Frontiers in Computing and Intelligent Systems ISSN: 2832-6024 | Vol. 5, No. 3, 2023 69 A Sensitivity‐based Location Privacy Protection Scheme in Vehicular Networks Han Jiang, Hequn Xian * College of Computer Science and Technology, Qingdao University, Qingdao, China * Corresponding author: Hequn Xian (Email: xianhq@126.com) Abstract: In recent times, the issue of vehicle location privacy has received increasing attention. Location-based services (LBSs) require users’ location information to be constantly updated to service providers, which causes the location information to be speculated and attacked by malicious entities. The pseudonym schemes offer a viable solution to the aforementioned problem, but existing pseudonym schemes do not provide differentiated protection for users’ varying locations, thereby increasing the possibility of location information leakage. To address this concern, we propose a sensitivity-based pseudonym exchange mechanism, which leverages the vehicle’s historical track record to extract features and enable customized location privacy protection. Performance evaluation results demonstrate that our approach significantly outperforms existing approaches in achieving location privacy. Keywords: Location Privacy Protection; Pseudonym; Vehicular Networks; Sensitivity. 1. Introduction The Internet of Vehicles (IoV) has gained significant attention due to the advancements in intelligent sensors, big data, artificial intelligence, and mechanical manufacturing technology. It plays a vital role in enabling vehicles to understand the surrounding environment and achieve autonomous navigation [1]. As a distributed self-organized network, IoV allows mobile nodes (vehicles) to communicate with other vehicles equipped with On-Board Units (OBUs) through Vehicle-to-Vehicle (V2V) communication, or with Road-Side Units (RSUs) [2-3]. According to the Regulation of the Standardization Development Organization [4], a vehicle’s current state should be broadcast at a frequency of 1-10 Hz when it is in motion, in the form of beacons that include information such as vehicle identification, location, speed, and direction. This aids drivers in anticipating potential hazards, preventing accidents, and enhancing driving safety. However, this information is broadcast to everyone, making it vulnerable to collection by attackers using technical means. Attackers can infer sensitive personal information from a vehicle’s historical behavior records, such as the driver’s occupation, health status, and daily routines. Consequently, privacy protection is crucial in the IoV. In order to solve the problem of location privacy in the IoV, the pseudonym schemes [5] are widely used, where multiple pseudonyms are utilized to conceal the identity of the vehicles. A pseudonym scheme based on public key infrastructure (PKI) is described in the ETSI102941-v1.1.1 vehicle security standard [6]. Under this scheme, when the vehicle is registered, the vehicle receives pseudonyms and private key from the Trusted Authority (TA), allowing for the pseudonym to be changed while the vehicle is in operation, and a new set of pseudonyms will be requested once the current set has been exhausted. This approach allows for various identifiers to fulfill network requirements for beacon broadcasting. However, adversaries can still track a vehicle if it maintains a single pseudonym for an extended period or if the pseudonyms are linkable, making unlinkability a critical requirement for pseudonyms in location privacy protection. Additionally, pseudonyms must be changed after being used for a period of time, but changing them at an inappropriate time or location may still enable adversaries to track the vehicle. As a result, the pseudonym change mechanism must be thoughtfully designed to prevent pseudonyms association attacks [7]. The time and location of pseudonym changes directly impact the pseudonym scheme’s anonymity performance, making the safe, efficient, and effective use of pseudonyms to protect vehicle track privacy a significant challenge. The existing research usually provides consistent protection, meaning that identical privacy standards are applied to all users in the Internet of Vehicles. For instance, the literature [8] pays their attention to the location where pseudonyms are changed. If a vehicle alters its pseudonym in a sparse location, the adversary can easily detect this change. To overcome this issue, scholars have proposed changing pseudonyms in mix-zones [9-10], social hotspots, and other areas, such as parking lots, shopping malls, and intersections. The fundamental concept behind this approach is to change pseudonyms in designated pseudonym change areas when the age of the pseudonym reaches a certain threshold, enabling multiple vehicles to simultaneously alter their pseudonyms to confuse attackers. It is evident that different locations, and times require varying degrees of privacy protection need for individual users, requiring different pseudonym change strategies [11]. We believe that the privacy needs of users at frequently visited locations, such as their workplace, should be greater than those in other regions. This paper’s primary contributions are presented as follows: 1) We define a measurement called sensitivity to quantify the location privacy requirements of each vehicle in each location. Based on this, we defined our pseudonym age growth model, so that the age growth rate of the vehicle’s pseudonyms is different with different sensitivity. 2) A sensitivity-based pseudonym exchange mechanism is proposed for protecting the location privacy of vehicles in vehicular networks. We construct an extended pseudonym-exchanging region called the 70 “group-region”, which enables vehicles to exchange their pseudonyms using a group identity. The usage of group identity protects the procedure of pseudonym exchange effectively. The subsequent sections of the paper are structured as follows: Sect.2 provides an overview of the related work. Sect.3 introduces the network model and threat model. Sect.4 describes the privacy protection mechanism and sensitivity calculation method. In Sect.5, the performance analysis is presented. Finally, we conclude our work in Sect.6. 2. Related Work With the growing concern over privacy disclosure related to the location of IoV, several methods have been developed to address the problem, including mixed zone [9-10], silence period [12]and group signature [13]. The fundamental concept underlying these approaches is that when a vehicle transmits information, it employs a pseudonym instead of its actual name. Consequently, many studies concentrate on the strategy of changing pseudonyms, including the time and location of such changes. Li et al. proposed the Swing&Swap scheme [12], which aims to prevent opponents from predicting the position of vehicles through sudden changes in location. The scheme updates vehicle pseudonyms when the speed drastically drops or accelerates, while maintaining the same pseudonym for nearly constant speeds. Buttyan et al. [14] proposed Slow, a pseudonym replacement method that considers driving speed as a factor affecting pseudonym replacement. When the speed falls below a specific threshold, the vehicle stops sending messages and performs pseudonym replacement. Chen et al.[15] identified pseudonym age as a critical factor in pseudonym changing. Specifically, when a vehicle’s pseudonym age exceeds a specified threshold ff, it attempts to change its pseudonym. The process of changing pseudonyms should occur in a proper occasion as vehicles can still be tracked when they change their pseudonyms in areas with few vehicles. To address this limitation, a hybrid zone scheme has been proposed as a solution. The fundamental principle of hybrid zones involves the use of RSU public key encryption when all vehicles within the hybrid zone exchange information. Consequently, when the hybrid zone is of sufficient size, attackers are unable to predict the location of vehicles. The concept of hybrid zones was first introduced by Beresford et al. [16], and further improved in [9]. Yu et al. [13] introduced an approach named MixGroup that integrates social gathering spots with other events where a vehicle can encounter a considerable number of vehicles. In MixGroup, vehicles can engage with each other to decide whether to participate in the pseudonym change procedure. Li et al. [17] proposed a method called TLAS, which uses the area in front of the red light as a mixing zone, uses the cycle of the street light to predict traffic flow, and adaptively adjusts the size of the mixing zone. This scheme can achieve better anonymity at lower vehicle speeds. Inspired by these efforts, we designed a pseudonym exchange scheme based on vehicle history records using a group signature technology and using pseudonym age as a basic factor that affects pseudonyms exchange. 3. System Model 3.1. Network Model The model of our network model is illustrated in Figure. 1. There exist four types of entities, including vehicles, RSUs, TA, and LBS provider. Figure 1. Architecture of vehicular networks 1) TA: TA is a reliable entity with robust computing and processing capabilities in the context of the IoV. Its primary responsibility is to generate the public key, private key, and certificate for secure communication before the vehicle’s operation. At the same time, TA will generate a set of pseudonyms along with their corresponding public and private keys, certificates according to the registration information, and distribute them to vehicles applying for pseudonyms. Additionally, TA maintains a tracking table, which enables the identification of the true identity of each vehicle, thereby facilitating investigations into any illegal activities. 2) RSU: RSUs are fixed infrastructure, vehicles communicate with LBS through RSUs for location updates and communicate with TA to access certificates for verification and authentication. 3) Vehicle: Each vehicle is equipped with OBUs for wireless communication, global positioning system for location service, and sensitivity management module. After registering with the TA, vehicles will receive sufficient pseudonyms and corresponding information to be used for broadcasting safety messages. The sensitivity management module is tasked with the computation and retention of sensitivity data 3.2. Threat Model To ensure periodic broadcast of safety-related messages, the OBU’s radio cannot be switched off while the vehicle is on the road. However, this makes the vehicle vulnerable to eavesdroppers who can track its location information by intercepting these messages. Therefore, safeguarding location privacy is crucial to counter potential threats. The adversary that we mainly consider is global passive adversary (GPA), which can eavesdrop all safety messages in the network, locate and track all vehicles through the safety messages which they broadcast. Then analyze the obtained user information to acquire the user’s personal sensitive information. 71 4. Pseudonym Exchanging Strategy In this section, we will introduce the sensitivity defined in this paper, along with the pseudonym age growth model and pseudonym exchanging strategy based on the sensitivity. Furthermore, a list of notations used in this article is given in Table 1. Table 1. The meaning of the symbols in the scheme Symbol Description iv The vehicle in the scheme lR The region in the scheme kRSU The RSU in the scheme TS Timestamp iLocation Position information of iv ( )iZ t The pseudonym age of iv at time t l iS The sensitivity of iv in lR lG The group in the scheme. lGM The group leader of the group iID The true identity of iv ,i kPID The pseudonym of iv , l lGID GIDPK Cert Public key and corresponding certificate of lGM , , , l i l iG GSK Cert Group private key of group ID and corresponding certificate for iv , ,i i iPK SK Cert Public and private key pair of iv , and corresponding certificate , , , , i k i kPID PIDPK SK ,i kPIDCert Public and private key pair of ,i kPID and corresponding certificate ( )kE m Message is encrypted with key i jv v iv sends a message to jv  Threshold of pseudonym age ' ' ', ,i i iPK SK Cert Public and private key pair of iv ’s temporary identity, and the corresponding certificate ( )kSign m Digital signature on message with 4.1. Growth Model of Pseudonym Age Upon analyzing the track dataset of the vehicle, we discovered that it strictly adheres to the owner’s daily activities. As humans exhibit certain social behaviors, such as having a job, maintaining a home, and hanging out with a circle of friends, they frequently visit specific areas, including workplaces and accommodations. If the location privacy of the vehicle in these sensitive areas cannot be protected safely, the personal privacy of the vehicle owner will be endangered. As such, location privacy protection is more critical in these areas than in ordinary ones, and the pseudonym exchanging frequency should be increased. Therefore, we have developed a pseudonym exchanging strategy based on having a job, maintaining a home, and hanging out with a circle of friends. Most of the existing studies believe that the growth rate of pseudonym age of each vehicle is the same, but it is obvious that different vehicles have different location privacy requirements. Thus, each vehicle’s pseudonym growth rate should vary from that of others, and a specific vehicle’s growth rate in a given area should also differ from that of other areas. The control center uses historical behavior records of each user to divide their personal sensitive areas and propose a sensitivity metric that quantifies different location privacy requirements In this paper, we consider a set of vehicles, which are represented as 1 2{ , }v nN v v v  and a set of regions, which are represented as 1 2{ , }l nR R R R  . Each vehicle uses its pseudonym that has been used for a period of time when broadcasting its safety message. When the vehicle iv is in lR , assume that the basic speed of the vehicle’s pseudonym age growth is . Then, it’s pseudonym age can be calculated as formula (1). Where x, y, a, b is optional constant determined by user. Z ( )=Z (t-1)+ x l i l i i i l i k S x t ak S y bk S y       (1) 4.2. Sensitivity Calculation Method Based on an analysis of the user’s historical track record, it is evident that users visit various locations with three discernible characteristics, namely access duration, access frequency, and access regularity. Therefore this paper uses these three features to measure the sensitivity of a certain region to users. The following are detailed descriptions of the three features: 1) Access duration: Analyze the user’s recent behavior track record, and calculate the average access time of the user to each location. Generally, the location with longer average access time also contains more personal privacy information. Define the access duration from iv to location jR as ,i jT . It can be calculated as formula (2). Where it is the start time of track recording, jt is the end time of track recording. F(t) = 0 indicates that the user is not in the area, and F(t) = 1 indicates that the user is in the area. , ( ) j i t t i j j i F t dt T t t    (2) 2) Access frequency: Access frequency refers to the ratio of the number of times users visit a certain location in a certain period of time to the total number of times users travel. If the user visits a location frequently, it can be judged that the location is more important to the user and contains more privacy information. The moving track of user i in the ( 1t , 2t ) time period is 1 2( , , , )i j nL l l l l   , 1<= j <=n, jl indicates a location accessed by the user in ( 1t , 2t ) time period. Define the access frequency from iv to location jR as ,i jP . It can be calculated as formula (3). Where ( )jN l indicates the number of visits user i to position jl , ( )N L indicates the total number of visits by user i in a period of time. 72 , ( ) ( ) i j i j l L N l P N L    (3) 3) Access regularity: In order to enhance the privacy protection of car owners, it is crucial to consider the regularity of their visits to specific locations such as their homes and workplaces. Such locations are frequently visited for long durations and exhibit predictable patterns of access. These regular factors of access can help determine whether a user’s access to a location is routine, thus reducing errors in location privacy demands caused by temporary and sudden events. To calculate the regularity of users’ access to a location, first calculate the average access period of users and locations, which can be calculated as: 2 1 , , ( ) t t i j i j o i dt AVG n   (4) Where 1t is the start time of track recording, 2t is the end time of track recording. ,i jn indicates the number of separations between user and location. O(i) indicates whether user i is in jR . O(i) = 0 indicates that the user is not at the location, and O(i) = 1 indicates that the user is at the location. Using Gaussian similarity function to measure ,i jAVG normalization, get the relationship strength between user i and location j, as shown in formula (5), σ scaling parameter representing access period. 2 ,( ) 2 , i jAVG i jC e  (5) By calculating the variance of the access period, the irregular metric ,i jI indicates the regularity of access cycle fluctuation to determine whether the user’s access to the location meets the regularity, which can be calculated as formula (6), ,i jx indicates the length of the access cycle. 2 , , , , ( )i j i jl i j i j C x I n    (6) Based on the factors affecting sensitivity described above, this paper proposes a multi-factor model based on multiple linear regression, which organically combines the above factors to form the user’s sensitivity evaluation function, sensitivity evaluation function can be calculated as formula (7). Where α, β, γ means the weight value of each feature element, and the value is between [0,1]. The sensitivity obtained is different with the weight of each element. , , . j i i j i j i js P T I     (7) 4.3. Pseudonym Exchanging Protocol Our mechanism mainly consists of several operations: system initialization, group joining, pseudonym exchanging, pseudonym activating, and group leaving. Figure.2 shows the state diagram of vehicles in our mechanism to explain how the vehicle transits from one state to another. Figure 2. State diagram of vehicles 4.3.1. System initialization Prior to driving, vehicle vi sends its iID and other identity information to TA for registration. Based on the vehicle’s provided information, the TA generates a set of public and private keys and certificates denoted by { , ,i iID Gk , }i iSk Cert . Additionally, iv requests a certain number of pseudonyms , ( 1,2,3 )i kPID k n  from the TA, along with the corresponding set of public/private key pairs and certificates , , , { , , } i k i k i kPID PID PIDPK SK Cert . Each vehicle is equipped with a sensitivity calculation module, which utilizes the vehicle’s historical track information to calculate the sensitivity of each area and store the data. Moreover, group leader vehicles receive public and private key pairs and certificates of communication. Protocol 1 Group joining protocol 1: lGM broadcast group invitation to the neighboring iv invition= || || || ||l l lR join GM TS Cert 2: if ( iv verified the legitimate identity of lGM ) then :i lv GM , ,,( || || || || || ) l i k i k iGM i k PID PID vE join PID PK TS Cert Location end if 3: if ( lGM verified the legitimate identity of iv )&& ( iv is in lR ) then , ' ' ': ( || || || |||| PIDi k l i PK l i i iGM v E GID TS PK SK Cert , , || || ) l i l iG G lSK Cert Cert else lGM do not response end if 4: if ( iv received reply within maxT ) then iv broadcast information , || || || i l il v Gbroadcast GID TS Location Cert else iv do not response end if 4.3.2. Group Joining During operation, all vehicles are required to broadcast safety beacons periodically to the surrounding area, for instance, every two seconds. The safety beacon should contain the vehicle’s pseudonym ,i kPID , current location i location ,TS and other status information.TS can ensure the real time of the information and avoid replay attacks. When vi enter region lR , it receives an invitation message from lGM including group identity region information, and other 73 relevant details. lGM is selected by nearby RSU. It is responsible for verifying the legitimacy of the identity of vehicles applying to become group member and distributing relevant information required for vehicles to become group member. Upon receiving the invitation message, vi verifies the message from lGM and sends a request message that includes its identity information and location as a response. If lGM verifies the response message from iv , it provides iv with parameters of lGID and the associated private key and certificate, and also the parameters of a temporary in-group identity (TID) used during pseudonym exchange with others. After that, iv becomes a group member and will broadcast safety message using lGID to prevent continuous tracking by attackers. In order to ensure liability of the message originator and safety of message receiver, each vehicle signs its safety message with a time-stamp to ensure message freshness and includes the group private key and certificate to enable verification. The entire process is described in Protocol 1. Protocol 2 Pseudonym exchanging protocol 1: lGM broadcast pseudonym exchanging invitation to iv which is in the group: invition= || || || ||l l lR exchange Cert TS GID 2: if (vi verified the inviation from lGM )&&(pseudonym age ≥ τ) then :i lv GM ,,( || || || || || || ) GID i k il l Pk i k i PID v iE agree PID s TS Cert Location speed else iv do not response end if 3: if ( lGM verified the legitimate identity of iv ) then , : ( || || || ) PID li k l i PK l GIDGM v E GID Cert TS Allocation else lGM do not response end if 4: if ( iv exchange pseudonym with of jv ) then ' , ': || ( _1|| _1|| || l ij i j j GPK v v PK E data Sig TS Cert , || ( _1|| _1) PIDi k SKSign data Sig , , ,_1 || , _1 ( _1) i k PIDi k i k PID SKdata PID Cert Sig Sign data  jv verify and store data from iv ' , ': || ( _ 2 || _ 2 || || l ji i GPKj iv v PK E data Sig TS Cert , || ( _ 2 || _ 2) PID j k SKSign data Sig , , ,_2 || , _2 ( _2) j k PIDj k j k PID SKdata PID Cert Sig Sign data  end if 4.3.3. Pseudonym Exchanging After becoming a member of group lGM , iv will have the opportunity to participate in the pseudonym exchange procedure. lGM will broadcast an invitation for pseudonym exchange to the vehicles within the group. If iv needs to conduct a pseudonym exchanging, it will report to lGM reply message. lGM will then confirm the participating vehicles for this round of pseudonym exchange, allocate them into pairs based on similar sensitivity, speed and driving direction. Then notify each vehicle of the distribution results separately. The entire process is described in Protocol 2. 4.3.4. Pseudonym Activating After the pseudonym exchange between iv and jv is completed, iv ’s pseudonym is changed to ,j kPID ,but it cannot be used immediately. The vehicle should firstly activate the pseudonyms by TA through the RSUs. To activate the new pseudonym, vi must send an activation request encrypted with the public key of the TA via the RSUs. The request includes the exchanged pseudonyms, personal data, and corresponding digital signature. TA first verifies the legal identity of iv , then generates and distributes a new public and private key pair and certificates for the new pseudonym. However, it is worth noting that to prevent continuous tracking by attackers and make it more difficult for them to link the old and new pseudonyms, iv uses the group identity to communicate and broadcast messages before leaving the group. After leaving the group, iv switches to the new pseudonym. 4.3.5. Group Leaving Once a vehicle moves out of the group-region, it broadcasts safety messages using newly changed pseudonyms. If lGM fails to receive any safety messages from iv with the certificate ,l iGCert within maxT time. lGM believes that iv has left the group, and consequently removes vi ’s entry from the group member list. When leaving group, iv independently decides whether to search for a new group in the next group-region or continue using the pseudonyms for a while. 4.4. Conditional Tracking When a vehicle is part of a group lG , its periodic broadcast message contains safety-related data and a group certificate ,l iGCert . Although only group members of lG can verify the validity of the safety message, the TA can associate all messages with their certificates to the true identities of the vehicles by contrast the tracking list. When a vehicle is not part of any group and uses its own pseudonyms for communication, its safety message also includes a certificate, which can be identified by the TA. In other words, the true identity of each vehicle is entirely revealed to the trustworthy TA, but conditionally private to the group leader, and unknown to other ordinary vehicles. 5. Experimental Analysis In this section, we evaluate the performance of this through some existing privacy metrics. Experimental results show that our mechanism is superior to existing methods in achieving location privacy 5.1. Performance Metrics Entropy represents the degree of uncertainty in the vehicle’s identity. In this paper, the entropy of the average anonymous set of vehicles is used to measure the location privacy of vehicles. Consider a group of n vehicles, which are 74 represented as 1 2{ , }j nG v v v  . Assume that pi represents the probability that the vehicle iv will be tracked by an attacker after exchanging a pseudonym. The entropy of the anonymous set jG can be calculated as: 2 | | 1 ( ) log j i G p j i i H G p     (8) The probabilistic attack model described in reference [18] assumes that two nodes are involved. Through the exchange of pseudonyms between these nodes, an attacker can calculate the likelihood of the target vehicle being present. This probability is denoted as α ∈ [0.5, 1]. The probability of an attacker successfully tracking a target vehicle can be calculated as: (| | 1) (1 )i j p G         (9) Assuming that n represents the number of vehicles in the entire network, after the vehicles exchange the nth pseudonym, the entropy of the average anonymous set of the entire network can be calculated as: | | 1 1 ( ) Gn ave j i j H H G     (10) 5.2. Simulation Parameters The simulation experiment was conducted using the real map of Qingdao City, and was implemented utilizing the OMNeT++ and SUMO simulation platforms. Detailed simulation parameters are shown in Table 2. Table 2. Simulation Parameters Parameter Value Simulation duration 0~1800 s Map Size 4*4 km2 Transmission bandwidth 10 MHZ Vehicle speed [0,60] km/h Communication range for OBU and RSU 500 m Number of RSU 15 Car-following model Krauss Model Beacon message interval 1 s 5.3. Simulation Results We employ the average anonymous entropy to evaluate and compare the proposed scheme with DMLP [19] and AS [14]. DMLP allows vehicles to dynamically generate mixed regions and exchange pseudonyms in the mixed regions. In AS, the vehicle’s pseudonym age is allowed to change only when it reaches the specified threshold. Figure.3 shows the comparison between the proposed scheme and other schemes under different vehicle densities. In any given scenario, the performance of this algorithm is superior to the other two schemes. This is due to the fact that this scheme maximizes the protection of location privacy by utilizing the opportunity of pseudonyms exchange as much as possible, even in situations where there are few vehicles present. Figure 3. Average anonymous entropy corresponding to different vehicle density Figure.4 is a comparison of the performance of three schemes under different attack capabilities. The ability of attackers is divided into two types: weak attackers α = 0.5 and strong attackers α = 0.9. It can be inferred that the proposed scheme presents significant advantages, irrespective of the attacker’s capabilities. Because in the AS scheme, the growth rate of the pseudonym age is fixed and only after the pseudonym age reaches a fixed threshold can be replaced, compared to the scheme proposed in this article, the number of pseudonym replacement times is greatly reduced. And in the DMLP scheme, the mixed area size is determined by the vehicle’s location and current traffic statistics, which limits the number of simultaneous vehicles in the same location. However, our mechanism increases the number of vehicles exchanging pseudonyms and the number of vehicles participating in the exchange of pseudonyms. Make our average anonymous entropy higher than other schemes. (a) α=0.8 (b) α=0.5 Figure 4. Average anonymous entropy with different attack capabilities Figure.5 shows the comparison of tracking rates between different schemes under different vehicle densities. It can be seen that the proposed scheme outperforms other schemes, as the use of group identities masks the process of kana exchange, resulting in a lower tracking rate for vehicles. Overall, the proposed scheme in this article outperforms other schemes in terms of privacy protection. 75 Figure 5. Vehicle tracking rate under different vehicle densities 6. Conclusion In this paper, we propose a pseudonym management mechanism to protect location privacy in vehicular networks. Our mechanism considers the historical trajectory of the vehicle and proposes a sensitivity to quantify the privacy requirements of the vehicle for each location. And the use of group signature technology reduces the link between pseudonyms and real identities. The results of the analysis demonstrate that in comparison with traditional approaches, our approach not only takes into account the heterogeneity between vehicles, but also provides higher location privacy. In future work, we intend to continue the perfection of the proposed mechanism. References [1] C. Chen, Z. Liu, S. Wan, J. Luan, and Q. Pei, “Traffic flow prediction based on deep learning in internet of vehicles,” IEEE Trans. Intell. Transp. Syst., vol. 22, no. 6, pp. 3776–3789, Jun. 2020. [2] J. Cui, X. Zhang, H. Zhong, J. Zhang, and L. Liu, “Extensible conditional privacy protection authentication scheme for secure vehicular networks in a multi-cloud environment,” IEEE Trans. Inf. Forensics Secur ., vol. 15,pp. 1654–1667, 2020. [3] C. Chen, Y . Zhang, Z. Wang, S. Wan, and Q. Pei, “Distributed computation offloading method based on deep reinforcement learning in ICV,”Appl. Soft Comput., vol. 103, May 2021, Art. no. 107108. [4] J. Petit, F. Schaub, M. Feiri, and F. Kargl, “Pseudonym schemes in vehicular networks: A survey,” IEEE Commun. Surveys Tuts., vol. 17,no. 1, pp. 228–255, Mar. 2014. [5] H. Artail and N. Abbani, “A pseudonym management system to achieve anonymity in vehicular ad hoc networks,” IEEE Trans. Dependable Secure Comput., vol. 13, no. 1, pp. 106– 119, Jan./Feb. 2016. [6] SAE J2735 V1.1.1-Dedicated Short Range Communications (DSRC) Message Set Dictionary. SAE Standard, 200. [7] X. Li, H. Zhang, Y. Ren, S. Ma, B. Luo, J. Weng, J. Ma, X. Huang, “PAPU: Pseudonym Swap With Provable Unlinkability Based on Differential Privacy in VANETs[J],” IEEE Internet of Things Journal, 2020, 7(12): 11789–11802. [8] R. Lu, X. Lin, T. H. Luan, X. Liang, and X. Shen, “Pseudonym changing at social spots: An effective strategy for location privacy in V ANETs,” IEEE Trans. V eh. Technol., vol. 61, no. 1, pp. 86–96, Jan. 2012. [9] J. Freudiger, M. Raya, M. Félegyházi, P. Papadimitratos, and J.-P. Hubaux,“Mix-zones for location privacy in vehicular networks,” in Proc. ACM Workshop Wireless Netw. Intell. Transp. Syst., 2007, pp. 1–7. [10] H. Zhong, J. Ni, J. Cui, J. Zhang and L. Liu, "Personalized Location Privacy Protection Based on Vehicle Movement Regularity in Vehicular Networks," in IEEE Systems Journal, vol. 16, no. 1, pp. 755-766, March 2022. [11] Z. Liu, Z. Liu, L. Zhang, and X. Lin, “MARP: A distributed MAC layer attack resistant pseudonym scheme for V ANET,” IEEE Trans. Dependable Secure Comput., vol. 17, no. 4, pp. 869–882, Jul./Aug. 2020. [12] L. Buttyán, T. Holczer, A. Weimerskirch and W. Whyte, "SLOW: A Practical pseudonym changing scheme for location privacy in VANETs," 2009 IEEE Vehicular Networking Conference (VNC), Tokyo, Japan, 2009, pp. 1-8. [13] R. Yu, J. Kang, X. Huang, S. Xie, Y. Zhang, and S. Gjessing, “Mixgroup:Accumulative pseudonym exchanging for location privacy enhancementin vehicular social networks,” IEEE Trans. Dependable Secure Comput.,vol. 13, no. 1, pp. 93–105, Jan./Feb. 2016. [14] M. Gerlach and F. Guttler, "Privacy in VANETs using Changing Pseudonyms - Ideal and Real," 2007 IEEE 65th Vehicular Technology Conference - VTC2007-Spring, Dublin, Ireland, 2007, pp. 2521-2525. [15] Y.-S. Chen, T.-T. Lo, C.-H. Lee, and A.-C. Pang, “Efficient pseudonym changing schemes for location privacy protection in VANETs,” in Proc. Int. Conf. Connected Veh. Expo., 2013, pp. 937–938. [16] A. R. Beresford and F. Stajano, “Location privacy in pervasive computing,”IEEE Perv. Comput., vol. 2, no. 1, pp. 46–55, Jan.– Mar. 2003. [17] Y. Li, Y. Yin, X. Chen, J. Wan, G. Jia and K. Sha, "A Secure Dynamic Mix Zone Pseudonym Changing Scheme Based on Traffic Context Prediction," in IEEE Transactions on Intelligent Transportation Systems, vol. 23, no. 7, pp. 9492- 9505, July 2022. [18] D. Eckhoff, C. Sommer, T. Gansen, R. German and F. Dressler, "Strong and affordable location privacy in VANETs: Identity diffusion using time-slots and swapping," 2010 IEEE Vehicular Networking Conference, Jersey City, NJ, USA, 2010, pp. 174-181. [19] B. Ying, D. Makrakis and H. T. Mouftah, "Dynamic Mix-Zone for Location Privacy in Vehicular Networks," in IEEE Communications Letters, vol. 17, no. 8, pp. 1524-1527, August 2013.