## 6 Proposed Scheme
### User Login and Authentication  
Firstly, User \(VU\) inserts the SC into OBU of vehicle and inputs the \(ID_{v}^{*}\), \(PW_{v}^{*}\), and biometric information \(BIO_{v}^{*}\). The SC extracts \(BSK_{v}^{*}=Rep\big{(}BIO_{v}^{*},\epsilon_{v}\big{)}\) and checks whether \(C_{v}=h\Big{(}ID_{v}^{*},PW_{v}^{*},BSK_{v}^{*}\Big{)}mod\)\(n\) or not, where \(n\in\big{(}2^{4},2^{8}\big{)}\). If not, SC terminates login process. Otherwise, SC computes \(PID_{v}^{*}=PPID_{v}\bigoplus h\Big{(}PW_{v}^{*},ID_{v}^{*},BSK_{v}^{*}\Big{)}\), \(A_{v}^{*}=PA_{v}\bigoplus h\Big{(}PW_{v}^{*},BSK_{v}^{*},ID_{v}^{*}\Big{)}\), and performs the authentication process. Figure 2 describes this process.  
Step 1. OBU \(\rightarrow\) RSU: \(\{CID_{v},DID_{v},M_{1},R_{0},t_{0}\}\)  
Figure 2: User authentication phase of the proposed scheme.  
The OBU chooses a random number \(r\), \(d\) and computes \(R_{0}=r\cdot P\), \(R_{1}=r\cdot P_{pub}\), computes the dynamic identity \(DID_{v}=PID_{v}^{*}\bigoplus h(R_{1}\|t_{0})\), \(CID_{v}=d\bigoplus h(t_{0}\|R_{1})\), \(M_{1}=h\Big{(}d,ID_{v}^{*},PID_{v}^{*},DID_{v},A_{v}^{*},t_{0},ID_{r}\Big{)}\), where \(t_{0}\) is timestamp. Then, OBU sends \(\{CID_{v},DID_{v},M_{1},R_{0},t_{0}\}\) to RSU on the public channel.  
Step 2. RSU \(\rightarrow\) TA: \(\{ID_{r},DID_{v},AID_{v},M_{1},t_{0},t_{1}\}\)  
While receiving the message from OBU, the RSU firstly checks the freshness of \(t_{0}\). If the \(t_{0}\) is fresh, the authentication continues; otherwise, RSU drops the message. The RSU computes \(R_{r}=PUF(C_{r})\) and recovers private key \(x_{r}=sk_{r}\oplus h(R_{r}\|t_{r})\) and \(PSID_{r}=PD_{r}\oplus h(t_{r}\|R_{r})\). The RSU calculates \(R_{1}=x_{r}\cdot R_{0}\), \(PID_{v}^{*}=DID_{v}\bigoplus h(R_{1}\|t_{0})\), \(d=CID_{v}\bigoplus h(t_{0}\|R_{1})\). The RSU computes \(AID_{v}=h(t_{1}\|DID_{v}\|PSID_{r})\bigoplus\left(PID_{v}^{*}\|d\right)\), where \(t_{1}\) is timestamp. Now, the RSU sends the message \(\{ID_{r},DID_{v},AID_{v},M_{1},t_{0},t_{1}\}\) to the TA.  
Step 3. TA \(\rightarrow\) RSU: \(\{BID_{v},t_{2}\}\)  
After TA receives the message from RSU, it first checks the freshness of \(t_{1}\). Then, TA computes \(PSID_{r}=h(ID_{r}\|K)\), \(PID_{v}^{*}\|d=h(t_{1}\|DID_{v}\|PSID_{r})\bigoplus AID_{v}\), and uses system key \(K\) to decrypt \(PID_{v}^{*}\), and obtains \(\big{(}ID_{v}\parallel y_{v}\parallel t_{v}\big{)}=D_{K}\big{[}PID_{v}^{*} \big{]}\) and computes \(A_{v}^{*}=h(ID_{v}\|K)\). TA verifies whether \(M_{1}=h\Big{(}d,ID_{v},PID_{v}^{*},DID_{v},A_{v}^{*},t_{0},ID_{r}\Big{)}\) is right or not. If yes, TA computes \(BID_{v}=h\Big{(}PID_{v}^{*}\|PSID_{r}\|t_{2}\Big{)}\), where \(t_{2}\) is timestamp. After that, TA sends \(\{BID_{v},t_{2}\}\) to RSU.  
Step 4. RSU \(\rightarrow\) OBU: \(\{M_{2},R_{2},t_{3}\}\)  
While receiving the message from TA, RSU checks the freshness of \(t_{2}\) and verifies whether \(BID_{v}=h\Big{(}PID_{v}^{*}\|PSID_{r}\|t_{2}\Big{)}\) is right or not. If the equation holds, RSU chooses a random number \(s\) and computes \(R_{2}=s\cdot P\), \(SK=h\Big{(}d,R_{0},R_{2},(s\cdot R_{0}),PID_{v}^{*},ID_{r}\Big{)}\), \(M_{2}=h(SK,t_{3},t_{0})\), where \(t_{3}\) is the timestamp. The RSU sends the message \(\{M_{2},R_{2},t_{3}\}\) to OBU.  
Step 5. After receiving the message from RSU, OBU checks the freshness of \(t_{3}\), and computes \(SK=h\Big{(}d,R_{0},R_{2},(r\cdot R_{2}),PID_{v}^{*},ID_{r}\Big{)}\), and verifies whether \(M_{2}=h(SK,t_{3},t_{0})\) is right or not. If yes, OBU and RSU share the session key \(SK\).  
**Remark 6**.: _The purpose of using the Diffie-Hellman value when generating a session key is to achieve perfect forward secrecy._