A group authentication and privacy-preserving level for vehicular networks based on fuzzy system

Abstract

Vehicular ad hoc networks play an important role in current intelligent transportation networks, which have attracted much attention from academia and industry. Vehicular networks can be implemented by Long-Term Evolution Advanced (LTE-A) networks, which have been formally defined in a series of standards by third-generation partnership projects (3GPP). Abundant challenges exist in the authentication processes in LTE-A-based vehicular networks. This paper aimed to improve the security functionality of these vehicular networks by proposing a secure and efficient group authentication and privacy-preserving scheme for vehicular networks based on fuzzy system: the group authentication and privacy-preserving level (GAPL). Compared with existing schemes, the proposed scheme can greatly reduce the number of control message transmissions from mass vehicular equipment (VEs) to the network and substantially avoid overhead in LTE-A-based vehicular networks. Privacy-preserving levels are established to protect VE privacy in authentication. Furthermore, the scheme contains security functions, including privacy preservation, non-frameability and non-repudiation verification.

Keywords

Group authentication key agreement LTE-A vehicular network fuzzy system

1 Introduction

Vehicular ad hoc networks (VANETs) have recently been emerging as mobile ad hoc networks [1]. This type of network can effectively contribute to improving road safety and driving environments. However, due to the large scale of vehicular networks and the nature of open wireless channels, the mobile trajectory is easily tracked, making vehicular networks vulnerable to various threats. For example, an attacker may broadcast messages in a wireless channel, analyze data, predict trajectories, and track vehicles. If the vehicular network exposes the private information of vehicles, it will not be widely accepted by the public [2]. Therefore, providing the necessary security functions to vehicular networks and preserving privacy are necessary for vehicular users.

To accommodate increasing mobile data transmission demands and new multimedia applications, Long-Term Evolution (LTE) and LTE-Advanced (LTE-A) technologies have been specified by the third-generation partnership projects (3GPP) as emerging mobile communication technologies for next-generation broadband mobile wireless networks. It is widely suggested that LTE/LTE-A technologies can be applied to vehicular networks to significantly improve the quality of service for applications relative to that provided by current vehicular networks. In a vehicular network, various modes of communication can exist, including vehicle-to-vehicle (V2 V) [3], vehicle-to-pedestrian (V2P) and vehicle-to-infrastructure (V2I) communications [4]. In particular, V2 V communications constitute a type of machine-type communication (MTC) as specified in the LTE-A standard [5]. 3GPP has formally defined MTC in the standard of Release 10. An on-board unit equipped with a vehicle as vehicular equipment (VE) works as an MTC device (MTCD) with some special features, such as limited computation capacity and low power consumption. Many security threats exist in LTE/LTE-A-based vehicular networks. For example, VE must be authenticated through an authentication process using the evolved packet system authentication and key agreement (EPS-AKA) protocol specified by the 3GPP standard [6]. When a large amount of VEs need to be authenticated simultaneously, the amount of signaling required will cause serious overload, leading to the congestion in LTE/LTE-A vehicular networks. Therefore, LTE/LTE-A networks need a new authentication protocol to avoid congestion resulting from massive VE access.

Various solutions for group authentication and key management solutions for other wireless networks are available. For example, a management group with a binary tree structure and a group key scheme was proposed in [7]. However, group authentication protocols have shown no improvement in terms of their safety and signaling overhead. A polymerization proxy signature based on elliptic curves was proposed in [8]. Since this method can significantly reduce the bandwidth required by the signature and its verification and computational overheads, it has been increasingly used for mobile devices with limited resources to achieve lower energy consumption. The efficient authentication protocol (EAP) for secure group (EAPSG) is a simple and reliable group authentication framework based on Elliptic Curve Diffie-Hellman (ECDH) that was proposed in [9]. EAPSG can reduce the communication overhead and computational complexity in group authentication procedures. Compared with the conventional EAP-AKA protocol, ESPSG can enhance the security and provide better performance. The group-based lightweight authentication scheme for resource-constrained machine-to-machine communications scheme in uses group authentication to reduce severe authentication signaling congestion [10]. This scheme is a novel lightweight group authentication scheme for resource-constrained devices in the 3GPP network architecture and can achieve efficient and secure group authentication in both 3GPP and non-3GPP access scenarios.

Some research has also addressed the authentication and key agreement (AKA) protocol in LTE/LTE-A networks. The secure and efficient group AKA (SE-AKA) scheme in employs the asymmetric key cryptosystem and ECDH to provide robust security protection [11], including privacy preservation. The authentication process used by the SE-AKA scheme adopts group temporary key (GTK) generation to simplify the whole authentication process. By adopting the concept of the SE-AKA scheme, the EAP-based group AKA (EG-AKA) scheme in facilitates access by an MTCD group to the LTE core network through a non-3GPP access network. In the above-mentioned schemes [12], no group key generation method or dynamic group member management mechanism is used. A novel lightweight group authentication protocol (LGTH) was proposed in for the authentication of MTCs in LTE networks based on aggregate message authentication codes (MACs) [13]. Using LGTH, a group leader collects the MACs from all members and validates them. Compared with the public key methods, the LGTH scheme can significantly reduce the computational cost of VEs; however, it must go through a verification process, which increases signaling overhead.

Massive VEs face challenges in requesting authentication on LTE/LTE-A-based vehicular networks; thus, a novel secure and efficient group authentication scheme is designed and proposed for group-based MTCs. This scheme is named group AKA for vehicular networks (GAPL), and its outstanding features result from taking advantage of the secret sharing in and the aggregate proxy signature in (Ahmed, E., & Gharavi, H, 2018) [14, 15]. The contributions of this work can be summarized as follows:

A new secure and efficient group authentication scheme is proposed for LTE/LTE-A-based vehicular networks.

Compared with existing schemes, the proposed scheme can greatly reduce the number of signal exchanges between massive VEs and the network and signaling overload over LTE/LTE-A-based vehicular networks.

Robust security functions, including privacy preservation, non-frameability and non-repudiation verification, can be achieved.

The remainder of this paper is organized as follows. In Section 2, the network architecture and security goals are introduced. In Section 3, the proposed GAPL scheme is presented in detail. In Section 4, the security functionality of the proposed scheme is evaluated. In Section 5, an efficiency analysis of the proposed scheme is performed. Finally, Section 6 concludes the work.

2 Preliminary information

2.1 Network architecture

In LTE/LTE-A-based vehicular networks, as shown in Fig. 1, an MTC user is a control center outside the network operator domain. The user can implement the services provided by one or more MTC servers to operate a large number of VEs Based on 3GPP standards, the MTC network architecture is divided into the following three parts: (1) the Evolved Universal Terrestrial Radio Access Network (E-UTRAN) (InterDigital Technology Corporation, 2018), which consists of MTC equipment and Evolved Node B (eNB); (2) the Evolved Packet Core (EPC), which consists of the Serving Gateway (S-GW), Packet Data Network Gateway (P-GW), Mobility Management Entity (MME) and Home Subscriber Server (HSS) used to perform the function of access authentication; and (3) non-3GPP access networks. The VE works as MTC equipment through the application program interface to connect to an MTC server [16 –18].

Fig. 1

Network architecture.

The MTC server can connect to the LTE-A network in the following two ways: (1) a mobile service provider deploys MTC servers to the LTE-A network to control the MTC server, and (2) the MTC user presents the MTC server in the LTE-A network [19].

When a large number of VEs access or leave the network simultaneously, signaling congestion occurs [20]. The 3GPP access technologies support some types of MTC applications, such as measurement and monitoring. When the power source is interrupted or after a synchronization time interval, the relevant VEs may be activated at the same time. This results in a large number of access requests being sent to the MME and HSS at the same time, leading to signaling congestion, which can occur in the following two places:

(1) within the wireless access network, such as when a large number of VEs access the eNB and multiple devices use the same wireless channel, and (2) in EPC nodes, including MME, S-GW and P-GW.

2.2 Aggregate proxy signature and elliptic curves

An aggregate proxy signature based on an elliptic curve allows a source signer to grant his signature authority to n proxy signer by n proxy signatures on n different messages. The n independent signatures aggregate into a single signature. The receiver of the user signature can check the validity of the signature by bilinear pairings. The computation and validation of the polymerization are legal.

Each group has a member manager (MM) and a tracing manager (TM). The MM is responsible for vehicle registration. The advantage of this scheme is that the signature verification workload is reduced and the verification efficiency improved.

Various important calculation problems commonly use the elliptic curve group in designing secure encryption schemes.

Problem 1: Computational Discrete Logarithm (CDL).

Given R = xP, where P, R = G_p, it is easy to calculate R given x and P, but it is difficult to determine x given P and R.

Problem 2: Computational Diffie-Hellman (CDH).

Given P, xP, yP ∈ G_p, it is difficult to compute xyP ∈ G_p.

Problem 3: Elliptic Curve Factorization (ECF).

Given two points P and R = x • P + y • P, for x, y∈ Z_{q
^*} *, it is difficult to find x • P and y • P.

2.3 Privacy-preserving levels

To subtly explain the privacy preserving function, five levels of user privacy are defined, as shown in Table 1.

Table 1
Definitions of privacy-preserving levels

Level 1 Level 2 Level 3 Level 4 Level 5

Anonymity Yes No No No No

Unlinkability Yes Yes No No No

Traceability Yes Yes Yes No No

Non-frameability Yes Yes Yes Yes No

Non-repudiation Yes Yes Yes Yes Yes

	Level 1	Level 2	Level 3	Level 4	Level 5
Anonymity	Yes	No	No	No	No
Unlinkability	Yes	Yes	No	No	No
Traceability	Yes	Yes	Yes	No	No
Non-frameability	Yes	Yes	Yes	Yes	No
Non-repudiation	Yes	Yes	Yes	Yes	Yes

Anonymity ((Fu, A et al., 2017),: the identities of VEs should be hidden from normal message receivers in the authentication process [21, 23].

Unlinkability: through the analysis of traffic information, an external observer cannot obtain any positive information from the encrypted information transmission process. Additionally, contact between the vehicle and the intruder cannot be established. An adversary cannot use individual vehicle tracking to hinder or cause vehicle location privacy problems [22].

Traceability: a trusted entity can trace a VE by revealing its identity in the case of any disputed situation, such as a liability investigation [24].

Non-frameability: when tracing misbehaving users, the privilege of tracing the VE cannot be abused by the single trusted entity, and more trusted entities should cooperate to reveal the identity that that an innocent user will not be framed [25].

Non-repudiation: the trusted entity or entities (e.g., the HSS, group manager or Log Export API [LEA]) have the right to verify the original information and the information non-repudiation of the vehicle. When the information is in a state of controversy, a credible agency can independently recover the true identify of a vehicle [26 –28].

2.4 Security goals

The security goals of the proposed scheme should be achieved to guarantee the security requirements, which include the following:

Group authentication and secure key agreement: all VEs must be authenticated successfully by the core network. After successful authentication, secure channels should be established between all VEs and the MME [31].

Privacy preservation: five levels of user privacy are required to achieve anonymity, unlinkability, traceability, non-frameability and non-repudiation [29].

Attack resistance: the GAPL scheme should be able to resist various attacks in LTE/LTE-A-based vehicular networks, including replay attacks, redirection attacks, and man-in-the-middle attacks [30].

3 Proposed GAPL scheme

In this section, the proposed scheme is described in detail. The GAPL scheme works based on the aggregation of the proxy signature with secret sharing, which consists of the initialization phase, the group authentication phase and a real ID trace phase for the VE. In the initialization phase, the HSS distributes the proxy signature to the MME and the VE. In the group AKA phase, the MME and the VE mutually authenticate through the proxy signature and then generate a shared secret. Furthermore, any LEAs can cooperate with each other to trace the real ID of the VE. The notations used in the scheme are defined in Table 2.

Table 2
Definitions of the notations used in the scheme

Notation Definition

ID_x Identity of x

GTK_Gi Group temporary key of the group

MAC_x Message authentication code computed by x

GID Group identity of VE

p A k-bit prime

Zp Prime finite field

G1, G2 Two elliptic curve groups

P Generator for group G₁

H1,H2, H3 Hash function

Notation	Definition
ID_x	Identity of x
GTK_Gi	Group temporary key of the group
MAC_x	Message authentication code computed by x
GID	Group identity of VE
p	A k-bit prime
Zp	Prime finite field
G1, G2	Two elliptic curve groups
P	Generator for group G₁
H1,H2, H3	Hash function

3.1 System initialization phase

In the system initialization phase, the HSS first initializes the whole system via the following steps.

The HSS properly chooses a k-bit prime p and generates an elliptic curve G. It selects a q-order subgroup G1 of the additive group of points over G and then chooses an arbitrary generator P of G1. It further chooses a random number $x \in Z_{p}^{*}$ as the master key and computes the corresponding system public key Q = xP. It chooses three secure hash functions H1, H2 and H3, where it maps a binary string to an integer H1: {0, 1} * × G → Zq *, H2: {0, 1 } * × G1 → { 0, 1 } ^k and the bilinear maps H3: {0, 1 } ^k × G1 → { 0, 1 } ^k. The right pair of linear mapping is e: G₁ × G₁ → G₂. The message encryption $f_{K}^{e}$ and MAC function $f_{K}^{m}$ will be selected, and ${p, q, G, G 1, P, Q, H 1, H 2, H 3, f_{K}^{e}, f_{K}^{m}}$ will be published as the system parameters by the HSS to keep the key x secret.

Each vehicle has an identity ID with a VE installed in the vehicle. The VE holds a unique identifier for registration in the LTE/LTE-A network. When the VE and MME first register with the network or the key expires, HSS sends each VE private key K_{G_j-i}_, where j-i indicates i VE in group G_j. For an MTC group containing n VEs, the group is named G₁. Each VE in G₁ shares group private key K_G1, and each group shares private key K_G₁-i. When the HSS receives the identification ID_MME of the MME, the HSS computes S_MME = xH₁ (ID_MME) as the private key and sends the key to the VE.

The HSS computes a family of unlinkable pseudo identities ( ${ID}_{VE - 1}, \dots, {ID}_{VE - N}$ ) for the VE after a successful full-access authentication. It selects N random numbers R_i∈ Z_p *, i = 1,2, ... ,N and calculates N pseudo identities ${ID}_{VE - i} = {ID}_{VE} \oplus H_{1} (R_{i}, Q)$ , i = 1,2, ... ,N, where ⊕ is an exclusive-OR (XOR) operation.

Similarly, when each VE_G1-i in group G₁ first accesses the network, the HSS computes S_{VE
_G1-i} = xH₁ (ID_{VE
_G1-i}) as the private key saved in VE_G1-i. With its real identity ID_VE, the scheme implements full-access authentication and negotiates a secret key with the HSS for future communications. Therefore, the VE can constantly change its pseudo identity to achieve user anonymity and unlinkability in the authentication process. To achieve user traceability, non-frameability and non-repudiation, the HSS implements the (t, n) threshold method based on secret sharing via the following steps (11).

For random numbers R_i, construct a t-1 degree polynomial f_i (x) = a_0,i + a_1,ix + a_2,ix² + , … , a_t-1,ix^t-1, where a_0,i = R_i, and a_1,i, a_2,i, …, a_t-1,i are from G₁. To increase the robustness, set 2t-1≤n. If there are n LEAs, then the threshold t belongs to the interval [1, (n + 1)/2]. When t is determined, the degree of the polynomial is t-1. Considering the tradeoff between secrecy and reliability, set t = [n/2] + 1.

Let r_m,i = f_i (m), where m = 1, 2, …, n; thus, HSS divides each R_i into n pieces r_m, i.

Send n pieces r_m, i to n LEAs via the secure IPSec channel established between the HSS and the LEAs.

Erase R_i from its memory to save the storage cost. Use the detailed real ID of the VE from pieces r_m, i to achieve traceability, non-frameability and non-repudiation.

The initial process of the proposed scheme (GAPL) is described in detail as follows.

Step 1: VE_G1-i → leader : (EID_{VE
_G1-i}, MAC_{EID
_G1-i}) ${EID}_{{VE}_{G 1 - i}} = f_{K_{G 1 - i}}^{e} ({ID}_{{VE}_{G 1 - i}})$ ${MAC}_{{VE}_{G 1 - i}} = f_{K_{G 1 - i}}^{e} ({EID}_{{VE}_{G 1 - i}} | | {ID}_{{VE}_{G 1 - i}})$

Step 2: leader → MME : (REQ_G1) $\begin{matrix} {MAC}_{G_{1}} = & {MAC}_{{EID}_{G 1 - 1}} \oplus {MAC}_{{EID}_{G 1 - 2}} \\ \oplus \dots \oplus {MAC}_{{EID}_{G 1 - n}} \end{matrix}$ ${REQ}_{G 1} = ({EID}_{{VE}_{G 1 - 1}} | | \dots | | {EID}_{{VE}_{G 1 - n}} | | {MAC}_{G 1})$

Step 3: MME → HSS : (REQ_G1 ∥ ID_MME)

Step 4: HSS → MME : (RESP_MME) $GTK = f_{K_{G 1}}^{m} (Ri)$ $S_{{VE}_{G 1 - i}} = {xH}_{1} ({EID}_{{VE}_{G 1 - i}})$ $S_{MME} = {xH}_{1} (f_{GTK}^{e} ({ID}_{MME}))$ $\begin{matrix} {RESP}_{MME} = & (S_{{VE}_{G 1 - 1}} | | \dots | | S_{{VE}_{G 1 - n}} | | S_{MME} | | \\ T_{ter min al} | | GTK | | R_{i}) \end{matrix}$

Step 5: MME → leader : (RESP_leader) $\begin{matrix} {RESP}_{leader} = & (S_{{VE}_{G 1 - 1}} | | \dots | | S_{{VE}_{G 1 - n}} | | S_{MME} | | \\ T_{terminal} | | R_{i}) \end{matrix}$

Step 6: Leader →VE_G1 - 1(S_{VE
_G1-i}||T_terminal||R_i)

3.2 Group AKA phase

A group of VE tries to access LTE networks at the same time. First, a group leader is selected according to the communication capability, storage capacity, battery status and other characteristics of each VE, as shown in Fig. 2. The group leader representatives of all other MME members are used for mutual authentication. After confirming the identity on both sides, each VE generates a session key to ensure safety during MME communication. This process is described in detail below.

Fig. 2

Group AKA phase.

Step 1: VE_G1-i → leader : : (V_G1-i, EID_{VE
_G1-i}, GID, T_G1-i)

Compute w = (EID_{VE
_G1-i}||GID||T_G1-i) and h_i = H₂ (w), compute V_G1-i = h_iS_{VE
_G1-i}, then send the vector (V_G1-i, EID_{VE
_G1-i}, GID, T_G1-i) to the leader.

Step 2: leader →MME: (AUTH _leader )

The group leader received all the VE member’s signature V_G1-i, then let n signature polymerization into a signature $V_{G 1} = \sum_{i = 1}^{n} V_{G 1 - i}$ . Compute vector AUTH _leader, and send it to MME. $\begin{matrix} {AUTH}_{leader} = & ({EID}_{{VE}_{G 1 - 1}} | | \dots | | {EID}_{{VE}_{G 1 - n}} | | \\ GID | | V_{G 1} | | T_{G 1 - 1} | | \dots | | T_{G 1 - n}) \end{matrix}$

Step 3: MME verification

MME received the message authentication AUTH _leader from leader, perform the following steps.

Check each T_G1 - i whether the timeout, if the timeout sends an authentication failed messages to the leader, otherwise enter the next validation process.

Compute h_i = H₂ (EID_{VE
_G1-i}||GID||T_G1-i), and validation the formula.

$e (V_{G 1}, P) = e (\sum_{i = 1}^{n} h_{i} H_{1} ({EID}_{{VE}_{G 1 - i}}), Q)$

After validation successful, MME choose current time T_MME. Through MAC function $f_{K}^{m}$ and secret key GTK to compute $K_{G 1 - i}^{S}$ . $\begin{matrix} K_{G 1 - i}^{S} = & f_{GTK}^{m} ({EID}_{{VE}_{G 1 - 1}} | | f_{GTK}^{m} ({ID}_{MME}) | | \\ T_{G 1 - 1}) \end{matrix}$

Compute w = (EID_MME||GID||T_MME), among compute ${EID}_{MME} = f_{GTK}^{e} ({ID}_{MME})$ , compute h_i = H₂ (w), compute V_G1-i = h_iS_{VE
_G1-i}, then the MME generated authentication message AUTH_MME. Compute vector AUTH_MME, and send it to leader.

{AUTH}_{MME} = ({EID}_{MME} | | GID | | V_{MME} | | T_{MME})

Step 4: MME →: leader (AUTH_MME)

Step 5: leader →VE_G1 - i: (AUTH_MME)

The leader sends the authentication message AUTH_MME to all the group number VE_G1 - i. Perform the following steps.

The VE_G1 - i compute h_MME = H₂ (EID_{VE
_G1-i}||T_MME), and through the formula validation MME’s identity. $e (V_{MME}, P) = e (h_{MME} H_{1} ({EID}_{{VE}_{G 1 - i}}), Q)$

If the MME have legal identity, generate the session key $K_{G 1 - i}^{S}$ . $\begin{matrix} K_{G 1 - i}^{S} = & f_{GTK}^{m} ({EID}_{{VE}_{G 1 - 1}} | | f_{GTK}^{m} ({ID}_{MME}) | | \\ T_{G 1 - 1}) \end{matrix}$

The VE_G1 - i send the confirmation message to MME, inform MME session key generated successfully, it can communicate.

After finishing validation for the first time, to save the signature VE_MME and the encrypted identity EID_MME of the MME into the VE_G1 - i. When the VE_G1 - i repeat access networks, can be directly to generate the session key, without the need to once again ask MME for signature and identity.

3.3 Real ID trace phase of VE

In this phase, any t LEAs can cooperate with each other to trace the real ID of the VE from the pseudo identity IDVE-i as follows.

Step 1: For tr_i, m corresponding to the t LEAs, construct a polynomial $y_{i} (x) = \sum_{c = 1}^{t} f_{i} (c) w_{c} (x)$ , where $\sum_{c = 1}^{t} f_{i} (c) = r_{i, 1} + r_{i, 2} + \dots + r_{i, t}$ , and $w_{c} (x) = \prod_{d = 1, d \neq c}^{t} \frac{x - d}{c - d}$ is the Lagrange interpolation coefficient.

Step 2: Construct $R_{i} = y_{i} (0) = \sum_{c = 1}^{t} f_{i} (c) w_{c} (0)$ .

Step 3: Compute the real ID of the VE. ${ID}_{VE}^{'} = {ID}_{VE}^{i} \oplus H_{1} (R_{i} \cdot Q) = {ID}_{VE}$

It should be noted that this phase does not affect the total group AKA delay since VE only notifies the HSS of the authentication result after performing group authentication.

4 Security evaluation

In this section, the security objectives of the GAPL scheme are analyzed. Burrows-Abadi-Needham (BAN) logic, along with the analytical results of formal automated validation of internet security protocols and applications (AVISPA) verification tools, is used to confirm that the security objectives have been met. The analysis shows that the GAPL scheme can work correctly to achieve these security objectives [32]. A comparative functionality analysis against other relevant schemes is also performed, and the results demonstrate that the GAPL scheme is secure and efficient for vehicular users.

4.1 Proof of security objectives

Presently, the most widely used method of formal security protocol analysis is the formal logic analysis method. This method plays an important role in security protocols, especially authentication protocols. Burrows et al. proposed the formal use of BAN logic based on the modal logic of belief, which is used to verify protocols. Furthermore, BAN logic has important significance for security protocol development and correctness.

The logical symbols and inference rules of BAN logic are described as follows.

P, Q: subjects; that is, the principal participants in the protocol.

X: message.

K: secret key.

{X } _K: message X is encrypted with K.

P| ≡ Q P believes Q.

P ⊲ X: P has received message X.

P| ∼ X: P said X.

Q ⇒ X: Q has the jurisdiction to X.

#(X): X is fresh.

P↔K ⟷ Q: K is the common pre-shared key of P and Q.

BAN logic specifies the message-meaning rules, nonce verification rules, jurisdiction rules, etc. The messages above the horizontal line are known as the conditions, while those below it are the results deduced from the known conditions.

Message-meaning rules: P share the secret key K with Q. If P receives a message that X encrypted with K, then P believes that Q has sent X.

Nonce-verification rule: if P believes that message X is fresh and believes that Q has sent X, then P believes that Q believes X.

Jurisdiction rules: if P believes Q has sent message X, and P believes that Q believes X, then P believes X.

Belief-joint rules: if P believes X and Y, then P believes messages of a cascade of X and Y; if P believes that Q believes messages of a cascade of X and Y, then P believes that Q believes X or Y; if P believes that Q has said X and Y, then P believes that Q has said X or Y; if P believes the message of a cascade of X and Y, then P believes X or Y.

Freshness-joint rule: if P believes that X is fresh, P believes the entire message of a cascade with X is fresh.

Reception rules: if P receives messages of a cascade of X and Y, we consider that P receives X or Y; if P receives the connection of the formula of X and Y, we consider that P receives X or Y; P shares secret key K with Q. If P receives message X encrypted with K, we can infer that P receives X.

Additional rules: secret key K is fresh. If P receives message X encrypted with K and P believes that P shares secret key K with Q, we can infer that P believes Q has sent message X and that P believes that Q believes P shares secret key K with Q.

This section will be based on the BAN logic model to correctly realize the LTE-A network mutual AKA. The proof process is as follows:

(1) Protocol idealization

To facilitate the formal analysis, by performing BAN logic analysis, the first step is to convert every step of the authentication into the idealized form.

$\begin{matrix} m_{1} : VE \to MME : {〈 GID, {ID}_{MME} 〉}_{h ({ID}_{VE} ∥ T)}; \\ m_{2} : Leader \to MME : {〈 {ID}_{VE} 〉}_{S_{Leader}}; \\ m_{3} : MME \to VE : {〈 {ID}_{Leader}, VE \overset{P}{⟷} Leader 〉}_{h ({ID}_{VE} ∥ T)}; \\ m_{4} : MME \to Leader : 〈 VE \overset{Q}{⟷} eNodeB 〉 S_{MME}; \\ m_{5} : Leader \to VE : 〈 VE \overset{K}{⟷} Leader 〉 K; \\ m_{6} : VE \to Leader : 〈 VE \overset{K}{⟷} Leader 〉 K; \end{matrix}$

(2) Initial assumption

The initial assumption is the important guarantee for GAPL analysis to be successfully conducted. It assumption included which key is the initial shared, which equipment in some situations is to be trusted, and which equipment generates a new value. Initial assumptions for the proposed agreement are the following. $\begin{matrix} A 1 : VE : | \equiv # MME \Rightarrow VE \overset{P}{⟷} Leader; \\ A 2 : Leaderc | \equiv # MME \Rightarrow VE \overset{P}{⟷} Leader; \\ A 3 : MME | \equiv VE | \Rightarrow P; \\ A 4 : MME | \equiv Leader | \Rightarrow Q; \\ A 5 : MME | \equiv VE | \Rightarrow {ID}_{VE}; \\ A 6 : VE | \equiv VE \overset{h ({ID}_{VE} ∥ T)}{⟷} MME; A 7 : MME | \equiv VE \overset{h ({ID}_{VE} ∥ T)}{⟷} MME; A 8 : Leader | \equiv | \overset{P_{MME}}{\to} MME; A 9 : MME | \equiv | \overset{P_{Leader}}{\to} Leader; \end{matrix}$

(3) Protocol goal

The ultimate goal of the proposed scheme is to realize the mutual authentication between the VE and Leader and establish a shared session key. The expression of the objectives is presented by BAN logic as follows. $\begin{matrix} Goal 1 : VE | \equiv VE \overset{K}{⟷} Leader; \\ Goal 2 : VE | \equiv Leader | \equiv VE \overset{K}{⟷} Leader; \\ Goal 3 : Leader | \equiv VE \overset{K}{⟷} Leader; \\ Goal 4 : Leader | \equiv VE | \equiv VE \overset{K}{⟷} Leader; \end{matrix}$

(4) Protocol annotations and target derivation

Based on m₁, can $Statment 1 : MME {〈 GID, {ID}_{MME} 〉}_{h ({ID}_{VE} ∥ T)};$ based on Statement 1 and A7, by the message-meaning rule, $Statement 2 : MME | \equiv VE | \sim 〈 GID, {ID}_{MME} 〉;$ based on Statement 2, by the fresh value validation and freshness verification rules, $Statement 3 : MME | \equiv VE | \equiv 〈 {ID}_{MME} 〉;$ based on m_2, $Statement 4 : MME {〈 {ID}_{VE} 〉}_{S_{Leader}};$ based on Statement 4 and A9, by the message-meaning rule, $Statement 5 : MME | \equiv VE | \sim 〈 P 〉;$ based on Statement 5, by the freshness verification rule, $Statement 6 : MME | \equiv VE | \equiv 〈 P 〉;$ based on m_3,

$Statement 7 : VE {〈 {ID}_{Leader}, VE \overset{P}{⟷} Leader 〉}_{h ({ID}_{VE} ∥ T)};$

based on Statement 7 and A6, by the message-meaning rule,

$Statement 8 : VE | \equiv MME | \sim 〈 VE \overset{h ({ID}_{VE} ∥ T)}{⟷} Leader 〉;$

based on Statement 8, by the fresh value validation and freshness verification rules, $Statement 9 : VE | \equiv MME | \equiv 〈 VE \overset{P}{⟷} Leader 〉;$ based on Statement 9 and A1, by the control rule, $Statement 10 : VE | \equiv 〈 VE \overset{P}{⟷} Leader 〉;$ based on $K_{G 1 - i}^{S}$ , $\begin{matrix} Statement 11 : VE | \equiv VE \overset{K}{⟷} Leader \\ (Goal 1) \end{matrix}$ based on m₄, $Statement 12 : Leader {〈 VE \overset{Q}{⟷} Leader 〉}_{S_{MME}};$ based on Statement 12 and A8, by the message-meaning rule,

$Statement 13 : Leader | \equiv MME | \sim 〈 VE \overset{Q}{⟷} Leader 〉;$

based on Statement 13, the fresh value validation and freshness verification rules,

$Statement 14 : Leader | \equiv MME | \equiv 〈 VE \overset{Q}{⟷} Leader 〉;$

based on Statement 14 and A6, by the control rule, $Statement 15 : Leader | \equiv 〈 VE \overset{Q}{⟷} Leader 〉;$ based on, $\begin{matrix} Statement 16 : VE | \equiv Leader | \equiv VE \overset{SK}{⟷} Leader \\ (Goal 2) \end{matrix}$ based on m₅, $Statement 17 : VE {〈 VE \overset{K}{⟷} Leader 〉}_{K};$ based on Statement 17, by the message-meaning rule, $Statement 18 : VE | \equiv Leader | \sim 〈 VE \overset{K}{⟷} Leader 〉;$ based on Statement 18, by the fresh value validation and freshness verification rules, $Statement 19 : VE | \equiv Leader | \equiv 〈 VE \overset{K}{⟷} Leader 〉;$ based on Statement 19, $\begin{matrix} Statement 20 : Leader | \equiv VE \overset{K}{⟷} Leader \\ (Goal 3) \end{matrix}$ based on m₆, $Statement 21 : Leader {〈 VE \overset{K}{⟷} Leader 〉}_{K};$ based on Statement 21, by the message-meaning rule, $Statement 22 : Leader | \equiv VE | \sim 〈 VE \overset{K}{⟷} Leader 〉;$ based on Statement 22, by the fresh value validation and freshness verification rules, $Statement 23 : Leader | \equiv VE | \equiv 〈 VE \overset{K}{⟷} Leader 〉;$ based on Statement 23, $\begin{matrix} Statement 24 : Leader | \equiv VE | \equiv VE \overset{SK}{⟷} Leader \\ (Goal 4) \end{matrix}$

According to the logic presentation and derivation, Goals 1–4 can be reached, demonstrating that the GAPL scheme can realize mutual authentication and session key agreement between the VE and the Leader.

4.2 Security analysis

In this section, the security properties of the proposed GAPL scheme are analyzed. Specifically, this analysis will focus on how the proposed GAPL scheme achieves the security goals discussed above.

Proposition 1. Mutual AKA

Proof. In GAPL, the response message and acknowledgement message include authentication codes AUTH_MME and AUTH_leader. No efficient algorithm can solve the elliptic curve discrete logarithm problem (ECDLP) with less than exponential time, and thus, deriving the private key of the MME is difficult. Mutual authentication mainly involves the following: (1) the HSS verification of the VE group and check of the MAC_G1; (2) VE group verification of the core network authentication, MAC_HSS and MAC_MME; and (3) MME verification of the VE group and the VE group authentication code AUTH_MME.

In the key agreement process, the VE and MME keys are independent. Moreover, no key exists in any communication channel transmission. In contrast, the freshness key is authenticated by a set of authentication vectors. Furthermore, each VE group has a different key because of the random number involved in the key generation algorithm.

Proposition 2.Vehicles receiving a message can ensure message authenticity, integrity, and non-repudiation.

Proof. An aggregate proxy signature is used to ensure the authenticity of the message and its integrity and non-repudiation. The VE group leader receives the entire signature V_G1-i of the VE member and lets n signatures polymerize into a signature $V_{G 1} = \sum_{i = 1}^{n} V_{G 1 - i}$ . Then, vector AUTH_leader is sent to the MME through e (V_G1, P) verification and T_MME is chosen to ensure message authenticity, integrity, and non-repudiation.

Proposition 3. User anonymity and unlinkability

Proof. In GAPL, each VE receives a family of pseudo identities and the corresponding private keys from the HSS at the time of registration. The pseudo identity is ID_VE - i instead of the real identity of the VE. Because the random number R_i, it is difficult for the global adverse to reveal the real identity of a VE from the ID_VE - i overheard. Only t trusted LEAs or more than t trusted LEAs know the relationship between a pseudo identity and the real identity. Since there is no linkage between pseudo identities, except at the least t LEAs, no one, including the MME, can utilize the acquired ID_VE - i to trace the movement route of the VE.

Proposition 4. Traceability and non-frameability

Proof. When the real identity of a VE needs to be revealed, at least t LEAs can reconstruct the random number R_i from their shares r_i,n and compute the real identity of the VE. Therefore, the GAPL scheme can provide traceability and can avoid the malicious abuse of user privacy. Meanwhile, to achieve non-frameability, at least t LEAs will cooperate with each other to trace the real identity of the VE instead of a single entity, such as HSS or the group manager. Therefore, an innocent VE cannot be framed by a corrupted or abusive entity due to the role of the splitting mechanism based on secret sharing. Moreover, less than t corrupted LEAs cannot trace the real identity of the VE due to the (t, n) threshold mechanism.

Proposition 5. Replay attacks

Proof. GAPL uses random parameters produced by the HSS, MME and VE_Gi - j. Because different random variables are used, the attacker obtains a random number from the certification process, and using the random number to look for a challenge message is impossible. In addition, the VE and HSS maintain synchronization through parameter T_MME, and as a result, no synchronization will cause authentication failure. Therefore, GAPL can resist replay attacks.

Proposition 6. Man-in-the-middle attack

Proof. The key agreement in GAPL is same as that in the CDH key exchange. Therefore, the adopted key $K_{G 1 - i}^{S}$ is only found in the MME and VE rather than through hollow transmission, which can prevent monitoring or tampering by malicious actors.

Proposition 7. Fraud attack

Proof. GAPL can realize mutual authentication for the network and all terminals in the group; therefore, it can prevent fraud attacks.

4.3 Formal verification

To ensure that the proposed scheme can resist malicious attacks, considering the design of the security goals, the AVISPA tool is used for formal verification of the protocol security. The AVISPA security protocol analysis tool works based on a complete set of model checking technologies and is a standard and automatic formal analysis tool. AVISPA takes the high-level protocol specification language (HLPSL) as the description tool. Using the HLPS2IF translator, AVISPA converts the description of HLPSL into an intermediate format (IF), and then, its model detector is used to verify the security functions. AVISPA has four security analysis terminals: the On-the-Fly Model Checker (OFMC), the Constraint-Logic-Based Attack Searcher (CLAtSe), the SAT-Based Model Checker (SATMC), and Tree Automata based on Automatic Approximations for the Analysis of Security (TA4SP). These four security analysis terminals have different underlying principles and foci. If a protocol can reach the expected security goals, the results of the security analysis and corresponding data will be presented. If the scheme is verified to be unsafe, the terminal will show the unrealized expected safety goal. To formally verify the security functionality of the proposed GAPL protocol in an LTE-A-based VANET, AVISPA is used for modeling and verification.

The GAPL scheme works to achieve the authentication of a VE to the MME. AVISPA can simulate intruders who can receive and send messages; in HLPSL, the intruder is named i, and its initial knowledge is explicitly defined in the specification (intruder knowledge = {...}). Once the HLPSL specification has been debugged, it will be checked for automatic attack detection by the four checkers. If the proposed protocol is safe, the checking result will report SAFE in the SUMMARY, as marked in Fig. 3. In the GAPL process, HLPSL is used to describe the basic roles of the VE and eNB. It shows the checking results from OFMC and the same results from the other three checkers. Therefore, the simulation results indicate that no revealed attacks were found. Through a simulation of intruder attacks, GAPL is proven to provide a good security presence.

Fig. 3

AVISPA checking results of GAPL.

4.4 Functionality comparison

Table 3 clearly shows that the proposed scheme has many excellent features and is more secure than similar authentication schemes. For a vehicle in an LTE-A-based VANET, VE is resistant to various types of security attacks, and anonymity is achieved. The GAPL scheme requires relatively few communications and has low computational costs. The privacy-preserving level of support protects the privacy of VEs in LTE-A-based vehicular networks.

Table 3
Definition of privacy-preserving levels

Dynamic group-based AKA (DGBAKA) [7], SE-AKA [8], and EG-AKA [9] Anonymous batch AKA (ABAKA) [13] Group-based access authentication for MTC in LTE Networks (GBAAM) [16] GAPL

Mutual authentication No Yes Yes Yes

Against impersonation attack Yes No No Yes

Resists replay attack Yes Yes Yes Yes

Resists perfect forward attack Yes Yes Yes Yes

Resists perfect backward attack Yes Yes Yes Yes

Resists insider attack No No No Yes

Anonymity No No Yes Yes

Unlinkability Yes No Yes Yes

Traceability No Yes Yes Yes

Non-frameability No No No Yes

Non-repudiation No No No Yes

	Dynamic group-based AKA (DGBAKA) [7], SE-AKA [8], and EG-AKA [9]	Anonymous batch AKA (ABAKA) [13]	Group-based access authentication for MTC in LTE Networks (GBAAM) [16]	GAPL
Mutual authentication	No	Yes	Yes	Yes
Against impersonation attack	Yes	No	No	Yes
Resists replay attack	Yes	Yes	Yes	Yes
Resists perfect forward attack	Yes	Yes	Yes	Yes
Resists perfect backward attack	Yes	Yes	Yes	Yes
Resists insider attack	No	No	No	Yes
Anonymity	No	No	Yes	Yes
Unlinkability	Yes	No	Yes	Yes
Traceability	No	Yes	Yes	Yes
Non-frameability	No	No	No	Yes
Non-repudiation	No	No	No	Yes

5 Performance analysis

In this section, the performance of the proposed scheme is compared with that of several existing schemes. Computational and communication overheads are very important performance indicators and are the primary focus of this study. To obtain quantitative results, simulations are conducted to compare GAPL with several typical authentication protocols. The applied cryptographic algorithms employed in the simulation are hashed functions, including the Secure Hash Algorithm (SHA-256), the symmetric encryption Advanced Encryption Standard (AES-128), and the Elliptic Curve Digital Signature Algorithm (ECDSA-160). The parameter settings and their values are listed in Table 4 and are in agreement with the literature. Suppose there are n VEs forming a group that accesses the network t times. The analysis of the computational overhead and communication overhead is as follows. The experimental hardware is an Intel Core E5-1607 processor with a 3.00-GHz clock frequency. The simulation tool is MATLAB 2014b.

Table 4
Parameter settings

Notation Definition

xP 1024

g^xmodp 1024

Identity ID_x 160

Random number 128

Hash function h(x) 160

Encryption/decryption 1024

Notation	Definition
xP	1024
g^xmodp	1024
Identity ID_x	160
Random number	128
Hash function h(x)	160
Encryption/decryption	1024

5.1 Communication overhead

The communication overhead of GAPL will be compared with those of other schemes. Assume that there are n VEs forming m groups; obviously, n > m. In a VE group, communication between each member and leader, leader and MME, and MME and HSS requires one unit of time. When the VE group applies for network access for the first time during the initialization phase, the VE requests verification and distribution of the long-held private key from the HSS to the VE and MME, which needs (2n+4) units of time. In the AKA phase, VE and MME require (2n+2) units of time to go through mutual authentication. In the subsequent process validation, because of the VE’s saved information, such as the MME signature, (n + 3) units of time are needed to complete the certification process. Table 5 and Fig. 4 show the analytical results obtained for the communication overhead. As the number of VEs involved in the authentication process, the performance advantages of GAPL increase relative to other techniques.

Table 5
Comparison of communication overheads

First access process Subsequent (t-1) process Total

DGBAKA [7], SE-AKA [8], EG-AKA [9] 5n 5n(t-1) 5nt+2

EPS–AKA [13] 7n 5n(t-1) 7n+5n(t-1)

GBAAM [16] 7n (n + 3)(t-1) 7n+(n + 3)(t-1)

GAPL 5n+6 (n + 3)(t-1) 5n+(n + 3)(t-1)+6

	First access process	Subsequent (t-1) process	Total
DGBAKA [7], SE-AKA [8], EG-AKA [9]	5n	5n(t-1)	5nt+2
EPS–AKA [13]	7n	5n(t-1)	7n+5n(t-1)
GBAAM [16]	7n	(n + 3)(t-1)	7n+(n + 3)(t-1)
GAPL	5n+6	(n + 3)(t-1)	5n+(n + 3)(t-1)+6

Fig. 4

Comparison of the communication overheads when t = 20.

Although the security evaluation demonstrated that the GAPL scheme is safe against various types of attacks, other types of malicious attacks and unknown types of attacks that cannot be predicted may interrupt the execution of the protocol during the authentication and key establishment phases. Therefore, it is assumed that any type of attack may randomly occur at any step of the protocol execution during authentication. The GAPL scheme cannot proceed if an attack successfully interrupts its execution. Additionally, as the number of successful attacks increases, the consumption overhead required to completely execute the protocol will also increase. VEs are resource-constrained devices in terms of their computational power, storage capacity, and power supply. As shown in Fig. 5, when VE = 200, the consumption overheads of the authentication schemes grow linearly as the probability of successful attacks increases. After the probability of a successful attack reaches 50%, probability is reached, the consumption overhead of GAPL slightly exceeds that of the GBAAM. Each of the schemes has a larger overhead when the probability of successful attack exceeds 60%.

Fig. 5

Comparison of the consumption overheads when VE = 200.

5.2 Computational cost

Regarding the computational cost, EPS-AKA uses a symmetrical secret key, and its computational cost can be regarded as zero [33]. The following operations will be considered, including a point multiplication (T_mul = 0.6 ms) of the elliptic curve encryption algorithm, a pairing operation (T_pair = 4.5 ms), and an identity encryption of the elliptic curve point operation (T_etp = 0.6 ms) of the hash function. Other operations, such as point addition and one-way hash function, are ignored. Table 6 and Fig. 6 show the analytical results for the computation cost. The proposed scheme for each VE only needs one T_mul, which is better than other schemes. In an LTE-A network, this scheme’s performance is slightly poorer than those of SE-AKA and EG-AKA because GAPL uses a multiple encryption algorithm. However, GAPL can achieve privacy-preservation with one T_mul, while the other schemes cannot.

Table 6
Comparison of computational costs

Each VE LTE-A network

DGBAKA [7], SE-AKA [8], EG-AKA [9] 2 Tmul 2n Tmul

EPS–AKA [13] 6 Tmul (3n+1) Tmul

GBAAM [16] 4 Tmul n Tetp +2n Tmul + 2 Tpair + Tmul

GAPL Tmul n Tetp +n Tmul + 2 Tpair

	Each VE	LTE-A network
DGBAKA [7], SE-AKA [8], EG-AKA [9]	2 Tmul	2n Tmul
EPS–AKA [13]	6 Tmul	(3n+1) Tmul
GBAAM [16]	4 Tmul	n Tetp +2n Tmul + 2 Tpair + Tmul
GAPL	Tmul	n Tetp +n Tmul + 2 Tpair

Fig. 6

Comparison of the computational costs when t = 20.

The number of attacks used in the simulation was VE = 200. The GAPL scheme was observed to have lower computational cost than the other schemes examined. Assuming a 50% probability of successful attacks, Fig. 7 reveals that the computational costs of DGBAKA, SE-AKA and EG-AKA are lower than those of EPS–AKA and GBAAM. Nevertheless, the linear increment observed for these methods indicates that they have low resistance when the attack types are unknown. The GAPL scheme exhibits smooth ascension under 50%, indicating that the proposed scheme has strong resistance against unknown attacks.

Fig. 7

Comparison of the computational costs when VE = 200.

5.3 Verification cost

Owing to its aggregation signature, GAPL can largely reduce the signaling cost and achieve low communication overhead and computational cost. However, once an invalid access request exists in the aggregation signature generation, GAPL may not have advantages in efficiency. V2 V communication, which was researched in [33], is a special type of machine-to-machine (M2M) communication [34]. Compared to other MTCDs [35], vehicles are more vulnerable to packet loss or sending bogus messages due to their mobility characteristics. To illustrate the verification cost of GAPL in the worst case, the probability of only one invalid access request in a batch is 0.42, and that of two invalid requests is 0.18; the probability of more than two invalid requests in a batch is almost negligible (i.e., approximately lower than 0.06). Thus, the verification cost of GAPL is evaluated when there is one or two invalid access requests. The worst case and average case are described in [19].

Figure 8 shows the results obtained for the total verification cost in both the worst case and the average case for an invalid request. According to Fig. 8, when there are 100 VEs, the total verification cost in the average case is less than 2000 ms; that is, verifying VE takes approximately 1.2 ms on average, even if there is one invalid access request. Note that the communication between the VE group and the MTC server in MTC service scenarios can begin after the group-based access authentication procedures are complete.

Fig. 8

Analytical results for the verification cost of the network for an invalid request.

6 Conclusions

In this paper, a GAPL scheme based on the aggregation of the proxy signature and MAC to obtain group AKA is proposed and analyzed. The identity of the proxy signature allows multiple VEs using polymerization information aggregation to be placed into a set of identity information. A privacy-preserving level is set to support protecting the privacy of VEs during authentication. The security analysis shows that GAPL is secure against various malicious attacks [36]. Furthermore, without a cryptographic method [37 –39], GAPL can achieve outstanding performance compared with existing solutions. In the future, we will continue to carry out attack test on our proposed GAPL scheme, and apply this scheme to the vehicle network for test.

Footnotes

Acknowledgments

This work was supported, the National Natural Science Foundation of China (Grant No. 61871039, 61802019, 61906017, 61932012,), the Supporting Plan for Cultivating High Level Teachers in Colleges and Universities in Beijing (Grant No. IDHT20170511), the Premium Funding Project for Academic Human Resources Development in Beijing Union University (No. BPHR2020EZ01, BPHR2019AZ01), the Beijing Municipal Commission of Education Project (No. KM201911417001), Beijing Union University project (ZK80202001, 202011417004, 202011417005, 202011417SJ025, KYDE40201702).

References

Sameer

S.M.

, Jun

and Wensong

, A Survey of Security Services, Attacks, and Applications for Vehicular Ad Hoc Networks (VANETs)19(16), 2019.

Yan

and Rawat

D.B.

, Vehicle-to-vehicle connectivity analysis for vehicular ad-hoc networks, 2016.

Qiu

, Ma

and Wang

, A proxy signature-based handover authentication scheme for LTE wireless networks, Journal of Network and Computer Applications83 (2017), 63–71.

Ubiergo

G.A.

and Jin

W.-L.

, Mobility and environment improvement of signalized networks through Vehicle-to-Infrastructure(V2I) communications. Transportation Research Part C, 2016.

Huang

, Xu

, Wang

and Liu

, LNSC: A security model for electric vehicle and charging pile management based on blockchain ecosystem, IEEE Access6 (2018), 13565–13574.

Baron

and Gupta

, Unpacking 3GPP standards, Journal of Economics & Management Strategy27(3), 2018.

Choi

, Choi

H.K.

and Lee

S.Y.

, A group-based security protocol for machine-type communications in LTE-advanced, Wireless Networks21(2) (2015), 405–419.

Lin

Y.C.

, Wu

T.C.

and Tsai

J.L.

, ID-based aggregate proxy signature scheme realizing warrant-based delegation, Journal of Information Science and Engineering29(3) (2013), 441–457.

Yang

, Lai

, Lu

and Jiang

, EAPSG: Efficient authentication protocol for secure group communications in maritime wideband communication networks, Peer-to-Peer Networking and Applications8(2) (2015), 216–228.

10.

Zhang

, Chen

, Li

, Cao

and Lai

, Group-based authentication and key agreement for machine-type communication, International Journal of Grid and Utility Computing5(2) (2014), 87–95.

11.

Lai

, Li

, Lu

, Jiang

and Shen

, LGTH: A lightweight group authentication protocol for machine-type communication in LTE networks. In 2013 IEEE Global Communications Conference (GLOBECOM), 2013, December (pp. 832-837). IEEE.

12.

Jiang

, Lai

, Luo

, Wang

and Wang

, EAP-based group authentication and key agreement protocol for machine-type communications, International Journal of Distributed Sensor Networks9(11) (2013), 1–14.

13.

Lai

, Li

, Lu

and Shen

X.S.

, SE-AKA: A secure and efficient group authentication and key agreement protocol for LTE networks, Computer Networks57(17) (2013), 3492–3510.

14.

, Huang

, Ma

and Bao

, A privacy-preserving and cross-domain group authentication scheme for vehicular in LTE-A networks, Journal of Communications12(11) (2017), 604–611.

15.

Ahmed

and Gharavi

, Cooperative vehicular networking: A survey, IEEE Transactions on Intelligent Transportation Systems19(3) (2018), 996–1014.

16.

, Yoshinaga

, Ji

and Zhang

, Computational Intelligence Inspired Data Delivery for Vehicle-to-Roadside Communications, IEEE Transactions on Vehicular Technology67(12) (2018), 12038–12048.

17.

Zhou

, Ma

and Sun

, A Hybrid Authentication Protocol for LTE/LTE-A Network, IEEE Access7 (2019), 28319–28333.

18.

Faigl

, Bokor

, Pellikka

and Gurtov

, Suitability analysis of existing and new authentication methods for future 3GPP Evolved Packet Core, Computer Networks57(17), 2013.

19.

Cao

, Ma

and Li

, Gbaam: group-based access authentication for mtc in lte networks, Security and Communication Networks8(17) (2015), 3282–3299.

20.

, Liu

, Li

and Wang

, A Remote Attestation Security Model Based on Privacy-Preserving Blockchain for V2X, IEEE Access6 (2018), 67809–67818.

21.

, Liu

, Zhang

and Wang

, Mutual authentication for vehicular network in complex and uncertain driving, Neural Computing and Applications32 (2020), 61–72.

22.

, Huang

, Ma

and Bao

, An Anonymous Handover Authentication Scheme Based on LTE-A for Vehicular Networks, Wireless Communications and Mobile Computing2018 (2018), 1–15.

23.

, Qin

, Wang

, Li

and Zhang

, Nframe: A privacy-preserving with non-frameability handover authentication protocol based on (t, n) secret sharing for LTE/LTE-A networks, Wireless Networks23(7) (2017), 2165–2176.

24.

, Chan

and Guizani

, Handover authentication for mobile networks: security and efficiency aspects, IEEE Network29(3) (2015), 96–103.

25.

Duan

and Wang

, Authentication handover and privacy protection in 5G hetnets using software-defined networking, IEEE Communications Magazine53(4) (2015), 28–35.

26.

, Cao

, Feng

, Li

, Zhang

and Lv

, PPSHA: Privacy preserving secure handover authentication scheme for all application scenarios in LTE-A networks, Ad Hoc Networks87 (2019), 49–60.

27.

, Huang

, Ma

and Bao

, A Secure and Efficient Message Authentication Scheme for Vehicular Networks based on LTE-V, KSII Transactions on Internet & Information Systems12(6) (2018), 2841–2860.

28.

Lai

, Lu

, Zheng

, Li

and Shen

X.S.

, GLARM: Group-based lightweight authentication scheme for resource-constrained machine to machine communications, Computer Networks99 (2016), 66–81.

29.

Hoogervorst

, Zhang

, Tillem

, Erkin

and Verwer

, Solving bin-packing problems under privacy preservation: Possibilities and trade-offs, Information Sciences (2019), 500.

30.

, Luo

and Bao

, STEIM: A Spatiotemporal Event Interaction Model in V2X Systems Based on a Time Period and a Raster Map, 2020 (2020), 1–20.

31.

Lai

, Li

, Lu

and Xuemin (Sherman) ShenSE-AKA: A secure and efficient group authentication and key agreement protocol for LTE networks, Computer Networks57(17), 2013.

32.

, Liu

, Lu

, Zeng

, Zhang

and Li

, A novel efficient MAKA protocol with desynchronization for anonymous roaming service in Global Mobility Networks, Journal of Network and Computer Applications (2018), 107.

33.

Huang

J.L.

, Yeh

L.Y.

and Chien

H.Y.

, Abaka: an anonymous batch authenticated and key agreement scheme for value-added services in vehicular ad hoc networks, IEEE Transactions on Vehicular Technology60(1) (2011), 248–262.

34.

S.-I.

, Considerations in Technology and Policy Planning for Machine-to-Machine (M2M) Networks [A], IEEE (2011), 4.

35.

Xia

, Recent Advances in Machine-to-Machine Communications[A], Proceedings of 2016 Workshop 5[C] (2016), 5.

36.

Roberts

F.S.

, From Football to Oil Rigs: Risk Assessment for Combined Cyber and Physical Attacks, Journal of Benefit-Cost Analysis10(2), 2019.

37.

Ibrahimov

B.G.

, Humbatov

R.T.

and Ibrahimov

R.F.

, Cryptographic Methods And Means Protection Transmitted Information in Telecommunication Systems, IFAC PapersOnLine51(30), 2018.

38.

Chu

, Yoo

and Jung

B.C.

, Resource usage of LTE networks for machine-to-Machine group communications: Modeling and analysis, Computers and Electrical Engineering (2018), 71.

39.

InterDigital Technology Corporation; Patent Issued for Method And Apparatus For Measurement Reporting And Event-Triggered Periodic Measurement Reporting In An Evolved Universal Terrestrial Radio Access Network (USPTO 10,070,332). Computers, Networks & Communications, 2018.

A group authentication and privacy-preserving level for vehicular networks based on fuzzy system

Abstract

Keywords

1 Introduction

2 Preliminary information

2.1 Network architecture

2.3 Privacy-preserving levels

Table 1 Definitions of privacy-preserving levels Level 1 Level 2 Level 3 Level 4 Level 5 Anonymity Yes No No No No Unlinkability Yes Yes No No No Traceability Yes Yes Yes No No Non-frameability Yes Yes Yes Yes No Non-repudiation Yes Yes Yes Yes Yes

3 Proposed GAPL scheme

3.2 Group AKA phase

4 Security evaluation

4.1 Proof of security objectives

4.2 Security analysis

4.3 Formal verification

Table 4 Parameter settings Notation Definition xP 1024 gxmodp 1024 Identity IDx 160 Random number 128 Hash function h(x) 160 Encryption/decryption 1024

Table 5 Comparison of communication overheads First access process Subsequent (t-1) process Total DGBAKA [7], SE-AKA [8], EG-AKA [9] 5n 5n(t-1) 5nt+2 EPS–AKA [13] 7n 5n(t-1) 7n+5n(t-1) GBAAM [16] 7n (n + 3)(t-1) 7n+(n + 3)(t-1) GAPL 5n+6 (n + 3)(t-1) 5n+(n + 3)(t-1)+6

Table 6 Comparison of computational costs Each VE LTE-A network DGBAKA [7], SE-AKA [8], EG-AKA [9] 2 Tmul 2n Tmul EPS–AKA [13] 6 Tmul (3n+1) Tmul GBAAM [16] 4 Tmul n Tetp +2n Tmul + 2 Tpair + Tmul GAPL Tmul n Tetp +n Tmul + 2 Tpair

Footnotes

Acknowledgments

References

Table 1
Definitions of privacy-preserving levels

Level 1 Level 2 Level 3 Level 4 Level 5

Anonymity Yes No No No No

Unlinkability Yes Yes No No No

Traceability Yes Yes Yes No No

Non-frameability Yes Yes Yes Yes No

Non-repudiation Yes Yes Yes Yes Yes

Table 4
Parameter settings

Notation Definition

xP 1024

g^xmodp 1024

Identity ID_x 160

Random number 128

Hash function h(x) 160

Encryption/decryption 1024

Table 5
Comparison of communication overheads

First access process Subsequent (t-1) process Total

DGBAKA [7], SE-AKA [8], EG-AKA [9] 5n 5n(t-1) 5nt+2

EPS–AKA [13] 7n 5n(t-1) 7n+5n(t-1)

GBAAM [16] 7n (n + 3)(t-1) 7n+(n + 3)(t-1)

GAPL 5n+6 (n + 3)(t-1) 5n+(n + 3)(t-1)+6

Table 6
Comparison of computational costs

Each VE LTE-A network

DGBAKA [7], SE-AKA [8], EG-AKA [9] 2 Tmul 2n Tmul

EPS–AKA [13] 6 Tmul (3n+1) Tmul

GBAAM [16] 4 Tmul n Tetp +2n Tmul + 2 Tpair + Tmul

GAPL Tmul n Tetp +n Tmul + 2 Tpair