Wang 2020b - Revision history

Rimni at 12:37, 27 August 2020

2020-08-27T12:37:26Z

Rimni at 12:36, 27 August 2020

2020-08-27T12:36:37Z

Rimni at 12:36, 27 August 2020

2020-08-27T12:36:13Z

Rimni at 12:34, 27 August 2020

2020-08-27T12:34:55Z

Rimni at 12:34, 27 August 2020

2020-08-27T12:34:26Z

Rimni at 12:33, 27 August 2020

2020-08-27T12:33:32Z

Rimni at 12:31, 27 August 2020

2020-08-27T12:31:08Z

Rimni at 12:28, 27 August 2020

2020-08-27T12:28:34Z

Rimni at 12:26, 27 August 2020

2020-08-27T12:26:41Z

Rimni at 12:25, 27 August 2020

2020-08-27T12:25:15Z

@@ Line 69: / Line 69: @@
 {| style="text-align: center; border: 1px solid #BBB; margin: 1em auto; width: auto;max-width: auto;"
 |-
-|style="padding:10px;"| [[Image:Review_388410900859-image41.png|288px]]
+|style="padding:10px;"| [[Image:Review_388410900859-image41.png|400px]]
 |- style="text-align: center; font-size: 75%;"
 | colspan="1" style="padding-bottom:10px;"| '''Figure 2'''. Schematic diagram of aggregate signature

@@ Line 386: / Line 386: @@
 |}
-==5.Conclusion==
+==5. Conclusion==
 The algorithm of aggregate signature aggregates the signatures of many different users into one signature, and only needs to verify the aggregated signature to determine whether the received signature is legal, which greatly improves the efficiency of message verification. This advantage makes it self-organized in the vehicle. It has good application value in the network. The secure and effective certificateless aggregate signature scheme proposed in this paper has the double advantages of certificateless cryptosystem and aggregate signature. The scheme in this paper effectively combines the privacy protection of vehicle users and the traceability of illegal users, so-called conditional privacy protection. According to the results of simulation, compared with other existing solutions, the solution in this paper has the advantages of low communication cost, low calculation cost and short verification delay, so it is more suitable for resource-constrained network environments such as VANETs.

@@ Line 366: / Line 366: @@
 |  style="text-align: center;"|3E
 |  style="text-align: center;"|4E
-|  style="text-align: center;"|3n+1)E
+|  style="text-align: center;"|(3n+1)E
 |-
 |  style="text-align: center;"|Our scheme

@@ Line 236: / Line 236: @@
 {| class="formulaSCP" style="width: 100%; text-align: center;"
 |-
-| <math>\begin{array}{ll} L.H.S \!\!\!& =e(p_{i} \cdot {\rm M}2_{i} +h_{i} \cdot r_{i} \cdot P_{k} +h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P) \\
+| <math>\begin{array}{ll} L.H.S & \!\!\! =e(p_{i} \cdot {\rm M}2_{i} +h_{i} \cdot r_{i} \cdot P_{k} +h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P) \\
 &=e(p_{i} \cdot {\rm M}2_{i} ,P)\; e(h_{i} \cdot r_{i} \cdot P_{k} ,P)\; e(h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P) \\
 & =e(s\cdot ID'_{i} \cdot a_{i} \cdot W_{i} ,P)\; e(h_{i} \cdot r_{i} \cdot s\cdot P,P)\; e(h_{i} \cdot x_{i} \cdot y_{i} \cdot P,P)\\

@@ Line 236: / Line 236: @@
 {| class="formulaSCP" style="width: 100%; text-align: center;"
 |-
-| <math>\begin{array}{ll} L.H.S & =e(p_{i} \cdot {\rm M}2_{i} +h_{i} \cdot r_{i} \cdot P_{k} +h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P) \\
+| <math>\begin{array}{ll} L.H.S \!\!\!& =e(p_{i} \cdot {\rm M}2_{i} +h_{i} \cdot r_{i} \cdot P_{k} +h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P) \\
 &=e(p_{i} \cdot {\rm M}2_{i} ,P)\; e(h_{i} \cdot r_{i} \cdot P_{k} ,P)\; e(h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P) \\
 & =e(s\cdot ID'_{i} \cdot a_{i} \cdot W_{i} ,P)\; e(h_{i} \cdot r_{i} \cdot s\cdot P,P)\; e(h_{i} \cdot x_{i} \cdot y_{i} \cdot P,P)\\

@@ Line 236: / Line 236: @@
 {| class="formulaSCP" style="width: 100%; text-align: center;"
 |-
-| <math>\begin{array}{ll} L.H.S & =e(p_{i} \cdot {\rm M}2_{i} +h_{i} \cdot r_{i} \cdot P_{k} +h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P)} \\ {\; \; \; \; \; \; \; &=e(p_{i} \cdot {\rm M}2_{i} ,P)\; e(h_{i} \cdot r_{i} \cdot P_{k} ,P)\; e(h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P)} \\ {\; \; \; \; \; \; \;
+| <math>\begin{array}{ll} L.H.S & =e(p_{i} \cdot {\rm M}2_{i} +h_{i} \cdot r_{i} \cdot P_{k} +h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P) \\
-& =e(s\cdot ID'_{i} \cdot a_{i} \cdot W_{i} ,P)\; e(h_{i} \cdot r_{i} \cdot s\cdot P,P)\; e(h_{i} \cdot x_{i} \cdot y_{i} \cdot P,P)} \\ {\; \; \; \; \; \; \;
+&=e(p_{i} \cdot {\rm M}2_{i} ,P)\; e(h_{i} \cdot r_{i} \cdot P_{k} ,P)\; e(h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P) \\
-& =e(a_{i} \cdot ID'_{i} \cdot W_{i} ,s\cdot P)\; e(h_{i} \cdot r_{i} \cdot P,s\cdot P)\; e(h_{i} \cdot x_{i} \cdot P,y_{i} \cdot P)} \\ {\; \; \; \; \; \; \;
+& =e(s\cdot ID'_{i} \cdot a_{i} \cdot W_{i} ,P)\; e(h_{i} \cdot r_{i} \cdot s\cdot P,P)\; e(h_{i} \cdot x_{i} \cdot y_{i} \cdot P,P)\\
-& =e({\rm M}1_{i} \cdot W_{i} ,P_{K} )\; e(h_{i} \cdot U_{i} ,P_{K} )\; e(h_{i} \cdot P_{i} ,\bar{P}_{i} )} \\ {\; \; \; \; \; \; \;
+& =e(a_{i} \cdot ID'_{i} \cdot W_{i} ,s\cdot P)\; e(h_{i} \cdot r_{i} \cdot P,s\cdot P)\; e(h_{i} \cdot x_{i} \cdot P,y_{i} \cdot P) \\
 & =e({\rm M}1_{i} \cdot W_{i} +h_{i} \cdot U_{i} ,P_{K} )\; e(h_{i} \cdot P_{i} ,\bar{P}_{i} )=R.H.S \end{array}</math>
 |}

@@ Line 59: / Line 59: @@
 * AggV: The algorithm of aggregate signature verification. Assuming that each user owns a private key  <math display="inline">SK</math> and a public key  <math display="inline">PK</math>,
 : if
 : <math display="inline">AggV(PK_1,\cdots ,PK_n,m_1,\cdots ,m_n,AggS(PK_1,\cdots ,PK_n,m_1,\cdots ,m_n,Sign(SK_1,m_1),\cdots ,Sign(SK_n,m_n)))=</math><math>1</math>,
 : It outputs "True", otherwise it outputs "False".
 Aggregate signatures can also support incremental aggregation, that is, signatures <math display="inline">{\sigma }_1</math>, <math display="inline">{\sigma }_2</math> can be aggregated into  <math display="inline">{\sigma }_{12}</math>, and then can be aggregated with  <math display="inline">{\sigma }_3</math> to  <math display="inline">{\sigma }_{123}</math>. The schematic diagram of the principle of aggregate signature is shown in [[#img-2|Figure 2]] .

@@ Line 43: / Line 43: @@
 ===2.1 Bilinear pair===
-Let <math display="inline">l</math> be a secure parameter,  <math display="inline">q</math> be a  <math display="inline">l</math> -bit prime number, <math display="inline">G_1</math> is a cyclic addition group of order <math display="inline">q</math> generated by <math display="inline">P</math>,  <math display="inline">G_2</math> is a cyclic addition group of order  <math display="inline">q</math> generated by  <math display="inline">Q</math> , and  <math display="inline">G_T</math> has the same order  <math display="inline">q</math> cyclic multiplication group. Let the discrete logarithm problem in groups  <math display="inline">G_1</math> , <math display="inline">G_2</math>,  <math display="inline">G_T</math> be a difficult problem. The mapping  <math display="inline">e:G_1\times G_2\rightarrow G_T</math>  is called a bilinear pair, if  <math display="inline">e</math> satisfies the following properties:
+Let <math display="inline">l</math> be a secure parameter,  <math display="inline">q</math> be a  <math display="inline">l</math> -bit prime number, <math display="inline">G_1</math> is a cyclic addition group of order <math display="inline">q</math> generated by <math display="inline">P</math>,  <math display="inline">G_2</math> is a cyclic addition group of order  <math display="inline">q</math> generated by  <math display="inline">Q</math>, and  <math display="inline">G_T</math> has the same order  <math display="inline">q</math> cyclic multiplication group. Let the discrete logarithm problem in groups  <math display="inline">G_1</math>, <math display="inline">G_2</math>,  <math display="inline">G_T</math> be a difficult problem. The mapping  <math display="inline">e:G_1\times G_2\rightarrow G_T</math>  is called a bilinear pair, if  <math display="inline">e</math> satisfies the following properties:
-# Bilinearity: For arbitrary <math display="inline">a,b\in Z_q^\ast </math> , satisfy <math display="inline">e(aP,bQ)=e{\left(P,Q\right)}^{ab}</math>;
+# Bilinearity: For arbitrary <math display="inline">a,b\in Z_q^\ast </math>, satisfy <math display="inline">e(aP,bQ)=e{\left(P,Q\right)}^{ab}</math>;
 #  Non-degenerate: <math display="inline">e(P,Q)\not =1</math>;
 # Easy to calculate properties: There is an effective algorithm to calculate  <math display="inline">e(P,Q)</math>.

@@ Line 35: / Line 35: @@
 Due to its own characteristics, such as resource limitation, high-speed movement of nodes, and communication delay should be short enough, the VANETs make their security issues very fragile, including eavesdropping, tampering, tracking user privacy, etc. [2]. If the messages in the vehicular network cannot be authenticated in a timely manner, the packet loss rate will increase, resulting in poor communication efficiency. Therefore, reducing the delay of message verification is a key requirement of the vehicle network for the efficiency of the authentication protocol. On the other hand, vehicle users are not willing to let their privacy and other sensitive information be illegally tracked and maliciously analyzed. When a traffic accident occurs or the owner commits a crime, the law enforcement authorities should be able to retrieve or track the owner’s information to reveal their identity, which is called conditional privacy protection [3].
-Digital signatures can provide non-repudiation，authentication and integrity of messages. In the communication of the vehicle network with high traffic density, each RSU or traffic control center needs to verify a large amount of vehicle information, which will cause a large amount of calculation overhead. But in many cases, these calculations must be done in a resource-constrained environment with low bandwidth and low storage space. Aggregate signature  is a hot spot that has been paid attention in recent years [4]. Using aggregation signature in VANET can greatly reduce the burden of RSU (Roadside unit). The signature based on the traditional PKI (Public Key Infrastructure) is based on the certificate system. CA (Certificate Authority) needs to bind the user and his public key, and the cost of managing and protecting certificates is very large, which is not suitable for the vehicle network. Identity-based aggregate signatures can avoid complicated certificate problems and can be applied to wireless networks and other fields [5-10]. But, that exits a key escrow problem in the identity-based aggregation signature scheme. The key generation center holds each user's private key, and there is a security problem of maliciously forging the signature. In recent years, some effective certificateless aggregation signature schemes have been proposed [11-20], which are provably secure in random predictions, but its high computational cost makes it unsuitable for dynamic wireless networks, such as VANETs. Horng et al. [3] proposed a privacy preserving aggregation signature model, which is based on certificateless cryptography. However, it has been proved that their scheme is not safe for malicious KGC. However, the authors themselves have always claimed that their scheme is provably secure and can resist adaptively choosing message attack. But, in fact, their scheme is insecure against a malicious-but-passive KGC under existing security model. In 2016, Nie et al. Proposed a distributed certificateless aggregation signature scheme [4], but it has not been well applied in VANETs and cannot resist signature forgery attacks. The scheme in [9] does not use the hash function mapped to the point, and does not use the bilinear pair, but there is an inherent key escrow problem. Lai et al. [18] proposed group handover authentication, which better realized the overhead of instruction delivery and reduced the delay, but with the increase of vehicle density and mobile speed, the communication cost may also increase. Liu et al. And Zhang et al. For the first time, the secure communication in heterogeneous vehicle network is realized, however their schemes require OBUs (On Board Units) with high computation power [19,20]. In 2020，Ikram Ali's scheme can also effectively protect conditional privacy, However, as in [9], there is a key escrow problem. So far, the authentication scheme suitable for vehicular network has not been solved satisfactorily.
+Digital signatures can provide non-repudiation，authentication and integrity of messages. In the communication of the vehicle network with high traffic density, each RSU or traffic control center needs to verify a large amount of vehicle information, which will cause a large amount of calculation overhead. But in many cases, these calculations must be done in a resource-constrained environment with low bandwidth and low storage space. Aggregate signature  is a hot spot that has been paid attention in recent years [4]. Using aggregation signature in VANET can greatly reduce the burden of RSU (Roadside unit). The signature based on the traditional PKI (Public Key Infrastructure) is based on the certificate system. CA (Certificate Authority) needs to bind the user and his public key, and the cost of managing and protecting certificates is very large, which is not suitable for the vehicle network. Identity-based aggregate signatures can avoid complicated certificate problems and can be applied to wireless networks and other fields [5-10]. But, that exits a key escrow problem in the identity-based aggregation signature scheme. The key generation center holds each user's private key, and there is a security problem of maliciously forging the signature. In recent years, some effective certificateless aggregation signature schemes have been proposed [11-20], which are provably secure in random predictions, but its high computational cost makes it unsuitable for dynamic wireless networks, such as VANETs. Horng et al. [3] proposed a privacy preserving aggregation signature model, which is based on certificateless cryptography. However, it has been proved that their scheme is not safe for malicious KGC. However, the authors themselves have always claimed that their scheme is provably secure and can resist adaptively choosing message attack. But, in fact, their scheme is insecure against a malicious-but-passive KGC under existing security model. In 2016, Nie et al. proposed a distributed certificateless aggregation signature scheme [4], but it has not been well applied in VANETs and cannot resist signature forgery attacks. The scheme in [9] does not use the hash function mapped to the point, and does not use the bilinear pair, but there is an inherent key escrow problem. Lai et al. [18] proposed group handover authentication, which better realized the overhead of instruction delivery and reduced the delay, but with the increase of vehicle density and mobile speed, the communication cost may also increase. Liu et al. And Zhang et al. For the first time, the secure communication in heterogeneous vehicle network is realized, however their schemes require OBUs (On Board Units) with high computation power [19,20]. In 2020，Ikram Ali's scheme can also effectively protect conditional privacy, However, as in [9], there is a key escrow problem. So far, the authentication scheme suitable for vehicular network has not been solved satisfactorily.
 In this paper, an effective certificateless aggregation signature scheme suitable for vehicle network is proposed. In our scheme, the vehicle generates a pseudonym through RSU and communicates with surrounding nodes through the pseudonym. When necessary, law enforcement authorities can track the true identity of vehicle users through pseudonyms, realizing conditional privacy protection. Not only that, the experimental results show that the delay of message verification in our scheme is relatively low, but the computational cost is not high.