arXiv CSopen access

SP2UBI: Secure and Privacy-Preserving Usage-Based Insurance

1

SP2UBI: Secure and Privacy-Preserving Usage-Based Insurance

arXiv:2608.01539v1 [cs.CR] 2 Aug 2026

Mobin Aghamirkarimi, Matin Aghamirkarimi, Farid Zaredar, and Morteza Amini Abstract—The transition from traditional auto insurance, whose basis is defined by a set of static parameters, like the age of driver and number of accidents, to Usage-Based Insurance (UBI), whose pricing is based on driving behavior, was boosted by Intelligent Transportation Systems (ITS). At the same time, the analysis of high-resolution telematics data might reveal users’ behavior and habits, which is associated with significant privacy concerns. The majority of privacy-preserving UBI systems are subject to policyholders’ data leaks at some point during the life cycle of their protocol. Moreover, it is challenging to ensure data integrity against possible intentional or unintentional sensor anomalies (like sensor spoofing or malfunctioning) since the approaches used in this case require privacy-compromising audits and do not consider the oracle problem. In order to address the issues, we propose SP2UBI, a privacy-preserving UBI solution which guarantees mutual confidentiality. SP2UBI collects the telematics data in coarse-grained, statistical form without any spatiotemporal identifiers so that it is impossible to reconstruct fine-grained mobility traces. By utilizing the Torus Fully Homomorphic Encryption (TFHE) scheme, which incurs low computational overhead, computations are performed directly over encrypted data. This way, the insurer calculates risk factors without accessing any sensitive information, while parameters of its risk model are confidential. In order to protect data integrity against sensor level manipulation, SP2UBI incorporates a speed verification system assisted by Integrated Sensing and Communications (ISAC) technology which is capable of detecting fraud while preserving user privacy. Experimental evaluation shows that one round of protocol execution takes 41.2 ms, showing that our framework is lightweight. Compared to the other state-of-the-art solutions, SP2UBI preserves more privacy guarantees and provides needed functionality for both insurers and policyholders. Index Terms—Usage-Based Insurance (UBI), Fully Homomorphic Encryption (FHE), Integrated Sensing and Communications (ISAC), Privacy-Preserving, Vehicular Networks.

✦

1

T

I NTRODUCTION

RADITIONAL vehicle insurance models have historically relied on static demographic data, such as driver age, vehicle model, and accident history. A major limitation of these models is their failure to incentivize safer driving, as they fundamentally ignore real-time, individual driving behavior [1]. The incorporation of Internet of Things (IoT), Intelligent Transportation Systems (ITS), and Vehicular Adhoc Network (VANET) technologies into contemporary transportation resulted in the exchange of real-time information and accurate tracking of routes [2]. These advancements made it possible to introduce Usage-Based Insurance (UBI). There are three core paradigms within UBI, namely PayAs-You-Drive (PAYD), Pay-How-You-Drive (PHYD), and Manage-How-You-Drive (MHYD), that are used to calculate premiums based on dynamic risk and driving behavior [3]. There are multiple advantages provided by telematics insurance both to users and insurers, and also to society at large. At the societal level, it contributes to improved public safety, reduced traffic congestion, and environmental sustainability by encouraging eco-driving habits and lowering emissions [4], [5]. For insurers and users, the benefits include accurate risk evaluation, reduction of claim costs, and access to value-added capabilities such as real-time emergency response [6]. Furthermore, telematics insurance financially incentivizes safer driving, allowing low-risk drivers to reduce their vehicle insurance premiums by up to 30% [7]. Across regions such as the USA, Europe, and Japan, prominent providers of usage-based vehicle insurance include major companies like Allianz, AXA, Zurich, and Tesla. According to forecasts, by 2033 the global market size will reach $267.4

billion and will keep a stable Compound Annual Growth Rate (CAGR) of 26.2% [8]. However, for an accurate calculation of risks, there is a need for the continuous tracking of kinematic parameters, including mileage, speed, hard braking, and nighttime driving. Continuous tracking raises significant privacy concerns, acting as a major obstacle to the mass adoption of UBI [9], [10]. Even when collecting only kinematic parameters, sensitive information such as the addresses that drivers frequently visit and commuting routines can be inferred [11]. In order to alleviate these issues, some insurers limit the data gathering process only to non-spatial attributes. However, several empirical studies reveal that the extraction of location trajectories from non-spatial kinematic data is highly feasible. For example, by using only a speed pattern of the car and the origin of the trip, it is possible to predict the destination of 26% of trips with less than 500 meters precision [12]. Furthermore, combining speed information with realtime traffic models allows attackers to narrow down the real path to a small set of highly probable candidate routes with a 70% success rate in the absence of Global Positioning System (GPS) [13]. Moreover, time series analysis of brake signals through deep learning enables the successful reconstruction of about 92% of drivers’ main routes [14]. Thus, the recent research reveal that there are significant privacy risks even in the case of non-spatial data. In order to resolve this inherent vulnerability, this paper presents SP2UBI, which is a privacy-preserving framework designed specifically for vehicular networks of today. By applying Fully Homomorphic Encryption (FHE) [15], in

2

particular, Torus Fully Homomorphic Encryption (TFHE) [16], the proposed SP2UBI performs risk factors calculation and speed verification over the encrypted driving data. Therefore, the suggested protocol meets the needs of risk assessment on the side of the insurer while preserving mutual confidentiality as the insurer calculates the risk of the policyholder without obtaining any telematics, and the policyholder’s risk evaluation parameters stay secret to the insurer. The main contributions of this research are summarized as follows: •

•

•

•

Spatiotemporal Anti-Inference & Privacy Preservation: The proposed architecture guards against trajectory tracking and temporal profiling by dissociating the driver’s identity from their physical location. At the network edge, anonymous communications prevent intermediate entities from identifying policyholders. On the backend, metadata removal and batch shuffling allow the insurer to evaluate actuarial risks without being able to reconstruct travel routes or daily habits. To ensure mutual privacy, all risk evaluations are carried out entirely over encrypted data using FHE. Computation Integrity: To secure outsourced cloud evaluations against malicious manipulations, we propose a nonce-based Homomorphic Message Authentication Code (HomMAC). This approach guarantees the algebraic integrity of the homomorphic computations while preserving the temporal indistinguishability of the daily records. Speed Verification: To tackle hardware-level sensor spoofing without compromising driver anonymity, SP2UBI employs an Integrated Sensing and Communications (ISAC)-assisted validation mechanism. By linking physical ground-truth measurements (e.g., Doppler shifts) to the cryptographic domain, our approach addresses the oracle problem specifically at the speed sensor level. This problem occurs when a compromised Vehicle Speed Sensor (VSS) feeds falsified kinematics into an otherwise secure system. While traditional cryptographic tools blindly sign and authenticate whatever raw data they receive, our framework reliably detects these source-level anomalies in a strictly privacy-preserving manner. Practical System Efficiency: Performance evaluations show that despite the integration of advanced cryptographic primitives, the proposed architecture maintains efficient computational and communication overheads, ensuring its practical viability for realworld deployments.

The remainder of this paper is organized as follows. Section II outlines the cryptographic preliminaries. Section III reviews existing UBI architectures. Section IV introduces the system model. Section V details the proposed SP2UBI framework. Section VI presents the privacy and security analysis. Section VII evaluates the system performance. Finally, Section VIII concludes the paper.

2

PRELIMINARIES

To establish a shared technical foundation for the proposed architecture, this section reviews the primary domain concepts

and cryptographic primitives. Specifically, we first categorize existing vehicle telematic insurance paradigms and their data requirements, followed by the mathematical principles of Fully Homomorphic Encryption (FHE), Privacy-Preserving Machine Learning (PPML), and Group Signatures (GS). 2.1

UBI Models

The primary Usage-Based Insurance (UBI) models can be systematically categorized based on their basic risk assessment principle, infrastructure complexity, and the complexity of their analytical approaches. As shown in Table 1, the area of UBI encompasses three main types of models: PayAs-You-Drive (PAYD), Pay-How-You-Drive (PHYD), and Manage-How-You-Drive (MHYD). However, despite their huge capabilities in risk profiling, the operational utility of these UBI models depends heavily on the granularity and type of collected telematics data. While basic PAYD schemes rely solely on aggregate odometer readings or periodic distance logs over extended billing cycles, PHYD architectures require multi-dimensional kinematic telemetry. To accurately profile driver behavior, PHYD systems must continuously capture time-series metrics such as vehicle speed, rapid acceleration, hard braking frequencies, and sharp cornering. Furthermore, MHYD frameworks expand these data requirements by fusing kinematic measurements with real-time contextual streams—including environmental conditions, traffic density, and road topography—to enable proactive risk mitigation and immediate driver feedback. Consequently, transitioning from basic PAYD to advanced PHYD and MHYD paradigms shifts the analytical engine from simple periodic distance aggregation to complex, continuous behavioral data processing. 2.2

Homomorphic Encryption

Homomorphic Encryption (HE) represents a major cryptographic scheme that helps solve privacy limitations and allows performing mathematical computations on ciphertexts without prior decryption. Earlier examples of this scheme include the Partially Homomorphic Encryption (PHE) schemes (e.g., RSA [17] and Paillier [18]) that can perform only one basic algebraic operation. Formally, Enc is an encryption function, ⋆ and ⋄ stand for the corresponding operations performed on the plaintext space and ciphertext space, respectively. Thus, for a PHE scheme, the homomorphic property holds true with respect to only one operation (either addition or multiplication):

Enc(m1 ) ⋄ Enc(m2 ) = Enc(m1 ⋆ m2 ) In order to bypass the limitation of a PHE scheme, the first viable Fully Homomorphic Encryption (FHE) scheme [15] was developed and consists of four Probabilistic Polynomial Time (PPT) algorithms (KeyGen, Enc, Dec, Eval). An encryption scheme E is formally defined as Fully Homomorphic if and only if it satisfies two core properties for all constructible circuits C : •

Correctness: The evaluation of the scheme over a vector of ciphertexts c = (c1 , . . . , ct ) representing a

3

TABLE 1 Technical and economic comparison of Usage-Based Insurance (UBI) models.

Dimension

PAYD (Pay-As-You-Drive)

PHYD (Pay-How-You-Drive)

MHYD (Manage-How-You-Drive)

Risk Criteria

Mileage/Distance

Speed, acceleration, braking, cornering

PHYD metrics + real-time context

Complexity & Cost

Low

Moderate

High

Analytics

Simple distance aggregation

Machine learning & behavioral analysis

Big data & real-time stream processing

Key Advantage

Rewards low-mileage drivers

Incentivizes safe driving behavior

Proactive risk mitigation & instant intervention

Main Limitation

Ignores actual driving behavior

Lacks real-time feedback; sensor-dependent

High computational and infrastructure overhead

vector of plaintexts m = (m1 , . . . , mt ) results in a correct encryption of the circuit’s output:

c∗ ← EvalE (evk, C, c) ⇒ DecE (sk, c∗ ) = C(m1 , . . . , mt ) •

(1)

Compactness: The complexity of the decryption algorithm and the size of the evaluated ciphertext c∗ do not depend on the depth of the circuit and are bounded by a polynomial in the security parameter poly(λ).

Homomorphic evaluation of the circuit implies the presence of noise in ciphertexts. The evaluation depth of the Somewhat Homomorphic Encryption (SHE) scheme is limited since noise accumulates in ciphertexts and renders them unusable, while for FHE schemes, this problem is solved by using bootstrapping as proposed by Gentry. Some of the notable lattice-based constructions are the CKKS scheme [19] that performs approximate computing over real and complex numbers, and the TFHE scheme [16]. By using the technique of Programmable Bootstrapping (PBS), TFHE allows controlling the amount of noise in ciphertexts and implementing any non-linear functions such as comparisons, thresholding, and boolean gates. Therefore, TFHE is applicable for exact, privacy-preserving discrete decision-making models. 2.3

Privacy-Preserving Machine Learning

Privacy-Preserving Machine Learning (PPML) [20] involves numerous cryptographic and distributed approaches such as Federated Learning, Multi-Party Computation (MPC), and HE aimed at processing the information without revealing the confidential original data. In the specific context of the FHE approach, PPML helps to convert analytical models and multi-parameter risk-assessment algorithms into efficient computational circuits ready for secure evaluation. For the realization of this conversion in the TFHE scheme [16], precise parameter configuration becomes necessary since it allows controlling noise growth and the multiplicative depth of the circuit to decrease the necessity of using resourceintensive bootstrapping procedures. Additionally, a unique property of TFHE is the ability to perform PBS [21], allowing

the homomorphic evaluation of non-linear functions (like thresholding and step functions), which are required for more sophisticated data analysis. Considering the inherent limitations of FHE computational stacks regarding the processing of limited bit-widths, the quantization of parameters and intermediate variables becomes a necessary condition. The quantization is typically done with the help of Quantization-Aware Training (QAT), which incorporates discrete restrictions into the gradient optimization process, or Post-Training Quantization (PTQ) based on post-hoc calibration. Eventually, the optimized model will be mapped to an equivalent homomorphic circuit, inheriting the IND-CPA security guarantees of the underlying encryption scheme. 2.4

Group Signatures

Whereas FHE and PPML techniques efficiently ensure telematics data privacy when processed, proving the authenticity and integrity of the data origin before applying the cryptographic transformations poses an essential problem. Group Signature (GS) [22] is a modern cryptographic primitive solving this problem since it enables group members to sign messages anonymously on behalf of the entire group. Unlike traditional digital signature schemes where the identity of the signer is revealed to everybody, the GS scheme allows verifying the fact that the message was indeed signed by one of the authorized parties without disclosing the signer’s specific identity [23]. Thus, the vehicle identity becomes hidden from the adversaries. In order to balance high levels of user privacy with system accountability, the GS protocol incorporates a trusted entity known as the Group Manager (GM) [24]. In cases of dispute, fraud, or malicious behavior, the GM utilizes a unique tracking key capable of revoking the anonymity and revealing the true identity of a rogue signer. Such conditional privacy, combined with definitive traceability, makes group signatures exceptionally valuable for securing data integrity in resource-constrained and dynamic IoT systems and smart vehicular architectures [25].

3

RELATED WORK

To contextualize the proposed framework within the broader landscape of telematics insurance, existing privacy-

4

preserving UBI solutions can be grouped based on their underlying architectural design and the methodologies employed to balance data integrity with user anonymity. Specifically, the related literature is examined across three methodological categories: (i) hardware-based security and tamper resistance, (ii) distributed and blockchain-based approaches, and (iii) noise-addition and data perturbation techniques. In the following, the operational concepts, trust assumptions, and practical limitations associated with each category are discussed. 3.1

Hardware-Based Security and Tamper Resistance

To minimize the reliance on potentially malicious vehicular sensors and to protect telematics data from being deliberately altered, various hardware solutions have been actively considered. Due to the inability of insurers to implicitly trust the native Electronic Control Units (ECUs) in a vehicle, these solutions generally require installing independent hardware modules, such as telematics black boxes containing a separate sensor suite. Despite early claims about the tamper-proof nature of these systems, in practice, they can only be implemented as either tamper-resistant or, at best, tamper-evident. These architectures perform some form of localized processing to prevent insurers from accessing the raw telematics data. For instance, Troncoso et al. [26] introduced PriPAYD—a privacy-oriented Pay-As-YouDrive architecture where insurance premiums are calculated locally in the black box based on information obtained from GPS, Global System for Mobile Communications (GSM), and digital maps. Though PriPAYD provides strict data minimization since the only transmitted piece of data is an aggregated premium, its adoption is hindered by the high expenses of making the hardware tamper-resistant [11], significant computational overhead for localized mapmatching, and the problem of ensuring hardware integrity in light of possible physical vulnerabilities. In order to address the computational overhead associated with localized mapmatching, Popa et al. [27] introduced the VPriv system, which integrates cryptographic commitments, secure multiparty computation, and interactive zero-knowledge proofs (ZKPs) into the design of a tamper-resistant transponder. The premium calculation in VPriv is performed on the server side over anonymized spatiotemporal logs, thus guaranteeing raw data confidentiality. However, the intensive use of these interactive cryptographic primitives for continuous, largescale telematics streams severely limits their scalability due to significant computational latency and communication overhead. Also, to ensure compliance and detect evasion, VPriv relies on random physical roadside inspections of license plates and location points [11], which inevitably introduces secondary privacy risks. At the same time, even securing the hardware housing does not preclude the presence of threats at the sensor layer. As demonstrated by Fu et al. [28], sensors can still be spoofed and attacked via transduction (signal injection) even without invasive physical access, since adversaries can exploit the fundamental physical properties of these components to manipulate analog outputs. Ultimately, while hardware-based solutions increase the integrity of telematics through localized processing, their practical viability is hampered by manufacturer-dependent

trust assumptions, the privacy degradation inherent in physical spot-checking, and the high expenses associated with widespread deployment and maintenance. 3.2

Distributed and Blockchain-Based Approaches

Several systems have utilized decentralized architectures to protect vehicular telematics data. For instance, PRIDE, a privacy-driven framework that integrates blockchain technology and homomorphic encryption in a vehicle-cloudblockchain setting, was proposed by Wan et al. [11]. This solution encrypts multi-dimensional driving vectors into invertible matrices, then anchors the Merkle tree roots generated from them onto the blockchain network, allowing smart contracts to compute acceleration-to-speed risk factors using encrypted data. Despite the fact that PRIDE ensures computations over ciphertexts, its reliance on multi-dimensional driving vectors encoded into binaries requires extensive storage capacity [29]. In addition, PRIDE faces significant privacy issues due to continuous data stream transmissions that might expose the underlying spatiotemporal behavioral profiles of the driver [1]. In order to address the issue of tracking, Singh et al. [6] proposed a multi-tier architecture that involves the integration of both public and private blockchains with a Proof-of-Work (PoW) consensus protocol. In this framework, Traffic Authority-controlled Roadside Units (RSUs) operate the public blockchain network while dynamically changing short-lived pseudonyms are assigned to vehicles through the private issuer blockchain network for performing periodic transactions. Even though the address rotation approach reduces tracking vectors and improves anonymity, relying on RSUs as mining nodes for an energy-consuming PoW consensus incurs prohibitive computational overheads, limiting its viability for large-scale vehicular networks. In regard to the problem of raw data exposure, Qi et al. [1] introduced the DUBI system that exploits Pedersen commitments, non-interactive zero-knowledge proofs (NIZKPs), and Merkle trees. In DUBI, the driving metrics are kept in encrypted form as commitments in a cloud broker while their Merkle tree roots are anchored to the blockchain network to perform insurance premium calculations through smart contracts. Unfortunately, this framework still requires partial data disclosure during random spot checks or postcollision inspections, thereby introducing localized privacy leakage vectors. Similar to DUBI, Huang et al. [30] presented a consortium blockchain solution that integrates the Paillier cryptosystem, Fujisaki-Okamoto commitments, and ZKPs. In this system, fraud detection is modeled as a recursive inspection game to achieve a Nash equilibrium. Though this system is designed to strike a balance between transparency and fraud prevention through an independent third-party auditor, its reliance on a fully trusted auditing entity introduces privacy vulnerabilities during the verification phase, as the auditor gains visibility into the raw driving data. To provide data integrity without centralized raw telematics collection while maintaining auditability, Yi et al. [31] proposed CCUBI, a cross-chain insurance framework. In this work, instead of transmitting fine-grained variables, vehicles commit cryptographic proofs of multi-dimensional driving indicators to the blockchain, leveraging random

5

blinding factors to prevent the brute-force resolution of discrete logarithms. Meanwhile, RSUs conduct random spot checks against physical traffic observations. Even though this solution ensures data trustworthiness, its scalability is restricted by the finite storage capacity of RSUs for shortterm data retention, alongside privacy issues related to localized data exposure during roadside verification. As for edge-based intelligence, Sahu et al. [29] proposed a framework called BE-VIP that combines blockchain, local analytical models, and computer vision. Local processing of the driving data occurs at the vehicle level via the use of logistic regression to calculate a safety score. To reduce the cost of on-chain storage, only this final index, alongside the cryptographic hashes of Fujisaki-Okamoto commitments and accident images stored on the InterPlanetary File System (IPFS), are anchored to the ledger. Although such a framework provides automated claims processing and preserves the confidentiality of raw telematics at the vehicular tier, the reliability of the safety score calculation strictly depends on the physical sensor layer. Hence, this framework is susceptible to data integrity compromises if the speed or kinematic sensors are manipulated or spoofed prior to the local processing of the data. Consequently, despite enhancing data integrity and transparency, these distributed frameworks remain constrained by storage and scalability bottlenecks, auditing-related privacy trade-offs, and a critical vulnerability to physical-layer sensor anomalies.

3.3

4 P ROBLEM D EFINITION AND OVERALL P ROPOSED S OLUTION To establish a clear technical context, this section first articulates the fundamental privacy and physical-layer security challenges in modern telematics insurance. Following this problem formulation, the physical system architecture of the proposed SP2UBI framework is presented and the trust assumptions governing the involved entities are outlined. 4.1

Problem Definition

While advanced UBI paradigms, specifically PHYD and MHYD, offer significant benefits in dynamic risk profiling, their real-world deployment is impeded by two unresolved structural vulnerabilities: •

Noise-Addition and Data Perturbation Techniques

The approach by Zhou et al. [32], known as Pri-UBI, represents the integration of cryptography with the synchronous injection of random noise in order to simultaneously ensure location privacy and prevent data fabrication. The design matches an in-vehicle On-Board Diagnostics (OBDII) telematics device with smartphone sensors by injecting identical random variables into both data streams before their submission. Because these random variables are specifically designed to sum to zero over a designated epoch, this mechanism ensures that the fine-grained profiling of an individual is concealed, while at the same time allowing the calculation of precise insurance risk scores over ciphertexts. For the purpose of preventing fraud, the authors use a probabilistic Usage Data Audition scheme that can be considered an inspection game. By probabilistically crosschecking the encrypted data obtained from the two sources, calculating the difference between the streams eliminates the shared noise and isolates any unauthorized data alterations. However, despite being able to balance privacy and fraud prevention through dual-source correlation, the architecture remains limited by the need for constant local synchronization between the smartphone and the OBD-II system for real-time key exchange. Furthermore, the selective application of zero-sum noise exclusively to continuous metrics leaves unperturbed discrete telematics features, such as timestamped hard braking events, susceptible to trajectory reconstruction attacks.

•

4.2

Spatiotemporal Privacy Leakage and Outsourced Computation Integrity: Sending continuous, finegrained driving metrics—such as vehicle speed, rapid acceleration, and braking frequency—to external cloud servers creates severe privacy risks. Even without explicit GPS coordinates, an untrusted server can analyze time-series kinematic patterns to reconstruct a driver’s daily commute, uncover private addresses, and build a detailed behavioral profile. This presents a dual challenge. First, the system must allow the insurer to evaluate actuarial risk models over encrypted, unordered data without ever exposing the underlying telemetry. Second, because these calculations are offloaded to third-party cloud providers, the insurance provider needs a dependable mechanism to verify that its outsourced model is executed correctly and honestly, guarding against any computational manipulation. The Physical-Layer Oracle Problem in Speed Telemetry: To prevent data tampering, most existing vehicular protocols rely on software-layer cryptography, such as digital signatures and zero-knowledge proofs generated inside an OBU. The drawback is that these tools simply assume the measurements coming from internal sensors are correct to begin with. This exposes a classic oracle problem: if the VSS suffers from an unintentional malfunction or is physically tampered with before the signal is digitized, the OBU will inevitably authenticate erroneous data. Vehicle speed is a highly important parameter for evaluating driver risk factors. However, conventional methods for catching sensor anomalies or fraud usually require inspecting fine-grained, plaintext driving logs or relying on random inspections—practices that severely infringe on user privacy. Therefore, a trustless, physical-layer speed verification mechanism is required that can independently detect sensor errors without relying on internal vehicular telemetry and without compromising driver anonymity. Proposed Solution Architecture

The architecture of the proposed SP2UBI framework comprises four primary entities: the On-Board Unit (OBU), the Roadside Unit (RSU), the Telematics Service Provider (TSP), and the Insurer. The hierarchical interactions among these

6

entities are illustrated in Fig. 1. The specific operational roles of each entity are defined as follows:

•

Fig. 1. Architecture of the system components and their interactions within the SP2UBI framework. •

•

•

On-Board Unit (OBU): This unit is responsible for interfacing with the physical sensors of the vehicle to collect coarse-grained driving telematics and instantaneous speed. While the cryptographic processor (Trusted Execution Environment (TEE) / Hardware Security Module (HSM)) inside the OBU is trusted, the collected telemetry data from the sensors can still be susceptible to hardware spoofing. In order to protect the confidentiality of the data and create a basis for verifiable computation, the OBU encapsulates driving metrics together with temporal nonces and cryptographic tags (HomMAC), encrypts the payload using FHE under the insurer’s public key, and authenticates the transmission with a group signature. The OBU securely keeps a local plaintext copy of the logs up until the end of the billing epoch in case of potential disputes. Roadside Unit (RSU): Serves as the local ISAC gateway in the vehicular ad-hoc network. The main objective of the RSU is the physical verification of the transmitted speed data. After receiving the uplink message, the RSU measures the physical ground-truth speed based on the Doppler shift and estimates the reliability of the channel. Then, it uses a lightweight, mixed-domain homomorphic verification circuit that computes directly over the encrypted sensor measurements and the physical measurement. The RSU forwards the authenticated, encrypted driving payload with the verification discrepancy to the TSP. Telematics Service Provider (TSP): Serves as the primary computational and obfuscation intermediary. It receives the risk factor assessment model created by the insurer in the form of a linear FHE circuit and homomorphically evaluates the model over the encrypted telematics data and cryptographic tags. In order to preserve the multidimensional anonymity of the data, the TSP actively removes any localized geographic identifiers and RSU identifiers, which allows the prevention of spatial inference. Additionally, it securely aggregates the daily evaluated pay-

4.3

loads and applies a cryptographically secure random permutation (shuffling) at the end of the epoch in order to prevent temporal inference and chronological profiling before sending the batch to the insurer. Insurer: Receives the batch of shuffled, anonymized, and encrypted evaluations from the TSP. The objective of the insurer is restricted to decrypting the received aggregate metrics. Prior to computing the insurance premium, the insurer must mathematically verify the cryptographic execution integrity of the TSP (via HomMAC algebraic congruence) and also check whether the decrypted speed discrepancy is within the acceptable physical tolerances. This architecture allows the insurer to maintain risk evaluation utility and auditability while remaining entirely oblivious to the policyholder’s raw spatiotemporal trajectories. Threat Model

Under the assumption of the threat model in the proposed scheme, the OBU is considered trusted with regard to executing its designated operations. Although the OBU is trusted, it receives data from the physical sensor layer, which is taken as an untrusted domain subject to anomalies in the environment, hardware degradation, or even external spoofing (the oracle problem). However, both the RSU edge infrastructure and the TSP are considered as honest-but-curious. Under normal operating conditions, they follow all the protocol specifications but might try to learn private trajectories from the intercepted ciphertexts. It is important to note that a significant advantage of the proposed SP2UBI architecture is its resilience beyond standard semi-honest assumptions. In cases where an active adversary breaks into the TSP and tries to manipulate the ciphertexts or forge evaluations, the proposed verification mechanism allows the insurer to reliably detect these anomalies and guarantees execution integrity. Lastly, the insurance provider is assumed to be honestbut-curious. Even though accurate risk profiling is required to compute fair premiums, its access is cryptographically limited to only the decrypted “Risk Factor” and the “Speed Verification” status. Access to raw vehicular data is mathematically impossible, ensuring strict policyholder privacy without compromising the utility of the UBI model.

5

DETAILED DESCRIPTION OF SP2UBI

This section describes the details of the proposed SP2UBI framework. To provide a clear structural progression, the presentation separates the underlying techniques from the operational protocol workflow. Specifically, the first three subsections outline the core cryptographic and physicallayer building blocks: the privacy-preserving risk factor calculation, the Integrated Sensing and Communications (ISAC)-assisted speed verification mechanism, and the homomorphic authentication scheme designed for temporal privacy. Following the introduction of these foundational tools, the final subsection describes the complete end-to-end protocol, detailing the step-by-step execution phases and data exchanges across all participating entities.

7

5.1

Risk Factor Calculation

To establish the risk assessment baseline in SP2UBI, the On-Board Unit (OBU) aggregates raw vehicular metrics into a coarse-grained telematics feature vector. Rather than transmitting privacy-sensitive, fine-grained event logs—such as individual braking timestamps which expose trajectory correlates—the OBU computes cumulative statistical summaries over a designated temporal interval. For a given day d, this daily feature vector, denoted generally as x(d) , is formally defined as: (d) (d) (d) (d)
x(d) = ID, xhb , x(d) (2) sv , xspd , xmi , xrh where ID represents the unique private policyholder’s identifier. The remaining vector elements correspond to key (d) behavioral and contextual metrics for that specific day: xhb denotes the cumulative frequency of hard braking events (d) defined as deceleration > 7.7 mph/s1 , xsv represents the (d) frequency of speed violations > 80 mph2 , xspd is the average (d)

(d)

trip speed, xmi is the total accumulated mileage, and xrh indicates the driving duration during high-risk temporal windows, such as 23:00–05:003 . This flexible aggregation interval is highly configurable to align with the standard risk-profiling requirements of commercial insurers. As a practical baseline, a 24-hour epoch is selected to maximize data fault tolerance. This setup ensures that localized telemetry corruption or short-term network invalidation events do not compromise extensive volumes of historical metrics, while effectively protecting the driver’s fine-grained spatiotemporal trajectories from passive infrastructure exposure. In practice, the TFHE framework is utilized to process vehicular metrics entirely within the encrypted domain. This secure computation is controlled by an asymmetric FHE key management system: the public encryption key (pk Ins ) is distributed to the OBUs for payload encryption; the evaluation key (evk Ins ) is provisioned to the Telematics Service Provider (TSP) to allow homomorphic computation; and the secret decryption key (sk Ins ) is held exclusively by the insurer. Specifically, any ciphertext encrypted under a public key pk is formally denoted as J·Kpk . The risk evaluation model FIns of the insurer’s choice is compiled into a linear FHE evaluation circuit and outsourced to the TSP. The TSP performs computations on the encrypted input vector Jx(d) Kpk Ins to obtain the encrypted risk result, which ensures that real vehicular data remains strictly inaccessible to the processing cloud. Crucially, the private identifier ID is securely embedded inside the encrypted payload. As a consequence, the TSP performs the computation blindly and cannot correlate specific ciphertexts with actual users, thereby mitigating potential trajectory tracking vectors. To compute the policyholder’s daily risk factor without compromising data confidentiality, the proposed framework processes these encrypted vehicular metrics utilizing the insurer’s specific risk assessment model. Due to the proprietary 1. Nationwide SmartRide Program. [Online]. Available: https://www. nationwide.com/ 2. Kia Usage-Based Insurance. [Online]. Available: https://owners. kia.com/content/owners/en/usage-based-insurance.html 3. Allstate Drivewise. [Online]. Available: https://www.allstate.com/

nature of commercial evaluation architectures, the insurer’s risk assessment is abstracted as a generalized function FIns that maps the encrypted behavioral features to an encrypted (d) daily risk factor score, denoted as JRIns Kpk Ins :  (d) (d) (d) JRIns Kpk Ins = FIns Jxhb Kpk Ins , Jx(d) sv Kpk Ins , Jxspd Kpk Ins ,  (3) (d) (d) Jxmi Kpk Ins , Jxrh Kpk Ins Since the data is already encrypted under the TFHE scheme, this framework inherently allows for evaluating quite complicated machine learning models through its PBS. Despite this capability, obtaining the exact structural parameters of commercial insurance models remains infeasible due to high confidentiality standards. For this reason, to set up a replicable baseline and considering the operational assumptions of existing telematics studies [33], the risk factor evaluation model is abstracted as a linear scoring function. This realistic assumption is consistent with standard industry practices (e.g., Generalized Linear Models) and fits the algebraic conditions of the designed execution verification scheme (detailed in Section 5.3). However, the built-in encryption layer guarantees the flexibility for insurers to securely integrate non-linear operations via PBS, accommodating more complex risk evaluation models in subsequent industrial applications. Finally, once the billing period is over, the TSP randomly shuffles the global pool of encrypted daily risk records before delivering them in a batch to the insurer. As a result, upon decryption, the insurer reveals the ID and accesses the daily factors in plaintext, preventing both spatial tracking by the edge and continuous temporal profiling by the cloud. 5.2 ISAC-Assisted Speed Verification with Reliability Awareness Many existing techniques face certain difficulties associated with data provenance. For instance, the PRIDE scheme [11] verifies data solely based on the mathematical coherence between speed and acceleration. This technique remains vulnerable to hardware-based spoofing attacks, since an attacker can systematically construct artificial telemetry that satisfies these theoretical criteria. Similar to that, the solution suggested by Huang et al. [30] incorporates OBU digital signatures and ZKPs yet overlooks the physical reality of the car itself. Usually, cryptographic techniques are applied to secure data only after it has been digitized, thereby exposing the fundamental oracle problem. If the VSS is compromised at the hardware level, the OBU authenticates the fake data and subsequently generates computationally valid ZKPs for the fabricated metrics. What is more, in modern automotive architectures, the odometer physically relies on VSS readings to accumulate miles; thus, modifying the speed results proportionally changes the total mileage. Hence, any physical auditing mechanisms based strictly on comparing distances can be easily bypassed. Since speed sensor telemetry serves as the fundamental basis for calculating driving risk factors, as mentioned in Section 5.1, verifying its physical integrity is paramount. In order to avoid the circular trust and data association vulnerabilities inherent to separated radar and communication solutions, the SP2UBI framework makes use of ISAC [34]. In

8

this paradigm, the sensing and communication capabilities share the exact same hardware infrastructure and employ a single Radio Frequency (RF) waveform. Extracting the kinematics of the vehicle directly from the Doppler shift and delay of the communication echoes allows ISAC to natively bind the physical ground-truth of the vehicle with its cryptographic digital identity. As a result, there is no need to rely on untrusted self-reports, such as on-board VSS readings or GPS coordinates, effectively bypassing the oracle problem. The verification process relies on the deterministic physical-layer sensing of the uplink communication signal. Once the telematics packet is sent to the edge for a given day d, the OBU retrieves the instantaneous speed of the vehicle, (d) denoted as vsen , directly from the onboard sensors. In order to preserve privacy, the OBU homomorphically encrypts this reading using the dedicated verification key (pk SV ) (d) and transmits the encrypted ciphertext Jvsen Kpk SV embedded inside an ISAC waveform (for example, an Orthogonal Frequency Division Multiplexing (OFDM) signal). Concurrently, upon receiving this uplink transmission via orthogonal resources (e.g., Orthogonal Frequency Division Multiple Access (OFDMA) / Space Division Multiple Access (SDMA)), the RSU decodes the communication payload while simultaneously extracting physical sensing parameters from the exact same electromagnetic signal. Because the transmitted data packet and the physical sensing target originate from a singular electromagnetic emission, data association is intrinsically guaranteed, overcoming the targetmatching ambiguities typical of traditional Frequency Modulated Continuous Wave (FMCW) radars [35]. Based on the ISAC vehicular model [34], the RSU directly extracts the Doppler shift (fD ) and the Angle of Arrival (θ). The vehicle’s (d) true physical speed (visac ) is geometrically compensated at the edge: cfD (d) visac = (4) fc cos(θ) where c is the speed of light and fc is the carrier frequency. Unlike two-way monostatic radar configurations, the oneway uplink transmission natively excludes the factor of 2 in the denominator, and standard pilot-based compensation is applied to isolate fD from asynchronous Carrier Frequency Offsets (CFO). This unified ISAC approach essentially abstracts the physical infrastructure into a reliable, GPSindependent speed oracle, allowing the framework to focus exclusively on cryptographic validation. In real-world traffic scenarios, the extracted measurement may be compromised by degraded channel conditions (e.g., severe multipath fading or Non-Line-of-Sight reflections) or numerical instability when the vehicle passes directly perpendicular to the RSU (θ → 90◦ , cos(θ) → 0). To prevent false-positive penalization of honest drivers, the RSU evaluates the physical-layer reliability before executing any cryptographic operations. Using the measured Signalto-Noise Ratio (SNR) γ (d) and the predefined threshold (d) γth , a Boolean reliability indicator Φrel ∈ {0, 1} is defined, (d) where Φrel = 1 if and only if the channel satisfies three physical criteria: sufficient SNR (γ (d) ≥ γth ), Line-of-Sight (LoS) dominance, and a geometrically stable Angle of Arrival (| cos(θ)| ≥ δθ ) to avoid singularity. Based on this indicator,

the RSU dictates the subsequent operation to produce the (d) daily verification result RSV :  (d) (d) (d) Jvsen Kpk SV ⊖ visac if Φrel = 1 (d) RSV = (5)  (d) FLAGuncert if Φrel = 0 (d)

If the measurement is considered reliable (Φrel = 1), in order to reduce computational complexity at the edge infrastructure, the RSU applies a light-weight verification circuit FSV homomorphically using the evaluation key evk SV , processing values in the mixed domain of ciphertext and plaintext. Given the discrete nature of FHE, both the ciphertext and plaintext values are represented as integers by quantizing the encrypted sensor data and ISAC measurement using the same universally shared scaling factor. Instead of performing the expensive homomorphic comparison of magnitudes, the RSU calculates the difference of the values using the homomorphic subtraction operation (⊖). However, (d) if the channel or geometry is unreliable (Φrel = 0), the RSU completely skips the use of the homomorphic circuit, producing the deterministic FLAGuncert value indicating a lack of physical-layer confidence. To integrate seamlessly with the underlying privacypreserving protocol architecture, the RSU sends the result of (d) the verification process RSV along with the encrypted telematics message to the TSP. As defined in the system model, the TSP systematically removes the geolocation metadata and shuffles the batch of daily telematics messages before sending it to the insurance provider at the end of the billing epoch. Upon decryption of the batch entries, if the FLAGuncert value is encountered by the insurance provider, then the specific daily verification is ignored neutrally without any penalty to the driver. Otherwise, the verification result is decrypted by the insurance provider using the secret verification key (sk SV ), and the absolute error is compared against the defined tolerance threshold (ϵ): (d)
Dec sk SV , RSV ≤ ϵ (6) In which ϵ denotes the policy-defined margin, taking into account the tolerances of the physical hardware and inherent estimation error of the ISAC technique, bounded from below by the Cramér-Rao Lower Bound (CRLB) [34]. If the threshold is exceeded, then the temporal epoch is marked as potentially affected by hardware spoofing. This fault-tolerant architecture implicitly exploits the ISAC to ensure trustless data validation, while maintaining the driver privacy and smartly offloading absolute decision-making to the trusted insurance provider. 5.3 Temporal-Privacy Preserving Homomorphic MAC for Daily Evaluations As discussed in Section 5.1, the insurer’s evaluation model is assumed to be a linear function. To achieve execution integrity without revealing the timing of daily evaluations inside the billing epoch t, a nonce-based Homomorphic Message Authentication Code (HomMAC) is proposed. Let D be the number of days in epoch t. During the offline phase, the OBU and the insurer generate and agree on a shared symmetric secret key K .

9

For each day d ∈ {1, . . . , D}, once the At the end of epoch t, the TSP applies a daily coarse-grained driving data vector x(d) = random permutation π to the D evaluated (d) (d) (d) (d) (d)
batch ID, xhb , xsv , xspd , xmi , xrh , as defined in Equation (2), is tuples. This step generates a randomized
D (π(j)) (π(j)) ready for transmission, the OBU initiates the cryptographic B = JRIns Kpk Ins , JTR Kpk Ins , Juπ(j) Kpk Ins j=1 , which binding process using a distinct set of parameters. The is subsequently forwarded to the insurer. structural parameters (αt , ri , and p) are deterministically Upon decrypting tuple j , the insurer locally derives αt derived from the shared key K or pre-agreed. Meanwhile, and the base blinding vector r. To guarantee that the TSP the daily nonce (ud ) is generated independently on the fly. honestly executed the exact model with the correct coeffiThe operational roles of these parameters are structured as cients, the insurer computes the expected base noise over follows. its identical linear circuit just once per epoch: rtotal = FIns (r) Using a cryptographic Pseudorandom Function (PRF) (mod p). Since the TSP has no knowledge of the secret denoted as FK keyed by the shared secret K , the OBU blinding vector r, this calculation acts as an algebraic anchor. generates an epoch-specific MAC base scalar αt ← FK (t ∥ 0) If the TSP alters the model or its coefficients, it cannot to bind the evaluation to the current billing cycle t. It then mathematically forge a tag that matches the insurer’s hidden applies the same PRF to compute input-specific base blinding rtotal . Execution integrity is definitively verified via the factors ri ← FK (t ∥ i), which act as spatial masks for the following algebraic congruence: individual driving features. While the insurer is authorized (j) ? (j) (d) TR ≡ αt · RIns + u(j) · rtotal (mod p) (10) to see only the final evaluated scalar risk score (RIns ), omitting ri would leave the algebraic structure of the tags To prevent intra-epoch replay attacks (e.g., the TSP copying unmasked. In such a scenario, an honest-but-curious insurer a favorable daily evaluation), the insurer asserts the uniquecould exploit its knowledge of the linear model weights, ness of u(j) within the batch. This approach ensures an O(1) set up a system of equations across the shuffled batch, and verification complexity per tuple. It also guarantees strict (d) (d) solve for the underlying raw driving metrics (xhb , xsv , . . . ). temporal privacy, as the insurer exclusively observes random Extracting these fine-grained features violates core data nonces u(j) with no algebraic linkage to the true temporal minimization principles. It also exposes the policyholder’s index d. exact daily behavioral fingerprint, which directly defeats the privacy objectives of the framework. 5.4 PROPOSED SCHEME To constrain the MAC space and prevent integer overflow during homomorphic evaluations, all computations are Before detailing the operational workflow of the proposed securely bounded by a large prime modulus p. Within this protocol, we briefly outline the system initialization phase finite field, the OBU randomly samples a fresh temporal and the distribution of cryptographic material. During nonce ud ∈ Z∗p that has no algebraic linkage to the actual the offline contract setup phase, the required asymmetric chronological day index d. If ud were deterministically tied and symmetric keys are generated and provisioned to the to the date, the insurer could easily sort the shuffled batch participating entities based on their specific roles in the and reconstruct the driver’s timeline. In addition, without a architecture. To ensure strict separation of duties and prevent fresh random nonce, identical driving behaviors on different unauthorized data access, each entity receives only the days would yield identical tags. This would expose daily cryptographic keys necessary for its designated operations. repetitions and leave the system vulnerable to replay attacks. Table 2 summarizes the distribution of keys across OBU, RSU, Therefore, combining ri and ud is strictly required to provide TSP, and the insurer. Step 1: Data Encapsulation and Homomorphic Tagging at comprehensive spatial and temporal masking. The OBU constructs the daily polynomial authenticators the OBU. During the contract initialization phase, the cryptographic (tags) for each feature i as follows: parameters (including the OBU’s individual group signing (d) (d) Ti = αt · xi + ud · ri (mod p) (7) key sk OBU , the group public key pk Group , the asymmetric encryption keys pk Ins and pk SV , the symmetric MAC key This specific structure (two scalar multiplications and one K , and the public routing identifier ID Ins ) are provisioned addition) is inspired by information-theoretic MACs. It is within a tamper-resistant Hardware Security Module (HSM) highly advantageous for homomorphic encryption systems or a Trusted Execution Environment (TEE) embedded in the because it avoids computationally expensive ciphertextOBU. The inclusion of ID Ins facilitates efficient ciphertext ciphertext multiplications while seamlessly distributing over routing by intermediate edge nodes without exposing the the linear evaluation model. policyholder’s true identity (Algorithm 1, line 1). Next, the OBU encrypts the driving data, the tags, and During the operational phase, for each day d within the the temporal nonce under the insurer’s public key pk
Ins . The billing epoch t, the OBU executes a sequence of numbered (d) (d) (d) daily tuple σ = Jx Kpk Ins , JT Kpk Ins , Jud Kpk Ins is then sub-steps as formalized in Algorithm 1: transmitted to the TSP. Step 1.1 (Scalar Derivation): The OBU derives the epochBecause the evaluation model FIns is linear, the TSP apspecific MAC base scalar αt and the feature-specific blinding plies the identical homomorphic circuit to both the encrypted factors ri from the shared symmetric key K using the feature vector and the encrypted tag vector: cryptographic PRF (Algorithm 1, lines 3–6).
(d) (d) Step 1.2 (Tag Computation): To support the verifiable execution JRIns Kpk Ins = FIns Jx Kpk Ins (8) integrity detailed in Section 5.3, the OBU dynamically
(d) JTR Kpk Ins = FIns JT(d) Kpk Ins (9) samples a daily temporal nonce ud ∈ Z∗p and computes the

10

TABLE 2 Cryptographic Key Distribution and Access Privilege Matrix Across System Entities Cryptographic Parameter

symmetric key to lock the raw telematics logs and random encryption values, storing them safely inside the TEE until the billing epoch concludes as a reliable backup for potential dispute resolution.

Notation OBU RSU TSP Ins.

Asymmetric Encryption & Decryption Layer Risk Evaluation Public Key pk Ins • Risk Evaluation Secret Key sk Ins ◦ Speed Verification Public Key pk SV • Speed Verification Secret Key sk SV ◦

◦ ◦ ◦ ◦

◦ ◦ ◦ ◦

◦ • ◦ •

Homomorphic Evaluation Layer Risk Evaluation Key evk Ins Speed Verification Key evk SV

◦ ◦

◦ •

• ◦

◦ ◦

Authentication, Anonymity & Routing Layer Group Public Key pk Group • OBU Group Signing Key sk OBU • Group Manager Secret Key sk Group ◦ Symmetric HomMAC Key K • Public Routing Identifier ID Ins •

• ◦ ◦ ◦ •

• ◦ ◦ ◦ •

◦ ◦ • • •

Note: • indicates key possession and authorization; ◦ indicates strict cryptographic isolation (no access).

plaintext homomorphic authenticators (tags) T(d) over the daily driving feature vector x(d) . Utilizing the epoch-unique ud ensures daily data freshness and facilitates deterministic malleability detection without requiring an auxiliary random nonce (Algorithm 1, lines 8–11). Step 1.3 (Payload Structuring and Encryption): In order to build the daily evaluation payload, the OBU first combines the policyholder’s private identifier, the driving feature vector, the polynomial tags, and the temporal nonce into a unified plaintext tuple:
(d) Praw = ID, x(d) , T(d) , ud (11) Because any untrusted edge infrastructure poses a major risk to the spatial and temporal anonymity of the driver, the OBU hides all elements of this package using homomorphic encryption. Specifically, it encrypts each component of the (d) tuple Praw individually under the insurer’s public key pk Ins . This computation yields the composite encrypted payload vector represented formally as JP (d) Kpk Ins (Algorithm 1, line 13). Step 1.4 (Speed Encryption): Concurrently, the captured in(d) stantaneous speed parameter vsen receives a separate layer of encryption under the verification key pk SV , producing (d) the encrypted ciphertext Jvsen Kpk SV for edge verification (Algorithm 1, line 15). Step 1.5 (Anonymized Authentication): Next, the OBU concatenates the encrypted payloads with the routing identifier ID Ins and applies a group signature protocol using its secret key sk OBU to generate the cryptographic signature σ (d) . This signature provides a practical advantage: RSU can confirm the subscription status and validity of the vehicle without uncovering its true identity (Algorithm 1, lines 17–18). Step 1.6 (Tuple Assembly and Storage): Finally, the OBU merges these parts into the unified transmission tuple
(d) C (d) = JP (d) Kpk Ins , Jvsen Kpk SV , ID Ins , σ (d) and broadcasts it to the edge infrastructure (Algorithm 1, lines 20–21). To secure the device against physical theft, the OBU uses a local

Algorithm 1 OBU Cryptographic Payload Encapsulation & Tagging Input: Daily feature vector x(d) of size n, instantaneous (d) speed vsen , private ID , public ID Ins , epoch t, prime modulus p. Output: Unified daily cryptographic transmission tuple C (d) . 1: // Retrieve parameters (pk Ins , pk SV , sk OBU , pk Group , K ) from HSM/TEE 2: // Step 1.1: Derive epoch-specific and feature-specific MAC scalars 3: αt ← FK (t ∥ 0) 4: for each feature index i ∈ {1, . . . , n} do 5: ri ← FK (t ∥ i) 6: end for 7: // Step 1.2: Sample temporal nonce and compute daily HomMAC tags $

− Z∗p (sampled without replacement for epoch t) 8: ud ← 9: for each feature index i ∈ {1, . . . , n} do (d)

(d)

10: Ti ← αt · xi + ud · ri (mod p) 11: end for 12: // Step 1.3: Homomorphic encryption of the insurance payload

components JP (d) Kpk Ins ← Enc(pk Ins , ID), Enc(pk Ins , x(d) ),
13: Enc(pk Ins , T(d) ), Enc(pk Ins , ud ) 14: // Step 1.4: Encrypt instantaneous speed for ISAC verification (d) (d)
15: Jvsen Kpk SV ← Enc pk SV , vsen 16: // Step 1.5: Generate group signature for anonymity and authentication (d) 17: msg ← JP (d) Kpk Ins ∥ Jvsen Kpk SV ∥ ID Ins
(d) 18: σ ← Sign sk OBU , pk Group , msg 19: // Step 1.6: Assemble the final transmission tuple
(d) 20: C (d) ← JP (d) Kpk Ins , Jvsen Kpk SV , ID Ins , σ (d) 21: return C (d) Step 2: Message Authentication and ISAC-Assisted Speed Verification at the RSU. As detailed in Algorithm 2, upon receiving the uplink electromagnetic signal carrying the encapsulated payload C (d) from the OBU, the RSU concurrently decodes the communication data and extracts the physical sensing parameters. The verification procedure is structured into three sequential sub-steps: Step 2.1 (Group Signature Authentication): Initially, the RSU performs cryptographic authentication utilizing the group public key (pk Group ) to validate the data origin and integrity of the message. If the group signature verification fails, the payload is immediately rejected and discarded to prevent computational resource exhaustion at the edge infrastructure (Algorithm 2, lines 2–6). Step 2.2 (Reliability-Aware Speed Verification): Conversely, upon successful authentication, the RSU proceeds to the ISAC-assisted speed verification phase, as formalized in Section 5.2. The RSU computes the true physical speed

11

(visac ) from the extracted Doppler shift and evaluates the channel SNR (γ ). To prevent false penalization due to degraded channel conditions, the RSU compares γ against the predefined reliability threshold γth . If γ ≥ γth , the RSU executes the lightweight verification circuit FSV utilizing the evaluation key evk SV . This operation performs a mixeddomain homomorphic subtraction between the encrypted (d) self-reported speed (Jvsen Kpk SV ) and the plaintext physical measurement (visac ). Alternatively, if the channel threshold is not met (γ < γth ), a deterministic FLAGuncert is generated to indicate sensing uncertainty (Algorithm 2, lines 8–14). Step 2.3 (Message Assembly and Forwarding): Finally, the (d) verification result, denoted formally as RSV , is assembled (d) alongside the original vehicular payload C into a forwarding message RSU M and transmitted to the TSP (Algorithm 2, lines 16–17). Algorithm 2 ISAC-Assisted Homomorphic Speed Verification at RSU Input: Vehicular payload C (d) =
(d) (d) (d) JP Kpk Ins , Jvsen Kpk SV , ID Ins , σ , physical speed visac , channel SNR γ , reliability threshold γth , evaluation key evk SV . Output: Forwarding message RSU M containing the verification result. 1: // Step 2.1: Cryptographically verify the group signature (d) 2: msg ← JP (d) Kpk Ins ∥ Jvsen Kpk SV ∥ ID Ins 3: if Verify(σ (d) , msg, pk Group ) == False then 4: reject Invalid payload; abort protocol 5: return ⊥ 6: end if 7: // Step 2.2: Evaluate ISAC physical-layer reliability 8: if γ ≥ γth then 9: // Execute mixed-domain homomorphic subtraction (d) (d) 10: RSV ← Jvsen Kpk SV ⊖ visac 11: else 12: // Flag uncertainty due to severe multipath/fading (d) 13: RSV ← FLAGuncert 14: end if 15: // Step 2.3: Assemble payload for TSP forwarding (d) 16: RSU M ← (RSV , C (d) ) 17: return RSU M Step 3: Message Authentication and Risk Evaluation Circuit Execution at the TSP. (d) Upon receiving the forwarded message RSU M from the RSU, the TSP executes the computational and obfuscation workflow formalized in Algorithm 3 through five distinct sub-steps: Step 3.1 (Signature Re-verification): The TSP first performs an end-to-end cryptographic verification of the group signature utilizing the corresponding group public key (pk Group ) to ensure data integrity across the routing hops. If the verification fails, the record is discarded (Algorithm 3, lines 3–7). Step 3.2 (Payload Unpacking): Upon successful authentication, the TSP accesses and extracts the elements of the OBU’s encrypted payload vector, specifically isolating Jx(d) Kpk Ins , JT(d) Kpk Ins , and Jud Kpk Ins from JP (d) Kpk Ins (Algorithm 3, line 9).

Step 3.3 (Homomorphic Circuit Execution): To compute the final driving risk factor while maintaining verifiable execution integrity (as formalized in Section 5.3), the TSP executes the insurer’s risk evaluation circuit FIns utilizing the dedicated evaluation key evk Ins . This homomorphic circuit is applied concurrently to both the encrypted feature vector and the encrypted tag vector, yielding the encrypted daily risk factor (d) (d) JRIns Kpk Ins and its aggregated tag JTR Kpk Ins (Algorithm 3, lines 11–12). Step 3.4 (Local Repository Storage): To mitigate temporal profiling, the TSP does not immediately transmit these daily results to the insurer. Instead, the evaluated tuple (comprising the computed risk score, the aggregated tag, the encrypted temporal nonce, and the ISAC verification result (d) RSV ) is stored in the TSP’s local repository (Algorithm 3, line 14). Step 3.5 (Batch Shuffling and Transmission): To address temporal inference attacks (a privacy vulnerability where the sequential transmission of daily results allows the insurer to reconstruct chronological behavioral routines), the proposed protocol delays data transmission until the billing epoch concludes. Let D denote the total number of accumulated daily records. At the end of the epoch, the TSP applies a random permutation π over the indices {1, . . . , D}. This shuffling mechanism breaks the chronological linkage, producing a randomized batch B that prevents time-series alignment analysis by the insurer (Algorithm 3, lines 17–19). Algorithm 3 Homomorphic Risk Evaluation and TSP Batch Generation (d)

(d)

Input: Forwarded RSU payloads RSU M = (RSV , C (d) ) for each day d ∈ {1, . . . , D} in epoch t. Output: A chronologically shuffled evaluation batch B for the insurer. 1: for each day d ∈ {1, . . . , D} do 2: // Step 3.1: End-to-end group signature verification (d) 3: msg ← JP (d) Kpk Ins ∥ Jvsen Kpk SV ∥ ID Ins (d) 4: if Verify(σ , msg, pk Group ) == False then 5: reject Invalid payload; discard daily record 6: continue to next iteration 7: end if 8: // Step 3.2: Access encrypted payload components 9: Retrieve Jx(d) Kpk Ins , JT(d) Kpk Ins , and Jud Kpk Ins from the vector JP (d) Kpk Ins 10: // Step 3.3: Execute linear risk evaluation circuit and HomMAC tag aggregation
(d) 11: JRIns Kpk Ins ← FIns Jx(d) Kpk Ins , evk Ins
(d) 12: JTR Kpk Ins ← FIns JT(d) Kpk Ins , evk Ins // Step 3.4: Store daily evaluated tuple in the local repository 13: (d)

(d)

(d)

(d)

14: TSP ← JRIns Kpk Ins , JTR Kpk Ins , Jud Kpk Ins , RSV 15: end for 16: // Step 3.5: At the conclusion of epoch t, apply random

permutation π 17: Generate permutation π over indices {1, . . . , D}

 D TSP (π(j)) j=1 19: return B 18: B ←

Step 4: Result Decryption, Integrity Verification, and Final

12

Extraction by the Insurer. In the final phase of the billing epoch, the insurer receives the chronologically shuffled batch B from the TSP. Utilizing its exclusive secret keys (sk Ins and sk SV ), the insurer decrypts the elements of each tuple j ∈ {1, . . . , D}. Specifically, sk Ins is employed to reveal the private policyholder identifier (j) (ID ), the homomorphically evaluated risk factor (RIns ), the (j) aggregated HomMAC tag (TR ), and the temporal nonce (u(j) ). Concurrently, the insurer utilizes sk SV to decrypt the (j) ISAC-assisted speed verification result (RSV ). Before utilizing the risk factor for premium calculation, the insurer performs two verification checks. First, it verifies the execution integrity of the TSP’s homomorphic aggregation via the algebraic congruence defined in Eq. (10). Second, the insurer validates the physical speed integrity (j) by confirming that the absolute error RSV falls within the predefined physical tolerance threshold ϵ, as stipulated in Eq. (6). Tuples successfully passing both validations are aggregated for the final premium adjustment, while those failing are flagged for potential spoofing or computation tampering. Dispute Resolution Mechanism: The group signature σ (d) securely links all of the daily payload together. Thanks to this cryptographic bond, no single party can deny the transmission of the data. As a result, the system establishes a clear and undeniable trail for any future audits. Every now and then, a dispute might arise between the two parties. In the event of such a conflict, the policyholder can extract the locally encrypted logs directly from the OBU. The driver decrypts these specific files on a local level first. After that, the driver securely reveals the raw driving data along with the random values used for the initial encryption. With all of this information, the logs are simply re-encrypted from scratch. This step mathematically checks if the new results match the original ciphertexts exactly. Such a deterministic verification offers a definitive cryptographic proof of the exact inputs from the driver. Ultimately, this method creates a fair and auditable framework for the resolution of conflicts. Above all, it ensures that no raw driving data is ever left unprotected inside the vehicle.

6

PRIVACY AND SECURITY ANALYSIS

This section evaluates the proposed SP2UBI framework in three phases. First, an informal analysis verifies how the architecture satisfies core security and privacy requirements. Second, a formal evaluation quantifies the privacy and confidentiality guarantees of the protocol. Finally, a comparative analysis benchmarks the scheme against existing vehicular telematics models. 6.1

Evaluation of Privacy and Security Requirements

This subsection examines how foundational privacy and security requirements are fulfilled within the SP2UBI scheme. Unlinkability: Unlinkability is established by implementing a dual-layered solution. On the edge side, the identity of the policyholder is concealed from the RSU by using a group signature, while the replacement of the private identifier with the public routing identifier (ID Ins ) ensures unlinkability at the edge node. On the cloud side, epoch-end shuffling by the

TSP mathematically disrupts temporal correlations between ciphertexts and ensures that daily risk factors cannot be chronologically linked to spatiotemporal trajectories. Non-repudiation: This requirement is met cryptographically due to the creation of an unforgeable group signature that authenticates the data origin and prevents the policyholder from denying message transmission. In addition, the secure archiving of deterministic plaintext logs inside the tamper-resistant OBU ensures cryptographic evidence to resolve any further billing disputes. Confidentiality and Non-disclosure: Confidentiality is provided at all infrastructure levels. The protocol intentionally uses coarse-grained statistical aggregation and does not transfer fine-grained GPS trajectories. Specifically, all risk and speed assessments are performed within the homomorphically encrypted domain. Thus, intermediary entities (e.g., the TSP) become blind evaluators of the traffic data, which ensures that raw vehicular telemetry remains inaccessible outside the trusted OBU-insurer perimeter. Unobservability: Data transmission becomes unobservable due to decoupling the data from its real-time spatial context. The TSP consistently removes any physical RSU identifiers and geographic metadata from the transmitted payloads to forward an aggregated, non-sequential batch to the insurer. As a result, time-series analysis of the transmitted batches will not allow the insurer to infer the daily commuting patterns of the policyholder. Data Sovereignty (Content Awareness): Since the initial telematics aggregation and cryptographic encapsulation are performed solely within the user-controlled OBU, data sovereignty is preserved. This gives the policyholder full content awareness before any transmission of data to external parties. Insurer’s Evaluation Privacy: The confidentiality of the insurer’s proprietary risk assessment model is protected. Due to the conversion of the risk model into a corresponding FHE circuit, the TSP is able to perform all computations without having plaintext access to potentially sensitive model weights and telematics data inputs. Execution Integrity and Verifiability: Unlike vulnerable systems susceptible to silent computational failures or malicious cloud tampering, SP2UBI guarantees execution integrity without sacrificing data confidentiality. The implementation of the decoupled HomMAC protocol allows the insurance provider to mathematically verify that the TSP correctly executes the intended linear circuit (FIns ). Furthermore, temporal nonces protect against intra-epoch replay attacks and intra-batch ciphertext substitution.

6.2

Formal Evaluation of Technical Privacy Metrics

To rigorously quantify the privacy guarantees of the protocol against a rational adversary, the structured technical metrics proposed in the systematic survey by Wagner and Eckhoff [36] are adapted. Given the context of UBI, the primary goal is to prevent behavioral profiling and pattern inference. Accordingly, the proposed scheme is evaluated based on the formal criteria of day-to-day unlinkability and informational entropy.

13

6.2.1 Mitigation of Temporal and Behavioral Profiling Over a billing epoch of D days (e.g., D = 30), the protocol generates a set of daily risk assessment vectors and speed verification results. Although the insurer identifies the policyholder for the final premium calculation, the proposed protocol prevents the insurer from linking any specific daily evaluation to its exact chronological calendar date. This privacy bound is established under three core architectural assumptions: (i) the insurer only accesses the authorized identity and the unordered batch of decrypted daily results B , without external side-channels; (ii) prior to transmission, the TSP strictly shuffles the accumulated daily records using a cryptographically secure pseudo-random permutation uniformly selected from the symmetric group of all possible arrangements Π (|Π| = D!); and (iii) the decrypted parameters, including the HomMAC temporal nonces u(j) , are structurally independent and contain no deterministic temporal identifiers linking back to the true day index d. Following [36], the degree of daily unlinkability (privDUE ) is quantified via the Shannon entropy of the adversary’s probability distribution p(π) over the hypothesis space Π: X privDUE ≡ H(Π) = − p(π) log2 p(π) (12) π∈Π

Theorem 1. The proposed epoch-end shuffling mechanism satisfies the day-to-day unlinkability criterion (privDUE ), bounding the adversarial insurer’s probability of chronologically reconstructing a policyholder’s behavioral profile over a D-day billing epoch to 1 D! . Proof: The daily unlinkability metric is evaluated across two distinct operational states: Case 1 (Baseline State Without Shuffling): If the TSP transmits daily evaluations chronologically, the sequence is deterministic, yielding p(πtrue ) = 1 and p(π ̸= πtrue ) = 0. Substituting these values into Eq. (12) results in H(Π) = 0, indicating deterministic temporal linkability and enabling behavioral trajectory reconstruction by the insurer. Case 2 (Protected State With Uniform Shuffling): Due to the cryptographically uniform permutation applied by the TSP and the absence of side-channels, the adversarial insurer’s prior probability over the hypothesis space Π is strictly uniform: p(π) = 1/D!, ∀π ∈ Π. Substituting this uniform distribution into Eq. (12) yields the upper bound for informational entropy under a uniform distribution:   X 1 1 H(Π) = − log2 = log2 (D!) (13) D! D! π∈Π For a standard monthly billing epoch where D = 30, Eq. (13) yields H(Π) = log2 (30!) ≈ 107.74 bits. Consequently, the brute-force success probability for an adversarial insurer attempting to deduce the exact chronological configuration of a policyholder’s behavioral profile is bounded by 2−107.74 , which is statistically negligible, thereby mitigating day-today linkability risks. 6.2.2 Anonymity Against External Attackers, RSUs, and the TSP In VANET environments, the primary tracking threat stems from the linkability of transmitted messages. To mitigate

this vulnerability, the proposed framework leverages k anonymity to mask the sender’s identity within an equivalence class. Following the Wagner-Eckhoff taxonomy [36], an equivalence class Ei represents the set of all potential users who could have generated a specific transmission from the adversary’s perspective. The system satisfies k -anonymity (privKA ) if and only if the cardinality of every equivalence class across X independent channels boundedly meets or exceeds k : privKA ≥ k ⇐⇒ ∀i ∈ {1, . . . , X} : |Ei | ≥ k

(14)

Theorem 2. The proposed packet encapsulation protocol satisfies k -anonymity for the vehicle against honest-but-curious RSUs, the TSP, and external eavesdroppers. Proof: Let E be an arbitrary equivalence class of users associated with a captured transmission payload C (d) . According to the operational design, every validated packet contains a group signature σ (d) verifiable solely via the group public key pk Group assigned to a distinct membership set G. Due to the indistinguishability property of the underlying group signature scheme, the cryptographic signatures leak no identifying information beyond group membership. Consequently, an adversary (whether an external attacker or the backend TSP) can only deduce that the packet originated from some authorized member within the group G. It follows that the adversary’s hypothesis space is restricted to the group boundaries, establishing an exact structural equivalence between the anonymity class and the group population, denoted as E = G. Given that the initialization phase provisions each cryptographic group with k distinct policyholders (|G| = k ), the cardinality of the equivalence class is deterministically bounded by:

|E| = |G| = k

(15)

Substituting this result into Eq. (14) confirms that ∀i : |Ei | = k ≥ k , thereby formally satisfying the k -anonymity metric. 6.2.3 Semantic Security Against Intermediary Entities To safeguard raw telematics streams against honest-butcurious intermediaries, the framework enforces semantic security throughout the data lifecycle. All data vectors generated by the OBU are encrypted prior to transmission using an FHE scheme that satisfies indistinguishability under chosenplaintext attacks (IND -CPA). Under this paradigm, the RSU and TSP are provisioned exclusively with evaluation keys (evk SV and evk Ins , respectively), while the corresponding decryption keys remain strictly private to the insurer. Following the Wagner-Eckhoff classification [36], the degree of confidentiality via a cryptographic game (privCG ) is formulated as a binary success indicator: ( 1 if Pr[A(cb ) = b] ≤ 21 + ϵ(κ) privCG ≡ (16) 0 otherwise where A denotes a polynomial-time adversary, cb = Enc(mb , pk ) is the challenge ciphertext generated from two chosen plaintexts m0 , m1 of equal length, and ϵ(κ) is a negligible function of the security parameter κ. Theorem 3. The proposed framework satisfies semantic security (IND -CPA) for all vehicular telematics payloads against honestbut-curious intermediary entities, ensuring privCG = 1.

14

Proof: Consider an adversarial intermediary (e.g., the TSP) executing the linear risk evaluation circuit FIns . Since the underlying FHE construction is established to be IND -CPA secure, no computationally efficient algorithm can distinguish between the ciphertexts of distinct plaintexts. Consequently, the advantage of A over a random guess is bounded by ϵ(κ), limiting its winning probability to 1 2 + ϵ(κ). This satisfies the upper branch of Eq. (16), yielding privCG = 1. Thus, even with full exposure to the evaluation keys and intermediate execution states, the telematics data remains semantically secure and computationally inaccessible to unauthorized entities. 6.2.4 Source Location Obfuscation and Adversarial Success Probability To counter localized trajectory tracking, the insurer is modeled as an active adversary attempting to infer the policyholder’s spatiotemporal distribution via the identity of the forwarding RSU. Let X denote the universe of all deployed RSUs, and X ∈ X be a random variable representing the actual source RSU. Let Y ∈ Y be the random variable representing the observable metadata intercepted by the insurer. Upon observing Y = y , the adversary executes an optimal estimation function X̂ : Y → X to guess the true source. Following [36], the global adversarial success probability Psucc is bounded by the maximum posterior probability:

Psucc (y) = max Pr(X = i | Y = y) i∈X

(17)

Theorem 4. The TSP-mediated architecture reduces the adversarial success probability for source location tracking from a deterministic proposed 1 base baseline (Psucc = 1) to a probabilistic bound (Psucc = |S| ), where |S| is the cardinality of the regional RSU anonymity set. Proof: The adversarial tracking capabilities across the two architectural paradigms are evaluated as follows: Case 1 (Baseline Direct Channel): In an architecture without a mediating proxy, each RSU forwards packets directly to the insurer along with its explicit identity. Thus, the observed metadata contains a deterministic mapping where Y = i. The posterior probability reduces to a degenerate distribution, modeled mathematically via the Kronecker delta: ( 1 if i = y Pr(X = i | Y = y) = δiy = (18) 0 otherwise base Substituting Eq. (18) into Eq. (17) yields Psucc = 1, demonstrating that the insurer can identify the exact source location deterministically. Case 2 (Proposed TSP-Mediated Obfuscation): To prevent tracking via edge node identifiers, the proposed protocol utilizes the TSP as a privacy-preserving proxy. The TSP actively intercepts RSU transmissions, stripping all localized geographic markers and physical RSU identifiers before batching and delivering the statistical payload to the insurer. Consequently, the insurer can only map the metadata y to an anonymity set of compatible RSUs covering the region over the D-day epoch, denoted as S ⊆ X . Assuming no side-channel bias, the posterior distribution over S is strictly uniform: ( 1 if i ∈ S Pr(X = i | Y = y) = |S| (19) 0 otherwise

Under this protected state, the adversary’s optimal guessing strategy yields a significantly mitigated success bound:   1 1 proposed Psucc = max = (20) i∈S |S| |S| Assuming a non-trivial regional deployment where |S| ≥ 2, comparing the two derivations demonstrates a strict mathematical reduction in adversarial tracking capability: proposed Psucc =

1 base < Psucc =1 |S|

(21)

This formalizes that the TSP-mediated architecture enhances source location obfuscation, preventing reliance on vulnerable edge nodes and forcing the insurer’s tracking capability to scale inversely with the size of the spatial anonymity set.

6.2.5

Collusion Analysis Among Entities

The potential collusion scenarios among participating entities, along with their respective adversarial targets and the corresponding mitigation mechanisms, are systematically summarized in Table 3. By enforcing coarse-grained statistical data encapsulation, evaluating homomorphic operations exclusively over these aggregated daily states, and leveraging cryptographic shuffling, SP2UBI preserves user privacy and execution integrity against multi-entity collusion scenarios. TABLE 3 Collusion Scenarios and Mitigation Mechanisms Collusion Scenario & Target

Mitigation Mechanism

OBU ↔ {RSU, TSP}

The intermediaries are provisioned exclusively with evaluation keys (evk ), ensuring the semantic security (IND -CPA) of the underlying FHE scheme. Furthermore, any malicious deviation from the designated circuits is deterministically detected by the insurer via the decoupled HomMAC algebraic verification.

Target: Reverse-engineering proprietary risk models (FIns , FSV ) or manipulating evaluation circuits. Insurer ↔ {RSU, TSP} Target: Extraction of fine-grained spatiotemporal trajectories or chronological profiling.

6.3 Comparative Schemes

The protocol enforces coarse-grained statistical aggregation natively at the OBU to prevent fine-grained trajectory reconstruction. Consequently, the colluding entities only access coarse-grained data without spatio-temporal metadata, thereby preserving a level of privacy.

Evaluation

with

State-of-the-Art

To accurately delineate the functional position of SP2UBI, Table 4 provides a systematic comparison with several prominent UBI frameworks. This evaluation is conducted across five critical dimensions: end-to-end (E2E) ciphertext confidentiality, physical layer tamper resistance, spatiotemporal unlinkability, conditional anonymity, and confidential anomaly detection. As illustrated in the table, existing literature shows a dichotomy between physical tamper resistance (mitigating

15

TABLE 4 Comparative Analysis of the Proposed SP2UBI Framework with State-of-the-Art UBI Schemes

Framework / Scheme

Security and Privacy Capabilities

Primary Cryptographic / Technical Mechanism E2E Ciphertext

Physical-Layer

Spatiotemporal

Conditional

Confidential

Confidentialitya

Fraud Resistanceb

Unlinkability

Anonymity

Anomaly Detectionc

PriPAYD [26]

Local Processing + Tamper-resistant HW

✗

∼

✓

✗

✗

VPriv [27]

ZKPs + Cryptographic Commitments

✓

∼

∼

✓

∼

PRIDE [11]

Matrix-based Homomorphic Encryption

✗

✗

✗

✗

✗

DUBI [1]

Pedersen Commitments + NIZKPs

✓

∼

∼

✓

∼

Huang et al. [30]

Paillier Cryptosystem + ZKPs

✓

✗

✓

✓

∼

BE-VIP [29]

Local ML (Logistic Regression) + IPFS

✗

✗

✓

✓

∼

SP2UBI (Proposed)

TFHE + Group Signatures + ISAC

✓

✓

✓

✓

✓

Legends: ✓ Fully Supported / Resistant; a

∼ Partially Supported / Limited by operational constraints;

✗ Not Supported / Vulnerable.

Ensures the execution environment cannot deduce intermediate logical states or boolean comparison results.

b

Mitigates the ”Oracle Problem” by validating physical ground-truth independently of the vehicle’s native internal sensors.

c

Executes fraud validation or anomaly detection without necessitating partial data disclosure or privacy-invasive spot-checks.

the Oracle Problem) and strict data privacy. Early frameworks like PriPAYD [26] achieve only a partial level of physical layer tamper resistance, as they rely heavily on the theoretical assumption of ”tamper-resistant black boxes,” an assumption vulnerable to pre-digitization signal injection in practice. Subsequent schemes, such as VPriv [27] and DUBI [1], attempt to address this by incorporating roadside spot-checks or trusted third-party auditors. Consequently, they also only achieve a partial level of physical layer tamper resistance. In addition, such auditing mechanisms inherently undermine privacy by temporarily exposing the real identity and location of the vehicle during the verification phase. Conversely, recent architectures, including the frameworks proposed by Huang et al. [30] and BE-VIP [29], achieve strong trajectory unlinkability via ZKPs and federated structures. However, they mathematically assume the digitized sensor data to be truthful, rendering them vulnerable to hardware spoofing. The SP2UBI framework bridges this gap by leveraging the physical properties of ISAC waves (e.g., Doppler shifts) to securely verify the vehicle’s kinematics without relying on onboard sensors or privacy-invasive spot-checks. Achieving confidential anomaly detection without compromising the E2E confidentiality of encrypted data remains an ongoing challenge. While PRIDE [11] ensures execution integrity, its reliance on intermediate plaintext thresholding (e.g., Boolean values for speeding anomalies) inadvertently leaks the temporal distribution of driver violations to all consensus nodes. Similarly, BE-VIP executes machine learning risk models locally on plaintext within the OBU. This design necessitates the long-term retention of unencrypted telematics data at the endpoint, expanding the attack surface against hardware tampering. Even ZKP-based models like DUBI and the Huang et al. framework often require partial data disclosure (e.g., opening cryptographic commitments) to trusted third-party auditors when anomalies trigger a dispute resolution process. Because these existing frameworks ultimately depend on endpoint plaintext processing (e.g., BE-VIP), privacy-invasive physical audits (e.g., VPriv), or partial data disclosure for resolving anomalies (e.g., DUBI and Huang et al.), they offer only a limited guarantee in confidential anomaly detection. By utilizing the TFHE framework, SP2UBI ensures data encryption at the source

and guarantees that all subsequent arithmetic and logical operations, including anomaly validations, are executed exclusively in the ciphertext domain. This reduces the endpoint attack surface and protects raw telematics data as well as intermediate execution states from all intermediate nodes.

7

PERFORMANCE ANALYSIS

To validate the performance and assess the computational efficiency of the proposed framework, the protocol was implemented in Python on a local machine equipped with an Intel Core i7-1065G7 CPU @ 1.30GHz (4 cores) running Ubuntu 22.04 LTS. The homomorphic circuits were constructed utilizing the Concrete framework developed by Zama4 . This library leverages PBS within the TFHE scheme, enabling the execution of exact discrete operations directly over ciphertexts while managing noise proliferation effectively. To evaluate the system’s capacity for risk assessment within the encrypted domain, the Concrete ML library was utilized. This framework facilitates the conversion of standard machine learning models into equivalent TFHE circuits through built-in quantization techniques. Through this setup, it is demonstrated that the proposed architecture possesses the computational flexibility to integrate homomorphic machine learning evaluations, maintaining a practical overhead tailored for VANETs. To train and validate the risk factor computation model, the machine learning framework was implemented using the telematics driving dataset provided by So et al. [37]. This dataset encapsulates records from 100,000 distinct automobile insurance policies, capturing traditional risk variables and granular telematics features. To align the predictive model with the behavioral parameters of the protocol, a targeted feature mapping was executed. Specifically, the data series corresponding to aggressive driving maneuvers (namely hard braking (Brake) and rapid acceleration (Accel)) were extracted and normalized alongside the total mileage driven and the percentage of vehicle operation during high-risk 4. Zama, “Concrete: TFHE Compiler that converts Python programs into FHE equivalent,” open-source FHE framework, available online: https://github.com/zama-ai/concrete, 2022.

16

hours. The risk assessment was formulated as a linear regression problem executed entirely within the FHE domain via Concrete ML. This specific linear formulation was deliberately chosen to satisfy the algebraic constraints of the decoupled HomMAC execution integrity protocol established in Section 5.3. 7.1

Computational Overhead

quantization and secure compilation to the underlying parameters. This cryptographic approach prevents the circuit evaluator (e.g., the TSP) from reconstructing the model’s proprietary architecture or exact weights. Specifically, the critical quantization scale factors and zero-point parameters remain strictly private to the model owner, preserving the confidentiality of the insurer’s model weights during domainspecific evaluations.

The computational complexity imposed by the cryptographic operations executed at the OBU is systematically evaluated. Recognizing that the OBU performs both lattice-based FHE encryption and elliptic-curve-based group signatures, the TFHE lattice parameters were maintained constant (yielding fixed encryption times), while the signature generation was evaluated across various elliptic curve configurations. The resulting execution timings are summarized in Table 5. TABLE 5 Computational Overhead Evaluation at the OBU Elliptic Curve Configuration SS512 SS1024 MNT159 MNT201 MNT224

(d)

tEnc (Jvsen Kpk SV ) (ms)

2.38

tEnc (JP (d) Kpk Ins ) (ms)

tGroupSign (ms)

tOBU Total (ms)

7.14

16.087 198.460 29.728 39.181 48.086

25.607 207.980 39.248 48.701 57.606

The computational overhead incurred at the infrastructure layers is evaluated to ascertain the real-time feasibility of the protocol. As illustrated in Fig. 2, the execution time for the RSU involves a single, mixed-domain homomorphic subtraction circuit for speed verification, whereas the TSP’s processing time for the baseline risk factor calculation accounts for 5 homomorphic multiplications and 4 homomorphic additions.

Fig. 3. Computational overhead of FHE-based machine learning models for TSP risk factor calculation.

The end-to-end evaluation of the protocol is illustrated in Fig. 4. The performance of the risk factor computation circuit is evaluated using both the conventional FHE-based approach and the TFHE-based linear machine learning models at the TSP.

Fig. 4. Total end-to-end execution time comparison.

Fig. 2. Computational overhead of infrastructure components (RSU and TSP).

Fig. 3 illustrates the computational overhead associated with integrating various linear regression algorithms (including standard linear regression, Ridge, Lasso, and ElasticNet) within the FHE framework. While in a standard FHE circuit implemented via Concrete, model coefficients are explicitly encrypted as ciphertexts, learning-based risk assessment frameworks compiled through Concrete ML apply optimized

In the comparative evaluation, the proposed SP2UBI scheme utilizes the TFHE framework, whereas the PRIDE scheme [11] relies on a matrix decomposition and multiplication encryption technique. PRIDE compromises end-to-end data privacy because the intermediate comparison outcomes (e.g., boolean values indicating speeding or acceleration thresholds) are directly revealed in plaintext within the smart contract execution environment. This fundamental cryptographic leakage exposes the chronological distribution of a driver’s traffic violations to all consensus nodes. In contrast, SP2UBI ensures data confidentiality throughout all processing phases without exposing intermediate states,

17

while remaining computationally efficient and suitable for deployment in real-world scenarios.

7.2

Communication and Storage Overhead

Modern commercial OBUs, such as those manufactured by Cohda Wireless, typically feature at least 8 GB of internal storage. Consequently, the 4.888 MB storage overhead required by the proposed scheme over a 30-day epoch occupies 0.059% of the available capacity, demonstrating its efficiency and practicality for continuous deployments. TABLE 6 Storage Overhead at the OBU over a 30-Day Epoch S(JPK) (MB) 4.758

S(Jvsen K) (MB) 0.130

STotal Veh (MB) 4.888

The communication overhead for transmitting the daily payload between the OBU and the RSU is detailed in Table 7, while the subsequent overhead for forwarding the evaluated batch between the RSU and the TSP is presented in Table 8. In addition, the communication overhead between the TSP and the insurer is illustrated in Fig. 5. These empirical results demonstrate that SP2UBI maintains a low communication footprint, rendering it scalable and optimized for ITS. TABLE 7 Communication Overhead from OBU to RSU Size(JP (d) K) 162.42 KB

(d)

Size(Jvsen K) 4.45 KB

Size(σ (d) ) 1.1 KB

Size(ID Ins ) 0.02 KB

Size(C (d) ) 167.99 KB

TABLE 8 Communication Overhead from RSU to TSP (d)

Size(RSV ) 4.45 KB

Size(C (d) ) 167.99 KB

(d)

Size(RSU M ) 172.44 KB

Fig. 5. Communication overhead between the TSP and the Insurer.

8

C ONCLUSION

In this paper, SP2UBI, a framework that performs verifiable risk assessments over homomorphically encrypted data, was proposed. By preventing the disclosure of raw driving metrics, the protocol mitigates the exposure of sensitive spatiotemporal trajectories. In addition, by compiling the insurer’s risk evaluation algorithms into equivalent TFHE circuits, the framework maintains the confidentiality of the model weights and internal parameters from intermediate edge evaluators. The protocol also integrates a decoupled HomMAC architecture to verify mathematical execution integrity, while incorporating an ISAC-assisted speed validation mechanism to counter physical-layer sensor spoofing and resolve data-association ambiguities. Formal security and privacy evaluations, structured across sequential mathematical proofs, demonstrate that the architecture satisfies day-to-day unlinkability, k -anonymity against eavesdroppers, semantic security (IND -CPA), and source location obfuscation. Empirical performance evaluations show that these theoretical properties can be achieved with practical overheads tailored for vehicular networks. Specifically, the total on-board storage requirement over a 30-day billing epoch occupies less than 4.9 MB, and the computational and communication footprints remain compatible with the real-time operational capacities of standard vehicular and roadside infrastructure. Future research will focus on extending this framework toward a privacypreserving driver behavior management model for real-time safety monitoring.

R EFERENCES [1]

H. Qi, Z. Wan, Z. Guan, and X. Cheng, “Scalable decentralized privacy-preserving usage-based insurance for vehicles,” IEEE Internet of Things Journal, vol. 8, pp. 4472–4484, 2021. [2] A. Dutta, L. M. S. Campoverde, M. Tropea, and F. D. Rango, “A comprehensive review of recent developments in vanet for traffic, safety & remote monitoring applications,” Journal of Network and Systems Management, vol. 32, 2024. [3] S. Arumugam and R. Bhargavi, “A survey on driving behavior analysis in usage based insurance using big data,” Journal of Big Data, vol. 6, 2019. [4] M. E. Soleymanian, C. B. Weinberg, and T. Zhu, “Sensor data and behavioral tracking: Does usage-based auto insurance benefit drivers?” Mark. Sci., vol. 38, pp. 21–43, 2019. [5] J. Peng, N. Liu, H. Zhao, and M. Yu, “Usage-based insurance system based on carrier-cloud-client,” 2015 10th International Conference on Communications and Networking in China (ChinaCom), pp. 579–584, 2015. [6] P. K. Singh, R. Singh, G. Muchahary, M. Lahon, and S. Nandi, “A blockchain-based approach for usage based insurance and incentive in its,” TENCON 2019 - 2019 IEEE Region 10 Conference (TENCON), pp. 1202–1207, 2019. [7] P. Händel, J. Ohlsson, M. Ohlsson, I. Skog, and E. Nygren, “Smartphone-based measurement systems for road vehicle traffic monitoring and usage-based insurance,” IEEE Systems Journal, vol. 8, pp. 1238–1248, 2014. [8] Allied Market Research, “Usage-based insurance market,” 2023, [Online]. Available: https://www.alliedmarketresearch.com/ usage-based-insurance-market. Accessed: Dec. 13, 2023. [9] O. Ben-Shahar, “Privacy protection, at what cost? exploring the regulatory resistance to data technology in auto insurance,” Journal of Legal Analysis, 2023. [10] J. Quintero and A. Railean, “Users’ privacy concerns and attitudes towards usage-based insurance: An empirical approach,” in International Conference on Vehicle Technology and Intelligent Transport Systems, 2022.

18

[11] Z. Wan, Z. Guan, and X. Cheng, “Pride: A private and decentralized usage-based insurance using blockchain,” 2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData), pp. 1349– 1354, 2018. [12] X. Gao, B. Firner, S. Sugrim, V. Kaiser-Pendergrast, Y. Yang, and J. Lindqvist, “Elastic pathing: Your speed is enough to track you,” in Proceedings of the 2014 ACM international joint conference on pervasive and ubiquitous computing, 2014, pp. 975–986. [13] L. Zhou, Q. Chen, Z. Luo, H. Zhu, and C. Chen, “Speed-based location tracking in usage-based automotive insurance,” 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), pp. 2252–2257, 2017. [14] A. Sarker, H. Shen, C. Qiu, H. Uehara, and K. Zhang, “Brake-signalbased driver’s location tracking in usage-based auto insurance programs,” IEEE Internet of Things Journal, vol. 10, pp. 10 172–10 189, 2023. [15] C. Gentry, “Fully homomorphic encryption using ideal lattices,” in Symposium on the Theory of Computing, 2009. [16] I. Chillotti, N. Gama, M. Georgieva, and M. Izabachène, “Tfhe: Fast fully homomorphic encryption over the torus,” Journal of Cryptology, vol. 33, pp. 34 – 91, 2019. [17] R. L. Rivest, A. Shamir, and L. M. Adleman, “A method for obtaining digital signatures and public-key cryptosystems,” Commun. ACM, vol. 21, pp. 120–126, 1978. [18] P. Paillier, “Public-key cryptosystems based on composite degree residuosity classes,” in International Conference on the Theory and Application of Cryptographic Techniques, 1999. [19] J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in International Conference on the Theory and Application of Cryptology and Information Security, 2017. [20] M. Taubert, A. Skuta, and T. Lorünser, “A pragmatic comparison of cryptographic computation technologies for machine learning,” in International Conference on Information Systems Security and Privacy, 2026. [21] I. Chillotti, M. Joye, and P. Paillier, “Programmable bootstrapping enables efficient homomorphic inference of deep neural networks,” IACR Cryptol. ePrint Arch., vol. 2021, p. 91, 2021. [22] D. Chaum and E. van Heyst, “Group signatures,” in International Conference on the Theory and Application of Cryptographic Techniques, 1991. [23] L. Zhang, J. Li, and Y. Yang, “Message linkable group signature with information binding and efficient revocation for privacy- preserving announcement in vanets,” IEEE Transactions on Dependable and Secure Computing, vol. 21, pp. 5667–5680, 2024. [24] M. Bellare, D. Micciancio, and B. Warinschi, “Foundations of group signatures: Formal definitions, simplified requirements, and a construction based on general assumptions,” in International Conference on the Theory and Application of Cryptographic Techniques, 2003. [25] D. Boneh, X. Boyen, and H. Shacham, “Short group signatures,” in Annual International Cryptology Conference, 2004. [26] C. Troncoso, G. Danezis, E. Kosta, J. Balasch, and B. Preneel, “Pripayd: Privacy-friendly pay-as-you-drive insurance,” IEEE Transactions on Dependable and Secure Computing, vol. 8, pp. 742–755, 2007. [27] R. A. Popa, H. Balakrishnan, and A. J. Blumberg, “Vpriv: Protecting privacy in location-based vehicular services,” in USENIX Security Symposium, 2009. [28] K. Fu and W. Xu, “Risks of trusting the physics of sensors,” Communications of the ACM, vol. 61, pp. 20 – 23, 2018. [29] B. L. Sahu, P. Chandrakar, S. Kumari, C.-M. Chen, and M. Amoon, “Blockchain and machine learning integrated secure driver behavior centric electric vehicle insurance model,” IEEE Transactions on Intelligent Transportation Systems, vol. 25, pp. 19 073–19 087, 2024. [30] C. Huang, W. Wang, D. Liu, R. Lu, and X. S. Shen, “Blockchainassisted personalized car insurance with privacy preservation and fraud resistance,” IEEE Transactions on Vehicular Technology, vol. 72, pp. 3777–3792, 2023. [31] L. Yi, Y. Sun, B. Wang, L. Duan, H. Ma, B. Wang, Z. Han, and W. Wang, “Ccubi: A cross-chain based premium competition scheme with privacy preservation for usage-based insurance,” International Journal of Intelligent Systems, vol. 37, pp. 11 522 – 11 546, 2022.

[32] L. Zhou, S. Du, H. Zhu, C. Chen, K. Ota, and M. Dong, “Location privacy in usage-based automotive insurance: Attacks and countermeasures,” IEEE Transactions on Information Forensics and Security, vol. 14, pp. 196–211, 2019. [33] Z. Liu, Q. Shen, and J. Ma, “A driving behavior model evaluation for ubi,” Int. J. Crowd Sci., vol. 1, pp. 223–236, 2017. [34] F. Liu, Y. Cui, C. Masouros, J. Xu, T. X. Han, Y. C. Eldar, and S. Buzzi, “Integrated sensing and communications: Toward dual-functional wireless networks for 6g and beyond,” IEEE Journal on Selected Areas in Communications, vol. 40, pp. 1728–1767, 2021. [35] S. M. Patole, M. Torlak, D. Wang, and M. Ali, “Automotive radars: A review of signal processing techniques,” IEEE Signal Processing Magazine, vol. 34, pp. 22–35, 2017. [36] I. Wagner and D. Eckhoff, “Technical privacy metrics: A systematic survey,” ACM Computing Surveys (CSUR), vol. 51, no. 3, pp. 57:1– 57:38, 2018. [37] B. So, J. P. Boucher, and E. A. Valdez, “Synthetic dataset generation of driver telematics,” ArXiv, vol. abs/2102.00252, 2021.