# An Enhanced Privacy-Preserving Authentication Scheme for Vehicle Sensor Networks
## 6 Analysis
### Security Analysis
#### 6.2.1 The Formal Security Analysis
Finally, let \(A\) represent an adversary attacking the semantic security of the secure communication protocol with time-complexity at most \(t\) by issuing \(q_{send}\) Send queries, \(q_{exe}\) Execute queries and \(q_{h}\) Hash queries. Then, we have:_  
\[Adv_{GAP,D}(A)\leq\frac{q_{h}^{2}}{|Hash|}+\frac{2q_{send}}{|D|}.\]3 \[Adv_{GAP,D}(A)\leq\frac{q_{h}^{2}}{|Hash|}+\frac{2q_{send}}{|D|}.\]4 \begin{table}
\begin{tabular}{l} \hline \hline A hash query \(h(m)\) (resp.\(h^{\prime}\)) that matches a record \((m,r^{\prime})\) in the list \(\Lambda_{h}\) (resp.\(\Lambda_{h^{\prime}}\)), returns \(r^{\prime}\). \\ Otherwise, it chooses a random number \(r\), adds the record \((m,r)\) to the list \(\Lambda_{h}\) (resp.\(\Lambda_{h^{\prime}}\)), and returns \(r\). \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Simulation of random oracles \(h\) and \(h^{\prime}\). _where \(t_{p}\) denotes the time required to produce a point._  
Proof of Theorem 2.: To complete the proof, six experiments are constructed, where the first one simulates a real attack. For every experiment \(Exp_{n}\), we use \(Succ_{n}\) to denote the event in which the adversary successfully guesses the bit \(b\) from the _Test_ query. **Experiment \(Exp_{0}\)**. This experiment simulates an actual attack, which begins with the random selection of a secure key \(PSK\). According to definition, we have  
\[Adv_{SCP,D}(A)=2 Pr[Succ_{0}]-1. \tag{6}\]  
**Experiment \(Exp_{1}\)**. In this experiment, the oracles \(Execute\), \(Send\), \(Corrupt\), \(Reveal\), and \(Test\), as in the actual attack with a chosen random secure key \(PSK\) are simulated. It can be seen that one cannot distinguish this experiment from the actual experiment. Thus,  
\[Pr[Succ_{1}]=Pr[Succ_{0}]. \tag{7}\]  
**Experiment \(Exp_{2}\)**. All oracles considered in experiment \(Exp_{1}\) are also simulated in this experiment. In addition, we stop simulating the adversary to execute guessing attacks on the real identity of a participant. In this case, we have  
\[|Pr[Succ_{1}]-Pr[Succ_{2}]|\leqslant\frac{q_{send}+q_{exe}}{\ell}. \tag{8}\]  
Proof. : Each participant's real identity is always converted into an alias using a random number (i.e., \(AID_{i}=ID_{i}\oplus H(r_{i}P_{pub_{j}})\)). Therefore, the adversary cannot determine the participant's real identity because every alias is different and there is nothing that can be used to verify the real identity. **Experiment \(Exp_{3}\)**. All oracles considered in experiment \(\text{Exp}_{2}\) are also simulated in this experiment; however, all executions are halted where a collision occurs among \((AID_{i}\), \(u_{i}\), \(M_{1})\), \((AID_{j}\),\(u_{j}\),\(M_{2})\), and \((M_{3})\). The probability of colliding in the \(h\) oracle is at most \(q_{h}^{2}/2|Hash|\) by the birthday paradox. Similarly, the probability of colliding in the transcript is at most \((q_{send}+q_{exe})^{2}/2p\), Consequently,  
\[|Pr[Succ_{2}]-Pr[Succ_{3}]|\leq\frac{q_{h}^{2}}{2|Hash|}+\frac{(q_{send}+q_{ exe})^{2}}{2p}. \tag{9}\]  
**Experiment \(Exp_{4}\)**. All oracles considered in as experiment \(\text{Exp}_{3}\) are simulated in this experiment, in addition to stopping the stimulation of a \(Corrupt\) query to an OBU. Note that the information \(B_{i}\), \(C_{i}\), \(D_{i}\), \(y_{i}\), \(Z_{i}\), \(P_{pub_{j}}\), and \(E_{i}\) stored in the OBU can be extracted by \(A\) when the \(Corrupt(U_{i})\) query is issued. However, this information is useless to \(A\) for calculating the session key since it would require the secure key \(PSK\), a private key \(x_{i}\) and a temporary secret random number, and it is difficult to derive \(PSK\) and \(x_{i}\) from \(E_{i}\) and \(Z_{i}\) without obtaining the user's correct password \(PW_{i}\) via the password attack. Hence, we obtain  
\[|Pr[Succ_{3}]-Pr[Succ_{4}]|\leq\frac{q_{send}}{|D|}. \tag{10}\]  
**Experiment \(Exp_{5}\)**. In this experiment, we use the private oracle \(h^{\prime}\) in place of the oracle \(h\) for computing \(k\) as shown in Table 3, such that the session key is totally independent of \(h\).