A Secure and Privacy-Preserving Navigation Scheme Using Spatial Crowdsourcing in Fog-Based VANETs

Fog-based VANETs (Vehicular ad hoc networks) is a new paradigm of vehicular ad hoc networks with the advantages of both vehicular cloud and fog computing. Real-time navigation schemes based on fog-based VANETs can promote the scheme performance efficiently. In this paper, we propose a secure and privacy-preserving navigation scheme by using vehicular spatial crowdsourcing based on fog-based VANETs. Fog nodes are used to generate and release the crowdsourcing tasks, and cooperatively find the optimal route according to the real-time traffic information collected by vehicles in their coverage areas. Meanwhile, the vehicle performing the crowdsourcing task can get a reasonable reward. The querying vehicle can retrieve the navigation results from each fog node successively when entering its coverage area, and follow the optimal route to the next fog node until it reaches the desired destination. Our scheme fulfills the security and privacy requirements of authentication, confidentiality and conditional privacy preservation. Some cryptographic primitives, including the Elgamal encryption algorithm, AES, randomized anonymous credentials and group signatures, are adopted to achieve this goal. Finally, we analyze the security and the efficiency of the proposed scheme.


Introduction
Traffic congestion in crowded urban areas has had a number of negative effects on society, such as wasting motorists' time, increasing air pollution from the wasted fuel, and creating a higher chance of collisions, etc. It is reported that commuters in Beijing spent on average 32 min per hour in traffic jams while traveling during rush hours in 2015 [1]. Hence, it is a common experience for a driver to find a better driving route in a congested area. Since real-time traffic information plays a key role in monitoring road conditions and predicting optimal routes of vehicles, it is certainly worth using a real-time navigation system for drivers on the road to find the optimal route of a certain destination.
For the last few years, global positioning system (GPS) [2] technology has been adopted for navigation systems, such as the Autonavi navigation system [3], which provides convenient navigation services based on a local map database. However, since the road conditions are not updated in time in the local map database, conventional GPS-based navigation systems may guide drivers to erroneous routes if some traffic accidents occur in real time.
In the meantime, vehicular ad hoc networks (VANETs), which act as important elements of the intelligent transportation system, has become increasingly popular in many countries. The navigation system based on VANETs can provide more timely and more accurate traffic information. In a typical VANET, vehicles are equipped with on-board units (OBUs) to perform mobile computation and communication with other nearby vehicles, and with road-side units (RSUs) installed along the road. With the support of VANETs and its crowdsensing capability, real-time road conditions can be collected

•
First, we present a model for a secure navigation scheme in fog-based VANETs, which takes advantage of vehicular cloud and fog computing to make up for the limitation of the previous VANET-based navigation system.
• Second, we construct a specific scheme that can support real-time navigation service to drivers in a congested area. In this way, drivers can quickly find an available route, and, moreover, gasoline and the time wasted in traffic congestion can be reduced. By using the spatial crowdsourcing, the real-time road conditions can be updated in time in fog-based VANETs. Meanwhile, the vehicle performing the crowdsourcing task can get a reasonable reward. Performance analysis shows that the real-time navigation service supported by the proposed scheme is effective.
• Third, the proposed scheme can also ensure the conditional privacy preservation of the vehicles (or drivers), which is regarded as the basic security requirement in VANET communications [8][9][10][11].
The rest of the paper is organized as follows: the system model and design goals are described in Section 2. Some preliminaries are given in Section 3. Our scheme is proposed in Section 4. The security analysis is given in Section 5, and the performance analysis is given in Section 6. Related work is reviewed in Section 7. Finally, Section 8 concludes the paper.

System Model and Design Goal
In this section, we define the problem by formalizing the system model and the design goal.

System Model
In this section, we consider the fog-based VANETs and describe our system model, in which communication nodes include trusted authority (TA), navigation servers (NS) and crowdsourcing servers (CS) residing in the fog, and vehicles as shown in Figure 1. The detailed description of system components is as follows:  is trusted and the public agency. For example, the transportation authoriti inistrative rights can take on a role of the TA. It is responsible for the registration of fo vehicles deployed in Fog-based VANETs, issuing anonymous credentials and tra icles' identity in case of rewarding purpose for spatial crowdsourcing, sending fak rmation for uncongested driving experience, etc. cloud is a set of interconnected computing resources. The cloud provides cen igation services for drivers, e.g., Google Map. node is a highly virtualized computing system, which is deployed at the edge of ne , banks, bus terminals, shopping halls, etc. Similar to a lightweight cloud serv e is equipped with the on-board large volume data storage, computers and w munication facility [12]. In our fog-based VANETs, the fog node consists of nav vers(NS) and crowdsourcing servers(CS) and conventional RSU, which are in ch asing crowdsourcing tasks, computing the optimal path for the querying vehic arding the crowdsourcing contributors. icles are equipped with irreplaceable and temper-proof OBU device, which enables to e simple computation, communicate with other vehicles and fog nodes, and has ount of read-only memory. In our model, OBU is requried to generate real-time nav ry, traffic information report for spatial crowdsourcing task, and result retrieving que shown in Figure 1, the navigation scheme works as the following. Assume each vehicle ve already registered to the TA. Then, a vehicle can send a navigation query generate the nearby fog node, denoted as fog 1 , at time t 0 . The navigation server(NS) in Fog 1 forw

•
TA is trusted and the public agency. For example, the transportation authorities with administrative rights can take on the role of the TA. It is responsible for the registration of fog nodes and vehicles deployed in fog-based VANETs, issuing anonymous credentials and tracing the vehicles' identity in case of rewarding purpose for spatial crowdsourcing, sending fake traffic information for uncongested driving experience, etc.
• The cloud is a set of interconnected computing resources. The cloud provides centralized navigation services for drivers, e.g., Google Map.
• Fog node is a highly virtualized computing system, which is deployed at the edge of networks, e.g., banks, bus terminals, shopping halls, etc. Similar to a lightweight cloud server, fog node is equipped with the on-board large volume data storage, computers and wireless communication facility [12]. In our fog-based VANETs, the fog node consists of navigation servers (NS) and crowdsourcing servers (CS) and conventional RSU, which are in charge of releasing crowdsourcing tasks, computing the optimal path for the querying vehicles, and rewarding the crowdsourcing contributors.
• Vehicles are equipped with irreplaceable and temper-proof OBU device, which enables performing some simple computations, communicating with other vehicles and fog nodes, and these vehicles have a small amount of read-only memory. In our model, OBU is required to generate real-time navigation query, traffic information reports for spatial crowdsourcing tasks, result retrieving query.
As shown in Figure 1, the navigation scheme works as the following. Assume each vehicle and fog node have already registered to the TA. Then, a vehicle can send a navigation query generated by the OBU to the nearby fog node, denoted as fog 1 , at time t 0 . The navigation server (NS) in Fog 1 forwards the query to the last Fog n which covers the destination by relaying fog nodes hop by hop. Upon receiving the navigation query, each crowdsourcing server (CS) generates and releases a crowdsourcing task of collecting real-time traffic information to vehicles in its coverage area. In addition, the vehicle who wants to perform the task returns a crowdsourcing report and can get a reasonable reward from the CS. Upon receiving the report, CS verifies it and shares the valuable traffic information with NS. The NS computes the optimal path for the querying vehicle in its area. Meanwhile, NS analyzes and forwards the traffic information to the cloud for other services. Finally, the querying vehicle can get successive navigation results from fog nodes by sending navigation result retrieving query when entering the coverage of the fog nodes until it ultimately reaches the desired destination.

Design Goal
Before describing our design goal for the navigation scheme, we first make necessary assumptions in our system model. Assumption 1. TA is fully trusted by all vehicles and fog nodes. TA can communicate with fog nodes and vehicles through a secure channel by the internet or any other reliable communication links with high bandwidth. The TA can also inspect all fog nodes and maintain the compromised entities list.

Assumption 2.
Fog nodes are untrusted. For instance, some honest-but-curious fog nodes may learn the position of specific vehicles and also get some sensitive information for some purposes. Assumption 3. The adversary can overhear V2V (Vehicle to Vehicle) and V2I (Vehicle to Infrastructure) communications to obtain any messages for their purposes, such as tracing the identity of some vehicles. Some dishonest vehicles may overhear the communications to obtain the navigation results queried by other vehicles to enjoy free navigation services if they happen to have the same destination. Our design goal is to develop a secure and privacy-preserving navigation scheme for vehicles, which can achieve the following desirable requirements: (1) real-time route navigation; (2) authentication; (3) confidentiality; and (4) conditional privacy preservation.

•
Real-time path navigation: With the guidance of the fog nodes, a vehicle can conveniently find the optimal path to the desired destination.
• Authentication: Only legitimate entities should take part in the fog-based VANETs. Fog nodes and vehicles should be able to prove themselves by using certificates or credentials. In addition, the origin of the messages should be authenticated to prevent against the impersonation and message forgery attacks. Meanwhile, the identity of the crowdsourcing contributor should be authenticated to get the reward. In addition, only a legitimate subscriber that has service access rights should be able to get navigation service.
• Confidentiality: the navigation query, traffic information report, and navigation result should be kept confidential from eavesdroppers who will illegally use the navigation information for their own purposes.
• Conditional privacy preservation: the real identity of the querying vehicle and the crowdsourcing vehicle should be kept secret. Although the location and destination would be exposed to fog nodes, the adversary can neither link a navigaiton query to a specific vehicle nor identify two navigation queries from the same vehicle. However, once an exceptional event occurs, the fog nodes can learn the vehicles' real identifier with the help of TA.

Preliminaries
This section describes some cryptographic primitives which are adopted in our proposed scheme. They are bilinear groups, message-locked encryption, randomized signatures and group signatures.

Bilinear groups
Bilinear groups are a set of three cyclic groups G 1 , G 2 , G T of prime order q with a bilinear map e : G 1 × G 2 → G T with the following properties: 1. for all g 1 ∈ G 1 , g 2 ∈ G 2 and a, b ∈ Z q , e(g a 1 , g b 2 ) = e(g 1 , g 2 ) ab ; 2. for g 1 = 1 G 1 and g 2 = 1 G 2 , e(g 1 , g 2 ) = 1 G T ; 3. the map e is efficiently computable.
There are three types of pairings defined by Galbraith, Paterson, and Smart [14]: in type 1, G 1 = G 2 ; in type 2, G 1 = G 2 , but there exists an efficient homomorphism φ : G 2 → G 1 while no efficient one exists in the other direction; in type 3, G 1 = G 2 and there is no efficiently computable homomorphism between G 1 and G 2 in either direction. In this paper, we only consider type 3 pairings, which will guarantee the security of the randomized signatures used in our scheme.

Message-Locked Encryption
A message-locked encryption (MLE) scheme is a symmetric encryption scheme in which the key used for encryption and decryption is itself derived from the message [15]. Instances of this primitive are seeing widespread deployment and application for the purpose of secure deduplication [16][17][18]. A message-locked encryption scheme MLE = (P, K, E , D, T ) is a five-tuple of polynomial time algorithm, the last two deterministic:

•
On input 1 λ , the parameter generation algorithm P returns a public parameter P.
• On input P and a message M, the key-generation algorithm K returns a message-derived key K ← K P (M).
• On input P, K, M, the encryption algorithm E returns a ciphertext C ← E P (K, M).
• On input P, C, the tag generation algorithm returns a tag T ← T P (C).

Randomized Signatures
Randomized signature [19] is both an efficient and secure signature with the same features as Camenisch-Lysyanskaya (CL)-signatures [20] but consists of only two elements in the signature. It takes advantage of the full potential of type 3 pairings, in which the space of the signatures and the one of the public key are seperated. A randomized signature scheme usually consists of four algorithms: • Setup(1 k ): given a security parameter k, this algorithm outputs public parameter param = (q, G 1 , G 2 , G T , e). These bilinear groups must be of type 3.
A randomized signature (σ 1 , σ 2 ) on m can be randomized by selecting a random r ∈ Z q and computing σ ← (σ r 1 , σ r 2 ) , which is still a valid signature on m.

Group Signatures
The group signature scheme was first introduced by David Chaum and Eugene van Heyst in 1991 [21]. In a group signature scheme, there exists a group manager and several group members, essential to which is a group manager, who is in charge of adding group members and has the ability to reveal the original signer in the event of disputes. A group signature scheme is desired to satisfy three security properties: unforgeability, anonymity, and traceability. Unforgeability ensures that only the group member can generate signatures on behalf of the group. Anonymity means that signatures do not reveal their signer's identity, except the group manager. Traceability shows that all valid signatures, even those generated by the collusion of multiple group members, can be revoked by the group manager.

Proposed Secure and Privacy-Preserving Navigation Scheme
In this section, we present a secure and privacy-preserving navigation scheme (SPNS) in fog-based VANETs, which consists of four parts: (1) system setting; (2) real-time navigation querying; (3) vehicular spatial crowdsourcing; and (4) navigation result retrieving.

System Setting
Let G 1 , G 2 , and G T be three cyclic groups of the same large prime order q. Suppose that G 1 , G 2 , and G T are equipped with a type 3 pairing. Let H : {0, 1} * → Z * q be a public collision-resistant hash function. The TA first chooses (x 1 , x 2 ) ∈ Z 2 q as the master key and computes 2 ) as its public key. In the end, the TA publishes the system parameters P = (q, G 1 , G 2 , G T , e, g 1 , g 2 , X 1 , X 2 , X 3 , X 4 ).
Each fog node has a unique identifier R ID to identify its position and a map of its coverage. R ID randomly chooses y ∈ Z q as its secret key and computes Y = g y 2 as its public key. In addition, R ID maintains a routing table to determine the next fog node to which the vehicle should move forward.
Each vehicle has a unique identifier V ID . The vehicle V ID randomly chooses v ∈ Z q to compute and sends (V, V 1 ) to the TA to prove its knowledge of v. Then, the TA verifies the validity by checking the equation e(V, X 2 ) = e(g 1 , V 1 ). If the equation does not hold, the TA returns failure and aborts. Otherwise, the TA picks s ∈ Z q to compute In addition, the TA stores (V ID , A) in a secure database, and returns (A, A 1 , A 2 ) to V ID through a secure channel. R ID sets its secret key as skv = (v, A, A 1 , A 2 ) and the corresponding public key as pkv = V.
When V ID starts to travel in the city, it will generate some short-life keys for navigation queries according to the following steps: • V ID chooses m random numbers, u 1 , u 2 , · · · , u m ∈ Z * q as the short-life private keys and computes the corresponding public keys U l = g u l 2 for l = 1, 2, · · · , m for the travel; • for each short-life public key U l , V ID computes the self-delegated certificate Cert l as follows: randomly choose α, t α , t v , t β ∈ Z q , compute T 1 , T 2 , β, β 1 , β 2 , β 3 as follows: T 1 = X α 1 , anyone can check the validity of U l ||Cert l by computing: 2 )e(g 1 , g c 2 ); and check whether c = H(X 1 , X 3 , U l , T 1 , T 2 , β 1 , β 2 , β 3 ) holds.
• V ID installs skv and u l ||U l ||Cert l for l = 1, 2, · · · , m into the read-only memory of the OBUs.

Real-Time Navigation Querying
When a vehicle V * ID that is equipped with an OBU is driving on the road, it can send a real-time navigation query to the nearby fog node, denoted as R 1 . The real-time query utilizes the OBU to generate the navigation information {N, U * , CL, DEST, t c , t e }, as shown in Table 1.
Upon receiving the navigation query Q, R 1 firstly checks whether the destination DEST is in its coverage. If the answer is yes, it will generate a crowdsourcing task to find the optimal route to the destination for the querying vehicle V * ID . Otherwise, R 1 performs the following steps to forward Q to the next fog node R 2 according to its routing table. Meanwhile, it will generate a crowdsourcing task to find the optimal route to the next fog node for the querying vehicle.
verify the validity of the signature (B 1 , B 2 , c, τ) by computing and checking whether the hash c = H(B 1 , B 2 , B, N, U * , CL, DEST, t c , t e ) holds. If not, R 1 returns failure and aborts; Otherwise, it checks the routing table to find the next fog node, denoted as R 2 , according to the destination DEST.
When R 2 receives Q , it performs the same operations as R 1 and will forward the query to the next fog node until it reaches the last fog node, denoted as R n , which covers the destination of the querying vehicle V * ID . Table 1. The description of navigation information elements.

Element Description
N Sequence number: records the query number that is used to distinguish different queries from the same OBU. U * Short-life public key: If a vehicle sends a navigation query at some time, it will randomly choose a short-life public key U * from the sequence u l ||U l ||Cert l for l = 1, 2, · · · , m stored in the OBU. This field is used to record the public key, which will be also used to reward vehicles in the spatial crowdsourcing step.

Spatial Crowdsourcing
When receiving a navigation query with a sequence number N, the fog node R j ∈ {R 1 , R 2 , · · · , R n } generates and releases a crowdsourcing task of collecting traffic information to all the vehicles in its coverage area. R j keeps a tag table TT, which contains all tags of rewarded vehicles for a specific crowdsourcing task. If a vehicle V i ID with the secret key skv i = (v i , A i , A 1i , A 2i ) wants to perform this task, it performs the operations as follows: • randomly choose a short-life public key U i from the u l ||U l ||Cert l for l = 1, 2, · · · , m stored in its OBU; • generate a traffic information report P i including the current location, current time, driving speed and the road condition; • randomly choose (r 1i , r 2i ) ∈ Z 2 q to calculate the randomized signature (B 1i , encrypt the traffic information report P i by using a message-lock encryption algorithm. Choose When R j receives the crowdsourcing response RP i , it will compute the optimal path to the destination by the following operations: • decode the crowdsourcing response P i by computing , and the tag T i = H(P, H(P, P i )); • check whether the equation T i = T i holds. If not, R j reject the RP i . Otherwise, it compares the tag T i with the element in the tag table TT. If there exists a tag T j in the tag table TT satisfying T i = T j , which means the same traffic information report has been stored in the database, R j will reject the RP i . Otherwise, it verifies the signature by computing and checking whether the equation c i = H(N, P i , B 1i , B 2i , B i ) holds. If not, R j returns failure and aborts; otherwise, it keeps RP i in its database; • R j rewards the contributor V i ID based on the short-life public key U i ; • R j can compute the optimal path OP j by using Dijkstra's algorithm in its coverage area; • choose k 1i ∈ Z q , g 0i ∈ G 2 to calculate (e 1i , e 2i , e 3i ) = (g k 1i 2 , g 0i · U * k 1i , AES Enc (g 0i , OP j )), and S j = U * y j . Finally, the navigation result for V * ID is (N, S j , e 1i , e 2i , e 3i ).

Navigation Result Retrieval
When the querying vehicle V * ID enters the coverage area of R j , it reads (u * , U * ) in the OBU, computes S j = Y u * j and generates the retrieving query RQ. V * ID chooses randomly (r 1 , r 2 ) ∈ Z 2 q to compute randomized signature (B 1 , 2 ), the hash value c = H(t c , S j , B 1 , B 2 , e(B 1 , X 2 ) r 2 ), in which t c is the current time. τ = r 2 + c · v , and sends RQ = (t c , S j , B 1 , B 2 , c , τ ) to the fog node R j .
Upon receiving RQ, R j computes and checks whether the equation c = H(t c , S j , B 1 , B 2 , B ) holds. If not, R j returns failure and aborts; otherwise, it searches for the navigation result (N, S j , e 1i , e 2i , e 3i ) in the database based on S j . R j signs the navigation result using its secret key y j . Randomly choose r j ∈ Z q to compute Finally, R j sends the navigation result NR j = (N, R j , e 1i , e 2i , e 3i , σ j 1 , σ j 3 ) to V * ID . Upon receiving the NR j , V * ID computes σ j 4 = H(N, R j , e 1i , e 2i , e 3i , σ j 1 ) and checks whether σ 1 holds. If not, V * ID returns failure and aborts; otherwise, it decodes OP j = AES Dec (g 0i , e 3i ) by computing g 0i = e 2i e −u * 1i .

Identity Revocation
Once an accepted message has been disputed, the TA can use the self-delegated certificate Cert l = {U l , T 1 , T 2 , c, s α , s v , s β } of (V * ID , A) to revoke the real identity of the disputed vehicle. The TA uses its secret key (x 1 , and can trace the identity V * ID by looking up the entry (V * ID , A) in the secure database.

Security Analysis
In this section, we discuss security issues of the proposed navigation scheme SPNS, i.e., authentication, confidentiality, and conditional privacy preservation.
(1) Authentication The identity authentication of vehicles can be guaranteed by the anonymous credentials (A 1 , A 2 ) issued by the TA through the system setting. For the real-time navigation query, vehicles need to generate some anonymous short-life keys U l by themselves, the authentication of which can also be provided by self-delegated certificates Cert l created by using authorized key A. Meanwhile, in the spatial crowdsourcing phase, crowdsourcing contributor V * i can get the reward by showing the certificate of U i used in the crowdsourcing response RP i . The identity authentication of fog nodes are also guaranteed by the certificates generated by TA.
Message authentication can be guaranteed by using randomized signatures [19] and Schnorr signatures [22]. In the real-time navigation query phase, vehicles generate signature (B 1 , B 2 , C, τ) of the navigation information by using short randomized signatures [19]. In the spatial crowdsourcing phase, vehicle V * i , who wants to perform the crowdsourcing task, returns the crowdsourcing report with a randomized signature (B 1i , B 2i , C i , τ i ) . In addition, when a fog node R j finds the optimal path OP j , it will generate a signature S j = U * y j by using its secret key y j to sign the OP j . The security of the signature depends on the discrete algorithm problem in G 1 . In the navigation result retrieving phase, vehicles generate signatures of the retrieving query through randomized signatures, and fog nodes create signatures of the navigation result by using Schnorr signatures. Since both short randomized signatures and Schnorr signatures used in our scheme have proven to be unforgeable, the security of signatures generated in our proposed scheme are secure, which guarantees the message authentication.
(2) Confidentiality To avoid navigation information being illegally obtained by unauthorized vehicles or adversaries, our scheme takes advantage of the Elgamal encryption algorithm, AES algorithm and the message-lock encryption algorithm to encrypt the transmitted information including real-time navigation query, crowdsourcing response and the navigation result. If the encryption algorithms used in the proposed scheme are secure, confidentiality requirements can be satisfied.
First, we consider the anonymous credential. When vehicle V i requests an anonymous credential from the TA, it first picks a random number v ∈ Z q to compute V = g v 1 , V 1 = X v 2 , and sends (V, V 1 ) to the TA along with a zero-knowledge proof to prove its knowledge of v. Thus, the TA cannot tell the secret key v of the vehicle, if the discrete algorithm problem in G 1 and G 2 is hard. Then, TA computes the anonymous credential skv = (v, A, A 1 , A 2 ) and sends it to the vehicle through a secure channel, so other vehicles can not illegally receive the anonymous credential by eavesdropping messages from the air.
Second, we consider the navigation query. V i utilizes the public key of the fog node Y 1 to encrypt (U * , CL, DEST) by computing C 1 = g k 1 1 , C 2 = g 0 · Y k 1 1 , C 3 = AES Enc (g 0 , U * ||CL||DEST) (k 1 ∈ Z q , g 0 ∈ G 1 ), which involves the Elgamal encryption algorithm and AES algorithm. Hence, the confidentiality of the navigation query is guaranteed. Similarly, when the fog node can not find the destination in its coverage, it will transmit the navigation query to the next fog node. The fog node will encrypt the (U * , CL, DEST) by using the Elgamal encryption algorithm and AES algorithm. Therefore, no other vehicle can eavesdrop on the route even if they want to go to the same destination.
Third, we consider the crowdsourcing report. When a vehicle wants to perform the crowdsourcing task, it will generate a traffic information report P i . To ensure the confidentiality of the report, P i , we encrypt it by using the message-lock encryption algorithm RCE [15], which can ensure the confidentiality of the report and avoid the repeated rewarding for the same vehicle.
Finally, we consider the navigation result. The navigation result OP j is encrypted as (e 1i , e 2i , e 3i ) by using the public key U i of the querying vehicle based on Elgamal encryption. When a vehicle asks for the navigation result, it can decode the navigation result by using its short-life secret key u. However, other vehicles can not decrypt the ciphertext (N, S j , e 1i , e 2i , e 3i ).
(3) Conditional privacy preservation In our scheme, although fog nodes can decode V * ID 's short-life public key, current location, and the destination by computing (U * , CL, DEST) = AES Dec (g 0 , C 3 ), they can not link this information to some specific vehicle. Because querying vehicle V * ID utilizes anonymous credentials (A 1 , A 2 ) to prove itself. To prevent dishonest fog nodes or adversaries from linking the navigation query or the retrieving query to a specific vehicle, V * ID provides a randomized version of the credential (A 1 , A 2 ) when generating signatures. Different versions of (A 1 , A 2 ) are unlinkable because linking (A 1 , A 2 ) with (A t 1 , A t 2 ) for some t ∈ Z q is equivalent to breaking the DDH assumption in G 1 . Furthermore, vehicles use the group signature scheme [21] to sign messages as (B 1 , B 2 , c, τ), which provides conditional anonymity of the signer.
In addition, V * ID takes advantage of group signatures [21] to generate short-life keys u l ||U l ||Cert l for l = 1, 2, · · · , m for anonymous authentication in the proposed scheme, so only TA can distinguish the real identity of V * ID . When vehicle V i ID performs the crowdsourcing task, its anonymity and identity privacy can also be guaranteed by the randomly chosen public key U i .
In conclusion, the anonymity, identity privacy and location privacy of the vehicles have been protected in our scheme. However, once an exceptional event occurs, the fog nodes can learn the vehicle's real identifier with the help of TA. The TA can use the self-delegated certificate Cert l = {U l , T 1 , T 2 , c, s α , s v , s β } used in the navigation query to trace the identity of the disputed vehicle. Hence, conditional privacy preservation is satisfied in our scheme.

Performance Analysis
In this section, we evaluate and compare the computational and communication costs of the proposed scheme SPNS with VSPN (VANET-Based Secure and Privacy-Preserving Navigation Scheme) [23].
Firstly, let T PM denote the time to perform one point scalar multiplication in G 1 /G 2 , with T AES the time of AES encryption, T par the time of a pairing operation, respectively. Since these operations dominate the speed of the proposed scheme SPNS, we only consider the time taken by these operations and neglect other operations such as one-way hash function, addition and scalar value manipulation. The number of the operations required in each phase of the proposed SPNS are shown in Table 2.
Next, we consider the computational costs of TA, vehicles and fog nodes in our scheme SPNS compared with VSPN [23]. For the TA side, it is only involved in the system setting and tracing phases. The number of the operations are 8T PM + 2T par and 2T PM in SPNS, compared to 2T PM and 2T PM in the protocol VSPN. For the participant TA side, SPNS is less efficient than VSPN because we need more secure parameters for self-delegating short-life public keys and crowdsourcing tasks, which are not mentioned in VSPN. As shown in Table 3, for the vehicles' side, our scheme needs more operations in the system setting phase to generate self-delegating short-life public keys, which can enhance the anonymity of the vehicles and also avoid delegating public key certificates by CA. Since our scheme accomplishes enhanced security and privacy, our scheme needs more operations than VSPN. Considering the experiment in [24] for an MNT (Miyaji, Nakabayashi, Takano) curve [25] with embedding degree k = 6, G being represented by 161 bits and order q being represented by 160 bits, on an Intel Pentium IV 3.0-GHz machine, there exists the following results: T PM = 0.6 ms, T par = 4.5 ms. Our scheme needs 1.8 ms more to realize the navigation query than VSPN. When retrieving the navigation result from each fog node or RSU, our scheme needs 1.2 ms more than VSPN. For the fog node side, since the computational capability is stronger than common RSU in our fog-based VANET model, it is efficient to realize the operations in each phase of our SPNS scheme. Table 2. Computational cost of each step in SPNS.

TA Fog Node Vehicle
m is the number of the short-life public keys generated by vehicles and n is the number of the fog nodes that relay the navigation query; SPNS is our proposed scheme. Table 3. Comparison of vehicles' computational cost.

Setting
(2 + m)T PM + 2mT par 9T PM + T par + 2T AES Querying 4T PM + T AES + T par T PM + T AES Crowdsourcing 2T PM + T AES 0 Retrieving n(6T PM + T par + T AES ) 4nT PM m is the number of the short-life public keys generated by vehicles and n is the number of the fog nodes that relay the navigation query; SPNS is our proposed scheme; VSPN is the VANET-Based Secure and Privacy-Preserving Navigation Scheme proposed in [23].
In terms of the communication overhead, VSPN needs the initial RSU, RSU k , to forward the navigation request Q to its neighbors until Q reaches the last RSU, RSU d , covering the destination. After RSU d constructs the navigation reply message, it sends the message back along the reverse path to the initial RSU, RSU k . Furthermore, the querying vehicle can get the the navigation result from the RSU k . This procedure needs much communication among RSUs. In contrast to VSPN, our SPNS does not require the fog nodes to return the navigation results to the first fog node. Instead, the querying vehicle can retrieve the navigation result from each fog node and use it to find a proper route to the destination or to the next fog node. In this way, the communication overhead among fog nodes is significantly reduced. Figure 2 shows the comparison results of SPNS and VSPN with respect to the average communication burden between two fog nodes.

Related Works
A number of previous studies have been dedicated to designing real-time VANET-based navigation systems for the last few years. In 2009, Lu [26] presented a VANET-based parking navigation protocol, which tracks available parking spaces and guides drivers to the available parking spaces. In their protocol, three RSUs are fully trusted, which provide the navigation functions for a vehicle to find a vacant parking space in a parking lot. However, the protocol [26] can not be used for our navigation purposes. In 2010, another work [27] gave an application of real-time navigation. In addition to driving guidance, the returned routes of the scheme [27] were used for opportunistically routing multimedia information such as images and videos of a desired scene to vehicles. In addition, VANET-based navigation systems [28,29] also emerged to provide real-time navigation services for drivers on roads. By means of the widely deployed vehicular communication infrastructure, the vehicles only needed the OBUs to enjoy the navigation services. However, the security and privacy issues were not concerned in their schemes.
Recently, several VANET-based vehicle navigation systems [23,[30][31][32] have been proposed for drivers' privacy preservation. Chim et al. [23] proposed a VANET-based secure and privacy-preserving navigation system, which utilizes the anonymous credentials to provide secure navigation services to drivers. Based on anonymous credentials and the destination, the system can use the real-time road information to search for an available route for drivers in a distributed way. Nevertheless, this system is vulnerable to insider attacks since the system master key is shared among all vehicles. To eliminate the system master key distribution and simplify the anonymous credential acquisition, Cho et al. [30] introduced a security-enhanced navigation system based on the concept of two person multisignature [33] and identity-based cryptographic schemes [34]. However, how to collect traffic information was not considered in their scheme. Sur et al. [31] pointed out that prior VANET-based secure navigation protocols cannot provide non transferability of anonymous credentials used in their protocols to prevent an insider attacker from sharing her anonymous credentials, and the protocols [23,30] are vulnerable to an attacker who can compromise roadside units (RSUs) deployed on the roads. Sur et al. [31] proposed a secure navigation system based on vehicular cloud from a trapdoor hash function and zero-knowledge proof. However, the anonymous credentials in this system can only be used once for fear of vehicles' sharing credentials with unregistered users. Ni et al. [32] proposed a privacy-preserving real-time navigation system using crowdsourcing. However, their scheme does not take advantage of fog computing, which leads to high efficiency and low-latency.
Our scheme is based on the idea of randomizing anonymous credentials. Once the fog nodes are compromised, they can not link the navigation query or a retrieving query to a specific vehicle.
In this way, it can preserve the privacy of the vehicles. Moreover, the anonymous credentials need not be updated frequently, whereas it can be used for a long time. In our scheme, we utilize fog nodes to issue spatial crowdsourcing tasks to vehicles in their coverage in order to collect real-time road conditions, which guarantee that the retrieving path is real-time and optimal. In addition, the querying vehicle can successively retrieve the navigation result from each fog node when entering its coverage area. This framework is superior to existing solutions, which mainly depend on the assumption that a moving vehicle has to obtain the results from the first fog node, which is quite challenging in reality due to vehicles' high moving speed.

Conclusions
In this paper, we proposed a secure and privacy-preserving real-time navigation system based on fog-based VANETs. We utilized the real-time traffic information to guid the vehicle to a desired destination in a distributed way: fog nodes generate the spatial crowdsourcing task to collect real-time road conditions. Then, each fog node takes advantage of the collected traffic information provided by the vehicles in its coverage to compute the optimal route to the destination. Vehicles can get the continuous optimal route from the fog nodes until it arrives at the desired destination. Moreover, the vehicle performing the crowdsourcing task can get a reasonable reward. Our scheme adopts some security primitives to provide a number of security features: (1) vehicles are authenticated by using zero-knowledge proof and randomized anonymous credentials; (2) messages provided by the vehicles and fog nodes can also be authenticated by means of signatures; (3) navigation queries, traffic information report and navigation results are protected from eavesdroppers. Besides satisfying all security requirements, our scheme provides the conditional privacy-preserving requirements. No one including TA can link up a vehicle's navigation query and its identity. However, the TA can trace the identity of the driver who reports false traffic information. Furthermore, our scheme is efficient in terms of computational and communication overhead. For the future work, we will further improve the effectiveness of our scheme and develop a privacy-preserving parking system using vehicular crowdsourcing based on fog-based VANETs.