Henri Gouin
email: henri.gouin@univ-amu.fr

Travelling waves of density for a fourth-gradient model of fluids

Keywords: Capillary fluids, Phases transition, Lagrangian methods, Gradient theories, Travelling waves, Extended Fisher-Kolmogorov equation PACS 47.35-i, 47-57.-s, 64.60.De, 64.70.F-Mathematics Subject Classification (2000) 76T10, 76 A02

In mean-field theory, the non-local state of fluid molecules can be taken into account using a statistical method. The molecular model combined with a density expansion in Taylor series of the fourth order yields an internal energy value relevant to the fourth-gradient model, and the equation of isothermal motions takes then density's spatial derivatives into account for waves travelling in both liquid and vapour phases. At equilibrium, the equation of the density profile across interfaces is more precise than the Cahn and Hilliard equation, and near the fluid's critical-point, the density profile verifies an Extended Fisher-Kolmogorov equation, allowing kinks, which converges towards the Cahn-Hillard equation when approaching the critical point. Nonetheless, we also get pulse waves oscillating and generating critical opalescence.

Introduction

In regions where mass density ρ is not uniform, the van der Waals forces exert stresses on fluid molecules, producing surface tension effects [START_REF] Dzyaloshinsky | The general theory of van der Waals forces[END_REF][START_REF] Evans | The nature of liquid-vapour interface and other topics in the statistical mechanics of non-uniform classical fluids[END_REF][START_REF] Widom | What do we know that van der Waals did not know?[END_REF]. The meanfield molecular theory generates a system of tensions [START_REF] Rowlinson | Molecular theory of capillarity[END_REF], and its main continuous representation is known as the second-gradient model [START_REF] Germain | The method of the virtual power in continuum mechanics -Part 2: microstructure[END_REF]. The secondgradient model can provide a construction of both the free energy density of the form F ρ, (gradρ) 2 , T and the internal energy density of the form ε ρ, (gradρ) 2 , η , as temperature T and specific entropy η are conjugate variables and the two energy densities are each the Legendre transformation of the other; for fluids, Cahn and Hilliard [START_REF] Cahn | Free energy of a nonuniform system, III. Nucleation in a two-component incompressible fluid[END_REF] demonstrated that F and ε can be assumed to be function of ∆ ρ instead of (gradρ) 2 , where ∆ and grad are the harmonic operator and the gradient, respectively.

The use of higher-order strain-gradient models has been studied for a long time in solid mechanics ( [START_REF] Maugin | Nonlocal theories or gradient-type theories -A matter of convenience[END_REF][START_REF] Rosenau | Dynamics of nonlinear mass-spring chains near the continuum limit[END_REF][START_REF] Dell'isola | How contact interactions may depend on the shape of Cauchy cuts in N-th gradient continua: approach "à la d'Alembert[END_REF][START_REF] Gouin | Vesicle model with bending energy revisited[END_REF] and references therein). One of the reason, because higher gradients are introduced in the framework of classical continuum mechanics, is to introduce dispersive effects in the mathematical model. This is a necessary step to study dispersive wave or localisation phenomena [START_REF] Peerlings | A critical comparison of nonlocal and gradient-enhanced softening continua[END_REF][START_REF] Askes | A classification of higher-order strain-gradient models -linear analysis[END_REF]. In fluid dynamics mathematical models that takes into account higher order derivatives of the stretching tensor have been introduced mainly to describe dipolar fluids and turbulence [START_REF] Bleustein | Dipolar fluids[END_REF][START_REF] Rubin | Continuum model of dispersion caused by an inherent material characteristic length[END_REF][START_REF] Fried | Tractions, balances, and boundary conditions for nonsimple materials with application to liquid flow at small-length scales[END_REF][START_REF] Jordan | Anomalous propagation of acoustic traveling waves in thermoviscous fluids under the Rubin-Rosenau-Gottlieb theory of dispersive media[END_REF]. In the present paper we consider higher gradients of the density. This is the strategy used by Korteweg to study capillarity [START_REF] Truesdell | The non-linear field theories of mechanics[END_REF], in the framework of the van der Waals model in the critical region [START_REF] Gouin | Thermodynamic form of the equation of motion for perfect fluids of grade n[END_REF], and to study fluid mechanics in nanotubes [START_REF] Gȃrȃjeu | Scaling Navier-Stokes equation in nanotubes[END_REF].

It is interesting to notice that the study of models containing higher order derivatives of the density has a clear interpretation in the framework of the mean-field molecular model. In fact, the extension obtained via the request of molecular range turns out to be effective in the construction of a new interpolating model compatible with fluctuations of density near the critical point. The internal energy takes the fourth derivative of the density into account in a three-dimensional space. The tension-like coefficients are not just formal computation: their values can be estimated by molecular forces and compared near the critical point.

Starting from the classical framework of kinetic theory of gases [START_REF] Rocard | Thermodynamique[END_REF], and using as basic constitutive quantities the potentials of the van der Waals forces, as done in [START_REF] Israelachvili | Intermolecular forces[END_REF][START_REF] Gouin | Energy of interaction between solid surfaces and liquids[END_REF], we consider an expansion in the density up to the fourth order and we obtain a new model for the volume energy. This new model is named a fourth-gradient fluid. We point out that the truncation of the Taylor's expansion to the fourth order is dictated by the fact that if we use the principle of virtual works (or virtual powers) and we consider that at the boundary edges and points of the domain of interest only vector forces are applied, this is the higher meaningful derivative in the sense of distributions theory [START_REF] Schwartz | Théorie des Distributions[END_REF][START_REF] Gouin | The d'Alembert-Lagrange principle for gradient theories and boundary conditions[END_REF]. The physical motivation is given by the interest to have a more detailed model of the interface at the nanoscale where small oscillations on the density profile are observed [START_REF] Mecke | Molecular dynamics simulation of the liquidvapor interface: The Lennard-Jones fluid[END_REF].

Using this approach, the equation of density profile through planar fluid interfaces is deduced together with the equation of isothermal travelling waves of density in liquid and vapour phases. Near the critical point, the equation of fluid density for equilibrium and motion is in the form of an Extended Fisher-Kolmogorov equation [START_REF] Swift | Hydrodynamic fluctuations at the convective instability[END_REF]. In the case of water, it is possible to estimate the relative values of the constitutive coefficients and consequently to compare the solutions of the Extended Fisher-Kolmogorov equation with the ones coming from the Cahn and Hilliard equation. It is interesting that this new model is able to predict very interesting solutions that share important feature with what is observed in experiments at least from a qualitative point of view [START_REF] Mecke | Molecular dynamics simulation of the liquidvapor interface: The Lennard-Jones fluid[END_REF].

The paper is organised as follows. In Section 2, we present a three-dimensional molecular model issued from the mean-field theory with application to water in the case of London's forces. In Section 3, we propose the conservative equation of isothermal motions. In Section 4, we consider planar interfaces which are specific to the vicinity of fluid's critical point; the profile of density near the fluid's critical point verifies an Extended Fisher-Kolmogorov equation generating oscillating pulses of density in the case of isothermal travelling waves. A conclusion and an appendix with some technical details end the paper.

A fourth-gradient fluid energy

General case

In the mean-field theory of hard-sphere molecules, all the fluid's molecules are identical and of mass m l . The central forces between molecules derive from a potential denoted ϕ(r) ≡ m 2 l ψ(r), where r is the distance between the centres of two molecules. In three-dimensional Euclidian medium D, the potential energy W O resulting from the combined action of all the molecules on the molecule located at origin O is assumed to be additive such that,

W O = i m 2 l ψ(r i ).
The summation is extended to all the fluid's molecules (except for the molecule located at origin O) and r i is the distance between the centres of molecule i and of the molecule at O. The number of molecules in the volume dv is represented by ν(x, y, z) dv, where dv denotes the volume element in D at point of coordinates x, y, z, and in a continuous representation,

W O = D ϕ(r) ν dv ≡ ∞ σ l ϕ(r) S ν ds dr,
where S is the sphere of centre O and radius r, and σ l is the molecular diameter. We assume that ν is an analytic function of coordinates x, y, z, i.e.

ν = ν(0, 0, 0) + ∞ n=1 1 n ! x ∂ν ∂x (0, 0, 0) + y ∂ν ∂y (0, 0, 0) + z ∂ν ∂z (0, 0, 0) (n)
.

Usually expansion (1) is limited to the second order. We notice that for any integers p, q, r,

S

x 2p+1 y q z r ds = 0, and

S x 2 ds = S y 2 ds = S z 2 ds = 4 π r 4 3 .
Then,

W O = ∞ σ l m 2 l ψ(r) 4 π r 2 ν O + 2π 3 r 4 ∆ν O dr.
Here ν O ≡ ν(0, 0, 0) and ∆ν O ≡ ∆ν(0, 0, 0). Let us denote

2 κ = ∞ σ l 4 π r 2 ψ(r) dr, 2 k b 2 = ∞ σ l 2 π 3 r 4 ψ(r) dr, ( 2
)
where b is the fluid's covolume [START_REF] Rocard | Thermodynamique[END_REF]. Then,

W O = 2 m 2 l k ν O + b 2 ∆ν O = 2 m l k ρ O + b 2 ∆ρ O ,
where ρ O = m l ν O is the mass density at O. Consider that couples of molecules are counted twice, the potential energy density per unit volume is

E O = 1 2 ν O W O = k ρ 2 O + b 2 ρ O ∆ρ O
and the corresponding potential energy of all the fluid is

W = D k ρ 2 + b 2 ρ ∆ρ dv. (3)
To obtain the internal energy, we have to take into account the kinetic effects of molecular motions where first term k ρ 2 in Eq. ( 3) corresponds to the internal pressure. Consequently, the specific internal energy writes

ε = α(ρ, η) + k b 2 ρ ∆ρ,
where α(ρ, η) is the internal energy of the homogeneous fluid of densities ρ, η.

But, ρ ∆ρ = div(ρ grad ρ) -(grad ρ) 2 ,
where div is the divergence operator and ∆ρ ≡ divgrad ρ.

W = D k ρ 2 -b 2 (gradρ) 2 dv + Σ k b 2 ρ (n.grad ρ) dσ,
where n is the external unit vector to Σ. When we assume that ρ is uniform on the boundary, the flux term on boundary Σ is null. If we note λ = -2 k b 2 , we get the internal energy per unit volume in the gradient form :

ρ ε = ρ α(ρ, η) + λ 2 (grad ρ) 2 ,
which corresponds to the model of internal capillarity for the simplest case of second-gradient theory [START_REF] Widom | What do we know that van der Waals did not know?[END_REF][START_REF] Gouin | Energy of interaction between solid surfaces and liquids[END_REF][START_REF] Gouin | The d'Alembert-Lagrange principle for gradient theories and boundary conditions[END_REF]. Now we consider an expansion of Eq. ( 1) up to the fourth order. Odd order terms have zero integrals, then

1 3 ! x ∂ν ∂x (0, 0, 0) + y ∂ν ∂y (0, 0, 0) + z ∂ν ∂z (0, 0, 0) (3)
is not taken into account, and in the expansion

1 4 ! x ∂ν ∂x (0, 0, 0) + y ∂ν ∂y (0, 0, 0) + z ∂ν ∂z (0, 0, 0) (4)
, only the two terms

1 4 ! x 4 ∂ 4 ν ∂x 4 (0, 0, 0) + y 4 ∂ 4 ν ∂y 4 (0, 0, 0) + z 4 ∂ 4 ν ∂z 4 (0, 0, 0) , 6 4 ! x 2 y 2 ∂ 4 ν ∂x 2 ∂y 2 (0, 0, 0) + y 2 z 2 ∂ 4 ν ∂y 2 ∂z 2 (0, 0, 0) + z 2 x 2 ∂ 4 ν ∂z 2 ∂x 2 (0, 0, 0) must be considered. Taking into account D x 2 y 2 ϕ(r)dv = D y 2 z 2 ϕ(r) dv = D z 2 x 2 ϕ(r) dv = 4 π 15 ∞ σ l ϕ(r) r 6 dr,
ϕ(r)dv

= π 30 ∞ σ l ∆(∆ρ) ϕ(r) r 6 dr.
This means that we have to add to the second member of Eq. ( 3) the term c 4 ρ ∆ 2 ρ, and

W = D k ρ 2 + b 2 ρ ∆ρ + c 4 ρ ∆ 2 ρ dv,
where ∆ 2 ρ ≡ ∆(∆ρ) is the biharmonic operator and

2 k c 4 = π 30 ∞ σ l ϕ(r) r 6 dr. (4)
Consequently, for the specific internal energy and the volume free energy of the fluid in the fourth-gradient order case,

ε = α(ρ, η) - λ 2 ∆ρ - γ 2 ∆ 2 ρ,
and

F = f (ρ, T ) - λ 2 ρ ∆ρ - γ 2 ρ ∆ 2 ρ,
respectively, with γ = -2 k c 4 . Term f (ρ, T ) is the volume free energy of the homogeneous fluid of density ρ and temperature T .

Numerical application to London's forces

The London potential of fluid/fluid interaction usually writes ϕ ll = -c ll /r 6 , where c ll is the intermolecular coefficient ( [START_REF] Israelachvili | Intermolecular forces[END_REF][START_REF] Hamaker | The London-van der Waals attraction between spherical particles[END_REF]). In the simple form 1/r 7 , the force range is infinite; to obtain a convergent expansion of the density in the volume integrals at boundary ∞, it is necessary to give range L of London's forces. London's forces being infinite for r < σ l , we additively assume that they are null for r > L. Then ϕ ll = -c ll /r 6 when σ l < r < L and ϕ ll = ∞ when r ≤ σ l . From Eqs. ( 2) and ( 4), we deduce

λ = 2πc ll 3 m 2 l σ l , γ = πc ll L 30 m 2 l ,
(when σ l /L ≪ 1, L can be considered as infinite for the calculation of λ).

In the case of water, the physical measurements are indicated in c.g.s. units [START_REF] Israelachvili | Intermolecular forces[END_REF][START_REF]Handbook of Chemistry and Physics[END_REF][START_REF] Gouin | Liquid nanofilms. A mechanical model for the disjoining pressure[END_REF]: c ll = 1.4 × 10 -58 , σ l = 2.8 × 10 -8 , m l = 2.99 × 10 -23 , λ = 1.17 × 10 -5 . The development of energy at the fourth order needs to take the force range into account; when L = 2 × 10 -6 cm, which is the average range of van der Waals forces, we get γ = 3.28 × 10 -20 . Let us note that if we slightly change the L-value, the γ-value changes only linearly.

The ratio γ/λ has the dimension of a square-length and γ/λ = 7.5×10 -8 cm. Consequently, an appropriate unit of length at the molecular scale is ℓ = γ/λ, which is of the same order than the molecular diameter.

Equation of isothermal conservative motions

The principle of virtual works (or virtual powers) is always a convenient way to obtain the equation of motions [START_REF] Lin | A new variational principle for isoenergetic flows[END_REF][START_REF] Seliger | Variational principle in continuum mechanics[END_REF][START_REF] Serrin | Mathematical principles of classical fluid mechanics[END_REF][START_REF]Variational Models and Methods in Solid and Fluid Mechanics[END_REF]. A particle is identified in a Lagrange representation by reference position X of coordinates X, Y, Z in reference configuration D 0 ; its position is given in D by the Euler representation x of coordinates x, y, z. The variations of particle motions can be deduced from families of virtual motions of the fluid written as

X = Ψ (x, t; β),
where β denotes a real parameter defined in the vicinity of 0 and the real motion corresponds to β = 0. Virtual displacements in the reference configuration are associated with any variation of the real motion and can be written as [START_REF] Gouin | Thermodynamic form of the equation of motion for perfect fluids of grade n[END_REF],

δX = ∂Ψ ∂β (x, t; β) β=0 .
Variation δX is dual and mathematically equivalent to Serrin's variation ( [START_REF] Serrin | Mathematical principles of classical fluid mechanics[END_REF], p. 145). Neglecting the body forces, the Lagrangian of the fluid writes,

Λ = 1 2 ρ u ⋆ u -F,
where u denotes the particle velocity and ⋆ the transposition. The equation of isothermal motions stationarises

G = D Λ dv.
The density satisfies the mass conservation

∂ρ ∂t + div(ρu) = 0 ⇐⇒ ρ det F = ρ 0 (X), (5)
where F ≡ ∂x/∂X and ρ 0 is defined on D 0 . Classical methods yield the variation of G. The variation in D 0 commutes with the derivatives with respect to x (δgrad p ρ = grad p δρ, p ∈ N ). As usual, we assume that virtual displacements are null on boundary ∂D and consequently variations of integrated terms are null on this boundary. By using Stokes' formula, we integrate by parts; from δG = G ′ (β)| β=0 , we get (see Appendix for details)

δG = D 1 2 u ⋆ u - ∂f (ρ, T ) ∂ρ + λ ∆ρ + γ ∆ 2 ρ δρ + ρ u ⋆ δu dv.
By taking Eq. ( 5) into account,

δρ = ρ div 0 δX + 1 detF ∂ρ 0 ∂X δX,
where div 0 is the divergence operator in D 0 . The definition of the velocity implies ∂X (x, t) ∂x u + ∂X (x, t) ∂t = 0, and therefore,

∂δX ∂x u + ∂X ∂x δu + ∂δX ∂t = 0 ⇐⇒ δu = -F δX,
where the superposed dot is the material derivative. By denoting

K = ∂f (ρ, T ) ∂ρ -λ ∆ρ -γ ∆ 2 ρ and m = 1 2 u ⋆ u -K , δG = D m δρ -ρ (u ⋆ F ) δX dv
and by integration by part on D 0 ,

δG = D0 ρ 0 ( u ⋆ F ) -grad ⋆ 0 m δX dv 0 ,
where grad 0 is the gradient and dv 0 the volume element, in D 0 . The principle of virtual work reads:

F or any displacement δX null on the edge of D 0 , δG = 0.

We get ( u ⋆ F ) = grad ⋆ 0 m. Noticing that

a ⋆ + u ⋆ ∂u ∂x F = ( u ⋆ F ),
where a is the acceleration vector,

a + grad K = 0. (6)
Obviously, K has the same physical dimension as a chemical potential. From ∂f (ρ, T )/∂ρ ≡ µ 0 (ρ, T ), where µ 0 (ρ, T ) is the chemical potential of the fluid bulk, at equilibrium and temperature T we get,

K = µ 0 -λ ∆ρ -γ ∆ 2 ρ,
and equation of motion ( 6) yields the potential acceleration value for the fourth-gradient fluid.

4 Case of planar interfaces

Fluid at equilibrium

The one-dimensional equilibrium equation writes

K = µ 01 , with K = µ 0 (ρ, T ) -λ d 2 ρ dx 2 -γ d 4 ρ dx 4 (7)
where d/dx is the derivative with respect to space variable x across the interface and µ 01 is a convenient additive constant. If we consider the limit case when γ = 0, we are back to the Cahn and Hilliard equation. Equation ( 7) multiplied by dρ/dx yields,

d dx 1 2 λ dρ dx 2 + x -∞ γ d 4 ρ dx 4 dρ dx dx = d dx [f -µ 01 ρ ] .
Taking into account the fact that

d dx x -∞ d 4 ρ dx 4 dρ dx dx = d dx d 3 ρ dx 3 dρ dx - 1 2 d 2 ρ dx 2 2 ,
the equilibrium equation has a first integral in the form of an energy equation,

1 2 λ dρ dx 2 + γ d 3 ρ dx 3 dρ dx - 1 2
d 2 ρ dx 2 2 = f -µ 01 ρ -f 1 ,
where f 1 is an additive constant.

Equation of one-dimensional travelling waves

Let us study the problem when scalar velocity u and density ρ are only functions of variable ζ ≡ x -c t, where t is the time and c the wave celerity with respect to a Galilean reference frame,

u = u (x -c t), ρ = ρ (x -c t).
Mass balance equation ( 5) yields

-c dρ dζ + d(ρ u) dζ = 0
and by integrating, we obtain

ρ (u -c) = q ,
where q is constant along the interfacial motion. In the case of waves, we obtain the acceleration,

a = 1 2 d(u -c) 2 dζ = 1 2 d dζ q ρ 2 . ( 8
)
In one-dimensional cases, Eqs. ( 6) and ( 8) yield d dζ

1 2 q ρ 2 + µ 0 -λ d 2 ρ dζ 2 -γ d 4 ρ dζ 4 = 0 and consequently, λ d 2 ρ dζ 2 + γ d 4 ρ dζ 4 = µ 0 -µ 02 + 1 2 q ρ 2 , ( 9
)
where µ 02 is a convenient additive constant.

Fluid at equilibrium near the critical point

Near the critical point, µ 0 (ρ, T )-µ 01 may be expanded in powers of ̺ ≡ ρ-ρ c , where ̺ denotes the deviation of ρ from its critical values ρ c :

µ 0 (ρ, T ) -µ 01 = -A(T c -T ) ̺ + B ̺ 3 , (10)
where A and B are two positive constants ( [START_REF] Rowlinson | Molecular theory of capillarity[END_REF], page 250) such that A = µ c ,11

and B = (1/6) µ c ,30 where

µ c ,ij = ∂ i+j µ 0 ∂ρ i ∂T j (ρ c , T c ) ( 11
)
and T c is the critical temperature.

When T < T c , the densities ρ l and ρ g of the liquid and vapour bulks at phase equilibrium satisfy the Maxwell equal-area rule, and by symmetry are the zeros other than ρ = ρ c in equation µ 0 (ρ, T ) -µ 01 = 0 :

ρ l ∼ ρ c + (T c -T ) B , ρ g ∼ ρ c - (T c -T ) B .
By taking Eqs. (7-10) into account, we obtain at equilibrium

γ d 4 ̺ dx 4 + λ d 2 ̺ dx 2 = -A (T c -T ) ̺ + B ̺ 3 . (12) 4.3.1 Rescaling
of Eq. ( 12)

We mainly consider the case when T < T c corresponding to a fluid at a temperature lower than its critical value. One way to study Eq. ( 12) is as follows. Two characteristic lengths are in competition :

ℓ 1 = λ A (T c -T ) and ℓ 2 = 4 γ A (T c -T ) . (13)
The two lengths are connected by the relation d × ℓ 1 = ℓ 2 2 with d = γ/λ . We define scalar τ and mass m as

τ = ℓ 2 2 d 2 ≡ λ γ A (T c -T ) , m = ℓ 2 γ B . (14)
In the system of units associated with unit length ℓ 2 and unit mass m, Eq. ( 12) writes

d 4 ̺ dx 4 + τ d 2 ̺ dx 2 = ̺ 3 -̺, (15)
which is an extended form of the Fisher-Kolmogorov equation. Let us consider the van der Waals equation of state,

p = (R/M ) T ρ 1 -b ρ -a ρ 2 ,
where p is the thermodynamical pressure of bulks, R/M is the perfect gas constant per unit mass, a is the measure of attraction between particles and b is the covolume previously defined in Section 2.1. Classical calculations using Eq. ( 11) yield the values of A and B:

A ≡ µ c ,11 = 6 p c T c ρ 2 c , B ≡ 1 6 µ c ,30 = 3 p c 2 ρ 4 c , (16)
where p c is the fluid's critical pressure.

Let us note that when T > T c , Eqs. [START_REF] Bleustein | Dipolar fluids[END_REF][START_REF] Rubin | Continuum model of dispersion caused by an inherent material characteristic length[END_REF] are modified by replacing (T c -T ) by (T -T c ) and Eq. ( 15) by

d 4 ̺ dx 4 + τ d 2 ̺ dx 2 = ̺ 3 + ̺. (17)

The case of water

In the case of water, the physical measurements are indicated in c.g.s. units [START_REF] Israelachvili | Intermolecular forces[END_REF][START_REF]Handbook of Chemistry and Physics[END_REF][START_REF] Gouin | Liquid nanofilms. A mechanical model for the disjoining pressure[END_REF] :

ρ c = 0.325, p c = 2, 185 × 10 8 , T c = 647.3 • K.
From water values already proposed in Section 2.2, we get d = 5.3 × 10 -8 cm. From Eq. ( 16), we obtain

ℓ 1 ≃ 3 × 10 -8 1 -(T /T c ) cm and ℓ 2 ≃ 4 × 10 -8 4 1 -(T /T c ) cm .
Two lengths ℓ 1 and ℓ 2 are equal when τ = 1 corresponding to temperature T ≃ 430 [START_REF] Peletier | Spatial Patterns Higher Order Models in Physics and Mechanics[END_REF] to study the solutions of Eqs. ( 15) and [START_REF] Truesdell | The non-linear field theories of mechanics[END_REF].

In Fig. 1 we draw the phase-transition in mass density near the critical point at T ≃ 646 • K. The form of this phase-transition pulse is not essentially different from the case when γ = 0.

Travelling waves near the critical point

When body forces are neglected, Eq. ( 9) writes at t=0 (we replace x by ζ to obtain the wave's profile at any time t):

λ d 2 ̺ dx 2 + γ d 4 ̺ dx 4 = -A (T c -T ) ̺ + B ̺ 3 + 1 2 q ρ 2 + µ 02 . (18)
Another way to study Eq. ( 18) in place of method in Section 2.1 is as follows.

We consider the case when T < T c . 15) are such that x-axis unit is 2.7 × 10 -7 cm ≡ 2.7 nm and y-axis unit is 3.2 × 10 -6 g/cm 3 .

In place of ρ (or ̺), x and q, we use the non-dimensional variables Y , z and Q such that :

ρ = ρ c (1 + εY ), x = L z, q = χ Q, with ε 2 = A(T c -T ) Bρ 2 c , L 2 = λ A(T c -T ) , χ 2 = 2 A 3 2 B 1 2 (T c -T ) 3 2 .
Then, Eq. ( 18) yields

d 2 Y dz 2 + γ A (T c -T ) λ 2 d 4 Y dz 4 = Y 3 -Y + Q 2 (1 + εY ) 2 + µ 1 . ( 19
) But Q 2 (1 + εY ) 2 = Q 2 -2 ε Q 2 Y + 3 ε 2 Q 2 Y 2 + 0 (ε 3 ) Equation (19) yields d 2 Y dz 2 + γA(T c -T ) λ 2 d 4 Y dz 4 = (Y + ε 2 Q 2 ) 3 -Y (1 + 2 ε Q 2 ) + µ 2 , (20)
where µ 1 and µ 2 are two additive constants. Let us consider the new change of variables:

Y = -ε 2 Q 2 + κ R, z = y κ , with κ 2 = 1 + 2 ε Q 2 , Equation (20)
yields

d 2 R dy 2 + κ 2 γ A (T c -T ) λ 2 d 4 R dy 4 = R 3 -R + R 0 . ( 21
)
where R 0 is constant. Generally, when we are close to equilibrium, we can consider that κ ≈ 1 and Eq. ( 21) reduces to :

d 2 R dy 2 + γ A (T c -T ) λ 2 d 4 R dy 4 = R 3 -R + R 0 .
Again, we obtain an Extended Fisher-Kolmogorov equation and, when T < T c , we have to estimate the value of positive term γ A (T c -T )/λ 2 which tends to zero when T tends to T c . (The case T > T c can be analogously deduced). When the coefficient in front of the fourth-order derivative is positive, solutions provided by the Extended Fisher-Kolmogorov equation are richer and more realistic than those provided by the Cahn-Hilliard equation in the vicinity of the critical point. Whereas the Cahn-Hilliard theory predicts only the possibility of monotonic kinks, here different density profiles are possible and especially oscillating pulse waves are admitted (cf. [START_REF] Peletier | Spatial Patterns Higher Order Models in Physics and Mechanics[END_REF] -Chapter 9 and [START_REF] Chaparova | Existence and nonexistence of nontrivial solutions of semilinear fourth-and sixth-order differential equations[END_REF]). Figures 2 and3 allow to compare -in second and fourth-gradient models -pulses near the critical point of water at T ≃ 646 • K. Fig. 2 Pulse ( in form ̺ = F 1 (x) ) near the water critical point at T ≃ 646 • K when γ = 0 (second-gradient model); x-axis unit is 2.7 × 10 -7 cm ≡ 2.7 nm and y-axis unit is 3.2 × 10 -6 g/cm 3 .

Concluding remarks

Characteristic lengths ℓ 1 and ℓ 2 , and τ defined in Section 3 grow to infinity when T tends to T c . Consequently, term τ d 2 ̺/dx 2 is preponderant over term d 4 ̺/dx 4 and Eq. ( 15) merges into the corresponding Cahn-Hilliard equation. These results correspond to the point of view in ([3], [4] -Chapter 9) that near the critical point, the energy expansion of the fluid may be approximated by a gradient expansion typically truncated at the second order. Nevertheless, the results we have found with an expansion truncated at the fourth order are more in accordance with the renormalisation group theory due to the possibility of oscillating pulse waves generating the density opalescence observed as the fluid approaches its critical point [START_REF] Widom | Fundamental problems in statistical mechanics III[END_REF] and [START_REF] Mecke | Molecular dynamics simulation of the liquidvapor interface: The Lennard-Jones fluid[END_REF]. The differences in pulsewave oscillations between second and fourth-gradient models allow to revisit papers introducing kinks versus pulses as in [START_REF] Truskinovsky | Kinks versus shocks[END_REF]. We believe that this result is remarkable and will hopefully stimulate further and deeper investigations on both theoretical and phenomenological nature. Finally, it is interesting to note -and it is not the case for the second gradient model -that the fourth-gradient model is able to take the range of London intermolecular forces into account.

Appendix: Some useful formulae

We take into account the following results :

ρ divgrad ρ = div(ρ grad ρ) -(grad ρ) 2 .
Term div(ρ grad ρ) can be integrated on the boundary of D, and consequently, -δ( λ 2 (grad ρ) 2 ) corresponds in D to -λ grad ⋆ ρ grad δρ ≡ -λ div(δρ grad ρ) + λ (divgradρ) δρ and the variation of λ 2 ρ ∆ρ is λ ∆ρ δρ.

In a similar way, ρ div grad(divgrad ρ) ≡ div ρ grad(divgrad ρ) -grad ⋆ ρ grad(divgrad ρ).

Term div ρ grad(divgrad ρ) can be integrated on the boundary of D and -grad ⋆ ρ grad(divgradρ) ≡ -div (divgrad ρ) grad ρ + (divgrad ρ) 2 .

Integrating on the boundary of D the term -div (divgrad ρ) grad ρ , and considering that the variation of ρ div grad(divgrad ρ) is the same as the variation of (divgrad ρ) 2 we obtain 2 (divgrad ρ) (divgrad δρ) ≡ 2 div (divgrad ρ) grad δρ -2 grad ⋆ (divgrad ρ) grad δρ.

Term 2 div (divgrad ρ) grad δρ can be integrated on the boundary of D and -2 grad ⋆ (divgrad ρ) grad δρ ≡ -2 div δρ grad(divgradρ) +2 divgrad(divgradρ) δρ.

Term -2 div δρ grad(divgradρ) can be integrated on the boundary of D and the variation of γ 2 ρ ∆ 2 ρ is γ divgrad(divgradρ) δρ ≡ γ (∆ 2 ρ) δρ.

Fig. 1

 1 Fig.1Phase-transition kink ( in form ̺ = F 0 (x) ) near the water critical point at T = 646 • K. The units associated with length and mass in Eq. (15) are such that x-axis unit is 2.7 × 10 -7 cm ≡ 2.7 nm and y-axis unit is 3.2 × 10 -6 g/cm 3 .

Fig. 3

 3 Fig.3Pulse ( in form ̺ = F 2 (x) ) near the water critical point at T ≃ 646 • K when γ = 0 (fourth-gradient model); x-axis unit is 2.7 × 10 -7 cm ≡ 2.7 nm and y-axis unit is 3.2 × 10 -6 g/cm 3 .

  • K, but for T ≃ 646 • K, τ ≃ 23 and for T ≃ 647.2 • K, τ ≃ 46 ; only very close to the critical point, d 4 ̺/dx 4 can be neglected with respect to τ d 2 ̺/dx 2 . Following the values of τ , we can refer to the monograph by Peletier and Troy

Acknowledgements:

H.G. and G.S. are grateful to the Carnot Star program at Aix-Marseille University and GNFM of Italian INDAM for partial supports. The authors thank Dr. M. Gȃrȃjeu for his scrutiny in the numerical exactness of Fig. 3.


Tan Heng Chuan

Jun Zhang
email: jun.zhang@telecom-paristech.fr

Ma Maode

Peter Han

Joo Chong
email: ehjchong@ntu.edu.sg

Houda Labiod
email: labiod@telecom-paristech.fr

Secure Public Key Regime (SPKR) in Vehicular Networks

Keywords: Schnorr signature, certificate-less PKI, Denial of Service Attacks, Collusion Attacks

Public Key Regime (PKR) was proposed as an alternative to certificate based PKI in securing Vehicular Networks (VNs). It eliminates the need for vehicles to append their certificate for verification because the Road Side Units (RSUs) serve as Delegated Trusted Authorities (DTAs) to issue up-to-date public keys to vehicles for communications. If a vehicle's private/public key needs to be revoked, the root TA performs real time updates and disseminates the changes to these RSUs in the network. Therefore, PKR does not need to maintain a huge Certificate Revocation List (CRL), avoids complex certificate verification process and minimizes the high latency. However, the PKR scheme is vulnerable to Denial of Service (DoS) and collusion attacks. In this paper, we study these attacks and propose a pre-authentication mechanism to secure the PKR scheme. Our new scheme is called the Secure Public Key Regime (SPKR). It is based on the Schnorr signature scheme that requires vehicles to expend some amount of CPU resources before RSUs issue the requested public keys to them. This helps to alleviate the risk of DoS attacks. Furthermore, our scheme is secure against collusion attacks. Through numerical analysis, we show that SPKR has a lower authentication delay compared with the Elliptic Curve Digital Signature (ECDSA) scheme and other ECDSA based counterparts.

I. INTRODUCTION

Public key cryptography is used to secure communications in Vehicular Networks (VNs). It guarantees message authentication, integrity and non-repudiation with digital signatures. The private key is used to generate a digital signature whereas the public key is used for verifying the digital signature. If the hash value of the message matches the hash value of the received signature after decryption, it proves that the message is not altered (integrity property) and that the message was created by a known sender such that the sender cannot deny having send the message (authentication and nonrepudiation property). However, since the public keys are published publicly, it has the problem ascertaining if a public key truly belongs to the purported owner. An attacker can create a private/public key pair and then announces it to the entire network that the public key he publishes belongs to another user, for example, Bob. Therefore, when other nodes sends confidential messages encrypted using Bob's public key, the attacker decrypts and reads the message instead. To solve this issue related to the ownership of public key, Public Key Infrastructure (PKI) is used. In North America, the IEEE Wireless Access in Vehicular Environments (WAVE) standard [START_REF] Uzcategui | WAVE: a tutorial[END_REF] describes the IEEE standard 1609.2 [START_REF]IEEE Trial-Use Standard for Wireless Access in Vehicular Environments -Security Services for Applications and Management Messages[END_REF] that specifies that a PKI to be employed to secure WAVE messages. In Europe, European Telecommunications Standards Institutes group for Intelligent Transport Systems (ETSI ITS G5) establishes the ETSI TS 102 940 standard [START_REF] Institute | Intelligent Transport Systems (ITS); Security; ITS communications security architecture and security management[END_REF] that mandates the use of a PKI for secure communication.

In a PKI, a Certificate Authority (CA) issues digital certificate to attest the credentials of the entities taking part in a communication protocol. Since the CA is trusted by all entities in the network, any node that receives a digital certificate that is signed by the CA can be ensured of the authenticity of the public key. The digital certificate contains binding between the public key and one or more attributes related to the user's identity. Unfortunately, employing a PKI in VNs has several limitations as highlighted in [START_REF] Wasef | Complementing public key infrastructure to secure vehicular ad hoc networks [security and privacy in emerging wireless networks[END_REF][START_REF] Shen | An efficient public key management system: an application in vehicular ad hoc networks[END_REF][START_REF] Slagell | A survey of PKI components and scalability issues[END_REF]. First of all, each vehicle is required to store large amount of certificates (Long Term Certificates/Pseudonyms Certificate) for PKI support which leads to storage overhead issue. At the same time, each vehicle needs to append its certificate signed by the CA to the message during transmission which increases the message overhead. This results in wastage of resources and valuable communication bandwidth. Another issue is the need to maintain a huge Certificate Revocation List (CRL) which does not scale well with increasing network size. Furthermore, the freshness of public keys cannot be guaranteed because CRL is disseminated only periodically by the CA. A vehicle may unknowingly accept a public key that has already been revoked. After receiving the certificate, vehicle needs to (1) check the expiry date of the certificate, (2) check the received certificate against a recent issued Certification Revocation List (CRL) to verify its status and (3) verify the CA's digital signature on the received signed certificate. This introduces much latency which is undesirable in most critical VNs applications that have strict delay requirements. For example, forward collision warning requires a frequency of 10 messages per second with a maximum latency of 100ms [START_REF] Hartenstein | A tutorial survey on vehicular ad hoc networks[END_REF].

To address the inefficiency of certificate based PKI, a Public Key Regime (PKR) scheme [START_REF] Shen | An efficient public key management system: an application in vehicular ad hoc networks[END_REF] was proposed. It is designed based on the public file concept where each Road Side Unit (RSU) in the network is given a public key directory by the Trusted Authority (TA). This public key directory contains the vehicles' IDs and their corresponding public keys already certified by a Trusted Authority (TA). To start a communication in the network, a vehicle has to broadcast its identity to the other communicating vehicle and the receiving vehicle sends a public key query to a nearby RSU to request for the sender's public key. Evaluation results show that the transmission overhead of the PKR scheme is lower than the certificate based PKI because the certificate is eliminated from the transmission. It also has a lower latency compared with the certificate based PKI because time-consuming certificate verifications are eliminated and there is no need to download huge CRL making it very scalable in a large scale environment.

However, PKR scheme is designed without security considerations. Since the RSU needs to service many query requests from the vehicles in a region, this may result in a bottleneck at the RSU leading to a Denial of Service (DoS) attack, compromising on the availability of service. Moreover, in the scheme, all the RSUs maintaining the public key directory are assumed to be trusted which exposes a security risk. The RSU can misbehave to launch a colluding attack with a malicious vehicle to issue a signed public key belonging to a colluding vehicle. Consequently, messages encrypted using a session key derived from the public key of the colluding vehicle will be compromised.

In this paper, we examine these two threats and propose several extensions to the PKR scheme. Our proposed solution is called the Secure Public Key Regime (SPKR) scheme. To mitigate the DoS attacks, the key idea is to let the requesting vehicle expends equal amount of computing power when it requests for public keys from the RSU. In this way, it discourages internal attackers from launching DoS attacks. To achieve this, we introduce a mutual pre-authentication scheme between a vehicle and an RSU whereby two communicating parties have to exchange signatures for verification before the requested public key is issued. This involves both parties to commit some CPU resources. External DoS attackers are also prevented since the unauthorized vehicles will not pass the authentication process. To solve collusion attacks, several changes are made to the stored public key directory held by each RSU.

The rest of the paper is organized as follows. Section II reviews the related works. Section III provides an overview of the PKR scheme and describes the two security threats. Section IV describes the system model. Section V discusses the SPKR scheme in details. Section VI analyses the security and performance of SPKR scheme. Section VII concludes the paper.

II. RELATED WORKS

The issues of certificate based PKI are widely known and discussed. Besides the PKR scheme [START_REF] Shen | An efficient public key management system: an application in vehicular ad hoc networks[END_REF], several other works have been proposed to make certificate based PKI more efficient. In [START_REF] Wasef | MAAC: Message Authentication Acceleration Protocol for Vehicular Ad Hoc Networks[END_REF], Wasef and Shen propose a Message Authentication Acceleration Protocol (MAAC) to accelerate the traditional CRL checking process. It uses a keyed Hash Message Authentication Code (HMAC) together with a secret key shared only among unrevoked vehicles to check that a vehicle is not previously revoked before proceeding to check the certificate against the CRL In this manner, MAAC avoids the long delay in checking the vehicle's certificate against a huge CRL list. Other approaches [START_REF] Jinyuan | An Identity-Based Security System for User Privacy in Vehicular Ad Hoc Networks[END_REF] [10] uses the ID-based cryptography to simplify the certificate management process. In an ID based system, the vehicle's identity is used as a public key for signing and verifying messages which greatly reduces the communication and computation overhead.

To mitigate external DoS attacks, Wasef et al. [START_REF] Wasef | Complementing public key infrastructure to secure vehicular ad hoc networks [security and privacy in emerging wireless networks[END_REF] propose to append a Hash based Message Authentication Code (HMAC) to all the outgoing signed messages when the number of invalid signatures to the number of received messages exceeds a certain threshold. The HMAC is generated using a common group key shared among all unrevoked vehicles. When other vehicles receive the message attached with the HMAC, each of them will verify the HMAC before verifying the digital signature. As long as the group key is not disclosed and unforgeable, this scheme is secure against external attackers. However, the disadvantage of employing a threshold value is that it will take several invalid signatures to detect an outsider attackers and this scheme only focuses on external DoS attackers. Other DoS mitigation schemes include [START_REF] Li | Mitigating DoS attacks against signature-based authentication in VANETs[END_REF] which is a modification of [START_REF] Wasef | Complementing public key infrastructure to secure vehicular ad hoc networks [security and privacy in emerging wireless networks[END_REF]. A pre-authentication process is introduced before the signature verifying process where a chain value of the one way hash chain is appended instead of the HMAC over the entire message. It proves that this method is computationally more efficient. But similar to [START_REF] Wasef | Complementing public key infrastructure to secure vehicular ad hoc networks [security and privacy in emerging wireless networks[END_REF], this scheme can only defend against external DoS attackers.

III. OVERVIEW OF PKR SCHEME

In this scheme, each RSU registers with the TA to receive a read-only copy of the public key directory and the TA's signing key. This public key directory contains the registered vehicles IDs and their corresponding public keys certified by the root TA. When a vehicle wishes to communicate to another vehicle, it sends a public key request message to any nearby RSU to request for it. The exact operation is detailed as follows.

Step 1: Periodic Announcements Vehicle 1 and vehicle 2 periodically broadcast a beacon message that contains its identity to the other neighboring vehicles within its communication range.

Step 2: Public key query If vehicle 1 (vehicle 2) wants to talk to vehicle 2 (vehicle 1), vehicle 1 (vehicle 2) sends an unencrypted signed public key request to RSU 1, requesting for a copy of vehicle 2's (vehicle 1's) public key.

Step 3: Verification of public key query RSU 1 then searches for the sender's (vehicle 1/vehicle 2) public key in the public key directory and verifies the signature on the sender's message to confirm its authenticity and message integrity.

Step 4: Issuing of requested public key reply If the verification is successful, RSU 1 searches for the public key of the requested vehicle ID in the public key directory and generates a reply message. This reply message is encrypted using the sender's (vehicle 1's/vehicle 2's) public key and its message content is signed using the TA's signing key (which is given to the RSU in the registration phase). When the sender (vehicle 1/vehicle 2) receives the message from RSU 1, it will decrypt the message using its own private key to retrieve the requested public key and then verifies the TA's signature on the public key using the TA's public key.

Step 5: Session key agreement Vehicle 1 and vehicle 2 then proceed to use each other public key to negotiate a session key and subsequently, use the common session key for message encryption.

A. Security Threats

As mentioned earlier, PKR scheme is vulnerable to DoS attacks and collusion attacks. In this sub-section, we describe the two attacks.

Denial of Service (DoS) Attacks 1)

In the PKR scheme, the RSU has to verify many signed public key request messages that originate from the vehicles in the RSU's communication range. This generates a huge amount of computation and communication overheads on the RSU side which creates a bottleneck. Exploiting this weakness, an external or internal attacker can launch a DoS attack by generating many invalid signed public key queries to deplete the resources of the RSU. As a result, legitimate vehicles are denied access to the service and therefore unable to communicate in the network. Situation can be worse if the legitimate vehicles are law enforcement vehicles that are deprived of communications. This could lead to dire consequences in life critical situations.

Collusion Attacks 2)

A misbehaved RSU may collude with another vehicle to issue the public key of the colluding vehicle such that subsequent confidential messages from the requesting vehicle are read by the colluding vehicle. This is possible because RSU has the TA's signing key which allows it to issue any valid signature using any public key stored in the public key directory. The effects of this attack are critical in the network as message confidentiality and privacy are compromised.

IV. SYTEM MODEL

We consider an infrastructure-based vehicular network consisting of 3 entities which we briefly describe below.

Transport Authority (TA) 1)

TA is in charge of the management of the vehicles and Road side Units (RSUs) in a geographical area. It is responsible for the registration of vehicles and RSUs, creation of the public file directory as well as updating and dissemination of the directory. It is assumed trusted by all entities (vehicles and RSUs) in the deployment area and is equipped with advanced security mechanisms to safeguard any information leakage. It therefore, has the highest security level and cannot be compromised.

Road Side Units (RSUs)

2)

The RSUs are devices that are statically and strategically deployed in the network to bridge the communication between vehicles or among RSUs in the network. They are installed at traffic lights, lamp posts or road signs etc. They are connected to the RTA via a secure network and are equipped with multiple interfaces for interoperability with different access technologies. RSUs have no resource constraints in terms of storage and computing power. Each RSU is given a copy of the public key directory where it assists in the request and issuance of public key. We assume majority of the RSUs are trusted but not all of them.

Vehicles

3)

Vehicles can be static or mobile, travelling in the network with varying speeds. Vehicles are installed with Onboard Unit (OBU) to support communications with other vehicles and RSUs. They are also equipped with a Hardware Security Module (HSM) responsible for storing and physically protecting the cryptographic information. Any attempt to retrieve any information from the HSM will cause it to selfdestruct. We assume that majority of the vehicles are trusted but not all.

V. SPKR SCHEME Our scheme makes use of the Schnorr signature to mutually authenticate each other before the RSU issues the requested public key. The benefits of using Schnorr signature are twofold. Firstly, a DoS attack is mitigated. Each communicating party has to prove to each other that it has committed some CPU resources to verify digital signature by providing a knowledge proof of a discrete logarithm. By doing so, vehicles have no incentive to misbehave as it is also going to cost them huge computational costs. Secondly, both parties are properly authenticated and no external unauthorized party can take part in the communication process. To facilitate the Schnorr based authentication process, we propose that each vehicle also stores a public key directory similar to the one kept by each RSU. In addition, the RSU in the SPKR scheme is not given the TA's signing key to prevent collusion attacks.

The SPKR scheme consists of four steps namely initialization, vehicles/RSU registration, dissemination of public key directory and authentication. More details of the scheme are elaborated below.

A. Initialization

TA chooses a large prime 𝑝 such that the discrete logarithm problem in 𝑍 𝑝 * is intractable and chooses another prime 𝑞 that divides 𝑝 -1 . Next, TA selects a generator 𝑔 of an order 𝑞 subgroup of 𝑍 𝑝 * such that 𝑔 𝑞 = 1 (𝑚𝑜𝑑 𝑝) and let ℎ: {0,1} * → 𝑍 𝑝 be a secure hash function. All system

B. Vehicles/RSUs Registration

Each vehicle 𝑖 chooses a private key 𝑎 𝑖 ∈ 𝑍 𝑝 * and constructs its own public key 𝑘 𝑖 + = 𝑔 -𝑎 𝑖 (𝑚𝑜𝑑 𝑝) . After generating the public key, each vehicle registers its public key with the TA. TA first generates a unique ID for the vehicle, then binds the public key with the corresponding vehicle's ID and stores this entry inside a public file directory. To prevent collusion attacks, another column of information is created in the public key directory to store the signature created from the vehicle's ID and its public key which is signed by the TA's signing key. Since the RSU is not in possession of the TA's signing key, RSU is not able to issue a forged public key reply using another vehicle's public key different from the one being requested. The role of the RSU is thus reduced to only issuing public keys. The new database format is shown in Fig. 1.

Each RSU 𝑖 also chooses a private key 𝑎 𝑖 ∈ 𝑍 𝑝 * and constructs its own public key as 𝑘 𝑖 + = 𝑔 -𝑎 𝑖 (𝑚𝑜𝑑 𝑝) . Similarly, TA generates a unique ID for each registered RSU, binds the RSU's public key with its corresponding ID and stores it in another public key directory. To differentiate between the two public key directories, the directory that stores only the vehicle's ID, its public key and TA's signature over the vehicle's ID and public key binding is called the Vehicle Public Key Directory (VPKD) whereas directory that stores only RSU's ID and its associated public key is called the RSU Public Key Directory (RSU-PKD). The format of the RSU-PKD is shown in Fig. 2.

C. Dissemination of VPKD and RSU-PKD

After successful registration, TA disseminates read-only copy of the VPKD to each RSU in the network. On the other hand, read-only copy of the RSU-PKD is given to each successfully registered vehicle. Since the vehicle is not responsible for issuing public keys, it does not need to contain the TA's signature column. Therefore, the size of the RSU-PKD is smaller than VPKD. The purpose of the RSU-PKD in each vehicle is only to serve as a lookup table to reference the RSU's public key for verification of signature during the authentication stage. Any changes to the VPKD will be updated and disseminated in real-time to the RSUs via a secure network according to the implementation in [START_REF] Shen | An efficient public key management system: an application in vehicular ad hoc networks[END_REF]. For RSU-PKD, vehicles can receive the updates from Original Equipment Manufacturers (OEM) whenever there are changes in the RSU-PKD.

D. Mutual Pre-authentication

Before an RSU issues a public key to the vehicle, both vehicle and RSU take turns to generate a Schnorr signature that contains a pre-generated commitment value. The authentication process is shown in Fig. 3 and consists of the following steps.

Step 1 and Step 2: Vehicle 1 and RSU 5, each select two random values, 𝑟 𝑖, 𝑘 𝑖 ∈ 𝑍 𝑝 * where 𝑖 stands for the ID of the nodes and computes 𝑅 𝑖 and 𝐾 𝑖 according to the formula in step 2 of Fig. 3. The 𝑅 𝑖 (𝑅 1 and 𝑅 5 ) values serve as nonce values to prevent replay attack. The 𝐾 𝑖 ( 𝐾 1 and 𝐾 5 ) are commitment values used to prove the knowledge of their private keys.

Step 3: Suppose vehicle 1wants to communicate with vehicle 3, it constructs a public key query message 𝑚 containing its own ID and the target vehicle's ID i.e. vehicle 3 and sends it to RSU 5. This message to RSU 5 also contains the random nonce value 𝑅 1 .

Step 4: Upon receiving (𝑅 1 , 𝑚) from vehicle 1, RSU 5 generates a challenge, 𝑒 5 and a response, 𝑆 5 according to the formula given in step 4 of Fig. 3 and sends the tuple (𝑒 5 , 𝑆 5 , 𝑅 5 ) to vehicle 1. The challenge contains the hash of the message, the random nonce values (𝑅 1 , 𝑅 5 ) and the commitment value, 𝐾 5 of RSU 5 used to proof that RSU 5 has the knowledge of its private key.

Step 5: When vehicle 1 receives (𝑒 5 , 𝑆 5 , 𝑅 5 ) from RSU 5, it first retrieves the RSU 5's public key from the RSU-PKD. Then, vehicle 1 re-computes the RSU 5's commitment value as 𝐾 ̅ 5 = 𝑔 𝑆 5 𝑘 5 + 𝑒 5 (𝑚𝑜𝑑 𝑝) based on the received 𝑆 5 , 𝑒 5 and RSU 5's public key, 𝑘 5 + . Next, vehicle 1 calculates its version of the challenge denoted as 𝑒 5

̅ by taking the hash of the message, 𝑚 concatenated with both random nonce values (𝑅 1 , 𝑅 5 ) and the calculated value of 𝐾 ̅ 5 computed earlier. If the calculated hash value matches the received 𝑒 5 , it implies that RSU 5 is authenticated successfully. If there is a mismatch, the session terminates at this stage. The proof of correctness is shown in ( 1) and ( 2). Once the challenge 𝑒 5 ̅ is verified true, vehicle 1 prepares its own signature consisting of a challenge 𝑒 1 and a response 𝑆 1 . At the same time, vehicle 1 needs to compute 𝑣 1 which is a hash of the two random nonce values and the 𝐾 ̅ 5 calculated earlier. Message to RSU 5 contains (𝑣 1 , 𝑒 1 , 𝑆 1 ).

Proof of Correctness:

𝐾

̅ 1 = 𝑔 𝑆 1 𝑘 1 + 𝑒 1 (𝑚𝑜𝑑 𝑝) = 𝑔 𝑘 1 +𝑎 1 𝑒 1 • 𝑔 -𝑎 1 𝑒 1 (𝑚𝑜𝑑 𝑝)  = 𝑔 𝑘 1 𝑚𝑜𝑑 𝑝 (1)
𝑒̅ 1 = ℎ(𝑚, 𝑅 1 , 𝑅 5 , 𝐾 ̅ 1 , 𝐾 5 ) (2)
If 𝑒 1 ̅ = 𝑒 1 and the signature pair (𝑒 1 , 𝑠 1 ) from vehicle 1 passes verification.

Step 6: Before RSU 5 proceeds to verify the signature pair (𝑒 1 , 𝑆 1 ) from vehicle 1. It first checks that the hash value of 𝑣 1 is correct by computing ℎ(𝑅 1 , 𝑅 5, 𝐾 5 ) using its own commitment value, 𝐾 5 generated in step 2. The signature pair (𝑒 1 , 𝑆 1 ) needs to be verified only if the hash value matches. The verification procedure of (𝑒 1 , 𝑆 1 ) is the same in step 5. RSU 5 computes the commitment value of vehicle 1 using 𝐾 ̅ 1 = 𝑔 𝑆 1 𝑘 1 + 𝑒 1 (𝑚𝑜𝑑 𝑝) and then verifies if 𝑒̅ 1 = ℎ(𝑚, 𝑅 1 , 𝑅 5 , 𝐾 ̅ 1 , 𝐾 5 ) matches the received 𝑒 1 .

Step 7: RSU 5 issues the requested public key only if 𝑒̅ 1 = 𝑒 1 , Otherwise, RSU 5 terminates at this step. The reply message to vehicle 1 contains the requested public key and TA's signature over the public key and the entire message is encrypted using vehicle 1's public key to ensure confidentiality. The TA's signature is to ensure the integrity and authenticity of the sent message.

VI. SECURITY AND PERFORMANCE ANALYSIS

In this section, we show that SPKR is robust against DoS and collusion attacks. After that, we analyze the storage overhead requirements.

A. Denial of Service (DoS) Attack

DoS attack is mitigated in the SPKR scheme because RSU 5 has to check if vehicle 1 has the correct hash value, ℎ(𝑅 1 , 𝑅 5, 𝐾 5 ) which contains the commitment value 𝐾 5 generated by RSU 5 in step 2. This implies that vehicle 1 has to spend expensive modular exponentiations to verify the signature pair given by RSU 5 in step 4. These expensive verifications are required to reveal the correct 𝐾 5 in order to obtain the correct hash value, 𝑣 1 . Using this approach, it discourages any malicious but rational attackers from launching DoS attacks. On the other hand, RSU 5 verifies vehicle 1's signature only when ℎ(𝑅 1 , 𝑅 5, 𝐾 5 ) is evaluated to be true which is inexpensive to RSU 5.

The malicious vehicle may attempt to skip the computational intensive verification of the RSU's signature by trying to forge a valid 𝑣 1 which is a function containing 𝐾 5 . This is not possible due to the property of the one-way hash function and the hardness of the discrete logarithm problem. The RSU may misbehave to cause requesting vehicles to waste their resources without issuing the requested public key. However, the impact of such misbehavior from the RSU side is less destructing since vehicles are mobile and they can request from other well-behaved RSUs in the region. Moreover, a reputation system can be implemented to measure the trust Hashing in ms 0.009 -level of the RSUs so that vehicles are better informed about the reliability of the RSUs before they request public keys from them. This, however, is beyond the scope of this paper and is left as a future work. Next, we analyze the authentication delay of the SPKR scheme and compared with those of the Elliptic Curve Digital Signature (ECDSA) algorithm which is the de facto standard adopted in [START_REF]IEEE Trial-Use Standard for Wireless Access in Vehicular Environments -Security Services for Applications and Management Messages[END_REF][START_REF] Institute | Intelligent Transport Systems (ITS); Security; Security header and certificate formats[END_REF] and the ECDSA-HMAC mechanism proposed by Wasef et al. [START_REF] Wasef | Complementing public key infrastructure to secure vehicular ad hoc networks [security and privacy in emerging wireless networks[END_REF]. The comparison is in terms of the following aspects: the authentication delay incurred by the RSU to process a public key query request from a vehicle.

For the SPKR, the authentication delay consists of the signature generation time, hashing time and verification time. When there is a DoS attack, the authentication delay consists of only the signature generation time and the hashing time because if there is a mismatch in the hash value, the RSU will skip the signature verification process. For the ECDSA, the authentication delay consists of the signature verification time regardless of whether there is DoS and no DoS attack. If ECDSA-HMAC [START_REF] Wasef | Complementing public key infrastructure to secure vehicular ad hoc networks [security and privacy in emerging wireless networks[END_REF] is used and when there is a DoS attack, the authentication delay consists of the signature verification time and the HMAC verification time.

To calculate the authentication delay, we implemented the SPKR and the ECDSA schemes in C using Openssl library to estimate the signature generation and verification times. Simulation was carried out for 100000 times on an Intel Core i7-2620M@2.70Ghz workstation with 2 GB RAM running on 32 bit Debian Linux operating system. Table 1 shows the running times of both schemes in milliseconds. Similarly, we ran the HMAC program for 100000 simulation runs and estimated the running time to be 0.008ms. Fig. 6 shows the authentication delay of all the schemes under no DoS and DoS attack.

We observe that when ECDSA is employed, the introduction of invalid messages (10% and 30% of the number of valid messages) increases the authentication delay greatly. On the other hand, using the Schnorr signature scheme as the mutual pre-authentication mechanism in SPKR, two observations can be made. First, the authentication delay is significantly lower than the ECDSA based schemes (ECDSA and ECDSA-HMAC) under no DoS attack. Second, according to the left inset figure in Fig. 6, the performance of the SPKR scheme when subject to 10% and 30% invalid messages has little effect on the authentication delay and is also significant lower than the two ECDSA based schemes under DoS attacks. SPKR scheme is more efficient because the signature generation time is much lower than the ECDSA counterparts due to that computation of modular exponentiations in step 1 and 2 can be done off-line. Furthermore, RSU only checks the vehicle's signature when the proof provided by the vehicle is correct. In this manner, RSU can differentiate well-behaved vehicles from DoS attackers. This explains why SPKR scheme has a lower authentication delay. A lower authentication delay indicates a higher availability to service the requests of other vehicles. Although ECDSA-HMAC scheme does not contribute much to the authentication delay under DoS attacks based on the right inset figure in figure 6, our scheme is still far more superior than the ECDSA-HMAC scheme. Based on these observations, we conclude that the SPKR scheme can effectively detect invalid messages and mitigate DoS attackers.

B. Collusion Attack:

In the original PKR scheme, when a vehicle requests for a target vehicle's public key, the RSU searches for it in the public key directory and then signs it using the TA's signing key. Since the RSU has possession of the TA's signing key, it is able to fake the signature to make sure that the signature always passes with the issued public key even if the public key is not the one requested by a vehicle. In the SPKR scheme, each entry {𝐼𝐷, 𝑝𝑢𝑏𝑙𝑖𝑐 𝑘𝑒𝑦} in the public key directory is attached with a signature generated by the TA's signing key during registration phase and the RSUs are not given the TA's signing key. Therefore, there is no way for the RSU to collude with another vehicle to manipulate and issue a valid signed public key reply. Another advantage of storing the TA's signature for every entry in the VPKD is that RSU do not need to generate a signature when it issues the requested public key. It can simply retrieve the TA's signature from the stored entry and send it back to the requesting vehicle thereby reducing the workload on the RSU. However, the storage size of the repository will increase which we analyze next.

C. Storage overhead:

We estimate the storage size required by each RSU and vehicle to store the VPKD and RSU-PKD respectively. Assume that the public key has a key size of 1024 bits and 4 bytes are allocated to store the node ID and further, the size of the TA's signature on the ID and public key pair is 40 bytes. If there are 1 million vehicles in the network, the size of the VPKD would be 1 𝑚𝑖𝑙𝑙𝑖𝑜𝑛 𝑥 (128 + 4 + 40)𝑏𝑦𝑡𝑒𝑠 = 172 𝑀𝑏𝑦𝑡𝑒𝑠 which is an increase of about 30.3% compared to the original PKR scheme. If there are 100,000 RSUs deployed in the network, the size of RSU-PKD will be equal to 100,000 𝑥 (128 + 4) = 13.2𝑀𝑏𝑦𝑡𝑒𝑠 which is still reasonable given that the typical storage capacity of an OBU is at least 256M bytes. This additional storage requirement is a trade-off for enhanced security against DoS and collusion attacks. To reduce the storage requirement, SPKR scheme can be realized with smaller key size using Elliptic Curve Cryptography (ECC) which is left as a future work.

VII. CONCLUSIONS

In this paper, we analyze the PKR scheme and show that it is vulnerable to DoS and collusion attacks. We improved on the scheme by introducing a mutual pre-authentication scheme using Schnorr signature and modified the way information is stored in the public key directories. Although each vehicle has to store a public key directory, we show that the total storage size is manageable given the current storage capacity of the OBUs in the vehicles. The results of these extensions prove that SPKR scheme alleviates the risk of DoS attacks and that it has a lower authentication delay compared to the ECDSA and ECDSA-HMAC schemes under DoS attack. It is also secure against collusion attacks. In terms of future work, we plan to apply the SPKR scheme using ECC. Furthermore, we are interest to validate the security properties of the SPKR scheme using AVISPA or Proverif.

Fig. 1 .

 1 Fig. 1. VPKD

Fig. 3 .

 3 Fig. 3. Pre-authentication process

Fig. 1 .

 1 Fig. 1. Authentication delay under no DoS and DoS attacks

TABLE I .

 I DELAY PERFORMANCE FOR SCHNORR AND ECDSA

	Algorithm	Schnorr	ECDSA
	Key length	1024	160
	Signing in ms	0.013	0.996
	Verify in ms	1.506	1.887