# A Lightweight Authenticated Key Agreement Protocol Using Fog Nodes in Social Internet of Vehicles

Authors: Tsu-Yang Wu; Xinglan Guo; Lei Yang; Qian Meng; Chien-Ming Chen
Journal: Mobile Information Systems
 (2021)

---

## Abstract

Recently, there has been rapid growth in the Internet of things, the Internet of vehicles, fog computing, and social Internet of vehiclesSIoV, which can generate large amounts of real-time data. Now, researchers have begun applying fog computing to the SIoV to reduce the computing pressure on cloud servers. However, there are still security challenges in SIoV. In this paper, we propose a lightweight and authenticated key agreement protocol based on fog nodes in SIoV. The protocol completes the mutual authentication between entities and generates the session key for subsequent communication. Through a formal analysis of the Burrows–Abadi–Needham (BAN) logic, real-oracle random (ROR) model, and ProVerif, the security, validity, and correctness of the proposed protocol are demonstrated. In addition, informal security analysis shows that our proposed protocol can resist known security attacks. We also evaluate the performance of the proposed protocol and show that it achieves better performance in terms of computing power and communication cost.


---

## Body

## 1. Introduction

With the popularization and development of the world wide web, the Internet of thingsIoT [1–3], which is a network of Internet extension and expansion, has emerged. With the continuous development of IoT applications, a “social network of intelligent objects” called social Internet of things SIoT [4] has been formed. Internet of vehicles IoV [5] is an extension of the concept of SIoT. IoV can realize network connections between the vehicle and vehicle V2V, vehicle and infrastructure V2I, and vehicle and pedestrian V2P and collect and share the key road information. With the rapid development of network and sensor technology, social connection in urban transportation systems is necessary, so social Internet of vehicles SIoV is produced [6–8]. SIoV is an application of SIoT in the field of vehicles and is a combination of vehicular ad hoc networks (VANET) and mobile networks, and it can generate a large amount of real-time data. In SIoV, intelligent vehicles can establish social relationships with other objects and form a specific social network.For cloud computing processing of road real-time data, there are some problems associated with network delays, transmission efficiency, and others. Because the distance between the cloud computing server and vehicles is far, and the number of vehicles is increasing, the cloud server needs to process more real-time data, which increases the computing burden. Therefore, researchers have introduced fog computing to reduce the computational burden on cloud servers. The data, processing, and application of fog computing are stored on scattered and weak devices, almost outside the cloud, so the computing power is not strong. It can help the cloud server process some data that are not necessary or urgent at that moment. If it encounters data that it cannot process, it reports to the cloud server. Fog nodes can detect unsafe driving behavior in time, issue early warnings for the behavior, and provide the corresponding punishment when necessary. The application of fog node inIoT and IoV environments was mentioned in the articles [9–13]. In 2016, Azimi et al. [11] proposed a medical warning system in IoT based on fog computing. In 2019, Ismail et al. [12] proposed an implication of fog computing on the IoT. In 2019, Ma et al. [10] proposed a protocol for fog-based IoV networks, which realized authenticated key agreement. In 2021, Eftekhari et al. [9] proposed a pairwise secret key agreement protocol using fog-based IoV, which was a three-part authentication protocol. The SIoV typical architecture based on fog nodes is shown in Figure 1.Figure 1
TheSIoV architecture based on fog node.However, in theSIoV environment based on fog nodes, there are still great risks related to security issues. For example, it is very challenging to ensure the confidentiality and privacy of data transmission based on ensuring the security of devices deployed on the network edge. The data transmitted through the public channel usually includes sensitive information such as the personal information of vehicle users, which needs to be kept secret. Recently, Ahmed et al. [6] researched a key agreement protocol for V2G in the SIoV environment, which was a two-party authentication protocol. The protocol [6] was based on an elliptic-curve (ECC) point multiplication and had a large computational cost. This shortcoming leads us to propose a more effective protocol.We propose a lightweight and authenticated key agreement protocol based on three parties using fog nodes in anSIoV environment. In this protocol, vehicles and fog nodes authenticate each other with the help of a cloud server CS and establish a secure session key. Owing to the weak computing power of fog nodes, our protocol only uses lightweight primitives, such as hash function and XOR operation. Through formal analysis of the Burrows–Abadi–Needham (BAN) logic, real-oracle random (ROR) model, and ProVerif, the security, validity, and correctness of the proposed protocol are demonstrated. In addition, informal security analysis shows that our proposed protocol can resist known security attacks. We also evaluate the performance of the proposed protocol and show that it has better performance in terms of computing power and communication cost.The rest of the paper is structured as follows: in Section2, we review recent research results. The details of our proposed agreement are in Section 3. In Section 4, we use BAN, ROR, and ProVerif to verify the security, validity, and correctness of the proposed protocol. In addition, we conduct an informal security analysis. In Section 5, we compare our method with other protocols in terms of performance and security. Finally, we summarize this paper in Section 6.


## 2. Related Work

IoV is an open network environment, so this feature may threaten the identity information and relevant sensitive data of vehicle users. For many years, researchers have proposed many protocols to protect the privacy of vehicle users in IoV environments. In 2006, Raya et al. [14] proposed a vehicle communication protocol that stored multiple public and private key pairs and protected the privacy of vehicle users through the certificates stored in OBU. However, in 2008, Lu et al. [15] determined that the protocol [14] had high computing and storage cost because the key was changing at times and proposed a privacy protection protocol for vehicle communication. That same year, Zhang et al. [16] proposed an identity verification protocol for IoV. The protocol [16] realized privacy protection by the tamper-proof device to generate a random pseudoidentity. In 2020, Cui et al. [17] researched a privacy-preserving scheme. The protocol [17] was based on edge computing and used lightweight primitives, such as elliptic-curve cryptography, instead of bilinear pairing-based primitives with high computational cost. Later, Hu et al. [18] proposed a privacy-preserving authentication scheme for IoV.The protocols proposed by some researchers have high computing power. In 2014, Li et al. [19] proposed a protocol that provided PKC-based privacy protection for IoV and claimed that their protocol could resist replay and stolen smart card attacks. However, Amit et al. [20] revealed that Li et al.’s protocol [19] was susceptible to key compromise impersonation attacks and could not provide user anonymity. To reduce high computing cost caused by the use of PCK in the above protocol, the Trust-Extended Authentication Mechanism (TEAM) protocol was proposed [21]. In 2016, Kumari et al. [22] proposed an authentication protocol that also used TEAM. In 2017, Ying and Nayak [23] proposed an effective and lightweight protocol for an IoV environment, which could provide user anonymity. Chen et al. [5] demonstrated that [23] was vulnerable to replay and offline identity guessing attacks. Therefore, to solve the vulnerability of Ying and Nayak’s protocol [23], Chen et al. [5] proposed a secure authentication scheme for IoV. However, the protocol [5] stored extensive data in the database, so it had high storage cost. In the same year, Mohit et al. [24] proposed an efficient authentication protocol for vehicular systems and deemed their protocol safe. However, Yu et al. [25] pointed out that the protocol [24] of Mohit et al. was susceptible to impersonation attacks and could not provide anonymity, traceability, and mutual authentication. Then, Yu et al. [25] proposed an authenticated protocol in vehicular communications. In 2020, Sadri et al. [26] demonstrated that Yu et al.’s protocol [25] was susceptible to sensor capture attacks and impersonation attacks and could not provide traceability. Additionally, Sadri and Rajabzadeh Asaar [26] proposed a protocol in the IoV environment, which was based on lightweight primitives. In 2021, Wu et al. [27] proposed a protocol in IoV, and the protocol realized authentication key exchange (AKE).There are increasingly more vehicles in theIoV environment, and data processing and transmission have become an inevitable challenge. Therefore, researchers began to apply cloud computing to IoV to solve the problem of processing a large amount of data to improve authentication efficiency. In an IoV environment, an authentication scheme based on cloud computing had been widely mentioned and applied in articles [28–31]. For an environment using cloud computing, problems such as network delay and transmission efficiency would exist, and the cloud server would need to process more data, which would increase the computing burden of the cloud server. Therefore, researchers have begun to introduce fog nodes for fog computing to share the pressure of cloud servers. In these papers [10–13], fog computing technology was applied. Ma et al.’s protocol [10] applied fog computing to IoV and proposed an authenticated key agreement protocol. They claimed that the protocol [10] was secure and efficient, but Eftekhari et al. [9] pointed out that Ma et al.’s protocol [10] was vulnerable to internal attacks, stolen smart card attacks, and known session-specific temporary information attacks. Therefore, Eftekhari et al. [9] proposed a more efficient authentication protocol. In 2021, Wu et al. [32] proposed a secure scheme using fog nodes in IoV, and the protocol realized AKE. In the same year, Maria et al. [33] proposed a blockchain-based anonymous authentication scheme, which used bilinear pairing. Some important related works are summarized in Table 1.Table 1
The summary of authentication protocols.
ProtocolsCryptographic techniquesLimitationsLi et al. [19](1) Utilized digital signature(2) Utilized asymmetric encryption(3) Based on anonymous authentication(1) Does not resist key compromise impersonation attacks(2) Does not provide user anonymityYing and Nayak [23](1) Utilized one-way hash function(2) Based on Diffie–Hellman problem(3) Based on anonymous authentication(1) Does not resist replay attacks(2) Does not resist offline identity guessing attacksMohit et al. [24](1) Utilized one-way hash function(2) Based on smart card(3) Two-factor(1) Does not resist impersonation attacks(2) Does not provide anonymity and untraceability(3) Does not provide mutual authenticationYu et al. [25](1) Utilized one-way hash function(2) Based on smart card(3) Two-factor(1) Does not resist sensor capture attacks(2) Does not resist impersonation attacks(3) Does not provide untraceabilityMa et al. [10](1) Utilized one-way hash function(2) Based on smart card(3) Utilized ECC(1) Does not resist internal attacks(2) Does not resist stolen smart card attacks(3) Does not resist known session-specific temporary information attacksWazid et al. [34](1) Utilized one-way hash function(2) Based on anonymous authentication(3) Utilized ECC—Eftekhari et al. [9](1) Utilized one-way hash function(2) Based on anonymous authentication(3) Utilized ECC—Wu et al. [32](1) Utilized one-way hash function(2) Based on smart card(3) Utilized ECC(4) Two-factor—


## 3. The Proposed Protocol

In this part, we introduce a lightweight and authenticated key agreement protocol using fog nodes inSIoV. Our protocol is based on the architecture of Figure 1. The protocol includes three entities: vehicle Vi, fog node FNj, and CS. The symbols used in the protocol are shown in Table 2. The protocol has three phases: vehicle registration phase, fog node registration phase, and login authentication phase.Table 2
Notations used in the proposed protocol.
SymbolDescriptionViThei-th vehicleFNjThej-th fog nodeCSCloud serverIDi,FIDj,IDCSIdentities ofVi, FNj, and CSPSWiPassword of theViKFNShared key ofFNj and CSKCSSecret key ofCSKVCounter value ofViSKSession key


### 3.1.Vi Registration Phase

In theVi registration phase, Vi registers with CS. The phase is shown in Figure 2, and the specific steps are as follows:(1)
First,Vi selects its identity IDi, password PSWi, and a random number ri, calculates its pseudoidentity PIDi=hIDi‖ri, and then transmits the PIDi to CS through the secure channel.(2)
After receiving the message fromVi, CS calculates the value of HIDi=hPIDi‖KCS, initializes the value of KV to 0, and stores PIDi,KV in its database. Finally, CS sends HIDi,KV to Vi.(3)
After receiving the message fromCS, Vi calculates the value αi=HIDi⊕hPSWi‖ri,Pi=hIDi‖PSWi‖ri, replaces HIDi with the value of αi, and stores the αi,Pi,ri,KV in its smart card.Figure 2
Vi registration phase.


### 3.2.Fj Registration Phase

InFNj registration phase, FNj registers with CS. The phase is shown in Figure 3, and the specific steps are as follows:(1)
First,FNj selects its identity FIDj and a random number rj, calculates its pseudoidentity PFIDj=hFIDj‖rj, and then transmits PFIDj,FIDj to CS through the secure channel.(2)
After receiving the message fromFNj, CS first selects a random number Rj, calculates the value of Nj=hFIDj‖IDCS⊕Rj,KFN=hPFIDj‖KCS,HIDj=hFIDj‖KCS, and stores PFIDj,KFN,FIDj in its database. Finally, CS sends KFN,HIDj,Nj,IDCS to FNj.(3)
After receiving the message fromCS, FNj calculates the value Rj=hFIDj‖IDCS⊕Nj,βj=HIDj⊕hRj‖rj, and stores the KFN,βj,rj,Nj in its database.Figure 3
FNj registration phase.


### 3.3. Login and Authentication Phase

In the login and authentication phase,Vi, FNj, and CS realize authentication and establish session key SK. This phase is shown in Figure 4, and the specific steps are as follows:(1)
First,Vi inserts the smart card into the reader terminal, inputs its identity IDi, password PSWi, calculates the login authentication value Pi∗=hIDi‖PSWi‖ri, and then compares Pi∗=?Pi. If equal, Vi logs in successfully. Otherwise, the login fails. After successful login, Vi selects a random number N1 and calculates A1=hIDi‖ri⊕N1, HIDi=αi⊕hPSWi‖ri, V1=hHIDi‖KV⊕N1. Finally, Vi sends the login request M1=A1,V1,IDCS,PIDi to FNj through the common channel.(2)
After receiving the messageM1 from Vi, FNj first selects a random number N2 and then calculates A2=hA1‖KFN‖HIDj⊕N2, V2=hA2‖KFN‖V1, and finally FNj transmits the message M2=PIDi,PFIDj,A2,V1,V2 to CS.(3)
After receiving messageM2 from FNj, CS first indexes KFN according to FPIDj, then calculates HIDi=hPIDi‖KCS, N1=hHIDi‖KV⊕V1, V1∗=hHIDi‖KV⊕N1, and compares V1∗=?V1. If it is equal, CS believes that Vi is legal. Otherwise, the authentication process is terminated. CS calculates V2∗=hA2‖KFN‖V1 and compares V2∗=?V2. If it is equal, it means that CS believes that FNj is legal. Otherwise, the authentication process is terminated. After authenticating Vi and FNj, CS calculates A1=N1⊕PIDi, HIDj=hFIDj‖KCS, N2=hA1‖KFN‖HIDj⊕A2, selects a random number N3, and calculates NX′=hHIDi‖N1⊕N2⊕N3⊕HIDj,NY′=hHIDj‖N2⊕N1⊕N3⊕HIDi,SK=hN1⊕N2⊕N3⊕HIDj⊕HIDi,V3=hHIDj‖KFN‖SK,V4=hHIDi‖KV‖SK. Then, it updates KV=KV+1, and finally, CS sends message M3=NX′,NY′,V3,V4 to FNj.(4)
After receiving messageM3 from CS, FNj calculates N1⊕N3⊕HIDi=hHIDj‖N2⊕NY′,SK=hN1⊕N2⊕N3⊕HIDj⊕HIDi,V3∗=hHIDj‖KFN‖SK, and compares V3∗=?V3. If it is equal, it means that FNj believes that CS is legal. Otherwise, the authentication process is terminated. Finally, FNj sends message M4=NX′,V4 to Vi.(5)
After receiving messageM4 from FNj, Vi calculates N2⊕N3⊕HIDj=hHIDi‖N1⊕NX′,SK=hN1⊕N2⊕N3⊕HIDj⊕HIDi,V4∗=hHIDi‖KV‖SK, and compares V4∗=?V4. If equal, it means that Vi believes that FNj and CS are legal. Otherwise, the authentication process is terminated. Finally, Vi updates KV=KV+1.Figure 4
Login and authentication phase.


## 3.1.Vi Registration Phase

In theVi registration phase, Vi registers with CS. The phase is shown in Figure 2, and the specific steps are as follows:(1)
First,Vi selects its identity IDi, password PSWi, and a random number ri, calculates its pseudoidentity PIDi=hIDi‖ri, and then transmits the PIDi to CS through the secure channel.(2)
After receiving the message fromVi, CS calculates the value of HIDi=hPIDi‖KCS, initializes the value of KV to 0, and stores PIDi,KV in its database. Finally, CS sends HIDi,KV to Vi.(3)
After receiving the message fromCS, Vi calculates the value αi=HIDi⊕hPSWi‖ri,Pi=hIDi‖PSWi‖ri, replaces HIDi with the value of αi, and stores the αi,Pi,ri,KV in its smart card.Figure 2
Vi registration phase.


## 3.2.Fj Registration Phase

InFNj registration phase, FNj registers with CS. The phase is shown in Figure 3, and the specific steps are as follows:(1)
First,FNj selects its identity FIDj and a random number rj, calculates its pseudoidentity PFIDj=hFIDj‖rj, and then transmits PFIDj,FIDj to CS through the secure channel.(2)
After receiving the message fromFNj, CS first selects a random number Rj, calculates the value of Nj=hFIDj‖IDCS⊕Rj,KFN=hPFIDj‖KCS,HIDj=hFIDj‖KCS, and stores PFIDj,KFN,FIDj in its database. Finally, CS sends KFN,HIDj,Nj,IDCS to FNj.(3)
After receiving the message fromCS, FNj calculates the value Rj=hFIDj‖IDCS⊕Nj,βj=HIDj⊕hRj‖rj, and stores the KFN,βj,rj,Nj in its database.Figure 3
FNj registration phase.


## 3.3. Login and Authentication Phase

In the login and authentication phase,Vi, FNj, and CS realize authentication and establish session key SK. This phase is shown in Figure 4, and the specific steps are as follows:(1)
First,Vi inserts the smart card into the reader terminal, inputs its identity IDi, password PSWi, calculates the login authentication value Pi∗=hIDi‖PSWi‖ri, and then compares Pi∗=?Pi. If equal, Vi logs in successfully. Otherwise, the login fails. After successful login, Vi selects a random number N1 and calculates A1=hIDi‖ri⊕N1, HIDi=αi⊕hPSWi‖ri, V1=hHIDi‖KV⊕N1. Finally, Vi sends the login request M1=A1,V1,IDCS,PIDi to FNj through the common channel.(2)
After receiving the messageM1 from Vi, FNj first selects a random number N2 and then calculates A2=hA1‖KFN‖HIDj⊕N2, V2=hA2‖KFN‖V1, and finally FNj transmits the message M2=PIDi,PFIDj,A2,V1,V2 to CS.(3)
After receiving messageM2 from FNj, CS first indexes KFN according to FPIDj, then calculates HIDi=hPIDi‖KCS, N1=hHIDi‖KV⊕V1, V1∗=hHIDi‖KV⊕N1, and compares V1∗=?V1. If it is equal, CS believes that Vi is legal. Otherwise, the authentication process is terminated. CS calculates V2∗=hA2‖KFN‖V1 and compares V2∗=?V2. If it is equal, it means that CS believes that FNj is legal. Otherwise, the authentication process is terminated. After authenticating Vi and FNj, CS calculates A1=N1⊕PIDi, HIDj=hFIDj‖KCS, N2=hA1‖KFN‖HIDj⊕A2, selects a random number N3, and calculates NX′=hHIDi‖N1⊕N2⊕N3⊕HIDj,NY′=hHIDj‖N2⊕N1⊕N3⊕HIDi,SK=hN1⊕N2⊕N3⊕HIDj⊕HIDi,V3=hHIDj‖KFN‖SK,V4=hHIDi‖KV‖SK. Then, it updates KV=KV+1, and finally, CS sends message M3=NX′,NY′,V3,V4 to FNj.(4)
After receiving messageM3 from CS, FNj calculates N1⊕N3⊕HIDi=hHIDj‖N2⊕NY′,SK=hN1⊕N2⊕N3⊕HIDj⊕HIDi,V3∗=hHIDj‖KFN‖SK, and compares V3∗=?V3. If it is equal, it means that FNj believes that CS is legal. Otherwise, the authentication process is terminated. Finally, FNj sends message M4=NX′,V4 to Vi.(5)
After receiving messageM4 from FNj, Vi calculates N2⊕N3⊕HIDj=hHIDi‖N1⊕NX′,SK=hN1⊕N2⊕N3⊕HIDj⊕HIDi,V4∗=hHIDi‖KV‖SK, and compares V4∗=?V4. If equal, it means that Vi believes that FNj and CS are legal. Otherwise, the authentication process is terminated. Finally, Vi updates KV=KV+1.Figure 4
Login and authentication phase.


## 4. Security Analysis

### 4.1. BAN Logic

BAN logic is a formal security analysis method [35]. In this part, we use BAN logic to prove that vehicles, fog nodes, and cloud servers share a session key SK and further prove the correctness of our protocol. The rules used in BAN logic are shown in the references.


#### 4.1.1. BAN Logic Rules

(1)
Message-meaning rule:P|≡P↔KQ,P⊲XK/P|≡Q|∼X(2)
Freshness rule:P|≡♯X/P|≡♯X,Y(3)
Nonce-verification rule:P|≡♯X,P|≡Q|∼X/P|≡Q|≡X(4)
Jurisdiction rule:P|≡♯X,P|≡Q|∼X/P|≡Q|≡X(5)
Belief rule:P|≡X,P|≡Y/P|≡X,Y(6)
Session key rule:P|≡♯X,P|≡Q|≡X/P|≡P↔KQ


#### 4.1.2. Goals

G1Vi|≡Vi↔SKFNjG2Vi|≡FNj|≡Vi↔SKFNjG3FNj|≡Vi↔SKFNjG4FNj|≡Vi|≡Vi↔SKFNjG5CS|≡Vi↔SKFNjG6CS|≡Vi|≡Vi↔SKFNjG7CS|≡FNj|≡Vi↔SKFNj


#### 4.1.3. Idealizing Communication

M1 Vi⟶CS: PIDi,A1,V1M2FNj⟶CS: PFIDj,A2,V2M3CS⟶FNj: NY′,V3M4CS⟶Vi: NX′,V4


#### 4.1.4. Initial State Assumptions

A1Vi|≡♯N1A2FNj|≡♯N2A3CS|≡♯N3A4CS|≡Vi⇌hHIDi‖KVCSA5CS|≡♯N1A6CS|≡Vi|⟹N1A7CS|≡FNj⇌hA1‖KFN‖HIDjCSA8CS|≡♯N2A9CS|≡FNj|⟹N2A10CS|≡HIDiA11CS|≡HIDjA12FNj|≡FNj⇌hHIDj‖N2CSA13FNj|≡CS|⟹N3A14FNj|≡CS|⟹HIDjA15FNj|≡♯N1A16FNj|≡♯N3A17FNj|≡♯HIDjA18Vi|≡Vi⇌hHIDi‖N1CSA19Vi|≡CS|⟹N3A20Vi|≡CS|⟹HIDjA21Vi|≡♯N2A22Vi|≡♯N3A23Vi|≡♯HIDj


#### 4.1.5. Detailed Steps

By considering the messageM1 and using the seeing rule, we get(1)S1:CS⊲V1:N1hHIDiKV,PIDi,A1.UsingS1, we get(2)S2:CS⊲N1hHIDiKV.Under the premise of assumingA4, using S2, and the message-meaning rule, we get(3)S3:CS≡Vi∼N1.In the case of conclusionS3, using assumption A5, the freshness rule, and the nonce-verification (N-V) rule, we get(4)S4:CS≡Vi≡N1.In the case of conclusionS4, using assumption A6, and the jurisdiction rule, we get(5)S5:CS|≡N1.In addition, considering the messageM2, we get(6)S6:CS⊲PFIDi,A2:N2hA1KFNHIDj,V2.UsingS6, we get(7)S7:CS⊲N2hA1KFNHIDj.Under the premise of assumingA7, using S7, and the message-meaning rule, we get(8)S8:CS≡FNj∼N2.In the case of conclusionS8, using assumption A8, the freshness rule, and the nonce-verification (N-V) rule, we get(9)S9:CS≡FNj≡N2.In the case of conclusionS9, using assumption A9, and the jurisdiction rule, we get(10)S10:CS|≡N2.BecauseSK=hN1⊕N2⊕N3⊕HIDi⊕HIDj, according to the conclusions A10, A11, S10, and S5 and the belief rule, we get(11)S11:CS|≡Vi↔SKFNj,G5.UsingA5, S11, and the SK rule, we get(12)S12:CS≡Vi≡Vi↔SKFNj,G6.UsingA8, S11, and the SK rule, we get(13)S13:CS≡FNj≡Vi↔SKFNj,G7.By considering the messageM3 and using the seeing rule, we get(14)S14:FNj⊲VY′:N1,N3,HIDihHIDjN2,V3.UsingS14, we get(15)S15:FNj⊲N1,N3,HIDihHIDj∥N2.Under the premise of assumingA12, using S15, and the message-meaning rule, we get(16)S16:FNj|≡CS|∼N1,N3,HIDi.In the case of conclusionS16, using assumptions A13 and A14, the freshness rule, and the nonce-verification (N-V) rule, we get(17)S17:FNj|≡CS|≡N1,N3,HIDi.Applying this for each component, we get(18)S18:FNj≡CS≡N1,S19:FNj≡CS≡N3,S20:FNj≡CS≡HIDi.In the case of conclusionS18, using assumption A15, and the jurisdiction rule, we get(19)S21:FNj|≡N1.In the case of conclusionS22, using assumption A16, and the jurisdiction rule, we get(20)S22:FNj|≡N1.In the case of conclusionS23, using assumption A17, and the jurisdiction rule, we get(21)S23:FNj|≡HIDi.BecauseSK=hN1⊕N2⊕N3⊕HIDi⊕HIDj, according to the conclusions S21, S22, and S23 and the belief rule, we get(22)S24:FNj|≡Vi↔SKFNj,G3.UsingA15, S24, and the SK rule, we get(23)S25:FNj≡Vi≡Vi↔SKFNj,G4.By considering the messageM4 and using the seeing rule, we get(24)S26:Vi⊲VX′:N2,N3,HIDjhHIDiN1,V4.UsingS26, we get(25)S27:Vi⊲N2,N3,HIDjhHIDiN1.Under the premise of assumingA18, using S27, and the message-meaning rule, we get(26)S28:Vi≡CS∼N2,N3,HIDj.In the case of conclusionS28, using assumption A19 and A20, the freshness rule, and the nonce-verification (N-V) rule, we get(27)S29:Vi≡CS≡N2,N3,HIDj.Applying this for each component, we get(28)S30:Vi≡CS≡N2,S31:Vi≡CS≡N3,S32:Vi≡CS≡HIDj.In the case of conclusionS30, using assumptions A21, and the jurisdiction rule, we get(29)S31:Vi|≡N2.In the case of conclusionS31, using assumptions A22, and the jurisdiction rule, we get(30)S32:Vi|≡N3.In the case of conclusionS32, using assumptions A23, and the jurisdiction rule, we get(31)S33:Vi|≡HIDj.BecauseSK=hN1⊕N2⊕N3⊕HIDi⊕HIDj, according to the conclusions S31, S32, and S33 and the belief rule, we get(32)S34:Vi|≡Vi↔SKFNj,G1.UsingA21, S34, and the SK rule, we get(33)S35:Vi≡FNj≡Vi↔SKFNj,G2.


### 4.2. Formal Security Analysis

In this part, we use the ROR model to formally prove the security of our proposed protocol. The ROR model judges the security of the protocol by calculating the session keySK probability of an ordinary situation [36, 37].


#### 4.2.1. ROR Model

The protocol consists of three entities: vehicle, fog node, and cloud server. In the ROR model, we useΠVix, ΠFNjy, and ΠCSz to represent the x-th communication of the Vi, the y-th communication of the FNj, and the z-th communication of the CS, respectively. We also define that the attacker A can have the following query capabilities, where Z=ΠVix,ΠFNjy,ΠCSz.ExecuteZ: by performing this query operation, A can intercept the messages transmitted on the public channel.Hashstring: by performing this query operation, A can obtain the hash value of the input string.SendZ,M: by performing this query operation, A can send message M to Z and receive the response from Z.CorruptZ: by performing this query operation, A can obtain a party’s secret values, such as some values in the smart card, long-term key, or temporary information.TestZ: by performing this query operation, A flips a coin c. If c=1, A can obtain an accurate session key; if c=0, A can obtain a random string of the same length as the session key.


#### 4.2.2. Theorem

In the ROR model, assumeA can perform execute, hash, send, corrupt, and test queries. Then, the probability that A can break the proposed protocol P in polynomial time is AdvAPξ≤qsend/2l−1+3qhash2/2l+2maxC′⋅qsends′,qsend/2l+qexe+qsend2/p, where qhash represents the number of times hash queries are executed, qsend represents the number of times send queries are executed, qexe represents the number of times execute queries are executed, l represents the bits of biological information, and C′ and s are constants in Zipf’s law.


#### 4.2.3. Proof

We played five rounds of games, which were expressed as follows:GM0 to GM6. SuccAGMiξ represents the event that A can win in the game GMi. SuccPA,GMi=PrSuccAGMi represents the advantage of A for winning GMi. PrZ is the probability of event Z. AdvPA represents the advantage A has in breaking the security of SK for protocol P. The specific steps of GMi are as follows:GM0: GM0 is the first-round game in the ROR model and a real attack. We choose a coin c to start the round. Therefore, in GM0, we can obtain the probability that A can successfully break P as(34)AdvAP=2PrSuccAGM0−1.GM1: GM1 adds an execute query to GM0. In GM1, A can only obtain the messages transmitted on the public channel. After GM1, A will query the session key SK through the test, but A cannot obtain five values N1,N2,N3,HIDi,HIDj, so the probability that GM0 is equal to that of GM1 is(35)PrSuccAGM1=PrSuccAGM0.GM2: GM2 adds a send query to GM1. According to Zipf’s law [38], we obtain(36)PrSuccAGM2−PrSuccAGM1≤qsend/2l.GM3: GM3 adds the hash query to GM2. The maximum probability of text collision in transmission is qexe+qsend2/2p, and we can obtain(37)PrSuccAGM3−PrSuccAGM2≤qexe+qsend22p+qhash22l+1.GM4: in this round, we verify the security of the session key SK using two events. One is to obtain the long-term key of ΠCSz to verify the perfect forward security, and the other is to obtain temporary information to verify that the protocol can resist the known session-specific temporary information attacks.(1
)Perfect forward security: usingΠCSz, A attempts to obtain the private key KCS of CS, or A uses ΠVix or ΠFNjy to obtain some secret values in the registration phase.(2)
Known session-specific temporary information attacks:A uses one of ΠVix or ΠFNjy or ΠCSz to attempt to obtain temporary information.For the first event, ifA obtains the private key KCS of CS, or the secret value of ΠVix and ΠFNjy in the registration phase, but A cannot get the random number N1,N2,N3,HIDj, it cannot calculate session key SK, where SK=hN1⊕N2⊕N3⊕HIDi⊕HIDj. For the second event, if A can obtain N1, but the values of N2 and N3 are confidential, the SK cannot be calculated. Similarly, if N2 and N3 are leaked, SK cannot be calculated by A. Therefore, the probability of this round is(38)PrSuccAGM4−PrSuccAGM3≤qhash22l+1.GM5: in this round of the game, A uses the corrupt query to obtain the parameter αi,Pi,ri,KV stored in the smart card, so A wants to conduct the offline key guessing attacks. Vi uses random numbers and passwords for registration, so A must guess Pi=hIDi‖PSWi‖ri, but the probability of guessing a random number is 1/2l, which can be ignored. Using Zipf’s law [38], we can obtain(39)PrSuccAGM5−PrSuccAGM4≤maxC′⋅qsends′,qsend2l.GM6: this round of the game is to verify that protocol P can resist the impersonation attacks, A uses hN1⊕N2⊕N3⊕HIDi⊕HIDj to query, and the game is terminated. Therefore, the probability that A can guess SK is(40)PrSuccAGM6−PrSuccAGM5≤qhash22l+1.Because the probability of success and failure of theGM6 is 1/2,(41)12AdvAP=PrSuccAGM0−12=PrSuccAGM0−PrSuccAGM6=PrSuccAGM1−PrSuccAGM6≤∑i=05PrSuccAGMi+1−PrSuccAGMi=qsend2l+3qhash22l+1+maxC′⋅qsends′,qsend2l+qhash+qsend22p.Finally, we can obtain(42)AdvAP≤qsend2l−1+3qhash22l+2maxC′⋅qsends′,qsend2l+qexe+qsend2p.


### 4.3. ProVerif

ProVerif is a formal automatic verification tool, which can verify confidentiality, identity, anonymity, and so on [39, 40]. In this paper, we use the ProVerif code to achieve vehicle registration, fog node registration, and authentication between the two parties and the CS and verify the security and effectiveness of our proposed protocol through ProVerif.ProVerif demonstrates that the specific operation works as follows. Our protocol includes three entities: vehicle, fog node, and cloud server. The symbols and operation definitions used in ProVerif are shown in Figure5.Figure 5
The definition in the ProVerif tool.The proof contains six events, as shown in Figure6. The six events are veclestarted (), vecleauthored (), cloudserveracvehicle (), cloudserveracfognode (), fognodeaccloudserver (), and vecleaccloudserver (), indicating that the vehicle starts certification, the vehicle completes certification, the cloud server completes the vehicle certification, and the cloud server completes the fog node certification, respectively. The fog node completed the certification of the cloud server, and the vehicle completed the certification of the cloud server.Figure 6
Process in the ProVerif tool.Then, we use ProVerif to query whetherA can calculate the session key SK through the data transmitted on the common channel. The query operation is shown in Figure 7.Figure 7
Queries and events in the ProVerif tool.Finally, we get the verification result using the ProVerif tool, as shown in Figure8. The result shows that A cannot calculate the session key SK of the Vi, FNj, and CS.Figure 8
Results in the ProVerif tool.


### 4.4. Informal Security Analysis

This part is an informal security analysis of our proposed agreement. We have proved that the protocol can meet common security requirements. The specific proof is as follows.


#### 4.4.1. Mutual Authentication

In the authentication phase, with the help ofCS, mutual authentication between Vi and FNj is realized. V1 in message M1 is the value CS uses to authenticate Vi, V2 in message M2 is the value CS uses to authenticate FNj, and V3 and V4 in message M3 are the values CS uses to authenticate FNj and Vi, respectively. Therefore, the mutual authentication among Vi, FNj, and CS is realized in the authentication phase.


#### 4.4.2. Replay Attacks

In this protocol, we use cumulative valueKV to resist replay attacks. In the Vi registration phase, we initialize KV to 0. As the session progresses, it carries out +1 operation on the value KV, saves it to its database after CS authenticates Vi, FNj, and carries out the necessary calculation. After CS authenticates Vi and generates the session key, it also carries out the +1 operation on the value KV and saves it to the smart card. In this manner, KV on both sides is synchronous and equal, and the session process is completed smoothly. If A repeatedly sends message M1 intercepted in the public channel, CS continues to calculate the value KV+1 in the authentication phase. Value V4 generated using KV is not equal to value V4 calculated by Vi using KV stored in its smart card, because the value KV in the smart card of Vi cannot keep up with the CS update speed, so the authentication fails. Thus, our protocol can resist replay attacks.


#### 4.4.3. Man-in-the-Middle Attacks

Suppose thatA can intercept the message M1=A1,V1,IDCS,PIDi transmitted on the public channel between Vi and FNj. Since A cannot obtain the information αi,KV,ri in the smart card and the identity IDi of Vi, A cannot calculate the values KV,HIDi,N1 required for V1, where V1=hHIDi‖KV⊕N1. Therefore, after A tampers with M1, it cannot pass the authentication of FNj. Similarly, because the privacy value is unknown, A cannot calculate the authentication value V2, V3, or V4 and cannot complete the verification after intercepting the information M2, M3, or M4. Therefore, our protocol can resist man-in-the-middle attacks.


#### 4.4.4. User Anonymity

The real identities ofVi and FNj are transmitted on the secure channel and are protected by pseudoidentity PIDi and PFIDj in the authentication phase. The anonymity of Vi and FNj is ensured. Therefore, our protocol can provide user anonymity.


#### 4.4.5. Untraceability

IfA wants to trace the Vi, it intercepts the messages M1,M2,M3,M4 transmitted on the common channel. Since the random numbers N1,N2,N3 are used, this means that messages M1,M2,M3,M4 are different during each session. In addition, A cannot obtain the random numbers N1,N2,N3, so A cannot be traced back to Vi. Therefore, our protocol can provide untraceability.


## 4.1. BAN Logic

BAN logic is a formal security analysis method [35]. In this part, we use BAN logic to prove that vehicles, fog nodes, and cloud servers share a session key SK and further prove the correctness of our protocol. The rules used in BAN logic are shown in the references.


### 4.1.1. BAN Logic Rules

(1)
Message-meaning rule:P|≡P↔KQ,P⊲XK/P|≡Q|∼X(2)
Freshness rule:P|≡♯X/P|≡♯X,Y(3)
Nonce-verification rule:P|≡♯X,P|≡Q|∼X/P|≡Q|≡X(4)
Jurisdiction rule:P|≡♯X,P|≡Q|∼X/P|≡Q|≡X(5)
Belief rule:P|≡X,P|≡Y/P|≡X,Y(6)
Session key rule:P|≡♯X,P|≡Q|≡X/P|≡P↔KQ


### 4.1.2. Goals

G1Vi|≡Vi↔SKFNjG2Vi|≡FNj|≡Vi↔SKFNjG3FNj|≡Vi↔SKFNjG4FNj|≡Vi|≡Vi↔SKFNjG5CS|≡Vi↔SKFNjG6CS|≡Vi|≡Vi↔SKFNjG7CS|≡FNj|≡Vi↔SKFNj


### 4.1.3. Idealizing Communication

M1 Vi⟶CS: PIDi,A1,V1M2FNj⟶CS: PFIDj,A2,V2M3CS⟶FNj: NY′,V3M4CS⟶Vi: NX′,V4


### 4.1.4. Initial State Assumptions

A1Vi|≡♯N1A2FNj|≡♯N2A3CS|≡♯N3A4CS|≡Vi⇌hHIDi‖KVCSA5CS|≡♯N1A6CS|≡Vi|⟹N1A7CS|≡FNj⇌hA1‖KFN‖HIDjCSA8CS|≡♯N2A9CS|≡FNj|⟹N2A10CS|≡HIDiA11CS|≡HIDjA12FNj|≡FNj⇌hHIDj‖N2CSA13FNj|≡CS|⟹N3A14FNj|≡CS|⟹HIDjA15FNj|≡♯N1A16FNj|≡♯N3A17FNj|≡♯HIDjA18Vi|≡Vi⇌hHIDi‖N1CSA19Vi|≡CS|⟹N3A20Vi|≡CS|⟹HIDjA21Vi|≡♯N2A22Vi|≡♯N3A23Vi|≡♯HIDj


### 4.1.5. Detailed Steps

By considering the messageM1 and using the seeing rule, we get(1)S1:CS⊲V1:N1hHIDiKV,PIDi,A1.UsingS1, we get(2)S2:CS⊲N1hHIDiKV.Under the premise of assumingA4, using S2, and the message-meaning rule, we get(3)S3:CS≡Vi∼N1.In the case of conclusionS3, using assumption A5, the freshness rule, and the nonce-verification (N-V) rule, we get(4)S4:CS≡Vi≡N1.In the case of conclusionS4, using assumption A6, and the jurisdiction rule, we get(5)S5:CS|≡N1.In addition, considering the messageM2, we get(6)S6:CS⊲PFIDi,A2:N2hA1KFNHIDj,V2.UsingS6, we get(7)S7:CS⊲N2hA1KFNHIDj.Under the premise of assumingA7, using S7, and the message-meaning rule, we get(8)S8:CS≡FNj∼N2.In the case of conclusionS8, using assumption A8, the freshness rule, and the nonce-verification (N-V) rule, we get(9)S9:CS≡FNj≡N2.In the case of conclusionS9, using assumption A9, and the jurisdiction rule, we get(10)S10:CS|≡N2.BecauseSK=hN1⊕N2⊕N3⊕HIDi⊕HIDj, according to the conclusions A10, A11, S10, and S5 and the belief rule, we get(11)S11:CS|≡Vi↔SKFNj,G5.UsingA5, S11, and the SK rule, we get(12)S12:CS≡Vi≡Vi↔SKFNj,G6.UsingA8, S11, and the SK rule, we get(13)S13:CS≡FNj≡Vi↔SKFNj,G7.By considering the messageM3 and using the seeing rule, we get(14)S14:FNj⊲VY′:N1,N3,HIDihHIDjN2,V3.UsingS14, we get(15)S15:FNj⊲N1,N3,HIDihHIDj∥N2.Under the premise of assumingA12, using S15, and the message-meaning rule, we get(16)S16:FNj|≡CS|∼N1,N3,HIDi.In the case of conclusionS16, using assumptions A13 and A14, the freshness rule, and the nonce-verification (N-V) rule, we get(17)S17:FNj|≡CS|≡N1,N3,HIDi.Applying this for each component, we get(18)S18:FNj≡CS≡N1,S19:FNj≡CS≡N3,S20:FNj≡CS≡HIDi.In the case of conclusionS18, using assumption A15, and the jurisdiction rule, we get(19)S21:FNj|≡N1.In the case of conclusionS22, using assumption A16, and the jurisdiction rule, we get(20)S22:FNj|≡N1.In the case of conclusionS23, using assumption A17, and the jurisdiction rule, we get(21)S23:FNj|≡HIDi.BecauseSK=hN1⊕N2⊕N3⊕HIDi⊕HIDj, according to the conclusions S21, S22, and S23 and the belief rule, we get(22)S24:FNj|≡Vi↔SKFNj,G3.UsingA15, S24, and the SK rule, we get(23)S25:FNj≡Vi≡Vi↔SKFNj,G4.By considering the messageM4 and using the seeing rule, we get(24)S26:Vi⊲VX′:N2,N3,HIDjhHIDiN1,V4.UsingS26, we get(25)S27:Vi⊲N2,N3,HIDjhHIDiN1.Under the premise of assumingA18, using S27, and the message-meaning rule, we get(26)S28:Vi≡CS∼N2,N3,HIDj.In the case of conclusionS28, using assumption A19 and A20, the freshness rule, and the nonce-verification (N-V) rule, we get(27)S29:Vi≡CS≡N2,N3,HIDj.Applying this for each component, we get(28)S30:Vi≡CS≡N2,S31:Vi≡CS≡N3,S32:Vi≡CS≡HIDj.In the case of conclusionS30, using assumptions A21, and the jurisdiction rule, we get(29)S31:Vi|≡N2.In the case of conclusionS31, using assumptions A22, and the jurisdiction rule, we get(30)S32:Vi|≡N3.In the case of conclusionS32, using assumptions A23, and the jurisdiction rule, we get(31)S33:Vi|≡HIDj.BecauseSK=hN1⊕N2⊕N3⊕HIDi⊕HIDj, according to the conclusions S31, S32, and S33 and the belief rule, we get(32)S34:Vi|≡Vi↔SKFNj,G1.UsingA21, S34, and the SK rule, we get(33)S35:Vi≡FNj≡Vi↔SKFNj,G2.


## 4.1.1. BAN Logic Rules

(1)
Message-meaning rule:P|≡P↔KQ,P⊲XK/P|≡Q|∼X(2)
Freshness rule:P|≡♯X/P|≡♯X,Y(3)
Nonce-verification rule:P|≡♯X,P|≡Q|∼X/P|≡Q|≡X(4)
Jurisdiction rule:P|≡♯X,P|≡Q|∼X/P|≡Q|≡X(5)
Belief rule:P|≡X,P|≡Y/P|≡X,Y(6)
Session key rule:P|≡♯X,P|≡Q|≡X/P|≡P↔KQ


## 4.1.2. Goals

G1Vi|≡Vi↔SKFNjG2Vi|≡FNj|≡Vi↔SKFNjG3FNj|≡Vi↔SKFNjG4FNj|≡Vi|≡Vi↔SKFNjG5CS|≡Vi↔SKFNjG6CS|≡Vi|≡Vi↔SKFNjG7CS|≡FNj|≡Vi↔SKFNj


## 4.1.3. Idealizing Communication

M1 Vi⟶CS: PIDi,A1,V1M2FNj⟶CS: PFIDj,A2,V2M3CS⟶FNj: NY′,V3M4CS⟶Vi: NX′,V4


## 4.1.4. Initial State Assumptions

A1Vi|≡♯N1A2FNj|≡♯N2A3CS|≡♯N3A4CS|≡Vi⇌hHIDi‖KVCSA5CS|≡♯N1A6CS|≡Vi|⟹N1A7CS|≡FNj⇌hA1‖KFN‖HIDjCSA8CS|≡♯N2A9CS|≡FNj|⟹N2A10CS|≡HIDiA11CS|≡HIDjA12FNj|≡FNj⇌hHIDj‖N2CSA13FNj|≡CS|⟹N3A14FNj|≡CS|⟹HIDjA15FNj|≡♯N1A16FNj|≡♯N3A17FNj|≡♯HIDjA18Vi|≡Vi⇌hHIDi‖N1CSA19Vi|≡CS|⟹N3A20Vi|≡CS|⟹HIDjA21Vi|≡♯N2A22Vi|≡♯N3A23Vi|≡♯HIDj


## 4.1.5. Detailed Steps

By considering the messageM1 and using the seeing rule, we get(1)S1:CS⊲V1:N1hHIDiKV,PIDi,A1.UsingS1, we get(2)S2:CS⊲N1hHIDiKV.Under the premise of assumingA4, using S2, and the message-meaning rule, we get(3)S3:CS≡Vi∼N1.In the case of conclusionS3, using assumption A5, the freshness rule, and the nonce-verification (N-V) rule, we get(4)S4:CS≡Vi≡N1.In the case of conclusionS4, using assumption A6, and the jurisdiction rule, we get(5)S5:CS|≡N1.In addition, considering the messageM2, we get(6)S6:CS⊲PFIDi,A2:N2hA1KFNHIDj,V2.UsingS6, we get(7)S7:CS⊲N2hA1KFNHIDj.Under the premise of assumingA7, using S7, and the message-meaning rule, we get(8)S8:CS≡FNj∼N2.In the case of conclusionS8, using assumption A8, the freshness rule, and the nonce-verification (N-V) rule, we get(9)S9:CS≡FNj≡N2.In the case of conclusionS9, using assumption A9, and the jurisdiction rule, we get(10)S10:CS|≡N2.BecauseSK=hN1⊕N2⊕N3⊕HIDi⊕HIDj, according to the conclusions A10, A11, S10, and S5 and the belief rule, we get(11)S11:CS|≡Vi↔SKFNj,G5.UsingA5, S11, and the SK rule, we get(12)S12:CS≡Vi≡Vi↔SKFNj,G6.UsingA8, S11, and the SK rule, we get(13)S13:CS≡FNj≡Vi↔SKFNj,G7.By considering the messageM3 and using the seeing rule, we get(14)S14:FNj⊲VY′:N1,N3,HIDihHIDjN2,V3.UsingS14, we get(15)S15:FNj⊲N1,N3,HIDihHIDj∥N2.Under the premise of assumingA12, using S15, and the message-meaning rule, we get(16)S16:FNj|≡CS|∼N1,N3,HIDi.In the case of conclusionS16, using assumptions A13 and A14, the freshness rule, and the nonce-verification (N-V) rule, we get(17)S17:FNj|≡CS|≡N1,N3,HIDi.Applying this for each component, we get(18)S18:FNj≡CS≡N1,S19:FNj≡CS≡N3,S20:FNj≡CS≡HIDi.In the case of conclusionS18, using assumption A15, and the jurisdiction rule, we get(19)S21:FNj|≡N1.In the case of conclusionS22, using assumption A16, and the jurisdiction rule, we get(20)S22:FNj|≡N1.In the case of conclusionS23, using assumption A17, and the jurisdiction rule, we get(21)S23:FNj|≡HIDi.BecauseSK=hN1⊕N2⊕N3⊕HIDi⊕HIDj, according to the conclusions S21, S22, and S23 and the belief rule, we get(22)S24:FNj|≡Vi↔SKFNj,G3.UsingA15, S24, and the SK rule, we get(23)S25:FNj≡Vi≡Vi↔SKFNj,G4.By considering the messageM4 and using the seeing rule, we get(24)S26:Vi⊲VX′:N2,N3,HIDjhHIDiN1,V4.UsingS26, we get(25)S27:Vi⊲N2,N3,HIDjhHIDiN1.Under the premise of assumingA18, using S27, and the message-meaning rule, we get(26)S28:Vi≡CS∼N2,N3,HIDj.In the case of conclusionS28, using assumption A19 and A20, the freshness rule, and the nonce-verification (N-V) rule, we get(27)S29:Vi≡CS≡N2,N3,HIDj.Applying this for each component, we get(28)S30:Vi≡CS≡N2,S31:Vi≡CS≡N3,S32:Vi≡CS≡HIDj.In the case of conclusionS30, using assumptions A21, and the jurisdiction rule, we get(29)S31:Vi|≡N2.In the case of conclusionS31, using assumptions A22, and the jurisdiction rule, we get(30)S32:Vi|≡N3.In the case of conclusionS32, using assumptions A23, and the jurisdiction rule, we get(31)S33:Vi|≡HIDj.BecauseSK=hN1⊕N2⊕N3⊕HIDi⊕HIDj, according to the conclusions S31, S32, and S33 and the belief rule, we get(32)S34:Vi|≡Vi↔SKFNj,G1.UsingA21, S34, and the SK rule, we get(33)S35:Vi≡FNj≡Vi↔SKFNj,G2.


## 4.2. Formal Security Analysis

In this part, we use the ROR model to formally prove the security of our proposed protocol. The ROR model judges the security of the protocol by calculating the session keySK probability of an ordinary situation [36, 37].


### 4.2.1. ROR Model

The protocol consists of three entities: vehicle, fog node, and cloud server. In the ROR model, we useΠVix, ΠFNjy, and ΠCSz to represent the x-th communication of the Vi, the y-th communication of the FNj, and the z-th communication of the CS, respectively. We also define that the attacker A can have the following query capabilities, where Z=ΠVix,ΠFNjy,ΠCSz.ExecuteZ: by performing this query operation, A can intercept the messages transmitted on the public channel.Hashstring: by performing this query operation, A can obtain the hash value of the input string.SendZ,M: by performing this query operation, A can send message M to Z and receive the response from Z.CorruptZ: by performing this query operation, A can obtain a party’s secret values, such as some values in the smart card, long-term key, or temporary information.TestZ: by performing this query operation, A flips a coin c. If c=1, A can obtain an accurate session key; if c=0, A can obtain a random string of the same length as the session key.


### 4.2.2. Theorem

In the ROR model, assumeA can perform execute, hash, send, corrupt, and test queries. Then, the probability that A can break the proposed protocol P in polynomial time is AdvAPξ≤qsend/2l−1+3qhash2/2l+2maxC′⋅qsends′,qsend/2l+qexe+qsend2/p, where qhash represents the number of times hash queries are executed, qsend represents the number of times send queries are executed, qexe represents the number of times execute queries are executed, l represents the bits of biological information, and C′ and s are constants in Zipf’s law.


### 4.2.3. Proof

We played five rounds of games, which were expressed as follows:GM0 to GM6. SuccAGMiξ represents the event that A can win in the game GMi. SuccPA,GMi=PrSuccAGMi represents the advantage of A for winning GMi. PrZ is the probability of event Z. AdvPA represents the advantage A has in breaking the security of SK for protocol P. The specific steps of GMi are as follows:GM0: GM0 is the first-round game in the ROR model and a real attack. We choose a coin c to start the round. Therefore, in GM0, we can obtain the probability that A can successfully break P as(34)AdvAP=2PrSuccAGM0−1.GM1: GM1 adds an execute query to GM0. In GM1, A can only obtain the messages transmitted on the public channel. After GM1, A will query the session key SK through the test, but A cannot obtain five values N1,N2,N3,HIDi,HIDj, so the probability that GM0 is equal to that of GM1 is(35)PrSuccAGM1=PrSuccAGM0.GM2: GM2 adds a send query to GM1. According to Zipf’s law [38], we obtain(36)PrSuccAGM2−PrSuccAGM1≤qsend/2l.GM3: GM3 adds the hash query to GM2. The maximum probability of text collision in transmission is qexe+qsend2/2p, and we can obtain(37)PrSuccAGM3−PrSuccAGM2≤qexe+qsend22p+qhash22l+1.GM4: in this round, we verify the security of the session key SK using two events. One is to obtain the long-term key of ΠCSz to verify the perfect forward security, and the other is to obtain temporary information to verify that the protocol can resist the known session-specific temporary information attacks.(1
)Perfect forward security: usingΠCSz, A attempts to obtain the private key KCS of CS, or A uses ΠVix or ΠFNjy to obtain some secret values in the registration phase.(2)
Known session-specific temporary information attacks:A uses one of ΠVix or ΠFNjy or ΠCSz to attempt to obtain temporary information.For the first event, ifA obtains the private key KCS of CS, or the secret value of ΠVix and ΠFNjy in the registration phase, but A cannot get the random number N1,N2,N3,HIDj, it cannot calculate session key SK, where SK=hN1⊕N2⊕N3⊕HIDi⊕HIDj. For the second event, if A can obtain N1, but the values of N2 and N3 are confidential, the SK cannot be calculated. Similarly, if N2 and N3 are leaked, SK cannot be calculated by A. Therefore, the probability of this round is(38)PrSuccAGM4−PrSuccAGM3≤qhash22l+1.GM5: in this round of the game, A uses the corrupt query to obtain the parameter αi,Pi,ri,KV stored in the smart card, so A wants to conduct the offline key guessing attacks. Vi uses random numbers and passwords for registration, so A must guess Pi=hIDi‖PSWi‖ri, but the probability of guessing a random number is 1/2l, which can be ignored. Using Zipf’s law [38], we can obtain(39)PrSuccAGM5−PrSuccAGM4≤maxC′⋅qsends′,qsend2l.GM6: this round of the game is to verify that protocol P can resist the impersonation attacks, A uses hN1⊕N2⊕N3⊕HIDi⊕HIDj to query, and the game is terminated. Therefore, the probability that A can guess SK is(40)PrSuccAGM6−PrSuccAGM5≤qhash22l+1.Because the probability of success and failure of theGM6 is 1/2,(41)12AdvAP=PrSuccAGM0−12=PrSuccAGM0−PrSuccAGM6=PrSuccAGM1−PrSuccAGM6≤∑i=05PrSuccAGMi+1−PrSuccAGMi=qsend2l+3qhash22l+1+maxC′⋅qsends′,qsend2l+qhash+qsend22p.Finally, we can obtain(42)AdvAP≤qsend2l−1+3qhash22l+2maxC′⋅qsends′,qsend2l+qexe+qsend2p.


## 4.2.1. ROR Model

The protocol consists of three entities: vehicle, fog node, and cloud server. In the ROR model, we useΠVix, ΠFNjy, and ΠCSz to represent the x-th communication of the Vi, the y-th communication of the FNj, and the z-th communication of the CS, respectively. We also define that the attacker A can have the following query capabilities, where Z=ΠVix,ΠFNjy,ΠCSz.ExecuteZ: by performing this query operation, A can intercept the messages transmitted on the public channel.Hashstring: by performing this query operation, A can obtain the hash value of the input string.SendZ,M: by performing this query operation, A can send message M to Z and receive the response from Z.CorruptZ: by performing this query operation, A can obtain a party’s secret values, such as some values in the smart card, long-term key, or temporary information.TestZ: by performing this query operation, A flips a coin c. If c=1, A can obtain an accurate session key; if c=0, A can obtain a random string of the same length as the session key.


## 4.2.2. Theorem

In the ROR model, assumeA can perform execute, hash, send, corrupt, and test queries. Then, the probability that A can break the proposed protocol P in polynomial time is AdvAPξ≤qsend/2l−1+3qhash2/2l+2maxC′⋅qsends′,qsend/2l+qexe+qsend2/p, where qhash represents the number of times hash queries are executed, qsend represents the number of times send queries are executed, qexe represents the number of times execute queries are executed, l represents the bits of biological information, and C′ and s are constants in Zipf’s law.


## 4.2.3. Proof

We played five rounds of games, which were expressed as follows:GM0 to GM6. SuccAGMiξ represents the event that A can win in the game GMi. SuccPA,GMi=PrSuccAGMi represents the advantage of A for winning GMi. PrZ is the probability of event Z. AdvPA represents the advantage A has in breaking the security of SK for protocol P. The specific steps of GMi are as follows:GM0: GM0 is the first-round game in the ROR model and a real attack. We choose a coin c to start the round. Therefore, in GM0, we can obtain the probability that A can successfully break P as(34)AdvAP=2PrSuccAGM0−1.GM1: GM1 adds an execute query to GM0. In GM1, A can only obtain the messages transmitted on the public channel. After GM1, A will query the session key SK through the test, but A cannot obtain five values N1,N2,N3,HIDi,HIDj, so the probability that GM0 is equal to that of GM1 is(35)PrSuccAGM1=PrSuccAGM0.GM2: GM2 adds a send query to GM1. According to Zipf’s law [38], we obtain(36)PrSuccAGM2−PrSuccAGM1≤qsend/2l.GM3: GM3 adds the hash query to GM2. The maximum probability of text collision in transmission is qexe+qsend2/2p, and we can obtain(37)PrSuccAGM3−PrSuccAGM2≤qexe+qsend22p+qhash22l+1.GM4: in this round, we verify the security of the session key SK using two events. One is to obtain the long-term key of ΠCSz to verify the perfect forward security, and the other is to obtain temporary information to verify that the protocol can resist the known session-specific temporary information attacks.(1
)Perfect forward security: usingΠCSz, A attempts to obtain the private key KCS of CS, or A uses ΠVix or ΠFNjy to obtain some secret values in the registration phase.(2)
Known session-specific temporary information attacks:A uses one of ΠVix or ΠFNjy or ΠCSz to attempt to obtain temporary information.For the first event, ifA obtains the private key KCS of CS, or the secret value of ΠVix and ΠFNjy in the registration phase, but A cannot get the random number N1,N2,N3,HIDj, it cannot calculate session key SK, where SK=hN1⊕N2⊕N3⊕HIDi⊕HIDj. For the second event, if A can obtain N1, but the values of N2 and N3 are confidential, the SK cannot be calculated. Similarly, if N2 and N3 are leaked, SK cannot be calculated by A. Therefore, the probability of this round is(38)PrSuccAGM4−PrSuccAGM3≤qhash22l+1.GM5: in this round of the game, A uses the corrupt query to obtain the parameter αi,Pi,ri,KV stored in the smart card, so A wants to conduct the offline key guessing attacks. Vi uses random numbers and passwords for registration, so A must guess Pi=hIDi‖PSWi‖ri, but the probability of guessing a random number is 1/2l, which can be ignored. Using Zipf’s law [38], we can obtain(39)PrSuccAGM5−PrSuccAGM4≤maxC′⋅qsends′,qsend2l.GM6: this round of the game is to verify that protocol P can resist the impersonation attacks, A uses hN1⊕N2⊕N3⊕HIDi⊕HIDj to query, and the game is terminated. Therefore, the probability that A can guess SK is(40)PrSuccAGM6−PrSuccAGM5≤qhash22l+1.Because the probability of success and failure of theGM6 is 1/2,(41)12AdvAP=PrSuccAGM0−12=PrSuccAGM0−PrSuccAGM6=PrSuccAGM1−PrSuccAGM6≤∑i=05PrSuccAGMi+1−PrSuccAGMi=qsend2l+3qhash22l+1+maxC′⋅qsends′,qsend2l+qhash+qsend22p.Finally, we can obtain(42)AdvAP≤qsend2l−1+3qhash22l+2maxC′⋅qsends′,qsend2l+qexe+qsend2p.


## 4.3. ProVerif

ProVerif is a formal automatic verification tool, which can verify confidentiality, identity, anonymity, and so on [39, 40]. In this paper, we use the ProVerif code to achieve vehicle registration, fog node registration, and authentication between the two parties and the CS and verify the security and effectiveness of our proposed protocol through ProVerif.ProVerif demonstrates that the specific operation works as follows. Our protocol includes three entities: vehicle, fog node, and cloud server. The symbols and operation definitions used in ProVerif are shown in Figure5.Figure 5
The definition in the ProVerif tool.The proof contains six events, as shown in Figure6. The six events are veclestarted (), vecleauthored (), cloudserveracvehicle (), cloudserveracfognode (), fognodeaccloudserver (), and vecleaccloudserver (), indicating that the vehicle starts certification, the vehicle completes certification, the cloud server completes the vehicle certification, and the cloud server completes the fog node certification, respectively. The fog node completed the certification of the cloud server, and the vehicle completed the certification of the cloud server.Figure 6
Process in the ProVerif tool.Then, we use ProVerif to query whetherA can calculate the session key SK through the data transmitted on the common channel. The query operation is shown in Figure 7.Figure 7
Queries and events in the ProVerif tool.Finally, we get the verification result using the ProVerif tool, as shown in Figure8. The result shows that A cannot calculate the session key SK of the Vi, FNj, and CS.Figure 8
Results in the ProVerif tool.


## 4.4. Informal Security Analysis

This part is an informal security analysis of our proposed agreement. We have proved that the protocol can meet common security requirements. The specific proof is as follows.


### 4.4.1. Mutual Authentication

In the authentication phase, with the help ofCS, mutual authentication between Vi and FNj is realized. V1 in message M1 is the value CS uses to authenticate Vi, V2 in message M2 is the value CS uses to authenticate FNj, and V3 and V4 in message M3 are the values CS uses to authenticate FNj and Vi, respectively. Therefore, the mutual authentication among Vi, FNj, and CS is realized in the authentication phase.


### 4.4.2. Replay Attacks

In this protocol, we use cumulative valueKV to resist replay attacks. In the Vi registration phase, we initialize KV to 0. As the session progresses, it carries out +1 operation on the value KV, saves it to its database after CS authenticates Vi, FNj, and carries out the necessary calculation. After CS authenticates Vi and generates the session key, it also carries out the +1 operation on the value KV and saves it to the smart card. In this manner, KV on both sides is synchronous and equal, and the session process is completed smoothly. If A repeatedly sends message M1 intercepted in the public channel, CS continues to calculate the value KV+1 in the authentication phase. Value V4 generated using KV is not equal to value V4 calculated by Vi using KV stored in its smart card, because the value KV in the smart card of Vi cannot keep up with the CS update speed, so the authentication fails. Thus, our protocol can resist replay attacks.


### 4.4.3. Man-in-the-Middle Attacks

Suppose thatA can intercept the message M1=A1,V1,IDCS,PIDi transmitted on the public channel between Vi and FNj. Since A cannot obtain the information αi,KV,ri in the smart card and the identity IDi of Vi, A cannot calculate the values KV,HIDi,N1 required for V1, where V1=hHIDi‖KV⊕N1. Therefore, after A tampers with M1, it cannot pass the authentication of FNj. Similarly, because the privacy value is unknown, A cannot calculate the authentication value V2, V3, or V4 and cannot complete the verification after intercepting the information M2, M3, or M4. Therefore, our protocol can resist man-in-the-middle attacks.


### 4.4.4. User Anonymity

The real identities ofVi and FNj are transmitted on the secure channel and are protected by pseudoidentity PIDi and PFIDj in the authentication phase. The anonymity of Vi and FNj is ensured. Therefore, our protocol can provide user anonymity.


### 4.4.5. Untraceability

IfA wants to trace the Vi, it intercepts the messages M1,M2,M3,M4 transmitted on the common channel. Since the random numbers N1,N2,N3 are used, this means that messages M1,M2,M3,M4 are different during each session. In addition, A cannot obtain the random numbers N1,N2,N3, so A cannot be traced back to Vi. Therefore, our protocol can provide untraceability.


## 4.4.1. Mutual Authentication

In the authentication phase, with the help ofCS, mutual authentication between Vi and FNj is realized. V1 in message M1 is the value CS uses to authenticate Vi, V2 in message M2 is the value CS uses to authenticate FNj, and V3 and V4 in message M3 are the values CS uses to authenticate FNj and Vi, respectively. Therefore, the mutual authentication among Vi, FNj, and CS is realized in the authentication phase.


## 4.4.2. Replay Attacks

In this protocol, we use cumulative valueKV to resist replay attacks. In the Vi registration phase, we initialize KV to 0. As the session progresses, it carries out +1 operation on the value KV, saves it to its database after CS authenticates Vi, FNj, and carries out the necessary calculation. After CS authenticates Vi and generates the session key, it also carries out the +1 operation on the value KV and saves it to the smart card. In this manner, KV on both sides is synchronous and equal, and the session process is completed smoothly. If A repeatedly sends message M1 intercepted in the public channel, CS continues to calculate the value KV+1 in the authentication phase. Value V4 generated using KV is not equal to value V4 calculated by Vi using KV stored in its smart card, because the value KV in the smart card of Vi cannot keep up with the CS update speed, so the authentication fails. Thus, our protocol can resist replay attacks.


## 4.4.3. Man-in-the-Middle Attacks

Suppose thatA can intercept the message M1=A1,V1,IDCS,PIDi transmitted on the public channel between Vi and FNj. Since A cannot obtain the information αi,KV,ri in the smart card and the identity IDi of Vi, A cannot calculate the values KV,HIDi,N1 required for V1, where V1=hHIDi‖KV⊕N1. Therefore, after A tampers with M1, it cannot pass the authentication of FNj. Similarly, because the privacy value is unknown, A cannot calculate the authentication value V2, V3, or V4 and cannot complete the verification after intercepting the information M2, M3, or M4. Therefore, our protocol can resist man-in-the-middle attacks.


## 4.4.4. User Anonymity

The real identities ofVi and FNj are transmitted on the secure channel and are protected by pseudoidentity PIDi and PFIDj in the authentication phase. The anonymity of Vi and FNj is ensured. Therefore, our protocol can provide user anonymity.


## 4.4.5. Untraceability

IfA wants to trace the Vi, it intercepts the messages M1,M2,M3,M4 transmitted on the common channel. Since the random numbers N1,N2,N3 are used, this means that messages M1,M2,M3,M4 are different during each session. In addition, A cannot obtain the random numbers N1,N2,N3, so A cannot be traced back to Vi. Therefore, our protocol can provide untraceability.


## 5. Security and Performance Comparisons

In this part, we compare our protocol with those of Ma et al. [10], Wazid et al. [34], Eftekhari et al. [9], and Wu et al. [32] in terms of security, computational cost, and communication cost.


### 5.1. Security Comparisons

When comparing protocol security, we use ✔ to indicate that the protocol can resist the attacks and× to indicate that the protocol cannot resist the attacks. The results of comparing protocol security are shown in Table 3. It can be seen that our protocol can resist known attacks and have better security. Ma et al.’s protocol [10] cannot provide user anonymity and untraceability and is vulnerable to impersonation attacks and known session-specific temporary information attacks. The protocols in [9, 32, 34] and our protocol are secure.Table 3
Comparisons of security.
Security properties[10][34][9][32]OursMutual authentication✔✔✔✔✔User anonymity×✔✔✔✔Perfect forward secrecy✔—✔✔✔Man-in-the-middle attacks✔——✔✔Impersonation attacks✔✔✔✔✔Known session-specific temporary information attacks×—✔✔✔Untraceability×✔✔✔✔Offline password guessing attacks✔✔—✔✔Replay attacks✔✔✔✔✔


### 5.2. Performance Comparison

Performance analysis is conducted from the aspects of computational cost and communication cost. We analyze and compare the computational cost from the login authentication phase of each protocol. The computational cost of XOR and join operations is negligible. The computational cost comparison is shown in Table4. It is obvious that the protocols of Ma et al. [10], Wazid et al. [34], Eftekhari et al. [9], and Wu et al. [32] perform point multiplication, Wazid et al. [34] and Wu et al. [32] perform fuzzy extraction, and Wazid et al.’s protocol [34] and Eftekhari et al. [9] also perform ECC point addition. Only our proposed protocol performs the hash operation, so its computational cost is less.Table 4
Computational cost comparison.
ProtocolViFNjCSTotalMa et al. [10]3Tpm+4Th4Tpm+4Th10Tpm+11Th17Tpm+19ThWazid et al. [34]3Tpm+2Tf+22Th2Tpm+Tpa+14Th3Th5Tpm+2Tpa+2Tf+43ThEftekhari et al. [9]3Tpm+Tpa+11Th3Tpm+Tpa+12Th3Tpm+2Tpa+15Th9Tpm+4Tpa+38ThWu et al. [32]2Tpm+Tf+8Th4Tpm+5Th4Tpm+13Th10Tpm+Tf+26ThOurs7Th5Th11Th23ThHere,Tpm represents the time taken to perform a point multiplication operation, Tpa represents the time taken to execute an ECC point addition, Tf represents the time taken to execute a fuzzy extraction function, and Th represents the time taken to execute a hash operation.In the comparison of communication cost, we assume that the length of the identity and the random number are 160 bits, the length of the timestamp is 32 bits, the length of the one-way hash function is 256 bits, and the length of ECC point is 320 bits. Therefore, based on our assumption, the communication costs of the protocols of Ma et al. [10], Wazid et al. [34], Eftekhari et al. [9], and Wu et al. [32] are 4512 bits, 3488 bits, 4416 bits, and 4448 bits. Here, we illustrate our protocol as an example to show the specific analysis. In our protocol, the messages transmitted in the login authentication phase are M1=A1,V1,IDCS,PIDi, M2=A2,V1,V2,PFIDj,PIDi, M3=NX′,NY′,V3,V4, and M4=NX′,V4, where A1,A2,NX′,NY′ are random strings, IDCS is an identity, and V1,V2,V3,V4,PFIDj,PIDi are hash values. Therefore, the total communication cost of our proposed protocol is 2336 bits. The comparison of communication cost is shown in Table 5. Obviously, the communication cost of our proposed protocol is less.Table 5
Communication cost comparison.
ProtocolRoundCommunication cost (bits)Ma et al. [10]44512Wazid et al. [34]33488Eftekhari et al. [9]44416Wu et al. [32]44448Ours42336In the security comparison, we found that Ma et al.’s protocol [10] cannot provide user anonymity and untraceability and is vulnerable to impersonation attacks and known session-specific temporary information attacks. Although the protocols of [9, 32, 34] can resist known security attacks, the overhead in the aspect of computational cost and communication cost is much more than that of our proposed protocol. Therefore, our protocol is better in terms of security and performance.


## 5.1. Security Comparisons

When comparing protocol security, we use ✔ to indicate that the protocol can resist the attacks and× to indicate that the protocol cannot resist the attacks. The results of comparing protocol security are shown in Table 3. It can be seen that our protocol can resist known attacks and have better security. Ma et al.’s protocol [10] cannot provide user anonymity and untraceability and is vulnerable to impersonation attacks and known session-specific temporary information attacks. The protocols in [9, 32, 34] and our protocol are secure.Table 3
Comparisons of security.
Security properties[10][34][9][32]OursMutual authentication✔✔✔✔✔User anonymity×✔✔✔✔Perfect forward secrecy✔—✔✔✔Man-in-the-middle attacks✔——✔✔Impersonation attacks✔✔✔✔✔Known session-specific temporary information attacks×—✔✔✔Untraceability×✔✔✔✔Offline password guessing attacks✔✔—✔✔Replay attacks✔✔✔✔✔


## 5.2. Performance Comparison

Performance analysis is conducted from the aspects of computational cost and communication cost. We analyze and compare the computational cost from the login authentication phase of each protocol. The computational cost of XOR and join operations is negligible. The computational cost comparison is shown in Table4. It is obvious that the protocols of Ma et al. [10], Wazid et al. [34], Eftekhari et al. [9], and Wu et al. [32] perform point multiplication, Wazid et al. [34] and Wu et al. [32] perform fuzzy extraction, and Wazid et al.’s protocol [34] and Eftekhari et al. [9] also perform ECC point addition. Only our proposed protocol performs the hash operation, so its computational cost is less.Table 4
Computational cost comparison.
ProtocolViFNjCSTotalMa et al. [10]3Tpm+4Th4Tpm+4Th10Tpm+11Th17Tpm+19ThWazid et al. [34]3Tpm+2Tf+22Th2Tpm+Tpa+14Th3Th5Tpm+2Tpa+2Tf+43ThEftekhari et al. [9]3Tpm+Tpa+11Th3Tpm+Tpa+12Th3Tpm+2Tpa+15Th9Tpm+4Tpa+38ThWu et al. [32]2Tpm+Tf+8Th4Tpm+5Th4Tpm+13Th10Tpm+Tf+26ThOurs7Th5Th11Th23ThHere,Tpm represents the time taken to perform a point multiplication operation, Tpa represents the time taken to execute an ECC point addition, Tf represents the time taken to execute a fuzzy extraction function, and Th represents the time taken to execute a hash operation.In the comparison of communication cost, we assume that the length of the identity and the random number are 160 bits, the length of the timestamp is 32 bits, the length of the one-way hash function is 256 bits, and the length of ECC point is 320 bits. Therefore, based on our assumption, the communication costs of the protocols of Ma et al. [10], Wazid et al. [34], Eftekhari et al. [9], and Wu et al. [32] are 4512 bits, 3488 bits, 4416 bits, and 4448 bits. Here, we illustrate our protocol as an example to show the specific analysis. In our protocol, the messages transmitted in the login authentication phase are M1=A1,V1,IDCS,PIDi, M2=A2,V1,V2,PFIDj,PIDi, M3=NX′,NY′,V3,V4, and M4=NX′,V4, where A1,A2,NX′,NY′ are random strings, IDCS is an identity, and V1,V2,V3,V4,PFIDj,PIDi are hash values. Therefore, the total communication cost of our proposed protocol is 2336 bits. The comparison of communication cost is shown in Table 5. Obviously, the communication cost of our proposed protocol is less.Table 5
Communication cost comparison.
ProtocolRoundCommunication cost (bits)Ma et al. [10]44512Wazid et al. [34]33488Eftekhari et al. [9]44416Wu et al. [32]44448Ours42336In the security comparison, we found that Ma et al.’s protocol [10] cannot provide user anonymity and untraceability and is vulnerable to impersonation attacks and known session-specific temporary information attacks. Although the protocols of [9, 32, 34] can resist known security attacks, the overhead in the aspect of computational cost and communication cost is much more than that of our proposed protocol. Therefore, our protocol is better in terms of security and performance.


## 6. Conclusions

In this paper, we first review the AKE protocol inIoV and SIoV, and then, we propose a lightweight and authenticated key agreement protocol using fog nodes. The security analysis of the protocol is conducted by using BAN, ROR, and ProVerif. The comparison of security and performance shows that the protocol achieves higher performance in terms of computing power and communication cost compared with other protocols. In future research, we will focus on improving the security and performance of the protocol in SIoV.



---

*Source: 3277113-2021-11-17.xml*