In our model, the service provider (SP) wants to inspect an area of interest (AoI) located near a highway where many platoons pass by. As illustrated in Figure 2, our system model consists of three roles: the service provider (SP), a cloud server (CS), the immobile roadside units (RSUs) along the highway and mobile vehicles traveling on the highway, which are equipped with onboard units (OBUs) and powerful sensors.

Service Provider (SP): The SP is fully trusted because it is normally controlled by the authority who wants to inspect an area of interest by collecting the data of this AoI. The data collected is a vector of readings regarding, for example, air pollution level, noise level, temperature, humidity and so on. The duty of SP is to initialize the whole system, and distribute key materials to RSUs and vehicles. It is also responsible for storing and updating trust values for all vehicles.

Roadside Units (RSUs): The RSUs are subordinated by the SP, which are connected to the CS and SP via reliable communication channels. Equipped with wireless devices, RSUs are able to exchange data with the vehicles passing-by. However, due to the high cost of RSU installment and maintenance, especially in the early stage of VANET, RSUs are sparsely deployed along the highway. The RSUs will never disclose any internal information without permission. However, we do not rule out the possibility that a portion of RSUs at the road side are compromised or the attackers even deploy bogus RSUs. Nevertheless, the SP can inspect all RSUs at high level: once the RSUs are compromised, they will be recovered or revoked soon by SP.

Cloud Server (CS): A CS collects data from RSUs, then aggregates them in a privacy-preserving way. In addition, a CS also computes the sensed data evaluations for vehicles and returns the results to SP. A CS is assumed to be honest but curious about the sensed data of vehicles, which means that it follows the proposed scheme faithfully but tends to be curious and disclose vehicles’ privacy.

Vehicles: The vehicles are regarded as a group of highly mobile nodes equipped with OBUs which allow them to communicate with other vehicles or with RSUs. On the highway, vehicles follow platoon head vehicles to form a platoon. With this driving pattern, the vehicles can be further divided into two categories:

Platoon Head (PH) Vehicles P 0 = { p h 1 , p h 2 , ⋯ } : PH vehicles take full control of the whole platoon when driving on the highway, and they are responsible for the safety and user experience of all platoon member vehicles. Apart from that, they also claim a sensing task and submit sensed data to RSUs through V-2-I communication. PH vehicles are also honest but curious about the privacy of platoon member vehicles. In fact, PH vehicles could be malicious and provide untruthful aggregated data to server in order to subvert the system, or they may even collude with a bunch of PM vehicles with the objective to victimize other PM vehicles. However, in this work, we do not consider this issue since it is not the main focus of this work.

Both PH vehicles and PM vehicles will be get paid by the SP for leading a platoon or contributing their sensed data.

In our security model, we assume that all roles, except the SP, RSUs and malicious PM vehicles, are honest-but-curious, i.e., they will faithfully follow the protocol, but could also snoop into another role’s privacy on account of some sensitive information available to them. Specifically, we first consider the privacy requirements of PM vehicles.

Privacy requirements of platoon member vehicles: The privacy requirements of a PM vehicle include its data privacy, location privacy and identity privacy. Since the sensed data are private assets of a PM vehicle, which may reflect some sensitive information like the sensor accuracy or sensing ability, the PM vehicles will not disclose them to others. The location privacy requirement indicates that a PM vehicle will not let its PH vehicle know its past driving pattern, and the identity privacy means that the PM vehicle tries to keep his real identity secret. Meanwhile, each vehicle is also privacy-curious, i.e., it tends to disclose the privacy of other vehicles from other information available to it.

We assume that there are two kinds of adversaries according to their attacking abilities, the first kind tries to impersonate another authorized PM vehicle; the second kind is able to control a small portion of vehicles. Specifically, we list potential attacks as follows:

Impersonation attack: The first kind of adversary may try to impersonate a PM vehicle to ask for a sensing task. However, this PM vehicle may not be qualified in the system. Once chosen to fulfill the task, these unqualified vehicles may submit inaccurate sensed data.

Our design goal is to develop a trust-based privacy-preserving scheme to not only improve the sensing accuracy, but also preserve the privacy of sensing vehicles while resisting against the attacks launched by adversary. Specifically, the following desirable objectives need to be achieved.

Let G and G T be two multiplicative cyclic groups of the same composite order n. Then, a bilinear pairing e : G × G → G T will satisfy the following properties: (i) Bilinear: Let g , h ∈ G and a , b ∈ Z n * , then e ( g a , h b ) = e ( g , h ) a b ; (ii) Non-degenerated: Let g ∈ G be a generator in G , then e ( g , g ) ≠ 1 G T ; and (iii) Computable: Let g , h ∈ G , then e ( g , h ) can be efficiently computed.

Defined on the interval of [0,1], beta distribution is a family of continuous probability distributions indexed by two parameters α and β. A random variable X beta-distributed with parameters α and β can be denoted by: X ∼ B e t a ( α , β ) . Given that Gamma function is an extension of the factorial function where Γ ( α ) = ∫ 0 ∞ x α − 1 e − x d x . The probability density function (PDF) f ( x | α , β ) can be expressed by using gamma function Γ as: f ( x | α , β ) = Γ ( α + β ) Γ ( α ) Γ ( β ) x α − 1 ( 1 − x ) β − 1 , where 0 ≤ x ≤ 1 , α > 0 , β > 0 . The probability expectation value of the beta distribution is given by: E ( x ) = α α + β .

Figure 3 shows the PDF of beta distribution with different parameters α and β. It expresses the uncertain probability that a process will produce positive outcomes in future. Take the example, when α = 8 , β = 2 , according to expectation equation, the probability expectation value of this type of beta distribution is E ( x ) = 0 . 8 , which can be interpreted as the relative frequency of positive outcome that is somewhat uncertain and that the most likely value is 0.8.

The Dirichlet distribution is a family of continuous multivariate probability distributions parameterized by a priori parameter vector α → . It is the conjugate prior distribution for the parameters of the multinomial distribution. In the case of a binary state space, it is determined by the Beta distribution [14]. Generally, we can use the Dirichlet distribution to describe the probability distribution over a k-component random variable X → = { X 1 , X 2 , ⋯ , X k } . If p → = { p 1 , p 2 , ⋯ , p k } is the probability distribution vector of X, and it satisfies P { θ i − 1 < X i ≤ θ i } = p i ( 1 ≤ i ≤ k , θ i ∈ [ 0 , 1 ] , θ i + 1 > θ i ) . The Dirichlet distribution captures a sequence of observations of k possible outcomes, and those observations serve as the prior parameters α → = ( α 1 , α 2 , … , α k ) that denote the cumulative observations and initial beliefs of X. p → is a k-dimensional random variable and α → is a k-dimensional random observation variable. The probability density function is given by: (1) f ( p → | α → ) = Γ ( Σ i = 1 k α i ) ∏ i = 1 k Γ ( α i ) ∏ i = 1 k p i α i − 1 where 0 ≤ p 1 , p 2 , ⋯ , p k ≤ 1 ; ∑ i = 1 k p i = 1 ; α 1 , α 2 , … , α k > 0 . The expected value of the probability that X to be x i given the observations vector α → is given by: E ( p i | α → ) = α i ∑ i = 1 k α i . Furthermore, if we let α 0 = ∑ i = 1 k α i , the variance of the event of X to be x i is given by: V a r [ X = x i ] = α i ( α 0 − α i ) α 0 2 ( α 0 + 1 ) . If i ≠ j , the covariance is: C o v [ X = x i , X = x j ] = − α i α j α 0 2 ( α 0 + 1 ) .

We assume that a service provider (SP) will bootstrap the whole system. Specifically, given a security parameter κ, SP first generates the bilinear parameters ( p , q , g , G , G T , e ) by running G e n ( κ ) and then computes h = g q ∈ G . Next, SP chooses a secure symmetric encryption algorithm E n c ( ) , i.e., AES, and a collision-resistant cryptographic hash function H : { 0 , 1 } * → Z n * . In addition, SP chooses a random number s ∈ Z n * as the master key and computes P p u b = g s , n = p q . Finally, SP keeps p , q secret and publishes { n , g , h , P p u b , G , G T , e , H , E n c } .

RSU REGISTRATION: For each RSU, SP first generates an identity, denoted by R I D , and then calculates its private key and public key as ( s r ; S r ), where s r is randomly chosen in Z n * and S r = g s r .

PH VEHICLE REGISTRATION: For any platoon head (PH) vehicle p h i ∈ P 0 that wants to participate in the sensing task, it has to register itself to SP and obtain a real identity R I D i . Then, SP assigns the private key and public key to p h i as ( s i , S i ), where s i is randomly chosen in Z n * and S i = g s i .

PM VEHICLE REGISTRATION: For each platoon member (PM) vehicle v j ∈ V 0 that wants to take part in the sensing task and contribute its sensed data, it first registers itself in the system. The following steps between SP and v j show the registration process.

TRUST REGISTRATION: Each registered PM vehicle v j will be given a trust score t s j by SP before it is able to take part in the sensing task, where t s j ∈ [ 0 , 1 ] with the precision of two decimal places. Initially, t s j = t s 0 . In addition, SP also defines L trust levels { T L 1 , T L 2 , ⋯ , T L L } for all trust scores from 0 to 1. For instance, T L 1 is with (0,0.1], T L 2 is with (0.1,0.2], ⋯, T L 10 is with (0.9,1]. Later, SP selects l random elements { y 1 , y 2 , ⋯ , y L ∈ Z n * } as master keys, and publishes the public keys as { Y 1 = g y 1 , Y 2 = g y 2 , ⋯ , Y L = g y l } .

TASK REGISTRATION: Before a task is broadcasted to PH vehicles, it should be registered by SP. First, the sensed data categories need to be decided, such as air pollution level, noise level, temperature, humidity, and so on. Second, the the format could be defined as d → = ( d A , d B , ⋯ , d Z ) , where each element denotes one category. In addition, SP also defines that each piece of data has the precision of two decimal places. In addition, the location of AoI is also included in the task. Finally, the SP will also decide a sensing vehicle trust level threshold T L T H according to the accuracy requirements of the task to make sure that the sensed data only come from those more trusted vehicles.

We assume that there are a number of m PH vehicles in the system which would like to participate in the sensing task. They form a new set P = { p h 1 , p h 2 , ⋯ , p h m } . For a specific PH vehicle p h i ∈ P , it needs to collect sensed data from all registered PM vehicles in its platoon and then select those which meet the trust level requirement. Therefore, a trust-based privacy-preserving sensing vehicle selection scheme has been proposed as follows:

Step 1: When the platoon approaches the AoI, p h i broadcasts its sensing requests { P I D i | | H ( T ) s i | | T } to all platoon members, where T is the current timestamp.

Step 2: In p h i ’s platoon, for each registered PM vehicle v j , after receiving p h i ’s requests, it first verifies whether p h i is a registered PH vehicle by checking e ( H ( T ) s i , g ) = ? e ( S i , H ( T ) ) . If it holds, v j accepts the requests, otherwise, v j rejects p h i . Then v j responds to p h i with { P I D j k | | H ( T ′ ) s j k | | T L x | | Π | | T ′ | | T j } by calculating as follows, where T ′ is the current timestamp and T j is the latest timestamp for updating v j ’s trust score.

Step 3: After receiving the response from v j , p h j first checks whether v j is a registered PM vehicle by checking e ( g , H ( T ′ ) s j k ) = ? e ( S j k , H ( T ′ ) ) . Then, p h i checks whether the timestamp T ′ is relatively new. Next, p h i checks whether v j ’s trust score t s j is with T L x by checking e ( E , g ) = ? e ( B , Y x · S j k · g H ( T j ) ) . If it does hold, p h i calculates C ^ = g z 1 h z 2 C − ϕ , E ^ = B − z 1 g z 3 E − ϕ and checks ϕ = ? H ( C , B , E , D , C ^ , E ^ , H ( T ) s i ) . If it holds, p h i will finally check whether T L x ≥ T L T H , and accept v j ’s sensed data once its trust level satisfies the task requirement.

For each PH vehicle p h i ∈ P , where i ∈ [ 1 , m ] , we assume that a number of n i PM vehicles meet the trust level threshold requirement, and those eligible PM vehicles form a set V i = { v i 1 , v i 2 , ⋯ , v i n i } . After a PH vehicle p h i receives the sensed data from its PM vehicles, it selects those eligible data and aggregates them locally before submitting to CS for global aggregation. Therefore, a privacy-preserving data aggregation scheme has been proposed.

Local Aggregation: Take one data category, d A , in d → as an example. For simplicity, we omit the superscript and use D i n i instead of D i n i A . As described in Section 4.2, p h i collects encrypted sensed data from n i PM vehicles as D i 1 = g d i 1 · h r i 1 ′ , D i 2 = g d i 2 · h r i 2 ′ , ⋯ , D i n i = g d i n i · h r i n i ′ together with their corresponding encrypted trust score: C i 1 = g t s i 1 · h r i 1 , C 2 = g t s i 2 · h r i 2 , ⋯ , C i n i = g t s i n i · h r i n i . Then, p h i aggregates the encrypted data D i j and trust score C i j of each PM vehicle v i j ∈ V i where j ∈ [ 1 , n i ] using the paring: (4) e ( D i j , C i j ) = e ( g d i j · h r i j ) = e ( g d i j · h r i j ′ , g t s i j · h r i j ) = e ( g , g ) d i j t s i j · e ( g , h ) d i j r i j + t s i j r i j ′ · e ( h , h ) r i j r i j ′

Later p h i aggregates all aggregated data of all PM vehicles in V i together as: (5) ϕ i = ∏ j = 1 m i e ( D i j , C i j ) = ∏ j = 1 m i e ( g d i j · h r i j ) = ∏ j = 1 m i e ( g , g ) d i j t s i j · ∏ j = 1 m i e ( g , h ) d i j r i j + t s i j r i j ′ · ∏ j = 1 m i e ( h , h ) r i j r i j ′ = e ( g , g ) ∑ j = 1 m i d i j t s i j · e ( g , h ) ∑ j = 1 m i ( d i j r i j + t s i j r i j ′ ) · e ( h , h ) ∑ j = 1 m i r i j r i j ′

Finally, when p h i drives within the transmission range of an RSU, it submits ϕ i together with all pseudo-IDs in V i to CS via RSU.

Global Aggregation: Upon receiving reports from all PH vehicles in P , CS aggregates those data together as follows, and passes the final result Φ and all pseudo-IDs of PM vehicles to SP.

Once SP receives the aggregated sensed data Φ from CS, it retrieves it using its secret key p: (7) Φ p = e ( g , g ) p · ∑ i = 1 m ∑ j = 1 n i d i j · t s i j · e ( g , h ) p · ∑ i = 1 m ∑ j = 1 m i ( d i j r i j + t s i j r i j ′ ) · e ( h , h ) p · ∑ i = 1 m ∑ j = 1 m i r i j r i j ′ = e ( g , g ) p · ∑ i = 1 m ∑ j = 1 n i d i j · t s i j

Similarly, we have: (8) e ( h , h ) p · ∑ i = 1 m ∑ j = 1 m i r i j r i j ′ = e ( h , h p ) ∑ i = 1 m ∑ j = 1 m i r i j r i j ′ = e ( h , 1 ) ∑ i = 1 m ∑ j = 1 m i r i j r i j ′ = 1

Since the aggregated data ∑ i = 1 m ∑ j = 1 n i d i j · t s i j is in a small space, we can use the method of exhaustion to retrieve them. From the pseudo-IDs in V i , i ∈ [ 1 , m ] , SP is able to find their real identities and corresponding trust scores t s i j , i ∈ [ 1 , m ] , j ∈ [ 1 , n i ] . Then, SP computes the sensed data d 0 using a weighted majority method: (9) d 0 = ∑ i = 1 m ∑ j = 1 n i d i j · t s i j ∑ i = 1 m ∑ j = 1 n i t s i j

For each category, there will be a sensed result; therefore the sensed result vector d 0 → will be d 0 → = ( d 0 A , d 0 B , ⋯ , d 0 Z ) . After shrinking 100 times, SP will get the final sensed result.

We assume that all PM vehicles in each PH vehicle p h i ’s platoon contribute their sensed data in the task, where p h i ∈ P , i ∈ [ 1 , m ] . These PM vehicles form a set, denoted as V = { v 1 , v 2 , ⋯ , v n } , where n is the total number of these PM vehicles. After the sensed result is computed, SP would like to evaluate the sensed data accuracy in this task for each PM vehicle who contributes its data. Specifically, for v k ∈ V , from Section 4.3, we learn that CS stores v k ’s pseudo-ID and encrypted sensed data for sensing category A as: D k A = g d k A · h r ′ k A . The evaluation score f k ∈ [ 0 , 1 ] for v k in this task can be calculated by following the steps below:

Step 1: Given that there are many sensing categories in the sensed data vector, SP first defines a tolerance value for each sensing category in sensed result vector d → . We denote these tolerance values as another vector d t → = ( d t A , d t B , ⋯ , d t Z ) . The tolerance value can be explained in this way: if the difference between the sensed data and sensed result is larger than tolerance level, the sensed data accuracy is unacceptable and f k = 0 . In addition, SP also defines the weights for different sensing categories as ω A , ω B , ⋯ which satisfies ω A + ω B + ⋯ + ω Z = 1 .

Step 2: We take sensing category A as an example, and SP needs to calculate the difference between sensed result and sensed data Δ d k A = | d 0 A − d k A | . When there are many vehicles in the VANET, the computation costs are to large for SP so it should be done by CS in a privacy-preserving way as follows. Note that, in case d 0 A is not an integer, SP rounds it off to the nearest integer.

Step 3: After calculating Δ d k A , SP uses a similar way to calculate other sensing categories as: Δ d k B , Δ d k C , ⋯ , Δ d k Z . Finally, the evaluation score for v k in this task is calculated by: (10) f k = ω A ( 1 − Δ d k A d t A ) + ω B ( 1 − Δ d k B d t B ) + ⋯ + ω Z ( 1 − Δ d k Z d t Z )

For a specific PM vehicle v k ∈ V , the SP would like to evaluate its trustworthiness from its evaluation scores. Since the trustworthiness of v k reflects its performance in a long period, SP first collects v k ’s evaluation scores in many tasks, denoted by a continuous random variable X ( 0 ≤ X ≤ 1 ). From these collected historic records, SP can estimate X’s future distributions by using Dirichlet distribution. Since Dirichlet distribution is based on initial belief on an unknown event according to prior distribution, it provides a solid mathematical foundation for measuring the uncertainty of feedbacks based on historical data. Compared to Beta distribution, which is more appropriate in a binary satisfaction level [15], Dirichlet distribution is more appropriate for multi-valued satisfaction levels [16]. In our case, the evaluation trustworthiness of user vehicles are described by continuous trust scores. Therefore, SP uses Dirichlet distribution to estimate the performance of candidate vehicles in the future and then builds the trust model accordingly.

In order to classify the historical and future evaluation scores, we also denote a number of l satisfaction levels of feedback as a set { θ 1 , θ 2 , ⋯ , θ l } ( θ i ∈ ( 0 , 1 ] , i ∈ [ 1 , l ] , θ i < θ i + 1 ) . Let p → = { p 1 , p 2 , ⋯ , p l } ( ∑ i = 1 l p i = 1 ) be the probability distribution vector of X with respect to satisfaction levels, so that we have P { θ i − 1 < X i ≤ θ i } = p i ( i = 1 , 2 , ⋯ , l ) . To make it more mathematically precise, we define θ 0 = 0 when i = 1 , X i = 0 is categorized into θ 1 .

As described in Section 4.5, once v k finishes many sensing tasks, the SP is able to collect v k ’s historical evaluation scores. Then, we let γ → = { γ 1 , γ 2 , ⋯ , γ l } denote the vector of cumulative evaluation score and initial belief of X. With a posterior Dirichlet distribution, p → can be modeled as: (11) f ( p → | ξ ) = D i r ( p → | γ → ) = Γ ( Σ i = 1 l γ i ) ∏ i = 1 l Γ ( γ i ) ∏ i = 1 l p i γ i − 1 where ξ denotes the background information represented by γ → . Let: γ 0 = ∑ i = 1 l γ i . The expected value of the probability of X i ∈ ( θ i − 1 , θ i ] with the historical distribution of evaluation scores is given by: (12) E ( p i | γ → ) = γ i γ 0

Consider the time factor of historical evaluation scores, and we introduce a forgetting factor η and give greater weight to more recent evaluation scores: (13) γ ( n ) → = S → ( 0 ) ( n = 0 ) ∑ i = 1 n η t − t i S → ( i ) + c 0 S → ( 0 ) ( n ≥ 1 ) where n is the total number of historical evaluation scores, and S ( 0 ) → is the initial belief vector when n = 0 . Since no prior information is available, all elements of S ( 0 ) → have equal probability, which makes S ( 0 ) → = ( 1 l , 1 l , ⋯ , 1 l ) . Parameter c 0 > 0 is a weight on the initial beliefs. In the ith sensing task of v k ( i ∈ [ 1 , n ] ) , S ( i ) → denotes the satisfaction level of its evaluation score, which contains only one element set to 1, corresponding to the selected satisfaction level, and all the other l − 1 elements set to 0. t i stands for the timestamp when the ith task took place and t is the moment of running the algorithm. The forgetting factor is η ∈ [ 0 , 1 ] , and a smaller η means that it is easier for the system to forget the historical records and vice versa. In order to defend against on-off attack [17], we choose an adaptive value as: η = c 1 · ( 1 − t s k ) , where c 1 is a parameter to control the forgetting factor, and the larger value of c 1 makes the system more forgettable about the historical behaviors and vice versa. From the equation we can see that when v k has a high trust score, its forgetting factor is small, which means that those good performances will be easily forgotten. On the contrary, once v k provides low accuracy sensed data, its trust score gets lower and the forgetting factor becomes larger. This means that all of those poor sensing performances will be memorized, and it takes even longer time for v k to build up a high trust score again.

To calculate v k ’s trust score when a sensing vehicle, we first assign the weight ω i to each satisfaction level θ i ( i ∈ [ 1 , l ] ) . Let p i denote the probability that v k ’s evaluation score is categorized into the satisfaction level of θ i . p → = ( p 1 , p 2 , ⋯ , p l ) | ∑ i = 1 l p i = 1 . We model p → using Equations (11)–(13). Let Y be the random variable denoting the weighted average of the probability of each evaluation score in p → , and the trust score t s k of v k is represented as: (14) t s k = E [ Y ] = ∑ i = 1 l ω i E [ p i ] = 1 γ 0 ∑ i = 1 l ω i , γ i where γ i is the accumulated evidence that v k ’s evaluation score is with a satisfaction level of θ i .

We design a simulation to evaluate our proposed TripSense scheme in which only a set of key factors are considered and specified in order to validate the PM vehicles’ sensing accuracy. It is worth noting that the selected factors are related to the movement of vehicles and the packet collision problems. In this case, we simulate the proposed scheme in the environment of MATLAB where there are a total number of n registered PM vehicles. To ensure the fairness, we suggest that each PM vehicle provides m times sensing report in totally m independent tasks. The detailed simulation parameter settings is in Table 1.

Due to the lack of real data, we need to model the behaviors of not only PM vehicles who take part in the sensing tasks, especially for malicious vehicles, in order to test the performance of our proposed scheme.

Sensing accuracy level (SAL) of PM vehicles: We define a parameter as sensing accuracy level (PQL) l v ∈ [ 0 , 1 ] to describe the capability of a PM vehicle to provide high accuracy sensed data. A PM vehicle with higher l v may submit more accurate sensing reports. Specifically, given a PM vehicle with l v , we use the beta distribution to describe the performance quality variable X of that PM vehicle, the probability density function of beta distribution can be expressed as: (15) f ( x | α , β ) = Γ ( α + β ) Γ ( α ) Γ ( β ) x α − 1 ( 1 − x ) β − 1 where Γ ( α ) = ∫ 0 ∞ x α − 1 e − x d x . f ( x | α , β ) is the probability that a PH vehicle with PQL of l v provides a service with the quality value of x ∈ [ 0 , 1 ] . Higher values of l v imply that the PH vehicle provides a higher quality service. To achieve this goal, we define α and β as follows: (16) α = c 2 · l v β = c 2 · ( 1 − l v ) where c 2 is the parameter to control the variance of the distribution. When c 2 is given a larger value, the performance quality values will have a larger variance and vice versa. For a PH vehicle with SAL of l v , the above model has the property of generating a service quality score that follows a beta distribution with the expectation E ( X ) = l v . We define that the malicious vehicles are vehicles with SAL l v ≤ 0 . 2 .