# An Enhanced RFID-Based Authentication Protocol using PUF for Vehicular Cloud Computing

Authors: Vikas Kumar; Rahul Kumar; Srinivas Jangirala; Saru Kumari; Sachin Kumar; Chien-Ming Chen
Journal: Security and Communication Networks
 (2022)

---

## Abstract

RFID (radio frequency identification) is an Internet of Things (IoT) enabling technology. All physical devices can be connected to the Internet of Things thanks to RFID. When RFID is extensively utilized and fast increasing, security and privacy concerns are unavoidable. Interception, manipulation, and replay of the wireless broadcast channel between the tag and the reader are all possible security threats. Unverified tags or readers provide untrustworthy messages. IoT requires a safe and consistent RFID authentication system. PUFs are also physical one-way functions made up of the unique nanoscopic structure of physical things and their reactivity to random occurrences. PUF includes an unclonable feature that takes advantage of physical characteristics to boost security and resistance to physical attacks. We analyze the security of the RSEAP2 authentication protocol that has been recently proposed by Safkhani et al., a hash-based protocol, and elliptic curve cryptosystem-based protocol. Our security analysis clearly shows important security pitfalls in RSEAP2 such as mutual authentication, session key agreement, and denial-of-service attack. In our proposed work, we improved their scheme and enhanced their version using physically unclonable function (PUF), which are used by the proposed protocol in tags. This research proposes a cloud-based RFID authentication technique that is both efficient and trustworthy. To decrease the RFID tag’s overhead, the suggested authentication approach not only resists the aforementioned typical assaults and preserves the tag’s privacy, but also incorporates the cloud server into the RFID system. According to simulation results, our approach is efficient. Moreover, according to our security study, our protocol can withstand a variety of attacks, including tracking, replay, and desynchronization assaults. Our scheme withstands all the 18 security features and further consumes the computation cost as 14.7088 ms which is comparable with the other schemes. Similarly, our scheme consumes the communication cost as 672 bits during the sending mode and 512 bits during the receiving mode. Overall, the performance of our proposed method is equivalent to that of related schemes and provides additional security features than existing protocols. Mutual authentication, session key generation, and ephemeral session security are all achieved. Using the real-or-random concept, we formalize the security of the proposed protocol.


---

## Body

## 1. Introduction

Recognition technologies are deserving of our attention as they are both essential parts of the Internet of Things. Recognition of barcodes, optical characters, biometric identity, and magnetic card identification and contact IC card identification are all examples of traditional automated identification technologies. However, when employed in the IoT, they have a number of drawbacks. Bar codes, for example, can only hold a limited amount of data; optical character recognition is too expensive; biological recognition is flawed; and magnetic card and contact IC card identification need intimate touch, which is inflexible. Currently, some of these identification methods are unable to protect personal information [1]. In contrast, RFID is a noncontact automatic identification technology that does not need mechanical or visual contact between the system and the target, and security protections can help keep user information private. Because of these advantages, RFID has emerged as one of the most promising IoT technologies [2].An RFID system consists of RFID tags, RFID readers, and a database server. Tag-affixed objects are uniquely identifiable, and their identifying information is saved. They communicate with the reader using radio waves. In a typical RFID system, the database server is a local back-end server.When RFID devices generate a large number of data, back-end servers’ performance is limited. Cloud computing overcomes this problem in the IoT context. As a result, the integration of the cloud platform with the RFID system is required [2, 3]. RFID systems’ reliability and data processing capabilities have dramatically enhanced since the introduction of cloud computing. Almost all of the data acquired by RFID sensors are processed on the cloud, which can aid in the resolution of issues such as data loss and latency [4]. In the IoT, the most commonly used public cloud servers are only semi-trustworthy. Because of the properties described above, the RFID system is vulnerable to attack. As a result, IoT necessitates the use of a secure and reliable RFID authentication system.Similarly, a number of protocols based on physically unclonable functions (PUFs) have been proposed [12–14]. PUFs are, in reality, physical one-way functions derived from the unique nanoscopic structure of physical things (e.g., integrated circuits, crystals, magnets, lenses, solar cells, or papers) and their reactivity to random occurrences. The quirks in the manufacturing process of the items are responsible for the innate uniqueness of the structure and reactivity. It enables for both the unique identification and authentication of an object. Furthermore, it is considered that copying an object’s PUF (and hence the object itself) is impossible, which might be seen as a security-by-design feature that prevents impersonation and cloning attacks. As a result, PUFs are regarded as a trustworthy and well-known physical security method for developing IoT authentication protocols. Physical devices are protected by PUF-based protocols, which are resistant to physical attacks and provide multilayer protection. Furthermore, even if the device is stolen, the attacker will not be able to use the PUF. However, the majority of proposed VANET solutions are still subject to different security concerns such as replay attacks, impersonation attacks, forgery attacks, and non-repudiation attacks. As a result, it is critical to build a viable VANET solution to address the existing issues.


## 2. Literature and Related Works

Several RFID authentication schemes have used elliptic curve cryptography in recent years (ECC). Due to the difficulties of resolving the discrete logarithm problem (DLP), ECCs have demonstrated their efficiency in assuring security and privacy. The state-of-the-art of ECC-based RFID, mobile computing, and VCC authentication protocols are reviewed in this section and are shown in Table1. Also, the details of PUF-based recent works are given in Table 2.Table 1
Summary of cryptographic techniques applied and limitations of previous existing user authentication mechanisms.
SchemeYearCryptographic techniquesAdvantagesDrawbacks/limitationsJiang et al. [3]2018(i) Uses “one-way cryptographic hash function”(i) Fits for vehicular cloud networking environment(i) Fails to preserve “revocability”(ii) Prone to “replay attack”Alamr et al. [5]2018(i) Based on “RFID”(i) Applicable in IoT environment(i) Does not support “revocability and password/biometric update”(ii) Applies “ECC cryptographic technique”(ii) Vulnerable to “data integrity and key compromise”(iii) Uses “to support IoT”Dinarvand and Barati [6]2019(i) Based on “RFID technology” uses “one-way cryptographic hash function”(i) Does not fit for generic IoT networking environment(i) Fails to preserve “impersonation and key compromise”(ii) Based on “ECC cryptographic technique”(ii) No “formal security” analysisBagga et al. [1]2018(i) Based on “three factors (user mobile device, user password, and personal biometrics”(i) Applicable in industrial IoT environment(i) Does not support “revocability and password/biometric update”(ii) Applies “ECC cryptographic technique”(ii) Vulnerable to “known session key attack”(iii) Uses “fuzzy extractor for biometric verification”Kumar et al. [7]2020(i) Based on “three factors (smart card, user password, and biometrics)” uses “one-way cryptographic hash function”(i) Fits for generic IoT networking environment(i) Fails to preserve “revocability”(ii) Based on “fuzzy extractor for biometric verification”(ii) No “formal security” analysisJiang et al. [4]2018(i) Based on “three factors (user mobile device, user password, and personal biometrics”(i) Applicable in cloud environment(i) Does not support “revocability and password/biometric update”(ii) Applies “ECC cryptographic technique”(ii) Vulnerable to “known session key attack”(iii) Uses “fuzzy extractor for biometric verification”Hosseinzadeh et al. [8]2020(i) Based on “RFID systems” uses “one-way cryptographic hash function”(i) Fits for IoT networking environment(i) Fails to preserve “revocability”(ii) No “session key agreement”Zhu [9]2020(i) Based on “RFID systems and quadratic residue” uses “Gong-Needham-Yahalom (GNY) logic”(i) Fits for healthcare environment(i) Fails to preserve “revocability”(ii) Confined to “healthcare system”(ii) Desynchronization issuesGabsi et al. [10]2021(i) Based on “RFID systems” uses “arithmetic calculation of ECC”(i) Fits for communicating reader to reader environment(i) Does not have to freedom to connect with the cloud server(ii) Based on “ECC cryptographic system”(ii) Not suitable for cloud environmentMishra et al. [11]2018(i) Based on “three factors (user mobile device, user password, and personal biometrics”(i) Applicable in industrial IoT environment(i) Does not support “revocability and password/biometric update”(ii) Applies “ECC cryptographic technique”(ii) Vulnerable to “known session key attack”(iii) Uses “fuzzy extractor for biometric verification”Safkhani et al. [2]2021(i) Based on “RFID and ECC cryptosystem” Uses “one-way cryptographic hash function”(i) Fits for IoT networking environment(i) Fails to establish “mutual authentication”(i) No proper “session key agreement”(ii) Could not resist “denial-of-service”Table 2
Summary of cryptographic techniques applied using PUF authentication mechanisms.
SchemeYearCryptographic techniques and environmentAdvantagesDrawbacks/limitationsXu et al. [15]2021Based on PUF is applicable for RFID healthcare systemsFits for healthcare systemsDoes not support “revocability.” Vulnerable to “know session key attack”Gope and Sikdar [16]2019Based on smart grid communication systems. The lightweight cryptographic primitives such as physically unclonable functions and one-way hash function is utilizedA novel privacy-aware authenticated key agreement scheme which can not only ensure secure communication between smart meters and the service providers, but also the physical security of smart meters(i) Does not support “revocability and password/biometric update”(ii) Vulnerable to “known session key attack”Cao et al. [17]2021(i) Based on “three factors (user mobile device, user password, and personal biometrics”(i) Applicable in smart grid environment and data collection scheme(i) Does not support “revocability and password/biometric update”(ii) Applies “ECC cryptographic technique”(ii) Vulnerable to “mutual authentication attack” and “known session key attack”(iii) Uses “fuzzy extractor for biometric verification”Zhang et al. [18]2020Key distribution in wireless sensor networksIt did not only save the storage overhead, but also provided perfect resilience against sensor capture attacksThis cannot resist anonymity, traceability, and forward secrecy attacksMall et al. [19]2022This approach is a survey on PUF-based authentication and key agreement protocols for IoT, WSN, and smart grids(i) This survey paper can be utilized to understand the technologies such as IoT, WSN, and smart grids and the way to address the AKA in these technologiesThis study fails to address the security pitfalls which can integrate all these technologies(ii) Systematically and taxonomically examine and discuss with pros and cons of AKA applications to the fast-growing areas of IoT, WSNs, and smart grids based on a meticulous survey of existing literatureLiu et al. [20]2021Key distribution for dynamic sensor networksCompared with traditional key predistribution schemes, the proposal reduces the storage overhead and the key exposure risks and thereby improves the resilience against node capture attacksThis study cannot be applied to the current technologies such as IoT and cloud computingMukhopadhyay [21]2016PUFs as promising tools for security in Internet of Things. This article discusses about security violation in the authentication of a commercial IoT(i) Studied the lightweight construction of PUFsThis study fails to address the security features and how they can be applied for the AKA protocols(ii) Proof context test-bed simulations were presented for commercially available tools to show how PUFs can interact with other IoT nodes to provide overall securityWang et al. [22]2021Blockchain and lightweight authentication protocol for wireless medical sensor networks. Applies “fuzzy extractor for biometric verification”Incorporated for blockchain and wireless medical sensor networks(i) Desynchronization attacks(ii) Excess communication costLee and Chen [23]2021Lightweight fog computing-based authentication protocols using physically unclonable functions for Internet of medical Things(i) The proposed protocols use lightweight cryptographic operations, including a one-way cryptographic hash function, the barrel shifter physically unclonable function (BS-PUF)This study is restricted to fog environment(ii) This study ensures the security of the sensors and fog nodes and to avoid a computational burden on devicesHassija et al. [24]2021A survey on supply chain security: application areas, security threats, and solution architectures(i) This article discusses the supply chain’s security critical application areas and presents a detailed survey of the security issues in the existing supply chain architectureThis study is a survey work and fails to address the security features and how they can be applied for the AKA protocols(ii) Various emerging technologies, such as blockchain, machine learning (ML), and physically unclonable functions (PUFs) as solutions to the vulnerabilities in the existing infrastructure of the supply chain


### 2.1. Problem Definition

Security protocols, such as authentication methods, are supposed to ensure the confidentiality, integrity, and availability (CIA triangle) of security. The parties to the protocols must be able to authenticate and synchronize with one another at any moment. Desynchronization attacks can break this condition by blocking protocol messages or forcing protocol parties to modify their shared secret values to different values, preventing the parties from authenticating each other and destroying service availability. Many protocols have been developed in the literature to satisfy CIA security standards; however, multiple instances of attacks [2, 10–14] against them show that they have failed to achieve the needed security. As a result, attempts to build a secure protocol are still continuing, and new attacks are emerging that provide designers fresh insight into how to (not) design a protocol. As a result of these assaults and security evaluations, the protocols have progressed.


### 2.2. Motivation and Contributions

In recent years, a number of key agreement and authentication techniques have been created. Most of these protocols have a greater calculation cost, making them unsuitable with devices with limited resources. We also noticed that the literature reviewed above did not take into account the physical factors of security for vehicle RFID communication systems in VCC situations. However, in the automotive RFID communication environment, the necessity of PUF receives a lot of attention in the literature.A PUF-based protocol is capable of dealing with physical security risks. Even stealing the PUF from the on-board memory will not allow an attacker to obtain it. As a result, for VCC, we developed a PUF-enabled RFID-based authentication protocol. The following are some of the many contributions made by this research:(1)
To build an authentication protocol for VCC communication, the system and threat models are defined first.(2)
We created a PUF-enabled RFID-based authentication mechanism using the hypothesized attack model.(3)
To keep the proposed protocol’s cost minimal, only fundamental cryptographic operations such as ECC, XOR, concatenation, and hash function are used. PUF is also used to protect against recognized physical security risks.(4)
Our approach ensures that possible security threats are avoided, based on formal and informal security assessments.(5)
The results of the performance study show that our protocol is superior to other similar protocols.


### 2.3. Roadmap of Article

The rest of the article is structured as follows: The preliminaries are presented in Section3. The RSEAP2 system is described in detail in Section 4. We give a security study of the RSEAP2 protocol as well as various efficient and strong attacks against it in Section 5. The improved protocol is presented in Section 6. In Section 7, we provide a verifiable security analysis of our approach. The performance analysis is presented in Section 8. Section 9 concludes the article.


## 2.1. Problem Definition

Security protocols, such as authentication methods, are supposed to ensure the confidentiality, integrity, and availability (CIA triangle) of security. The parties to the protocols must be able to authenticate and synchronize with one another at any moment. Desynchronization attacks can break this condition by blocking protocol messages or forcing protocol parties to modify their shared secret values to different values, preventing the parties from authenticating each other and destroying service availability. Many protocols have been developed in the literature to satisfy CIA security standards; however, multiple instances of attacks [2, 10–14] against them show that they have failed to achieve the needed security. As a result, attempts to build a secure protocol are still continuing, and new attacks are emerging that provide designers fresh insight into how to (not) design a protocol. As a result of these assaults and security evaluations, the protocols have progressed.


## 2.2. Motivation and Contributions

In recent years, a number of key agreement and authentication techniques have been created. Most of these protocols have a greater calculation cost, making them unsuitable with devices with limited resources. We also noticed that the literature reviewed above did not take into account the physical factors of security for vehicle RFID communication systems in VCC situations. However, in the automotive RFID communication environment, the necessity of PUF receives a lot of attention in the literature.A PUF-based protocol is capable of dealing with physical security risks. Even stealing the PUF from the on-board memory will not allow an attacker to obtain it. As a result, for VCC, we developed a PUF-enabled RFID-based authentication protocol. The following are some of the many contributions made by this research:(1)
To build an authentication protocol for VCC communication, the system and threat models are defined first.(2)
We created a PUF-enabled RFID-based authentication mechanism using the hypothesized attack model.(3)
To keep the proposed protocol’s cost minimal, only fundamental cryptographic operations such as ECC, XOR, concatenation, and hash function are used. PUF is also used to protect against recognized physical security risks.(4)
Our approach ensures that possible security threats are avoided, based on formal and informal security assessments.(5)
The results of the performance study show that our protocol is superior to other similar protocols.


## 2.3. Roadmap of Article

The rest of the article is structured as follows: The preliminaries are presented in Section3. The RSEAP2 system is described in detail in Section 4. We give a security study of the RSEAP2 protocol as well as various efficient and strong attacks against it in Section 5. The improved protocol is presented in Section 6. In Section 7, we provide a verifiable security analysis of our approach. The performance analysis is presented in Section 8. Section 9 concludes the article.


## 3. Definitions and Mathematical Preliminaries

The key size comparison between the public-key cryptosystems like ECC and RSA shows that the communication messages can utilize the elliptic curve cryptosystem to reduce the communication bandwidth. The key size comparison between ECC and RSA is given in Table3.


### 3.1. Background of ECC

“LetE denotes an elliptic curve over the prime finite field Fq, where q be the large prime number. An equation of elliptic curve over Fq is given by v2=u3+αu+βmodq, where α,β∈Fq. The elliptic curve is said to be nonsingular if 4α3+27β2modq≠0. The additive elliptic curve group G is defined as G=u,v:u,v∈Fqu,v∈E∪Φ, where the point Φ is known as asymptotic point which work as the identity element or zero element in G.”Some operations on the groupG are as follows [2, 7]:(1)
Let∨=u,v∈G, then define −∨=u,−v and ∨+−∨=Φ.(2)
If∨1=u1,v1 and ∨2=u2,v2∈G, then ∨1+∨2=u3,v3, where u3=ρ2−u1−u2modqv3=ρu1−u2−v1modq and ρ=v2−v1/u2−u1modq,if∨1≠∨2,3u12+α/2v1modq,if∨1=∨2(3)
Let∨=u,v∈G, then scalar multiplication in G is defined as: η.∨=∨+∨+∨+⋯+∨η−times.(4)
Ifg is the generator of G with order η, then η.g=Φ.(a)
“Elliptic curve discrete logarithm problem (ECDLP)”: Findingμ∈Zq∗ such that ∨2=μ.∨1, for a given ∨1,∨2∈G is difficult.(b)
“Elliptic curve computational Diffie–Hellman problem (ECCDHP)”: Ifg is the generator of G and α.g, β.g are supplied (g, α.g, β.g), then computing α.β.g in G is difficult.Table 3
Key size comparison between ECC and RSA.
S. NoECC key size (bits)RSA key size (bits)Key size ratio116310241 : 6225630721 : 12338476801 : 204512153601 : 30


### 3.2. Physically Unclonable Function

ThePUF hardware primitive accepts a challenge C and generates the matching response R from the physical properties of its integrated chip IC and C. A PUF may easily be thought of as a one-way function R=PUFC since both the accepted challenge C and the produced answer R are bit strings [14].In essence,PUF security is based on the fact that, even if various ICs use the same production processes, each IC will be somewhat different owing to manufacturing variances. The following are the characteristics of PUF [15]:(i)
Uniqueness: A PUF cannot be duplicated;(ii)
Unidirectionality: In the real manufacturing circuit, the variances between input and output function mapping are both fixed and unpredictable. It is the hardware counterpart of the one-way function in this regard;(iii)
Invulnerability: Any effort to tamper with the device containing thePUF will cause the PUF to modify its behaviour and, as a result, it will be destroyed [14];


### 3.3. Network Model

Figure1 represents the architecture which we applied for the design of communication among the participants. The RFID tag communicates with the roadside RFID reader and thereby the communication passes through the vehicular cloud server. In order to communicate efficiently, the communication parties have to undergo the authentication and key agreement phase to establish a session key. More details regarding how the participants actually take part in the authentication and key agreement and communication process is discussed in the next section.Figure 1
Communication architecture (source: this architecture was adopted from [2, 7]).


### 3.4. Threat Model

The “CK-adversary model” is widely regarded as the “current de facto standard model in modeling key-exchange protocols.” Using the “CK-adversary model,” the adversaryA can “deliver messages (as in the DY model),” and in addition, A can also “compromise other information, such as session state, private keys, and session keys.” “Since the sessions as procedures run inside a party, the internal state of a session is well-defined. An important point here is that what information is included in the local state of a session. For instance, the information revealed in this way may be the exponent used by a party. Typically, the revealed information will include all the local state of the session and its subroutines, except for the local state of the subroutines that directly access the long-term secret information.” Therefore, it is important that “the leakage of some forms of secret information, such as session ephemeral (short-term) secrets or session key, should have the least possible effect on the security of other secret credentials of the communicating entities in an authenticated key-exchange protocol.” We demonstrate that the proposed technique is secure against well-known attacks and offers session key security and strong credentials’ privacy under the CK-adversary model through a comprehensive formal security analysis.


### 3.5. Security Requirements for an IoT-Based RFID Communication System

To the best of our knowledge and based on the available literature, many authentication algorithms for RFID communication systems have been proposed in recent years. The best ways for making RFID systems appropriate for a wide variety of applications are authentication and key agreement. Several forms of security threats might arise during the transfer of messages between RFID tags and readers.Any authentication mechanism attempting to secure a viable RFID-based system should meet the following security requirements: Impersonation attack: By repeating a message recorded from the channels, an attacker might try to imitate genuine protocol participants (such as the cloud database server, RFID reader, or RFID tag). At all costs, any impersonation should be avoided.Replay attack: In this attack, an outsider tries to deceive other certified participants by restating intercepted data. This attack is aimed at a user whose data have been intercepted by an untrustworthy third party. Mutual authentication: The authentication procedure takes place between the RFID tag and the back-end database server. Messages are exchanged across an unprotected communication route between the tag, reader, and server. This is the most crucial feature of any authentication system. Mutual authentication must also be accomplished with all three RFID system players present.Tag anonymity: This is the most critical and required security criterion to reduce forgeries and assure security. Furthermore, the RFID authentication method retains its anonymity if an opponent is unable to trace an RFID tag during message transmission over a public channel. There are two types of anonymity, namely strong anonymity and weak anonymity. Furthermore, in order to protect their security and privacy, participants in IoT communication do not reveal their true identities.Man-in-the-middle attack: In this attack, an adversary listens to the transmitted data before attempting to remove or change the data supplied to recipients.Insider attack: Any insider can play the role of adversary in the RFID communication system. Desynchronization attack: If a protocol’s authentication is reliant on shared values, an adversary may cause desynchronization difficulties. If the shared data are updated by the server but the tag is not, the server might be unable to validate the tag in the future. Attempts to desynchronize should be avoided at all costs.Untraceability: Untraceability in the RFID communication system means that no one can track the participants’ activity patterns or their relayed messages.Session key agreement: A session key agreement will be made between users and their mobile devices, as well as the network control centre, following the successful deployment of the proposed protocol.Confidentiality: The security of RFID communications between the tag and the reader is ensured by encrypting shared secrets on the public channel.Perfect forward secrecy: This is utilized in the authentication protocol architecture to keep previously transmitted messages private, so that an adversary who obtains the entities private and public keys will be unable to deduce a past session key.Availability: The authentication and key agreement mechanism between the RFID tag and the RFID back-end database server operates continuously in an RFID system. To accomplish the characteristic of accessibility, the shared secret information between the RFID tag and the RFID back-end database server must be updated in most authentication procedures. However, security issues such as denial-of-service (DoS) or desynchronization attacks may cause this process to be disrupted. As a result of these problems, the RFID system’s efficiency may be jeopardized. Hence, this issue should be considered while creating an authentication mechanism.


## 3.1. Background of ECC

“LetE denotes an elliptic curve over the prime finite field Fq, where q be the large prime number. An equation of elliptic curve over Fq is given by v2=u3+αu+βmodq, where α,β∈Fq. The elliptic curve is said to be nonsingular if 4α3+27β2modq≠0. The additive elliptic curve group G is defined as G=u,v:u,v∈Fqu,v∈E∪Φ, where the point Φ is known as asymptotic point which work as the identity element or zero element in G.”Some operations on the groupG are as follows [2, 7]:(1)
Let∨=u,v∈G, then define −∨=u,−v and ∨+−∨=Φ.(2)
If∨1=u1,v1 and ∨2=u2,v2∈G, then ∨1+∨2=u3,v3, where u3=ρ2−u1−u2modqv3=ρu1−u2−v1modq and ρ=v2−v1/u2−u1modq,if∨1≠∨2,3u12+α/2v1modq,if∨1=∨2(3)
Let∨=u,v∈G, then scalar multiplication in G is defined as: η.∨=∨+∨+∨+⋯+∨η−times.(4)
Ifg is the generator of G with order η, then η.g=Φ.(a)
“Elliptic curve discrete logarithm problem (ECDLP)”: Findingμ∈Zq∗ such that ∨2=μ.∨1, for a given ∨1,∨2∈G is difficult.(b)
“Elliptic curve computational Diffie–Hellman problem (ECCDHP)”: Ifg is the generator of G and α.g, β.g are supplied (g, α.g, β.g), then computing α.β.g in G is difficult.Table 3
Key size comparison between ECC and RSA.
S. NoECC key size (bits)RSA key size (bits)Key size ratio116310241 : 6225630721 : 12338476801 : 204512153601 : 30


## 3.2. Physically Unclonable Function

ThePUF hardware primitive accepts a challenge C and generates the matching response R from the physical properties of its integrated chip IC and C. A PUF may easily be thought of as a one-way function R=PUFC since both the accepted challenge C and the produced answer R are bit strings [14].In essence,PUF security is based on the fact that, even if various ICs use the same production processes, each IC will be somewhat different owing to manufacturing variances. The following are the characteristics of PUF [15]:(i)
Uniqueness: A PUF cannot be duplicated;(ii)
Unidirectionality: In the real manufacturing circuit, the variances between input and output function mapping are both fixed and unpredictable. It is the hardware counterpart of the one-way function in this regard;(iii)
Invulnerability: Any effort to tamper with the device containing thePUF will cause the PUF to modify its behaviour and, as a result, it will be destroyed [14];


## 3.3. Network Model

Figure1 represents the architecture which we applied for the design of communication among the participants. The RFID tag communicates with the roadside RFID reader and thereby the communication passes through the vehicular cloud server. In order to communicate efficiently, the communication parties have to undergo the authentication and key agreement phase to establish a session key. More details regarding how the participants actually take part in the authentication and key agreement and communication process is discussed in the next section.Figure 1
Communication architecture (source: this architecture was adopted from [2, 7]).


## 3.4. Threat Model

The “CK-adversary model” is widely regarded as the “current de facto standard model in modeling key-exchange protocols.” Using the “CK-adversary model,” the adversaryA can “deliver messages (as in the DY model),” and in addition, A can also “compromise other information, such as session state, private keys, and session keys.” “Since the sessions as procedures run inside a party, the internal state of a session is well-defined. An important point here is that what information is included in the local state of a session. For instance, the information revealed in this way may be the exponent used by a party. Typically, the revealed information will include all the local state of the session and its subroutines, except for the local state of the subroutines that directly access the long-term secret information.” Therefore, it is important that “the leakage of some forms of secret information, such as session ephemeral (short-term) secrets or session key, should have the least possible effect on the security of other secret credentials of the communicating entities in an authenticated key-exchange protocol.” We demonstrate that the proposed technique is secure against well-known attacks and offers session key security and strong credentials’ privacy under the CK-adversary model through a comprehensive formal security analysis.


## 3.5. Security Requirements for an IoT-Based RFID Communication System

To the best of our knowledge and based on the available literature, many authentication algorithms for RFID communication systems have been proposed in recent years. The best ways for making RFID systems appropriate for a wide variety of applications are authentication and key agreement. Several forms of security threats might arise during the transfer of messages between RFID tags and readers.Any authentication mechanism attempting to secure a viable RFID-based system should meet the following security requirements: Impersonation attack: By repeating a message recorded from the channels, an attacker might try to imitate genuine protocol participants (such as the cloud database server, RFID reader, or RFID tag). At all costs, any impersonation should be avoided.Replay attack: In this attack, an outsider tries to deceive other certified participants by restating intercepted data. This attack is aimed at a user whose data have been intercepted by an untrustworthy third party. Mutual authentication: The authentication procedure takes place between the RFID tag and the back-end database server. Messages are exchanged across an unprotected communication route between the tag, reader, and server. This is the most crucial feature of any authentication system. Mutual authentication must also be accomplished with all three RFID system players present.Tag anonymity: This is the most critical and required security criterion to reduce forgeries and assure security. Furthermore, the RFID authentication method retains its anonymity if an opponent is unable to trace an RFID tag during message transmission over a public channel. There are two types of anonymity, namely strong anonymity and weak anonymity. Furthermore, in order to protect their security and privacy, participants in IoT communication do not reveal their true identities.Man-in-the-middle attack: In this attack, an adversary listens to the transmitted data before attempting to remove or change the data supplied to recipients.Insider attack: Any insider can play the role of adversary in the RFID communication system. Desynchronization attack: If a protocol’s authentication is reliant on shared values, an adversary may cause desynchronization difficulties. If the shared data are updated by the server but the tag is not, the server might be unable to validate the tag in the future. Attempts to desynchronize should be avoided at all costs.Untraceability: Untraceability in the RFID communication system means that no one can track the participants’ activity patterns or their relayed messages.Session key agreement: A session key agreement will be made between users and their mobile devices, as well as the network control centre, following the successful deployment of the proposed protocol.Confidentiality: The security of RFID communications between the tag and the reader is ensured by encrypting shared secrets on the public channel.Perfect forward secrecy: This is utilized in the authentication protocol architecture to keep previously transmitted messages private, so that an adversary who obtains the entities private and public keys will be unable to deduce a past session key.Availability: The authentication and key agreement mechanism between the RFID tag and the RFID back-end database server operates continuously in an RFID system. To accomplish the characteristic of accessibility, the shared secret information between the RFID tag and the RFID back-end database server must be updated in most authentication procedures. However, security issues such as denial-of-service (DoS) or desynchronization attacks may cause this process to be disrupted. As a result of these problems, the RFID system’s efficiency may be jeopardized. Hence, this issue should be considered while creating an authentication mechanism.


## 4. RSEAP2 Protocol

We offer a brief explanation of RSEAP2 [2] in this section. The tag Ti and the cloud database server S interact through the reader Rj to establish a session key SKST in this protocol. It is divided into two parts. The tag enrollment or startup phase is the first step, in which the tag talks with S via a secure connection to provide the needed data. The login and authentication phase is the second phase of the protocol, and it is used to perform mutual authentication and share the session key SKST=SKTS. This part of the communication takes place via a public network. We have made use of the notations as shown in Table 4.Table 4
Notations along with their descriptions.
SymbolDescriptionTi,Rj,Sith tag, jth reader, and cloud serverIDTi,IDRjUnique identities ofTi and RjpwTiPassword ofTixsLong-term private secret key of theS‖⊕Operations of bitwise concatenation and bitwise XORSKTS/SKSTSession key established betweenTi and SPUFPhysically unclonable functionh⋅Cryptographic collision-resistant one-way hash functionαi,βjRandom numbersTSTAiTimestamps used atith transmissionΔTMaximum threshold transmission delay allowedi=?jValidation check, if expressioni matches j or notAAn adversaryIn the initialization phase of RSEAP2, the serverS chooses an elliptic curve EFq over Fq and a generator g over G. It also selects xsFq∗ as its secret key and its public key will be xs.g. Any tag Ti which aims to register with S inputs its IDTi and pwTi, generates a random value RTiFq, computes PWT=hIDTi‖pwTi⊕RTi, and sends the tuple MR1=PWT,IDTi,TSR1 to S. Once S received M1, verifies the timestamp, that is TSR2−TSR1≤?tTSxΔT at the first. Next, it generates sniFq and sets it as the Ti’s serial number, computes XTi=hsniIDTixS, ATi=hPWT‖XTi⊕IDTi, BTi=XTi⊕PWT, and stores sni corresponding to IDTi. It then sends tuple MR2=ATi,BTi,sni,g,xs.g,G,h. to Ti. The tag Ti stores ATi,BTi,sni,g,xs.g,G,h..The description of the protocol is as follows:L1.Ti uses it credentials IDTi,pwTi,RTi, computes PWT=hIDTi‖pwTi⊕RTi, XTi∗=BTi⊕PWT, and verifies ATi∗=?hPWT‖XTi∗⊕IDTi. If verification is successful, Ti generates α∈Fq∗, calculates α.g and W1=hα.g⊕XTi∗‖IDTi‖TSLA1, and sends M1=IDTi‖W1⊕α.xs.g,α.g,TSLA1 to the reader Rj.L2. The reader checks the timestamp, that is,TSLA2−TSLA1≤?tTRΔT, generates β∈Fq∗, computes β.g, and then sends M2=M1,TSLA3,β.g,hTSLA1‖TSLA3⊕xRi.g‖IDRj⊕β.xs.g to S.L3. OnceS received M2, it verifies the timestamps, that is, TSLA4−TSLA1≤?tTSxΔT and TSLA4−TSLA3≤?tRS×ΔT. Next S extracts h∗TSLA1‖TSLA3⊕xRi.g‖RIDi∗  =  hTSLA1‖TSLA3⊕xRi.g‖RIDi, retrieves xRi.g from the database, and evaluates hTSLA1‖TSLA3⊕xRi.g to authenticate Rj. After the successful authentication on Rj parameters, S extracts IDT∗‖W1∗, verifies W1∗=?hα.g⊕XT∗‖IDT∗‖TSLA1, retrieves the related sni using IDT∗, computes XT∗=hsni‖IDT∗‖xs, and verifies W1∗=?hα.g⊕XT∗‖IDT∗‖TSLA1. Further generating γ∈ℱq∗, computing the session key SKST=hIDT∗⊕XTα.β.γ.g⊕xs.α.gsni⊕TSLA1‖TSLA5, W2=hIDT∗‖SKST, and sending M3=W2⊕hRIDi‖β.γ.g,γ.g,TSLA5,hRIDiTSLA5β.γ.g to Rj.L4.Rj verifies the timestamp, that is, TSLA5−TSLA3≤?tSRxΔT and hRIDi‖TSLA5‖β.γ.g to authenticate S. Subsequently, it extracts W2 and then sends M4=W2,β.γ.g,TSLA5 to Ti.L5. Similarly,Ti verifies the timestamp, that is, TSLA7−TSLA1≤?tSTxΔT and TSLA5−TSLA1≤?tRTxΔT, and then computes SKTS=hIDT⊕XTα.β.γ.g⊕xs.α.gsni⊕TSLA1‖TSLA5 and checks W2∗=?hIDT‖SKTS. If so, it sets SKTS as the session key.


## 5. Security Analysis of RSEAP2

### 5.1. Inefficient Mutual Authentication Attack

On receiving the messageM2 from the reader Rj, the cloud database server S extracts and computes to validate the user and reader. The details are as follows:(1)
The cloud server performs the computations and validates the timestamps such asTSLA4−TSLA1≤?tTSxΔT and TSLA4−TSLA3≤?tRS×ΔT.(2)
NextS extracts h∗TSLA1‖TSLA3⊕xRi.g‖RIDi∗  =  hTSLA1‖TSLA3⊕xRi.g‖RIDi, retrieves xRi.g from the database, and evaluates hTSLA1‖TSLA3⊕xRi.g to authenticate Rj.(3)
After the successful authentication onRj parameters, S extracts IDT∗‖W1∗, verifies W1∗=?hα.g⊕XT∗‖IDT∗‖TSLA1, retrieves the related sni using IDT∗, computes XT∗=hsniIDT∗xs, and verifies W1∗=?hα.g⊕XT∗‖IDT∗‖TSLA1 the authenticity of the user.(4)
It further generatesγ∈ℱq∗ and computes the session key SKST=hIDT∗⊕XTα.β.γ.g⊕xs.α.gsni⊕TSLA1‖TSLA5.But the conflict here is that the cloud server fails to compute the proper session key to pass it on to the tag for the validation. The reason is that the cloud server could not retrieve the random values generated by the tag and reader such asα,β∈ℱq∗, and in the session key the cloud server uses α.β.γ.g⊕xs.α.g value without the knowledge of the random numbers. Though the cloud server performs this computation, it would be certainly a garbage value which the tag cannot validate at any given point of time. Thus, this scheme holds the inefficiency to perform mutual authentication.


### 5.2. Inefficient Session Key Establishment Attack

On receiving the messagem3 from the cloud server, the tag performs the mutual authentication verification. But, the verification gets fails. The details are as follows:(1)
As discussed in the above Section5.1, we understood that the cloud server fails to compute the authentic session key. However, on receiving the message from the cloud server, Ti verifies the timestamp, that is, TSLA7−TSLA1≤?tSTxΔT and TSLA5−TSLA1≤?tRTxΔT, and then computes SKTS=hIDT⊕XTα.β.γ.g⊕xs.α.gsni⊕TSLA1‖TSLA5 and checks W2∗=?hIDT‖SKTS. If so, it sets SKTS as the session key.(2)
Now you can see that the tagTi did not retrieve or has the potential to draw out the value α.β.γ.g⊕xs.α.g but still perform the computation to validate the session key.This validation never gets successful as it is a known fact that without the proper parameters and values the verification fails and the tag and the cloud server cannot establish the session key for the future communications. Thus, this scheme holds the inefficiency to perform session key establishment.


### 5.3. Denial-of-Service Attack

According to RSEAP2’s scheme, the legitimate participants tries to communicate to each other and get the services as and when required, but from the security flaw as shown above in Sections5.1 and 5.2, we understood that the scheme fails to establish the session key and mutual authentication. This shows the enough conclusive evidence that the scheme fails to provide services to the participants thought the tag and readers are the legitimate participants in the system. Hence, this scheme is prone to the denial-of-service attack.


## 5.1. Inefficient Mutual Authentication Attack

On receiving the messageM2 from the reader Rj, the cloud database server S extracts and computes to validate the user and reader. The details are as follows:(1)
The cloud server performs the computations and validates the timestamps such asTSLA4−TSLA1≤?tTSxΔT and TSLA4−TSLA3≤?tRS×ΔT.(2)
NextS extracts h∗TSLA1‖TSLA3⊕xRi.g‖RIDi∗  =  hTSLA1‖TSLA3⊕xRi.g‖RIDi, retrieves xRi.g from the database, and evaluates hTSLA1‖TSLA3⊕xRi.g to authenticate Rj.(3)
After the successful authentication onRj parameters, S extracts IDT∗‖W1∗, verifies W1∗=?hα.g⊕XT∗‖IDT∗‖TSLA1, retrieves the related sni using IDT∗, computes XT∗=hsniIDT∗xs, and verifies W1∗=?hα.g⊕XT∗‖IDT∗‖TSLA1 the authenticity of the user.(4)
It further generatesγ∈ℱq∗ and computes the session key SKST=hIDT∗⊕XTα.β.γ.g⊕xs.α.gsni⊕TSLA1‖TSLA5.But the conflict here is that the cloud server fails to compute the proper session key to pass it on to the tag for the validation. The reason is that the cloud server could not retrieve the random values generated by the tag and reader such asα,β∈ℱq∗, and in the session key the cloud server uses α.β.γ.g⊕xs.α.g value without the knowledge of the random numbers. Though the cloud server performs this computation, it would be certainly a garbage value which the tag cannot validate at any given point of time. Thus, this scheme holds the inefficiency to perform mutual authentication.


## 5.2. Inefficient Session Key Establishment Attack

On receiving the messagem3 from the cloud server, the tag performs the mutual authentication verification. But, the verification gets fails. The details are as follows:(1)
As discussed in the above Section5.1, we understood that the cloud server fails to compute the authentic session key. However, on receiving the message from the cloud server, Ti verifies the timestamp, that is, TSLA7−TSLA1≤?tSTxΔT and TSLA5−TSLA1≤?tRTxΔT, and then computes SKTS=hIDT⊕XTα.β.γ.g⊕xs.α.gsni⊕TSLA1‖TSLA5 and checks W2∗=?hIDT‖SKTS. If so, it sets SKTS as the session key.(2)
Now you can see that the tagTi did not retrieve or has the potential to draw out the value α.β.γ.g⊕xs.α.g but still perform the computation to validate the session key.This validation never gets successful as it is a known fact that without the proper parameters and values the verification fails and the tag and the cloud server cannot establish the session key for the future communications. Thus, this scheme holds the inefficiency to perform session key establishment.


## 5.3. Denial-of-Service Attack

According to RSEAP2’s scheme, the legitimate participants tries to communicate to each other and get the services as and when required, but from the security flaw as shown above in Sections5.1 and 5.2, we understood that the scheme fails to establish the session key and mutual authentication. This shows the enough conclusive evidence that the scheme fails to provide services to the participants thought the tag and readers are the legitimate participants in the system. Hence, this scheme is prone to the denial-of-service attack.


## 6. Our Proposed Scheme

This section presents the proposed secure authentication protocol and the program architecture which is divided into a tag, a reader, and a cloud server for parallel processing, with each component working independently. In this architecture as shown in Figure2, the tag initiates the communication by computing the validating message and transmits the validating message with a virtual ID to the reader. Upon receiving the message, it challenges the reader to validate the message. Thus, the reader computes the validating message and transmits the validating message with the virtual ID to the cloud server for further process. Once the message is received by the cloud server, it validates the reader message thereby the cloud server authenticates the reader and tag. After the successful authentication, it computes the session key to establish the key. Further, at the next stage, the reader receives the Ack1 and Ack2 from the cloud server as an acknowledgment. Then the check happens in the next stage, where the tag receives Ack1 from the reader and simultaneously the reader checks the received Ack2. Finally, once the check is successful, the tag establish the session key and end the process (see process flow diagram in Figure 2).Figure 2
Communication flowchart.In this section, we present our proposed scheme. In the initialization phase, the serverS chooses an elliptic curve Eℱq over ℱq and a generator g over G. It also selects xs∈ℱq∗ as its secret key and its public key will be xs⋅g. Any tag Ti which aims to register with S, inputs its IDTi,pwTi, generates challenge CTi, computes αTi=PUFCTi, paTi=αTi⊕hIDTi‖pwTi, and sends the tuple MR1=IDTi,αTi,CTi to S. Once S received MR1, verifies in the records whether IDTi exists or not. If the IDTi is new, it generates sni∈ℱq, computes pidTi=sni⋅xs⋅g, ATi=hαTi⊕IDTi‖pidTi, and stores pidTi,CTi,sni,αTi corresponding to IDTi. It then sends tuple MR2=pidTi,ATi to Ti. The tag Ti computes PWT=hIDTipwTi⊕αTipaTi and stores PWT,pidTi,paTi,ATi. Similarly, reader Rj aims to register with S, generates challenge CRj, computes αRj=PUFCRj, paRj=CRj⊕IDRj), and sends MR3=IDRj,αRj,paRj to the cloud database server S. S computes pidRj by its private key and CRj=paRj⊕IDRj, αRj∗=PUFCRj, ARj=hαRj∗⊕IDRj‖pidRj; sends MR4=pidRj,ARj; and stores pidRj,IDRj,CRj,αRj in its database. Further Rj also stores pidRj,paRj,ARj. The illustration of the tag registration and reader registration is shown in Table 5 and Table 6, respectively.Table 5
Tag registration phases of our scheme.
TagTiCloud database serverSInputsIDTi,pwTiGenerates challengeCTiComputesαTi=PUFCTiVerifiesIDTipaTi=αTi⊕hIDTi‖pwTiComputespidTi by private key of S⇒SecureChannelMR1=IDTi,αTi,CTiATi=hαTi⊕IDTi‖pidTi⇐SecureChannelMR2=pidTi,ATiPWT=hIDTipwTi⊕αTipaTi, deletes IDTi,CTi,αTi and stores PWT,pidTi,paTi,ATiStorespidTi,IDTi,CTi,sni,αTiTable 6
Reader registration phases of our scheme.
ReaderRjCloud database serverSGenerates challengeCRjComputesαRj=PUFCRjpaRj=CRj⊕IDRjComputespidRj by private key of SCRj=paRj⊕IDRjαRj∗=PUFCRj⇒SecureChannelMR3=IDRj,αRj,paRjARj=hαRj∗⊕IDRj‖pidRj⇐SecureChannelMR4=pidRj,ARjDeletesIDRj,CRj,αRjStorespidRj,IDRj,CRj,αRjStorespidRj,paRj,ARj


### 6.1. Login and Authentication Phase

To access the services fromS, Ti needs to establish a session key with S. The following steps are followed by Ti,Rj, and S during this phase. The illustration is shown in Table 7.LA1: The tag logs on byIDTi,pwTi, computes αTi∗=paTi⊕hIDTi‖pwTi, verifies PWT=?hIDTipwTi⊕αTi∗paTi, generates α∈ℱq∗ to compute W1=hα.g.αTi⊕ATi∗‖IDTi‖TSLA1, and sends M1=pidTiATiW⊕α.xs.g,α.g,TSLA1 to Rj.LA2: On receiving the request,Rj verifies TSLA1; computes CRj=paRj⊕IDRj, αRj=PUFCRj, and W2=hαRjARjTSLA3; and sends M2=M1,TSLA3,W2‖pidRj to S.LA3: On receiving the request,S verifies TSLA1 and TSLA3; extracts M1,TSLA3,W2‖pidRj; validates W2=?hαRj‖hαRj⊕IDRj‖pidRj‖TSLA3; and extracts pidTi∗ATi∗W1∗ to verify W1∗=?hα.g.αTi⊕ATi∗‖IDTi‖TSLA1 and on success, generates β∈ℱq∗, computes SKST=hIDTi∗⊕ATiα.β.g‖xs.α.gsni⊕TSLA1‖TSLA5, W3=hα.β.g‖SKST‖ATi‖pidTi, W4=hIDRj‖ARj‖TSLA5‖pidRj, and sends M3=W3,W4,TSLA5,β.g as a response to Rj.LA4: After receiving the response fromS, Rj checks TSLA5, verifies W4=?hIDRj‖ARj‖TSLA5‖pidRj, and sends M4=W3,β.g,TSLA5 to Ti.LA5: On receiving the response fromRj, Ti verifies TSLA5, computes SKTS=hIDTi⊕ATi‖α.β.g‖α.xs.g‖sni⊕TSLA1‖TSLA5, and checks W3∗=?hα.β.g‖SKTS‖ATi‖pidTi. On successful verification, Ti sets SKTS as the session key.Table 7
Login and authentication phases of our scheme.
TagTiReaderRjCloud database serverSLogs on byIDTi,pwTiComputesαTi∗=paTi⊕hIDTi‖pwTiVerifiesPWT=?hIDTipwTi⊕αTi∗paTiGeneratesα∈ℱq∗ComputesW1=hα.g.αTi⊕ATi∗‖IDTi‖TSLA1⟶M1=pidTiATiW1⊕α.xs.g,α.g,TSLA1VerifiesTSLA1, computeCRj=paRj⊕IDRjComputesαRj=PUFCRjW2=hαRjARjTSLA3⟶M2=M1,TSLA3,W2‖pidRjVerifiesTSLA1 and TSLA3ExtractsM1,TSLA3,W2‖pidRjVerifiesW2=?hαRjhαRj⊕IDRj‖pidRjTSLA3,ExtractspidTi∗ATi∗W1∗VerifiesW1∗=?hα.g.αTi⊕ATi∗‖IDTi‖TSLA1Generatesβ∈ℱq∗, computesSKST=hIDTi∗⊕ATiα.β.g‖xs.α.gsni⊕TSLA1‖TSLA5W3=hα.β.g‖SKST‖ATi‖pidTiW4=hIDRj‖ARj‖TSLA5‖pidRjChecksTSLA5 and←M3=W3,W4,TSLA5,β.gVerifiesTSLA5 and computesVerifiesW4=?hIDRj‖ARj‖TSLA5‖pidRjSKTS=hIDTi⊕ATiα.β.g‖α.xs.g←M4=W3,β.g,TSLA5sni⊕TSLA1‖TSLA5ChecksW3∗=?hα.β.g‖SKTS‖ATi‖pidTito setSKTS as the session key


### 6.2. Revocation and Reissue Phase

To revoke the access ofTi, S checks for the availability of IDTi during the subsequent login attempts. The tag will be given or refused access on the basis of the check. Since all dynamic identities have a finite lifetime, it is also impossible to continuously use the same dynamic identity.In addition, the next steps to get new credentials are crucial when a tagTi from an approved registered user is stolen/lost.RR1: The tag keeps the sameIDTi, but chooses a password pwTiR and generates challenge CTiR to compute αTiR=PUFCTiR, paTiR=αTiR⊕hIDTi‖pwTiR. Further submitting the revocation request MRR1=IDTi,αTiR,CTiR to the cloud database server S through secure channel.RR2: On receiving the request,S checks the database for the availability of ATiR=hαTiR⊕IDTi‖pidTiR where pidTiR is computed by private key of S. If ATiR is not available, the cloud database server computes and sends MRR2=pidTiR,ATiR to Ti over the secure channel.RR3: Finally, for each tag, the cloud serverS issues the new credentials.RR4: After receiving the new credentials,Ti completes the registration process as processed in the registration phase.


### 6.3. Tag’s Password/Update Phase

A registered tagTi can update his/her current password and follow the steps without contacting S:PU1: The tag logs on byIDTi,pwTi, computes αTi∗=paTi⊕hIDTi‖pwTi, and verifies PWT=?hIDTi‖pwTi⊕αTi∗‖paTi. Upon unsuccessful verification, this process gets terminated by Ti. Otherwise, Ti uses new password.PU2:Ti picks pwTinew; computes αTi=PUFCTi, paTinew=αTi⊕hIDTi‖pwTinew, and PWTnew=hIDTi‖pwTinew⊕αTi‖paTinew; and stores PWTnew,pidTi,paTinew,ATi to complete the process.


## 6.1. Login and Authentication Phase

To access the services fromS, Ti needs to establish a session key with S. The following steps are followed by Ti,Rj, and S during this phase. The illustration is shown in Table 7.LA1: The tag logs on byIDTi,pwTi, computes αTi∗=paTi⊕hIDTi‖pwTi, verifies PWT=?hIDTipwTi⊕αTi∗paTi, generates α∈ℱq∗ to compute W1=hα.g.αTi⊕ATi∗‖IDTi‖TSLA1, and sends M1=pidTiATiW⊕α.xs.g,α.g,TSLA1 to Rj.LA2: On receiving the request,Rj verifies TSLA1; computes CRj=paRj⊕IDRj, αRj=PUFCRj, and W2=hαRjARjTSLA3; and sends M2=M1,TSLA3,W2‖pidRj to S.LA3: On receiving the request,S verifies TSLA1 and TSLA3; extracts M1,TSLA3,W2‖pidRj; validates W2=?hαRj‖hαRj⊕IDRj‖pidRj‖TSLA3; and extracts pidTi∗ATi∗W1∗ to verify W1∗=?hα.g.αTi⊕ATi∗‖IDTi‖TSLA1 and on success, generates β∈ℱq∗, computes SKST=hIDTi∗⊕ATiα.β.g‖xs.α.gsni⊕TSLA1‖TSLA5, W3=hα.β.g‖SKST‖ATi‖pidTi, W4=hIDRj‖ARj‖TSLA5‖pidRj, and sends M3=W3,W4,TSLA5,β.g as a response to Rj.LA4: After receiving the response fromS, Rj checks TSLA5, verifies W4=?hIDRj‖ARj‖TSLA5‖pidRj, and sends M4=W3,β.g,TSLA5 to Ti.LA5: On receiving the response fromRj, Ti verifies TSLA5, computes SKTS=hIDTi⊕ATi‖α.β.g‖α.xs.g‖sni⊕TSLA1‖TSLA5, and checks W3∗=?hα.β.g‖SKTS‖ATi‖pidTi. On successful verification, Ti sets SKTS as the session key.Table 7
Login and authentication phases of our scheme.
TagTiReaderRjCloud database serverSLogs on byIDTi,pwTiComputesαTi∗=paTi⊕hIDTi‖pwTiVerifiesPWT=?hIDTipwTi⊕αTi∗paTiGeneratesα∈ℱq∗ComputesW1=hα.g.αTi⊕ATi∗‖IDTi‖TSLA1⟶M1=pidTiATiW1⊕α.xs.g,α.g,TSLA1VerifiesTSLA1, computeCRj=paRj⊕IDRjComputesαRj=PUFCRjW2=hαRjARjTSLA3⟶M2=M1,TSLA3,W2‖pidRjVerifiesTSLA1 and TSLA3ExtractsM1,TSLA3,W2‖pidRjVerifiesW2=?hαRjhαRj⊕IDRj‖pidRjTSLA3,ExtractspidTi∗ATi∗W1∗VerifiesW1∗=?hα.g.αTi⊕ATi∗‖IDTi‖TSLA1Generatesβ∈ℱq∗, computesSKST=hIDTi∗⊕ATiα.β.g‖xs.α.gsni⊕TSLA1‖TSLA5W3=hα.β.g‖SKST‖ATi‖pidTiW4=hIDRj‖ARj‖TSLA5‖pidRjChecksTSLA5 and←M3=W3,W4,TSLA5,β.gVerifiesTSLA5 and computesVerifiesW4=?hIDRj‖ARj‖TSLA5‖pidRjSKTS=hIDTi⊕ATiα.β.g‖α.xs.g←M4=W3,β.g,TSLA5sni⊕TSLA1‖TSLA5ChecksW3∗=?hα.β.g‖SKTS‖ATi‖pidTito setSKTS as the session key


## 6.2. Revocation and Reissue Phase

To revoke the access ofTi, S checks for the availability of IDTi during the subsequent login attempts. The tag will be given or refused access on the basis of the check. Since all dynamic identities have a finite lifetime, it is also impossible to continuously use the same dynamic identity.In addition, the next steps to get new credentials are crucial when a tagTi from an approved registered user is stolen/lost.RR1: The tag keeps the sameIDTi, but chooses a password pwTiR and generates challenge CTiR to compute αTiR=PUFCTiR, paTiR=αTiR⊕hIDTi‖pwTiR. Further submitting the revocation request MRR1=IDTi,αTiR,CTiR to the cloud database server S through secure channel.RR2: On receiving the request,S checks the database for the availability of ATiR=hαTiR⊕IDTi‖pidTiR where pidTiR is computed by private key of S. If ATiR is not available, the cloud database server computes and sends MRR2=pidTiR,ATiR to Ti over the secure channel.RR3: Finally, for each tag, the cloud serverS issues the new credentials.RR4: After receiving the new credentials,Ti completes the registration process as processed in the registration phase.


## 6.3. Tag’s Password/Update Phase

A registered tagTi can update his/her current password and follow the steps without contacting S:PU1: The tag logs on byIDTi,pwTi, computes αTi∗=paTi⊕hIDTi‖pwTi, and verifies PWT=?hIDTi‖pwTi⊕αTi∗‖paTi. Upon unsuccessful verification, this process gets terminated by Ti. Otherwise, Ti uses new password.PU2:Ti picks pwTinew; computes αTi=PUFCTi, paTinew=αTi⊕hIDTi‖pwTinew, and PWTnew=hIDTi‖pwTinew⊕αTi‖paTinew; and stores PWTnew,pidTi,paTinew,ATi to complete the process.


## 7. Formal Security Analysis

Formal security examination strategies are usually used to inspect and evaluate diverse check plans. According to literature [25], various security assessment systems can be used to evaluate authentication methods. In this article, we used ROR security theories.


### 7.1. ROR Model-Based Proof

Under this model, adversaries say thatA has access to a set of executing entity queries including CorruptTi Ti, Test Pt, , Execute Ti,Sj, and Reveal Pt, which perform simulation to check the real attack. The query descriptions of such queries are given in Table 8. The ROR model components are as follows:(i)
Participants: The associated participants with the proposed scheme are the tagTi, reader Rj, or a cloud server Sj. The instances t1 and ts of Ti and Sj are marked as PTit1 and PSjt2 which are known as oracles.(ii)
Accepted state: If the peer points achieve an accepted status when the final communication has been authenticated, the instance “Pt” comes under “accepted state.” For the ongoing session, sid is a Pt session ID created in a sequence by PPt after the sent and received messages were rearranged.(iii)
Partnering: The following things must be accomplished to be partnered betweenPt1 and Pt2:(1)
They are in “accepted states.”(2)
They possess the samesid. Further also “authenticate mutually with each other.”(3)
They are also “mutual partners of each other.”(iv)
Freshness:PTit1 or PSjt2 is fresh when the constructed session key between Ti and Sj is not leaked to A using the Reveal Pt query listed in Table 8.Table 8
Various queries with their descriptions.
QuerySignificanceCorruptTiTiA can extract the stored credentials by compromised tag Ti’s memoryExecute(Ti,Sj)This supportsA in intercepting communications between Ti and SjRevealPtThis allowsA to obtain the SKST=SKTS session key from Pt and its partnerTestPtIt allowsA to request Pt for the session key SKTS=SKST and is probably a consequence of a flickered “unbiased coin c” Pt outputThe proposed scheme undergoes “semantic security” as defined in Definition1.Definition 1.
IfAdvARfid−PUFtp is the “advantage of an adversary A running in polynomial time tp in breaching the semantic security of Rfid−PUF to extract the session key SKTS among a tag Ti and a cloud server Sj,” AdvARfid−PUFtp=2Prc′=c−1, where c are the correct bits and c′ indicate the guessed bits.
Furthermore, Definition2 is about “collision-resistant one-way hash function” and Definition 3 is about “elliptic curve decisional Diffie–Hellman problem (ECDDHP),” for briefing Rfid−PUF.Definition 2.
A “deterministic function,” sayh: 0,1∗⟶0,1lb, is a “one-way collision-resistant hash function” if it produces fixed length of lb bits output string hm∈0,1lb as “hash value or message digest” upon an arbitrary length input string m∈0,1∗. Let an adversary A want to find a hash collision. Then, the “advantage” of A in attacking “hash collision” is provided by AdvAHashth=Prm1,m2←rA:m1≠m2,hm1=hm2. PrX here shows the chance that the pair will be randomly picked by A in the case of “random event X” and m1,m2←rA. The attack of η,t-adversary of A to the resistance of collision of h⋅ indicates that the maximum runtime of th to the AdvAHashth≤η.Definition 3.
Consider an elliptic curveEqu,v and a point P, the ECDDHP is “for a quadruple 〈P, uv1.P, uv2.P, uv3.P〉, decide whether uv3=uv1⋅uv2 or it is a uniform value,” where uv1, uv2, uv3∈Zq∗ (=\{1, 2, …, q−1\}).
To make ECDDHP intractable, the chosen primeq needs to be at least 160-bit number.Theorem 1.
Suppose our schemeRfid−PUF runs in “polynomial time tp” and the adversary A is working to gain advantage on Rfid−PUF. If queryh, Hash, and AdvAECDDHPtp indicate the “cardinality of hash queries,” “size of one-way hash function h⋅,” and “A’s advantage in breaching ECDDHP in t ime tp (see Definition III-A),” respectively, and chosen passwords follow the Zipf’s law [26], then the bit-lengths of the PUF key PUFC∗ where ∗ refers to Ti/Rj and the tag identity IDTi are l1 and l2, respectively, γ′ and sγ′ are the Zipf’s parameters [26] respectively, A’s advantage in compromising the semantic security of the proposed scheme Rfid−PUF is AdvARfid−PUFtp≤2AdvAECDDHPtp+queryh2/Hash+2maxquerys/2l1,querys/2l2,γ′⋅queryssγ′.Proof.
This proof is presented in the similar way as presented by authentication protocols. Here four games are played, such asGk, k=0,1,2,3 related to the evidence where G0 is the starting and G3 is the finishing game. We define SuccAGk as “an event wherein A can guess the random bit c in the game Gk correctly” and also the “advantage of A in winning the game Gk as AdvA,GkRfid−PUF=PrSuccAGk.” The detailed study of these games is as follows:G0: G0 is the same as the real ROR model protocol. Therefore, the semantic security of Rfid−PUF is defined in Definition 1.(1)AdvARfid−PUFtp=2⋅AdvA,G0Rfid−PUF−1,G1: In this game, we model for the “eavesdropping attack” in which A can intercept all the communicated messages M1=pidTiATiW1⊕α.xs.g,α.g,TSLA1, M2=M1,TSLA3,W2‖pidRj, M3=W3,W4,TSLA5,β.g, and M4=W3,β.g,TSLA5 while executing “authentication and key agreement phase” in Section A using Execute query as discussed in Table 8. To confirm whether the “calculated session key SKTS between Ti and S is real or a random number,” A can execute both Reveal and Test queries. The established session key is SKST=hIDTi∗⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5=SKTS. It is worth noting that the key to session security is dependent on both α and β “temporary secrets” and Ti′ and S’ for long-term secretions that cannot be disregarded by eavesdrops of the messages M1, M2, M3, and M4. Therefore, this “eavesdropping attack” does not give any advantage/increase of winning probability of A in G1. This shows G0 and G1 games become “indistinguishable,” and thus obtains the following result:(2)AdvA,G1Rfid−PUF=AdvA,G0Rfid−PUF.G2: In this game, the hash searches are simulated. Both ATi and TSLA1 are altered in the M1 message. Similarly, M2, M3, and M4 are also equally unexpected, as they include random timestamps and random numbers, such as ARj, αRj, TSLA3, pidTi∗, sni, and TSLA5 are equally unforeseeable. So, no collision occurs when A does hash queries. Since both G1 and G2 are “indistinguishable” except for the inclusion of the G2 simulations, we obtain birthday paradox outcomes as(3)AdvA,G2Rfid−PUF−AdvA,G1Rfid−PUF≤queryh22Hash.G3: The CorruptTi Ti query was implemented in this final game. Therefore, the opponent A is extracted depending on the performance of the query for the credentials ATi,pidTi,αTi,αRj,ARj,pidRj from a compromised tag Ti. The A probability to properly guess the PUFC∗ physically unclonable function secret key of l1 bit-length and IDTi user identity of l2 bit-length are querys/2l1 and querys/2l2, respectively. The advantage of A is more than 0.5, if querys=107or108, since the passwords of the users selected tend to obey the law of Zipf’s, by using assaults via trawling. If A can exploit user’s personal data for a targeted assault, then querys≤106 gives him an edge over 0.5.
Furthermore,A will have all the intercepted messages M1, M2, M3, and M4. To derive the session key SKST=hIDTi∗⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5=SKTS shared between Ti and S, A needs to calculate hαRj⊕IDRj, ATi∗‖IDTi which in a polynomially restricted time tp is computationally costly owing to the intractability of ECDDHP. Since G2 and G3 games are “indistinguishable,” the following is excepted to include the question and ECDDHP of CorruptTi Ti(4)AdvA,G3Rfid−PUF−AdvA,G2Rfid−PUF≤AdvAECDDHPtp+maxquerys2l1,querys2l2,β′⋅queryssβ′.
Now, all the relevant queries related to the above games are executed, and then theReveal query is executed along with Test query to guess the random bit c. Thus, we get(5)AdvA,G3Rfid−PUF=12.
Combining equations (1), (2), and (5) derives:(6)12⋅AdvARfid−PUFtp=AdvA,G0Rfid−PUF−12=AdvA,G1Rfid−PUF−AdvA,G3Rfid−PUF≤AdvA,G1Rfid−PUF−AdvA,G2Rfid−PUF+AdvA,G2Rfid−PUF−AdvA,G3Rfid−PUF.
Next, combining equations (3), (4), and (6) provide the following result:(7)12⋅AdvARfid−PUFtp≤queryh22Hash+AdvAECDDHPtp+maxquerys2l1,querys2l2,β′⋅queryssβ′.
Finally, the equation (7) is multiplied by 2 on both sides to get(8)AdvARfid−PUFtp≤2AdvAECDDHPtp+queryh2Hash+2maxquerys2l1,querys2l2,β′⋅queryssβ′.


### 7.2. Informal Security Analysis

Proposition 1.
Location privacy (non-traceability)Proof.
The tagTi simply transmits the message M1=pidTiATiW1⊕α.xs.g,α.g,TSLA1, with W1=hα.g⊕ATi∗‖IDTi‖TSLA1. Only pidTiATiW1 of this message can be utilized to identify the tag. On each session, the variables alpha and TSLA1 masked and randomized the token described above. The attacker has no control over any of these values. If a collision happens on the specified value by Ti in the worst-case scenario, the adversary could detect it by monitoring the alpha.g fraction of M1, and then Ti could be monitored. However, the adversary’s advantage in finding a collision after N protocol sessions is ON2/Fq∗, which is modest enough in practice. Furthermore, M1 makes no mention of Rj or S.
The readerRj delivers M2=M1,TSLA3,W2‖pidRj to S, where W2‖pidRj may be used to monitor the reader and determine whether the W2 fraction has a collision. Similarly, after N protocol executions, the adversary has an advantage of ON2/Fq∗ in detecting a collision. As a result, the opponent’s chances of success are slim.
M3=W3,W4,TSLA5,β.g is sent by the server S, where W3=hα.β.g‖‖SKST‖ATi‖pidTi, W4=hIDRj‖ARj‖TSLA5‖pidRj. The reader Rj and the server S, on the other hand, in each of the W3 and W4 tokens are randomized in each session. As a result, an adversary is unable to retrieve data that could aid in the breach of the protocol’s location privacy.
Finally,Rj sends M4=W3,β.g,TSLA5 to Ti. The adversary’s only target in this communication could be W3. This token is a function of SKTS=hIDTi⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5, which is randomized by Ti,Rj, and S on each session.
Overall, the location privacy of all of our entities (i.e.,Ti,Rj, and S) is guaranteed by our protocol.Proposition 2.
Mutual authentication and session key agreementProof.
It is obvious that the pairsS,Ti and S,Rj are mutually authenticated if a legitimate tag Ti connects with an honest server S through a valid reader Rj and within acceptable time thresholds. However, we do not require mutual authentication between the reader Rj and the tag Ti in this protocol. In more detail, S is the source of trust for Ti, while Rj is only a gateway to S. The following is a list of the session key’s correctness and mutual agreement:
Correction Proof:(9)W3=hβ.α.g‖SKST‖ATi‖pidTi=hβ.α.g‖hIDTi∗⊕ATi‖β.α.g‖xs.α.g‖sni⊕TSLA1‖TSLA5‖ATi‖pidTi=hα.β.g‖hIDTi∗⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5ATipidTi=hα.β.g‖hIDTi⊕ATi‖α.β.g‖α.xs.g‖sni⊕TSLA1‖TSLA5ATipidTi=hα.β.g‖SKTS‖ATi‖pidTi=W3∗.
Because the tag and the server have mutual authentication,S has already authenticated Rj, and Ti may trust the reader Rj. As a result, our technique ensures mutual authentication and establishes suitable session key agreement.Proposition 3.
Physical securityProof.
. Any alteration or damage to the device with built-inPUF will cause PUF to respond differently or the device to become unavailable, according to PUF’s characteristics. It is impossible to collect any relevant information in an accessible environment since car sensors do not preserve any information. Physical attacks, aside from rendering the hardware components in the proposed protocol ineffective, are unable to extract any relevant information. As a result, the suggested protocol can ensure the system’s physical security.Proposition 4.
Achieving forward secrecyProof.
In our proposed scheme, the session key is computed asSKTS=hIDTi⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5. This session key is established between the tag Ti and the server S. If A wishes to compromise the session key, A requires the knowledge of the session-specific random values α,β, fixed value αTi, and the identities of the participants involved in the session key establishment. Now, even if pwTi,paTi are compromised by A, due to the lack of knowledge of CTi or random values α,β and fixed value αTi, attacker fails to compute W1. Thus, A does not gain any advantage even if he compromises pwTi,paTi. Therefore, A cannot compute the previous/current/future session keys.Proposition 5.
Message authenticationProof.
In this protocol, the server authenticatesM1 and M2. The reader Rj authenticates S, M3 partially and the tag Ti totally. The use of random integers and the one-way hash function ensure the integrity of all messages. Any alteration to the conveyed message causes the receiver to reject the message.
For instance, considerM1=pidTiATiW1⊕α.xs.g,α.g,TSLA1 message, where W1=hα.g⊕ATi∗‖IDTi‖TSLA1, which should be authenticated by S. TSLA4−TSLA1≤?ΔT is checked by the server S first. As a result, if the adversary replicates the message, S will reject it. Then, S extracts pidTi∗ATi∗W1∗, retrieves the related sni value using IDTi and αTi, and computes and verifies W1∗=?hα.g.αTi⊕ATi∗‖IDTi‖TSLA1 to accept the message. It is clear that any modification in TSLA, α.g, or pidTi∗ATi∗W1∗ renders the probability of W1∗?=W1 to 2−n, where n is the hash length, for example 256−bit for SHA−256. The other messages in the protocol can be reasoned about in the same way. As a result, our protocol ensures message authentication between the parties involved.Proposition 6.
Replay attackProof.
In a replay attack, the adversary attempts to use a previously traded message at a later timet′. Any message received outside of the threshold time (a preset factor of ΔT) is likely to be rejected in our protocol. Aside from that, the one-way hash function ensures the integrity of timestamps. As a result, replay attacks against our protocol are impossible. Finally, the adversary may break the tag’s anonymity if he extracted xs.g from the α.xs.g and α.g pair. It is most likely the same as solving ECCDHP, which is known to be a difficult task (see Section 3.1).Proposition 7.
Impersonation attack
Tag:Proof.
Due to the integrity ofTSLA1, the only way to spoof the tag is to construct a valid M1. It is not possible, however, without guessing or computing a valid W1=hα.g⊕ATi∗‖IDTi‖TSLA1, where TSLA1 is the attack time’s timestamp. The enemy also lacks ATi and IDTi. As a result, the adversary’s chance of successfully impersonating the tag is 2−n, where n is the hash function’s bit-length. To put it another way, the repeat attack is a waste of time.
Reader:Proof.
Because the integrity ofTSLA3 is guaranteed in our protocol, the adversary cannot replay messages to impersonate a reader. As a result, generating a legitimate W2‖pidRj is the only way to impersonate the Rj in front of S. The opponent, on the other hand, lacks W2=hαRjARjTSLA3, W2, and ARj. Even if she/he obtains the values W2,pidRj, and ARj in some other way, she/he must extract αRj from M2 in order to determine IDRj. It necessitates reverse engineering of the one-way hash function, which is a difficult challenge that makes the assault impracticable. As a result, impersonating Rj to S is not feasible under this protocol.
Server:Proof.
To impersonate the serverS in front of Rj, the adversary would have to compute W3,W4,TSLA5,β.g, where W3=hα.β.g‖SKST‖ATi‖pidTi and W4=hIDRj‖ARj‖TSLA5‖pidRj. pidRj,IDRj,xs.α.g would be required. Aside from xs.α.g,β.α.g, which is contributed by Ti through sending α.g, this token is randomized by xs.α.g,β.α.g. Solving a ECCDHP problem, which is a difficult problem, would be required for the disclosure of α and xs. Even if the adversary reveals the band and adapts it appropriately, the adversary still needs to know IDTi due to TSLA5 in hα.β.g‖SKST‖ATi‖pidTi, which is not the case. As a result, cheating Rj and successfully mimicking S gives the opponent a 2−n advantage. Furthermore, impersonating S in front of Rj is a prerequisite for impersonating S in front of Ti. As a result, the attacker cannot effectively impersonate the server S in front of Ti using Rj. Only M4=W3,β.g,TSLA5, where W3=hα.β.g‖SKST‖ATi‖pidTi. Unlikely as it may seem, the attacker lacks IDTi. As a result, the adversary’s advantage in committing this impersonation attack is negligible (i.e., 2−n).Proposition 8.
Offline password guessing attackProof.
The rationale for security against this attack is nearly comparable to that ofRSEAP2. In a nutshell, PWT=hIDTi‖pwTi⊕αTi‖paTi calculates the tag’s temporary password. Even if the adversary could estimate PWT, the value αTi, which is a random integer created by the tag Ti, is still required. As a result, the opponent who could not foresee αTi will be defeated by this assault.Proposition 9.
Desynchronization attackProof.
Because there is no updating phase of shared parameters after the protocol execution concludes, our proposed technique is immune to desynchronization assaults. The attacker may only block theM4 message if the tag Ti is used to set the session key SKTS/SKST. Because Ti has not received M4 in a timely manner, this entity may need to restart the login and authentication step in order to reestablish the session key. We wish to underline that the aforementioned situation is distinct from an impersonation assault—as previously stated, an adversary cannot impersonate a valid tag. In addition, the tag Ti must start the protocol; otherwise, the server S would reject the request.Proposition 10.
Insider attackProof.
In the initialization phase of our scheme,Ti sends MR1=IDTi,αTi,CTi to S and receives MR2=pidTi,ATi in return. Further computes, where PWT=hIDTi‖pwTi⊕αTi‖paTi. Likely, the chances for an insider attacker to disclose pwTi are almost null (i.e., 2−n).Proposition 11.
Man-in-the-middle attackProof.
To carry out a successful man-in-the-middle attack, an adversary must be able to impersonate a protocol entity or modify a message without being discovered. Nonetheless, the aforementioned attack will fail in our suggested protocol for the following reasons. For starters, as we explained in Section7, the adversary’s advantage in impersonating the tag, the reader, or the server is insignificant. Second, we have shown (5) that any change to the transmitted message causes the receiver to reject the received message. Finally, we demonstrated how an opponent cannot properly relay a message to deceive about his distance or replay an earlier message in Sections 6. As a result, the suggested protocol is impenetrable to a man-in-the-middle assault.Proposition 12.
Ephemeral secret leakage (ESL) attack:Proof.
As described in the Proposition2, both Ti and S establish a common session key during the execution of the proposed scheme. The session key is computed as SKTS=hIDTi⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5. The SK-security of the proposed scheme relies on the secret credentials as discussed in the following two cases:Case 1. Let us considerA knows the ephemeral (short-term) secret credentials α and β. It is computationally infeasible for A to create the valid session key SKTS without the knowledge of the long-term secrets ARj, ATi, αRj, and xs.Case 2. We assume that the long-term secretsARj, ATi, αRj, and xs some or all of them are revealed to A, and the attacker A’s task to generate SKTS without the ephemeral secret credentials α and β this again turns out to be computationally infeasible task.
This shows thatA can generate a valid session key SKTS only if both the ephemeral and long-term secret credentials are revealed. Furthermore, if a particular session is compromised, the session key established in previous/future sessions are completely different to the compromised session key due to the application of both long-term secrets and newly generated random nonces, which are secret and not revealed to A. Therefore, both forward as well as backward secrecy along with the SK-security are preserved in the proposed scheme. Moreover, in the proposed scheme, with the help of the session hijacking attack, a session key is leaked in a particular session; it has no affect to compromise the security of other previous as well as future sessions. By summing up all these cases, the proposed scheme is secure against the ESL attack.


## 7.1. ROR Model-Based Proof

Under this model, adversaries say thatA has access to a set of executing entity queries including CorruptTi Ti, Test Pt, , Execute Ti,Sj, and Reveal Pt, which perform simulation to check the real attack. The query descriptions of such queries are given in Table 8. The ROR model components are as follows:(i)
Participants: The associated participants with the proposed scheme are the tagTi, reader Rj, or a cloud server Sj. The instances t1 and ts of Ti and Sj are marked as PTit1 and PSjt2 which are known as oracles.(ii)
Accepted state: If the peer points achieve an accepted status when the final communication has been authenticated, the instance “Pt” comes under “accepted state.” For the ongoing session, sid is a Pt session ID created in a sequence by PPt after the sent and received messages were rearranged.(iii)
Partnering: The following things must be accomplished to be partnered betweenPt1 and Pt2:(1)
They are in “accepted states.”(2)
They possess the samesid. Further also “authenticate mutually with each other.”(3)
They are also “mutual partners of each other.”(iv)
Freshness:PTit1 or PSjt2 is fresh when the constructed session key between Ti and Sj is not leaked to A using the Reveal Pt query listed in Table 8.Table 8
Various queries with their descriptions.
QuerySignificanceCorruptTiTiA can extract the stored credentials by compromised tag Ti’s memoryExecute(Ti,Sj)This supportsA in intercepting communications between Ti and SjRevealPtThis allowsA to obtain the SKST=SKTS session key from Pt and its partnerTestPtIt allowsA to request Pt for the session key SKTS=SKST and is probably a consequence of a flickered “unbiased coin c” Pt outputThe proposed scheme undergoes “semantic security” as defined in Definition1.Definition 1.
IfAdvARfid−PUFtp is the “advantage of an adversary A running in polynomial time tp in breaching the semantic security of Rfid−PUF to extract the session key SKTS among a tag Ti and a cloud server Sj,” AdvARfid−PUFtp=2Prc′=c−1, where c are the correct bits and c′ indicate the guessed bits.
Furthermore, Definition2 is about “collision-resistant one-way hash function” and Definition 3 is about “elliptic curve decisional Diffie–Hellman problem (ECDDHP),” for briefing Rfid−PUF.Definition 2.
A “deterministic function,” sayh: 0,1∗⟶0,1lb, is a “one-way collision-resistant hash function” if it produces fixed length of lb bits output string hm∈0,1lb as “hash value or message digest” upon an arbitrary length input string m∈0,1∗. Let an adversary A want to find a hash collision. Then, the “advantage” of A in attacking “hash collision” is provided by AdvAHashth=Prm1,m2←rA:m1≠m2,hm1=hm2. PrX here shows the chance that the pair will be randomly picked by A in the case of “random event X” and m1,m2←rA. The attack of η,t-adversary of A to the resistance of collision of h⋅ indicates that the maximum runtime of th to the AdvAHashth≤η.Definition 3.
Consider an elliptic curveEqu,v and a point P, the ECDDHP is “for a quadruple 〈P, uv1.P, uv2.P, uv3.P〉, decide whether uv3=uv1⋅uv2 or it is a uniform value,” where uv1, uv2, uv3∈Zq∗ (=\{1, 2, …, q−1\}).
To make ECDDHP intractable, the chosen primeq needs to be at least 160-bit number.Theorem 1.
Suppose our schemeRfid−PUF runs in “polynomial time tp” and the adversary A is working to gain advantage on Rfid−PUF. If queryh, Hash, and AdvAECDDHPtp indicate the “cardinality of hash queries,” “size of one-way hash function h⋅,” and “A’s advantage in breaching ECDDHP in t ime tp (see Definition III-A),” respectively, and chosen passwords follow the Zipf’s law [26], then the bit-lengths of the PUF key PUFC∗ where ∗ refers to Ti/Rj and the tag identity IDTi are l1 and l2, respectively, γ′ and sγ′ are the Zipf’s parameters [26] respectively, A’s advantage in compromising the semantic security of the proposed scheme Rfid−PUF is AdvARfid−PUFtp≤2AdvAECDDHPtp+queryh2/Hash+2maxquerys/2l1,querys/2l2,γ′⋅queryssγ′.Proof.
This proof is presented in the similar way as presented by authentication protocols. Here four games are played, such asGk, k=0,1,2,3 related to the evidence where G0 is the starting and G3 is the finishing game. We define SuccAGk as “an event wherein A can guess the random bit c in the game Gk correctly” and also the “advantage of A in winning the game Gk as AdvA,GkRfid−PUF=PrSuccAGk.” The detailed study of these games is as follows:G0: G0 is the same as the real ROR model protocol. Therefore, the semantic security of Rfid−PUF is defined in Definition 1.(1)AdvARfid−PUFtp=2⋅AdvA,G0Rfid−PUF−1,G1: In this game, we model for the “eavesdropping attack” in which A can intercept all the communicated messages M1=pidTiATiW1⊕α.xs.g,α.g,TSLA1, M2=M1,TSLA3,W2‖pidRj, M3=W3,W4,TSLA5,β.g, and M4=W3,β.g,TSLA5 while executing “authentication and key agreement phase” in Section A using Execute query as discussed in Table 8. To confirm whether the “calculated session key SKTS between Ti and S is real or a random number,” A can execute both Reveal and Test queries. The established session key is SKST=hIDTi∗⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5=SKTS. It is worth noting that the key to session security is dependent on both α and β “temporary secrets” and Ti′ and S’ for long-term secretions that cannot be disregarded by eavesdrops of the messages M1, M2, M3, and M4. Therefore, this “eavesdropping attack” does not give any advantage/increase of winning probability of A in G1. This shows G0 and G1 games become “indistinguishable,” and thus obtains the following result:(2)AdvA,G1Rfid−PUF=AdvA,G0Rfid−PUF.G2: In this game, the hash searches are simulated. Both ATi and TSLA1 are altered in the M1 message. Similarly, M2, M3, and M4 are also equally unexpected, as they include random timestamps and random numbers, such as ARj, αRj, TSLA3, pidTi∗, sni, and TSLA5 are equally unforeseeable. So, no collision occurs when A does hash queries. Since both G1 and G2 are “indistinguishable” except for the inclusion of the G2 simulations, we obtain birthday paradox outcomes as(3)AdvA,G2Rfid−PUF−AdvA,G1Rfid−PUF≤queryh22Hash.G3: The CorruptTi Ti query was implemented in this final game. Therefore, the opponent A is extracted depending on the performance of the query for the credentials ATi,pidTi,αTi,αRj,ARj,pidRj from a compromised tag Ti. The A probability to properly guess the PUFC∗ physically unclonable function secret key of l1 bit-length and IDTi user identity of l2 bit-length are querys/2l1 and querys/2l2, respectively. The advantage of A is more than 0.5, if querys=107or108, since the passwords of the users selected tend to obey the law of Zipf’s, by using assaults via trawling. If A can exploit user’s personal data for a targeted assault, then querys≤106 gives him an edge over 0.5.
Furthermore,A will have all the intercepted messages M1, M2, M3, and M4. To derive the session key SKST=hIDTi∗⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5=SKTS shared between Ti and S, A needs to calculate hαRj⊕IDRj, ATi∗‖IDTi which in a polynomially restricted time tp is computationally costly owing to the intractability of ECDDHP. Since G2 and G3 games are “indistinguishable,” the following is excepted to include the question and ECDDHP of CorruptTi Ti(4)AdvA,G3Rfid−PUF−AdvA,G2Rfid−PUF≤AdvAECDDHPtp+maxquerys2l1,querys2l2,β′⋅queryssβ′.
Now, all the relevant queries related to the above games are executed, and then theReveal query is executed along with Test query to guess the random bit c. Thus, we get(5)AdvA,G3Rfid−PUF=12.
Combining equations (1), (2), and (5) derives:(6)12⋅AdvARfid−PUFtp=AdvA,G0Rfid−PUF−12=AdvA,G1Rfid−PUF−AdvA,G3Rfid−PUF≤AdvA,G1Rfid−PUF−AdvA,G2Rfid−PUF+AdvA,G2Rfid−PUF−AdvA,G3Rfid−PUF.
Next, combining equations (3), (4), and (6) provide the following result:(7)12⋅AdvARfid−PUFtp≤queryh22Hash+AdvAECDDHPtp+maxquerys2l1,querys2l2,β′⋅queryssβ′.
Finally, the equation (7) is multiplied by 2 on both sides to get(8)AdvARfid−PUFtp≤2AdvAECDDHPtp+queryh2Hash+2maxquerys2l1,querys2l2,β′⋅queryssβ′.


## 7.2. Informal Security Analysis

Proposition 1.
Location privacy (non-traceability)Proof.
The tagTi simply transmits the message M1=pidTiATiW1⊕α.xs.g,α.g,TSLA1, with W1=hα.g⊕ATi∗‖IDTi‖TSLA1. Only pidTiATiW1 of this message can be utilized to identify the tag. On each session, the variables alpha and TSLA1 masked and randomized the token described above. The attacker has no control over any of these values. If a collision happens on the specified value by Ti in the worst-case scenario, the adversary could detect it by monitoring the alpha.g fraction of M1, and then Ti could be monitored. However, the adversary’s advantage in finding a collision after N protocol sessions is ON2/Fq∗, which is modest enough in practice. Furthermore, M1 makes no mention of Rj or S.
The readerRj delivers M2=M1,TSLA3,W2‖pidRj to S, where W2‖pidRj may be used to monitor the reader and determine whether the W2 fraction has a collision. Similarly, after N protocol executions, the adversary has an advantage of ON2/Fq∗ in detecting a collision. As a result, the opponent’s chances of success are slim.
M3=W3,W4,TSLA5,β.g is sent by the server S, where W3=hα.β.g‖‖SKST‖ATi‖pidTi, W4=hIDRj‖ARj‖TSLA5‖pidRj. The reader Rj and the server S, on the other hand, in each of the W3 and W4 tokens are randomized in each session. As a result, an adversary is unable to retrieve data that could aid in the breach of the protocol’s location privacy.
Finally,Rj sends M4=W3,β.g,TSLA5 to Ti. The adversary’s only target in this communication could be W3. This token is a function of SKTS=hIDTi⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5, which is randomized by Ti,Rj, and S on each session.
Overall, the location privacy of all of our entities (i.e.,Ti,Rj, and S) is guaranteed by our protocol.Proposition 2.
Mutual authentication and session key agreementProof.
It is obvious that the pairsS,Ti and S,Rj are mutually authenticated if a legitimate tag Ti connects with an honest server S through a valid reader Rj and within acceptable time thresholds. However, we do not require mutual authentication between the reader Rj and the tag Ti in this protocol. In more detail, S is the source of trust for Ti, while Rj is only a gateway to S. The following is a list of the session key’s correctness and mutual agreement:
Correction Proof:(9)W3=hβ.α.g‖SKST‖ATi‖pidTi=hβ.α.g‖hIDTi∗⊕ATi‖β.α.g‖xs.α.g‖sni⊕TSLA1‖TSLA5‖ATi‖pidTi=hα.β.g‖hIDTi∗⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5ATipidTi=hα.β.g‖hIDTi⊕ATi‖α.β.g‖α.xs.g‖sni⊕TSLA1‖TSLA5ATipidTi=hα.β.g‖SKTS‖ATi‖pidTi=W3∗.
Because the tag and the server have mutual authentication,S has already authenticated Rj, and Ti may trust the reader Rj. As a result, our technique ensures mutual authentication and establishes suitable session key agreement.Proposition 3.
Physical securityProof.
. Any alteration or damage to the device with built-inPUF will cause PUF to respond differently or the device to become unavailable, according to PUF’s characteristics. It is impossible to collect any relevant information in an accessible environment since car sensors do not preserve any information. Physical attacks, aside from rendering the hardware components in the proposed protocol ineffective, are unable to extract any relevant information. As a result, the suggested protocol can ensure the system’s physical security.Proposition 4.
Achieving forward secrecyProof.
In our proposed scheme, the session key is computed asSKTS=hIDTi⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5. This session key is established between the tag Ti and the server S. If A wishes to compromise the session key, A requires the knowledge of the session-specific random values α,β, fixed value αTi, and the identities of the participants involved in the session key establishment. Now, even if pwTi,paTi are compromised by A, due to the lack of knowledge of CTi or random values α,β and fixed value αTi, attacker fails to compute W1. Thus, A does not gain any advantage even if he compromises pwTi,paTi. Therefore, A cannot compute the previous/current/future session keys.Proposition 5.
Message authenticationProof.
In this protocol, the server authenticatesM1 and M2. The reader Rj authenticates S, M3 partially and the tag Ti totally. The use of random integers and the one-way hash function ensure the integrity of all messages. Any alteration to the conveyed message causes the receiver to reject the message.
For instance, considerM1=pidTiATiW1⊕α.xs.g,α.g,TSLA1 message, where W1=hα.g⊕ATi∗‖IDTi‖TSLA1, which should be authenticated by S. TSLA4−TSLA1≤?ΔT is checked by the server S first. As a result, if the adversary replicates the message, S will reject it. Then, S extracts pidTi∗ATi∗W1∗, retrieves the related sni value using IDTi and αTi, and computes and verifies W1∗=?hα.g.αTi⊕ATi∗‖IDTi‖TSLA1 to accept the message. It is clear that any modification in TSLA, α.g, or pidTi∗ATi∗W1∗ renders the probability of W1∗?=W1 to 2−n, where n is the hash length, for example 256−bit for SHA−256. The other messages in the protocol can be reasoned about in the same way. As a result, our protocol ensures message authentication between the parties involved.Proposition 6.
Replay attackProof.
In a replay attack, the adversary attempts to use a previously traded message at a later timet′. Any message received outside of the threshold time (a preset factor of ΔT) is likely to be rejected in our protocol. Aside from that, the one-way hash function ensures the integrity of timestamps. As a result, replay attacks against our protocol are impossible. Finally, the adversary may break the tag’s anonymity if he extracted xs.g from the α.xs.g and α.g pair. It is most likely the same as solving ECCDHP, which is known to be a difficult task (see Section 3.1).Proposition 7.
Impersonation attack
Tag:Proof.
Due to the integrity ofTSLA1, the only way to spoof the tag is to construct a valid M1. It is not possible, however, without guessing or computing a valid W1=hα.g⊕ATi∗‖IDTi‖TSLA1, where TSLA1 is the attack time’s timestamp. The enemy also lacks ATi and IDTi. As a result, the adversary’s chance of successfully impersonating the tag is 2−n, where n is the hash function’s bit-length. To put it another way, the repeat attack is a waste of time.
Reader:Proof.
Because the integrity ofTSLA3 is guaranteed in our protocol, the adversary cannot replay messages to impersonate a reader. As a result, generating a legitimate W2‖pidRj is the only way to impersonate the Rj in front of S. The opponent, on the other hand, lacks W2=hαRjARjTSLA3, W2, and ARj. Even if she/he obtains the values W2,pidRj, and ARj in some other way, she/he must extract αRj from M2 in order to determine IDRj. It necessitates reverse engineering of the one-way hash function, which is a difficult challenge that makes the assault impracticable. As a result, impersonating Rj to S is not feasible under this protocol.
Server:Proof.
To impersonate the serverS in front of Rj, the adversary would have to compute W3,W4,TSLA5,β.g, where W3=hα.β.g‖SKST‖ATi‖pidTi and W4=hIDRj‖ARj‖TSLA5‖pidRj. pidRj,IDRj,xs.α.g would be required. Aside from xs.α.g,β.α.g, which is contributed by Ti through sending α.g, this token is randomized by xs.α.g,β.α.g. Solving a ECCDHP problem, which is a difficult problem, would be required for the disclosure of α and xs. Even if the adversary reveals the band and adapts it appropriately, the adversary still needs to know IDTi due to TSLA5 in hα.β.g‖SKST‖ATi‖pidTi, which is not the case. As a result, cheating Rj and successfully mimicking S gives the opponent a 2−n advantage. Furthermore, impersonating S in front of Rj is a prerequisite for impersonating S in front of Ti. As a result, the attacker cannot effectively impersonate the server S in front of Ti using Rj. Only M4=W3,β.g,TSLA5, where W3=hα.β.g‖SKST‖ATi‖pidTi. Unlikely as it may seem, the attacker lacks IDTi. As a result, the adversary’s advantage in committing this impersonation attack is negligible (i.e., 2−n).Proposition 8.
Offline password guessing attackProof.
The rationale for security against this attack is nearly comparable to that ofRSEAP2. In a nutshell, PWT=hIDTi‖pwTi⊕αTi‖paTi calculates the tag’s temporary password. Even if the adversary could estimate PWT, the value αTi, which is a random integer created by the tag Ti, is still required. As a result, the opponent who could not foresee αTi will be defeated by this assault.Proposition 9.
Desynchronization attackProof.
Because there is no updating phase of shared parameters after the protocol execution concludes, our proposed technique is immune to desynchronization assaults. The attacker may only block theM4 message if the tag Ti is used to set the session key SKTS/SKST. Because Ti has not received M4 in a timely manner, this entity may need to restart the login and authentication step in order to reestablish the session key. We wish to underline that the aforementioned situation is distinct from an impersonation assault—as previously stated, an adversary cannot impersonate a valid tag. In addition, the tag Ti must start the protocol; otherwise, the server S would reject the request.Proposition 10.
Insider attackProof.
In the initialization phase of our scheme,Ti sends MR1=IDTi,αTi,CTi to S and receives MR2=pidTi,ATi in return. Further computes, where PWT=hIDTi‖pwTi⊕αTi‖paTi. Likely, the chances for an insider attacker to disclose pwTi are almost null (i.e., 2−n).Proposition 11.
Man-in-the-middle attackProof.
To carry out a successful man-in-the-middle attack, an adversary must be able to impersonate a protocol entity or modify a message without being discovered. Nonetheless, the aforementioned attack will fail in our suggested protocol for the following reasons. For starters, as we explained in Section7, the adversary’s advantage in impersonating the tag, the reader, or the server is insignificant. Second, we have shown (5) that any change to the transmitted message causes the receiver to reject the received message. Finally, we demonstrated how an opponent cannot properly relay a message to deceive about his distance or replay an earlier message in Sections 6. As a result, the suggested protocol is impenetrable to a man-in-the-middle assault.Proposition 12.
Ephemeral secret leakage (ESL) attack:Proof.
As described in the Proposition2, both Ti and S establish a common session key during the execution of the proposed scheme. The session key is computed as SKTS=hIDTi⊕ATi‖α.β.g‖xs.α.g‖sni⊕TSLA1‖TSLA5. The SK-security of the proposed scheme relies on the secret credentials as discussed in the following two cases:Case 1. Let us considerA knows the ephemeral (short-term) secret credentials α and β. It is computationally infeasible for A to create the valid session key SKTS without the knowledge of the long-term secrets ARj, ATi, αRj, and xs.Case 2. We assume that the long-term secretsARj, ATi, αRj, and xs some or all of them are revealed to A, and the attacker A’s task to generate SKTS without the ephemeral secret credentials α and β this again turns out to be computationally infeasible task.
This shows thatA can generate a valid session key SKTS only if both the ephemeral and long-term secret credentials are revealed. Furthermore, if a particular session is compromised, the session key established in previous/future sessions are completely different to the compromised session key due to the application of both long-term secrets and newly generated random nonces, which are secret and not revealed to A. Therefore, both forward as well as backward secrecy along with the SK-security are preserved in the proposed scheme. Moreover, in the proposed scheme, with the help of the session hijacking attack, a session key is leaked in a particular session; it has no affect to compromise the security of other previous as well as future sessions. By summing up all these cases, the proposed scheme is secure against the ESL attack.


## 8. Observations and Performance Analysis

We use the implementation results in [2] “(CPU: Intel(R) Core(TM)2T6570 2.1 GHz, Memory: 4G, OS: Win7 32-bit, Software: Visual C++ 2008, MIRACL C/C++ Library)” to estimate the computation time. Because SHA-2 occupies 15.8 cycles per bytes [27], it takes Thfun=0.0004∗15.8/11.4=0.0005 milliseconds to compute. To be clear, the number Thfun corresponds to a single call to the SHA-2 compression function fun. The SHA-2 compression function has a message-block length of 512 bits. We built the new protocol in detail to reduce the amount of calls to this compression function, particularly on the tag side, which is the most limited device. Finally, the time required to calculate scalar multiplication on ECC-160, represented by TEMP, is 7.3529 milliseconds, whereas the time required to calculate a chaotic map is TCH  =  TEMP[28]. The needed time for encryption/decryption of a symmetric scheme TSym varies depending on the employed symmetric encryption method; however, the stated time for AES is TSym=0.1303 milliseconds. The details are shown in Table 9.Table 9
Approximate time required for various operations.
NotationDescriptionApproximate computation(Time to compute)Time (in milliseconds)ThfunHash function0.0005TEMPECC point multiplication7.3529TSymEnc/DecSymmetric encryption/decryption0.1303TQR≈TEMPQR code7.3529TCH≈TEMPChaotic map7.3529TMAC≈ThfunMessage authentication code0.0005The hash function output, nonces, timestamps, tag/reader identities, a symmetric encryption output block, and elliptic curve points all have bit widths of160,160,32,160,128, and 320 bits, respectively, for the performance analysis. We compare the computational and communication expenses of RSEAP2 with our method in Table 10. Because tags are the most limited devices in the system, we focus our investigation on them. There are no major changes in consuming time when compared to RSEAP2, as shown in Figure 3, simply a minor improvement in our approach. Our scheme is much more efficient than RSEAP2 in terms of bits sent (and received), as shown in Figure 4. It entails a significant reduction in power consumption, which is a critical metric in such devices. Finally, in Table 11, we compare and contrast the security qualities afforded by comparable systems with our scheme (see Figure 5 for an instance). To summarize, the new protocol is more efficient and secure than the old one.Table 10
Comparison of communication costs.
SchemeCommunication cost(sending mode)Communication cost(receiving mode)Computation(in milliseconds)Time(ms)Jiang et al. [3]7687689Thfun+5TSys+3TEMP37.4205Kumar et al. [7]8325449Thfun+3TEMP22.0632Mishra et al. [11]6722244Thfun+2TCH14.7078Jiang et al. [4]12808009Thfun+TSys+5TEMP22.1935Safkhani et al. [2]6725126Thfun+3TEMP22.0617Our scheme6725126Thfun+2TEMP14.7088Figure 3
Computation cost comparison.Figure 4
Communication cost comparison.Table 11
Comparison of security features.
Security attributes[7][3][4][2][11]OurTraceability preservation×√√√√√Suitable for cloud environments√√√√√√Password guessing attack√√√√√√Privileged-insider attack√√√√√√User anonymity preservation×√√√√√Relay attack×××√×√Replay attack√√√√√√Impersonation attacks×√√××√Denial-of-service attack×√√×√√Message authentication×√√××√Mutual authentication√√√×√√Man-in-the-middle attack×√√√×√ESL attack√√√√√√Session key agreement√√√×√√Desynchronization attack√√√√√√Revocability×××××√Free password/biometric change√√√×√√Security attributes achieved91515101218Figure 5
Security attribute comparison.


## 9. Concluding Remarks

In this article, we designed a PUF and RFID-based authentication protocol for vehicular cloud computing environment which ensure the secure communication among the participating entities such as tag, reader, and the cloud server. The uniqueness property of PUF and ECC allows significant functional advantages in ensuring and designing the secure key establishment and communication. Our proposed protocol efficiently supports for the revocation and reissue features and tag’s friendly password update/change mechanism. Using the provable random oracle model, we presented the advantages of an adversary in violating the security features. Moreover, through the informal security analysis, we have shown that the proposed scheme successfully prevents all the well-known security attacks for authentication protocols. Our scheme withstands all the 18 security features and further consumes the computation cost of6Thfun+2TEMP  = 14.7088 ms which is comparable with the other schemes. Similarly, our scheme consumes the communication cost as 672 bits during the sending mode and 512 bits during the receiving mode. Overall, the performance of our proposed scheme is comparable with the related schemes and provides more security features compared to the other related existing protocols.



---

*Source: 8998339-2022-07-30.xml*