# An ECC-Based Anonymous and Fast Handover Authentication Protocol for Internet of Vehicles
## 4 Proposed Protocol
### The Initial Authentication Between Vehicles and RSUs and the Generation of Cryptographic Keys  
The initial authentication between the vehicles and the RSUs and the generation process of the cryptographic keys are shown in Table 5. During this phase, \(V_{i}\) and \(RSU_{j}\) perform initial authentication to establish a session key \(SK_{ij}\), laying the foundation for subsequent re-authentication. After completing initial authentication, a vehicle-specific secret parameter \(\{PID_{i},ID_{V_{i}},C,TTL\}\) is shared with a legitimate \(RSU\) through time tree technology. When the vehicle enters the jurisdiction of another \(RSU\), handover authentication is conducted between the vehicle and the new \(RSU\), thereby reducing authentication overhead and enhancing efficiency. 1. \(V_{i}\) randomly selects a partial private key \(r_{1}\in\mathbb{Z}_{p}^{*}\), computes \(R_{1}=r_{1}\cdot P\), and uses the local \(RSU_{i}\)'s \(ID_{RSU_{j}}\) along with \(P_{RSU_{j}}=\{X_{r},Y_{r}\}\) to derive \(D_{r}=X_{r}+Y_{r}+P_{Pub}\cdot h\left(ID_{RSU_{j}}||X_{r}||Y_{r}\right)\), pseudonymous identifier \(PID_{i}=ID_{V_{i}}\oplus h(r_{1}\cdot D_{r})\) and verification parameter \(V_{v}=r_{1}+d_{V_{i}}\cdot h(R_{1}||PID_{i}||T_{1})\). Subsequently, \(V_{i}\) obtains the current timestamp \(T_{1}\) and transmits the message \(\{PID_{i},R_{1},V_{v},T_{1}\}\) to the \(RSU_{j}\). 2. Upon receiving the message, the \(RSU_{j}\) first verifies the freshness of \(T_{1}\) through a condition check \(|T_{1}-T_{c}|<\Delta T\). If this condition is violated (indicating \(T_{1}\) staleness), the \(RSU_{j}\) terminates the current session. Otherwise, the \(RSU_{j}\) retrieves the \(V_{i}^{\prime}\)'s true identity \(ID_{V_{i}}^{*}=PID_{i}\oplus h(R_{1}\cdot d_{RSU_{i}})\), sets \(C=h(ID_{V_{i}}^{*}||X_{v}||Y_{v})\), computes the \(V_{i}\)'s \(D_{v}=X_{v}+Y_{v}+P_{Pub}\cdot C\), and validates the message's legitimacy and integrity via the verification equation \(V_{v}\cdot P=R_{1}+D_{v}\cdot h(R_{1}||PID_{i}||T_{1})\). If the equation holds, the \(RSU_{j}\) proceeds with the following steps: The \(RSU_{j}\) generates a random number \(r_{2}\in\mathbb{Z}_{p}^{*}\), computes \(R_{2}=r_{2}\cdot P\) and \(R_{ij}=R_{1}\cdot r_{2}\), establishes the session key \(SK_{ij}=h(R_{ij}||C)\), updates the pseudonymous identifier \(PID_{i}^{+}=h(d_{RSU_{j}}||ID_{V_{i}}^{*}||C||T_{4})\) to prevent tracking, and encrypts it as \(H_{1}=PID_{i}^{+}\oplus h(r_{2}\cdot D_{v})\). Subsequently, the \(RSU_{j}\) generates \(V_{r}=r_{2}+d_{RSU_{i}}\cdot h(R_{2}||H_{1}||T_{2})\) and transmits \(\{ID_{RSU_{j}},R_{2},H_{1},V_{r},T_{2}\}\) to the \(V_{i}\). Finally, the \(RSU\) stores \(\{PID_{i},ID_{V_{i}},C,TTL\}\) in its memory. After updating, the default PID\({}_{i}=\) PID\({}_{i}^{+}\) is set. Here, \(TTL\) is a configured threshold representing the maximum number of messages allowed to pass through the \(RSU_{j}\) before being discarded. If TTL \(\leq\) 0, the \(V_{i}\) must re-register. 3. Upon receiving a message from the \(RSU_{j}\), \(V_{i}\) first verifies the \(T_{2}\)'s freshness, then validates the equation \(V_{r}\cdot P=R_{2}+D_{r}\cdot h(R_{2}||H_{1}||T_{2})\). If the equation holds, \(V_{i}\) computes \(R_{ij}=r_{1}\cdot R_{2}\), recovers the pseudonymous identifier \(PID_{i}^{+}=H_{1}\oplus h(R_{2}\cdot d_{V_{i}})\), and generates the session key \(SK_{ij}=h(R_{ij}||C)\); otherwise, the \(V_{i}\) resends the authentication request. Finally, \(V_{i}\) replaces parameter \(PID_{i}\) with \(PID_{i}^{+}\) and stores the updated value in its memory. \begin{table}
\begin{tabular}{c c} \hline \hline
**Notation** & **Description** \\ \hline Randomly choose \(r_{1}\) & \\ Compute \(R_{1}=r_{1}\cdot P\) & \\ \(D_{r}=X_{r}+Y_{r}+P_{Pub}\cdot h\left(ID_{RSU_{j}}||X_{r}||Y_{r}\right)\) & \\ \(PID_{i}=ID_{V_{i}}\oplus h(r_{1}\cdot D_{r})\) & \\ \(V_{v}=r_{1}+d_{V_{i}}\cdot h(R_{1}||PID_{i}||T_{1})\) & \\ send \(\{PID_{i},R_{1},V_{v},T_{1}\}\) & \\ \hline \multicolumn{2}{c}{(via open channel)} \\ \hline \hline \end{tabular}
\end{table}