Authentication and Billing for Dynamic Wireless EV Charging in an Internet of Electric Vehicles

Abstract

Dynamic wireless charging (DWC) is a promising technology to charge Electric Vehicles (EV) using on-road charging segments (CS), also known as DWC pads. In order to ensure effective utilization of this on-the-road charging service, communication and coordination need to be established between the EVs and the different network entities, thereby forming an Internet of Electric Vehicles (IoEV). In an IoEV, EVs can utilize different V2X communication modes to enable charging scheduling, load management, and reliable authentication and billing services. Yet, designing an authentication scheme for dynamic EV charging presents significant challenges given the mobility of the EVs and the short contact time between the EVs and the charging segments. Accordingly, this work proposes a fast, secure and lightweight authentication scheme that allows only authentic EVs with valid credentials to charge their batteries while ensuring secure and fair payments. The presented scheme starts with a key pre-distribution phase between the charging service company (CSC) and the charging pad owner (PO), followed by a hash chain and digital signature-based registration and authentication phase between the EV and the CSC, before the EV reaches the beginning of the charging lane. These preliminary authentication phases allow the authentication between the EVs and the charging segments to be performed using simple hash key verification operations prior to charging activation, which reduces the computational cost of the EVs and the CS. Symmetric and asymmetric key cryptography are utilized to secure the communication between the different network entities. Analysis of the computational and transmission time requirements of the proposed authentication scheme shows that, for an EV traveling at 60 km/h to start charging at the beginning of the charging lane, the authentication process must be initiated at least $1.35$ m ahead of the starting point of the lane as it requires ≃81 ms to be completed.

1. Introduction

With the increasing global concerns on fuel consumption and global warming, extensive research and development activities are currently ongoing to encourage large-scale adoption of electric vehicles (EVs) as an alternative to internal combustion engine (ICE) vehicles, aiming to reduce pollution and conserve energy, while ensuring driver satisfaction [1,2]. This has motivated increasing global investments in the development of EV charging infrastructures, as well as in advanced battery technologies, to help reduce the range anxiety experienced by EV drivers due to limited EV battery capacities. Furthermore, government subsidies and the utilization of renewable energy sources for electricity generation, together with the high efficiency of EV motors, all help reduce the total cost of operation (TCO) of EVs. This helps compensate for the higher EV purchase prices compared to their ICE counterparts and further motivates the adoption of EVs [3,4].

EV charging can take place using plug-in charging cables or wireless charging pads. Plug-in charging, also known as wired charging, involves a direct physical connection between the EV and the charging socket. This requires effective yet costly electrical isolation solutions to mitigate risks of electrocution, particularly during harsh weather conditions [3]. Furthermore, the need for hardware compatibility and/or interoperability between the EV charging connector and the charging inlet point impacts the convenience of EV users and may contribute to their range anxiety for fear of running out of charge without reaching a compatible charging point [5]. Accordingly, to reduce the risks associated with wired (plug-in) charging and improve charging flexibility and convenience, wireless EV charging solutions are becoming increasingly popular, in which the charging power is wirelessly transferred, typically using inductive coupling, between a primary charging pad laid on the ground and a secondary receiver pad fitted at the bottom of the EVs [6,7]. Nevertheless, range anxiety remains the key drawback for any stationary charging solution including static wireless charging systems, as EV drivers fear running out of charge before reaching the charging station and/or without completing their desired journeys on time.

Dynamic wireless charging (DWC) systems offer an effective solution to the issue of range anxiety. This is because, by laying charging segments in dedicated lanes along extended roadways, EVs can be charged wirelessly during their motion [2,6,8]. This ensures charge ubiquity during extended journeys, thereby reducing range anxiety and eliminating driving delays due to the EV charging downtime [9,10]. Furthermore, large-scale deployments of DWC lanes across different cities enable EV battery downsizing and reduces EV production costs by increasing the dependence on the energy received during the vehicle’s motion [11,12]. This energy can also be wirelessly exchanged between traveling vehicles, using direct vehicle-to-vehicle (V2V) wireless energy transfer, given effective coordination and alignment between the EVs [13,14].

With the increasing penetration of EVs and the corresponding advantages and drawbacks of the different charging systems, these systems need to be integrated and collectively utilized within the city infrastructure to address the increasing demand for EV charging facilities. This requires effective energy management and coordination to avoid grid disturbance and overload from unregulated and/or unscheduled charging [15,16,17]. Accordingly, a network of electric vehicles, also referred to as the Internet of EVs (IoEV), needs to be established, in which EVs can communicate and exchange information securely with one another and with the surrounding infrastructure and the power grid, to enable charging coordination, effective energy management, grid load balancing and traffic optimization [18,19,20]. Hence, an IoEV consists of the different EVs and the corresponding charging infrastructure, including plug-in charging stations, static and dynamic wireless charging units and vehicle-to-vehicle (V2V) energy exchange facilities. These are shown in Figure 1.

The concept of an IoEV leverages on the capabilities of vehicular ad hoc networks (VANETs) by defining each EV as an intelligent entity that communicates with other surrounding entities using V2X communications, to ultimately establish a framework for reliable EV charging coordination and effective demand management. Accordingly, the key requirements of V2X communications in an IoEV are high-speed communications, ultra-low latency and ultra-high reliability, particularly for DWC systems due to their relatively short charging durations compared with static charging [21,22,23]. Different V2X communication technologies are addressed in the literature, including Dedicated Short Range Communication (DSRC), cellular-V2X (C-V2X) and 5G-V2X communications [24,25], each of which offers different features to address the different requirements for effective EV communication and coordination in an IoEV [21]. A heterogeneous network integrating the different radio access technologies (RATs) with other 5G advanced technologies such as MIMO, mmWaves and D2D communications, further improves the capabilities of vehicular communications in an IoEV and helps satisfy the requirements of the different use cases in terms of throughput, reliability, latency, security and quality-of-service (QoS).

In addition to effective vehicular communications, accurate authentication algorithms with fair and efficient billing schemes are essential to establish effective EV charging coordination and demand management strategies. This is because, whether the coordination strategy is implemented using game theory as in [26,27] or fuzzy logic inferences as in [17,28,29], accurate user authorization is crucial to ensure reliable scheduling of the charging resources among the EVs demanding energy, while ensuring protection against free riders and other unauthorized drivers. Fair billing, on the other hand, maximizes EV drivers’ satisfaction and motivates their participation in EV charging coordination programs. The effective operation of these programs ultimately helps reduce power network congestion and overloading, and ensures grid load balancing between the different charging points [30,31].

Nevertheless, the implementation of effective authentication and billing schemes for dynamically charged EVs is a challenging task. This is mainly due to the continuously varying charging rate during the vehicle’s motion and the charging “handover” from one charging pad to another. In addition, the fast EV traveling speeds impose the need for low latency communications, and fast authentication protocols to guarantee accurate billing during the EV motion over the charging lanes. Hence, in an Internet of EVs in which different entities are interconnected with the charging infrastructure, the charging service provider (CSP) needs to ensure the authenticity of the EVs requesting the dynamic charging service and to verify the corresponding billing credentials before initiating the charging service. This needs to be achieved while preserving the privacy of EV user information and minimizing the computational overhead to ensure fast and lightweight communications during the vehicle’s motion.

This work particularly focuses on the authentication and billing aspects of EVs utilizing the DWC infrastructure. Given the stringent requirements for low latency and high reliability due to the short lane-crossing duration, and assuming an efficient underlying communication network, this paper proposes a fast, secure and lightweight authentication and billing scheme for EVs requesting dynamic wireless charging. The proposed scheme allows each EV user to receive a single, aggregated bill instead of segment-by-segment payment, in a DWC network consisting of multiple charging lanes owned by different pad owners (PO) and coordinated using a Centralized Management and Coordination System (CMCS) in an IoEV within a smart grid. A charging service company (CSC) is responsible for EV registration and authentication with the DWC network. This scheme uses pseudonyms, symmetric and asymmetric encryption, and lightweight hashing to authenticate the EVs to the charging segments, after registration and authentication with the CSC and the PO. In the proposed model, the amount of energy demanded by the EV needs to be announced before the EV enters the charging lane. A heterogeneous communication network that integrates different communication technologies has been adopted, including 5G cellular networks, wired connections and Direct Short Range Communications (DSRC) to meet the communication requirements of the different entities. The performance of the proposed model is analyzed in terms of security, communication overhead, computational cost and system delay.

The remainder of this paper is organized as follows: Section 2 provides a description of some of the cryptographic techniques used in this work. Section 3 then outlines the related works on authentication and billing of EVs in DWC systems. The system model, including the network entities and the communication and cryptographic protocols, is then presented in Section 4, and the proposed authentication and billing scheme is detailed in Section 5. Security analysis and performance evaluation of the proposed scheme are presented in Section 6 and Section 7, respectively, before the paper is concluded in Section 8.

2. Preliminaries

This section explains some of the techniques used for information security and user authentication.

2.1. Symmetric and Asymmetric Cryptography

Asymmetric cryptography or public-key cryptography is a technique that uses pairs of keys, namely public and private keys, for encryption and decryption. In public-key cryptography, a message is encrypted using the receiver’s public key, and only the intended receiver is able to decrypt the message using its private key [32]. In contrast, symmetric-key cryptography is based on a shared key that is used for both encryption and decryption [33]. Since a single shared key is utilized, the execution of symmetric key cryptography is faster and simpler than asymmetric cryptography protocols.

2.2. Digital Signatures

A digital signature is a cryptographic protocol that verifies the authenticity of a digital document or a message. This protocol is used in asymmetric cryptography to send information over an insecure channel, and the receiver can verify that the message is transmitted by the claimed sender [34]. The widely used digital signature techniques are Rivest, Shamir, and Adleman (RSA), Digital Signature Algorithm (DSA), and Elliptic Curve Digital Signature Algorithm (ECDSA) [35,36,37]. ECDSA is the recommended digital signature scheme in the IEEE 1609.2 standard, as it offers a lower computational overhead compared to RSA-based schemes [38,39]. Three steps are involved in digital signature schemes, namely: key generation, algorithm signing, and signature verification.

2.3. Hash Chains

A hash function is a mathematical one-way function that maps a message of an arbitrary size into a fixed-sized message that can be used for efficient authentication. A hash chain is a chain of multiple one-way hash functions generated using hash algorithms such as Secure Hash Algorithms-1 (SHA-1) or SHA-2 [40]. The first key is selected randomly and the remaining keys are calculated using the hash function, $\mathcal{H}$. Each key is found by $k_i=\mathcal{H}\left(k_{i-1}\right)$ for $i=1,2,3,\dots \dots ,n$ [40]. A sample 4-key hash chain is shown in Figure 2. For verification, the keys are verified in opposite order to the order of generation, i.e., $k_n$ is the first key to be verified [35,40].

3. Related Works

3.1. EV Authentication in DWC Systems

Different authentication techniques are proposed in the literature for DWC systems. A fast authentication for a dynamic EV charging (FADEC) model is proposed in [41], to provide fast message signatures, fast signature verification, and low communication overhead. The proposed system utilizes DSRC for the information exchange between the EVs and the road side units (RSUs). The cryptographic techniques employed for authentication include hash-based message authentication code (HMAC), Elliptic Curve Digital Signature Algorithm (ECDSA), and Just Fast Keying (JFK), which is a key exchange protocol based on the Diffie-Hellman protocol. The scheme is designed such that the same key is used to authenticate each EV to multiple RSUs, based on EV driving route estimation from traffic statistics, to avoid re-authentication and reduce handover latency. Nevertheless, this scheme does not preserve the privacy of the EV as the charging pad owners can determine the exact location of the EVs and can use this data for vehicle tracking.

To address the issue of EV location privacy, an anonymous authentication scheme is proposed by the authors in [42] using verifiable encryption, authenticated pairwise-keys and coin hash chains. The EV identity is preserved by using pseudonyms instead of its real identity, and a hash chain is used for verification purposes. A similar approach is also adopted in [9] and fast authentication is achieved using symmetric keys involving the spatiotemporal location of the EV. The scheme proposed in [9] further enhances the privacy of EV information and ensures lightweight authentication by eliminating the need for communication between the charging segments, allowing the EV to exchange the corresponding encrypted messages securely with each segment as it approaches it.

The authors in [43] also propose an efficient authentication protocol for dynamic charging using blind signatures and hashing. The process is initiated when the charging company generates keys and the EV purchases these keys and un-blinds them, while they are being verified by the charging management controller. The EV then uses a hash chain to authenticate itself to the charging segments and starts charging. Hence, the charging pads do not need to share any keys with the pad owner, and the EV anonymously authenticates itself to the pad owner using the blind signatures. Another authentication approach is proposed in [44,45], using partial blind signatures, hashing, and one-time tokens to formulate a secure and privacy-preserving physical-layer-assisted authentication model. However, while hash key verification is computational efficient for authentication between the EVs and the charging segments, the verification of blind signatures requires exponential operations and bilinear pairing, which increases the overall computational cost of the authentication models presented in [43,44,45].

A lightweight authentication and charging management scheme for DWC systems is also proposed in [46], involving EV registration and power negotiation with the charging controller, referred to as power supply station (PSS), and hierarchical token-based authentication with the RSUs. The DWC system in [46] assumes the charging energy is harvested from renewable energy sources (RES) and hence, power negotiation is essential to guarantee energy availability. The proposed system utilizes pseudonyms and digital signatures to first register the EVs with the PSS, then uses asymmetric key cryptography for power negotiation and demand management. The mutual authentication between the EVs and different system entities, using signature verification and public/private key pairs, ensures reliability and security of the message exchange process.

3.2. Billing Models in DWC Systems

In addition to authentication schemes, fair and privacy-preserving billing models are also reported in the literature, some of which utilize segment-by-segment billing [47,48] while others adopt a single bill approach [9,49].

In [47,48], the authors assume that a tamper-resistant module is installed on each EV to perform secure calculations required for authentication and billing. Segment-by-segment billing is performed with a bidirectional audit between the CSP and the EV, while assuming that a constant amount of energy is supplied per segment. A key disadvantage of segment-by-segment billing is that it enables free-riders to charge before and after authenticated EVs by utilizing the associated handover delay from one segment to another. This particular problem is addressed by the authors in [50]. The proposed privacy-preserving billing approach in [50] uses token authentication and tamper-proof meters, and requests each authenticated EV to securely share its power levels before and after the charging lane with N segments. These levels are then compared to the actual energy supplied by the charging pads, and the difference in readings helps identify free-riders while preventing over-billing of authorized EVs.

Another lightweight and secure billing approach using hash functions and symmetric key cryptography is proposed in [49]. The process starts with a pre-registration phase using symmetric keys, followed by hashing with the different charging segments. At the end of the charging process, the EV communicates its received energy level with all the associated entities and is billed accordingly. A single bill approach is also adopted by the authors in [9], to achieve the required computational efficiency given effective privacy-preserving authentication protocols to ensure data security.

4. System Model

Different entities constitute the DWC infrastructure within the IoEV modeled in this work, namely: the charging service company (CSC), the charging pad owners (PO), the charging segments (CS), and the EVs. Each pad owner, $P{O}_i$, owns ${\mathcal{S}}_i$ charging segments. For simplicity, it is assumed that the charging segments are numbered $1,2,3,\dots ,{\mathcal{S}}_i$ and that the EVs always enter the charging lane at segment 1 and are charged subsequently by the following segments. Each EV has to register and sign a contract with a specific CSC before a registered pad owner, $P{O}_i$, provides dynamic charging to EVs. The EVs are, however, not billed directly by the PO. Instead, the PO submits the bills to the CSC, which pays for the EVs and then bills the subscribers accordingly. Each EV is assumed to be equipped with a tamper-proof device that carries out cryptographic computations, including message signatures, encryption and decryption. The proposed authentication and billing strategies in this work are developed to leverage on the advantages of the different approaches discussed in Section 2 and Section 3 to provide fast, lightweight and privacy-preserving authentication with fair and efficient billing.

4.1. Communication Model

For the communication model, a wired connection is assumed between the charging segments and the pad owners, to provide a reliable and high-speed communication link. A 5G cellular communication link is used to exchange information between the EVs and the CSC, and between the EVs and the PO, through 5G base stations, also known as 5G g-Node-B (gNB). By using 5G communications, EVs benefit from the wide cellular coverage, ultra-low latency, high capacity, and the support for unicast, groupcast and broadcast messages [51,52,53]. This enables each EV to simultaneously initiate multiple dedicated communication sessions with different entities within the charging infrastructure. For the direct communication between the EVs and the charging segments, DSRC is utilized to benefit from the short operation range of DSRC links and avoid interference from adjacent channels. Utilizing DSRC between the EV and the CS also reduces the physical-layer latency due to the small air gap between the EV and the underlying segment. A summary of the different communication technologies utilized in the proposed model is shown in Figure 3.

4.2. Cryptography

In order to develop a secure and privacy-preserving authentication and billing scheme, different cryptographic methods are utilized in this work. In particular, the following cryptographic protocols are used:

• The SHA-256 algorithm is adopted for the hash function with 256 bits (32 bytes) output.
• The Advanced Encryption Standard (AES) algorithm is used for symmetric encryption of messages exchanged with the charging segments, with a 256-bit key and an output size of 16 bytes.
• The RSA algorithm is used for asymmetric encryption of messages exchanged between the EVs, the CSC and the PO, with a 2048-bit key and an output size of 256 bytes.
• The elliptic-curve digital signature algorithm (ECDSA) is used to sign the messages exchanged between the EVs, the CSC and the PO, resulting in 448-bit signatures.

Furthermore, additional communication security can be achieved by implementing advanced physical-layer security (PLS) techniques on the 5G wireless communication link [21,54,55], but this is beyond the scope of this work.

Table 1. Description and length, in bytes, of the different symbols used in the proposed authentication and billing model.

Symbol	Description	Length (bytes)
C	ID of the charging service company	8
$P{O}_i$	Pad Owner ID	8
s	charging segment ID	8
$I_e$	Real identity of EV e	128
p	Pseudo identity of EV e	32
$k_p$	Session key for the EV with pseudo identity p	32
$t_x$	Time stamp of the message generated by x	8
$reqE$	Required energy by EV e	8
$SI{G}_{g{k}_x}$	Message signature with the signing key of x	56
${\epsilon }_{k_p}(.)$	Symmetric key encryption using session key, $k_p$	16
$E_{p{k}_x}(.)$	Asymmetric key encryption using public key, $p{k}_x$	256
$HashChReq$	Hash chain request	8
${\mathcal{H}}_i\left(\right)$	Hash function	32
$h_n$	Hash key for authentication with the nth segment	32
$param$	Charging parameters	32
$cost$	Unit cost of the charging energy, in $\$/$kWh	8
$P_{s,p}$	Power supplied by s to the EV with pseudonym p	8
$E_p$	Total energy supplied to the EV, calculated by the PO	8
E	Actual energy received by the EV	8

lists each symbol used in the proposed authentication and billing strategy and the corresponding symbol length given the aforementioned cryptographic protocols.

5. Proposed Authentication and Billing Scheme

Each entity in the DWC system at hand, namely the EV, the CSC and the PO, has its public and private key pair for encryption, $(p{k}_x,s{k}_x)$. The function $E_{p{k}_x}(.)$ means encrypt the message with the public key of entity x. A pair of signing/verification keys is also used for each entity. The function ${\mathrm{SIG}}_{g{k}_x}(.)$ denotes signing the message with the signing key of x.

5.1. Key Pre-Distribution Phase

To begin with, the CSC generates pseudonyms and the corresponding key sets, ${\mathcal{P}}_i$ and ${\mathcal{K}}_i$, daily based on the traffic volume and sends the message $m_1$:$\{{\mathcal{P}}_i,{\mathcal{K}}_i,t_C,{\mathrm{SIG}}_{g{k}_C}\}$ to each PO, denoted as $P{O}_i$, where the subscript i is the index of the PO owning the DWC lane, and the subscript C indicates that the message is initiated by the CSC. This message is signed using the signing key of the CSC and is encrypted using the public key of $P{O}_i$. Therefore, only the PO is able to decrypt the message using its private key. After receiving the message, $P{O}_i$ verifies the signature of the CSC and forwards the pseudonyms and the corresponding key sets to the charging segments under its control in a message $m_2$:$\{{\mathcal{P}}_i,{\mathcal{K}}_i,t_{P{O}_i}\}$. This phase can be done during light traffic hours.

5.2. Registration and Authentication Phase

When EV e enters the charging lane, it has to communicate with the CSC to obtain a pseudonym, $p\in {\mathcal{P}}_i$, and a session key, $k_p\in {\mathcal{K}}_i$. To authenticate with the CSC and obtain the session key, EV e sends its real identity and its energy demand, $reqE$, in $m_3$:$\{I_e,t_e,reqE,{\mathrm{SIG}}_{g{k}_e}\}$. To ensure the privacy of EV information, the calculation of the energy demand is performed on the on-board unit (OBU) of the EV, based on the current EV SoC, $So{C}_0$, the desired final SoC, $So{C}_f$, and the maximum EV battery capacity, $E_{max}$, using the expression,

$$reqE=(So{C}_f-So{C}_0)E_{max},$$

(1)

where the desired final SoC is estimated by each EV based on its remaining trip distance, its average traveling velocity and the average EV energy consumption rate [6,28]. The message $m_3$ is then signed using the signing key of EV e and is encrypted using the pubic key of the CSC, $E_{p{k}_C}\left(m_3\right)$. In response, the CSC calculates the estimated number of charging segments, N, that need to be activated to meet the energy demand of the EV, given the rated power of each charging segment owned by $P{O}_i$, $P_{rate{d}_i}$, and the nominal driving velocity on the charging lane, $v_i$, using the expression,

$$N=⌈\frac{reqE}{P_{rate{d}_i}}\frac{v_i}{L_i}⌉,$$

(2)

where $L_i$ is the length of each charging segment assuming equally sized segments, and $\lceil .\rceil$ is used to round up to the nearest integer value of N. The rated segment power and the nominal lane crossing velocity, $v_i$, are assumed to be predetermined by the Charging Management and Coordination System (CMCS), which runs different supply and demand management programs to ensure grid load balancing and maximal demand coverage. Nevertheless, since this work particularly focuses on proposing a fast, reliable and privacy-preserving authentication and billing scheme for DWC systems, the specifications of the charging coordination process including load distribution and scheduling are beyond the scope of this work.

Upon verifying that the EV energy demand can be addressed by $N\le {\mathcal{S}}_i$ segments on the DWC lane owned by $P{O}_i$, the CSC selects a pseudonym p from the list of unassigned pseudonyms and sends it back to the EV e with the corresponding session key, $k_p$, after signing the message with its key, $m_4$:$\{I_e,t_C,p,k_p,{\mathrm{SIG}}_{g{k}_C}\}$, and encrypting it with the EV public key, $E_{p{k}_e}\left(m_4\right)$. The CSC then activates a countdown timer, T, and waits for a response from the EV, which shall include the hash chain request in $m_5$:$\{HashChReq,p,t_e,SI{G}_{g{k}_e}\}$. In case of timer expiry, a timer expiry flag, $f_T$, is shared with the EV, and the authentication process is terminated. The value of the timer, T, must acknowledge the expected transmission delay for the communication between the EV and the CSC, yet must not be excessively long to avoid undesirable channel occupancy, which allows unauthorized channel access and leads to network congestion.

If $m_5$ is received before timer expiry, the CSC responds by generating a hash chain, ${\mathcal{H}}_i^N\left(h_0\right)$, where $h_0$ is selected randomly. The CSC accordingly generates a number of hash keys sufficient to charge EV e according to the value of N estimated earlier by the CSC using Equation (2), based on the EV energy demand shared by the EV in $m_3$. The message sent by the CSC is, $m_6$:$\{h_0,h_1,h_2,\dots ,h_N,t_C,{\mathrm{SIG}}_{g{k}_C}\}$ and is encrypted as $E_{p{k}_e}\left(m_6\right)$. When the EV receives the packet, it decrypts the message and verifies the signature of the CSC. If the verification succeeds, the EV stores the N hash keys to be used for authentication with the charging segments. Algorithm 1 presents the detailed procedure taking place at the CSC to register and authenticate the EVs. Assuming the EV energy demand can be fully covered by the DWC lane owned by $P{O}_i$, the message exchange sequence between the different entities up to this step is shown in Figure 4.

Algorithm 1 Proposed EV registration and authentication algorithm at the CSC.

Given $P_{rate{d}_i}$ and $v_i$ for $P{O}_i$ are provided to the CSC by the CMCS.      Input $E_{p{k}_C}(m_3$:$\{I_e,t_e,reqE,{\mathrm{SIG}}_{g{k}_e}\})$ from EV e. 1: Decrypt $E_{p{k}_C}\left(m_3\right)$ using the private key of the CSC. 2: Calculate the number of charging segments, N, required to provide $reqE$ using Equation (2). 3: if$N\le {\mathcal{S}}_i$then 4:     Select a pseudonym $p\in {\mathcal{P}}_i$ for EV e. 5:     Send $m_4$ to EV e with pseudonym, p, and session key, $k_p$. 6:     Activate countdown timer, T. 7:     while $T>0$ do 8:         Listen for incoming messages from EV e and other nearby EVs. 9:         if $E_{p{k}_C}\left(m_5\right)$ is received from e then 10:             Randomly generate $h_0$. 11:             Run the hashing algorithm to generate the hash chain, ${\mathcal{H}}_i^N\left(h_0\right)$. 12:             Send the N hash keys back to the EV in $E_{p{k}_e}\left(m_6\right)$. 13:             EV e is now authenticated and ready to communicate with $P{O}_i$ and the N segments for charging activation. 14:         end if 15:     end while 16:     if $T=0$ and no message is received from e then 17:          Send timer expiry flag, $f_T$, to EV e and terminate the authentication process. 18:     end if 19: else if$N>S_i$then 20:      Set $N=S_i$. 21:      Calculate maximum energy that can be provided from the $S_i$ segments connected to $P{O}_i$. 22:      Communicate the remaining EV energy demand with CMCS to recommend nearest available DWC lane. 23:      Send charge insufficiency flag, $f_{nc}$, to EV e with the ID of the new PO, $P{O}_j$, shared by the CMCS. 24:      Calculate the number of segment to be activated from the DWC lane owned by $P{O}_j$, $N_j$. 25:      Upon EV approval, share the pseudonyms and session keys to register EV e with $P{O}_i$ and $P{O}_j$. 26:      Repeat steps 6-18 for $N_j$ segments belonging to $P{O}_j$. 27: end if

5.3. Charging Activation Phase

After getting the hash key set from the CSC, EV e starts to communicate with $P{O}_i$ by sending the Nth hash key assigned by the CSC with the charging parameters and the ID of the CSC who generated the hash chain, in $m_7$:$\{h_N,p,C,t_e,param,{\mathrm{SIG}}_{g{k}_e}\}$, encrypted using $E_{p{k}_{P{O}_i}}\left(m_7\right)$. The charging parameters field, $param$, includes the EV energy requirement, $reqE$, as well as the desired charging rate, EV speed, EV charging coil model, battery type, etc. The privacy of this information is maintained as it is linked to the pseudonym p assigned to the EV, not to the real EV identity. Hence, even if this message is compromised, this information cannot be traced back to the EV.

Upon receiving $E_{p{k}_{P{O}_i}}\left(m_7\right)$, the PO replies by sending its ID, the unit cost of charging and the time stamp to the EV, as $m_8$:$\{cost,P{O}_i,t_{P{O}_i},SI{G}_{g{k}_{P{O}_i}}\}$. The PO also publishes the Nth hash key shared by the EV to the charging segments, in $m_9$:$\{h_N,t_{P{O}_i}\}$. Once the EV enters the communication range of the first charging segment, it sends a message containing its pseudonym, the next hash key, $h_{N-1}$, the CSC ID, C, and the time stamp generated by EV. This is denoted as $m_{10}$:$\{p,h_{N-1},C,t_e\}$. The message is encrypted using the session key, $k_p$, as ${\epsilon }_{k_p}\left(m_{10}\right)$. $C{S}_1$ decrypts the message and verifies the hash key by finding $h_N=\mathcal{H}\left(h_{N-1}\right)$, which has to be equal to the root key sent by the PO in $m_9$. If verification succeeds, $C{S}_1$ is activated and the EV starts charging. The segment also adds the received pseudonym, p, and corresponding key, $k_p$, to the revocation list to avoid reuse by free-riders.

In addition, $C{S}_1$ forwards the verified hash key received from the EV, $h_{N-1}$, in a message, $m_{11}$, to the next segment, $C{S}_2$, which includes the EV pseudonym, p, the segment index, s, and $h_{N-1}$, encrypted using the segment-to-segment session key, $k_s$, as ${\epsilon }_{k_s}(p,s,h_{N-1})$. The second segment stores the hash key and waits for the incoming message from the EV with pseudonym, p. As soon as the next message is received from the EV with $h_{N-2}$, $C{S}_2$ performs one hashing operation to verify that $h_{N-1}=\mathcal{H}\left(h_{N-2}\right)$ before activating the charging process. This process continues until EV e finishes the required number of charging segments by sending $h_0$ to the last charging segment, $C{S}_N$. The use of dedicated short range communication (DSRC) between the EVs and the CSs ensures that the message transmitted by the EV only reaches the nearest charging segment before fading out, which minimizes the interference between the different messages shared between the EVs and the CSs.

5.4. Billing Phase

The billing process is performed during light traffic. Each charging segment, $s\in {\mathcal{S}}_i$, reports its supplied power levels for the vehicle with pseudonym p, $P_{s,p}$, to the PO along with the charging duration, i.e., the start and end charging times, $t_{s,p}^s$ and $t_{s,p}^e$, respectively, in the message $m_{12}$:$\{p,s,t_{s,p}^s,t_{s,p}^e,P_{s,p}\}$. The PO then calculates the total energy received by EV e by integrating the power supplied by each pad over time and finds the total energy using,

$$E_p=\sum _{s=1}^N{E}_{s,p}=\sum _{s=1}^N\left({\int }_{t_{s,p}^s}^{t_{s,p}^e}{P}_{s,p}dt\right).$$

(3)

The PO sends the total energy calculated using Equation (3) with the start and end times to the CSC, in $m_{13}$:$\{p,t_p^s,t_p^e,E_p,{\mathrm{SIG}}_{g{k}_{P{O}_i}}\}$, encrypted using $E_{p{k}_C}\left(m_{13}\right)$. On the other hand, EV e reports its received energy when it leaves the charging lane by sending a packet that contains its real identity and the total energy received. The corresponding message is $m_{14}$:$\{I_e,E,t_e,{\mathrm{SIG}}_{g{k}_e}\}$, encrypted using $E_{p{k}_C}\left(m_{14}\right)$. The CSC then compares these two messages and pays the due amount to $P{O}_i$, then charges the EV at the end of the charging cycle. The message exchange between the charging entities during the charging activation and billing processes is presented in Figure 5.

6. Security Analysis

This section assesses the security of the proposed scheme, in terms of message integrity, information privacy and protection against different types of attacks, including double-spending attacks, man in the middle (MITM) attacks and impersonation attacks.

6.1. Message Integrity

Message integrity is an important metric in vehicular authentication schemes to ensure the accuracy of the information exchanged between the different entities and guarantee that the messages have not been altered by unauthorized users. In the proposed schemes, digital signatures are employed to ensure the integrity of messages exchanged between the EVs, the CSC and the PO. Furthermore, hash functions are utilized for communications between the EV and the charging segments to verify message integrity before initiating the charging process. If an attacker modifies the message in transition, the hash value generated by the CS for the altered message shall be different from the value for the original message. Accordingly, the altered message shall be dropped by the CS, and the charging process is terminated.

6.2. Man in the Middle (MITM) Attack

This happens when an attacker secretly relays and possibly alters the communication between two parties who believe that they are directly communicating with one another. In addition to using the hash function to ensure message integrity, asymmetric key cryptography is utilized in this work to provide mutual authentication between the EV, the CSC and the PO, and help in protecting against MITM attacks. That is, by encrypting the messages using the public key of the receiver, only the intended receiver can decrypt the message using his private key. Assuming the private key of the receiver is not compromised, this encryption scheme provides protection against MITM attacks.

6.3. Impersonation Attack

Another common concern during wireless communications is that anyone can pretend to be the sender and encrypt the messages using the receiver’s public key. This is acknowledged in the proposed model by using digital signatures, implemented using ECDSA. The message is signed using the signing key of the sender, which cannot be generated by any other entity, and the receiver has to verify the signature before establishing the communication link.

6.4. Double Spending and Free Rider Attacks

In this case, the attacker tries to listen to the message sent over the public channel and uses it during another time slot. The attacker can be an EV that has already received an amount of energy and would like to use the message to charge again without paying, i.e., double spending, or a free rider who aims to charge without being authenticated. The proposed system avoids this issue by using time stamps and revocation lists. Each time a hash key is sent to the charging segment, it has to validate $t_e$ by calculating $|t_e-t_s|\in \Delta t$, where $\Delta t$ represents the permitted tolerance time. If the time $t_s$ by which the segment s receives a key exceeds the limit, the message is invalid. Revocation lists, on the other hand, are particularly beneficial against free riders. This is because once an EV starts receiving energy from the CS, its corresponding pseudonym and session key are added to the revocation list of the charging segment. Accordingly, any EV attempting to reuse the same pseudonym or key would be detected and prevented from charging.

6.5. EV Privacy

One of the most important considerations in vehicular communications is the privacy of vehicular information. In the proposed model, the identities of the EVs requesting charge are kept confidential during the communication. This is achieved by utilizing pseudonyms that are assigned randomly each time an EV decides to charge, thereby eliminating the need to reveal the real identity of the EV. Furthermore, EV-related information such as current SoC and distance until the charging lane are not explicitly shared by the EV in any of the messages exchanged with the CSC or with the PO. During communication with the CSC, only the EV energy demand is shared as a single value, $reqE$, in the encrypted message, $m_3$, together with the EV identity. Upon receiving its pseudonym from the CSC, the EV shares its charging parameters, $param$, in $m_7$ using its pseudonym without revealing its real identity to the PO. Hence, the privacy of EV information is preserved in the proposed scheme.

7. Performance Evaluation

In addition to security analysis, the performance of the proposed model is evaluated using:

• Communication overhead: The communication overhead associated with the process of authentication and billing is measured by estimating the sizes of the different messages exchanged in the process.
• Computational cost: The computational cost is the time taken by the network entities to execute the different cryptographic techniques.
• Authentication delay: The authentication process needs to be performed within a few milliseconds to provide sufficient time for dynamic wireless charging, given the relatively short lane crossing time. This is evaluated by calculating the total time required for EV registration and authentication with the different network entities before starting the charging process. This is calculated using the estimated computational cost of the different cryptographic protocols and the transmission delay of the underlying communication networks.

7.1. Communication Overhead

The communication overhead is estimated by calculating the number of bytes transmitted during the message exchange process. In order to compute the size of each packet, the size of each message is calculated using the information in Table 1, as shown in

Table 2. Calculation of message sizes for message $m_3$ to $m_{14}$ exchanged during EV registration, authentication, charging activation and billing.

Message	Message Content	Message Size (bytes)
$m_3$	$\{I_e,t_e,reqE,SI{G}_{g{k}_e}\}$	$128+8+8+56=200$ bytes
$m_4$	$\{I_e,p,k_p,t_c,SI{G}_{g{k}_c}\}$	$128+32+32+8+56=256$ bytes
$m_5$	$\{HashChReq,p,t_e,SI{G}_{g{k}_e}\}$	$8+32+8+56=104$ bytes
$m_6$	$\{h_0,h_1,h_2,\dots ,h_N,t_c,SI{G}_{g{k}_c}\}$	$32N+8+56=32N+64$ bytes
$m_7$	$\{h_N,p,C,t_e,param,SI{G}_{g{k}_e}\}$	$32+32+8+8+32+56=168$ bytes
$m_8$	$\{cost,PO,t_{PO},SI{G}_{g{k}_{PO}}\}$	$8+8+8+56=80$ bytes
$m_9$	$\{h_N,t_{PO}\}$	$32+8=40$ bytes
$m_{10}$	$\{p,h_{N-1},C,t_e\}$	$32+32+8+8=80$ bytes
$m_{11}$	$\{p,s,h_{N-1}\}$	$32+8+32=72$ bytes
$m_{12}$	$\{p,s,t_{s,p}^s,t_{s,p}^e,P_{s,p}\}$	$32+8+8+8+8=64$ bytes
$m_{13}$	$\{p,t_p^s,t_p^e,E_p,SI{G}_{g{k}_{PO}}\}$	$32+8+8+8+56=112$ bytes
$m_{14}$	$\{I_e,E,t_e,SI{G}_{g{k}_e}\}$	$128+8+8+56=200$ bytes

, excluding the size of symmetric and asymmetric encryption and the messages exchanged offline between the CSC, the PO and the CS.

As observed in Table 2, the size of $m_6$ depends on the number of segments, N, that need to be activated to satisfy the charging requirements of the EV, which means that the communication overhead increases as N increases. Nevertheless, although the EV needs to allocate sufficient memory to store N hash keys, the computational complexity of its authentication module is reduced as it does not need to run the hashing algorithm or generate the hash chain, as this is performed by the CSC. On the other hand, the hash key verification is performed on the CS side using a single hashing operation per CS. This offers lightweight authentication, particularly due to the robustness and low computational complexity of the SHA-256 algorithm used for hashing. This is further clarified in the computational cost calculation that follows. Furthermore, the inherent sequentiality of the hash keys formed in the chain structure allows the EV to authenticate with the CSs in order, which improves the security of the proposed model.

7.2. Computational Cost

Using the message exchange sequences described in Figure 4 and Figure 5, the total computational cost of each entity in the proposed DWC authentication and billing system is analyzed, excluding the key pre-distribution phase, and is compared to the computational cost of the scheme proposed in [46], as shown in

Table 3. Computational cost calculation for each network entity.

Entity	This Work	Ref. [46]
EV	$N{T}_{\epsilon }+4T_s+3T_v+4T_E+3T_{dE}$	$T_{\epsilon }+T_{d\epsilon }+2T_s+3T_v+2T_E+3T_{dE}$
		$+2T_{MAC}+2N{T}_h+2T_r+2T_{PM}$
CSC (PSS in [46])	$2x{T}_s+4x{T}_v+2x{T}_E+4x{T}_{dE}$	$2x{T}_s+x{T}_v+2x{T}_E+x{T}_{dE}+2x{T}_{\epsilon }$
	$+N{T}_h+T_r$	$+x{T}_{d\epsilon }+2T_{MAC}+T_h+2T_r+3T_{PM}$
PO (RSU in [46])	$2x{T}_s+x{T}_v+2x{T}_E+x{T}_{dE}+$	$x{T}_s+x{T}_v+x{T}_E+x{T}_{dE}+x{T}_{d\epsilon }$
	$x{T}_{\epsilon }+xN{T}_{d\epsilon }$	$+(2+N)T_h+T_{MAC}+T_r+2T_{PM}$
CS	$3x{T}_{d\epsilon }+2x{T}_{\epsilon }+x{T}_h$	Negligible

, with the following notation:

• N is the number of charging segments,
• x is the number of EVs,
• $T_s$ and $T_v$ are the time durations for signature and verification, respectively,
• $T_E$ and $T_{dE}$ are the time durations to encrypt and decrypt messages using RSA, respectively,
• $T_{\epsilon }$ and $T_{d\epsilon }$ are the time durations to encrypt and decrypt the message using AES, respectively,
• $T_h$ is the time for one hashing operation, $\mathcal{H}(.)$, and
• $T_r$ is the time for random number generation, required for generating $h_0$ at the CSC.

In addition, $T_{MAC}$ and $T_{pm}$ are the times for one message authentication code (MAC) and for one point multiplication operation, respectively, which are utilized in the model proposed in [46]. The model in [46] is particularly selected for comparison with the proposed scheme in this work because it utilizes similar cryptographic protocols and hashing operations to achieve lightweight authentication. Nevertheless, the message structures and the underlying authentication and billing algorithms are different between the two schemes and the corresponding computational efficiencies are compared accordingly.

As observed in Table [46], the scheme proposed in [46] requires additional operations of MAC, hashing, random number generation and point multiplication by the EV, the CSC and the PO. This increases the computational cost incurred by these entities, in comparison with the proposed scheme in this work, despite the additional encryption and decryption operations incurred in this work compared to [46].

The scheme proposed in [46] requires N hashing operations to be performed by the EV and the PO, which increases their computational requirements. In contrast, N hash keys are generated by the CSC only in the scheme proposed in this work. Furthermore, the additional operations in [46] aim to minimize the role of the CS to a pure comparison of the hash keys generated and shared by the PO and the EV, respectively, without performing any hashing operations. This, however, introduces additional delay, in the computational time required to run the hashing algorithm on the EV side, and in the transmission of messages with hash keys from both the EV and the PO, to be compared and verified by the CS prior to charging activation. In this work, on the other hand, hash keys are generated once by the CSC in a hash chain, and are shared to the EV, which shares them with the respective charging segments without having to run any hashing algorithm. Each CS then performs a single hashing operation to verify that $h_n=\mathcal{H}\left(h_{n-1}\right)$, where n is the index of the received hash key such that $n=1,2,3,\dots ,N$.

7.3. Authentication Delay

In order to evaluate the system delay of the proposed authentication and billing scheme, the computational time for the different cryptographic protocols needs to be estimated. Accordingly, the different cryptographic protocols used in the proposed model are implemented using OpenSSL library on a system with Intel Core i7-3537U processor, 16-GB RAM, 256-GB SSD hard drive and a 64-bit Windows 10 operating system. To validate the results, the obtained computational time for the different protocols is compared with the time reported in Reference [56], which uses a machine with similar hardware specifications, namely an Intel Core i7-4702MQ processor, 16-GB RAM, 256-GB SSD hard drive and 64-bit Ubuntu 16.04 operating system. This comparison is presented in

Table 4. Computational time for the cryptographic protocols.

Operation	This Work	Ref. [56]
SHA-256 (16 bytes)	225 ns	255 ns
AES-256 CBC Encryption (16 Bytes)	109 ns	192 ns
AES-256 CBC Decryption (16 Bytes)	122 ns	-
256-bit ECDSA (nistp256) signature	30 $\mathsf{\mu }$s	46 $\mathsf{\mu }$s
256-bit ECDSA (nistp256) verification	100 $\mathsf{\mu }$s	116 $\mathsf{\mu }$s
RSA 2048 Encryption	651 $\mathsf{\mu }$s	728 $\mathsf{\mu }$s
RSA 2048 Decryption	20 $\mathsf{\mu }$s	32 $\mathsf{\mu }$s

.

As observed in Table 4, the computational time for executing the different cryptographic protocols on the machine used for this work is comparable and reasonably lower than the values reported in [56]. This validates the reliability of the utilized processor and its effectiveness for running the different cryptographic protocols. Nevertheless, the aforementioned hardware specifications are typically utilized at the CSC and the PO but are quite costly to be implemented on EV OBUs and at the charging segments. Hence, to account for the limited computational capabilities of the EV and the charging segments, the computational time for the cryptographic protocols in Table 4 is increased by $60\%$ when used to compute the time required to run these protocols on the OBUs of the EV and at the CS.

The short computational times reported in Table 4, in microseconds and nanoseconds, confirm that the adopted protocols are sufficiently lightweight and can be efficiently implemented for the proposed authentication scheme in an IoEV. For the protocols executed by the charging segments in particular, namely the hash function algorithm and symmetric key encryption/decryption, a significantly low computational time is required, which is around two orders of magnitude less than that needed for the digital signatures and asymmetric cryptography protocols. This is also significantly lower than the expected transmission delay in the DSRC link between the EV and the CS, which proves the advantage of off-loading the hashing verification operation from the EV and PO sides to the CS side, to enable faster authentication between the EV and the CS and faster charging activation as the EV approaches the charging lane.

In order to accurately assess the speed of the authentication process, the total time required to execute the proposed authentication scheme needs to be evaluated, including the time taken to sign and encrypt messages, the transmission delay of the wireless communication channel, and the time taken to decrypt the messages and verify the signatures. Accordingly, the communication links between the different network entities in the proposed model are simulated on ns-3 network simulator, using the 5G-K SimNet tool developed by [57]. For the conducted simulations, equally-sized charging segments, each of length $L=1$ m, are deployed on a road of 500 m length with segment-to-segment spacing, $d=0.25$ m, and a 5G g-Node-B (gNB) is assumed to be located in the middle of the road. A total of 400 charging segments, one EV, one CSC and one PO are simulated and a constant EV speed of 60 km/h is considered throughout the EV motion along the charging lane.

When the EV enters the charging lane, it starts to communicate with the different network entities using different communication technologies shown in Figure 3. Using the message length calculations in Table 2, the transmission delay, $T_d$, for sending a message between the EV and the CSC (or the PO) using the 5G network modeled on ns-3 is found to be $11.75$ ms. Furthermore, the wired link between the CSC and the PO, and between the PO and each charging segment has an average communication delay of $4.28$ ms.

Hence, the total computational and transmission time requirements of the proposed scheme up to message $m_9$, i.e., before the EV starts communicating with the charging segments, is shown in Figure 6. To acknowledge the difference in the computational capabilities between the different entities, an additional subscript c is used to indicate the computational time for the CSC and the PO, while the subscript e indicates the time for the EV and the CS, which is $60\%$ higher than the values reported in Table 4.

As shown in Figure 6, the time required to authenticate the EV to the PO and the CSC before reaching the first charging segment is $81.22$ ms. Hence, for an EV traveling with a constant speed of 60 km/h, the authentication protocol proposed in this work needs to be executed at least $1.35$ m before the EV reaches the first charging segment. Furthermore, the delay for the DSRC link between the EVs and the charging segments is measured by ns-3 simulations to be $0.24$ ms. The time required by the EV to encrypt the message shared to the CS is $T_{{\epsilon }_e}=0.17$$\mathsf{\mu }$s and the time required by the CS to decrypt the EV message, verify the hash key sent by the EV and encrypt the message forwarded to the next segment is $T_{d{\epsilon }_e}+T_{h_e}+T_{{\epsilon }_e}=0.73$$\mathsf{\mu }$s, which are negligible compared to the DSRC transmission delay. Accordingly, for a CS of length 1 m, the EV-segment crossing time at 60 km/hr is ≃60 ms, of which ≃0.241 ms shall be used for message encryption/decryption and transmission, while the remaining time is allocated for charging.

8. Conclusions

In this paper, an efficient, lightweight and privacy-preserving authentication and billing scheme is proposed to be utilized for dynamic wireless charging of vehicles in an IoEV. The model preserves the user’s information by using pseudonyms and supports a single aggregated bill for efficient and fair payment. Due to the limited computation capabilities of the charging segments, a lightweight EV-to-segment authentication model is employed, while major EV registration and authentication operations are performed with the charging service provider entities before the EV approaches the charging lane. In particular, hash chain generation is assigned to the entities with higher computational capabilities, namely the charging service company (CSC), while only simple hash key verification is required by the charging segments. Furthermore, the computationally extensive public key encryption and digital signature algorithms are employed by the entities with higher computational resources, namely the CSC and the PO, while the charging segments are only required to perform symmetric key encryption and decryption with lower computational requirements. This guarantees faster authentication as the EV approaches the charging lane. The proposed approach is also analyzed against different possible attacks and is considered robust against double-spending attacks, MITM attacks and impersonation attacks. Future research shall study the utilization of advanced asymmetric cryptography techniques with lower computational costs to reduce the overall execution time of the proposed scheme. In addition, integrating the proposed scheme with an EV charging coordination system shall leverage on its advantages to ensure reliable and effective energy management in an IoEV.