## 6 Security Analysis
### ROR Model
Because \(GM_{0}\) and protocol are identical, we get, \[Adv_{P}=|2\cdot Pr[Succ_{0}]-1|.\] (1)
* **Game \(GM_{1}\)**: under this game, \(\mathcal{A}\) performs the eavesdropping attack to all transmitted messages during key generation and message confirmation process of the proposed protocol using the \(Execute\) query. At the end of the this game, \(\mathcal{A}\) makes \(Reveal\) and \(Test\) queries. The output of the \(Reveal\) and \(Test\) queries decide if \(\mathcal{A}\) obtains the derived session key \(SK\) between \(v_{i}\) and \(RSU_{j}\) or a random number. In our proposed protocol, \(v_{i}\) and \(RSU_{j}\) computes the session key as \(SK=h(r_{i}||r_{j})\). To derive \(SK\), \(\mathcal{A}\) needs the short-term (temporal) secrets (\(r_{i}\) and \(r_{j}\)), which are unknown to \(\mathcal{A}\). However, the transmitted messages are not helpful to increase winning probability. As both the game \(GM_{0}\) and \(GM_{1}\) are indistinguishable, we can get \[Pr[Succ_{1}]=Pr[Succ_{0}].\] (2)
* **Game \(GM_{2}\)**: this game is modeled as an active attack which includes the simulation of \(Hash\) and \(Send\) queries. In proposed protocol, all of the messages are protected by the collision-resistant one-way hash function except \(M_{1},B_{j},C_{i}\) and \(D_{i}\). However, random numbers are used in values \(M_{1},B_{j},C_{i}\) and \(D_{i}\). Furthermore, deriving \(r_{i}\) from the intercepted \(Auth_{1}\), \(C_{i}\), and \(M_{1}\), and also \(r_{j}\) from intercepted \(B_{i}\), \(Auth_{2}\), \(D_{i}\), and \(Auth_{4}\) are computationally infeasible task because of collision-resistant property of the hash function. Therefore, no collision occurs when \(\mathcal{A}\) executes \(Hash\) query. Using the birthday paradox results, we can have, \[|Pr[Succ_{2}]-Pr[Succ_{1}]|\leq\frac{q_{h}^{2}}{2|Hash|}.\] (3)
* **Game \(GM_{3}\)**: this is the final game that executes the \(CorruptOBU\) query by \(\mathcal{A}\). \(\mathcal{A}\) can extract all the information \(\{A_{i},V_{i},AE_{i},BE_{i},VS_{i}\}\) from the OBU of \(v_{i}\). Note that \(HPW_{i}=h(HID_{i}||PW_{i})\), \(AE_{i}=h(ID_{i}||PE_{i})\oplus a_{i}\), \(PE_{i}=h(PW_{i}||b_{i})\), \(BE_{i}=b_{i}\oplus h(ID_{i}||PW_{i})\), and \(VS_{i}=h(HID_{i}||MV_{i}||s_{i})\). To derive the secrets \(s_{i}\), \(a_{i}\), and \(b_{i}\) from \(A_{i}\), \(VI_{i}\), \(BE_{i}\), and \(AE_{i}\), \(\mathcal{A}\) needs unknown \(ID_{i}\) and \(PW_{i}\). Without having secret credentials \(b_{i}\), \(ID_{i}\), and \(PW_{i}\) of \(v_{i}\), it is a computationally difficult problem for \(\mathcal{A}\) to guess password \(PW_{i}\) of \(v_{i}\) correctly using the \(Send\) queries. Because \(GM_{2}\) and \(GM_{3}\) are identical when password guessing attack is absent. Therefore, using the [PERSON]'s law on passwords, we obtain \[|Pr[Succ_{3}]-Pr[Succ_{2}]|\leq C^{{}^{\prime}}\cdot q_{Send}^{s^{{}^{\prime}}}.\] (4) All of the games are executed; therefore, \(\mathcal{A}\) needs to guess the correct bit \(c\). Therefore, we have \[Pr[Succ_{3}]=\frac{1}{2}.\] (5) Equations (1) and (2) give the following result: \[\frac{1}{2}Adv_{P} =|Pr[Succ_{0}]-\frac{1}{2}|\] \[=|Pr[Succ_{1}]-\frac{1}{2}|.\] (6) Again, Equations (5) and (6) give the following result: \[\frac{1}{2}Adv_{P} =|Pr[Succ_{1}]-Pr[Succ_{3}]|.\] (7)We obtain the following equation using the triangular inequality and Equations (3) and (4):  
\[\frac{1}{2}Adv_{P} =|Pr[Succ_{1}]-Pr[Succ_{3}]|\] \[Adv_{P}=|2\cdot Pr[Succ_{0}]-1|.\]0 \[Adv_{P}=|2\cdot Pr[Succ_{0}]-1|.\]1  
At last, we obtain the required result by multiplying both sides of Equation (8) by a factor of 2:  
\[Adv_{P}=|2\cdot Pr[Succ_{0}]-1|.\]2  
Therefore, the Theorem 1 is proved.