An effective aggregate signature scheme suitable for VANETs and its implementation using OPNET IT Guru

<!-- metadata commented in wiki content


<div class="center" style="width: auto; margin-left: auto; margin-right: auto;">
<big>'''An Effective Aggregate Signature Scheme Suitable for VANETs and Its Implementation Using OPNET IT Guru'''</big></div>

<div class="center" style="width: auto; margin-left: auto; margin-right: auto;">
Daxing Wang</div>

<div class="center" style="width: auto; margin-left: auto; margin-right: auto;">
</div>

<div class="center" style="width: auto; margin-left: auto; margin-right: auto;">
corresponding author: [mailto:daxingwang@chzu.edu.cn daxingwang@chzu.edu.cn]</div>
-->
==Abstract==

Vehicular Ad hoc NETwork (VANET) is a multi-hop and high-speed mobile wireless communication network. In order to realize the security authentication of the information transmission between vehicle nodes in vehicular ad hoc networks, a certificateless aggregate signature scheme is designed. The proposed scheme uses certificateless cryptography, which eliminates the complex maintenance cost of certificate and solves the problem of key escrow. Communicating through pseudonyms and nodes around the roadside units generated, the conditional privacy protection is achieved for vehicle users. Then, the efficiency of the scheme is analyzed, and the relationship between the traffic density in VANETs environment and the time delay of message verification is simulated. The results show that the scheme satisfies the message authentication, anonymity, unforgeability and traceability, as well as the higher communication efficiency and the shorter delay of message verification, which is more suitable for dynamic vehicular ad hoc network environment.

'''Keywords''': Vehicular ad hoc NETwork, aggregate signature, certificateless cryptosystem

==1. Introduction==

As the basis of future intelligent transportation, VANET provides a very important network environment for vehicle-to-vehicle communication, which can effectively solve the problems of road safety, traffic management and traffic congestion. It is a research direction that scientists are keen on at present. The on-board network is mainly composed of on-board units (OBU) installed on the vehicle and road-side units (RSU) deployed on the infrastructure around the road. Users communicate through vehicles-to-vehicle (V2V) and between vehicles and infrastructure (Vehicle-to-Infrastructure, V2I) to share information and access various services provided by nearby infrastructure [1]. The network model is shown in [[#img-1|Figure 1]] .

<div id='img-1'></div>
{| style="text-align: center; border: 1px solid #BBB; margin: 1em auto; width: auto;max-width: auto;"
|-
|style="padding:10px;"| [[Image:Review_388410900859-image1.png|450px]]
|- style="text-align: center; font-size: 75%;"
| colspan="1" style="padding-bottom:10px;"| '''Figure 1'''. The network model of VANETs (Source [10] 
|}


Due to its own characteristics, such as resource limitation, high-speed movement of nodes, and communication delay should be short enough, the VANETs make their security issues very fragile, including eavesdropping, tampering, tracking user privacy, etc. [2]. If the messages in the vehicular network cannot be authenticated in a timely manner, the packet loss rate will increase, resulting in poor communication efficiency. Therefore, reducing the delay of message verification is a key requirement of the vehicle network for the efficiency of the authentication protocol. On the other hand, vehicle users are not willing to let their privacy and other sensitive information be illegally tracked and maliciously analyzed. When a traffic accident occurs or the owner commits a crime, the law enforcement authorities should be able to retrieve or track the owner’s information to reveal their identity, which is called conditional privacy protection [3].

Digital signatures can provide non-repudiation，authentication and integrity of messages. In the communication of the vehicle network with high traffic density, each RSU or traffic control center needs to verify a large amount of vehicle information, which will cause a large amount of calculation overhead. But in many cases, these calculations must be done in a resource-constrained environment with low bandwidth and low storage space. Aggregate signature  is a hot spot that has been paid attention in recent years [4]. Using aggregation signature in VANET can greatly reduce the burden of RSU (Roadside unit). The signature based on the traditional PKI (Public Key Infrastructure) is based on the certificate system. CA (Certificate Authority) needs to bind the user and his public key, and the cost of managing and protecting certificates is very large, which is not suitable for the vehicle network. Identity-based aggregate signatures can avoid complicated certificate problems and can be applied to wireless networks and other fields [5-10]. But, that exits a key escrow problem in the identity-based aggregation signature scheme. The key generation center holds each user's private key, and there is a security problem of maliciously forging the signature. In recent years, some effective certificateless aggregation signature schemes have been proposed [11-20], which are provably secure in random predictions, but its high computational cost makes it unsuitable for dynamic wireless networks, such as VANETs. Horng et al. [3] proposed a privacy preserving aggregation signature model, which is based on certificateless cryptography. However, it has been proved that their scheme is not safe for malicious KGC. However, the authors themselves have always claimed that their scheme is provably secure and can resist adaptively choosing message attack. But, in fact, their scheme is insecure against a malicious-but-passive KGC under existing security model. In 2016, Nie et al. Proposed a distributed certificateless aggregation signature scheme [4], but it has not been well applied in VANETs and cannot resist signature forgery attacks. The scheme in [9] does not use the hash function mapped to the point, and does not use the bilinear pair, but there is an inherent key escrow problem. Lai et al. [18] proposed group handover authentication, which better realized the overhead of instruction delivery and reduced the delay, but with the increase of vehicle density and mobile speed, the communication cost may also increase. Liu et al. And Zhang et al. For the first time, the secure communication in heterogeneous vehicle network is realized, however their schemes require OBUs (On Board Units) with high computation power [19,20]. In 2020，Ikram Ali's scheme can also effectively protect conditional privacy, However, as in [9], there is a key escrow problem. So far, the authentication scheme suitable for vehicular network has not been solved satisfactorily.

In this paper, an effective certificateless aggregation signature scheme suitable for vehicle network is proposed. In our scheme, the vehicle generates a pseudonym through RSU and communicates with surrounding nodes through the pseudonym. When necessary, law enforcement authorities can track the true identity of vehicle users through pseudonyms, realizing conditional privacy protection. Not only that, the experimental results show that the delay of message verification in our scheme is relatively low, but the computational cost is not high.

==2. Basic theory and definition==

===2.1 Bilinear pair===

Let <math display="inline">l</math> be a secure parameter,  <math display="inline">q</math> be a  <math display="inline">l</math> -bit prime number, <math display="inline">G_1</math> is a cyclic addition group of order <math display="inline">q</math> generated by <math display="inline">P</math>,  <math display="inline">G_2</math> is a cyclic addition group of order  <math display="inline">q</math> generated by  <math display="inline">Q</math> , and  <math display="inline">G_T</math> has the same order  <math display="inline">q</math> cyclic multiplication group. Let the discrete logarithm problem in groups  <math display="inline">G_1</math> , <math display="inline">G_2</math>,  <math display="inline">G_T</math> be a difficult problem. The mapping  <math display="inline">e:G_1\times G_2\rightarrow G_T</math>  is called a bilinear pair, if  <math display="inline">e</math> satisfies the following properties:

# Bilinearity: For arbitrary <math display="inline">a,b\in Z_q^\ast </math> , satisfy <math display="inline">e(aP,bQ)=e{\left(P,Q\right)}^{ab}</math>;
#  Non-degenerate: <math display="inline">e(P,Q)\not =1</math>;
# Easy to calculate properties: There is an effective algorithm to calculate  <math display="inline">e(P,Q)</math>.


In the above definition, if  <math display="inline">G_1\not =G_2</math>, the mapping  <math display="inline">e:G_1\times G_2\rightarrow G_T</math>  is called an asymmetric bilinear pair; if  <math display="inline">G_1=G_2=G_T</math>, the mapping  <math display="inline">e:G_1\times G_2\rightarrow G_T</math>  is called a symmetric bilinear pair which can be seen as a special case of asymmetric bilinear pairs. The bilinear map  <math display="inline">e</math> can be defined by Weil pairs or Tate pairs on a Special elliptic curve called hyper-singular curve on a finite field.

===2.2 Aggregate signature===

Aggregate signature is a variant of digital signature, which has the function of aggregation. That is to say, given  <math display="inline">n</math> users  <math display="inline">u_i</math> to individual signatures of  <math display="inline">n</math> messages  <math display="inline">m_i</math>, the generator of aggregate signature can aggregate these  <math display="inline">n</math> individual signatures into a unique short Signature  <math display="inline">\sigma </math>. Furthermore, given the aggregate signature, the identity  <math display="inline">u_i</math> of the participating signers, and the original message  <math display="inline">m_i</math>, it can believe that the user  <math display="inline">u_i</math> signed the message  <math display="inline">m_i</math>. Let AS={Setup, Key, Sign, Verify, AggS, AggV} be a six-tuple of polynomial time algorithm, where Setup, Key, Sign and Verify are common signature algorithms. The remaining algorithms are described as follows:

* AggS:The algorithm of aggregate signature generation implements at least three sub-functions: First, it can implement ordinary signature functions. Secondly, it can realize the aggregation function of message vector group  <math display="inline">\left(m_1,m_2,\cdots ,m_n\right)</math>, user vector group  <math display="inline">\left(u_1,u_2,\cdots ,u_n\right)</math> and individual signature vector group  <math display="inline">\left({\sigma }_1,{\sigma }_2,\cdots ,{\sigma }_n\right)</math>. Finally, it can aggregate and add new individual signatures.

* AggV: The algorithm of aggregate signature verification. Assuming that each user owns a private key  <math display="inline">SK</math> and a public key  <math display="inline">PK</math>, 


: if

: <math display="inline">AggV(PK_1,\cdots ,PK_n,m_1,\cdots ,m_n,AggS(PK_1,\cdots ,PK_n,m_1,\cdots ,m_n,Sign(SK_1,m_1),\cdots ,Sign(SK_n,m_n)))=</math><math>1</math>,

: It outputs "True", otherwise it outputs "False".


Aggregate signatures can also support incremental aggregation, that is, signatures <math display="inline">{\sigma }_1</math>, <math display="inline">{\sigma }_2</math> can be aggregated into  <math display="inline">{\sigma }_{12}</math>, and then can be aggregated with  <math display="inline">{\sigma }_3</math> to  <math display="inline">{\sigma }_{123}</math>. The schematic diagram of the principle of aggregate signature is shown in [[#img-2|Figure 2]] .

<div id='img-12'></div>
{| style="text-align: center; border: 1px solid #BBB; margin: 1em auto; width: auto;max-width: auto;"
|-
|style="padding:10px;"| [[Image:Review_388410900859-image41.png|288px]]
|- style="text-align: center; font-size: 75%;"
| colspan="1" style="padding-bottom:10px;"| '''Figure 2'''. Schematic diagram of aggregate signature
|}


Aggregate signatures can provide security services such as identity authentication, data integrity, and non-repudiation. In aggregate signatures, aggregation and signature are combined into one step, and the efficiency advantage is very obvious. Compress the signatures of any number of users into one signature, which greatly shorten the length of signature, and also reduce the network bandwidth requirements for transmitting signatures. Simplify the verification of any numbers of signatures to one verification, greatly reducing the workload of signature verification, so aggregate signatures greatly improve the efficiency of signature verification and transmission.

==3. Design of certificateless aggregate signature scheme==

Generally, the certificateless aggregate signature is composed of a key management center PKG, a signer, a signature aggregator, and a signature verifier. The scheme is composed of algorithms {System initialization, Key generation, Sign, Verify, Aggregate, Batch verification}. In addition to the above steps, the certificateless aggregation signature algorithm based on the VANETs designed in this paper also includes the vehicle registration algorithm, pseudonym generation algorithm and message verification algorithm. The specific description is as follows:

===3.1 System initialization===

Input the security parameter  <math display="inline">l</math>, the key management center KGC selects the additive cyclic group <math display="inline">G_1</math> and the multiplicative cyclic group  <math display="inline">G_2</math> whose order is prime  <math display="inline">q</math>, and defines the bilinear mapping  <math display="inline">e:G_1\times G_1\rightarrow G_2</math>, and selects the generator  <math display="inline">P\in G_1</math> of group  <math display="inline">G_1</math>. Then KGC randomly selects the master key  <math display="inline">s\in Z_q^\ast </math>, and calculates the public key  <math display="inline">P_K=s\cdot P</math> of  KGC, finally selects the secure hash function  <math display="inline">H_1,H_2:{\left\{0,1\right\}}^\ast \rightarrow Z_q^\ast </math>. The message set  <math display="inline">M={\left\{0,1\right\}}^\ast </math>. Each RSU selects its secret value  <math display="inline">y_i\in Z_q^\ast </math> and calculates the public key  <math display="inline">{\overline{P}}_i=y_i\cdot P</math>, then send to KGC. The parameter list  <math display="inline">params</math> of the system is disclosed as follows:

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| style="text-align: center;" |  <math display="inline">params=\lbrace G_1,G_2,e,P,P_K,H_1,H_2,PR_i\rbrace </math> 
|}

===3.2 Vehicle registration algorithm===

The algorithm is executed by the Road and Transport Authority (RTA). For each vehicle user whose identity information is  <math display="inline">ID_i</math>, in order to protect their privacy, RTA generates their false identity  <math display="inline">I{D^{{'}}}_i</math>. RTA selects hash function  <math display="inline">H_3:{\left\{0,1\right\}}^\ast \rightarrow G_1</math> and calculates  <math display="inline">I{D^{{'}}}_i=H_3(ID_i)</math>. When law enforcement agencies want to track down vehicles that are responsible, RTA can show the true identity of the vehicle.

===3.3 Key generation algorithm===

KGC executes this algorithm. KGC inputs the parameter list <math display="inline">params</math>, master key  <math display="inline">s</math>, and identity  <math display="inline">I{D^{{'}}}_i</math> to calculate part of the private key  <math display="inline">p_i=s\cdot I{D^{{'}}}_i</math> of the vehicle user. The vehicle user can determine the correctness by verifying whether  <math display="inline"> e(p_i,P)=e(I{D^{{'}}}_i,P_K)</math> is true, because

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| style="text-align: center;" | <math display="inline">e(p_i,P)=e(s\cdot I{D^{{'}}}_i,P)=e(I{D^{{'}}}_i,s\cdot P)=</math><math>e(I{D^{{'}}}_i,P_K)</math> 
|}

The algorithm generates the secret value and public key of the vehicle user in VANETs, and once the vehicle travels to a new area, the new RTA can update the user's false identity. The user  <math display="inline">U_i</math> randomly selects a secret value  <math display="inline">x_i\in Z_q^\ast </math> and calculates its public key <math display="inline">P_i=x_i\cdot P</math>.

===3.4 Pseudonym generation algorithm===

The algorithm is executed by the roadside unit RSU. RSU inputs the identity  <math display="inline">I{D^{{'}}}_i</math> of the vehicle user  <math display="inline">U_i</math> and parameter  <math display="inline">params</math>, and randomly chooses  <math display="inline">a_i\in Z_q^\ast </math>, then calculates

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math display="inline">{\mbox{M1}}_i=a_i\cdot I{D^{{'}}}_i</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (1)
|}

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math display="inline">W_i=H_2(\mbox{M}1_i)</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (2)
|}

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math display="inline">\mbox{M}2_i=a_i\cdot W_i</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (3)
|}


Finally, RSU outputs the pseudonym

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math display="inline">\mbox{M}_i=\mbox{M}1_i+\mbox{M}2_i</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (4)
|}

===3.5 Signature algorithm===

To sign the outgoing message  <math display="inline">m_i</math>, the vehicle user  <math display="inline">U_i</math> needs to perform the following calculation process.  <math display="inline">U_i</math> randomly chooses  <math display="inline">r_i\in Z_q^\ast </math>, and calculates

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math display="inline">U_i=r_i\cdot P</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (5)
|}

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math display="inline">h_i=H_1(m_i,\mbox{M}1_i,P_i,U_i)</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (6)
|}

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math display="inline">V_i=p_i\cdot \mbox{M}2_i+h_i\cdot r_i\cdot P_K+h_i\cdot x_i\cdot {\overline{P}}_i</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (7)
|}

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math display="inline">{\sigma }_i=(U_i,V_i)</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (8)
|}

and outputs the signature of this message  <math display="inline">\left(m_i,{\sigma }_i\right)</math>.

===3.6 Verification algorithm===

Inputs the signature of this message <math display="inline">\left(m_i,{\sigma }_i\right)</math>, Public key <math display="inline">P_i</math>, Partial pseudonym  <math display="inline">\mbox{M}1_i</math> and parameter  <math display="inline">params</math>. The signature verification process needs to calculate the following values:

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math>h_i=H_1(m_i,\mbox{M}1_i,P_i,U_i)</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (9)
|}

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math>W_i=H_2(\mbox{M}1_i)</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (10)
|}

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math>e(V_i,P)\overset{?}{=}e(\mbox{M}1_i\cdot W_i+h_i\cdot U_i,P_K)\mbox{ }e(h_i\cdot P_i,{\overline{P}}_i)</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (11)                                                                                   
|}

If the equation holds, the signature is valid, otherwise the signature verification fails. The correctness is proved as follows:

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| <math>\begin{array}{l} {L.H.S=e(p_{i} \cdot {\rm M}2_{i} +h_{i} \cdot r_{i} \cdot P_{k} +h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P)} \\ {\; \; \; \; \; \; \; =e(p_{i} \cdot {\rm M}2_{i} ,P)\; e(h_{i} \cdot r_{i} \cdot P_{k} ,P)\; e(h_{i} \cdot x_{i} \cdot \bar{P}_{i} ,P)} \\ {\; \; \; \; \; \; \; =e(s\cdot ID'_{i} \cdot a_{i} \cdot W_{i} ,P)\; e(h_{i} \cdot r_{i} \cdot s\cdot P,P)\; e(h_{i} \cdot x_{i} \cdot y_{i} \cdot P,P)} \\ {\; \; \; \; \; \; \; =e(a_{i} \cdot ID'_{i} \cdot W_{i} ,s\cdot P)\; e(h_{i} \cdot r_{i} \cdot P,s\cdot P)\; e(h_{i} \cdot x_{i} \cdot P,y_{i} \cdot P)} \\ {\; \; \; \; \; \; \; =e({\rm M}1_{i} \cdot W_{i} ,P_{K} )\; e(h_{i} \cdot U_{i} ,P_{K} )\; e(h_{i} \cdot P_{i} ,\bar{P}_{i} )} \\ {\; \; \; \; \; \; \; =e({\rm M}1_{i} \cdot W_{i} +h_{i} \cdot U_{i} ,P_{K} )\; e(h_{i} \cdot P_{i} ,\bar{P}_{i} )=R.H.S} \end{array}</math>
|}

===3.7 Aggregate signature algorithm===

After inputs the signatures of  <math display="inline">n</math> vehicle users  <math display="inline">\left(m_i,{\sigma }_i\right)</math>, the aggregator outputs signature  <math display="inline">\left(m,\sigma \right)</math>, where <math display="inline">m=\lbrace m_1,m_2,\cdots ,m_n\rbrace </math>, <math display="inline">\sigma =(U_1,U_2,\cdots ,U_n,V)</math>,  <math display="inline">V={\sum }_{i=1}^nV_i</math>.

===3.8 Batch verification algorithm===

After receiving the aggregated signatures of  <math display="inline">n</math> users, the RSU verifies through the following steps:

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math display="inline">h_i=H_1(m_i,\mbox{M}1_i,P_i,U_i)</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (12)
|}

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math display="inline">W_i=H_2(\mbox{M}1_i)</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (13)
|}

{| class="formulaSCP" style="width: 100%; text-align: center;" 
|-
| 
{| style="text-align: center; margin:auto;" 
|-
| <math>e(V,P)\overset{?}{=}e({\sum }_{i=1}^n\left(\mbox{M}1_i\cdot W_i+\right. </math><math>\left. h_i\cdot U_i\right),P_K)e({\sum }_{i=1}^n\left(h_i\cdot P_i\right),\overline{P})</math>
|}
| style="width: 5px;text-align: right;white-space: nowrap;" | (14)
|}

If the above equation is true, it indicates that the aggregation signature is valid, otherwise the signature verification fails.

==4. Analysis of security and efficiency==

We compare the aggregate signature scheme proposed in this paper with several schemes currently used in VANET. In contrast, the verification algorithm of scheme in [4] requires a large computational cost and cannot resist signature forgery attacks. Schemes in [19,20] have high computational efficiency, but they do not satisfy the traceability of signatures. Moreover, schemes in [9,10] are identity-based cryptosystems and suffer from inherent key escrow problem. In addition to satisfying the authentication of messages and the unforgeability of signatures, the scheme proposed in this paper has the following two characteristics.

===4.1 Anonymity===

Every vehicle user  <math display="inline">U_i</math> needs to register at the RTA of the Road Traffic Administration. RTA uses the hash function  <math display="inline">H_3</math> to associate the user ’s real  <math display="inline">ID_i</math> and false  <math display="inline">ID_i{}^{{'}}</math>, while the roadside unit RSU selects the random number  <math display="inline">a_i\in Z_q^\ast </math> as the false  <math display="inline">ID_i^{'}</math>. A pseudonym  <math display="inline">M_i</math> was generated. Therefore, no one except RSU can associate the user's false  <math display="inline">ID_i^{'}</math> and pseudonym  <math display="inline">M_i</math>, and no one except RTA can associate the user's real  <math display="inline">ID_i</math> and false  <math display="inline">ID_i{}^{{'}}</math>. Therefore, the scheme proposed in this paper satisfies the anonymity of vehicle users.

===4.2 Traceability===

In the signature scheme proposed in this article, once the verification algorithm fails or the vehicle user commits a crime, the RSU can submit the false identity  <math display="inline">ID_i{}^{{'}}</math> of the vehicle user  <math display="inline">U_i</math> to RTA. The RTA queries the registration information of the vehicle user to track the corresponding true identity  <math display="inline">ID_i</math>. In the event of disputes or doubts, RTA uses the one-way nature of the hash function to verify the true identity of malicious vehicle users by calculating <math display="inline">I{D^{{'}}}_i=H_3(ID_i)</math>, which enables traceability of illegal vehicle users. [[#tab-1|Table 1]] gives a comparison of the security of several schemes. It can be seen that the scheme in this paper has the above-mentioned excellent properties.

<div class="center" style="font-size: 75%;">'''Table 1. '''Comparison of security</div>

<div id='tab-1'></div>
{| class="wikitable" style="margin: 1em auto 0.1em auto;border-collapse: collapse;font-size:85%;width:auto;" 
|-style="text-align:center"
! !! [4] !! [9] !! [10] !! Our scheme
|-
|  style="text-align: left;"|Communication mode
|  style="text-align: center;"|V2I
|  style="text-align: center;"|V2I
|  style="text-align: center;"|V2V
|  style="text-align: center;"|V2I
|-
|  style="text-align: left;"|Authentication
|  style="text-align: center;"|Yes
|  style="text-align: center;"|Yes
|  style="text-align: center;"|Yes
|  style="text-align: center;"|Yes
|-
|  style="text-align: left;"|Anonymity
|  style="text-align: center;"|Yes
|  style="text-align: center;"|Yes
|  style="text-align: center;"|No
|  style="text-align: center;"|Yes
|-
|  style="text-align: left;"|Traceability
|  style="text-align: center;"|No
|  style="text-align: center;"|No
|  style="text-align: center;"|Yes
|  style="text-align: center;"|Yes
|-
|  style="text-align: left;"|Resist forgery attack
|  style="text-align: center;"|Yes
|  style="text-align: center;"|Yes
|  style="text-align: center;"|Yes
|  style="text-align: center;"|Yes
|-
|  style="text-align: left;"|Certificateless
|  style="text-align: center;"|Yes
|  style="text-align: center;"|No
|  style="text-align: center;"|No
|  style="text-align: center;"|Yes
|}


We give a comparison of the calculation costs of several certificateless aggregate signature schemes currently used in VANET, as shown in [[#tab-2|Table 2]]. We only select four of the more time-consuming operations. Let <math display="inline">B</math>,  <math display="inline">S</math>,  <math display="inline">P_M</math>, and  <math display="inline">E</math> represent the operation of a bilinear map, a scalar multiplication, a modular exponentiation, and a point multiplication respectively in G. These four operations run on an Intel i7 3.07GHz machine with approximately 3.21ms, 1.79ms, 0.442ms, 1.9ms. It can be seen that when there is more traffic, the calculation cost of our scheme is relatively low. The calculation time of other operations such as the hash function is very small and can be ignored. In the table, Sync represents the normal transmission mode, Ad hoc represents the ad hoc network transmission mode, and  <math display="inline">n</math> represents the number of vehicle users.

<div class="center" style="font-size: 75%;">'''Table 2. '''Comparison of calculation cost</div>

<div id='tab-2'></div>
{| class="wikitable" style="margin: 1em auto 0.1em auto;border-collapse: collapse;font-size:85%;width:auto;" 
|-style="text-align:center"
!  Scheme!!Type!!Signature!!Verification!!Aggregate verification
|-
|  style="text-align: center;"|[4]
|  style="text-align: center;"|Sync
|  style="text-align: center;"|3B
|  style="text-align: center;"|4B+S
|  style="text-align: center;"|4B+nS
|-
|  style="text-align: center;"|[19]
|  style="text-align: center;"|Adhoc
|  style="text-align: center;"|2B
|  style="text-align: center;"|2B+3P<math>_{M}</math> 
|  style="text-align: center;"|2B+3nP<math>_{M}</math> 
|-
|  style="text-align: center;"|[20]
|  style="text-align: center;"|Adhoc
|  style="text-align: center;"|3E
|  style="text-align: center;"|4E
|  style="text-align: center;"|3n+1)E
|-
|  style="text-align: center;"|Our scheme
|  style="text-align: center;"|Adhoc
|  style="text-align: center;"|3S
|  style="text-align: center;"|3B+2S
|  style="text-align: center;"|3B+2nS
|}


We simulated the proposed scheme in windows + OPNET IT Guru release 9.1.a and compared several VANET-based certificateless aggregate signature schemes, as shown in [[#img-3|Figure 3]]. By comparing the traffic flow entering the same roadside unit RSU with the verification delay time, we can see that when the traffic load increases, our scheme verifies the most signatures, that is, the information loss rate is the lowest.

<div id='img-1'></div>
{| style="text-align: center; border: 1px solid #BBB; margin: 1em auto; width: auto;max-width: auto;"
|-
|style="padding:10px;"|  [[Image:Review_388410900859-image137.png|390px]]
|- style="text-align: center; font-size: 75%;"
| colspan="1" style="padding-bottom:10px;"| '''Figure 3'''. Traffic density versus verification delay
|}

=5.Conclusion=

The algorithm of aggregate signature aggregates the signatures of many different users into one signature, and only needs to verify the aggregated signature to determine whether the received signature is legal, which greatly improves the efficiency of message verification. This advantage makes it self-organized in the vehicle. It has good application value in the network. The secure and effective certificateless aggregate signature scheme proposed in this paper has the double advantages of certificateless cryptosystem and aggregate signature. The scheme in this paper effectively combines the privacy protection of vehicle users and the traceability of illegal users, so-called conditional privacy protection. According to the results of simulation, compared with other existing solutions, the solution in this paper has the advantages of low communication cost, low calculation cost and short verification delay, so it is more suitable for resource-constrained network environments such as VANETs.

==Acknowledgement ==

This work has been partially supported by Outstanding Young Talent Program in Universities  of Anhui (grant no. gxyqZD2016330).

==Conflicts of Interest ==

The authors declare no conflict of interest.

==References ==

[1] LIU Zhe, LIU Jianwei, WU Qianhong, et al. Secure and efficient distributed pseudonym generation in VANET , Journal on Communica -tions, 2015, 36(11):33-40.

[2] Z. Lu, G. Qu, Z. Liu, A survey on recent advances in vehicular network security, trust, and privacy, IEEE Trans. Intel. Transp. Syst.2019, 20 (2) :760–776.

[3] S. J. Horng et al., An efficient certificateless aggregate signature with conditional privacy preserving for vehicular sensor networks, Information Sciences,2015(317): 48-66.

[4] NIE H, LI Y, CHEN W, et al. NCLAS: a novel and efficient certificateless aggregate signature scheme [J]. Security & Communication Networks, 2016, 9(16):3141-3151.

[5] DU Hongzhen, An efficient and secure aggregate signature scheme for vehicular Ad hoc network. Henan Science, 2016, 34(4):481-485.

[6] SHEN L, MA J, LIU X, et al. A provably secure aggregate signature scheme for healthcare wireless sensor networks. Journal of Medical Systems, 2016, 40(11):244-247.

[7] SHEN L, MA J, LIU X, et al. A secure and efficient ID-based aggregate signature scheme for wireless sensor networks. IEEE Internet of Things Journal，2017, 4(2):546-554.

[8] IWASAKI T, YANAI N, INAMURA M, et al. Tightly-secure identity-based structured aggregate signature scheme under the computational Diffie- Hellman assumption. International Conference on Advanced Information Networking and Applications. IEEE, Australia, 2016:669-676.

[9] S. Wang, N. Yao, LIAP: A local identity-based anonymous message authentication protocol in VANETs, Comput. Commun. 2017(112): 154–164.

[10] Ikram Ali, Fagen Li, An efficient conditional privacy-preserving authentication scheme for vehicle to infrastructure communication in VANETs. Vehicular Communications, 2020(22):1-15.

[11] TU H, HE D, and HUANG B. Reattack of a certificateless aggregate signature scheme with constant pairing computations. The Scientific World Journal, 2014(9):1-10.

[12] Shim K A. On the security of a certificateless aggregate signature scheme. International Journal of Distributed Sensor Networks, 2011(10):1136-1138.

[13] HE D, TIAN M, and CHEN J. Insecurity of an efficient certificateless aggregate signature with constant pairing computations. Information Sciences, 2014, 268: 458-462.

[14] ZHANG Yulei, LI Chenyi, WANG Caifen, et al. Security analysis and improvements of certificate -less aggregate signature schemes. Journal of Electronics & Information Technology, 2015, 37(8): 1994-1999.

[15] DU Hongzhen, HUANG Meijuan, and WEN Qiaoyan. Efficient and Provably-Secure certificateless aggregate signature scheme , Acta Electronica Sinica, 2013,41(1): 72-76.

[16] SHEN H, CHEN J, SHEN J, et al. Cryptanalysis of a certificateless aggregate signature scheme with efficient verification. Security & Communication Networks, 2016, 9(13):2217-2221.

[17] Wang L, Chen K, Long Y, et al. Cryptanalysis of a certificateless aggregate signature scheme. Security & Communication Networks, 2016, 9(11):1353-1358.

[18] C. Lai, H. Zhou, N. Cheng, X.S. Shen, Secure group communications in vehicular networks: a software-defined network-enabled architecture and solution, IEEE Veh. Technol. Mag. 2017(12): 40–49.

[19] J. Liu, Y. Yu, Y. Zhao, J. Jia, S. Wang, An efficient privacy preserving batch authentication scheme with deterable function for VANETs, in: International Conference on Network and System Security, Springer, 2018: 288–303.

[20] X. Zhang, L. Mu, J. Zhao, C. Xu, An efficient anonymous authentication scheme with secure communication in intelligent vehicular ad-hoc networks, KSII Trans. Int. Inf. Syst. 2019(6): 3280–3298.