenaton Operaton A. System Intalzaton and Vehcle Regstraton. System ntalzaton Accordng to the standard IEEE609. [3], there exsts PKI to provde key management. The DRA and vehcles have a par of publc/prvate keys and the publc key certfcate sgned by TA. System ntalzaton s completed by TA to establsh the publc parameters of the system. Let G be a cyclc addtve group generated by the P wth the order q; TA pcks h, H, and establshes the publc parameters {G, q, P, h, H}; DRA, AMBs, and vehcles download the system parameters {G, q, P, h, H} from TA; The DRA randomly chooses s Z * q as ts prvate secret key used to generate group secret key.. Vehcle regstraton Durng the regstraton process, a sesson key agreement scheme s proposed to establsh a shared secret between vehcle and DRA va AMB, as shown n Fg.. The secret s just known to the vehcle tself and the DRA, thus ensurng only the DRA can trace to the real dentty of a vehcle, and revoke malcous vehcle from the network. Ths can be acheved by the modfed Dffe- Hellman sesson key agreement scheme secured wth sgnature. The processes of mutual authentcaton and key agreement are shown as follows. Fgure. Vehcle regstraton Step: Frst, vehcle V randomly selects a Z * q, and concatenates the random element P a and ts real dentty. Next, V encrypts the concatenaton wth the DRA s publc key. Then V encrypts the concatenaton of the encrypton and the tme stamp and gets RM as a RM = (T ( P RID) ) () PKDRA PKAMB Fnally, V sends RM to the AMB. Step: Recevng the frst message RM from vehcle V, AMB decrypts and verfes the tme stamp. If the message s new, t delvers the rest part of the message,.e., RM, to DRA securely. Otherwse, t dscards the message and wats for new regstraton messages. a RM = ( P RID) PK () DRA Step3: DRA decrypts the message and verfes the real dentty RID. If RID s n the revoke lst (RL), the message s abandoned. Otherwse, DRA randomly chooses b Z * q, gets k =P ab. Next, DRA sgns the concatenaton of P a and P b and then encrypts the sgnature and P b by V s publc key. Then the encrypted message b a b RM 3 = ( P ( P P ) ) (3) SKDRA s sent to AMB securely. Step4: AMB passes the message to vehcle V. RM4= RM3 (4) Step5: The vehcle verfes the DRA s sgnature, and f vald, sends ts own sgnature on P a and P b to the DRA va AMB. PK a b RM 5 = ( P P ) (5) Step6: DRA authentcates the sgnature. If t s vald, a shared secret between V and DRA has been establshed through the above steps. RM6= RM5 (6) The shared secret s k =P ab, whch s employed to generate pseudonyms by the vehcle V. The actual dentty of the vehcle can only be traced by DRA to ensure the condtonal prvacy protecton. B. Pseudonym Generaton In the dentty based cryptography, the entty s publc key can be generated based on ts dentty. Compared to tradtonal PKI based scheme, there s no certfcates management and transportaton. Thereby computaton and communcaton overhead are greatly economzed. Dfferent pseudonyms are used to sgn messages durng the communcaton process, to protect the vehcle s locaton prvacy from beng tracked or assocated. The pseudonym ID conssts of three parts: ID, ID, LT, where ID and ID are the pseudonym materal and LT s the pre-defned lfe perod of the pseudonym. Frst of all, the vehcle selects a random number r Z * q to establsh pont R G, so that R =(x, y )=r P. The vertcal SK

5 98 JOURNAL OF SOFTWARE, VOL. 8, NO. 8, AUGUST 03 and horzontal coordnates of each pont of are ntegers wthn F q. Then, the vehcle generates pseudonym as ID= h( R ), ID = RID H ( k ID LT), whch only allows the DRA to reveal the real dentty of malcous vehcles. Because only the vehcle and the DRA know the secret generatng the pseudonym, the thrd party s unable to obtan the true dentty of the vehcle. The correspondng prvate key CSK s CSK= h( ID k) P. So the vehcle V generates ts own pseudonym as ID = ( ID, ID, LT) ID= h( R) ID = RID H ( k ID LT) and the correspondng prvate key as (7) CSK= h( ID k) P (8) In the end, the vehcle V stores a lst of the pseudonyms ID wth ts correspondng prvate key CSK and the random ponts R. Notce that, ) t s essental to nsert lfe perod LT nto every pseudonym to prevent attackers from abusng obsolete pseudonyms; ) the pseudonyms and the prvate keys can be completed pror to jonng the network communcaton. Thus, the delay of sgnng a message does not nclude the tme generatng a pseudonym and the prvate key. C. EPAS When facng a mass of VANETs messages, vehcles may be not able to verfy every message before ts deadlne as the large computatonal overhead, resultng n hgh packet loss rate. Whle packet loss may serously mpact the securty applcatons, savng computatonal overhead s a major consderaton for vehcles lmted resources. Pont multplcatons are adopted nstead of blnear operatons to sgn and verfy message, as one parng operaton costs 4.5ms whle the pont multplcaton only 0.6ms [4]. In addton, batch verfcaton allows verfer to authentcate messages n batch to provde hgh effcency.. Scheme:VD communcaton The vehcle V s sgnature σ on message M conssts of two parts, σ =( S, S ) as S = R + h( M ID) CSK S = xp where x s the horzontal coordnate of the pont R. Then V sends the message packet <ID, M, σ, T > to the DRA va AMB. AMBs can just forward vehcles messages to the DRA n ths knd of communcaton, but could not verfy the messages, because the secret key k s only known to the vehcle and the DRA. In order to acheve the communcaton between vehcles, a group communcaton scheme s descrbed n the next secton. The vehcle s message can be verfed one by one or n batch by DRA. Batch verfcaton can acheve verfyng a number of messages at once, to save computatonal (9) overhead and verfcaton tme. The batch verfcaton can also make the DRA react tmely to the dsaster stuaton and dspatch the nearby ambulance. Next, the processes of batch verfcaton are ntroduced n detal. Gven n dstnct sgnatures σ, σ, σ 3,, σ n receved from V, V, V 3,, V n respectvely, the DRA frst checks the tmestamp n the message, verfes the freshness of the message, and deletes outdated ones. Then DRA calculates the vehcle s prvate key and the pont R wth k. Untl now, t s the same as sngle message authentcaton. Fnally, DRA verfes all the sgnatures n one operaton. The specfc verfcaton steps are as follows: For freshness, DRA frst checks the transmsson delay. Assumng the tme DRA recevng the message s T n, DRA checks whether ΔT T n -T s vald, where ΔT s the preset maxmum transmsson delay. If the nequalty holds, then contnue the verfcaton; otherwse, the DRA dscards the outdated message. Ths step s done for every message. DRA calculates the vehcle s correspondng prvate key accordng to (8) CSK =h(id k )P. Calculate the pont R = S -h(m ID )CSK. Authentcate all the sgnatures by verfyng f (9) n holds: S? ( ) x P. = The DRA needs to fnd out the shared secret k wth V, V, V 3,, V n respectvely, by checkng whch of the stored pars (RID, k ) satsfy (7) ID = RID H( k ID LT). Durng the verfyng process, the prvate key CSK and the random pont R need to be calculated to acheve authentcaton. However, the securty of our scheme s not destroyed. The DRA s completely trustable, and the prvate key can not reveal the vehcle s real dentty. In addton, vehcles change the pseudonym perodcally.. Scheme: vehcle group communcaton The above verfcaton processes are only sutable for communcaton between the vehcle and the DRA. Durng the rescue process, vehcles also need to communcate wth each other to tmely exchange nformaton. Therefore, we desgned a vehcle group communcaton scheme, whch s based on the aforementoned pseudonym sgnature. Sgnng and verfcaton only requre pont multplcatons to ensure fast verfcaton and reduce the computatonal overhead. ) Group formaton Ths sub-secton shows how a group of known vehcles form a communcaton group, and how they securely communcate wth each other. The establshment of the group s dvded nto four stages: applcaton stage, agreed stage, valdaton stage, and key establshment stage. AMB launches the message M ={GR, ID, ID, ID 3,, ID n } to start the group establshment, where GR ndcates t s the group request message. Vehcle recevng the message checks for ts own pseudonym ID j. If found, t sgns the agreed message M j ={GA, ID j } and sends t to DRA va AMB.

6 JOURNAL OF SOFTWARE, VOL. 8, NO. 8, AUGUST Recevng the request message and all the agreed messages, the DRA batch-verfes all the sgnatures. Only f the verfcaton succeeds, the DRA carres on to the group key generaton phase. Otherwse, the DRA suspends the protocol and wats for new request. If all the sgnatures are vald, the DRA establshes the group key for the group members. It selects a random number ran, and sets the group prvate key as GSK=s ranp, whle the group publc key for each member s set GPK =k P. The DRA encrypts the shared group prvate key wth each k respectvely, and broadcasts the message M={ID, ID,, ID n, E ( ) k GSK, E ( ) k GSK,, E ( ) k n GSK } wth ts sgnature SIGSK DRA ( M ). The group members frst verfy DRA s sgnature and then conduct decrypton wth the k to get the group prvate key GSK. ) Group communcaton Vehcles can authentcate each other wthn the group to realze real-tme communcaton. Note that DRA s stll able to verfy the group messages. Wth the pre-generated pseudonym (7), and the group prvate key GSK, a vehcle generates the group message sgnature σ as S= R+ h( M ID) GSK S = xp (0) The GSK s employed to generate sgnatures of group message. The group message s broadcasted n the format <ID, M, σ, T >, where two bts can be added to dstngush the group message and vehcle-to-dra message. But these two bts are not counted n the communcaton overhead. Recevng the message, the verfer V j frst checks the tme valdty. If the aforementoned step s vald, t comes to the sgnature verfcaton. Frstly, V j calculates the pont R= S- h( M) GSK wth the group prvate key GSK. Then, V j verfes the sgnature by checkng whether S = xp holds. Note that batch verfcaton s also applcable to the group communcaton, provdng a much smaller computng overhead and verfcaton delay. Vehcles and the DRA can both carry out batch verfcaton to acheve effcency. In Scheme, (n+) pont multplcatons are needed when the DRA verfes n message, whle n Scheme, only (n+) pont multplcatons. D. Dscusson Traceablty: Gven the pseudonym ID, only the trust authorty DRA, havng the shared secret k, can trace the actual dentty RID. Therefore, once vehcles are n dspute about a sgnature or are found to abuse the VANETs, the DRA has the ablty to trace the vehcle from the dsputed message sgnature, by whch the traceablty can be well satsfed. The trackng process s as follows: ID H ( k ID LT ) = RID RID H k ID LT H k ID LT RID ( ) ( ) = () Invald sgnature detecton: If there s one nvald sgnature n the batch, t wll lead to falure of the entre batch verfcaton. In VANETs, nvald sgnature may be caused by many cases, lke malcous vehcles or the hardware malfuncton of legtmate vehcles. Therefore, nvald sgnature detecton mechansm s necessary. We adopt the bnary search method to check for nvald sgnatures, as ABAKA [4]. When the batch verfcaton fals, the batch s bsected, and verfed respectvely untl only one message left or vald. Revocaton check: Before jonng the network, new vehcles need to complete regstraton wth the DRA va AMB. When DRA receves V s request, t must check f the requestng vehcle s n the sorted revocaton lst (RL) by runnng Algorthm. If the returned value of Algorthm s, the revocaton s detected. Then DRA rejects the regstraton request. Otherwse, DRA contnues the regstraton process. Algorthm Revocaton Detecton. RDetAlg(RL, l, r, RID ):. begn 3. md= l+ r ; 4. f RL[md]=RID then return Found=; 5. else f RL[md]>RID then r=md-; RDetAlg(RL, l, r, RID ) 6. else l=md+; RDetAlg(RL, l, r, RID ); 7. end f 8. end V. SECURITY ANALYSIS We analyze of the securty performance of the proposed scheme n ths chapter. Accordng to the securty objectves aforementoned, we manly focus on the followng four aspects: sender authentcaton and message ntegrty, nternal attacks preventon, condtonal prvacy protecton and revocablty, effcency. ) Sender authentcaton and message ntegrty: The proposed scheme EPAS securely acheves sesson key establshment, mutual authentcaton between vehcles, and DRA batch-verfyng vehcles messages. The adopted Dffe-Hellman sesson key agreement scheme secured wth sgnature has been proven secure. The vehcle generates pseudonym and correspondng prvate key wth the unque secret key, whch guarantees no one else can forge ts pseudonym and sgnature. Once the message content s dstorted durng the transportaton, the sgnature verfcaton can t be vald. Ths ensures that only the unmodfed messages from legtmate senders are accepted. ) Internal attacks preventon: An mportant securty property of our EPAS s the ablty to prevent nternal attacks. Even f an attacker has captured some legtmate vehcles and ther prvate secrets, the attacker stll can t use the nformaton to forge other legtmate vehcle s sgnature. In addton, the damage caused by the captured

7 90 JOURNAL OF SOFTWARE, VOL. 8, NO. 8, AUGUST 03 vehcles s also lmted, because the trackng mechansm can quckly determne the real dentty of these vehcles, and TA can promptly revoke the malcous vehcles from the network. 3) Condtonal prvacy protecton and revocablty: The actual dentty of a vehcle s concealed by the pseudonym. On the other hand, the authorty DRA, and only the DRA can reveal the real dentty. For example, once V s found msbehavng, the ID s reported to DRA. The DRA traces the real dentty RID through () and sends t to TA, who determnes whether to revoke V or not. The specfc revocaton mechansm s out of the scope of our paper. 4) Effcency: Pseudonym mechansm s adopted n order to save communcaton overhead. To acheve fast authentcaton and save the computatonal overhead, we employ the dea of batch valdaton. In addton, the sgnature s generated through pont multplcatons, whose computatonal overhead s just 0.6ms much smaller than 4.5ms of blnear parng. The message verfcaton procedure only needs two pont multplcatons n the group communcaton scheme, whch can sgnfcantly mprove the effcency. VI. PERFORMANCE EVALUATION In ths secton, we evaluate the performance of the proposed scheme EPAS n terms of verfcaton delay and transmsson overhead. In the smulaton, our scheme EPAS s compared wth three related typcal schemes IBV [3], ABAKA [4], and ECDSA [3]. IBV and ABAKA are typcal batch verfcaton schemes, whle ECDSA sgnature scheme s adopted by the current standard IEEE 609. and some other schemes such as RAISE []. A. Verfcaton Delay Let T mtp denotes the tme of a MapToPont hash operaton, T mul the tme of performng one pont multplcaton over an ellptc curve, and T par the tme of a blnear parng operaton. Accordng to [4], T mul s 0.6 ms, T mtp s 0.6 ms and T par s 4.5ms. So the operaton tme of T mul and T mtp s much smaller than T par. The computaton cost manly focus on the above three parameters. Our EPAS doesn t need the parng operaton. We don t consder the cost of one-way hash functon, whch s only mcroseconds. The computatonal overhead of the schemes s gven n Table Ⅲ. TABLE III. COMPUTATIONAL OVERHEAD Schemes Authentcate a sngle Authentcate n message messages IBV 3T par +T mtp +T mul 3T par +nt mtp +nt mul ECDSA 4T mul 4nT mul ABAKA 7T mul (n+5)t mul EPAS: Scheme 3T mul (n+)t mul EPAS: Scheme T mul (n+)t mul From the comparson, we can see the proposed scheme EPAS Scheme acheves the least verfcaton overhead for both one-by-one message authentcaton and batch verfcaton. To verfy n dstnct sgnatures, IBV needs 3T par +nt mtp +nt mul, ECDSA 4nT mul and ABAKA (n+5)t mul, whle our scheme EPAS only (n+)t mul and (n+)t mul. The ECDSA verfes n dstnct sgnatures one by one, so the n-messages verfcaton s not effcent. In addton, snce ECDSA s not dentty based, addtonal operatons are needed to verfy the certfcate of publc key. Although IBV s a batch verfcaton scheme, the basc parng operaton s computatonal costly. The verfcaton cost of ABAKA s close to that of our Scheme, but much hgher than the Scheme. Verfcaton delay (ms) IBV ECDSA ABAKA SCHEME SCHEME Traffc densty (#) Fgure 3. Verfcaton delay wth dfferent traffc densty The verfcaton delay of all the fve schemes s obvously presented n Fg. 3. We can see from the fgure apparently that the computatonal overhead and the verfcaton delay ncrease lnearly wth the number of messages for all these schemes. Our EPAS s superor to all the other typcal schemes, especally Scheme. Ths s because our EPAS adopts lghtweght pont multplcatons to sgn and verfy messages. The rato of the message verfcaton delay of these schemes s shown n Fg. 4, wth (a) for Scheme and (b) for Scheme respectvely. It s obvous that the delay rato between EPAS Scheme and IBV s always less than 0.50 no matter the number of messages; the delay rato between EPAS Scheme and ECDSA s approxmately 0.5 when the number of messages s larger than 60. In other words, the verfcaton speed of EPAS s twce of IBV s, and s almost 70% faster than the current standard ECDSA. Verfcaton delay rato Scheme/IBV Scheme/ECDSA Scheme/ABAKA Traffc densty (#) (a)

8 JOURNAL OF SOFTWARE, VOL. 8, NO. 8, AUGUST 03 9 Verfcaton delay rato Scheme/IBV Scheme/ECDSA Scheme/ABAKA Traffc densty (#) (b) Fgure 4. Verfcaton delay rato wth dfferent traffc densty B. Transmsson Overhead In ths sub-secton, we compare the transmsson overhead of the fve schemes. The comparson s n terms of the sgnature and the certfcate appended to the orgnal message, whle the message tself s not counted. As shown n Table Ⅳ, for IBV, the length of sgnature s bytes, and 4 bytes for pseudonym. ABAKA s authentcaton materals consst of 0 bytes verfcaton message and 0 bytes materal message, resultng n a sgnature of 40 bytes. ECDSA sgnature s 4 bytes, but a certfcate of 5 bytes must be transmtted along wth the message. And the total transmsson overhead of the ECDSA scheme s 67 bytes. Besdes, as the number of messages ncreases, the transmsson overhead ncreases lnearly for all the schemes. TABLE IV. TRANSMISSION OVERHEAD Schemes One message n messages IBV 63B 63nB ECDSA 67B 67nB ABAKA 80B 80nB EPAS: Scheme 8B 8nB EPAS: Scheme 8B 8nB Snce the IBV scheme adopts blnear parng cryptographc operatons for sgnature, whch s short n length but costly n verfcaton, the total transmsson overhead of IBV s 63 bytes as the shortest. The transmsson overhead of ECDSA s the largest because of certfcate overhead. Our two proposals have the same transmsson cost, whch s a bt larger than ABAKA as bytes lfe perod LT s added to the pseudonym n our scheme to prevent expred pseudonyms abuse. Although the transmsson overhead of IBV s much smaller than the other four schemes, t has a serous flaw of sgnature forgng, whch makes IBV napplcable to safety applcatons. VII. CONCLUSION In ths paper, we have proposed an Effcent Prvacypreservng Authentcaton Scheme (EPAS) for VANETsbased emergency communcaton, whch contans two effcent communcaton patterns: vehcle-to-dra communcaton and vehcle group communcaton. The EPAS adopts pseudonym based sgnature, effectvely preventng the leak and track of vehcle s prvacy nformaton. On the other hand, the authorty can trace the malcous vehcle to protect the securty of VANETs. From the experment results, the proposed scheme releves the bottleneck problem of one-by-one message verfcaton, and reduces the computatonal overhead and the transmsson overhead n VANETs. But the performance analyses of the proposed scheme are not very comprehensve and we have not explored the specfc revocaton mechansm. REFERENCES [] Dedcated Short Range Communcatons (DSRC), Avalable: src. [] USA Department of Transportaton, Natonal Hghway Traffc Safety Admnstraton, Vehcle Safety Communcatons Project, Fnal Repot, 006. [3] S Lee, G Pan, J Park, M Gerla, S Lu, Secure ncentves for commercal ad dssemnaton n vehcular networks, In Proceedngs of the ACM Internatonal Symposum on Moble Ad Hoc Networkng and Computng (MobHoc 07), pp.50-59, 007. [4] A Studer, E Sh, F Ba, and A Perrg, TACKng Together Effcent Authentcaton, Revocaton, and Prvacy n VANETs, In Proceedngs of the IEEE Communcatons Socety Conference on Sensor, Mesh and Ad Hoc Communcatons and Networks (SECON), pp.-6, June 009. [5] R Chen, D Ma, A Regan, TARI: Meetng Delay Requrements n VANETs wth Effcent Authentcaton and Revocaton, In Proceedngs of WAVE, 009. [6] D Boneh, H Shacham, Group sgnatures wth verferlocal revocaton, In Proceedngs of the ACM conference on Computer and communcatons securty(ccs), pp.68-77, 004. [7] B-K Chaurasua, S Verma, Condtonal prvacy through rng sgnature n vehcular ad-hoc networks, Transactons on Computatonal Scence, Sprnger, vol. 6750, pp.47-56, 0. [8] R-X Lu, X-D Ln, T-H Luan, Pseudonym changng at socal spots: an effectve strategy for locaton prvacy n VANET, IEEE Transacton on Vehcular Technology, vol. 6, no., pp.86-96, Jan, 0,. [9] M Raya, J-P Hubaux, Securng vehcular ad hoc networks, Computer Securty, IOS, vol. 5, no., pp , Jan [0] X Ln, X Sun, P-H Ho, X Shen, GSIS: A Secure and Prvacy-Preservng Protocol for Vehcular Communcatons, IEEE Transactons on Vehcular Technology. vol. 56, no. 6, pp , Nov [] C Zhang, X Ln, R Lu, P-H Ho, X. Shen, An effcent message authentcaton scheme for vehcular communcatons, IEEE Transacton Vehcular Technology, vol. 57, no. 6, pp , Nov [] Y Hao, Y Cheng, CH Zhou, W Song, A Dstrbuted Key Management Framework wth Cooperatve Message Authentcaton n VANETs, IEEE Journal on selected areas n communcatons, vol. 9, no. 3, pp.66-69, Mar. 0.

9 9 JOURNAL OF SOFTWARE, VOL. 8, NO. 8, AUGUST 03 [3] C Zhang, R Lu, X Ln, P-H Ho, X. Shen, An Effcent Identty-based Bath Verfcaton Scheme for Vehcular Sensor Networks, INFOCOM, pp.46-50, 008. [4] J-L Huang, L-Y Yeh, H-Y Chen, ABAKA: An Anonymous Batch Authentcated and Key Agreement Scheme for Value-Added Servces n Vehcular, IEEE Transacton On Vehcular Technology, vol. 60, no., pp. 48-6, Jan. 0. [5] K-A Shm, CPAS: An Effcent Condtonal Prvacy- Preservng Authentcaton Scheme for Vehcular Sensor Networks. IEEE Transactons on Vehcular Technology, vol.6, no.4, pp , May 0. [6] 008 Schuan Earthquake. Avalable: org/wk/008_schuan_earthquake. [7] X Guo, T Feng, ZH Yuan, Multple Node-dsjont Paths Dstance Vector Routng for Ad hoc Networks, Computer Scence, vol. 38, no., pp. 86-9,0. [8] C Ren, Solvng Mn-Max Vehcle Routng Problem, Journal of Software, vol. 6, No. 9, pp , Sep. 0. do:0.4304/jsw [9] J L, Vehcle Routng Problem wth Tme Wndows for Reducng Fuel Consumpton, Journal of Computers, vol. 7, No., pp , Dec. 0. do:0.4304/jcp [0] D Hankerson, A Menezes, S Vanstone, Gude to Ellptc Curve Cryptography, Sprnger-Verlag, 004. [] F L, X Xn, Y Hu, Identty-based broadcast sgncrypton, Computer Standard & Interfaces, vol. 30, no. -, pp , Jan [] J-H Yang, C Chang, An ID-based remote mutual authentcaton wth key agreement scheme for moble devces on ellptc curve cryptosystem, Computer Securty, vol. 8, no. 3-4, pp , 009. [3] IEEE Standard IEEE Tral-Use Standard for Wreless Access n Vehcular Envronments - Securty Servces for Applcatons and Management Messages, July 006. [4] C Zhang, P-H Ho and J Tapolca, On batch verfcaton wth group testng for vehcular communcatons,wreless Networks, vol.7, no. 8, pp , 0. Xuedan Ja was born n Chna n 988. She s a master degree canddate n Jangsu Unversty. Her research nterests nclude secure authentcaton and prvacy preservaton technology for VANETs. Langmn Wang was born n Chna n 977. He s an assocate professor n Jangsu Unversty and a specal term professor n Anhu Unversty. Hs research nterests nclude securty and prvacy-preservng technology for the Internet of Thngs.