# TFPPASV: A Three-Factor Privacy Preserving Authentication Scheme for VANETs

Authors: Zongtao Duan; Jabar Mahmood; Yun Yang; Michael Abebe Berwo; Abd al Kader Ahmed Yassin; Muhammad Nasir Mumtaz Bhutta; Shehzad Ashraf Chaudhry
Journal: Security and Communication Networks
 (2022)

---

## Abstract

A vehicular ad hoc network (VANET) is essential for the autonomous vehicle industry, and with the advancement in VANET technology, security threats are increasing rapidly. Mitigation of these threats needs an intelligent security protocol that provides unbreakable security. In recent times, various three-factor authentication solutions for VANET were introduced that adopt the centralized Trusted AuthorityTA, which is responsible for assigning authentication parameters during vehicle registration, and the authentication process depends on these parameters. This article first explains the vulnerabilities of the recent three-factor (3F) authentication scheme presented by Xu et al. Our analysis proves that if an RSU is dishonest, it can easily bypass the TA and can create a session with OBU. Furthermore, this paper puts forward a new scheme that provides the 3F authentication for VANETs (TFPPASV) to resist RSU from bypassing the TA and to offer user privacy. The proposed scheme fulfills the security and performance requirements of the VANET. We use BAN-Logic analysis to perform a formal security analysis of the proposed scheme, in addition to the informal security feature discussion. Finally, we compare the security and performance of the proposed TFPPASV with some recent and related schemes.


---

## Body

## 1. Introduction

Due to its dynamic structure and related advantages including the realization of autonomous cars, increased road safety, congestion avoidance, and so on, the vehicular ad hoc networks (VANETs) are getting more popularity and are being considered as the only vehicular network structure of the future. In recent years, the road travel safety is also being considered as most important factor for transportation industry and accordingly several technologies are being developed. A general model of vehicular ad hoc network (VANET) [1–3] is given in Figure 1. VANET is a subbranch of MANETs; intelligent transportation system (ITS) [4] provides support to manage transportation efficiently on roads. VANET consists of three parts [5]. (i) On-board unit OBU [6]: OBU is installed inside the vehicle at the time of manufacture from the company side. The OBU stores the information related to vehicle identity, vehicle password, and other parameters necessary for registration and communication; without this confidential information, the vehicle cannot communicate to other OBUs or road side unit RSU [2]. OBU communicates to other OBUs or RSUs on the road using the dedicated short range communication (DSRC) protocol [7–9]. (ii) RSU is fixed alongside the road; RSU has more computational and communication power than OBU. RSU provides the facilities to OBUs to communicate with other OBUs or to communicate with RSU via DSRC. In addition, OBU wants to communicate with Trusted Authority TA [2]. RSU acts as a mediator between OBU and TA, where the communication among RSU and TA is carried over some wired or wireless channel. (iii) TA provides authentication parameters to facilitate communication among various entities in a VANET. TA is responsible for completing all node authentication. VANETs provide more comfortable and reliable facilities to passengers and drivers on the road, such as infotainment, weather conditions, location information, traffic congestion, and so on. These services aim to provide a safe drive and secure human life on the road and proper energy resource utilization. Due to VANET’s openness characteristics, many security threats are faced during communication. Avoiding these security threats needs a secure authentication scheme that provides resilience against all such threats.Figure 1
General model of VANETs.


### 1.1. Motivation

In recent past, many researchers proposed various authentication schemes for VANETs, but many of these schemes do not fulfill the security requirements and are having insecurities against various threats. In addition, some of these schemes have high computational and communication costs. Due to these limitations, we propose a three-factor authentication scheme and key agreement for VANETs. In our scheme,RSU and TA perform authentication processes. RSU reduces the TA computational and communication cost and performs the authentication. In the proposed scheme, TA hands over a smart card (SC) to each registering vehicle. Inside the SC, TA stores confidential information such as the biological information of the vehicle to provide better security. The proposed scheme provides the facilities to identify malicious vehicle in a multi-drive environment.


### 1.2. Contributions

The contributions of this study are as follows:(1)
Firstly, we reviewed and revealed that Xu et al.’s authentication scheme for IoV is insecure against TA bypassing attack. Additionally, an improved scheme titled “TFPPASV: A Three-Factor Privacy Preserving Authentication Scheme for VANETs” is proposed.(2)
Secondly, the security of the proposed TFPPASV scheme is proved using BAN-Logic in addition to the informal discussion on critical security feature provision of the proposed TFPPASV scheme.(3)
We also provided a comparative security and performance analysis of the proposed TFPPASV with some related and recent authentication schemes.


### 1.3. Organization

The remaining structure of the paper is organized as follows. Section2 describes the preliminaries such as elliptic curve cryptography, fuzzy extractor, network model, and attack model. Section 3 provides the summary of the related work, and Section 4 details the previously published Xu et al.’s scheme [10]. Section 5 summarizes the weaknesses of Xu et al.’s scheme. In Section 6, the proposed TFPPASV is explained briefly. Section 7 analyzes the BAN-Logic-based security proof of the proposed TFPPASV, in addition to the security feature discussion under various attacks. In Section 8, we conduct security and performance comparisons with related schemes. Finally, a conclusion is provided in Section 9.


## 1.1. Motivation

In recent past, many researchers proposed various authentication schemes for VANETs, but many of these schemes do not fulfill the security requirements and are having insecurities against various threats. In addition, some of these schemes have high computational and communication costs. Due to these limitations, we propose a three-factor authentication scheme and key agreement for VANETs. In our scheme,RSU and TA perform authentication processes. RSU reduces the TA computational and communication cost and performs the authentication. In the proposed scheme, TA hands over a smart card (SC) to each registering vehicle. Inside the SC, TA stores confidential information such as the biological information of the vehicle to provide better security. The proposed scheme provides the facilities to identify malicious vehicle in a multi-drive environment.


## 1.2. Contributions

The contributions of this study are as follows:(1)
Firstly, we reviewed and revealed that Xu et al.’s authentication scheme for IoV is insecure against TA bypassing attack. Additionally, an improved scheme titled “TFPPASV: A Three-Factor Privacy Preserving Authentication Scheme for VANETs” is proposed.(2)
Secondly, the security of the proposed TFPPASV scheme is proved using BAN-Logic in addition to the informal discussion on critical security feature provision of the proposed TFPPASV scheme.(3)
We also provided a comparative security and performance analysis of the proposed TFPPASV with some related and recent authentication schemes.


## 1.3. Organization

The remaining structure of the paper is organized as follows. Section2 describes the preliminaries such as elliptic curve cryptography, fuzzy extractor, network model, and attack model. Section 3 provides the summary of the related work, and Section 4 details the previously published Xu et al.’s scheme [10]. Section 5 summarizes the weaknesses of Xu et al.’s scheme. In Section 6, the proposed TFPPASV is explained briefly. Section 7 analyzes the BAN-Logic-based security proof of the proposed TFPPASV, in addition to the security feature discussion under various attacks. In Section 8, we conduct security and performance comparisons with related schemes. Finally, a conclusion is provided in Section 9.


## 2. Preliminaries

This section describes the elliptic curve cryptography (ECC), fuzzy extraction, network model, and attack model used in the proposed TFPPASV. Moreover, Table1 provides the notation used in this paper.Table 1
List of notations.
NotationsDescription of notationsTA,OBUTrusted authority, on-board unitRSURoad side unitV2V,V2IVehicle to vehicle, vehicle to infrastructureIoVInternet of vehiclexRSU and TA private keyPpubTA public keyAAn adversaryTPDTemper proof deviceWiBiometric Information ofUiαThe random biometric secret key ofUiβThe public reproduction parameter ofUiGAn elliptic curve cycle additive groupPA generator ofGpOrder ofGSCSmart cardUiith userst0,t1,t2Timestampyi,r,kRandom numberIDiThe identity of vehicle/userUiPWiThe password of vehicle/userUiAi,Ci,Di,EiTA-generated Ui parametersh.One-way cryptography hash function⊕XOR operation


### 2.1. Elliptic Curve Cryptography

The concept of elliptic curve cryptography (ECC) was presented by Miller and Koblitz in 1985 [11]. ECC is an asymmetric cryptography technique and the following are details related to ECC.Characteristics of ECC:(i)
In ECC, the key generation time is faster than other cryptographic techniques.(ii)
The size of the ECC key is small and provides the same security, for example, RSA key size is 1024-bit and ECC key size is 160-bit.Currently, ECC is used in various authentication schemes, devices, and applications such as VANETs, wireless sensor networks, mobiles, RFID devices, bitcoin, and safe web browsers through SSL/TLS due to its small key size. In this paper, we also used the ECC for a secure scheme. Here, we describe the basics of ECC.The ECC equationE:y2=x3+ix+jmodp is used to describe the mathematical operations, where i,j∈RZp∗ and 4i3+27j2modp≠0 such that p is a large prime number P≥2160. Here, we discuss two computationally intensive problems along with a trapdoor function (TF) role in ECC.(i)
TF is defined as a function that is a one-way function easy to compute in one direction but if computing in the reverse direction is computationally difficult, every public key cryptography has its TF.(ii)
Elliptic curve discrete logarithm problem (ECDLP): LetU=kV and k<n, if V and k are known, U can be computed easily, whereas, it is computationally difficult to compute k such that k∈RZp∗, if U and V are known.(iii)
Elliptic curve computational Diffie–Hellman problem (ECCDHP): letU=aP and V=bP be two points on E and a,b∈RZp∗. It is computationally hard to calculate the W=abP point, provided that a, b are unknown.


### 2.2. Fuzzy Extractor

Authentication through complex passwords is not a better idea for secure registration on an insecure channel. A good technique for secure registration is biometric template, for example, heartbeat, fingerprint, and iris templates are usually used for authentication.The characteristics of the biometric key are given below:(i)
Biometric keys are unique and these are not easy to replicate.(ii)
No need to store or memorize because it comes from the user’s body.(iii)
No duplicate keys are generated.(iv)
Cannot be estimated or guessed.(v)
Challenging to reprint and distribute.Biometrics using raw data are not safe, and thus the biometric data must be stored safely in the system. Various security methods are developed to save the biometric information, such as fuzzy extractor and bio-hash function. They mostly used the fuzzy extractor because the bio-hash function faces the denial of service attack.The fuzzy extractor has been widely used in an authentication scheme for extracting the biometric key.The fuzzy extractor has two processes with the following parametersW,l,t where W is the input string.(i)
Gen(.) is a probability generation procedure. In this procedure, inputW is the biometric information from the user, α is a random secret key of the length of l, and β is a public string extracted from the input W, and (1) describes the procedure of generation key.(1)GenW=α,β.(ii)
Rep (.) is the process of reproduction and in this procedure, and R can be retrieved as per biometric informationW′ close to W and β. (2) describes the procedure of reproduction key. For all W, W′, if dW,W′≥t, there is (2) under precondition (1), where dW,W′≥t represent the distance between W and W′ which should not be greater than l.(2)α=RepW′,β.Here, we define the fuzzy extractor.(iii)
In (3), there is a high probability that the distance between two biometric values W and W′ generated from the same entity is low, which can be described as(3)PrdisW,W′<t≥1−ϵfn,wheret is the predetermined tolerance threshold and “false negative” probability is ϵfn.(iv)
There is a high probability that the distance between two biometric values,W1, W2, for two entities is high, which is described in the following equation:(4)PrdisW,W′<t≥1−ϵfn,wheret′ < t and ϵfp is the probability of “false positive.”


### 2.3. Network Model

The network model of the proposed security scheme is presented in Figure2.Figure 2
Proposed scheme network model.TA: TA is an autonomous or fully trusted entity in VANET responsible for system initialization and registration of a vehicle or a user. TA has more resources in the shape of communication and computational cost. It knows about all RSUs′ locations and identities. It issues the parameters to the nodes in VANET and transmits via a secure channel to each node.RSU: RSU is fixed alongside the road and is equipped with temper proof deviceTPD. TPD is responsible for storing data and performing encryption operations on data. RSU communicates with TA via wired or wireless channels and OBU via DSCR protocol. RSU holds information about all registered vehicles in the range of RSU. In addition, RSU shares information with authenticated vehicles via a session key created during authentication.OBU: each vehicle has its OBU device fixed inside it and stores all confidential information integral for OBU to prove its authenticity. OBU links to RSU via DSRC protocol. Before communication, OBU proves their authenticity; if OBU proves that it is authenticated, then it communicates with RSU; otherwise, it stops the session key generation.


### 2.4. Attack Model

In this paper, we consider the common DY adversarial model with following description:(1)
An adversaryA plays the role of an eavesdropper, who easily eavesdrops on the insecure communication link and can modify/change or replay the message or send a new message on the link. A can also stop/remove a message from the communication link.(2)
IfA gets the vehicle smart card (SC), he can quickly get all the confidential information stored in SC.(3)
TA is assumed to be secure. Precisely, except the private key of the TA, rest of the parameters stored on TA could be exposed to A.(4)
TPD is an important temper proof device because the authenticated data of RSU are stored inside the TPD. Suppose E captures the TPD; it cannot extract the data from the TPD.


## 2.1. Elliptic Curve Cryptography

The concept of elliptic curve cryptography (ECC) was presented by Miller and Koblitz in 1985 [11]. ECC is an asymmetric cryptography technique and the following are details related to ECC.Characteristics of ECC:(i)
In ECC, the key generation time is faster than other cryptographic techniques.(ii)
The size of the ECC key is small and provides the same security, for example, RSA key size is 1024-bit and ECC key size is 160-bit.Currently, ECC is used in various authentication schemes, devices, and applications such as VANETs, wireless sensor networks, mobiles, RFID devices, bitcoin, and safe web browsers through SSL/TLS due to its small key size. In this paper, we also used the ECC for a secure scheme. Here, we describe the basics of ECC.The ECC equationE:y2=x3+ix+jmodp is used to describe the mathematical operations, where i,j∈RZp∗ and 4i3+27j2modp≠0 such that p is a large prime number P≥2160. Here, we discuss two computationally intensive problems along with a trapdoor function (TF) role in ECC.(i)
TF is defined as a function that is a one-way function easy to compute in one direction but if computing in the reverse direction is computationally difficult, every public key cryptography has its TF.(ii)
Elliptic curve discrete logarithm problem (ECDLP): LetU=kV and k<n, if V and k are known, U can be computed easily, whereas, it is computationally difficult to compute k such that k∈RZp∗, if U and V are known.(iii)
Elliptic curve computational Diffie–Hellman problem (ECCDHP): letU=aP and V=bP be two points on E and a,b∈RZp∗. It is computationally hard to calculate the W=abP point, provided that a, b are unknown.


## 2.2. Fuzzy Extractor

Authentication through complex passwords is not a better idea for secure registration on an insecure channel. A good technique for secure registration is biometric template, for example, heartbeat, fingerprint, and iris templates are usually used for authentication.The characteristics of the biometric key are given below:(i)
Biometric keys are unique and these are not easy to replicate.(ii)
No need to store or memorize because it comes from the user’s body.(iii)
No duplicate keys are generated.(iv)
Cannot be estimated or guessed.(v)
Challenging to reprint and distribute.Biometrics using raw data are not safe, and thus the biometric data must be stored safely in the system. Various security methods are developed to save the biometric information, such as fuzzy extractor and bio-hash function. They mostly used the fuzzy extractor because the bio-hash function faces the denial of service attack.The fuzzy extractor has been widely used in an authentication scheme for extracting the biometric key.The fuzzy extractor has two processes with the following parametersW,l,t where W is the input string.(i)
Gen(.) is a probability generation procedure. In this procedure, inputW is the biometric information from the user, α is a random secret key of the length of l, and β is a public string extracted from the input W, and (1) describes the procedure of generation key.(1)GenW=α,β.(ii)
Rep (.) is the process of reproduction and in this procedure, and R can be retrieved as per biometric informationW′ close to W and β. (2) describes the procedure of reproduction key. For all W, W′, if dW,W′≥t, there is (2) under precondition (1), where dW,W′≥t represent the distance between W and W′ which should not be greater than l.(2)α=RepW′,β.Here, we define the fuzzy extractor.(iii)
In (3), there is a high probability that the distance between two biometric values W and W′ generated from the same entity is low, which can be described as(3)PrdisW,W′<t≥1−ϵfn,wheret is the predetermined tolerance threshold and “false negative” probability is ϵfn.(iv)
There is a high probability that the distance between two biometric values,W1, W2, for two entities is high, which is described in the following equation:(4)PrdisW,W′<t≥1−ϵfn,wheret′ < t and ϵfp is the probability of “false positive.”


## 2.3. Network Model

The network model of the proposed security scheme is presented in Figure2.Figure 2
Proposed scheme network model.TA: TA is an autonomous or fully trusted entity in VANET responsible for system initialization and registration of a vehicle or a user. TA has more resources in the shape of communication and computational cost. It knows about all RSUs′ locations and identities. It issues the parameters to the nodes in VANET and transmits via a secure channel to each node.RSU: RSU is fixed alongside the road and is equipped with temper proof deviceTPD. TPD is responsible for storing data and performing encryption operations on data. RSU communicates with TA via wired or wireless channels and OBU via DSCR protocol. RSU holds information about all registered vehicles in the range of RSU. In addition, RSU shares information with authenticated vehicles via a session key created during authentication.OBU: each vehicle has its OBU device fixed inside it and stores all confidential information integral for OBU to prove its authenticity. OBU links to RSU via DSRC protocol. Before communication, OBU proves their authenticity; if OBU proves that it is authenticated, then it communicates with RSU; otherwise, it stops the session key generation.


## 2.4. Attack Model

In this paper, we consider the common DY adversarial model with following description:(1)
An adversaryA plays the role of an eavesdropper, who easily eavesdrops on the insecure communication link and can modify/change or replay the message or send a new message on the link. A can also stop/remove a message from the communication link.(2)
IfA gets the vehicle smart card (SC), he can quickly get all the confidential information stored in SC.(3)
TA is assumed to be secure. Precisely, except the private key of the TA, rest of the parameters stored on TA could be exposed to A.(4)
TPD is an important temper proof device because the authenticated data of RSU are stored inside the TPD. Suppose E captures the TPD; it cannot extract the data from the TPD.


## 3. Related Work

Due to dynamicity of VANETs environment, communication process deviates from other networks. VANET communication in smart cities faces various security threats such as eavesdropping, tracking, and positioning. Security and anonymity provisions are required to avoid these issues. Zheng et al. [12] proposed a VANETs authentication scheme for smart cities. Zhang et al.'s scheme uses certificateless group signature and the Elliptic curve scalar multiplication operations. Zheng et al. [12] proved that overhead cost of their scheme is less than Chen et al. 's [13] and Zhao et al.'s [14] schemes. However, they failed to provide the security analysis of the proposed scheme.Two-factor security authentication protocols in VANETs are mainly accepted and used for authentication betweenV2V and V2I on the insecure communication channel. In recent years, various two-factor authentication schemes were proposed, but most of these schemes are vulnerable to one or more weaknesses including SC loss, impersonation assaults, and offline password guessing assaults. Qu and Tan. [15] proposed a password based remote user authentication with key agreement scheme using ECC. Qu and Tan [15] proved that their proposed scheme provides security against various known security threats, but they did not provide the communication cost, running time, and overhead cost of their scheme.Nandy et al. [16] proposed an authentication scheme using ECC. Nandy et al. [16] proved through security analysis that the proposed scheme provides security against several VANET security attacks. Nevertheless, Chaudhry [17] proved that the ECC techniques used by Nandy et al. involve a faulty operation and their scheme cannot compute the private key of the vehicles. Therefore, their scheme cannot complete the authentication process in their described manner.Chuang and Lee [18] proposed a security scheme called TEAM in 2013 for V2V secure communication. In TEAM, TA is only for initialization and vehicle registration, which reduces the computational cost of TA. However, Zhou et al. [19] in 2017 highlighted the weakness of the Chuang and Lee’s scheme [18] and proved that it cannot perform against inside assaults such as impersonation assaults. Thus, Zhou et al. [19] proposed an authentication scheme that removes the weakness of Chuang and Lee’s scheme [18]. In 2019, Wu et al. [20] revealed the weakness of Zhou et al.’s scheme [19] and proved that it cannot perform against impersonation assault, identity guessing assault, and vehicle anonymity. Wu et al. [20] proposed a scheme for V2V secure communication through mutual authentication.In 2020, Vasudev et al. [21] proposed a security scheme related to mutual authentication between V2V of IoV and proved that it worked against various VANET attacks through informal security analysis. However, they did not provide a formal security analysis of the scheme. In 2021, Mahmood et al. [22] highlighted its weakness and proved that it does not work in dense environments if more than one vehicle is registered. Thus, Mahmood et al. [22] proposed a new scheme that removes the weakness of Vasudev et al. [21] and proved it through formal analysis and informal analysis.The main issue faced in VANETs is the provision of security to the user on the road because the nature of VANETs is different from the other communication networks. Therefore, more focus on the secure and authentication process is mandatory to avoid the VANET threats. In 2016, Jiang et al. [23] proposed a scheme related to WSN and implemented the three-factor authentication mechanism and proved that it works better than other schemes. However, in 2017, Li et al. [24] pointed out the functional and security flaws in Jiang et al.’s [23] scheme and proposed a new scheme for WSN. Li et al. [24] removed the flaws of the Jiang et al.'s scheme and proved through formal and informal security analysis that their proposed scheme provides correctness and incures less computation and communication cost than other schemes. However, they did not provide the running time of the proposed scheme.Wang et al. [25] proposed a two-factor authentication scheme for vehicular ad hoc networks. The scheme aims to provide lightweight authentication and parallel security against various security threats such as denial of service attacks that cause traffic jamming. Wang et al.’s [25] scheme provides biometric security to vehicles; thus, adversaries cannot track and trace the vehicle’s location and identity. However, the authors [25] did not provide a formal security analysis of the scheme.In 2010, Paruchuri and Durresi [26] proposed a protocol called PAAVE. In that protocol, the smart card generated a key for authentication between the vehicle and RSU. Paruchuri and Durresi [26] provided security comparison but did not provide formal and informal security analysis.In 2017, Ying and Nayak [27] proposed lightweight authentication for VANETs; the authors [27] focused on efficiency and anonymity. The proposed protocol reduces 50% computation and communication cost compared to other protocols. The sceheme of Ying and Nayak [27] provides password change feature without involvment of TA. In 2019, Chen et al. [28] discovered some weaknesses in Ying and Nayak’s scheme and proved that the scheme does not perform securely against location spoofing, offline identity guessing, and replay attack. In addition, it takes more time for authentication; after that, Chen et al. [28] also proposed a protocol to remove these vulnerabilities from the scheme presented in [27]. Table 2 provides the bird’s eye view of the previous related works such as cryptography techniques, and their advantages and disadvantages are listed in the table.Table 2
Summary of authentication schemes in VANETs.
AuthorsCryptography techniqueAdvantageDisadvantageZheng et al. [12]ECCLess storage cost, suitable forOBU and RSU in sense of less computing and limited storageMissing formal security analysisQu and Tan [15]ECCProvides mutual authentication and key agreement, resists against impersonation attack, stolen smart card, inside attack, and sever spoofing attack, provides user anonymityMissing communication cost, running time, and overhead costNandy et al. [16]ECC and symmetric key operation-based authenticationLightweight and provides vehicle to vehicle secure communicationFaulty designVasudev et al. [21]XOR operation, one-way hash functionsResists against impersonation attack, stolen smart card, offline password guessing, and man-in-the-middle attacks and provides anonymityMissing formal security analysisMahmood et al. [22]XOR operations, one-way hash functionsProved that Vasudev et al.’s scheme [21] is incorrect and proposed new scheme for V2V secure communication. Resists against impersonation attack, stolen smart card, offline password guessing, man-in-the-middle attacks, and DOS attack and provides anonymity and untraceability.—Li et al. [24]XOR operation, hash function, biometric authenticationImproves the functional and security flaws of Jiang et al.’s scheme [23], communication and computation cost is less than that of other schemesRunning time of scheme is missingWang et al. [25]Using multiple hashing functions, biological password-based authenticationReduces the communication, overhead, and computation costFormal security analysis is missingParuchuri and Durresi [26]Smart card-based key generationProvides anonymous authentication, less space for key storage in smart cardInformal and formal security analysis is missing


## 4. Summary of Xu Et Al.’s Scheme

This section provides a detailed review of Xu et al.’s scheme [10]. The scheme is divided into six phases and three entities are participating in this scheme. First of all, we explain the entities and then phases of the scheme. User Ui or OBU acts as a vehicle or node that wants to communicate with other OBUs or RSUs. The second entity is RSU which plays the role of an intermediate node between Ui and TA. Ui communicates with RSU via DSRC protocol and RSU communicates with TA via a wired or wireless channel. The last entity of this scheme is TA, and it is responsible for user authentication and making sure users have been authenticated. These three entities perform activities in six phases such as (1) system initialization, (2) registration, (3) user login, (4) user authentication, (5) malicious user tacking, and (6) password and biometric key exchange phase.


### 4.1. System Initialization

In system initialization phase,TA performs the following steps:(i)
TA selects G, which is a cyclic additive group having order p and E:y2=X3+iX+jmodp where i,j∈RZp∗. The TA further generates x as the primary/private key and computes the Ppub=x.P as the public key; after generation, the public key is published by TA. Through secure channel, TA loads the private key x in the RSUs and TPD.


### 4.2. User Registration

Under this phase,Ui approaches the TA for the completion of the registration process. The following are the steps involved in user registration phase:(i)
Ui puts Wi (his biometric information) on the reader to get αi,βi=GENW via FE and provides his original identity IDi and password PWi to the TA. TA generates yi:i=1,2…n randomly for each Ui. Moreover, TA computes PIDi=hIDi,yi, Ai∗=hIDi,x⊕αi, Ci=hIDi,PWi,αi⊕yi, Di=hPWi,yi,αi, Ei=PIDi⊕Ai. After that, TA forwards the SC to Ui with engraved information of the tuple G,p,P,βi,Ci,Di,h and stores the tuple PIDi,αi in a verifier table.


### 4.3. User Login

For user login, theOBU checks and verifies the legitimacy of users via execution of the following steps:(i)
UserUi inserts the SC into OBU and enters the IDi∗ and PWi∗ and imprints biometric information Wi∗. The SC extracts αi∗=RepW′,βi. The SC computes yi∗=Ci⊕IDi∗,PWi∗,αi∗. The SC verifies Di=?hPWi∗,yi∗,αi∗. If the information is true, login is successful. The SC computes Ai∗=Ei⊕IDi∗,yi∗; after that, user attenuation will start. Otherwise, SC terminates the registration process. If Ui repeatedly enters wrong information and exceeds the threshold value, it will not accept inputs from Ui.


### 4.4. User Authentication

Under this phase,OBU and RSU perform mutual authentication and produce secret key for data communication through authentication process. Figure 3 describes the whole process of user authentication of Xu et al.’s scheme, and the following steps are involved:Step 1. OBU⟶RSU : DIDi,M0,M1,R0,t0.(i)
OBU generates a random number r and computes Ro=rP,R1=rPpub. After that, OBU computes the dynamic identity DIDi=hIDi∗,yi∗⊕hR1,t0 and t0 (timestamp). Now, OBU computes M0=Ai∗⊕hR1,t0 and M1=hIDi∗,DIDi,Ai∗,R1,t0. OBU sends DIDi,M0,M1,R0,t0 to RSU through insecure channel.Step 2. RSU⟶TA: DIDi,AIDi,t0.(ii)
After receiving the message from theOBU, the RSU checks the freshness of t0 and verifies whether the message has expired or not. If tr1−t0≥Δt, RSU immediately stops the process; otherwise, continue. RSU computes R1=xR0. RSU computes PIDi∗=DIDi⊕hR1,t0, A1∗=M0⊕hR1,t0. RSU computes AIDi=hDIDi,x⊕PIDi∗. Now, RSU sends the message DIDi,AIDi,t0 to the TA.Step 3. TA⟶RSU: BIDi,t1,.(iii)
WhenTA receives the message form the RSU, it checks the freshness of t1 and verifies whether the message has expired or not. On success, TA computes PIDi∗=AIDi⊕hDIDi,x. TA searches the legitimate table of Ui based on PIDi∗. If table is not found, TA stops the process; otherwise, it continues the process. TA computes BIDi=hDIDi,x⊕IDi. After computing BIDi, TA sends message BIDi,t1, to RSU.Step 4. RSU⟶OBU: M2,R2,t2.(iv)
WhenRSU receives the message from the TA side, check the freshness of t2 and verify whether the received message has expired. On success, the RSU computes IDi=BIDi⊕hDIDi,x and verifies M1=?hIDi,DIDi,Ai∗,R1,t0; if RSU finds these parameters correct and satisfies the originality, the process continues; otherwise, it stops. After that, RSU computes R2=kP,KS=hR0,R2,kR0, M2=hKS,Ai∗,R0,R2,t2. Now RSU stores data tuple PIDi∗,Ai∗,KS. RSU sends the message M2,R2,t2 to OBU.Step 5. The OBU reacts by executing the following steps.(v)
When theOBU receives the message from the RSU, it checks the freshness of t3, and on success, the SC computes KS=hR0,R2,rR2 and verifies M2=hKS,Ai∗,R0,R2,t2. On successful verification, the OBU considers KS as session key and Ui as authenticated user.Figure 3
User authentication phase of Xu et al.’s scheme.


### 4.5. Malicious User Tracking

If the malicious vehicle/node tries to authenticate itself, then the following steps will be performed to identify and track the malicious node:(i)
WhenRSU gets the message from OBU and computes the PIDi∗=DIDi⊕hR1,t0, Ai∗=M0⊕R1,t0, then RSU gets the value of Ai∗ from database (stored tuple) PIDi∗,Ai∗,KS. RSU computes the MA=PIDi∗⊕x⊕t3,MA=PIDi⊕Ai∗⊕t3,M3=hPIDi∗,Ai∗,MA,MP,t3. After that, RSU sends message MA,MP,M3,t3 to trusted authority. When TA receives a message from the RSU, TA checks and verifies the freshness of message and stops the process if freshness is not validated. The TA computes the PIDi∗=MA⊕x⊕t3 and Ai∗=MP⊕PIDi∗⊕t3. The TA checks and verifies the M3=?hPIDi∗,Ai∗,MA,MP,t3. If it holds, the process continues.(ii)
TheTA searches the verifier table; if the table contains IDi,PIDi∗,αi, the process continues. The TA checks and verifies Ai∗=?hIDi,x⊕αi; if this parameter holds, the process continues. After the confirmation of the malicious vehicle, TA computes the MN=IDi⊕x⊕t,M4=hIDi,MN,t4 and sends a message to RSUMN,M4,t4. RSU deletes the entry from the legal user table and declares that malicious user is not a legitimate user. After receiving the message from TA, the RSU computes the message again and checks its originality such as IDi=MN⊕x⊕t4,M4=?hIDi,MN,t4. Now, RSU broadcasts the malicious node identity IDi,PIDi∗ to inform other nodes or vehicles.


### 4.6. Password and Biometric Change

Under this phase, the user changes his password or gives the vehicle to another user. The user changes his biometric key using the following step:(i)
TheUi inserts SC into OBU and enters the identity IDi∗ and password PWi∗ and imprints the biometric information Wi′. The FE extracts αi∗=RepW′,βi. The SC computes yi∗=Ci⊕hIDi∗,PWi∗,αi∗. The SC checks and verifies Di=?hPWi∗,yi∗,αi∗; if equation carries these parameters, Ui is granted permission to change his/her password and biometric key; otherwise, it stops the process. In case Ui wants to change his/her password, the SC computes the CiNew=hIDi∗,PWiNew∗,αi∗⊕yi,DiNew=hPWiNew∗,yi∗,αi∗. The SC replaces the values of Ci,Di with CiNew,DiNew and stores these into memory.(ii)
IfUi wants to hand over the vehicle temporarily to another user, he/she must change biometric key. UiNew puts his own biometric information WiNew in the special device to get GenWiNew=αiNew,βiNew via fuzzy extractor. SC computes the CiNew=hIDi∗,PWi∗,αi⊕yi∗ and DiNew=hPWi∗,yi∗,αiNew. SC computes Ai∗=EihIDi∗,yi∗, hIDi∗,x=Ai∗⊕αi and EiNew=hIDi∗,x⊕αiNew⊕hIDi∗,yi∗. SC replaces βi,Ci,Di,Ei in memory with βiNew,CiNew,DiNew,EiNew to complete the process of biometric key exchange.


## 4.1. System Initialization

In system initialization phase,TA performs the following steps:(i)
TA selects G, which is a cyclic additive group having order p and E:y2=X3+iX+jmodp where i,j∈RZp∗. The TA further generates x as the primary/private key and computes the Ppub=x.P as the public key; after generation, the public key is published by TA. Through secure channel, TA loads the private key x in the RSUs and TPD.


## 4.2. User Registration

Under this phase,Ui approaches the TA for the completion of the registration process. The following are the steps involved in user registration phase:(i)
Ui puts Wi (his biometric information) on the reader to get αi,βi=GENW via FE and provides his original identity IDi and password PWi to the TA. TA generates yi:i=1,2…n randomly for each Ui. Moreover, TA computes PIDi=hIDi,yi, Ai∗=hIDi,x⊕αi, Ci=hIDi,PWi,αi⊕yi, Di=hPWi,yi,αi, Ei=PIDi⊕Ai. After that, TA forwards the SC to Ui with engraved information of the tuple G,p,P,βi,Ci,Di,h and stores the tuple PIDi,αi in a verifier table.


## 4.3. User Login

For user login, theOBU checks and verifies the legitimacy of users via execution of the following steps:(i)
UserUi inserts the SC into OBU and enters the IDi∗ and PWi∗ and imprints biometric information Wi∗. The SC extracts αi∗=RepW′,βi. The SC computes yi∗=Ci⊕IDi∗,PWi∗,αi∗. The SC verifies Di=?hPWi∗,yi∗,αi∗. If the information is true, login is successful. The SC computes Ai∗=Ei⊕IDi∗,yi∗; after that, user attenuation will start. Otherwise, SC terminates the registration process. If Ui repeatedly enters wrong information and exceeds the threshold value, it will not accept inputs from Ui.


## 4.4. User Authentication

Under this phase,OBU and RSU perform mutual authentication and produce secret key for data communication through authentication process. Figure 3 describes the whole process of user authentication of Xu et al.’s scheme, and the following steps are involved:Step 1. OBU⟶RSU : DIDi,M0,M1,R0,t0.(i)
OBU generates a random number r and computes Ro=rP,R1=rPpub. After that, OBU computes the dynamic identity DIDi=hIDi∗,yi∗⊕hR1,t0 and t0 (timestamp). Now, OBU computes M0=Ai∗⊕hR1,t0 and M1=hIDi∗,DIDi,Ai∗,R1,t0. OBU sends DIDi,M0,M1,R0,t0 to RSU through insecure channel.Step 2. RSU⟶TA: DIDi,AIDi,t0.(ii)
After receiving the message from theOBU, the RSU checks the freshness of t0 and verifies whether the message has expired or not. If tr1−t0≥Δt, RSU immediately stops the process; otherwise, continue. RSU computes R1=xR0. RSU computes PIDi∗=DIDi⊕hR1,t0, A1∗=M0⊕hR1,t0. RSU computes AIDi=hDIDi,x⊕PIDi∗. Now, RSU sends the message DIDi,AIDi,t0 to the TA.Step 3. TA⟶RSU: BIDi,t1,.(iii)
WhenTA receives the message form the RSU, it checks the freshness of t1 and verifies whether the message has expired or not. On success, TA computes PIDi∗=AIDi⊕hDIDi,x. TA searches the legitimate table of Ui based on PIDi∗. If table is not found, TA stops the process; otherwise, it continues the process. TA computes BIDi=hDIDi,x⊕IDi. After computing BIDi, TA sends message BIDi,t1, to RSU.Step 4. RSU⟶OBU: M2,R2,t2.(iv)
WhenRSU receives the message from the TA side, check the freshness of t2 and verify whether the received message has expired. On success, the RSU computes IDi=BIDi⊕hDIDi,x and verifies M1=?hIDi,DIDi,Ai∗,R1,t0; if RSU finds these parameters correct and satisfies the originality, the process continues; otherwise, it stops. After that, RSU computes R2=kP,KS=hR0,R2,kR0, M2=hKS,Ai∗,R0,R2,t2. Now RSU stores data tuple PIDi∗,Ai∗,KS. RSU sends the message M2,R2,t2 to OBU.Step 5. The OBU reacts by executing the following steps.(v)
When theOBU receives the message from the RSU, it checks the freshness of t3, and on success, the SC computes KS=hR0,R2,rR2 and verifies M2=hKS,Ai∗,R0,R2,t2. On successful verification, the OBU considers KS as session key and Ui as authenticated user.Figure 3
User authentication phase of Xu et al.’s scheme.


## 4.5. Malicious User Tracking

If the malicious vehicle/node tries to authenticate itself, then the following steps will be performed to identify and track the malicious node:(i)
WhenRSU gets the message from OBU and computes the PIDi∗=DIDi⊕hR1,t0, Ai∗=M0⊕R1,t0, then RSU gets the value of Ai∗ from database (stored tuple) PIDi∗,Ai∗,KS. RSU computes the MA=PIDi∗⊕x⊕t3,MA=PIDi⊕Ai∗⊕t3,M3=hPIDi∗,Ai∗,MA,MP,t3. After that, RSU sends message MA,MP,M3,t3 to trusted authority. When TA receives a message from the RSU, TA checks and verifies the freshness of message and stops the process if freshness is not validated. The TA computes the PIDi∗=MA⊕x⊕t3 and Ai∗=MP⊕PIDi∗⊕t3. The TA checks and verifies the M3=?hPIDi∗,Ai∗,MA,MP,t3. If it holds, the process continues.(ii)
TheTA searches the verifier table; if the table contains IDi,PIDi∗,αi, the process continues. The TA checks and verifies Ai∗=?hIDi,x⊕αi; if this parameter holds, the process continues. After the confirmation of the malicious vehicle, TA computes the MN=IDi⊕x⊕t,M4=hIDi,MN,t4 and sends a message to RSUMN,M4,t4. RSU deletes the entry from the legal user table and declares that malicious user is not a legitimate user. After receiving the message from TA, the RSU computes the message again and checks its originality such as IDi=MN⊕x⊕t4,M4=?hIDi,MN,t4. Now, RSU broadcasts the malicious node identity IDi,PIDi∗ to inform other nodes or vehicles.


## 4.6. Password and Biometric Change

Under this phase, the user changes his password or gives the vehicle to another user. The user changes his biometric key using the following step:(i)
TheUi inserts SC into OBU and enters the identity IDi∗ and password PWi∗ and imprints the biometric information Wi′. The FE extracts αi∗=RepW′,βi. The SC computes yi∗=Ci⊕hIDi∗,PWi∗,αi∗. The SC checks and verifies Di=?hPWi∗,yi∗,αi∗; if equation carries these parameters, Ui is granted permission to change his/her password and biometric key; otherwise, it stops the process. In case Ui wants to change his/her password, the SC computes the CiNew=hIDi∗,PWiNew∗,αi∗⊕yi,DiNew=hPWiNew∗,yi∗,αi∗. The SC replaces the values of Ci,Di with CiNew,DiNew and stores these into memory.(ii)
IfUi wants to hand over the vehicle temporarily to another user, he/she must change biometric key. UiNew puts his own biometric information WiNew in the special device to get GenWiNew=αiNew,βiNew via fuzzy extractor. SC computes the CiNew=hIDi∗,PWi∗,αi⊕yi∗ and DiNew=hPWi∗,yi∗,αiNew. SC computes Ai∗=EihIDi∗,yi∗, hIDi∗,x=Ai∗⊕αi and EiNew=hIDi∗,x⊕αiNew⊕hIDi∗,yi∗. SC replaces βi,Ci,Di,Ei in memory with βiNew,CiNew,DiNew,EiNew to complete the process of biometric key exchange.


## 5. Weaknesses of Xu Et Al.’s Scheme

This section describes the ability of a dishonestRSU to bypass TA and construct a session key with requesting OBU.


### 5.1. TA Bypassing

If an RSU is dishonest, it can easily by pass TA and create a session key directly with OBU, and for this, RSU can skip sending messageDIDi,AIDi,t0. In this case, the RSU will calculate R1=xR0, PIDi∗=DIDi⊕hR1,t0, and Ai∗=M0⊕hR1,t0. Now RSU just skips some of the remaining steps and goes directly on the step which computes R2=kP,KS=hR0,R2,kR0 and M2=hKS,Ai∗,R0,R2,t2 and sends PIDi∗,Ai∗,KS to OBU. The OBU checks validity of t2 and then computes KS=hR0,R2,rR2. Finally, the OBU checks M2=hKS,Ai∗,R0,R2,t2. As the computation of KS involves R0, R2, and rR2=kR0 and the RSU has access to all these parameters, it does not require any information from the TA. Therefore, it can easily compute KS without any verification by the TA. Hence, in the scheme of Xu et al. [10], a dishonest RSU can bypass the TA.


## 5.1. TA Bypassing

If an RSU is dishonest, it can easily by pass TA and create a session key directly with OBU, and for this, RSU can skip sending messageDIDi,AIDi,t0. In this case, the RSU will calculate R1=xR0, PIDi∗=DIDi⊕hR1,t0, and Ai∗=M0⊕hR1,t0. Now RSU just skips some of the remaining steps and goes directly on the step which computes R2=kP,KS=hR0,R2,kR0 and M2=hKS,Ai∗,R0,R2,t2 and sends PIDi∗,Ai∗,KS to OBU. The OBU checks validity of t2 and then computes KS=hR0,R2,rR2. Finally, the OBU checks M2=hKS,Ai∗,R0,R2,t2. As the computation of KS involves R0, R2, and rR2=kR0 and the RSU has access to all these parameters, it does not require any information from the TA. Therefore, it can easily compute KS without any verification by the TA. Hence, in the scheme of Xu et al. [10], a dishonest RSU can bypass the TA.


## 6. Proposed Scheme

The following subsections explain the main phases of the proposed scheme.


### 6.1. System Initialization

Under this phase,TA performs the following steps for registration:(i)
TA selects the cyclic additive group G with order of p and a generator P.(ii)
TA selects an ECE:y2=X3+iX+jmodP where i,j∈_RZp∗.(iii)
TA generates a primary key x as a random number and then computes the Ppub=x.P as the public key.(iv)
Through secure channel,TA uploads the primary key x into RSUs and TPD.


### 6.2. User Registration

Under this phase, user andTA interact through following steps for the completion of registration process, where Ui approaches the TA to complete the process:(i)
TheUi puts his biometric information on the reader to get αi,βi=GENW via FE and provides his original identity IDi and password PWi to the TA.(ii)
TA generates a random number yi for each Ui, and TA computes PIDi=hIDi,yi, Ai∗=hIDi,x⊕αi, Ci=hIDi,PWi,αi⊕yi, Di=hPWi,yi,αi, Ei=PIDi⊕Ai.(iii)
TA forwards the SC to Ui, which is engraved with the following tuple: G,p,P,βi,Ci,Di,h. The TA now stores the tuple (IDi,αi in the verification table.


### 6.3. User Login

Under the user login phase,OBU checks and verifies Ui’s legitimacy via the following steps:(i)
UserUi inserts the SC into OBU and enters the IDi∗ and PWi∗ and imprints biometric information Wi∗. The FE extracts αi∗=RepW′,βi.(ii)
TheSC computes yi∗=Ci⊕IDi∗,PWi∗,αi∗.(iii)
TheSC verifies Di=?hPWi∗,yi∗,αi∗. If this information is true, the user login succeeds and SC computes Ai∗=Ei⊕IDi∗,yi∗. After that, user attenuation will start. Otherwise, SC terminates the registration process and SC sets an error threshold to increase the security. If Ui tries repeatedly through entering wrong information and attempts exceed the threshold value, Ui is blocked.


### 6.4. User Authentication

Under the user authentication phase,OBU and RSU perform mutual authentication and produce a session key for data/information communication. Figure 4 describes the complete process of user authentication phase of the proposed scheme.Step 1. OBU⟶RSU: DIDi,M0,M1,R0,t0.(i)
TheOBU generates a random number r and computes Ro=rP,R1=rPpub.(ii)
TheOBU computes the dynamic identity DIDi=hIDi∗,yi∗⊕hR1,t0 and t0 (timestamp).(iii)
TheOBU computes M0=Ai∗⊕hR1,t0 and M1=hIDi∗,DIDi,Ai∗,R1,t0.(iv)
TheOBU sends DIDi,M0,M1,R0,t0 to RSU through insecure channel.Step 2. RSU⟶TA: DIDi,AIDi,t0.(v)
After receiving the message from theOBU, the RUS checks the freshness of t0 and verifies whether the message has expired or not. If the message is fresh, the process continues; otherwise, RSU stops the process.(vi)
TheRUS computes R1=xR0, PIDi∗=DIDi⊕hR1,t0, and A1∗=M0⊕hR1,t0.(vii)
TheRSU computes AIDi=hDIDi,x⊕PIDi∗.(viii)
Now, theRSU sends the message DIDi,AIDi,t0 to the TA.Step 3. TA⟶RSU: BIDi,t1.(ix)
WhenTA receives the message form the RSU, it checks the freshness of t1 and verifies whether message timeliness has expired or not. On successful validation of timeliness, the process continues; otherwise, the process is stopped.(x)
Now,TA computes PIDi∗=AIDi⊕hDIDi,x. TA searches the verifier table for PIDi∗. If corresponding entry in the table is not found, the TA stops the process; otherwise, the process continues.(xi)
TA computes the BIDi=hDIDi,x⊕IDi. After computing the BIDi, TA sends message BIDi,t1, to RSU.Step 4. RSU⟶OBU: M2,R2,t2.(xii)
WhenRSU receives the message from the TA side, check the freshness of t2 and verify whether the received message has expired.(xiii)
On successful validation of timeliness, theRSU computes IDi=BIDi⊕hDIDi,x.(xiv)
RSU verifies M1=?hIDi,DIDi,Ai∗,R1,t0 and on success executes the next steps.(xv)
TheRSU computes R2=kP,KS=hR0,R2,kR0,IDi, M2=hKS,Ai∗,R0,R2,t2.(xvi)
TheRSU stores the data tuple PIDi∗,Ai∗,KS.(xvii)
TheRSU sends the message M2,R2,t2 to OBUStep 5. The OBU performs following steps.(xviii)
When theOBU receives the message from the RSU, it checks the freshness of t3.(xix)
On successful validation of timeliness, theSC computes the KS=hR0,R2,rR2,IDi.(xx)
Now,SC verifies the M2=?hKS,Ai∗,R0,R2,t2, and if it is proved, the process of mutual authentication is assumed to be successfully completed. Furthermore, the KS will be kept for further use.Figure 4
User authentication phase of the proposed scheme.


### 6.5. Malicious User Tracking

Following is the malicious user tracking phase of the proposed scheme:(i)
RSU gets the message from OBU, computes the PIDi∗=DIDi⊕hR1,t0, Ai∗=M0⊕R1,t0, and gets stored tuple PIDi∗,Ai∗,KS. RSU computes the MA=PIDi∗⊕x⊕t3,MA=PIDi⊕Ai∗⊕t3,M3=hPIDi∗,Ai∗,MA,MP,t3. After that, RSU sends message MA,MP,M3,t3 to the trusted authority. When TA receives message from the RSU, TA checks and verifies the freshness of message. On successful validation of timeliness, the TA computes the PIDi∗=MA⊕x⊕t3,Ai∗=MP⊕PIDi∗⊕t3. The TA then checks and verifies the M3=?hPIDi∗,Ai∗,MA,MP,t3. On successful validation, the process continues; otherwise, the process is stopped by RSU.(ii)
TheTA searches the user verifier table for IDi,PIDi∗,αi; if these values are found in the table, rest of the process continues; otherwise, the process is stopped. The TA checks and verifies Ai∗=?hIDi,x⊕αi; if this equation holds, the malicious vehicle is identified. After the confirmation of the malicious vehicle, TA computes MN=IDi⊕x⊕t,M4=hIDi,MN,t4 and sends a message MN,M4,t4 to RSU. The RSU selects the entry from the legal user table and declares that vehicle is malicious. After receiving the message from TA, the RSU computes the message again and checks its originality IDi=MN⊕x⊕t4. RSU broadcasts the malicious node identity IDi,PIDi∗ to inform other nodes or vehicles about the malicious node and warns RSU that malicious node is no more allowed to communicate with system entities including the RSUs.


### 6.6. Password and Biometric Change

Under this phase, the user changes his password or hands over his vehicle to some other user, and it needs to change his own biometric key. We consider the same process as that used by Xu et al.’s scheme. Therefore, it is not reproduced here.


## 6.1. System Initialization

Under this phase,TA performs the following steps for registration:(i)
TA selects the cyclic additive group G with order of p and a generator P.(ii)
TA selects an ECE:y2=X3+iX+jmodP where i,j∈_RZp∗.(iii)
TA generates a primary key x as a random number and then computes the Ppub=x.P as the public key.(iv)
Through secure channel,TA uploads the primary key x into RSUs and TPD.


## 6.2. User Registration

Under this phase, user andTA interact through following steps for the completion of registration process, where Ui approaches the TA to complete the process:(i)
TheUi puts his biometric information on the reader to get αi,βi=GENW via FE and provides his original identity IDi and password PWi to the TA.(ii)
TA generates a random number yi for each Ui, and TA computes PIDi=hIDi,yi, Ai∗=hIDi,x⊕αi, Ci=hIDi,PWi,αi⊕yi, Di=hPWi,yi,αi, Ei=PIDi⊕Ai.(iii)
TA forwards the SC to Ui, which is engraved with the following tuple: G,p,P,βi,Ci,Di,h. The TA now stores the tuple (IDi,αi in the verification table.


## 6.3. User Login

Under the user login phase,OBU checks and verifies Ui’s legitimacy via the following steps:(i)
UserUi inserts the SC into OBU and enters the IDi∗ and PWi∗ and imprints biometric information Wi∗. The FE extracts αi∗=RepW′,βi.(ii)
TheSC computes yi∗=Ci⊕IDi∗,PWi∗,αi∗.(iii)
TheSC verifies Di=?hPWi∗,yi∗,αi∗. If this information is true, the user login succeeds and SC computes Ai∗=Ei⊕IDi∗,yi∗. After that, user attenuation will start. Otherwise, SC terminates the registration process and SC sets an error threshold to increase the security. If Ui tries repeatedly through entering wrong information and attempts exceed the threshold value, Ui is blocked.


## 6.4. User Authentication

Under the user authentication phase,OBU and RSU perform mutual authentication and produce a session key for data/information communication. Figure 4 describes the complete process of user authentication phase of the proposed scheme.Step 1. OBU⟶RSU: DIDi,M0,M1,R0,t0.(i)
TheOBU generates a random number r and computes Ro=rP,R1=rPpub.(ii)
TheOBU computes the dynamic identity DIDi=hIDi∗,yi∗⊕hR1,t0 and t0 (timestamp).(iii)
TheOBU computes M0=Ai∗⊕hR1,t0 and M1=hIDi∗,DIDi,Ai∗,R1,t0.(iv)
TheOBU sends DIDi,M0,M1,R0,t0 to RSU through insecure channel.Step 2. RSU⟶TA: DIDi,AIDi,t0.(v)
After receiving the message from theOBU, the RUS checks the freshness of t0 and verifies whether the message has expired or not. If the message is fresh, the process continues; otherwise, RSU stops the process.(vi)
TheRUS computes R1=xR0, PIDi∗=DIDi⊕hR1,t0, and A1∗=M0⊕hR1,t0.(vii)
TheRSU computes AIDi=hDIDi,x⊕PIDi∗.(viii)
Now, theRSU sends the message DIDi,AIDi,t0 to the TA.Step 3. TA⟶RSU: BIDi,t1.(ix)
WhenTA receives the message form the RSU, it checks the freshness of t1 and verifies whether message timeliness has expired or not. On successful validation of timeliness, the process continues; otherwise, the process is stopped.(x)
Now,TA computes PIDi∗=AIDi⊕hDIDi,x. TA searches the verifier table for PIDi∗. If corresponding entry in the table is not found, the TA stops the process; otherwise, the process continues.(xi)
TA computes the BIDi=hDIDi,x⊕IDi. After computing the BIDi, TA sends message BIDi,t1, to RSU.Step 4. RSU⟶OBU: M2,R2,t2.(xii)
WhenRSU receives the message from the TA side, check the freshness of t2 and verify whether the received message has expired.(xiii)
On successful validation of timeliness, theRSU computes IDi=BIDi⊕hDIDi,x.(xiv)
RSU verifies M1=?hIDi,DIDi,Ai∗,R1,t0 and on success executes the next steps.(xv)
TheRSU computes R2=kP,KS=hR0,R2,kR0,IDi, M2=hKS,Ai∗,R0,R2,t2.(xvi)
TheRSU stores the data tuple PIDi∗,Ai∗,KS.(xvii)
TheRSU sends the message M2,R2,t2 to OBUStep 5. The OBU performs following steps.(xviii)
When theOBU receives the message from the RSU, it checks the freshness of t3.(xix)
On successful validation of timeliness, theSC computes the KS=hR0,R2,rR2,IDi.(xx)
Now,SC verifies the M2=?hKS,Ai∗,R0,R2,t2, and if it is proved, the process of mutual authentication is assumed to be successfully completed. Furthermore, the KS will be kept for further use.Figure 4
User authentication phase of the proposed scheme.


## 6.5. Malicious User Tracking

Following is the malicious user tracking phase of the proposed scheme:(i)
RSU gets the message from OBU, computes the PIDi∗=DIDi⊕hR1,t0, Ai∗=M0⊕R1,t0, and gets stored tuple PIDi∗,Ai∗,KS. RSU computes the MA=PIDi∗⊕x⊕t3,MA=PIDi⊕Ai∗⊕t3,M3=hPIDi∗,Ai∗,MA,MP,t3. After that, RSU sends message MA,MP,M3,t3 to the trusted authority. When TA receives message from the RSU, TA checks and verifies the freshness of message. On successful validation of timeliness, the TA computes the PIDi∗=MA⊕x⊕t3,Ai∗=MP⊕PIDi∗⊕t3. The TA then checks and verifies the M3=?hPIDi∗,Ai∗,MA,MP,t3. On successful validation, the process continues; otherwise, the process is stopped by RSU.(ii)
TheTA searches the user verifier table for IDi,PIDi∗,αi; if these values are found in the table, rest of the process continues; otherwise, the process is stopped. The TA checks and verifies Ai∗=?hIDi,x⊕αi; if this equation holds, the malicious vehicle is identified. After the confirmation of the malicious vehicle, TA computes MN=IDi⊕x⊕t,M4=hIDi,MN,t4 and sends a message MN,M4,t4 to RSU. The RSU selects the entry from the legal user table and declares that vehicle is malicious. After receiving the message from TA, the RSU computes the message again and checks its originality IDi=MN⊕x⊕t4. RSU broadcasts the malicious node identity IDi,PIDi∗ to inform other nodes or vehicles about the malicious node and warns RSU that malicious node is no more allowed to communicate with system entities including the RSUs.


## 6.6. Password and Biometric Change

Under this phase, the user changes his password or hands over his vehicle to some other user, and it needs to change his own biometric key. We consider the same process as that used by Xu et al.’s scheme. Therefore, it is not reproduced here.


## 7. Security Analysis

Under this section, we have performed the formal security analysis using BAN-Logic [29–31] in addition to the security discussion of the proposed scheme.


### 7.1. Formal Security Analysis

This section provides the detailed formal security analysis of the proposed security scheme using the BAN-Logic. It first describes the basic notations of BAN-Logic that are used to analyze the proposed scheme’s secure authentication and correctness. Here,X is used for the formula, and N and Q are used as participants.(i)
#X: X is fresh.(ii)
N|≡X:N believes that X is trustworthy.(iii)
N|∼X:NsaidX once.(iv)
N⊲X:N sees X.(v)
N|X:N has jurisdiction over X.(vi)
N↔KSQ: between N and Q, KS is the shared key.(vii)
X,Yk: K is used to encrypt X and Y.(viii)
XY: X and Y are combined.Following are the rules of BAN-Logic:Rule 1: message meaning rule.IfN sees X and believes that X is encrypted by shared key K among N andQ, then then N believes Q said X once.(5)N|≡↔KQ,N⊲XKN≡Q∼X.Rule 2: nonce verification rule.IfN believes that the statement X is updated and N also believes that Q once said X, then N believes Q is the statement of X.(6)N|≡#X,N≡Q∼XN≡Q≡X.Rule 3: jurisdiction rule.IfN believes Q has jurisdiction over the statement X and N believes Q the statement X, then N believes the statement of X.(7)N|≡Q⇒X,N≡Q≡XN|≡X.Rule 4: session key rule.IfNbelieves the freshness ofX, N and Qbelieves onX, thenNbelieves that a key is shared betweenN and Q.(8)N|≡#X,N≡Q≡XN|≡N↔KQ.Rule 5: freshness rule.If a part ofX is believed by N as updated, then X,Y is also believed by N as updated.(9)N|≡#XN|≡#X,Y.Rule 6: belief rule.IfN believes that Q believes in the statement of X,Y, then N believes that Q believes in the part of statement X.(10)N≡Q≡X,YN≡Q≡X.The goals of our TFPPASV protocol are proved through BAN-Logic as under:(i)
G1:OBU|≡OBU↔KSTA(ii)
G2:TA|≡OBU↔KSTA(iii)
G3:RSU|≡OBU↔KSTA(iv)
G4:OBU≡TA≡OBU↔KSTA(v)
G5:TA≡OBU≡OBU↔KSTA(vi)
G6:RSU≡OBU≡OBU↔KSTA(vii)
G7:RSU≡TA≡OBU↔KSTAIn the proposed TFPPASV scheme, the messages are sent over the public channel. The details of these messages are mentioned below:(i)
M1:OBU⟶RSU:DIDi,M0,M1,R0,t0(ii)
M2:RSU⟶TA:DIDi,AIDi,t0(iii)
M3:TA⟶RSU:BIDi,t1(iv)
M4:RSU⟶OBU:M2,R2,t2Furthermore, the following assumptions are used for analyzing the proposed scheme using BAN-Logic.(i)
A1:OBU|≡#rOBU(ii)
A2:TA|≡#rRSU(iii)
A3:RSU|≡#rTA(iv)
A4:RSU≡OBU⇒DIDi(v)
A5:RSU|≡OBU⇌A1TA(vi)
A6:RSU|≡#rOBU(vii)
A7:RSU≡OBU⇒rOBU(viii)
A8:RSU|≡#Ai∗(ix)
A9:RSU≡OBU⇒Ai∗(x)
A10:TA≡RSU⇒DIDi(xi)
A11:TA≡RSU⇒AIDi(xii)
A12:TA|≡#AIDi(xiii)
A13:TA|≡#PIDi∗(xiv)
A14:TA|≡RSU⇒PIDi∗(xv)
A15:TA|≡#rOBU(xvi)
A16:RSU|≡TA⇌R1,t0TA(xvii)
A17:RSU|≡#rTA(xviii)
A18:RSU≡TA⇒rTA(xix)
A19:OBU≡RSU≡A1(xx)
A20:OBU|≡#A1(xxi)
A21:OBU|≡#rTA(xxii)
A22:OBU≡RSU⇒rTA(xxiii)
A23:OBU|≡OBU⇌R1,t0TA(xxiv)
A24:OBU|≡rRSU(xxv)
A25:OBU≡TA⇒rRSU(xxvi)
A26:RSU≡RSU≡rOBU


#### 7.1.1. BAN-Logic Proof

The proof of proposed scheme through BAN-Logic analysis is as follows.S1 can be acquired from M1.S1:RSU⊲DIDi,M0,M1,R0,t0.S2:RSU≡OBU≡DIDi. Based on A4, S2, and rule 3, we can obtain S3:RSU|≡DIDi. According to S1, it implies that S4:RSU⊲rOBU,DIDiA1. By A5, S4, and rule 1, it implies that S5:RSU≡OBU∼rOBU,DIDi.By A6, S5, and rule 2, we can obtain S6:RSU≡OBU≡rOBU. According to A7,S6, and rule 3, it implies that S7:RSU|≡rOBU. According to S1, we have acquired S8:RSU⊲AIDi. By A5, S8, and rule 1, it implies that S9:RSU|≡OBU∼AIDi. By A8,S9, and rule 2, we can obtain S10:RSU≡OBU≡AIDi. According to A9,S10, and rule 3, it implies that S11:RSU|≡AIDi.ByM2, we can obtain S12:TA⊲DIDi,AIDi,t0 and further S13:TA≡RSU≡DIDi. Based on A10,S13, and rule 3, we can obtain S14:TA|≡DIDi. By A11,A12, and rule 4, it implies that S15:TA|≡⇌A1RSU. According to S12, we have S16:TA⊲PIDi∗RSU. Based on S15,S16, and rule 1, it implies that S17:TA|≡RSU∼rRSU. By A13,S17, and rule 2, we can obtain S18:TA≡RSU≡rRSU. According to A14,S18, and rule 3, it implies that S19:TA|≡rRSU. Based on A11,A12, and rule 4, we have S20:TA|≡TA⇌PIDi∗RSU. According to S12, we have S21:TA⊲rOBU. By S20,S21, and rule 1, it implies that S22:TA≡RSU∼rOBU. By A15,S22, and rule 2, we can obtain S23:TA≡RSU≡rOBU. Based on A26,S23, and rule 3, it implies that S24:TA|≡rOBU. KS=hR0,R2,kR0,IDi. S25:TA|≡OBU↔KSTA is obtained. (G2). According to A2,S25, and rule 4, we can obtain S26:RSU|≡OBU⇌A1RSU. (G5).ByM3, we have S27:RSU⊲BIDi,t1 and further S28:RSU⊲IDi=BIDi⊕hDIDi,x. Based on A16,S28, and rule 1, we can obtain S29:RSU≡TA≡rTA. By A17,S29, and rule 2, it implies that S30:RSU≡TA≡rTA. Based on A18,S30, and rule 3, we can obtain S31:RSU|≡rTA. According to S2,S11, and S31, it implies that S32:RSU|≡OBU↔KSTA. (G3). Based on A16,S32, and rule 4, we can obtain S33:RSU≡OBU≡↔KSTA. (G6). According to A12,S32, and rule 4, it implies that S34:RSU≡TA≡OBU↔KSTA. (G7).ByM4, we have S35:OBU⊲M2,R2,t2. Based on A19,A20, and rule 4, we can obtain S36:OBU|≡OBU⇌hR0,R2,kR0,IDiRSU. According to S35, we have S37:OBU⊲rRSU,hR0,R2,kR0,IDi. Based on S36,S37, and rule 1, it implies that S38:OBU≡RSU∼rRSU. By A21,S38, and rule 2, we can obtain S39:OBU≡RSU≡rRSU. According to A22,S39, and rule 3, it implies that S40:OBU|≡rRSU.We haveS41:OBU⊲rTA,hOBU‖rRSU. Based on A23,S41, and rule 1, it implies that S42:OBU|≡TA∼rTA. By A24,S42, and rule 2, we can obtain S43:OBU≡TArTA. Based on A25,S43, and rule 3, it implies that S44:OBU|≡rTA. According to S40 and S44, we can obtain S45:OBU|≡OBU⟷KSTA. (G1). According to A24 and S45, we can obtain S46:OBU≡TA≡OBU⟷KSTA. (G4).


### 7.2. Security Discussion

The security feature provision and resistance of the proposed scheme against various attacks are explained in the following subsection.


#### 7.2.1. Anonymity and Untraceability

In the proposed TFPPASV protocol, the identityIDi of the user is secure, because in TFPPASV, the vehicle sends a pseudo identity DIDi=hIDi∗,yi∗⊕hR1,t0 instead of its original identity IDi over the communication channel. The attacker can intercept DIDi, but it cannot extract IDi because it is concealed in a oneway hash function along with a random number and other parameters. The only method to get the identity is to break the hash function and get knowledge of random numbers involved in the computation of DIDi. Thus, the protocol provides user anonymity. In addition, the proposed protocol provides untraceability for the user because when the message is transmitted on a communication channel, it uses a random number during the authentication process. Thus, the attacker is not able to track the user.


#### 7.2.2. Perfect Forward Secrecy

The proposed TFPPASV protocol provides ultimate forward secrecy because it uses various random numbers during the message transmission. Three parametersRO=rP,R2=kP and kR0 are used to construct the session key KS=hR0,R2,kR0,IDi. If an attacker wants to launch an attack on the basis of a compromised session key, the attacker is not able to obtain the previous and subsequent session keys. Thus, the proposed protocol provides forward secrecy.


#### 7.2.3. Replay Attack

The proposed TFPPASV protocol provides resistance against the replay attack. Three entitiesOBU, RSU, and TA are involved in the authentication phase of the proposed TFPPASV protocol. These entities send the messages to each other such as DIDi,M0,M1,R0,t0, DIDi,AIDi,t0,BIDi,t1, and M2,R2,t2. In each of these messages, random numbers and timestamps are used and these are session specific. If an attacker wants to launch a replay attack, the replayed message cannot pass the verification process and the recipient can easily identify the replay attack.


#### 7.2.4. Offline Password Guessing Attack

Our TFPPASV protocol provides resistance against offline password guessing attack. During registration phase, some parameters are stored into SC such asCi=hIDi,PWi,αi⊕yi, Di=hPWi,yi,αi. The PWi is masked with yi generated randomly and the biometric key αi. Thus, attacker is not able to guess the password.


#### 7.2.5. Impersonation Attack

Our TFPPASV protocol provides resistance against impersonation assaults such asOBU impersonation assault, RSU impersonation assault, and TA impersonation assault.OBU impersonation attack: if an attacker tries to impersonate the OBU, it requires to construct the original login request message: DIDi′,M0′,M1′,R0′,t0′DIDi′=hIDi∗,yi∗⊕hR1,t0, M0′=Ai∗⊕R1,t0, M1′=hIDi∗,DIDi,Ai∗,R1,t0, and R0′=rP with updated random number r and timestamp tO. However, it is computationally difficult to recover tO, DIDi, and R1 for constructing DIDi′, M0′, M1′, R0′,t0′. Thus, the proposed protocol provides security against OBU impersonation.RSU impersonation attack: for the execution of a RSU impersonation attack, the attacker tries to instigate a forgery to TA on behalf of the RSU. The attacker needs to construct the DIDi′,AIDi′,tO′ with updated timestamp. In addition, it requires more confidential parameters such as x,R0 and R1. It is computationally hard to calculate these parameters from DIDi,M0,M1,R0,t0. Thus, the proposed TFPPASV scheme provides security against RSU impersonation.TA impersonation attack: in the case of TA impersonation, the attacker needs to construct BIDi′,t1 with an updated timestamp, and in addition, it requires the private key x, where BIDi′=DIDi,x⊕IDi. However, the attacker is not able to form the message until it gets the private key x and DIDi. Thus, the attacker is not able to launch TA impersonation attack.


#### 7.2.6. Smart Card Stolen

The proposed protocol provides security against SC stolen. If an attacker captures the SC and gets the informationG.p,P,βi,Ci,Di,Ei,h from the SC and it wants to login via SC, the attacker also needs the user IDi, PWi, and the biometric key αi in polynomial time, which is not possible for the attacker. Thus, the attacker is not able to complete a successful login.


#### 7.2.7. Man-in-the-Middle Attack

If the attackers want to launch attack as a man-in-the-middle, it needs to capture the messagesDIDi,M0,Mi,R0,R1, DIDi,AIDi,t0, BIDi,t1, and M2,R2,t2 from the public communication channel. The attacker must change or replace the message and forward it on the channel to get authenticated from both sides. However, due to the inability of construction of legal messages, the attacker may not be able to get authenticated from any side without getting IDi and PWi and private key x of the TA.


#### 7.2.8. Insider Attack

The proposed TFPPASV protocol protects from insider attacks because at the time of registration, user registers itself withTA on a secure channel. In addition, stored user passwords are in the ciphertext. It is computationally difficult for any dishonest insider to get information related to passwords and keys.


## 7.1. Formal Security Analysis

This section provides the detailed formal security analysis of the proposed security scheme using the BAN-Logic. It first describes the basic notations of BAN-Logic that are used to analyze the proposed scheme’s secure authentication and correctness. Here,X is used for the formula, and N and Q are used as participants.(i)
#X: X is fresh.(ii)
N|≡X:N believes that X is trustworthy.(iii)
N|∼X:NsaidX once.(iv)
N⊲X:N sees X.(v)
N|X:N has jurisdiction over X.(vi)
N↔KSQ: between N and Q, KS is the shared key.(vii)
X,Yk: K is used to encrypt X and Y.(viii)
XY: X and Y are combined.Following are the rules of BAN-Logic:Rule 1: message meaning rule.IfN sees X and believes that X is encrypted by shared key K among N andQ, then then N believes Q said X once.(5)N|≡↔KQ,N⊲XKN≡Q∼X.Rule 2: nonce verification rule.IfN believes that the statement X is updated and N also believes that Q once said X, then N believes Q is the statement of X.(6)N|≡#X,N≡Q∼XN≡Q≡X.Rule 3: jurisdiction rule.IfN believes Q has jurisdiction over the statement X and N believes Q the statement X, then N believes the statement of X.(7)N|≡Q⇒X,N≡Q≡XN|≡X.Rule 4: session key rule.IfNbelieves the freshness ofX, N and Qbelieves onX, thenNbelieves that a key is shared betweenN and Q.(8)N|≡#X,N≡Q≡XN|≡N↔KQ.Rule 5: freshness rule.If a part ofX is believed by N as updated, then X,Y is also believed by N as updated.(9)N|≡#XN|≡#X,Y.Rule 6: belief rule.IfN believes that Q believes in the statement of X,Y, then N believes that Q believes in the part of statement X.(10)N≡Q≡X,YN≡Q≡X.The goals of our TFPPASV protocol are proved through BAN-Logic as under:(i)
G1:OBU|≡OBU↔KSTA(ii)
G2:TA|≡OBU↔KSTA(iii)
G3:RSU|≡OBU↔KSTA(iv)
G4:OBU≡TA≡OBU↔KSTA(v)
G5:TA≡OBU≡OBU↔KSTA(vi)
G6:RSU≡OBU≡OBU↔KSTA(vii)
G7:RSU≡TA≡OBU↔KSTAIn the proposed TFPPASV scheme, the messages are sent over the public channel. The details of these messages are mentioned below:(i)
M1:OBU⟶RSU:DIDi,M0,M1,R0,t0(ii)
M2:RSU⟶TA:DIDi,AIDi,t0(iii)
M3:TA⟶RSU:BIDi,t1(iv)
M4:RSU⟶OBU:M2,R2,t2Furthermore, the following assumptions are used for analyzing the proposed scheme using BAN-Logic.(i)
A1:OBU|≡#rOBU(ii)
A2:TA|≡#rRSU(iii)
A3:RSU|≡#rTA(iv)
A4:RSU≡OBU⇒DIDi(v)
A5:RSU|≡OBU⇌A1TA(vi)
A6:RSU|≡#rOBU(vii)
A7:RSU≡OBU⇒rOBU(viii)
A8:RSU|≡#Ai∗(ix)
A9:RSU≡OBU⇒Ai∗(x)
A10:TA≡RSU⇒DIDi(xi)
A11:TA≡RSU⇒AIDi(xii)
A12:TA|≡#AIDi(xiii)
A13:TA|≡#PIDi∗(xiv)
A14:TA|≡RSU⇒PIDi∗(xv)
A15:TA|≡#rOBU(xvi)
A16:RSU|≡TA⇌R1,t0TA(xvii)
A17:RSU|≡#rTA(xviii)
A18:RSU≡TA⇒rTA(xix)
A19:OBU≡RSU≡A1(xx)
A20:OBU|≡#A1(xxi)
A21:OBU|≡#rTA(xxii)
A22:OBU≡RSU⇒rTA(xxiii)
A23:OBU|≡OBU⇌R1,t0TA(xxiv)
A24:OBU|≡rRSU(xxv)
A25:OBU≡TA⇒rRSU(xxvi)
A26:RSU≡RSU≡rOBU


### 7.1.1. BAN-Logic Proof

The proof of proposed scheme through BAN-Logic analysis is as follows.S1 can be acquired from M1.S1:RSU⊲DIDi,M0,M1,R0,t0.S2:RSU≡OBU≡DIDi. Based on A4, S2, and rule 3, we can obtain S3:RSU|≡DIDi. According to S1, it implies that S4:RSU⊲rOBU,DIDiA1. By A5, S4, and rule 1, it implies that S5:RSU≡OBU∼rOBU,DIDi.By A6, S5, and rule 2, we can obtain S6:RSU≡OBU≡rOBU. According to A7,S6, and rule 3, it implies that S7:RSU|≡rOBU. According to S1, we have acquired S8:RSU⊲AIDi. By A5, S8, and rule 1, it implies that S9:RSU|≡OBU∼AIDi. By A8,S9, and rule 2, we can obtain S10:RSU≡OBU≡AIDi. According to A9,S10, and rule 3, it implies that S11:RSU|≡AIDi.ByM2, we can obtain S12:TA⊲DIDi,AIDi,t0 and further S13:TA≡RSU≡DIDi. Based on A10,S13, and rule 3, we can obtain S14:TA|≡DIDi. By A11,A12, and rule 4, it implies that S15:TA|≡⇌A1RSU. According to S12, we have S16:TA⊲PIDi∗RSU. Based on S15,S16, and rule 1, it implies that S17:TA|≡RSU∼rRSU. By A13,S17, and rule 2, we can obtain S18:TA≡RSU≡rRSU. According to A14,S18, and rule 3, it implies that S19:TA|≡rRSU. Based on A11,A12, and rule 4, we have S20:TA|≡TA⇌PIDi∗RSU. According to S12, we have S21:TA⊲rOBU. By S20,S21, and rule 1, it implies that S22:TA≡RSU∼rOBU. By A15,S22, and rule 2, we can obtain S23:TA≡RSU≡rOBU. Based on A26,S23, and rule 3, it implies that S24:TA|≡rOBU. KS=hR0,R2,kR0,IDi. S25:TA|≡OBU↔KSTA is obtained. (G2). According to A2,S25, and rule 4, we can obtain S26:RSU|≡OBU⇌A1RSU. (G5).ByM3, we have S27:RSU⊲BIDi,t1 and further S28:RSU⊲IDi=BIDi⊕hDIDi,x. Based on A16,S28, and rule 1, we can obtain S29:RSU≡TA≡rTA. By A17,S29, and rule 2, it implies that S30:RSU≡TA≡rTA. Based on A18,S30, and rule 3, we can obtain S31:RSU|≡rTA. According to S2,S11, and S31, it implies that S32:RSU|≡OBU↔KSTA. (G3). Based on A16,S32, and rule 4, we can obtain S33:RSU≡OBU≡↔KSTA. (G6). According to A12,S32, and rule 4, it implies that S34:RSU≡TA≡OBU↔KSTA. (G7).ByM4, we have S35:OBU⊲M2,R2,t2. Based on A19,A20, and rule 4, we can obtain S36:OBU|≡OBU⇌hR0,R2,kR0,IDiRSU. According to S35, we have S37:OBU⊲rRSU,hR0,R2,kR0,IDi. Based on S36,S37, and rule 1, it implies that S38:OBU≡RSU∼rRSU. By A21,S38, and rule 2, we can obtain S39:OBU≡RSU≡rRSU. According to A22,S39, and rule 3, it implies that S40:OBU|≡rRSU.We haveS41:OBU⊲rTA,hOBU‖rRSU. Based on A23,S41, and rule 1, it implies that S42:OBU|≡TA∼rTA. By A24,S42, and rule 2, we can obtain S43:OBU≡TArTA. Based on A25,S43, and rule 3, it implies that S44:OBU|≡rTA. According to S40 and S44, we can obtain S45:OBU|≡OBU⟷KSTA. (G1). According to A24 and S45, we can obtain S46:OBU≡TA≡OBU⟷KSTA. (G4).


## 7.1.1. BAN-Logic Proof

The proof of proposed scheme through BAN-Logic analysis is as follows.S1 can be acquired from M1.S1:RSU⊲DIDi,M0,M1,R0,t0.S2:RSU≡OBU≡DIDi. Based on A4, S2, and rule 3, we can obtain S3:RSU|≡DIDi. According to S1, it implies that S4:RSU⊲rOBU,DIDiA1. By A5, S4, and rule 1, it implies that S5:RSU≡OBU∼rOBU,DIDi.By A6, S5, and rule 2, we can obtain S6:RSU≡OBU≡rOBU. According to A7,S6, and rule 3, it implies that S7:RSU|≡rOBU. According to S1, we have acquired S8:RSU⊲AIDi. By A5, S8, and rule 1, it implies that S9:RSU|≡OBU∼AIDi. By A8,S9, and rule 2, we can obtain S10:RSU≡OBU≡AIDi. According to A9,S10, and rule 3, it implies that S11:RSU|≡AIDi.ByM2, we can obtain S12:TA⊲DIDi,AIDi,t0 and further S13:TA≡RSU≡DIDi. Based on A10,S13, and rule 3, we can obtain S14:TA|≡DIDi. By A11,A12, and rule 4, it implies that S15:TA|≡⇌A1RSU. According to S12, we have S16:TA⊲PIDi∗RSU. Based on S15,S16, and rule 1, it implies that S17:TA|≡RSU∼rRSU. By A13,S17, and rule 2, we can obtain S18:TA≡RSU≡rRSU. According to A14,S18, and rule 3, it implies that S19:TA|≡rRSU. Based on A11,A12, and rule 4, we have S20:TA|≡TA⇌PIDi∗RSU. According to S12, we have S21:TA⊲rOBU. By S20,S21, and rule 1, it implies that S22:TA≡RSU∼rOBU. By A15,S22, and rule 2, we can obtain S23:TA≡RSU≡rOBU. Based on A26,S23, and rule 3, it implies that S24:TA|≡rOBU. KS=hR0,R2,kR0,IDi. S25:TA|≡OBU↔KSTA is obtained. (G2). According to A2,S25, and rule 4, we can obtain S26:RSU|≡OBU⇌A1RSU. (G5).ByM3, we have S27:RSU⊲BIDi,t1 and further S28:RSU⊲IDi=BIDi⊕hDIDi,x. Based on A16,S28, and rule 1, we can obtain S29:RSU≡TA≡rTA. By A17,S29, and rule 2, it implies that S30:RSU≡TA≡rTA. Based on A18,S30, and rule 3, we can obtain S31:RSU|≡rTA. According to S2,S11, and S31, it implies that S32:RSU|≡OBU↔KSTA. (G3). Based on A16,S32, and rule 4, we can obtain S33:RSU≡OBU≡↔KSTA. (G6). According to A12,S32, and rule 4, it implies that S34:RSU≡TA≡OBU↔KSTA. (G7).ByM4, we have S35:OBU⊲M2,R2,t2. Based on A19,A20, and rule 4, we can obtain S36:OBU|≡OBU⇌hR0,R2,kR0,IDiRSU. According to S35, we have S37:OBU⊲rRSU,hR0,R2,kR0,IDi. Based on S36,S37, and rule 1, it implies that S38:OBU≡RSU∼rRSU. By A21,S38, and rule 2, we can obtain S39:OBU≡RSU≡rRSU. According to A22,S39, and rule 3, it implies that S40:OBU|≡rRSU.We haveS41:OBU⊲rTA,hOBU‖rRSU. Based on A23,S41, and rule 1, it implies that S42:OBU|≡TA∼rTA. By A24,S42, and rule 2, we can obtain S43:OBU≡TArTA. Based on A25,S43, and rule 3, it implies that S44:OBU|≡rTA. According to S40 and S44, we can obtain S45:OBU|≡OBU⟷KSTA. (G1). According to A24 and S45, we can obtain S46:OBU≡TA≡OBU⟷KSTA. (G4).


## 7.2. Security Discussion

The security feature provision and resistance of the proposed scheme against various attacks are explained in the following subsection.


### 7.2.1. Anonymity and Untraceability

In the proposed TFPPASV protocol, the identityIDi of the user is secure, because in TFPPASV, the vehicle sends a pseudo identity DIDi=hIDi∗,yi∗⊕hR1,t0 instead of its original identity IDi over the communication channel. The attacker can intercept DIDi, but it cannot extract IDi because it is concealed in a oneway hash function along with a random number and other parameters. The only method to get the identity is to break the hash function and get knowledge of random numbers involved in the computation of DIDi. Thus, the protocol provides user anonymity. In addition, the proposed protocol provides untraceability for the user because when the message is transmitted on a communication channel, it uses a random number during the authentication process. Thus, the attacker is not able to track the user.


### 7.2.2. Perfect Forward Secrecy

The proposed TFPPASV protocol provides ultimate forward secrecy because it uses various random numbers during the message transmission. Three parametersRO=rP,R2=kP and kR0 are used to construct the session key KS=hR0,R2,kR0,IDi. If an attacker wants to launch an attack on the basis of a compromised session key, the attacker is not able to obtain the previous and subsequent session keys. Thus, the proposed protocol provides forward secrecy.


### 7.2.3. Replay Attack

The proposed TFPPASV protocol provides resistance against the replay attack. Three entitiesOBU, RSU, and TA are involved in the authentication phase of the proposed TFPPASV protocol. These entities send the messages to each other such as DIDi,M0,M1,R0,t0, DIDi,AIDi,t0,BIDi,t1, and M2,R2,t2. In each of these messages, random numbers and timestamps are used and these are session specific. If an attacker wants to launch a replay attack, the replayed message cannot pass the verification process and the recipient can easily identify the replay attack.


### 7.2.4. Offline Password Guessing Attack

Our TFPPASV protocol provides resistance against offline password guessing attack. During registration phase, some parameters are stored into SC such asCi=hIDi,PWi,αi⊕yi, Di=hPWi,yi,αi. The PWi is masked with yi generated randomly and the biometric key αi. Thus, attacker is not able to guess the password.


### 7.2.5. Impersonation Attack

Our TFPPASV protocol provides resistance against impersonation assaults such asOBU impersonation assault, RSU impersonation assault, and TA impersonation assault.OBU impersonation attack: if an attacker tries to impersonate the OBU, it requires to construct the original login request message: DIDi′,M0′,M1′,R0′,t0′DIDi′=hIDi∗,yi∗⊕hR1,t0, M0′=Ai∗⊕R1,t0, M1′=hIDi∗,DIDi,Ai∗,R1,t0, and R0′=rP with updated random number r and timestamp tO. However, it is computationally difficult to recover tO, DIDi, and R1 for constructing DIDi′, M0′, M1′, R0′,t0′. Thus, the proposed protocol provides security against OBU impersonation.RSU impersonation attack: for the execution of a RSU impersonation attack, the attacker tries to instigate a forgery to TA on behalf of the RSU. The attacker needs to construct the DIDi′,AIDi′,tO′ with updated timestamp. In addition, it requires more confidential parameters such as x,R0 and R1. It is computationally hard to calculate these parameters from DIDi,M0,M1,R0,t0. Thus, the proposed TFPPASV scheme provides security against RSU impersonation.TA impersonation attack: in the case of TA impersonation, the attacker needs to construct BIDi′,t1 with an updated timestamp, and in addition, it requires the private key x, where BIDi′=DIDi,x⊕IDi. However, the attacker is not able to form the message until it gets the private key x and DIDi. Thus, the attacker is not able to launch TA impersonation attack.


### 7.2.6. Smart Card Stolen

The proposed protocol provides security against SC stolen. If an attacker captures the SC and gets the informationG.p,P,βi,Ci,Di,Ei,h from the SC and it wants to login via SC, the attacker also needs the user IDi, PWi, and the biometric key αi in polynomial time, which is not possible for the attacker. Thus, the attacker is not able to complete a successful login.


### 7.2.7. Man-in-the-Middle Attack

If the attackers want to launch attack as a man-in-the-middle, it needs to capture the messagesDIDi,M0,Mi,R0,R1, DIDi,AIDi,t0, BIDi,t1, and M2,R2,t2 from the public communication channel. The attacker must change or replace the message and forward it on the channel to get authenticated from both sides. However, due to the inability of construction of legal messages, the attacker may not be able to get authenticated from any side without getting IDi and PWi and private key x of the TA.


### 7.2.8. Insider Attack

The proposed TFPPASV protocol protects from insider attacks because at the time of registration, user registers itself withTA on a secure channel. In addition, stored user passwords are in the ciphertext. It is computationally difficult for any dishonest insider to get information related to passwords and keys.


## 7.2.1. Anonymity and Untraceability

In the proposed TFPPASV protocol, the identityIDi of the user is secure, because in TFPPASV, the vehicle sends a pseudo identity DIDi=hIDi∗,yi∗⊕hR1,t0 instead of its original identity IDi over the communication channel. The attacker can intercept DIDi, but it cannot extract IDi because it is concealed in a oneway hash function along with a random number and other parameters. The only method to get the identity is to break the hash function and get knowledge of random numbers involved in the computation of DIDi. Thus, the protocol provides user anonymity. In addition, the proposed protocol provides untraceability for the user because when the message is transmitted on a communication channel, it uses a random number during the authentication process. Thus, the attacker is not able to track the user.


## 7.2.2. Perfect Forward Secrecy

The proposed TFPPASV protocol provides ultimate forward secrecy because it uses various random numbers during the message transmission. Three parametersRO=rP,R2=kP and kR0 are used to construct the session key KS=hR0,R2,kR0,IDi. If an attacker wants to launch an attack on the basis of a compromised session key, the attacker is not able to obtain the previous and subsequent session keys. Thus, the proposed protocol provides forward secrecy.


## 7.2.3. Replay Attack

The proposed TFPPASV protocol provides resistance against the replay attack. Three entitiesOBU, RSU, and TA are involved in the authentication phase of the proposed TFPPASV protocol. These entities send the messages to each other such as DIDi,M0,M1,R0,t0, DIDi,AIDi,t0,BIDi,t1, and M2,R2,t2. In each of these messages, random numbers and timestamps are used and these are session specific. If an attacker wants to launch a replay attack, the replayed message cannot pass the verification process and the recipient can easily identify the replay attack.


## 7.2.4. Offline Password Guessing Attack

Our TFPPASV protocol provides resistance against offline password guessing attack. During registration phase, some parameters are stored into SC such asCi=hIDi,PWi,αi⊕yi, Di=hPWi,yi,αi. The PWi is masked with yi generated randomly and the biometric key αi. Thus, attacker is not able to guess the password.


## 7.2.5. Impersonation Attack

Our TFPPASV protocol provides resistance against impersonation assaults such asOBU impersonation assault, RSU impersonation assault, and TA impersonation assault.OBU impersonation attack: if an attacker tries to impersonate the OBU, it requires to construct the original login request message: DIDi′,M0′,M1′,R0′,t0′DIDi′=hIDi∗,yi∗⊕hR1,t0, M0′=Ai∗⊕R1,t0, M1′=hIDi∗,DIDi,Ai∗,R1,t0, and R0′=rP with updated random number r and timestamp tO. However, it is computationally difficult to recover tO, DIDi, and R1 for constructing DIDi′, M0′, M1′, R0′,t0′. Thus, the proposed protocol provides security against OBU impersonation.RSU impersonation attack: for the execution of a RSU impersonation attack, the attacker tries to instigate a forgery to TA on behalf of the RSU. The attacker needs to construct the DIDi′,AIDi′,tO′ with updated timestamp. In addition, it requires more confidential parameters such as x,R0 and R1. It is computationally hard to calculate these parameters from DIDi,M0,M1,R0,t0. Thus, the proposed TFPPASV scheme provides security against RSU impersonation.TA impersonation attack: in the case of TA impersonation, the attacker needs to construct BIDi′,t1 with an updated timestamp, and in addition, it requires the private key x, where BIDi′=DIDi,x⊕IDi. However, the attacker is not able to form the message until it gets the private key x and DIDi. Thus, the attacker is not able to launch TA impersonation attack.


## 7.2.6. Smart Card Stolen

The proposed protocol provides security against SC stolen. If an attacker captures the SC and gets the informationG.p,P,βi,Ci,Di,Ei,h from the SC and it wants to login via SC, the attacker also needs the user IDi, PWi, and the biometric key αi in polynomial time, which is not possible for the attacker. Thus, the attacker is not able to complete a successful login.


## 7.2.7. Man-in-the-Middle Attack

If the attackers want to launch attack as a man-in-the-middle, it needs to capture the messagesDIDi,M0,Mi,R0,R1, DIDi,AIDi,t0, BIDi,t1, and M2,R2,t2 from the public communication channel. The attacker must change or replace the message and forward it on the channel to get authenticated from both sides. However, due to the inability of construction of legal messages, the attacker may not be able to get authenticated from any side without getting IDi and PWi and private key x of the TA.


## 7.2.8. Insider Attack

The proposed TFPPASV protocol protects from insider attacks because at the time of registration, user registers itself withTA on a secure channel. In addition, stored user passwords are in the ciphertext. It is computationally difficult for any dishonest insider to get information related to passwords and keys.


## 8. Security and Performance Analysis

This section describes the security features and computational and communication cost of the proposed TFPPASV scheme in relation to other schemes [10, 32–34].


### 8.1. Security Feature

Table3 provides the complete bird’s eye view of the security feature comparison of our TFPPASV scheme with related schemes [10, 32–34]. Through BAN-Logic analysis, we prove that our proposed scheme is correct. Section 5.1 discusses Xu et al.’s scheme [10] which has TA bypassing issue, and if RSU is dishonest, it can easily bypass the TA and establish a connection directly with OBU. Ma et al.’s [32] scheme does not provide security against malicious user tracking, offline password attack, and smart card stolen attack. Cui et al.’s [33] scheme is also insecure against the man-in-the-middle attack, offline password, and smart card stolen attacks. Zhong et al.’s [34] scheme failed to provide security against the man-in-the-middle attack, offline password attack, and smart card stolen attack. The proposed scheme provides better security features compared to other related schemes [10, 32–34].Table 3
Security feature performance analysis.
SchemesOurs[10][32][33][34]Correctness✓✓✓✓✓Vehicle impersonation attack✓✓✓✓✓Trusted authority impersonation attack✓✓✓✓✓Vehicle server impersonation attack✓✓✓✓✓Stolen SC attack✓✓✗✗✗Anonymity attack✓✓✓✓✓Untraceability attack✓✓✓✓✓Man-in-the-middle attack✓✓✗✗✗Offline password guessing attack✓✓✗✗✗Replay attack✓✓✓✓✓Mutual authentication✓✓✓✓✓Malicious user tracing✓✓✓✗✗TA bypassing✓✗✓✓✓Note. ✓: provides or resists; ✗: does not provide or does not resist.


### 8.2. Computational Cost

In this section, we calculate the computational cost (CC) of the proposed TFPPASV scheme and compare it with the related schemes. Before calculating CC, we denote some symbols as follows:xor operation is denoted by T⊕, the execution time for scale multiplication on ECC is denoted by Tsm, and the execution time for hash function is represented by Th. For calculating the CC, the real-time hardware platform with the following specifications: CPU:Intel I7-6700, with 4.00 GHz RAM 16 GB OS windows 10th, is adopted from [35]. Tsm furnishes in 0.442ms, and the running time of Th is 0.0001, while T⊕ takes negligible time to complete the execution. Thus, T⊕ is being ignored in the comparisons. We used SHA256 with 256 bit hash digest and the size of identity and random numbers are fixed at 64 bits. The proposed scheme executes 6Tsm+15Th+8T⊕ operations with the running time of 2.6535ms. Referring to Table 4, computational cost of the proposed TFPPASV scheme is low as compared to Ma et al.’s scheme [32] and a bit high as compared to Cui et al. and Zhong et al.’s schemes [33, 34], respectively. However, the proposed TFPPASV scheme offers more security features as compared with related schemes.Table 4
Performance comparisons.
SchemeComputation costRT (ms)MEBESOOurs6Tsm+15Th+8T⊕2.6535425601024Xu et al. [10]6Tsm+15Th+8T⊕2.6535425601024Ma et al. [32]17Tsm+19Th+3T⊕7.515944992832Cui et al. [33]6Tsm+3Th2.652333840512Zhong et al. [34]1Tsm+6Th0.442634648320Note. RT: running time; ME: no. of message exchanges; BE: bit exchange; SO: storage overhead.


### 8.3. Communication Cost

To calculate the communication cost of the proposed TFPPASV scheme and to compare it with related schemes, we adopted SHA-256 with 256 bit size. We also adopted 256 bit ECC parameters. In addition, identities and timestamps are taken as 64 bit length. In the proposed TFPPASV scheme, total four messages are exchanged for a successful authentication process completion. In message 1,DIDi,M0,M1,R0,t0=256+256+256+256+64=1088 bits are sent from OBU to RSU. In message 2, DIDi,AIDi,t0=256+256+64=576 bits are sent from RSU to TA. In message 3, BIDi,t1=256+64=320 bits are sent from TA to RSU. In message 4, M2,R2,t2=256+256+64=576 bits are sent from RSU to OBU. Total communication cost of the proposed TFPPASV scheme is =1088+576+320+576=2560 bits. Referring to Table 2, the TFPPASV scheme has low communication as compared to other related schemes [32–34].


### 8.4. Storage Cost

The proposed TFPPASV stores four authentication related parametersP,βi,Ci,Di in addition to h function and system parameters G,p. The system parameters and functions take marginal memory and are stored in the smart card in all competing authentication schemes. Therefore, for analysis and comparison purposes, we focus on the authentication related parameters. The storage cost of the proposed TFPPASV P,βi,Ci,Di=256+256+256+256=1024 bits. The storage cost of Xu et al.’s scheme is also same (i.e., 1024 bits). The storage cost of Ma et al. [32], Cui et al. [33], and Zhong et al. [34] is 832, 512, and 320, respectively.


## 8.1. Security Feature

Table3 provides the complete bird’s eye view of the security feature comparison of our TFPPASV scheme with related schemes [10, 32–34]. Through BAN-Logic analysis, we prove that our proposed scheme is correct. Section 5.1 discusses Xu et al.’s scheme [10] which has TA bypassing issue, and if RSU is dishonest, it can easily bypass the TA and establish a connection directly with OBU. Ma et al.’s [32] scheme does not provide security against malicious user tracking, offline password attack, and smart card stolen attack. Cui et al.’s [33] scheme is also insecure against the man-in-the-middle attack, offline password, and smart card stolen attacks. Zhong et al.’s [34] scheme failed to provide security against the man-in-the-middle attack, offline password attack, and smart card stolen attack. The proposed scheme provides better security features compared to other related schemes [10, 32–34].Table 3
Security feature performance analysis.
SchemesOurs[10][32][33][34]Correctness✓✓✓✓✓Vehicle impersonation attack✓✓✓✓✓Trusted authority impersonation attack✓✓✓✓✓Vehicle server impersonation attack✓✓✓✓✓Stolen SC attack✓✓✗✗✗Anonymity attack✓✓✓✓✓Untraceability attack✓✓✓✓✓Man-in-the-middle attack✓✓✗✗✗Offline password guessing attack✓✓✗✗✗Replay attack✓✓✓✓✓Mutual authentication✓✓✓✓✓Malicious user tracing✓✓✓✗✗TA bypassing✓✗✓✓✓Note. ✓: provides or resists; ✗: does not provide or does not resist.


## 8.2. Computational Cost

In this section, we calculate the computational cost (CC) of the proposed TFPPASV scheme and compare it with the related schemes. Before calculating CC, we denote some symbols as follows:xor operation is denoted by T⊕, the execution time for scale multiplication on ECC is denoted by Tsm, and the execution time for hash function is represented by Th. For calculating the CC, the real-time hardware platform with the following specifications: CPU:Intel I7-6700, with 4.00 GHz RAM 16 GB OS windows 10th, is adopted from [35]. Tsm furnishes in 0.442ms, and the running time of Th is 0.0001, while T⊕ takes negligible time to complete the execution. Thus, T⊕ is being ignored in the comparisons. We used SHA256 with 256 bit hash digest and the size of identity and random numbers are fixed at 64 bits. The proposed scheme executes 6Tsm+15Th+8T⊕ operations with the running time of 2.6535ms. Referring to Table 4, computational cost of the proposed TFPPASV scheme is low as compared to Ma et al.’s scheme [32] and a bit high as compared to Cui et al. and Zhong et al.’s schemes [33, 34], respectively. However, the proposed TFPPASV scheme offers more security features as compared with related schemes.Table 4
Performance comparisons.
SchemeComputation costRT (ms)MEBESOOurs6Tsm+15Th+8T⊕2.6535425601024Xu et al. [10]6Tsm+15Th+8T⊕2.6535425601024Ma et al. [32]17Tsm+19Th+3T⊕7.515944992832Cui et al. [33]6Tsm+3Th2.652333840512Zhong et al. [34]1Tsm+6Th0.442634648320Note. RT: running time; ME: no. of message exchanges; BE: bit exchange; SO: storage overhead.


## 8.3. Communication Cost

To calculate the communication cost of the proposed TFPPASV scheme and to compare it with related schemes, we adopted SHA-256 with 256 bit size. We also adopted 256 bit ECC parameters. In addition, identities and timestamps are taken as 64 bit length. In the proposed TFPPASV scheme, total four messages are exchanged for a successful authentication process completion. In message 1,DIDi,M0,M1,R0,t0=256+256+256+256+64=1088 bits are sent from OBU to RSU. In message 2, DIDi,AIDi,t0=256+256+64=576 bits are sent from RSU to TA. In message 3, BIDi,t1=256+64=320 bits are sent from TA to RSU. In message 4, M2,R2,t2=256+256+64=576 bits are sent from RSU to OBU. Total communication cost of the proposed TFPPASV scheme is =1088+576+320+576=2560 bits. Referring to Table 2, the TFPPASV scheme has low communication as compared to other related schemes [32–34].


## 8.4. Storage Cost

The proposed TFPPASV stores four authentication related parametersP,βi,Ci,Di in addition to h function and system parameters G,p. The system parameters and functions take marginal memory and are stored in the smart card in all competing authentication schemes. Therefore, for analysis and comparison purposes, we focus on the authentication related parameters. The storage cost of the proposed TFPPASV P,βi,Ci,Di=256+256+256+256=1024 bits. The storage cost of Xu et al.’s scheme is also same (i.e., 1024 bits). The storage cost of Ma et al. [32], Cui et al. [33], and Zhong et al. [34] is 832, 512, and 320, respectively.


## 9. Conclusion

In this study, we analyzed a recent authentication scheme and proved that the scheme of Xu et al. can become a victim ofTA bypassing attack by a dishonest RSU. We then introduced an improved and bypassing free authentication scheme (TFPPASV) for VANETs. We used the lightweight ECC and symmetric key based functions to design our proposed TFPPASV scheme. In addition to a comprehensive discussion on the security feature provision of TFPPASV, we utilized the BAN-Logic analysis to prove the formal security of the TFPPASV. We also compared the security and performance of the TFPPASV with related schemes and showed that the proposed TFPPASV offers a good trade-off between the security and performance criterion. Therefore, it can be concluded that the TFPPASV is best suitable in practical VANET scenarios.



---

*Source: 8259927-2022-09-30.xml*