###### Abstract  
With the development of vehicular ad-hoc networks (VANETs) and Internet of vehicles (IoVs), a large amount of useful information is generated for vehicle drivers and traffic management systems. The amount of vehicle and traffic information is as large as the number of vehicles and it is enormous when compared to vehicle calculation and storage performance. To resolve this problem, VANET uses a combined cloud computing technology, called vehicular cloud computing (VCC), which controls vehicle-related data, and helps vehicle drivers directly or indirectly. However, VANETs remain vulnerable to attacks such as tracking, masquerade and man-in-the-middle attacks because VANETs communicate via open networks. To overcome these issues, many researchers have proposed secure authentication protocols for message confirmation with vehicular cloud computing. However, many researchers have pointed out that some proposed protocols use ideal tamper-proof devices (TPDs). They demonstrated that realistic TPDs cannot prevent adversaries attack. [PERSON] et al. presented a message confirmation scheme for vehicular cloud computing using a realistic TPD in order to prevent these problems. However, their proposed scheme still has security weaknesses over a TPD and does not guarantee mutual authentication. This paper proposes a secure key agreement and authentication protocol to address the security weaknesses inherent in the protocol of [PERSON] et al. The suggested protocol withstands malicious attacks and ensures secure mutual authentication for privacy-preserving. We prove that the proposed protocol can provide session key security using Real-Or-Random (ROR) model. We also employed Automated Validation of Internet Security Protocols and Applications (AVISPA) simulation tool to show that the proposed protocol is able to defeat replay and man-in-the-middle attacks. Furthermore, we established that the proposed protocol can resist other malicious attacks by conducting the informal security analysis. We proved that our proposed protocol is lightweight and suitable for VCC environments. VANET; vehicular cloud computing; message confirmation; cryptanalysis; mutual authentication; AVISPA; ROR model +
Footnote †: journal: Applied  
0000-0001-5000-0000-0000-0000-00000-0000-00000-0000-00000-0000-00000-00000-00000-00000-00000-00000-00000-00000-00000-00000-00000-00000-000000-00000-00000-00  
computing power and extending the storage space of the embedded devices is not technically possible or financially viable. Vehicular cloud computing (VCC) has been suggested to address these limitations of embedded devices. VCC is a system that controls vehicle-related data. IoVs send traffic information to the vehicular cloud. Subsequently, other vehicles can obtain information from the vehicular cloud when required. However, this information is transmitted through open and unsecured channels; therefore, malicious attackers can threaten the VCC environment. When malicious attackers steal and manipulate traffic information, the lives of pedestrians, and drivers are endangered. Therefore, VCC should provide a key agreement with secure authentication that protects the information by providing message confirmations. Therefore, many studies have been suggested for VCC to provide a secure authentication. Recently, proposed schemes are used for ideal tamper-proof devices (TPDs). The TPD is safe from malicious attacks and it is impossible to tamper with it, according to the proposed schemes. However, the ideal TPD has a strong assumption that an attacker cannot obtain or tamper with values in the TPD according to [1; 2; 3; 4]. They pointed out that attackers can obtain stored values in the realistic TPD through power analysis attacks and side-channel attacks. In 2019, [PERSON] et al. [4] presented a message confirmation scheme based batch verification, and a VCC environment to address OBU computation limitations. They proposed secure authentication to address an issue, where realistic TPD cannot prevent side channel and power analysis attacks.