Abstract
In unmanned aerial vehicle networks (UAVNs), unmanned aerial vehicles with restricted computing and communication capabilities can perform tasks in collaborative manner. However, communications in UAVN confront many security issues, for example, malicious entities may launch impersonate attacks. In UAVN, the command center (CMC) needs to perform mutual authentication with unmanned aerial vehicles in clusters. The aggregator (AGT) can verify the authenticity of authentication request from CMC; then, the attested authentication request is broadcasted to the reconnaissance unmanned aerial vehicle (UAV) in the same cluster. The authentication responses from UAVs can be verified and aggregated by AGT before being sent to CMC for validation. Also, existing solutions cannot resist malicious key generation center (KGC). To address these issues, this paper proposes a pairing-free authentication scheme (CLAS) for UAVNs based on the certificateless signature technology, which supports batch verification at both AGT and CMC sides so that the verification efficiency can be improved greatly. Security analysis shows that our CLAS scheme can guarantee the unforgeability for (attested) authentication request and (aggregate) responses in all phases. Performance analysis indicates that our CLAS scheme enjoys practical efficiency.
1. Introduction
Unmanned aerial vehicles in UAVN have been widely used in many civilian and military fields, for example, data collection, communication relay, and military electronic reconnaissance [1]. Unmanned aerial vehicles can be classified into three categories according to the working mode, namely, unmanned aerial vehicles under the control of a remote operator, under the supervision of a remote supervisor, and without an operator and supervisor. UAVNs can be deployed in mesh topology or multistar topology [2]. With the mesh topology, all unmanned aerial vehicles are connected to CMC directly, where all communication between unmanned aerial vehicles and CMC may cause network congestion. Although with the mesh topology, each unmanned aerial vehicle can communicate with each other, it is hard to be expanded and controlled [3]. With the multistar topology, each unmanned aerial vehicle is connected to CMC; thus, any illegal requests or responses in UAVNs can be easily detected.
However, when deployed in an open communication environment, the UAVN system confronts many security issues [4, 5]. Due to multiple connections among unmanned aerial vehicles, a malicious entity may control some unmanned aerial vehicle or launch impersonate attacks. Thus, it is important to enforce a secure and efficient authentication mechanism in UAVNs [6, 7]. Recently, Wang et al. [8] proposed an identity-based authentication scheme, which did not consider the verification mechanisms at the AGT side for validating the real sources of the authentication request from CMC and responses from UAVs. Li et al. [9] designed an identity-based aggregate authentication framework in bilinear groups, where the private keys of UAVs are generated by KGC. Thus, malicious KGC may launch attacks by sending illegal authentication request to AGTs and UAVs.
1.1. Our Contributions
To address the abovementioned issues, this paper proposes a certificateless pairing-free aggregate authentication scheme (CLAS) for UAVNs. In CLAS, KGC is responsible for generating partial private keys for all entities including CMC, AGTs, and UAVs. Each AGT acts as the cluster head of some cluster and plays the role of an intermediate between CMC and UAVs in the respective cluster. Each authentication request from CMC can be validated by AGT, which is then attested and broadcasted to UAVs in its administrative domain. A verification process can be run by each UAV so that the true source of the (forwarded) authentication request can be validated. AGT can aggregate all responses of UAVs in its administrative cluster before performing verification procedure in batch. Then, the response of AGT is further combined with the aggregated responses of UAVs, which can be validated by CMC in batch to complete the authentication process.
This paper describes a concrete CLAS construction based on the certificateless signature technology. Security analysis shows that our CLAS construction can protect malicious entity from forging the authentication request and responses of others and can resist against the malicious KGC. Performance comparison shows that our CLAS construction enjoys better computational efficiency compared with Wang et al.’s scheme [8] and Li et al.’s scheme [9].
1.2. Related Works
Taking advantages of recent advancement and development in information and communication technology, unmanned aerial vehicles have been employed to perform some special tasks in real-world applications [10]. In [11], Islam and Shin proposed a blockchain-based solution for safe healthcare, which uses the unmanned aerial vehicle (UAV) to collect health data (HD) from users. Liu et al. [1] presented a detailed survey on the opportunities and challenges of IoE supported by unmanned aerial vehicles. Jiang et al. [12] proposed a trust-based energy efficient data collection with the unmanned aerial vehicle (TEEDC-UAV) scheme, which can prolong lifetime in a trusted way. In the TEEDC-UAV scheme, an ant colony-based unmanned aerial vehicle (UAV) trajectory optimization algorithm was proposed, which constituted the most data anchor points in the working field with the shortest trajectory possible. In view of the untrusted broadcast features and wireless transmission of UAV networks, a novel privacy-preserving secure spectrum trading and sharing scheme based on blockchain technology is proposed in [13].
For the Internet of Drones (IoD) infrastructure, Cho et al. [14] proposed a framework called SENTINEL (Secure and Efficient autheNTIcation for uNmanned aErial vehicLes). Khanh et al. [15] presented a safe and effective authentication mechanism suitable for the dynamic environment of the unmanned aerial vehicle. In order to solve the information security problem of unmanned aerial vehicle ad-hoc network communication, Sun et al. [2] introduced an efficient and energy-saving distributed network architecture based on clustering stratification. Owing to the unreliable wireless channel and high-dynamic topology of Unmanned Aerial Vehicles Ad-Hoc Network (UAANET), the loss of some certain group key broadcast messages by nodes occurs frequently. Therefore, Li et al. [16] proposed a mutual-healing group key distribution scheme based on the blockchain. Yang et al. [17] investigated degradation-of-QoS attacks in vehicular ad hoc networks, where the attacker is able to relay the authentication exchanges but cannot relay the service afterwards. In [18], Gope et al. proposed a novel anonymous authentication scheme for RFID-enabled UAV applications using Physically Unclonable Functions (PUF).
Al-Riyami et al. [19] first introduced and made concrete the concept of certificateless public key cryptography (CL-PKC), a model for the use of public key cryptography which avoids the inherent escrow of identity-based cryptography. Baek et al. [20] considered a relaxation of the original model of CLPKE and proposed a new CLPKE scheme that does not depend on the bilinear pairings. In order to ensure security for interactions between these smart things, Yeh et al. [21] presented a certificateless signature scheme for smart objects in IoT-based pervasive computing environments. Jia et al. [22] made an improvement on the scheme of Yeh et al.’s certificateless signature scheme; they presented an improved scheme and demonstrated its unforgeability against superadversaries in the random oracle model. Zhao et al. [23] presented an advanced efficient CLAS scheme with elliptic curve cryptography for the IoV environment. Furthermore, their scheme used pseudonyms in communications to prevent vehicles from revealing their identity. Shu et al. [24] presented a certificateless aggregate signature scheme for blockchain-based MCPS, which can realize the authentication of related medical staffs, medical equipment, and medical apps, ensure the integrity of medical records, and support the secure storage and sharing of medical information.
1.3. Paper Organization
The structure of this paper is organized as follows. In Section 2, we introduce the system architecture and system requirements for CLAS. A concrete CLAS construction is presented in Section 3, followed by its security and efficiency analysis in Section 4. Finally, Section 5 concludes the paper.
2. System Architecture and Requirements
This section formalizes the architecture of CLAS and summarizes its system requirements.
2.1. System Architecture
As shown in Figure 1, there are four types of entities in a CLAS system, namely, key generation center (KGC), command center (CMC), reconnaissance unmanned aerial vehicles (UAVs), and aggregators (AGTs). KGC is assumed to be fully trusted by all the entities, which is responsible for initializing the CLAS system by generating system public parameters and producing partial private keys for all entities in UAVNs. After system initialization, CMC performs the mutual authentication process with unmanned aerial vehicles before assigning tasks. CMC initializes the authentication process so that AGT can validate, attest, and broadcast authentication request to its administrated UAVs.
As the intermediary between CMC and UAV, AGT has the computing and communication capabilities to manage its UAV cluster. UAV only has limited short-distance communication capability; thus, its communication with CMC is performed via the AGT in the cluster. Before responding to the authentication request of CMC, each UAV can verify its true source and the attested request. The responses of UAVs in the same cluster can be validated by AGT in batch. Then, the response of AGT can be further combined with that of UAVs so that the aggregated response is sent to CMC for validation.
2.2. System Requirements
Similar to [25], we define two types of adversaries for the CLAS system, namely, Type-I adversary and Type-II adversary. A Type-I adversary acts as an outsider who can replace the public keys of CMC, AGT, and UAV but cannot access the master secret key, whereas a Type-II adversary acts as the KGC that can access the master secret key but cannot replace the public keys of CMC, AGT, and UAV. A CLAS system must satisfy the following system requirements. Unforgeability of authentication request: in the authentication process, for the authentication request generated by CMC, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating CMC to forge an authentication request. Unforgeability of attested request: for the attested authentication request of AGT, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating AGT to forge an attested authentication request. Unforgeability of response: for the responses from UAVs in its administrative cluster of AGT, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating some UAV to forge a response. Unforgeability of aggregate response: for the attested authentication request of some AGT, it should be guaranteed that it is existentially unforgeable against Type-I adversary. That is, any entity cannot launch attacks by impersonating AGT to forge an aggregate response. Resistance against malicious KGC: for the whole authentication procedure, it should be guaranteed that it is existentially unforgeable against Type-II adversary. That is, malicious KGC cannot forge a valid signature of CMC, AGT, or UAV.
A correct CLAS construction should satisfy the following conditions:(1)For the partial private key sent by KGC, it can be successfully verified by respective entity including CMC, AGTs, and UAVs(2)For the authentication request generated by CMC, it can be successfully validated by AGTs(3)For the attested authentication request forwarded by AGT, it can be successfully validated by UAVs in the same cluster(4)For the responses of UAVs, they can be validated by AGT in the same cluster(5)For the aggregate response from AGT, it can be successfully validated by CMC
3. CLAS Construction
This section describes our concrete CLAS construction. The authentication process in UAVNs is shown in Figure 2.
The Discrete Logarithm Assumption in Elliptic Curve (ECDLP): let be an elliptic curve group with prime order . Given , any probabilistic polynomial time algorithm would have negligible probability in computing such that .
3.1. System Setup
On inputting a security parameter , KGC chooses an additive group with prime order on some elliptic curve, where is a generator of . Then, KGC chooses randomly and computes
KGC continues to choose four collision-resistant hash functions for . Finally, KGC publishes the system parameters and keeps the master secret key secret.
3.2. Key Generation for CMC
KGC sets the partial private key for the control center as follows. KGC chooses a random number and computes
Then, KGC sends the partial private key to CMC through a secure channel. CMC can validate the partial private key as follows:
CMC sets a secret value and generates its public key and private key as follows. CMC chooses a random number and computes
Then, CMC sets and .
3.3. Key Generation for Unmanned Aerial Vehicles
Let be an unmanned aerial vehicle. For the ease of representation, let be an AGT and be UAVs in the administration domain of . KGC sets a partial private key for unmanned aerial vehicles as follows.
KGC chooses a random number and computeswhere
Then, KGC sends the partial private key to through a secure channel. The unmanned aerial vehicle can validate the partial private key as follows:
The unmanned aerial vehicle sets a secret value and generates its public key and private key as follows. chooses a random number and computeswhere
Then, the unmanned aerial vehicle sets and .
3.4. Authentication Request
Let denote the request information chosen by CMC, which contains the timestamp. CMC randomly picks and computes
Then, CMC sends the authentication request to AGTs.
3.5. Request Forwarding
After receiving the request from CMC, each AGT validates its authenticity by checking the following equality:
If it holds, then AGT accepts the authentication request from CMC, otherwise terminates. AGT randomly chooses and computeswhere
At last, AGT broadcasts the tuple of attested authentication request to all UAVs in its administrative domain.
3.6. UAV Response
Once received from AGT , each UAV verifies its authenticity by checking the following equality:where
If it holds, then UAV accepts the authentication request from CMC, otherwise terminates. randomly picks and computeswhere
Then, UAV sends the response tuple to AGT .
3.7. AGT Aggregation
Upon receiving the response tuples from the controlled UAVs , AGT computes
Then, AGT verifies the authenticity of the received response tuples in a batch as follows:where
If it holds, then all response tuples of are valid; otherwise, validates each response tuple in individual to find the invalid one. AGT continues to pick a random element and computewhere
Then, AGT sends the aggregate response to CMC.
3.8. CMC Verification
Once received the aggregate response from AGT , CMC validates its authenticity by checking the following equality:where
If it holds, then AGT and UAVs are all accepted as legitimate.
Theorem 1. The proposed CLAS construction is correct.
Proof 1. To prove the correctness of the proposed CLAS construction, it only needs to show that equalities (16), (21), (30), and (37) are satisfied.(1)For the authentication request generated by CMC, equality (16) satisfies as follows:(2)For the attested authentication request from AGT , equality (21) satisfies as follows:(3)For the response tuples from the controlled UAVs , equality (30) holds as follows:(4)For the aggregate response tuple from AGT , equality (37) holds as follows:Thus, the proposed CLAS construction is correct.
4. System Analysis
This section analyzes the security and performance of the proposed CLAS construction.
4.1. Security Analysis
Theorem 2. Assume that the ECDLP assumption holds in cyclic group. The proposed CLAS construction can guarantee the unforgeability of the authentication request from CMC.
Proof 2. In the authentication request generated by CMC, the element is considered to be a certificateless signature of . It can be seen that can serve as the common signature in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes that the ECDLP assumption holds in additive group of elliptic curve points. Therefore, any attacker cannot forge a valid authentication request of CMC without knowing public key , which implies the unforgeability of the authentication request from CMC can be guaranteed.
Theorem 3. Assume that the ECDLP assumption holds in cyclic group. The proposed CLAS construction can guarantee the unforgeability of the attested authentication request from AGT.
Proof 3. In the attested request generated by AGT, the element is considered to be a certificateless signature on . It can be seen that can serve as the common signature in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes that the ECDLP assumption holds in additive group of elliptic curve points. Therefore, any attacker cannot forge a valid attested request or response of AGT without knowing public key , which implies the unforgeability of the attested authentication request from AGT can be guaranteed.
Theorem 4. Assume that the ECDLP assumption holds in cyclic group. The proposed CLAS construction can guarantee the unforgeability of the responses from UAVs.
Proof 4. For the response tuple generated by UAV , it is considered to be a certificateless signature on . It can be seen that can serve as the common signature in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes that the ECDLP assumption holds in additive group of elliptic curve points. Therefore, any attacker cannot forge a valid authentication response of UAV without knowing public key , which implies the unforgeability of the responses from UAVs can be guaranteed.
Theorem 5. Assume that the ECDLP assumption holds in cyclic group. The proposed CLAS construction can guarantee the unforgeability of the aggregate response from AGT.
Proof 5. For the aggregate response tuple generated by CMC, it is considered as the aggregate signature on individual responses. It can be seen that can serve as the common signature in Thumbur et al.’s scheme [26]. As proved in Theorem 1 in [26], their scheme is existentially unforgeable against Type-I adversary, which assumes the ECDLP assumption holds in additive group of elliptic curve points. Therefore, any attacker cannot forge a valid aggregate response of AGT without knowing public key , which implies the unforgeability of the aggregate response from AGT can be guaranteed.
Theorem 6. Assume that the ECDLP assumption holds in cyclic group. The proposed CLAS construction can be resistant to malicious KGC.
Proof 6. For the partial private key generated by KGC, it is considered as a Schnorr signature [27] on . It can be seen that can serve as the common signature in [26]. As proved in Theorem 2 in [26], their scheme is existentially unforgeable against Type-II adversary, which assumes that the ECDLP assumption holds in additive group of elliptic curve points. Therefore, any malicious KGC cannot forge valid partial private key of UAVs without knowing master secret key ; thus, the authenticity of KGC can be guaranteed in producing a partial private key.
4.2. Functional Comparison
Wang et al. [8] proposed an identity-based aggregate authentication scheme for UAVNs in bilinear groups. In [8], all UAVs are able to communicate with the CMC through their respective AGTs in the cluster, to perform valid authentication. There is no mechanism for AGT to validate the authenticity of CMC before forwarding authentication request to UAVs in its administrative domain. Furthermore, when individual responses are aggregated from UAVs in the respective cluster, the AGT does not verify the authenticity of those responses.
Li et al. [9] proposed an aggregate authentication scheme, where the above two mechanisms are introduced to enhance the security of authentication in UAVNs. Note that CMC may be malicious in generating keys for UAVs, which means their scheme cannot resistant against malicious KGC. While in our CLAS construction, the partial private key for UAVs are generated by KGC. The detailed comparison on the functionalities among Wang et al.’s proposal [8], Li et al.’s proposal [9], and our CLAS construction is summarized in Table 1.
4.3. Theoretical Comparison
Let be the time of one scalar point multiplication and be one bilinear pairing operation. For the key generation procedure, Wang et al.’s scheme [8] and Li et al.’s scheme [9] require and scalar point multiplications for entities, respectively. In the request verification procedure, 2 bilinear pairing operations are both required in Wang et al.’s scheme [8] and Li et al.’s scheme [9]. For the aggregate verification by AGT procedure, Li et al.’s scheme [9] requires scalar point multiplications and 3 bilinear pairing operations. In the aggregate verification by CMC procedure, compared with Li et al.’s scheme [9], our scheme requires only scalar point multiplications. More details for comparsion on computation costs are summarized in Table 2.
4.4. Experimental Performance
To evaluate the computation cost of our CLAS construction, we conduct experiments using the Java Pairing-Based Cryptography Library (JPBC, http://gas.dia.unisa.it/projects/jpbc/), on a platform with Microsoft Windows 10 operating system, Intel(R) Core(TM) i5-6500 CPU @ 3.20 GHz, and 12 GB RAM. The elliptic curve is of Type A such that is a 160 bit prime, and the element size in group is 512 bits.
The performance of the procedures of our CLAS construction is depicted in Figure 3, which are system setup (Setup), key generation (SUMkgen), authentication request generation (REQgen) and attestation (REQfwd), and RAV response (UAVresp). The SUMkgen stage consists of three algorithms, partial key generation for UAV (KGCkgen), key verification for UAV (UAVerify), and key generation for UAV (UAVkgen). The setup algorithm is used to initialize the CLAS system. We can see that the majority of the computation depends on , which takes roughly 144 msec. The SUMkgen algorithm is used to generate public and private keys for UAVs, which efficiency depends on the UAVerify and the UAVkgen algorithms. Since the partial private key is generated by KGC, the time for UAVs to generate public and private keys is reduced, which is approximately 24 msec in experiments.
The REQgen algorithm can be run to generate authentication request. Its performance mainly depends on the computation of , requiring one scalar point multiplication, whereas Wang et al.’s scheme [8] and Li et al.’s scheme [9] both cost two scalar point multiplications. As depicted in Figure 3, an authentication request is able to be transmitted in less than 24 msec. In the stage of REQfwd, before producing attested request, AGT verifies the authenticity of the authentication request from CMC by checking equality (16), which takes two scalar point multiplications. It requires AGT to forward the request in roughly 0.07 seconds. Before generating a response, each UAV validates the authenticity of the attested request received from its administrative AGT, requiring 5 scalar point multiplications. As a result, it takes about 0.15 seconds for each UAV to run the response procedure, while Li et al.’s scheme [9] requires more computational costs, i.e., 4 bilinear pairing operations.
In the response aggregation procedure, AGT needs to aggregate the elements in the received response tuples. It can be seen that prior to the batch verification of these responses, only scalar point multiplications are required in equality (30), as compared to Li et al.’scheme [9]. In the simulation, a variety of scenarios for the number of unmanned aerial vehicles are considered, that is, , and the amount of UAVs consists of one AGT and UAVs. AGT aggregates and verifies response tuples of UAVs and further aggregates all the response tuples including its response. The experimental results are shown in Figure 4, which indicates a linear correlation between the computation time of this process and the number of unmanned aerial vehicles in a single cluster.
For the process of aggregating verification by CMC, Figure 5 shows the computation time that the CMC verifies the aggregate response from AGT for a single cluster. We also consider multiple cases where the number of unmanned aerial vehicles in a single cluster are , respectively. As shown in equality (37), CMC is required to compute scalar point multiplications. It can be seen from Figure 5 that there is also a linear correlation between the computation time of this process and the number of unmanned aerial vehicles in a single cluster.
5. Conclusion
To address the security problems in UAVNs, this paper proposed a CLAS construction without bilinear groups to realize efficient mutual authentication between control center and unmanned aerial vehicles. After the system is initialized, KGC produces the partial private key for each entity. CMC sends the authentication request to AGT; then, AGT forwards the attested request to UAVs in its adminstrative cluster. All response tuples of UAVs are validated by the cluster head AGT and then forwarded to CMC for further verificaton. Security analysis showed that our CLAS construction can not only provide unforgeability for (attested) authentication request and (aggregate) responses but also can resist malicious KGC. Experimental analysis demonstrated that the proposed CLAS construction enjoys practical performance.
Data Availability
No data were used to support the findings of this study.
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
This article was supported in part by the National Key R&D Program of China under project 2020YFB1006003, National Natural Science Foundation of China under projects 61772150, 61862012, and 61962012, Guangdong Key R&D Program under project 2020B0101090002, Guangxi Natural Science Foundation under grants 2018GXNSFDA281054, 2019GXNSFFA245015, and 2019GXNSFGA245004, Peng Cheng Laboratory Project of Guangdong Province under grant PCL2018KP004, and Innovation Project of Guangxi Graduate Education under grant YCSW2021176.