Received July 12, 2021, accepted August 11, 2021, date of publication August 16, 2021, date of current

version August 31, 2021.

Digital Object Identifier 10.1109/ACCESS.2021.3104861

Efficient Short Group Signatures for Conditional

Privacy in Vehicular Ad Hoc Networks via ID
Caching and Timed Revocation
L. ELLEN FUNDERBURG AND IM-YEONG LEE
Department of Software Convergence, Soonchunhyang University, Asan 31538, South Korea
Corresponding author: Im-Yeong Lee ([email protected])
This work was supported in part by the Basic Science Research Program through the National Research Foundation of Korea (NRF)
funded by the Ministry of Education under Grant NRF-019R1A2C1085718, in part by the Soonchunhyang University Research Fund, and
in part by the Brain Korea 21 (BK21) FOUR (Fostering Outstanding Universities for Research) under Grant 5199990914048.

ABSTRACT Vehicular Ad hoc Networks (VANETs) are a subset of the Internet of Things (IoT) that are
used in smart traffic applications. Due to their high speed, mobility, and exposure to the environment,
the security requirements for VANETs result in the conflicting design goals of protecting member privacy
while also ensuring non-repudiation. Group signature schemes can fulfill these requirements, but often at the
cost of expensive bilinear pairing operations. Furthermore, the cost of updating the group key information
can be costly. Accordingly, this paper has two goals. First, it presents a group signature scheme that has
been modified to remove pairing operations by caching computed values, while still preserving the critical
requirement of conditional privacy. Second, this paper presents an argument for the abandonment of perfect
forward and backward secrecy in VANET schemes in order to prevent the generation of keys that are never
used, or used only once, and reduce the twin burdens of excessive key recalculation and key redistribution
on the system.

INDEX TERMS Short group signatures, conditional privacy, revocation, forward secrecy, backward secrecy,
elliptic curve caching, VANET, timed key updates.

I. INTRODUCTION While VANET is an application of Internet of Things (IoT),

Vehicular Ad hoc Networks (VANETs) are a specialization of the security requirements of VANET are a bit different than
Mobile Ad hoc Networks (MANETs) [1] connecting vehicles other IoT systems. Most of the data collected from vehicles
with other vehicles as well as roadside infrastructure [2]. The in a VANET does not contain sensitive information [4] and
goals of a VANET may include maintaining smooth traffic has low value for attackers. In general, the data are publicly
flow, improving safety for traffic as well as pedestrians, and observable quantities such as vehicle speed, heading, break-
providing comfort, entertainment, or quality of life services ing status, etc. Additionally, the data are usually ephemeral
to drivers and passengers [3]. In a typical VANET, vehi- so protecting access to previously collected data is also not
cles communicate via wireless connections with neighboring a priority. A much more costly, and potentially dangerous,
vehicles, vehicle-to-vehicle (V2V), as well as fixed-location class of attacks on VANET involve the injection of false
devices located along the roadways, vehicle-to-infrastructure data into the system, and in particular Sybil attacks [5]. This
(V2I) [3]. The latter are typically called Road Side Units places a high priority on securing the identity and authenti-
(RSUs). In general, VANETs usually consist of a top-level, cation of message sources [6]. Conversely, another attack of
fully-trusted server, known as a Trusted Authority (TA) or significant concern is malicious entities tracking individual
Service Provider (SP), a middle level of semi-trusted RSUs, vehicles, which places a seemingly contradictory importance
and a final level of vehicles containing computers known as on privacy [7]. Finally, the highly dynamic nature of the
On-Board Units (OBUs). system makes efficiency even more important than usual as
algorithms must execute quickly to ensure the updates do not
arrive too late to be of use.
The associate editor coordinating the review of this manuscript and As a practical matter, VANETs often divide vehicles into
approving it for publication was Zhe Xiao . groups based on RSU locations. Accordingly, there are many

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
VOLUME 9, 2021 118065
 L. E. Funderburg, I.-Y. Lee: Efficient Short Group Signatures for Conditional Privacy in VANETs

VANET schemes using group key sharing or group signa- non-repudiation. All vehicles in the system have identical
tures [8]. In these schemes, the questions of how and when to keys and any identifying information included in the mes-
update the group keys are critical. In many IoT applications, sage could have been forged or stolen. This results in a
such as smart factories or smart power grids, the groups are system that is highly vulnerable to the injection of bad data,
static or change only slowly over time. However, in the case without a reliable way to trace and remove the offending
of VANET, group membership is highly dynamic. Depending vehicles even in the case such data is detected. For exam-
on the traffic situation, group membership may change as, ple, among recently proposed group key schemes, schemes
or possibly even more, frequently than the standard rate of by Cui et al. [13], Islam et al. [14], Liu et al. [15], and
safety message updates [9]. Paliwal and Chandrakar [16] assign traceable pseudo-IDs to
When groups change, group key and group signature vehicles, but the identities are only authenticated when the
schemes must concern themselves with the issues of for- vehicle joins (and for some schemes when it leaves) a group.
ward secrecy, joining members can’t read old messages, When the vehicles are within the system, they are free to
and backward secrecy, departed members can’t read new create mayhem. Without per-message pseudo-ID authentica-
messages [10]. The concept of backward secrecy can be tion, malicious vehicles could use fake identities to appear
extended in the case of group signatures to be departed as multiple vehicles or copy the identities of other vehicles
members can’t sign future messages. The decision of when for use in impersonation attacks. While join-time authenti-
and when not to update the group keys is critical for perfor- cation is an important layer of security, it is reasonable to
mance, but not often closely examined by VANET group key expect that a malicious entity may obtain valid credentials
schemes. In particular, some schemes assume group keys will through offline theft or forgery. Therefore, non-repudiation
update every time a vehicle leaves [2], or even every time and traceability are important features of VANET systems,
group membership changes [11], [12], which may be imprac- and vehicles should not be considered fully-trusted even after
tical given the highly-dynamic nature of VANET group their credentials have been authenticated.
membership. In order to provide authentication, privacy, and non-
This paper has two main goals: 1) We present a scheme repudiation for messages by vehicles after they have joined
increasing the efficiency of group signatures via a method the system, some VANET schemes use group signatures with
of caching pairing calculations, as pairings are a relatively conditional privacy. With conditional privacy, vehicle identi-
slow mathematical operation. 2) We propose to use a fixed ties are protected from other vehicles but may be revealed by
interval for triggering group key updates instead of perfectly a trusted entity. Many of these schemes use bilinear pairing
preserving forward and backward secrecy, and provide a operations. One scheme using pairings for privacy preserving
thorough analysis in support of this proposition over other authentication is the DIKE scheme by Lu et al. [2]. Unfor-
methods. tunately, this scheme contains no tracing key, and it is not
The remainder of the paper is organized as follows. possible to entirely revoke the privacy for a vehicle and reveal
Section II presents a summary of recent work on the topic. its true identity. In this case, the scheme can only reveal if
Section III contains the proposed scheme. Section IV gives a malicious entity is attempting to join the group multiple
an analysis of our scheme and evidence in support of fixed times using the same private key or after being previously
interval group key updates. Section V concludes the paper. revoked. The Alimohammadi & Pouyan scheme [17] uses the
same basic algorithm, but applies it to detecting duplicated
II. RELATED WORK messages rather than duplicated join request. This scheme
VANET schemes can be primarily divided into schemes using shares the same problem that there is no mechanism for
group keys and schemes using group signatures. Group key tracing the true identity of the offending entity, only detecting
schemes focus on efficient group key agreement and rekeying the attempt.
algorithms. They often use symmetric group keys without Zhang et al. proposed a different scheme using pairings
verification of the sender’s true identity, only verifying that for privacy preserving signatures [18]. In this scheme, RSUs
they are in possession of the current group key. Group sig- can trace the identity of malicious nodes, however the trace
nature schemes, on the other hand, attempt to also track requires up to n pairing operations, where n is the num-
the identity of the message sender and frequently use zero- ber of vehicles in the group. Signature verification also
knowledge proofs, where the sender proves possession of requires 3 pairing operations, although the verifications may
a secret without revealing anything about that secret, with be batched.
bilinear pairings in order to provide conditional privacy. The Another scheme using pairings was proposed by
sender’s identity is protected from other group members, but Azees et al. in [19]. Certificates containing pseudo-IDs are
the possessor of the tracing key can reveal the identity in cases sent along with each message to provide authentication.
of malicious behavior or disputes. There is only one pseudo-ID per vehicle and the IDs are
As noted above, many VANET schemes propose to use included on the certificates, so it is easy for other vehicles
symmetric group keys following vehicle authentication. to link messages from the same sender. In addition, while
While using symmetric group keys makes for quick encryp- pairings are not used for authentication, they are used for
tion and decryption times, there is no way to guarantee checking message integrity and n + 1 pairings are required for

118066 VOLUME 9, 2021

L. E. Funderburg, I.-Y. Lee: Efficient Short Group Signatures for Conditional Privacy in VANETs

n messages. Finally, while the TA can reveal the true identity only detect fake IDs by looping through a database of stored
of a malicious node, there is no mechanism for revoking the identity tuples in order to confirm that none of the real IDs
certificates of such nodes. stored match the ‘‘real’’ ID used for signing. As the number
The short group signature algorithm proposed by Boneh, of registered vehicles in the system grows, it will become
Boyen, and Shacham (BBS) [20] provides conditional pri- increasingly difficult to detect fake identities in real-time.
vacy preservation and forms the basis of the Lim et al. [21] A final category of VANET schemes uses methods that pre-
and Hao et al. [22] group signature schemes. These BBS clude broadcast messaging, such as asymmetric encryption or
signatures have the advantage of providing a tracing key 1:1 symmetric keys for communication between each vehicle
that may be used to reveal the identities of message sign- pair. One example is signcryption schemes such as those
ers. However, they require pairing operations to authenticate proposed in Zhou et al. [27] and Ali et al. [28], which require
the signatures, which are relatively expensive mathematical the public key of the receiver. Schemes using 1:1 symmetric
operations. keys include Xiong and Tang [29] and Li et al. [30]. Due to
While many VANET signature schemes use elliptic the large group sizes, high speeds, and time criticality of the
curve pairings to provide authenticated conditional privacy, data, schemes that lack support for broadcast communication
Zhong et al. [23] proposed a scheme without them. In the to anonymous receivers are impractical for VANET applica-
Zhong scheme, the RSU for the group authenticates the sig- tions. Furthermore, the above schemes require unique keys
natures and broadcasts a Bloom filter list of valid and invalid for every member of the system, which presents a risk to
messages to the vehicles. This method requires RSUs to issue privacy.
validation messages for every vehicle message before other To overcome the shortcomings of the schemes discussed in
vehicles will process it, which increases message traffic and this section, we propose a new scheme that uses the caching
creates a delay in time-critical V2V message processing as of pre-computed bilinear pairing values and restricts routine
vehicles wait for the message confirmation. The use of a group secret updates to timed intervals. These modifications
Bloom filter also introduces the problem of false positives. preserve the advantages of existing schemes with regards
Another set of schemes uses individual signatures, rather to message authentication and conditional privacy while
than group signatures, to validate the messages. These providing increased efficiency. A table comparing the pro-
schemes use traceable pseudo-IDs in order to hide the ori- posed scheme with recent similar schemes is included in the
gin of the messages from other vehicles in the system. Analysis section.
Two schemes using similar signatures were proposed by
Zhang et al. [24] and Cui et al. [25]. The Zhang scheme uses III. PROPOSED SCHEME
the Chinese Remainder Theorem in order to quickly and The basis of our scheme is a system using Boneh, Boyen, and
efficiently handle both initial key distribution and key updates Shacham short group signatures [20] that has been configured
when group members change. The Cui scheme focuses on for detecting Sybil attacks as described in [9]. In a Sybil
the use of content sharing among neighboring vehicles in attack a vehicle sends messages appearing to come from
order to reduce the network burden of accessing content from many different vehicles in order to create the illusion of addi-
distant servers. In both schemes, vehicles create traceable tional traffic or out-vote honest vehicles to create erroneous
pseudo-IDs for message signing, but there is no authentica- condition reports [31].
tion in the signatures of the real IDs used to create the pseudo- The system used in this scheme consists of 3 levels as
IDs. Malicious vehicles could use random numbers in place shown in Fig. 1: a top level with one or more TAs that control
of their real identifiers in order to create untraceable pseudo- the group master keys, a middle level of more numerous
IDs. The schemes assume a theoretical tamper-proof device
in order to prevent this behavior.
Zhang et al. [26] present another scheme in this cate-
gory. Their scheme involves a future-facing system that uses
selected vehicles as edge nodes in order to take advantage
of 5G technology and remove the need for cumbersome
RSUs. As with the previous two schemes, this scheme does
not validate the real IDs (5G_ID) during the signature ver-
ification phase. Therefore, a malicious vehicle could sign a
message using a random value for its ‘‘real’’ identifier and
remain untraceable. This scheme does have an advantage over
the previous two in that it is possible for the TA to detect a
fake real ID given a message signature. However, the mes-
sages would still have been received and processed by the
vehicles in the group before the TA could detect the problem.
In addition, this requires the TA to check all messages from all
vehicles in the system to detect a problem. Finally, the TA can FIGURE 1. System Hierarchy.

VOLUME 9, 2021 118067

 L. E. Funderburg, I.-Y. Lee: Efficient Short Group Signatures for Conditional Privacy in VANETs

FIGURE 2. Messaging.

Regional Traffic Monitors (RTMs) that manage and moni- signature verification. In this scheme, a single pairing oper-
tor the vehicles within their respective geographic coverage ation is required the first time an OBU signature is verified,
areas, and a final level for the OBUs. In this system, the RSUs but all subsequent signature verifications for that OBU are
are only semi-trusted relay nodes that convey the short-range pairing free.
wireless communications of the vehicles to the RTMs or TAs.. The proposed scheme consists of 8 steps, as can be seen
All OBUs within a single RTM’s geographic coverage in Fig. 2: 1) The TA generates the group public parameters
area form a group. The OBUs communicate with each other as well as the master and tracing keys. 2) The tracing key is
and that RTM using privacy-preserving group signatures via sent to the RTM in charge of the group. 3) An OBU wishing
a Dedicated Short-Range Communication (DSRC) standard to join the group sends its identification to the TA via an
such as IEEE 802.11p for Wireless Access in Vehicular RSU relay or direct 5G connection to the internet. 4) The
Environments (WAVE) [32]. The RTM is responsible for TA authenticates the OBU, and 5) generates a private group
monitoring the group to detect Sybil attacks, as well as other signing key for that OBU. 6) The TA informs the RTM of the
malicious behavior, and reporting traffic and road conditions OBU joining the group. 7) The TA sends the signing key to
to other parts of the system. the OBU. 8) The OBU sends messages to the RTM and other
group members signed with its signing key.

A. OVERVIEW B. DETAILS
The TA initially generates the group public, master, and The notations used in this paper are shown in Table 1.
tracing keys for each RTM. Each tracing key is distributed to
the corresponding RTM, but the master keys are held by the
TABLE 1. Notations.
TA so that semi-trusted RTMs may not generate group keys.
When an OBU enters the coverage area of an RTM, the OBU
contacts the TA in order to authenticate its identity and receive
a group secret key to use for signing messages within that
RTM group. The TA notifies the appropriate RTM of the new
group member, and sends the pseudo-ID for that OBU to
that RTM. The RTM can then use the tracing key to monitor
message signatures and detect when an OBU is sending more
messages than it should in an attempt to perform a Sybil
attack. In the event a Sybil attack, or any other malicious
behavior is detected, the RTM can report the pseudo-ID of the
malicious node to the TA, which can regenerate group keys to
exclude the malicious node as well as map the pseudo-ID of
the OBU to its real-world ID for reporting to law enforcement
or other authorities.
The scheme presented here differs from the system in [9] 1) BILINEAR MAPS
and other schemes using BBS signatures because it caches For each RTM, G1 and G2 are two bilinear, multiplicative,
some of the pairing calculations to reduce the cost of cyclic groups of prime order p. g1 is a generator of G1 and g2

118068 VOLUME 9, 2021

L. E. Funderburg, I.-Y. Lee: Efficient Short Group Signatures for Conditional Privacy in VANETs

is a generator of G2 . e is a computable map e : G1 ×G2 → GT 4) SIGNATURE GENERATION

and e(g1 , g2 ) 6 = 1. Following the BBS short group signature algorithm, when an
OBU wants to send a message, it signs the message using its
2) INITIALIZATION private signing key as follows:
For each RTM, the TA configures a signature group. The TA 1. Choose random values for α, β ← Zp .
randomly selects hj ← G1 \{1G1 } and ζ1j , ζ2j ← Z∗p and sets β
2. Compute T1 ← uαj , T2 ← vj , T3 ← Aji hj , δ1 ←
α+β
uj , vj ∈ G1 such that xji α, and δ2 ← xji β.
ζ ζ 3. Choose random values for rα , rβ , rx , rδ1 , rδ2 ← Zp .
uj 1j = vj 2j = hj . (1) r
4. Compute R1 ← urj α , R2 ← vj β , R3 ← e (T3 , g2 )rx ·
−rδ
Then it randomly selects the group master key γj ← Z∗p

−r −r
−r −r
e hj , wj α β · e hj , g2 δ1 δ2 , R4 ← T1rx · uj 1 ,
and sets −rδ
and R5 ← T2rx · vj 2 .
γ
wj = g2j . (2) 5. Construct a challenge value using a publicly known
hash function and the values computed above: c ←
In order to reduce pairing computations when generating H (M , T1 , T2 , T3 , R1 , R2 , R3 , R4 , R5 ) ∈ Zp .
and evaluating signatures, the TA also precomputes the pair- 6. Compute sα = rα + cα, sβ = rβ + cβ, sx = rx + cxji ,
ings [20] sδ1 = rδ1 + cδ1 , and sδ2 = rδ2 + cδ2 .
p1j = e hj , wj ,


(3) 7. Set the final signature value as σ ← (T1 , T2 , T3 , c, sα ,
sβ , sx , sδ1 , sδ2 ).
p2j = e hj , g2 ,


(4)
This creates a zero-knowledge proof of signature. Without
pg = e (g1 , g2 ) . (5) access to the tracing key, verifiers cannot know the pseudo-ID
The public parameters for group j are (g1 , g2 , pg , hj , uj , vj , of the OBU that signed the message. They can only know that
wj , p1j , p2j ) and the tracing key is (ζ1j , ζ2j ). The public param- the message was signed by an OBU with a valid private key.
eters are distributed to all entities in the group, as well as new This prevents malicious OBUs from impersonating the signer
OBUs on joining. The tracing key is sent to the RTM in charge by reusing its pseudo-ID, as well as providing some privacy
of group j, RTMj . to the OBU.
The pairing calculations can be completely eliminated
3) OBU JOINING from message signing [20]. The pairings using g2 , hj , and wj
were included in the public parameters, so the R3 calculation
When an OBU enters an RTM coverage area, the OBU
becomes
contacts the TA to obtain its group signature key for that
−r −rβ −rδ1 −rδ2
RTM. The TA authenticates the real identity of the OBU via a R3 ← e (T3 , g2 )rx · p1j α · p2j . (7)
Public Key Infrastructure (PKI). Offline, each OBU receives
an identity certificate signed by an issuing authority when Furthermore, the e (T3 , g2 ) pairing can also be eliminated
the vehicle is registered with the government. When an OBU by using the precomputed pairing provided as part of the
α+β
contacts the TA in order to join an RTM’s group, the TA private signing key [20]. Substitute Aji hj for T3 to get
checks the signature of that certificate in order to verify the 
α+β

real identity of the OBU. If the certificate is valid, the TA e Aji hj , g2 (8)
uses the public key included with the certificate to establish and separate the terms into
a secure channel with the OBU. Note that this certificate is
 α+β 
used only for the initial authentication step. e Aji , g2 e hj , g2 . (9)
After the OBU’s real identity is verified as being allowed
to join the system, the TA generates a private signing key for Then it can be seen that both pairings can be done using
the OBU by randomly selecting xji ← Z∗p then calculating precomputed values
the pseudo-ID for the OBU as
α+β
e Aji , g2 e hj , g2 .


(10)
1/(γj +xji )
Aji ← g1 , (6) This makes the final R3 calculation
α+β rx −rδ −rδ
 
where j is the RTM group and i is the OBU. Additionally, −r −r
R3 ← pji · p2j · p1j α β · p2j 1 2 . (11)
pji = e Aji , g2 will be precomputed. The private signing

key for OBUi is then (Aji , xji , pji ). For reasons detailed in the next section, Signature Verifi-
The private signing key and group public parameters are cation, in this scheme random values of α and β will only
then encrypted with the public key from the OBU’s PKI be used for the initial signature. Subsequent signatures will
certificate and sent securely to the OBU. The pseudo-ID for reuse the same α and β values. This will greatly increase the
the OBU, Aji , is also sent to the RTM via a secure channel. efficiency of the algorithm at the potential cost of some loss
The second component of the OBU’s signing key, xji , will not of privacy due to the values of the T parameters remaining
be known by the RTM. constant across all messages signed by the same OBU. This

VOLUME 9, 2021 118069

 L. E. Funderburg, I.-Y. Lee: Efficient Short Group Signatures for Conditional Privacy in VANETs

trade-off, including the reasons that this weakening of privacy 7) OBU LEAVING
is not as consequential as might be feared at first glance, When an OBU leaves the group naturally, i.e. by exiting
is discussed further in the Analysis section. the area or disconnecting from the system, no action is
taken. Instead, the group keys will be periodically updated at
5) SIGNATURE VERIFICATION rate tre−key , which can be determined according to the traffic
When group members receive a message, they can verify the density and infrastructure capabilities in an installed area.
signature as follows: As discussed below in the Analysis section, the highly
s ephemeral nature of groups in VANET makes it extremely
1. Compute R̃1 ← usj α /T1c , R̃2 ← vj β /T2c , R̃3 ←

−s −s
−s −s inefficient to perfectly preserve forward and backward
e (T3 , g2 )sx · e hj , wj α β · e hj , g2 δ1 δ2 · secrecy, and the nature of the message contents makes it
e(T3 ,wj ) c sδ sδ
e(g1 ,g2 ) , R̃4 ← T1sx /uj 1 , and R̃5 ← T2sx /vj 2 . unnecessary. The main goal of a VANET group key scheme
2. Verify the challenge by checking c = H (M , T1 , T2 , T3 , should be to prevent malicious nodes from injecting false data
R̃1 , R̃2 , R̃3 , R̃4 , R̃5 ). or otherwise corrupting the system. Accordingly, valuable
As in the case of signature generation, several pairings bandwidth and computation time should not be expended to
can be eliminated from the verification process by using the immediately remove group privileges from OBUs that tra-
precomputed values provided as part of the public parameters. versed the region without exhibiting any malicious behavior.
However, unlike in the case of signature generation, two On the other hand, when a malicious node is detected
pairings remain, e (T3 , g2 ) and e T3 , wj . These pairings can

its access to the system will be immediately removed. The
be combined into a single pairing [20], RTM will notify the TA of the malicious node and the TA
will regenerate and reissue group keys for all other OBUs
 
e T3 , wcj gs2x . (12) following the same steps described above in Initialization and
OBU Joining.
sx

This can be seen by rewriting the pairings as e T3 , g2 and IV. ANALYSIS
e T3 , wcj then combining them. The R̃3 calculation can then
A. SCHEME SECURITY AND EFFICIENCY
be written as VANET security schemes should seek to balance the oppos-
 
−s −s −sδ −sδ ing needs of authentication/non-repudiation and privacy.
e T3 , wcj gs2x · p1j α β · p2j 1 2 · p−c
g . (13)
Authentication and non-repudiation prevent the injection of
potentially dangerous false data into the system, while pro-
While a single pairing is much better than five, pairings
tecting privacy is necessary to prevent the stalking or targeting
are still very expensive compared to other mathematical
of individual users. In addition, efficiency is particularly
operations [13], [23], [33]. In order to achieve performance
important in VANET applications due to the time-sensitive
similar to a pairing-free algorithm, while retaining the critical
nature and volume of the data. Table 2 shows a comparison of
security features provided by group signatures, we propose to
the proposed scheme with other recently proposed schemes.
cache the T3 pairing.
In the original BBS short group signature scheme,
T3 changed with every signature. In the proposed scheme, 1) AUTHENTICATION
signers will use constant values for T3 . With T3 constant, In order to forge a signature, an attacker must create a valid

verifiers can compute the T3 pairing just once, the first time signature with an arbitrary value for one half of the Aji , xji
a message is received from that signer, and cache that value. pair without knowing the master key. If an attacker chooses
Subsequent messages from the same signer can accordingly an arbitrary value for Aji . In order to obtain a matching xji
be verified without any pairing calculations. the attacker must invert (6), but without knowing the master
key, the value of xji that successfully completes the challenge
6) TRACING cannot be distinguished from a random member of the set Zp .
The same holds if the attacker chooses an arbitrary xji and
When malicious activity is detected, an RTM can use the
attempts to obtain the corresponding Aji . If the value of γj
tracing key to unmask the pseudo-ID of the offending node
used to compute Aji does not match the value of γj used to
as shown:
compute wj the R̃3 challenge will fail and the signature will
ζ ζ
Aji ← T3 /(T1 1j · T2 2j ). (14) be flagged as invalid. Furthermore, obtaining the γj from (2)
requires solving the Discrete Logarithm Problem.
The pseudo-ID is reported to the TA, which regenerates
the group keys using the steps above for Initialization and 2) NON-REPUDIATION
OBU Joining, maps the pseudo-ID to a real-world ID, and The property of non-repudiation holds for the signatures.
reports the real-world ID to the appropriate agencies. A list After a valid signature has been produced and authenticated,
of banned IDs is maintained by the TAs and these IDs will a vehicle cannot plausibly deny producing that signature
not be allowed to rejoin the system. when its pseudo-ID, Aji , has been revealed via the tracing key.

118070 VOLUME 9, 2021

L. E. Funderburg, I.-Y. Lee: Efficient Short Group Signatures for Conditional Privacy in VANETs

TABLE 2. Comparison of proposed scheme with existing schemes N/A = not applicable.

First, a vehicle cannot produce a valid signature without RSU’s access to the tracing key) and use that to create a valid
including an Aji value calculated using the master key, γj . If a signature. The challenge will fail without knowledge of the
random value is used for Aji , the R̃3 portion of the challenge corresponding xji value as discussed in the second point.
will fail. In order to pass the R̃3 challenge, Finally, a vehicle cannot use its own private signature key
 x
 values Aji and xji to compute the value of the TA’s master key
e Aji , wj g2ji (15) from (6) because that requires solving the Discrete Logarithm
must equal Problem to obtain a value for 1/(γj +xji ) before solving for γj .

e (g1 , g2 ) . [20] (16) 3) PRIVACY

For the first pairing, substitution yields The proposed scheme preserves the over-all privacy of the
 1/(γ +x ) γ x  vehicles. The pseudo-ID contains no information about the
e g1 j ji , g2j g2 ,
ji
(17) real-world identity of the vehicle. The mapping of pseudo-
ID to real-world identity is stored in a table accessible only
and by rearranging the terms to to the TA, which is fully trusted. An RTM may easily obtain
 −γ −x γ +x 
e g1 j ji , g2j ji (18) a vehicle’s pseudo-ID from its signature via the tracing key,
but it cannot associate that pseudo-ID with the vehicle’s
it can be seen that value of γj used to compute Aji must equal real-world identity. In addition, as discussed above in Non-
the value of γj used to compute wj . Repudiation, vehicles cannot trace the pseudo-IDs of other
Second, a vehicle cannot reuse the T1 , T2 , T3 values vehicles without solving the Decision Linear Problem.
from another vehicle’s signature. Computing the value of Aji Although knowledge of a vehicle’s real-world identity as
from T1 , T2 , T3 without the tracing key requires solving the well as its pseudo-ID is protected in the proposed scheme,
Decision Linear Problem [20]. Furthermore, even if a mali- the scheme does allow some tracking of a vehicle in exchange
cious vehicle were able to obtain the Aji for another vehicle, for an increase in efficiency compared to similar schemes.
the challenge will fail without the corresponding value of xji , Because the T3 value for a vehicle is fixed, other members of
as seen from the R̃3 challenge above in (17) where the value the group can use the T3 value to track a vehicle within the
x
of xji in g2ji must match the xji used to compute Aji . group until the group key updates. However, the T3 values are
Third, a vehicle cannot reuse the signature of another not linked following group key updates, so the tracking will
vehicle. The challenge hash calculation includes the message not continue beyond the specified group key update rate.
contents, M ; therefore, the signature value will change for Another consideration is that vehicles may be tracked using
each message. A malicious vehicle can merely replay an some combination of known physical factors such as position,
identical message, which is easily detected through the use heading, speed, etc. [34]. In fact, the contents of the standard
of timestamps or incrementing message serial numbers, for messages of intelligent transportation systems, for example
example. the Cooperative Awareness Message (CAM) [35] from the
Fourth, a malicious vehicle cannot collude with a malicious European Telecommunications Standards Institute (ETSI)
RSU in order to steal the Aji of another vehicle (via the and the Basic Safety Message (BSM) [36] of the SAE J2735

VOLUME 9, 2021 118071

 L. E. Funderburg, I.-Y. Lee: Efficient Short Group Signatures for Conditional Privacy in VANETs

TABLE 3. Execution times for cryptographic operations.

standard, are designed to aid trajectory prediction. While the

intention is to allow vehicles to predict the future positions of
other vehicles in order to avoid collisions, this means that by
design it should be easy to track the position of a target vehicle
in a VANET without any identifying information. Therefore,
the ability to track vehicles due to the use of fixed values for FIGURE 4. Tracing times for various group sizes.

T3 is of minimal impact.

4) EFFICIENCY
By using a mixture of pre-computed and cached pairing between groups as a requirement, so as written they are not
results, the proposed scheme gains an efficiency advantage compatible with BN462, which is a Type 3 curve [38]. How-
during signature verification over other schemes. Moreover, ever, the isomorphism requirement was originally included
this efficiency is not gained at the price of conditional privacy by Boneh et al. in order to satisfy their definition of the
preservation. In the proposed scheme it is still possible for the Strong Diffie-Hellmann (SDH) assumption given in [20]. In a
group manager to quickly trace the identities of any nodes later paper, Boneh and Boyen introduced an updated defini-
exhibiting malicious behavior. At the same time, vehicles tion of SDH that does not require isomorphism [39], [40].
in the group cannot determine the pseudo-IDs of any other This revised definition allows the use of the faster Type 3
vehicles in the group from their signatures. curves with short group signature schemes, and therefore the
The performance of the proposed scheme was compared to BN462 curve may be safely used in this analysis.
existing schemes [18] and [21] as these schemes are the only As can be seen from Fig. 3, the proposed scheme has a
schemes reviewed that also provide tracing and authentication performance advantage over the Lim scheme for all actions
of vehicle’s real identities. The estimated times required for and the Zhang scheme for unbatched signature verification
message signing and verification for the three schemes are and tracing. In cases where message batching is possible,
presented in Fig. 3. Timings for the non-negligible constituent the Zhang scheme will outperform the proposed scheme for
operations are presented in Table 3. The operation times signature verification as the time remains essentially constant
were measured using the C MIRACL Core Cryptographic regardless of the number of messages verified. However,
Library [37] on an Intel Core i7-8700 CPU @ 3.2 GHz there may be many times in VANETs where message caching
with 32 GB of RAM running the Windows 10 operating is undesirable, for example in the cases of time-critical safety
system, averaged over many iterations in order to account for or emergency messages.
interrupts due to background system operations. The main disadvantage of the Zhang scheme compared
to the other two schemes lies in its message tracing algo-
rithm. The Zhang scheme traces message senders by looping
through a table of stored tracing and identity parameters with
one entry for each member of the group. Fig. 4 shows the
effect of this iteration on tracing time in relation to group
size, assuming that on average the tracing will find the correct
vehicle after searching half of the table. The tracing times of
the other two schemes remain constant as the identities are
computed directly and not dependent on the size of the group.
The ability to revoke privacy and trace a message signer
is an important part of identifying and removing malicious
vehicles in VANETs. For example, in order to detect Sybil
FIGURE 3. Comparison of execution times. attacks, it must be possible for some monitoring authority to
quickly link messages sent by the same vehicle using different
A Barreto-Naehrig curve, BN462, was used for all three pseudo-IDs. As traffic density grows, the Zhang scheme’s
schemes. This curve provides 128-bit security [38]. Both the tracing algorithm quickly becomes inadequate for detecting
Zhang et al. scheme and Lim et al. scheme state isomorphism these kinds of attacks.

118072 VOLUME 9, 2021

L. E. Funderburg, I.-Y. Lee: Efficient Short Group Signatures for Conditional Privacy in VANETs

FIGURE 7. New York (Queens-Midtown Tunnel).

FIGURE 5. Houston (I-45/610).

Traffic counts were obtained for morning and evening rush

hour periods. Rush hour is often not the busiest time of day for
each of the interchanges analyzed, but it represents a typical
period of heavy traffic in US cities. Traffic counts were
taken from 2019 in order to avoid undercounts in 2020 due
to a dramatic, and atypical, reduction in traffic during the
COVID-19 pandemic [44].
A few assumptions were made due to the limited availabil-
ity of data samples, which were generally only measured on
major roads. First, only traffic on major roads was considered.
Traffic entering or leaving the group on side streets was
considered negligible. Second, traffic on major roads was
assumed to continue on the major roads without exiting.
FIGURE 6. Seattle (I-5/405). This assumption was necessary due to the distance of some
count sensors from the 1km radius. A comparison of Annual
Average Daily Traffic (AADT) counts, which were often
Finally, our scheme proposes to restrict group key updates closer to the group boundary modeled but do not report the
to timed intervals in the case of normal operation. This would required fine-grained hourly data, supported this assumption.
greatly reduce group key updates compared to other schemes, Finally, in several cases hourly traffic counts were not avail-
and therefore also provide increased efficiency by reducing able for one of the routes included. In those cases, an hourly
the messaging and calculations associated with updating the estimate was made using the 2019 AADT for that route. It’s
group keys. A detailed analysis of group key update fre- important to note that the first and third assumptions almost
quency is presented below. certainly lead to an undercount, which means the required
group rekeying time would likely be somewhat greater than
B. ANALYSIS OF FORWARD & BACKWARD SECRECY these calculations show.
Some schemes propose to preserve forward and backward Tables 4, 5, and 6 show the traffic counts leaving the
secrecy perfectly by updating the group secret for every 1 km radius circle for each metropolitan area, and Table 7
vehicle that leaves and, in many current schemes, also for shows the resulting calculations of the required frequency of
joining members [2], [11]–[13], [15], [16], [18], [24], [26]. group secret updates in order to perfectly maintain forward or
In order to investigate the required update frequency for such backward secrecy. In the case of Houston, between 7am and
a strategy under some common traffic conditions, publicly 8am 24040 vehicles cross the RSU boundary at the studied
available traffic count data for three US cities: Houston [41], intersection to leave the group. This is the highest volume of
Seattle [42], and New York [43] were analyzed. traffic that occurs at that intersection during the three hours
In each city, a busy interchange was chosen for the inves- we investigated. With 24040 vehicles leaving the area over
tigation. Sample locations are shown in Figs. 5, 6, and 7. the course of an hour, just over 6 vehicles will leave the
A 1km radius was used to mark the group boundaries as that area per second. The group key schemes referenced in this
is typically defined to be the area covered by a single RSU paper define their groups based on geographical location.
as it is the maximum transmission distance in the WAVE This means that around 6 cars will leave the group per second.
standard [6]. If the group keys are updated every time a car leaves the

VOLUME 9, 2021 118073

 L. E. Funderburg, I.-Y. Lee: Efficient Short Group Signatures for Conditional Privacy in VANETs

TABLE 4. Houston traffic counts.

TABLE 5. Seattle traffic counts.

TABLE 6. New York City traffic counts.

TABLE 7. Total traffic counts and rate of group exit at peak traffic.

group, the group keys will change at a rate of 150ms. The of the work done to calculate and distribute the keys in the
worst case rate of our sampled locations requires the group first place, and may even be impossible with real-world trans-
key to update every 139ms. mission times and processor loads. Similarly, attempting to
The BSM of the SAE J2735 standard should be sent about preserve forward and backward secrecy by alternative meth-
every 100ms [36]. Using actual traffic counts, in all of the ods, such as maintaining some form of revocation list, would
sampled cases, at most two BSMs could be sent before a car require those structures to grow and change at an impracti-
departed the group. In fact, it can clearly be seen that two cal rate. When real-world traffic conditions are considered,
messages would be a best case scenario. At almost all of the it makes sense that some forward and backward secrecy is
sample times and locations, keys could only be guaranteed to sacrificed in the absence of known malicious VANET mem-
be used to send at most one BSM. Additionally, these random bers in order to allow the use of group keys for more than a
samples do not even represent worst-case scenarios. At all single message before regenerating and redistributing a new
locations there were times of day and days of the year that shared secret. The appropriate timing of the updates will
exceeded the traffic counts used in our analysis. Furthermore, likely vary given the traffic and network characteristics of any
there is no reason to think these samples capture the busiest given area.
traffic locations in the US, or the world. While relaxing forward and backward secrecy introduces
Given the calculated rate of group change, updating group some security risks, these risks should be minimal. In the
keys for every vehicle that leaves or joins a group is a waste case of vehicles that join a group, access to previously sent

118074 VOLUME 9, 2021

L. E. Funderburg, I.-Y. Lee: Efficient Short Group Signatures for Conditional Privacy in VANETs

messages is of little use in VANET due to the ephemeral and [3] M. S. Sheikh, J. Liang, and W. Wang, ‘‘A survey of security services,
open nature of the data. In the case of vehicles that leave a attacks, and applications for vehicular ad hoc networks (VANETs),’’ Sen-
sors, vol. 19, no. 16, p. 3589, Aug. 2019, doi: 10.3390/s19163589.
group, vehicles that leave the group by crossing a geographic [4] M. Raya and J.-P. Hubaux, ‘‘Securing vehicular ad hoc networks,’’ J. Com-
boundary have already had access to the group keys and could put. Secur., vol. 15, no. 1, pp. 39–68, 2007.
have attempted insider attacks at any time. When a vehicle [5] F. Sakiz and S. Sen, ‘‘A survey of attacks and detection mechanisms
on intelligent transportation systems: VANETs and IoV,’’ Ad Hoc Netw.,
leaves a group without having committed any attacks against vol. 61, pp. 33–50, Jun. 2017, doi: 10.1016/j.adhoc.2017.03.006.
the group, it is reasonable to continue trusting that vehicle [6] M. N. Mejri, J. Ben-Othman, and M. Hamdi, ‘‘Survey on VANET security
for some short time more until the next scheduled group key challenges and possible cryptographic solutions,’’ Veh. Commun., vol. 1,
no. 2, pp. 53–66, Apr. 2014, doi: 10.1016/j.vehcom.2014.05.001.
update. On the other hand, if a malicious vehicle is detected, [7] B. Parno and A. Perrig, ‘‘Challenges in securing vehicular networks,’’ in
the group secret should be updated immediately in order to Proc. HotNets, College Park, MD, USA, 2005, pp. 1–6.
preserve secrecy in the presence of a known bad actor. [8] D. Manivannan, S. S. Moni, and S. Zeadally, ‘‘Secure authentica-
tion and privacy-preserving techniques in vehicular ad-hoc NETworks
At this point, it is reasonable to question why the group (VANETs),’’ Veh. Commun., vol. 25, Oct. 2020, Art. no. 100247, doi:
key should ever be updated barring malicious activity. There 10.1016/j.vehcom.2020.100247.
are several arguments in favor of periodic group key updates. [9] L. E. Funderburg and I.-Y. Lee, ‘‘A privacy-preserving key management
scheme with support for sybil attack detection in VANETs,’’ Sensors,
First, pseudo-IDs will remain the same until the group key vol. 21, no. 4, p. 1063, Feb. 2021, doi: 10.3390/s21041063.
updates. This makes it easier to track vehicles by their [10] H. Alzaid, D. Park, J. G. Nieto, C. Boyd, and E. Foo, ‘‘A forward
pseudo-IDs, although as discussed above there are other, and backward secure key management in wireless sensor networks for
PCS/SCADA,’’ in Proc. S-CUBE, Pisa, Italy, vol. 24, 2009, pp. 66–82, doi:
physical means of tracking vehicles. A second argument is 10.1007/978-3-642-11528-8_6.
that the longer the group keys remain the same, the more time [11] K. K. Chauhan, S. Kumar, and S. Kumar, ‘‘The design of a secure key
an attacker has to amass a set of valid keys in order to perform management system in vehicular ad hoc networks,’’ in Proc. Conf. Inf.
Commun. Technol. (CICT), Gwalior, India, Nov. 2017, doi: 10.1109/INFO-
a Sybil attack, for example. Finally, changing the group key COMTECH.2017.8340636.
‘‘resets’’ the group, which clears old data from tables and [12] A. Mansour, K. M. Malik, A. Alkaff, and H. Kanaan, ‘‘ALMS: Asymmetric
memory caches in order to prevent them from growing too lightweight centralized group key management protocol for VANETs,’’
IEEE Trans. Intell. Transp. Syst., vol. 22, no. 3, pp. 1663–1678, Mar. 2021,
large and slowing down the system as vehicles that have doi: 10.1109/TITS.2020.2975226.
departed the geographic area need no longer be monitored [13] J. Cui, X. Tao, J. Zhang, Y. Xu, and H. Zhong, ‘‘HCPA-GKA: A hash
or processed by the RTM. function-based conditional privacy-preserving authentication and group-
key agreement scheme for VANETs,’’ Veh. Commun., vol. 14, pp. 15–25,
Oct. 2018, doi: 10.1016/j.vehcom.2018.09.003.
V. CONCLUSION [14] S. H. Islam, M. S. Obaidat, P. Vijayakumar, E. Abdulhay, F. Li,
In this paper, we presented an improved VANET security and M. K. C. Reddy, ‘‘A robust and efficient password-based condi-
tional privacy preserving authentication and group-key agreement proto-
scheme using short group signatures which increases signing col for VANETs,’’ Future Gener. Comput. Syst., vol. 84, pp. 216–227,
and signature validation efficiency by reducing pairing oper- Jul. 2018, doi: 10.1016/j.future.2017.07.002.
ations through the use of cached calculation results. In addi- [15] L. Liu, Y. Wang, J. Zhang, and Q. Yang, ‘‘A secure and efficient group key
agreement scheme for VANET,’’ Sensors, vol. 19, no. 3, p. 482, Jan. 2019,
tion, the scheme also improves overall system efficiency by doi: 10.3390/s19030482.
using timed group key updates instead of changing the keys [16] S. Paliwal and A. Chandrakar, ‘‘A conditional privacy preserving authen-
in response to members departing the group. This extends tication and multi party group key establishment scheme for real-time
application in VANETs,’’ Cryptol. ePrint Arch., pp. 1–27, Sep. 2019.
the life of the group keys, which reduces the computation [Online]. Available: http://ia.cr/2019/1041
and communication burdens present in other schemes due to [17] M. Alimohammadi and A. A. Pouyan, ‘‘Sybil attack detection using a low
the wasteful key updates that would result under real-world cost short group signature in VANET,’’ in Proc. ISCISC, Rasht, Iran, 2015,
pp. 23–28.
traffic conditions. [18] C. Zhang, X. Xue, L. Feng, X. Zeng, and J. Ma, ‘‘Group-signature and
In the future, we plan to explore methods to completely group session key combined safety message authentication protocol for
eliminate pairings and other costly operations from both VANETs,’’ IEEE Access, vol. 7, pp. 178310–178320, Dec. 2019, doi:
10.1109/ACCESS.2019.2958356.
message signing and signature validation operations with- [19] M. Azees, P. Vijayakumar, and L. J. Deboarh, ‘‘EAAP: Efficient anony-
out sacrificing the benefits of short group signatures which mous authentication with conditional privacy-preserving scheme for vehic-
include conditional privacy, non-repudiation, and broadcast ular ad hoc networks,’’ IEEE Trans. Intell. Transp. Syst., vol. 18, no. 9,
pp. 2467–2476, Sep. 2017, doi: 10.1109/TITS.2016.2634623.
messaging ability. Furthermore, traffic and network simu- [20] D. Boneh, X. Boyen, and H. Shacham, ‘‘Short group signatures,’’ in Proc.
lations could be created using real-world traffic count data CRYPTO, Santa Barbara, CA, USA, 2004, pp. 41–55, doi: 10.1007/978-3-
to better model the actual performance issues involved with 540-28628-8_3.
[21] K. Lim, W. Liu, X. Wang, and J. Joung, ‘‘SSKM: Scalable and secure
VANET and group keys. key management scheme for group signature based authentication and
CRL in VANET,’’ Electronics, vol. 8, no. 11, p. 1330, Nov. 2019, doi:
10.3390/electronics8111330.
REFERENCES
[22] Y. Hao, Y. Cheng, C. Zhou, and W. Song, ‘‘A distributed key management
[1] R. Vishwakarma, R. Barskar, and M. Ahirwar, ‘‘Secure key management framework with cooperative message authentication in VANETs,’’ IEEE
in vehicular ad-hoc network: A review,’’ in Proc. SCOPES, Odisha, India, J. Sel. Areas Commun., vol. 29, no. 3, pp. 616–629, Mar. 2011, doi:
2016, pp. 1688–1694. 10.1109/JSAC.2011.110311.
[2] R. Lu, X. Lin, X. Liang, and X. Shen, ‘‘A dynamic privacy-preserving [23] H. Zhong, B. Huang, J. Cui, Y. Xu, and L. Liu, ‘‘Conditional
key management scheme for location-based services in VANETs,’’ IEEE privacy-preserving authentication using registration list in vehicular ad
Trans. Intell. Transp. Syst., vol. 13, no. 1, pp. 127–138, Mar. 2012, doi: hoc networks,’’ IEEE Access, vol. 6, pp. 2241–2250, Dec. 2018, doi:
10.1109/TITS.2011.2164068. 10.1109/ACCESS.2017.2782672.

VOLUME 9, 2021 118075

 L. E. Funderburg, I.-Y. Lee: Efficient Short Group Signatures for Conditional Privacy in VANETs

[24] J. Zhang, J. Cui, H. Zhong, Z. Chen, and L. Liu, ‘‘PA-CRT: Chi- [38] H. Okano, K. Emura, T. Ishibashi, T. Ohigashi, and T. Suzuki, ‘‘Implemen-
nese remainder theorem based conditional privacy-preserving authen- tation of a strongly robust identity-based encryption scheme over type-3
tication scheme in vehicular ad-hoc networks,’’ IEEE Trans. Depend- pairings,’’ in Proc. CANDAR, Nagasaki, Japan, 2019, pp. 191–196, doi:
able Secure Comput., vol. 18, no. 2, pp. 722–735, Mar. 2021, doi: 10.1109/CANDAR.2019.00032.
10.1109/TDSC.2019.2904274. [39] D. Boneh and X. Boyen, ‘‘Short signatures without random oracles and
[25] J. Cui, J. Chen, H. Zhong, J. Zhang, and L. Liu, ‘‘Reliable and the SDH assumption in bilinear groups,’’ J. Cryptol., vol. 21, no. 2,
efficient content sharing for 5G-enabled vehicular networks,’’ pp. 149–177, Apr. 2008, doi: 10.1007/s00145-007-9005-7.
IEEE Trans. Intell. Transp. Syst., early access, Sep. 24, 2020, doi: [40] A. L. Ferrara, M. Green, S. Hohenberger, and M. Pedersen, ‘‘Practical short
10.1109/TITS.2020.3023797. signature batch verification,’’ in Proc. CT-RSA, San Francisco, CA, USA,
[26] J. Zhang, H. Zhong, J. Cui, M. Tian, Y. Xu, and L. Liu, ‘‘Edge computing- 2009, pp. 309–324, doi: 10.1007/978-3-642-00862-7_21.
based privacy-preserving authentication framework and protocol for 5G- [41] Texas Statewide Traffic Analysis and Reporting System (STARS II).
enabled vehicular networks,’’ IEEE Trans. Veh. Technol., vol. 69, no. 7, Accessed: Apr. 28, 2021. [Online]. Available: https://www.txdot.
pp. 7940–7954, Jul. 2020, doi: 10.1109/TVT.2020.2994144. gov/inside-txdot/division/transportation-planning/stars.html
[27] F. Zhou, Y. Li, and Y. Ding, ‘‘Practical V2I secure communication schemes [42] Washington State Traffic Data GeoPortal. Accessed: Apr. 28,
for heterogeneous VANETs,’’ Appl. Sci., vol. 9, no. 15, p. 3131, Aug. 2019, 2021. [Online]. Available: https://www.wsdot.wa.gov/mapsdata/
doi: 10.3390/app9153131. tools/trafficplanningtrends.htm
[28] I. Ali, T. Lawrence, A. A. Omala, and F. Li, ‘‘An efficient hybrid sign- [43] New York State Traffic Data Viewer. Accessed: Apr. 19, 2021. [Online].
cryption scheme with conditional privacy-preservation for heterogeneous Available: https://www.dot.ny.gov/tdv
vehicular communication in VANETs,’’ IEEE Trans. Veh. Technol., vol. 69, [44] J. Du, H. A. Rakha, F. Filali, and H. Eldardiry, ‘‘COVID-19 pandemic
no. 10, pp. 11266–11280, Oct. 2020, doi: 10.1109/TVT.2020.3008781. impacts on traffic system delay, fuel consumption and emissions,’’ Int.
[29] W. Xiong and B. Tang, ‘‘A cloud based three layer key management scheme J. Transp. Sci. Technol., vol. 10, no. 2, pp. 184–196, Jun. 2021, doi:
for VANET,’’ in Proc GSKI, Chiang Mai, Thailand, 2017, pp. 574–587, 10.1016/j.ijtst.2020.11.003.
doi: 10.1007/978-981-13-0896-3_57.
[30] Q. Li, C.-F. Hsu, K.-K. Raymond Choo, and D. He, ‘‘A provably secure
and lightweight identity-based two-party authenticated key agreement pro- L. ELLEN FUNDERBURG received the B.S.
tocol for vehicular ad hoc networks,’’ Secur. Commun. Netw., vol. 2019, degree in computer and systems engineering from
pp. 1–13, Dec. 2019, doi: 10.1155/2019/7871067. Rensselaer Polytechnic Institute, Troy, NY, USA,
[31] T. Zhou, R. R. Choudhury, P. Ning, and K. Chakrabarty, ‘‘Privacy- in 1999, and the M.S. degree in electrical and com-
preserving detection of Sybil attacks in vehicular ad hoc networks,’’ puter engineering from The University of Texas at
in Proc. MobiQuitous, Philadelphia, PA, USA, 2007, doi: Austin, Austin, TX, USA, in 2001. She is currently
10.1109/MOBIQ.2007.4451013. pursuing the Ph.D. degree with the Department
[32] J. B. Kenney, ‘‘Dedicated short-range communications (DSRC) Standards of Software Convergence, Soonchunhyang Uni-
in the United States,’’ Proc. IEEE, vol. 99, no. 7, pp. 1162–1182, Jul. 2011, versity, Asan, South Korea.
doi: 10.1109/JPROC.2011.2132790.
She worked as a senior software engineer, from
[33] D. He, S. Zeadally, B. Xu, and X. Huang, ‘‘An efficient identity-based
conditional privacy-preserving authentication scheme for vehicular ad
2001 to 2010. She has been a Lecturer with the Department of Software
hoc networks,’’ IEEE Trans. Inf. Forensics Security, vol. 10, no. 12, Convergence, Soonchunhyang University, since 2013. Her research interests
pp. 2681–2691, Dec. 2015, doi: 10.1109/TIFS.2015.2473820. include applications of the Internet of Things, group signature schemes,
[34] J. Petit, S. Dietzel, and F. Kargl, ‘‘Privacy of connected vehicles,’’ in security of wireless communications, and VANET security.
Handbook Mobile Data Privacy, 1st ed. A. Gkoulalas-Divanis C. Bettini,
eds. Berlin, Germany: Springer, 2018, pp. 229–251.
[35] Intelligent Transport Systems (ITS) Vehicular Communications Basic Set
IM-YEONG LEE was born in Busan, Republic of
of Applications Part 2: Specification of Cooperative Awareness Basic Korea, in 1958. He received the B.S. degree from
Service, document ETSI Technical Specification 102 637-2, V1.2.1, Hongik University, Seoul, South Korea, in 1981,
2011. and the M.S. and Ph.D. degrees from Osaka Uni-
[36] B. Cronin, ‘‘Vehicle based data and availability,’’ in Proc. ITSPAC. versity, Osaka, Japan, in 1986 and 1989, respec-
Washington, DC, USA: United States Department of Transportation, tively. His research interests include information
Oct. 2012, pp. 1–13. Accessed: May 8, 2021. [Online]. Available: security, cryptographic protocols, information the-
https://www.its.dot.gov/itspac/october2012/PDF/data_availability.pdf ory, and data communications.
[37] MIRACL Core Cryptographic Library. Accessed: Jul. 6, 2021. [Online].
Available: https://github.com/miracl/core

118076 VOLUME 9, 2021