## Security Analysis
### Informal Security Analysis
Even if the attacker \(\mathcal{A}\) eavesdrops and obtains these messages, \(\mathcal{A}\) cannot verify the guessed identity. Because these messages not only contain identity but also include random numbers, the passwords and biometric keys, such as \(M_{1}=h\Big{(}d,ID_{v}^{*},PID_{v}^{*},DID_{v},A_{v}^{*},t_{0},ID_{r}\Big{)}\) (\(d\) is random number), \(DID_{v}=PID_{v}^{*}\bigoplus h(R_{1}\|t_{0})\), \(PID_{v}^{*}=PPID_{v}\bigoplus h\Big{(}PW_{v}^{*},ID_{v}^{*},BSK_{v}^{*}\Big{)}\), \(A_{v}^{*}=PA_{v}\bigoplus h\Big{(}PW_{v}^{*},BSK_{v}^{*},ID_{v}^{*}\Big{)}\), \(PW_{v}^{*}\) is the password and \(BSK_{v}^{*}\) is the biometric key. Thus, \(\mathcal{A}\) is unable to verify the accuracy of the guessed identity without having knowledge of \(PID_{v}^{*}\), \(PW_{v}^{*}\), and \(BSK_{v}^{*}\). * Forgery attacks and impersonation attacks: Suppose the attacker \(\mathcal{A}\) impersonates user U\({}_{i}\) and sends message \(\{CID_{v},DID_{v},M_{1},R_{0},t_{0}\}\) to RSU, where \(R_{0}=r\cdot P,\,DID_{v}=PID_{v}^{*}\bigoplus h(R_{1}\|t_{0})\), \(R_{1}=r\cdot P_{pub}\), \(M_{1}=h\Big{(}d,ID_{v}^{*},PID_{v}^{*},DID_{v},A_{v}^{*},t_{0},ID_{r}\Big{)}\), \(PID_{v}^{*}=PPID_{v}\bigoplus h\Big{(}PW_{v}^{*},ID_{v}^{*},BSK_{v}^{*}\Big{)}\), \(A_{v}^{*}=PA_{v}\bigoplus h\Big{(}PW_{v}^{*},BSK_{v}^{*},ID_{v}^{*}\Big{)}\). \(\mathcal{A}\) cannot forg M\({}_{1}\) without knowing \(ID_{v}^{*}\), \(PID_{v}^{*}\) and \(A_{v}^{*}\). If the attacker wants to know \(A_{v}^{*}\), they must know the three-factor \(ID_{v}^{*}\), password \(PW_{v}^{*}\), and biometric key \(BSK_{v}^{*}\) at the same time, which is obviously impossible. Therefore, \(\mathcal{A}\) cannot impersonate the user. Suppose the attacker \(\mathcal{A}\) wants to impersonate RSU and sends \(\{ID_{r},DID_{v},AID_{v},M_{1},t_{0},t_{1}\}\) to TA, where \(AID_{v}=h(t_{1}\|DID_{v}\|PSID_{r})\bigoplus\Big{(}PID_{v}^{*}\|d\Big{)}\), \(PSID_{r}=PD_{r}\oplus h(t_{r}\|R_{r})\), \(R=PUF(C_{r})\). Since the PUF is unique, even if the attacker \(\mathcal{A}\) obtains Challenger C\({}_{r}\), they cannot obtain \(R_{r}\) and cannot compute the \(PSID_{r}\). Thus, the attacker cannot impersonate the RSU without knowing \(PSID_{r}\). Supposed the attacker \(\mathcal{A}\) wants to impersonate [PERSON] and sends \(\{BID_{v},t_{2}\}\), where \(BID_{v}=h\Big{(}PID_{v}^{*}\|PSID_{r}\|t_{2}\Big{)}\), \(PSID_{r}=(ID_{r}\|K)\), \(K\) is the system's primary key. Since \(\mathcal{A}\) cannot know \(K\), \(\mathcal{A}\) cannot impersonate [PERSON]. Hence, our scheme effectively mitigates the risks of forgery attacks and impersonation attacks. * RSU captured attacks: In our scheme, RSU stores \(<C_{r},sk_{r},ID_{r},PD_{r},t_{r}>\), where \(C_{r}\) is the corresponding challenge to generate a response of PUF. Suppose the attacker \(\mathcal{A}\) captures the RSU and obtains the date \(<C_{r},sk_{r},ID_{r},PD_{r},t_{r}>\). Due to the characteristics of PUF, \(\mathcal{A}\) cannot obtain the corresponding \(R_{r}\) and cannot compute private key \(x_{r}=sk_{r}\oplus h(R_{r}\|t_{r})\) and shared key \(PSID_{r}=PD_{r}\oplus h(t_{r}\|R_{r})\). In simpler terms, capturing an RSU will yield no valuable information. Therefore, our protocol effectively withstands RSU capture attacks.