# A Provably Secure Authentication and Key Exchange Protocol in Vehicular Ad Hoc Networks

Authors: Tsu-Yang Wu; Zhiyuan Lee; Lei Yang; Chien-Ming Chen
Journal: Security and Communication Networks
 (2021)

---

## Abstract

While cloud computing and Internet of Things (IoT) technologies have gradually matured, mobile intelligent transportation systems have begun to be widely used. In particular, the application of vehicular ad hoc networks (VANETs) is very convenient for real-time collection and analysis of traffic data. VANETs provide a great convenience for drivers and passengers, making it easier to choose routes. Currently, most research on VANETs obtains data through cloud servers. However, there are few studies on cloud servers obtaining vehicle information through the roadside unit (RSU). In the process of reading traffic information, there will be some private and sensitive information, which may be intercepted or tampered with in untrusted public channels. Therefore, it is necessary to propose a protocol to protect vehicle data during the information reading phase. In this paper, we propose a new provably secure authentication protocol to negotiate a session key before transmitting traffic information. This protocol can complete mutual authentication and generate a session key. Finally, security analysis and performance analysis show that our protocol is secure and efficient.


---

## Body

## 1. Introduction

Due to social and economic development, motor vehicles are rapidly spreading. At the same time, the rapid increase in the number of vehicles on the road has also made the traffic situation more complicated, and there will be many traffic problems, such as traffic accidents and road congestion. Therefore, researchers apply artificial intelligence [1–4], wireless networks, and sensor technology [5, 6] to road vehicle management, so that vehicles can share information and release relevant road information to alleviate traffic problems. This is the vehicular ad hoc network, which consists of vehicle-to-vehicle (V2V) communication and vehicle-to-infrastructure (V2I) communication. In the VANETs, the vehicle is equipped with an on-board unit (OBU), so the vehicle can be regarded as a mobile network node that can communicate. Therefore, the vehicle can obtain the corresponding road information from the cloud server through the RSU and can also send the relevant information recorded by itself to the cloud server. The main goal of VANET technology is to improve traffic efficiency and increase driving experience. With the popularity and development of VANET, it plays a key role in user travel planning and road safety.Although VANETs have various obvious benefits, their security and privacy issues [7–9] are still the keys to whether they can be widely used. In VANETs, the network environment is open; attackers can capture various messages transmitted in the network and can forge a legitimate vehicle to send wrong information. The transmission of wrong information will mislead the driver to make the wrong decision, bringing corresponding troubles and even dangers. First, before information transmission, mutual authentication must be performed, and a corresponding session key must be generated for subsequent information transmission. Then the integrity of the message must be verified every time a message is received. In addition, anonymity is indispensable in VANET, because if the vehicle transmits its identity on the network in clear text, the attacker captures the information, and the vehicle can be faked or the vehicle can be tracked.However, several kinds of research in VANETs mainly focus on how to ensure that vehicles obtain corresponding road information. In other aspects, vehicles can receive current traffic conditions through RSU. Based on the information received, the driver can adjust the driving decision. Because the road conditions are changing, the RSU can actively establish a communication request with the vehicle to obtain the road condition information stored by the vehicle sensor (as shown in Figure1). Based on our best knowledge, we propose a new provably secure mutual authentication scheme for negotiating session keys before transmitting traffic information in this paper. The main contributions of this paper are summarized as follows:(1)
A three-party AKE scheme is proposed, with vehicles, RSU, and cloud servers. RSU actively sends a request, completes mutual authentication with the vehicle through the cloud server, and generates a session key.(2)
Due to environmental constraints, the proposed scheme only performs simple operations, such as elliptic curve (ECC), bitwise XOR, and hash functions.(3)
We conduct a security analysis of the protocol, including formal analysis, informal analysis, and ProVerif simulation.(4)
Finally, the performance of the proposed protocol is evaluated. Compared with the existing methods, we show that our protocol is feasible.Figure 1
A typical VANETs structure.The remainder of this paper is organized as follows. In Section2, the latest research results of the AKE protocol and related research on security authentication in the VANET environment are reviewed. Section 3 describes our proposed protocol in detail. Then, in Sections 4 and 5, the security analysis and performance analysis of the protocol proposed in Section 3 are carried out. Finally, the article is summarized in Section 6.


## 2. Related Work

Many researchers have conducted a series of studies on authentication and key exchange protocols in VANETs. However, with the changes of various needs and scenarios, many security issues have emerged in these studies.First of all, in terms of an authentication protocol, Lamport [10] proposed for the first time password authentication in an insecure channel. Immediately afterward, various two-party authentication schemes were proposed [11, 12]. But, for the VANETs environment, the communication between vehicles can use a two-party authentication scheme, and if the vehicle and the cloud server are authenticated, the two-party authentication will cause transmission delay, because two-party identity authentication is generally used in a single-server environment. In 2001, Li et al. [13] first proposed an authentication scheme in a multiserver environment, but their scheme is inefficient because it takes a lot of time to train neural networks. Later, to complete efficient and secure identity authentication, researchers began to introduce multifactor security. In addition to passwords, security factors such as smart cards and biological information were introduced [14–16]. Recently, Irshad et al. [17] proposed an authentication scheme under a multiserver architecture based on the chaotic mapping. But Wu et al. [18] found that Irshad et al.’s protocol cannot guarantee user anonymity and is vulnerable to attacks by privileged insiders. Therefore, Wu et al. proposed an authentication protocol for distributed cloud environments, claiming that their protocol can resist various known attacks. However, Wu et al. [19] recently proposed an authentication key exchange protocol under a multiserver architecture and found that [18] has multiple security problems, including the inability to provide perfect forward secrecy (PFS) and being vulnerable to privileged internal attacks. Also, in a multiserver environment, in 2017, Truong et al. [20] proposed an ECC-based authentication scheme. Their article discussed that Yeh et al.’s [21] protocol cannot provide mutual authentication and the key agreement phase is incorrect. In 2018, Zhao et al. [22] proposed a secure and efficient authentication protocol based on passwords and smart cards. They claimed that the scheme of Truong et al. could not achieve the security authentication requirements of multiserver authentication and could not resist offline password guessing and impersonation attacks. However, Hassan et al. [23] conducted a security analysis on the scheme proposed by Zhao et al. and found that the scheme is vulnerable to anonymity and traceability issues and is not suitable for a multiserver environment. Then, on this basis, Hassan et al. proposed an improved multiserver authentication scheme.Currently, there are two research focuses on the VANETs environment; one is efficient authentication, and the other is privacy protection. The former appeared because of the large number of vehicles in the VANETs environment, and data transmission and processing are very challenging. In order to solve this problem, cloud computing began to be applied to the VANETs [24]. In VANETs, cloud computing-based authentication schemes have also begun to be widely proposed [25–29]. These solutions reduce the server-side service response time and improve authentication efficiency. However, due to the number of vehicles involved and management issues, network delays can also be caused. Then cloud computing began to decentralize and fog computing was used to solve the above shortcomings [15, 30–32]. The latter is because, in an open network environment, the private information of vehicle users must be protected. Therefore, the Conditional Privacy Preservation Authentication (CPPA) agreement was proposed [33]. In this protocol, the attacker cannot obtain the true identity of the vehicle user through messages intercepted on the public channel, but a trusted third party can calculate the identity of the vehicle user who sent the message. In 2008, Zhang et al. [34] proposed an identity-based verification scheme and proved that their proposed scheme can practice conditional privacy protection, trusting the authority to retrieve the true identity of the vehicle from any false identity. In 2014, Chuang and Lee [35] proposed the first authentication mechanism using transitive trust relationship. Later, Zhou et al. [36] used elliptic curve cryptography (ECC) to propose a new mutual authentication scheme based on the mechanism proposed by Chuang and Lee and mentioned in their paper that the scheme of Chang and Lee cannot resist internal attacks. However, Wu et al. [37] found that Zhou et al.’s scheme could not guarantee anonymity and was vulnerable to identity guessing and impersonation attacks. At the same time, they designed a new privacy protection authentication protocol using ECC technology. Some researchers have proposed the use of fog computing for information processing in the VANET environment. In 2019, Ma et al. [30] proposed a new AKE protocol without bilinear pairing. They believed that the proposed protocol is safe and efficient. However, Eftekhari et al. [38] found that the protocol of Ma et al. had security problems, such as internal attacks, known session-specific temporary information attacks, and stolen smart card attacks, and then they proposed a safer and more efficient protocol. In 2017, Mohit et al. [39] proposed a new vehicle communication protocol and believed that their protocol could resist attacks such as stolen smart card attacks and impersonation attacks. However, Yu et al. [40] found that Mohit et al.’s scheme could not provide security attributes such as anonymity and mutual authentication and would suffer impersonation and traceability attacks. Then Yu et al. proposed a new security authentication protocol and proved that their protocol can resist various known attacks. In 2020, Sadri and Rajabzadeh Asaar [41] proved that Yu et al.’s protocol is vulnerable to tracking attacks, impersonation attacks, sensor capture attacks, and so forth and proposed a secure protocol for application in VANETs.Some studies have begun to design the AKE protocol for the advantages of low latency and high reliability in the 5G environment [42]; and, for some special occasions, blockchain technology [43] is also used to complete the authentication key exchange. Research similar to VANET currently has similar flying ad hoc networks (FANETs). Moreover, this environment is also vulnerable to serious security threats. Due to these security threats, many security protocols have been proposed in this environment [44–47]. Therefore, when studying VANETs, you can refer to some security solutions in FANETs. However, most of the research is carried out on the premise that the vehicle initiates a communication request. So, it is necessary to propose an authentication scheme in which a cloud server or RSU initiates a communication request to the vehicle user to meet the timely update of road condition information.


## 3. Proposed Scheme

In this section, we introduce in detail a new provably secure mutual authentication scheme used to negotiate session keys before transmitting traffic information. The communication entities in the proposed protocol include vehicle users, roadside units, and cloud servers. For the convenience of reading, the symbols used in the scheme are listed in Table1. The proposed protocol has five phases, namely, the initialization phase, the vehicle registration phase, the RSU registration phase, the login phase, and the authentication phase.Table 1
Notations and descriptions.
NotationsDescriptionViTheith vehicle end userRSUjThejth roadside unitCSThe cloud serverVIDiVi’s identityPwiVi’s passwordBioiBiometric features ofViGen⋅/Rep⋅Generation/reproduction process of fuzzy extractorxThe secret key ofCSPPVIDiThe pseudoidentities ofViSKSession keyAThe attackerh⋅One-way hash functionxyConcatenationx⊕yThe exclusive-or operation withx and y


### 3.1. Initialization Phase

(1)
The cloud serverCS selects two large prime numbers p and q and then constructs an elliptic curve E defined about the domain Zq for q. The points on E form a cyclic additive elliptic curve group G, and the generator P of G is obtained.(2)
CS selects two random numbers x and α and computes β=α⋅P, where x is the long-term key of the CS, α is the private key, and β is the public key.(3)
Finally,CS chooses a one-way hash function h⋅.


### 3.2. Vehicle User Registration Phase

When the vehicle userVi wants to get the corresponding service, he/she must register through the cloud server CS. The main steps are as follows. Figure 2 describes the process of vehicle user registration in detail.(1)
Vi chooses its own VIDi and then sends it to CS through a secret channel.(2)
On receivingVIDi, CS selects ni and computes Kv=hVIDihxni and PVIDi=hVIDiKv. Then, CS saves PVIDi,VIDi,ni to memory and securely transmits PVIDi,Kv to Vi.(3)
Finally,Vi computes ϕi,θi=GenBioi, HPi=Kv⊕hPwiϕi, and Authi=hKvVIDi and stores PVIDi,Authi,HPi,θi into OBU. Among them, Pwi is the Vi ’s password, and Bioi is the Vi ’s biological information.Figure 2
Vehicle user registration phase.


### 3.3. RSU Registration Phase

Through the registration phase,RSUj can obtain the private key, as shown in Figure 3.(1)
RSUj selects a random number cj and computes dj=cj⋅P and then sends the identity RIDj and dj to CS securely.(2)
CS selects the pseudoidentity PRIDj of RSUj and the random number kj. Then CS computes yj=kj⋅P+dj and zj=kj+yj+PRIDj⋅αmodp, stores PRIDj,RIDj,yj,kj in its database, and finally sends PRIDj,yj,zj to RSUj.(3)
RSUj computes xj=zj+cj and then verifies whether xj⋅P is equal to zj⋅P+cj⋅P. If the verification is passed, the private key distribution is successful. Then PRIDj,yj,zj is stored in RSUj memory.Figure 3
Registration phase.


### 3.4. Login Phase

Since the environment proposed by the scheme is to complete mutual authentication and key exchange during vehicle operation, the vehicle user login will be completed in advance. Figure4 shows the login information of the vehicle user.Figure 4
Login phase.


### 3.5. Authentication Phase

The entire authentication phase is initiated byRSUj, which wants to communicate with the running vehicle. The detailed information is shown in Figure 5.(1)
First,RSUj makes a communication request Request and selects a random number rj to compute Rj=rj⋅P. RSUj sends Request and Rj to Vi.(2)
AfterVi receives the communication request, it selects a random number ai and the current timestamp T1 and computes Ni,Mi,C1,C2 (see equations (1)–(4)). Then it sends Ni,C1,C2,T1 to RSUj.(1)Ni=ai⋅P,(2)Mi=ai⋅β,(3)C1=PVIDi+hMiRjNiT1,(4)C2=hPVIDiVIDiNiT1.(3)
RSUj verifies the validity of the timestamp (by T2−T1<ΔT). RSUj computes Mj,C3,C4 (as shown in equations (5)–(7)). Finally, RSUj sends Rj,C3,C4,T2 to CS.(5)Mj=rj⋅β,(6)C3=PRIDj+hMjRjT2,(7)C4=hPRIDjRIDjMjT2.(4)
AfterCS receives the message, it first verifies whether the timestamp is valid (by T3−T2<ΔT). If the verification is passed, it computes Mi′=xj⋅Ni and PVIDi′=C1−hMi′RjNiT1. Then it takes out VIDi from the memory through PVIDi and computes C2′=hPVIDi′VIDiNiT1. If C2′ and C2 are equal, then perform the operation; otherwise, terminate the session. Then, CS computes Mj′=α⋅Rj and PRIDj′=C3−hMj′RjT2 and then retrieves RIDj in the database through PRIDj. After that, CS computes C4′=hPRIDj′RIDjMj′T2 and completes the authentication operation. If authenticated, CS selects a random number bs and a timestamp T3 and computes Ns,C5,C6,PVIDinew,PRIDjnew,C7 (see equations (8)–(13)). Finally, CS updates the values of PRIDj and PVIDi in memory and sends C5,C6,C7,Ns,T3 to RSUj.(8)Ns=bs⋅P,(9)C5=bs⋅yj+yj+PRIDj⋅β,(10)C6=PRIDj′+hVIDiMi′T3,(11)PVIDinew=hPVIDi′Mi′,(12)PRIDjnew=hPRIDj′Mj′,(13)C7=PVIDinew+hRIDiMj′T3.(5)
RSUj also verifies the validity of the timestamp. Then it computes C5′=xj⋅Ns and verifies that C5′ is equal to C5. If authenticated, RSUj computes PVIDinew,C8,PRIDjnew (see equations (14)–(16)). Then it updates the values of PRIDj in memory. Finally, RSUj computes the session key SK=hPVIDinewPRIDjrj⋅Ni and sends C6,C7,C8,T3,T4 to Vi.(14)Ns=bs⋅P,(15)C8=hPRIDjRjMi′T4,(16)PRIDjnew=hPRIDjMj.(6)
AfterVi receives the message, it checks the freshness of timestamp. If it is confirmed, Vi computes PRIDj′=C6−hVIDiMiT3 and C8′=hPRIDj′RjMiT4 and then verifies C8′?=C8. If authenticated, Vi computes a new PVIDinew=hPVIDiMi and updates this value in the memory. Finally, Vi computes the session key SK=hPVIDinewPRIDj′ai⋅Rj.Figure 5
Authentication phase.


## 3.1. Initialization Phase

(1)
The cloud serverCS selects two large prime numbers p and q and then constructs an elliptic curve E defined about the domain Zq for q. The points on E form a cyclic additive elliptic curve group G, and the generator P of G is obtained.(2)
CS selects two random numbers x and α and computes β=α⋅P, where x is the long-term key of the CS, α is the private key, and β is the public key.(3)
Finally,CS chooses a one-way hash function h⋅.


## 3.2. Vehicle User Registration Phase

When the vehicle userVi wants to get the corresponding service, he/she must register through the cloud server CS. The main steps are as follows. Figure 2 describes the process of vehicle user registration in detail.(1)
Vi chooses its own VIDi and then sends it to CS through a secret channel.(2)
On receivingVIDi, CS selects ni and computes Kv=hVIDihxni and PVIDi=hVIDiKv. Then, CS saves PVIDi,VIDi,ni to memory and securely transmits PVIDi,Kv to Vi.(3)
Finally,Vi computes ϕi,θi=GenBioi, HPi=Kv⊕hPwiϕi, and Authi=hKvVIDi and stores PVIDi,Authi,HPi,θi into OBU. Among them, Pwi is the Vi ’s password, and Bioi is the Vi ’s biological information.Figure 2
Vehicle user registration phase.


## 3.3. RSU Registration Phase

Through the registration phase,RSUj can obtain the private key, as shown in Figure 3.(1)
RSUj selects a random number cj and computes dj=cj⋅P and then sends the identity RIDj and dj to CS securely.(2)
CS selects the pseudoidentity PRIDj of RSUj and the random number kj. Then CS computes yj=kj⋅P+dj and zj=kj+yj+PRIDj⋅αmodp, stores PRIDj,RIDj,yj,kj in its database, and finally sends PRIDj,yj,zj to RSUj.(3)
RSUj computes xj=zj+cj and then verifies whether xj⋅P is equal to zj⋅P+cj⋅P. If the verification is passed, the private key distribution is successful. Then PRIDj,yj,zj is stored in RSUj memory.Figure 3
Registration phase.


## 3.4. Login Phase

Since the environment proposed by the scheme is to complete mutual authentication and key exchange during vehicle operation, the vehicle user login will be completed in advance. Figure4 shows the login information of the vehicle user.Figure 4
Login phase.


## 3.5. Authentication Phase

The entire authentication phase is initiated byRSUj, which wants to communicate with the running vehicle. The detailed information is shown in Figure 5.(1)
First,RSUj makes a communication request Request and selects a random number rj to compute Rj=rj⋅P. RSUj sends Request and Rj to Vi.(2)
AfterVi receives the communication request, it selects a random number ai and the current timestamp T1 and computes Ni,Mi,C1,C2 (see equations (1)–(4)). Then it sends Ni,C1,C2,T1 to RSUj.(1)Ni=ai⋅P,(2)Mi=ai⋅β,(3)C1=PVIDi+hMiRjNiT1,(4)C2=hPVIDiVIDiNiT1.(3)
RSUj verifies the validity of the timestamp (by T2−T1<ΔT). RSUj computes Mj,C3,C4 (as shown in equations (5)–(7)). Finally, RSUj sends Rj,C3,C4,T2 to CS.(5)Mj=rj⋅β,(6)C3=PRIDj+hMjRjT2,(7)C4=hPRIDjRIDjMjT2.(4)
AfterCS receives the message, it first verifies whether the timestamp is valid (by T3−T2<ΔT). If the verification is passed, it computes Mi′=xj⋅Ni and PVIDi′=C1−hMi′RjNiT1. Then it takes out VIDi from the memory through PVIDi and computes C2′=hPVIDi′VIDiNiT1. If C2′ and C2 are equal, then perform the operation; otherwise, terminate the session. Then, CS computes Mj′=α⋅Rj and PRIDj′=C3−hMj′RjT2 and then retrieves RIDj in the database through PRIDj. After that, CS computes C4′=hPRIDj′RIDjMj′T2 and completes the authentication operation. If authenticated, CS selects a random number bs and a timestamp T3 and computes Ns,C5,C6,PVIDinew,PRIDjnew,C7 (see equations (8)–(13)). Finally, CS updates the values of PRIDj and PVIDi in memory and sends C5,C6,C7,Ns,T3 to RSUj.(8)Ns=bs⋅P,(9)C5=bs⋅yj+yj+PRIDj⋅β,(10)C6=PRIDj′+hVIDiMi′T3,(11)PVIDinew=hPVIDi′Mi′,(12)PRIDjnew=hPRIDj′Mj′,(13)C7=PVIDinew+hRIDiMj′T3.(5)
RSUj also verifies the validity of the timestamp. Then it computes C5′=xj⋅Ns and verifies that C5′ is equal to C5. If authenticated, RSUj computes PVIDinew,C8,PRIDjnew (see equations (14)–(16)). Then it updates the values of PRIDj in memory. Finally, RSUj computes the session key SK=hPVIDinewPRIDjrj⋅Ni and sends C6,C7,C8,T3,T4 to Vi.(14)Ns=bs⋅P,(15)C8=hPRIDjRjMi′T4,(16)PRIDjnew=hPRIDjMj.(6)
AfterVi receives the message, it checks the freshness of timestamp. If it is confirmed, Vi computes PRIDj′=C6−hVIDiMiT3 and C8′=hPRIDj′RjMiT4 and then verifies C8′?=C8. If authenticated, Vi computes a new PVIDinew=hPVIDiMi and updates this value in the memory. Finally, Vi computes the session key SK=hPVIDinewPRIDj′ai⋅Rj.Figure 5
Authentication phase.


## 4. Security Analysis

In this section, we conduct a security analysis of the proposed protocol and use the ROR model and ProVerif tool to complete the formal security analysis [48, 49]; and, through informal security analysis, we verified that the proposed protocol has security features and can resist various known attacks.


### 4.1. Informal Security Analysis

This section is an informal security analysis of the proposed protocol. We verify the security attributes and attacks that the proposed protocol needs to have one by one.


#### 4.1.1. Mutual Authentication

After receiving the authentication request fromRSUj, Vi computes C2=hPVIDiVIDiNiT1 and sends it to CS through RSUj. After CS receives the RSUj message, the computed C2 contains the parameters PVIDi,VIDi. Only legitimate users can generate correct C2, so that CS can verify the identity of the user and the legitimacy of the information by verifying whether C2′ is equal to C2; that is, CS authenticates Vi. Similarly, the server computes C4, RSUj computes C5, and Vi computes C8, respectively, indicating that CS has authenticated RSUj, RSUj has authenticated CS, and Vi has authenticated CS. In summary, Vi and RSUj can perform mutual authentication in the protocol.


#### 4.1.2. Man-in-the-Middle Attacks

By intercepting the information in the public channel,A may launch man-in-the-middle attacks. But after CS receives the message, it needs to verify C2?=hPVIDi′VIDiNiT1 and C4?=hPRIDj′RIDjMj′T2 to authenticate the sender. Suppose that when A tries to tamper with the information sent to RSUj, he needs to generate a new authentication information C5, but he cannot obtain the parameters xj, bs, and so forth. This means that A cannot complete the verification after tampering with the information. Similarly, when A tampered with the information sent to Vi and CS, he could not complete the relevant authentication. This shows that the protocol can resist man-in-the-middle attacks.


#### 4.1.3. Replay Attacks

In the protocol, when a new round of authentication is performed, new random numbersrj, ai, and bs will be generated; and every time the authentication is completed, the values stored in the memory such as PVIDi and PRIDj will be updated. The random number and the updated PVIDi are used when generating the session key. Therefore, when A resends the previous message, new random numbers and related parameters updated in the memory have been generated, and he cannot pass the verification and cannot compute the session key. Therefore, the proposed protocol can resist replay attacks.


#### 4.1.4. Known Session-Specific Temporary Information Attacks

Under the CK attack model [50], A can obtain the random number ai or rj generated during the authentication phase. Assuming that A obtains the random number ai generated by Vi; then Ni, Mi, and PVIDi can be calculated. However, since A cannot obtain VIDi and PRIDj, he still cannot compute the session key SK; and when A tries to use a random number to perform a man-in-the-middle attack or an impersonation attack, he cannot complete the verification by recalculating C2. Therefore, the proposed protocol can resist known session-specific temporary information attacks.


#### 4.1.5. Perfect Forward Secrecy

This security feature requires that the leakage of the long-term key does not reveal the previously generated session key.SK=hPVIDinewPRIDjai⋅Rj=hPVIDinewPRIDjrj⋅Ni in the scheme. That is, the long-term key x of CS is not used in the calculation of the session key. Since the private key α of CS does not change after each authentication, it is assumed that A can get α. Then A can compute Mi=α⋅Ni and Mj=α⋅Rj; that is, PVIDi=C1−hMiRjNiT1 and PRIDj=C3−hMjRjT2, and the updated PVIDinew=hPVIDiMi and PRIDjnew=hPRIDjMj. However, A cannot obtain the random number ai or rj needed to compute SK, so there is no way to compute SK; that is, the proposed protocol can provide perfect forward secrecy.


#### 4.1.6. Internal Attacks

Assuming thatA is a CS internal staff, he can easily obtain the information transmitted during the registration phase, including VIDi, PVIDi,Kv, RIDj,dj, and PRIDj,yj,zj. However, A cannot compute ai and rj from this information. Therefore, the proposed protocol can resist internal attacks.


#### 4.1.7. User Anonymity and Untraceability

During the authentication process,VIDi is used to compute C2 and A cannot obtain PVIDi to guess VIDi. So, the scheme can guarantee anonymity. At the same time, due to the use of random numbers and the update of the pseudoidentity after each authentication, it is also ensured that A cannot confirm the user’s identity by tracing a specific piece of information. Therefore, the protocol satisfies anonymity and untraceability.


#### 4.1.8. Three-Factor Secrecy

The proposed protocol uses passwords, biological information, and storage devices (OBU) for security encryption, so it is a three-factor authentication protocol. For this type of protocol, it is assumed that the extreme case is thatA can obtain two of the three factors and can launch an attack on the protocol.Assume thatA obtains VIDi, Pwi, and Bioi. It is necessary to compute Authi when logging in, where Kv=HPi⊕hPwiϕi, but HPi is stored in OBU. In other words, A cannot complete the login operation. The proposed protocol is safe in this situation. Assume that A obtains VIDi, Pwi, and OBU. Since ϕi cannot be computed through Bioi, A cannot compute Kv and Auth and cannot complete login verification. That is, the protocol is safe in this situation. Similarly, when A knows Bioi and OBU, there is no way to compute Authi because there is no password and identity. Therefore, the protocol is safe in the three situations, and the proposed protocol satisfies the three-factor security characteristics.


#### 4.1.9. No Key Control

In this protocol, the session keySK can only be generated through negotiation between Vi and RSUj; that is, a single entity cannot generate SK by itself. When computing SK, Vi needs to know PRIDj and Rj generated by RSUj. In the same way, RSUj needs to negotiate to obtain PVIDinew and Ni during the calculation to compute SK. Therefore, the proposed protocol is satisfied with no key control property.


### 4.2. Formal Security Analysis Based on Random Oracle Model

In this section, a random oracle model (ROR model) is used to formally prove the security of our proposed protocol. This analysis model was proposed by Canetti et al. [51]. By launching different rounds of Games, the ROR model can compute the probability of A successfully guessing the SK in various situations and thus judge the security of the protocol. Assume that IVx, IRSUy, and ICSz, respectively, represent the xth communication of Vi, the yth communication of RSUj, and the zth communication of CS. A can initiate the following query, where O=IVx,IRSUy,ICSz.(i)
ExecuteO: through this query, A can eavesdrop on the message transmitted on the public channel.(ii)
Hashstring: A executes the query and can get the hash value of the input parameter string.(iii)
SendO,M: A executes the query, sends a message M to O, and can receive the corresponding response.(iv)
RevealO: A executes this query to obtain the return result of current session key SK generated by M.(v)
CorruptO: by executing the query, A can obtain some secret values, such as long-term private keys and temporary information.(vi)
TestO: A executes the query and judges the correctness of the session key by flipping coin C. If the result is C=1, A will receive the correct session key returned; if the result is C=0, A will receive a random string.Definition 1.
(elliptic curve discrete logarithm problem (ECDLP)). Our proposed protocol uses elliptic curve cryptography (ECC). Here, we describe the computational difficulties and assumptions of ECC. Suppose thatC is an elliptic curve generation group. At the same time, given points P and a⋅P, where P belongs to C and a belongs to Fp, it is computationally infeasible to obtain a. In polynomial time, the probability that A solves this problem is defined as follows: AdvAECDLPξ=PrAP,aP=a:a∈Fp,P∈ξ. For a sufficiently small η, we have AdvAECDLPξ<η.Theorem 1.
IfA attempts to initiate some queries in polynomial time, then the advantage that he can break through the proposed protocol P is as follows: AdvAPξ=qhash2/2lAdvAECDLPξ+2maxC′⋅qsends,qsend/2l+2qsendAdvAECDLPξ+qsend+qexe2/p+qhash2/2l+qsend/2l−1, where qhash represents the number of times to execute Hashstring queries, qsend represents the number of times to execute SendO,M queries, qexe represents the number of times to ExecuteO queries, l represents the number of bits of the operation, and C′ and s are constants in Zipf’s law [52].Proof.
We use the game sequenceGM0,GM1,GM2,GM3,GM4,GM5,GM6 to verify the above theorem. SuccAGMnξ represents the probability of A’s success in game GMn. Finally, using the Test query to determine SuccAGM5ξ, the specific description is as follows:(i)
GameGM0:GM0 represents a real attack, and A did not initiate any query at this time. Therefore, in GM0, the probability of A cracking P is AdvAPξ=2PrSuccAGM0ξ−1.(ii)
GameGM1:GM1 adds Execute query on the basis of GM0, and there is no difference in the others. So, PrSuccAGM1ξ=PrSuccAGM0ξ.(iii)
GameGM2:GM2 adds Send query on the basis of GM1. According to Zipf’s law, we get PrSuccAGM2ξ−PrSuccAGM1ξ≤qsend/2l.(iv)
GameGM3:GM3 adds Hash query on the basis of GM2. According to the birthday paradox, we can get the maximum probability of hash collision as qhash2/2l+1; the maximum probability of collision in the transmitted text is qsend+qexe2/2p; and so PrSuccAGM3ξ−PrSuccAGM2ξ≤qsend+qexe2/2p+qhash2/2l+1.(v)
GameGM4: In this game, we consider the security of the session key. Here, we divide the discussion into two situations. The first is to obtain a long-term private key to verify perfect forward secrecy; the second is to provide temporary information leakage to verify whether the known session-specific temporary information attacks can be resisted.Perfect forward secrecy:A uses CorruptIRSUy to try to get the private key xj of RSUj or uses CorruptIVx or CorruptICsz to try to get a certain secret value in the registration phaseKnown session-specific temporary information attacks:A uses CorruptIVx or CorruptIRSUy or CorruptICsz to try to obtain temporary information of one party
In both cases, ECDLP needs to be solved to compute the session keySK. For SK=hPVIDinewPRIDjai⋅Rj, in the first case, even if Mi and PVIDi are calculated by xj, the random number rj is unknown. While getting ai through CorruptIVx, A cannot get VIDi,PVIDi. In the second case, even if ai⋅Rj is calculated through ai, the long-term private key is unknown. Similarly, for the second formula SK=hPVIDinewPRIDjrj⋅Ni also holds, PrSuccAGM4ξ−PrSuccAGM3ξ≤qsendAdvAECDLPξ.(i)
GameGM5:GM5 uses CorruptIVx to query; A can get the information PVIDi,Authi,HPi,θi in OBU. The user uses the password and biological information to register. A wants to guess +, but the possibility of guessing the biological characteristics is 1/2l, which can be almost ignored. Using Zipf’s law, we can get PrSuccAGM5ξ−PrSuccAGM4ξ≤maxC′qsends,qsend/2l.(ii)
GameGM6: the purpose of this game is to verify forgery attacks. In GM6, if A issues hPVIDinewPRIDjrj⋅Ni or hPVIDinewPRIDjai⋅Rj query, the game is terminated. At this point, the probability of A guessing SK is PrSuccAGM6ξ−PrSuccAGM5ξ≤qhash2/2l+1AdvAECDLPξ. Because the probability of success and unsuccess of GM6 is half, PrSuccAGM6ξ = 1/2.
In summary, we can get the following conclusions:(17)12AdvAPξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤PrSuccAGM6ξ−PrSuccAGM5ξ+PrSuccAGM5ξ−PrSuccAGM4ξ+PrSuccAGM4ξ−PrSuccAGM3ξ+PrSuccAGM3ξ−PrSuccAGM2ξ+PrSuccAGM2ξ−PrSuccAGM1ξ=qhash22l+1AdvAECDLPξ+maxC′qsends,qsend2l+qsendAdvAECDLPξ+qsend+qexe22p+qhash22l+1+qsend2l.
Thus, we can obtain(18)AdvAPξ=qhash22lAdvAECDLPξ+2maxC′⋅qsends,qsend2l+2qsendAdvAECDLPξ+qsend+qexe2p+qsend2l−1.


### 4.3. ProVerif Security Analysis

ProVerif [53] is a formal cryptographic protocol security verification tool proposed by Bruno Blanchet in 2001 and developed using the Prolog language. The tool is based on the DY model and can handle basic cryptographic operations such as symmetric encryption and decryption, public-key encryption and decryption, hash operations, and XOR operations. The security attributes that can be verified are confidentiality, authentication, consistency, and equivalence between processes. Through the use of code to achieve the registration and authentication phases of vehicle users, RSU, and cloud server, a protocol simulation experiment is created in this section. The following is the whole process:(1)
The definition of the channel isch and sch. The former is a common channel used in the login and authentication phases, and the latter is a secure channel used in the registration phase. SKv and SKr are the session keys generated by OBUi and Sj. The subsequent definitions are string concatenation operations, XOR operations, hash functions, and fuzzy extractor functions. Next is to use some queries to verify the security requirements. The entire definition is shown in Figure 6.(2)
The process ofVi is shown in Figure 7.(3)
The process ofRSUj is shown in Figure 8.(4)
The process ofCS is shown in Figure 9.(5)
In Figure10, we show the results of the verification. We use VehicleStarted(), VehicleAuthed(), ServerAcVehicle(), ServerAcRSU(), RSUAcServer(), and VehicleAcRSU() to declare the beginning and the end of the agreement and whether the mutual authentication between the vehicle user, RSU, and CS is correct. The verification result shows that the session key we established has withstood the attack, and the mutual authentication is successful and correct. The protocol proposed in this chapter has passed the security verification of ProVerif.Figure 6
Predefinition code.Figure 7
The process ofVi.Figure 8
The process ofRSUj.Figure 9
The process ofCS.Figure 10
Verification result.


## 4.1. Informal Security Analysis

This section is an informal security analysis of the proposed protocol. We verify the security attributes and attacks that the proposed protocol needs to have one by one.


### 4.1.1. Mutual Authentication

After receiving the authentication request fromRSUj, Vi computes C2=hPVIDiVIDiNiT1 and sends it to CS through RSUj. After CS receives the RSUj message, the computed C2 contains the parameters PVIDi,VIDi. Only legitimate users can generate correct C2, so that CS can verify the identity of the user and the legitimacy of the information by verifying whether C2′ is equal to C2; that is, CS authenticates Vi. Similarly, the server computes C4, RSUj computes C5, and Vi computes C8, respectively, indicating that CS has authenticated RSUj, RSUj has authenticated CS, and Vi has authenticated CS. In summary, Vi and RSUj can perform mutual authentication in the protocol.


### 4.1.2. Man-in-the-Middle Attacks

By intercepting the information in the public channel,A may launch man-in-the-middle attacks. But after CS receives the message, it needs to verify C2?=hPVIDi′VIDiNiT1 and C4?=hPRIDj′RIDjMj′T2 to authenticate the sender. Suppose that when A tries to tamper with the information sent to RSUj, he needs to generate a new authentication information C5, but he cannot obtain the parameters xj, bs, and so forth. This means that A cannot complete the verification after tampering with the information. Similarly, when A tampered with the information sent to Vi and CS, he could not complete the relevant authentication. This shows that the protocol can resist man-in-the-middle attacks.


### 4.1.3. Replay Attacks

In the protocol, when a new round of authentication is performed, new random numbersrj, ai, and bs will be generated; and every time the authentication is completed, the values stored in the memory such as PVIDi and PRIDj will be updated. The random number and the updated PVIDi are used when generating the session key. Therefore, when A resends the previous message, new random numbers and related parameters updated in the memory have been generated, and he cannot pass the verification and cannot compute the session key. Therefore, the proposed protocol can resist replay attacks.


### 4.1.4. Known Session-Specific Temporary Information Attacks

Under the CK attack model [50], A can obtain the random number ai or rj generated during the authentication phase. Assuming that A obtains the random number ai generated by Vi; then Ni, Mi, and PVIDi can be calculated. However, since A cannot obtain VIDi and PRIDj, he still cannot compute the session key SK; and when A tries to use a random number to perform a man-in-the-middle attack or an impersonation attack, he cannot complete the verification by recalculating C2. Therefore, the proposed protocol can resist known session-specific temporary information attacks.


### 4.1.5. Perfect Forward Secrecy

This security feature requires that the leakage of the long-term key does not reveal the previously generated session key.SK=hPVIDinewPRIDjai⋅Rj=hPVIDinewPRIDjrj⋅Ni in the scheme. That is, the long-term key x of CS is not used in the calculation of the session key. Since the private key α of CS does not change after each authentication, it is assumed that A can get α. Then A can compute Mi=α⋅Ni and Mj=α⋅Rj; that is, PVIDi=C1−hMiRjNiT1 and PRIDj=C3−hMjRjT2, and the updated PVIDinew=hPVIDiMi and PRIDjnew=hPRIDjMj. However, A cannot obtain the random number ai or rj needed to compute SK, so there is no way to compute SK; that is, the proposed protocol can provide perfect forward secrecy.


### 4.1.6. Internal Attacks

Assuming thatA is a CS internal staff, he can easily obtain the information transmitted during the registration phase, including VIDi, PVIDi,Kv, RIDj,dj, and PRIDj,yj,zj. However, A cannot compute ai and rj from this information. Therefore, the proposed protocol can resist internal attacks.


### 4.1.7. User Anonymity and Untraceability

During the authentication process,VIDi is used to compute C2 and A cannot obtain PVIDi to guess VIDi. So, the scheme can guarantee anonymity. At the same time, due to the use of random numbers and the update of the pseudoidentity after each authentication, it is also ensured that A cannot confirm the user’s identity by tracing a specific piece of information. Therefore, the protocol satisfies anonymity and untraceability.


### 4.1.8. Three-Factor Secrecy

The proposed protocol uses passwords, biological information, and storage devices (OBU) for security encryption, so it is a three-factor authentication protocol. For this type of protocol, it is assumed that the extreme case is thatA can obtain two of the three factors and can launch an attack on the protocol.Assume thatA obtains VIDi, Pwi, and Bioi. It is necessary to compute Authi when logging in, where Kv=HPi⊕hPwiϕi, but HPi is stored in OBU. In other words, A cannot complete the login operation. The proposed protocol is safe in this situation. Assume that A obtains VIDi, Pwi, and OBU. Since ϕi cannot be computed through Bioi, A cannot compute Kv and Auth and cannot complete login verification. That is, the protocol is safe in this situation. Similarly, when A knows Bioi and OBU, there is no way to compute Authi because there is no password and identity. Therefore, the protocol is safe in the three situations, and the proposed protocol satisfies the three-factor security characteristics.


### 4.1.9. No Key Control

In this protocol, the session keySK can only be generated through negotiation between Vi and RSUj; that is, a single entity cannot generate SK by itself. When computing SK, Vi needs to know PRIDj and Rj generated by RSUj. In the same way, RSUj needs to negotiate to obtain PVIDinew and Ni during the calculation to compute SK. Therefore, the proposed protocol is satisfied with no key control property.


## 4.1.1. Mutual Authentication

After receiving the authentication request fromRSUj, Vi computes C2=hPVIDiVIDiNiT1 and sends it to CS through RSUj. After CS receives the RSUj message, the computed C2 contains the parameters PVIDi,VIDi. Only legitimate users can generate correct C2, so that CS can verify the identity of the user and the legitimacy of the information by verifying whether C2′ is equal to C2; that is, CS authenticates Vi. Similarly, the server computes C4, RSUj computes C5, and Vi computes C8, respectively, indicating that CS has authenticated RSUj, RSUj has authenticated CS, and Vi has authenticated CS. In summary, Vi and RSUj can perform mutual authentication in the protocol.


## 4.1.2. Man-in-the-Middle Attacks

By intercepting the information in the public channel,A may launch man-in-the-middle attacks. But after CS receives the message, it needs to verify C2?=hPVIDi′VIDiNiT1 and C4?=hPRIDj′RIDjMj′T2 to authenticate the sender. Suppose that when A tries to tamper with the information sent to RSUj, he needs to generate a new authentication information C5, but he cannot obtain the parameters xj, bs, and so forth. This means that A cannot complete the verification after tampering with the information. Similarly, when A tampered with the information sent to Vi and CS, he could not complete the relevant authentication. This shows that the protocol can resist man-in-the-middle attacks.


## 4.1.3. Replay Attacks

In the protocol, when a new round of authentication is performed, new random numbersrj, ai, and bs will be generated; and every time the authentication is completed, the values stored in the memory such as PVIDi and PRIDj will be updated. The random number and the updated PVIDi are used when generating the session key. Therefore, when A resends the previous message, new random numbers and related parameters updated in the memory have been generated, and he cannot pass the verification and cannot compute the session key. Therefore, the proposed protocol can resist replay attacks.


## 4.1.4. Known Session-Specific Temporary Information Attacks

Under the CK attack model [50], A can obtain the random number ai or rj generated during the authentication phase. Assuming that A obtains the random number ai generated by Vi; then Ni, Mi, and PVIDi can be calculated. However, since A cannot obtain VIDi and PRIDj, he still cannot compute the session key SK; and when A tries to use a random number to perform a man-in-the-middle attack or an impersonation attack, he cannot complete the verification by recalculating C2. Therefore, the proposed protocol can resist known session-specific temporary information attacks.


## 4.1.5. Perfect Forward Secrecy

This security feature requires that the leakage of the long-term key does not reveal the previously generated session key.SK=hPVIDinewPRIDjai⋅Rj=hPVIDinewPRIDjrj⋅Ni in the scheme. That is, the long-term key x of CS is not used in the calculation of the session key. Since the private key α of CS does not change after each authentication, it is assumed that A can get α. Then A can compute Mi=α⋅Ni and Mj=α⋅Rj; that is, PVIDi=C1−hMiRjNiT1 and PRIDj=C3−hMjRjT2, and the updated PVIDinew=hPVIDiMi and PRIDjnew=hPRIDjMj. However, A cannot obtain the random number ai or rj needed to compute SK, so there is no way to compute SK; that is, the proposed protocol can provide perfect forward secrecy.


## 4.1.6. Internal Attacks

Assuming thatA is a CS internal staff, he can easily obtain the information transmitted during the registration phase, including VIDi, PVIDi,Kv, RIDj,dj, and PRIDj,yj,zj. However, A cannot compute ai and rj from this information. Therefore, the proposed protocol can resist internal attacks.


## 4.1.7. User Anonymity and Untraceability

During the authentication process,VIDi is used to compute C2 and A cannot obtain PVIDi to guess VIDi. So, the scheme can guarantee anonymity. At the same time, due to the use of random numbers and the update of the pseudoidentity after each authentication, it is also ensured that A cannot confirm the user’s identity by tracing a specific piece of information. Therefore, the protocol satisfies anonymity and untraceability.


## 4.1.8. Three-Factor Secrecy

The proposed protocol uses passwords, biological information, and storage devices (OBU) for security encryption, so it is a three-factor authentication protocol. For this type of protocol, it is assumed that the extreme case is thatA can obtain two of the three factors and can launch an attack on the protocol.Assume thatA obtains VIDi, Pwi, and Bioi. It is necessary to compute Authi when logging in, where Kv=HPi⊕hPwiϕi, but HPi is stored in OBU. In other words, A cannot complete the login operation. The proposed protocol is safe in this situation. Assume that A obtains VIDi, Pwi, and OBU. Since ϕi cannot be computed through Bioi, A cannot compute Kv and Auth and cannot complete login verification. That is, the protocol is safe in this situation. Similarly, when A knows Bioi and OBU, there is no way to compute Authi because there is no password and identity. Therefore, the protocol is safe in the three situations, and the proposed protocol satisfies the three-factor security characteristics.


## 4.1.9. No Key Control

In this protocol, the session keySK can only be generated through negotiation between Vi and RSUj; that is, a single entity cannot generate SK by itself. When computing SK, Vi needs to know PRIDj and Rj generated by RSUj. In the same way, RSUj needs to negotiate to obtain PVIDinew and Ni during the calculation to compute SK. Therefore, the proposed protocol is satisfied with no key control property.


## 4.2. Formal Security Analysis Based on Random Oracle Model

In this section, a random oracle model (ROR model) is used to formally prove the security of our proposed protocol. This analysis model was proposed by Canetti et al. [51]. By launching different rounds of Games, the ROR model can compute the probability of A successfully guessing the SK in various situations and thus judge the security of the protocol. Assume that IVx, IRSUy, and ICSz, respectively, represent the xth communication of Vi, the yth communication of RSUj, and the zth communication of CS. A can initiate the following query, where O=IVx,IRSUy,ICSz.(i)
ExecuteO: through this query, A can eavesdrop on the message transmitted on the public channel.(ii)
Hashstring: A executes the query and can get the hash value of the input parameter string.(iii)
SendO,M: A executes the query, sends a message M to O, and can receive the corresponding response.(iv)
RevealO: A executes this query to obtain the return result of current session key SK generated by M.(v)
CorruptO: by executing the query, A can obtain some secret values, such as long-term private keys and temporary information.(vi)
TestO: A executes the query and judges the correctness of the session key by flipping coin C. If the result is C=1, A will receive the correct session key returned; if the result is C=0, A will receive a random string.Definition 1.
(elliptic curve discrete logarithm problem (ECDLP)). Our proposed protocol uses elliptic curve cryptography (ECC). Here, we describe the computational difficulties and assumptions of ECC. Suppose thatC is an elliptic curve generation group. At the same time, given points P and a⋅P, where P belongs to C and a belongs to Fp, it is computationally infeasible to obtain a. In polynomial time, the probability that A solves this problem is defined as follows: AdvAECDLPξ=PrAP,aP=a:a∈Fp,P∈ξ. For a sufficiently small η, we have AdvAECDLPξ<η.Theorem 1.
IfA attempts to initiate some queries in polynomial time, then the advantage that he can break through the proposed protocol P is as follows: AdvAPξ=qhash2/2lAdvAECDLPξ+2maxC′⋅qsends,qsend/2l+2qsendAdvAECDLPξ+qsend+qexe2/p+qhash2/2l+qsend/2l−1, where qhash represents the number of times to execute Hashstring queries, qsend represents the number of times to execute SendO,M queries, qexe represents the number of times to ExecuteO queries, l represents the number of bits of the operation, and C′ and s are constants in Zipf’s law [52].Proof.
We use the game sequenceGM0,GM1,GM2,GM3,GM4,GM5,GM6 to verify the above theorem. SuccAGMnξ represents the probability of A’s success in game GMn. Finally, using the Test query to determine SuccAGM5ξ, the specific description is as follows:(i)
GameGM0:GM0 represents a real attack, and A did not initiate any query at this time. Therefore, in GM0, the probability of A cracking P is AdvAPξ=2PrSuccAGM0ξ−1.(ii)
GameGM1:GM1 adds Execute query on the basis of GM0, and there is no difference in the others. So, PrSuccAGM1ξ=PrSuccAGM0ξ.(iii)
GameGM2:GM2 adds Send query on the basis of GM1. According to Zipf’s law, we get PrSuccAGM2ξ−PrSuccAGM1ξ≤qsend/2l.(iv)
GameGM3:GM3 adds Hash query on the basis of GM2. According to the birthday paradox, we can get the maximum probability of hash collision as qhash2/2l+1; the maximum probability of collision in the transmitted text is qsend+qexe2/2p; and so PrSuccAGM3ξ−PrSuccAGM2ξ≤qsend+qexe2/2p+qhash2/2l+1.(v)
GameGM4: In this game, we consider the security of the session key. Here, we divide the discussion into two situations. The first is to obtain a long-term private key to verify perfect forward secrecy; the second is to provide temporary information leakage to verify whether the known session-specific temporary information attacks can be resisted.Perfect forward secrecy:A uses CorruptIRSUy to try to get the private key xj of RSUj or uses CorruptIVx or CorruptICsz to try to get a certain secret value in the registration phaseKnown session-specific temporary information attacks:A uses CorruptIVx or CorruptIRSUy or CorruptICsz to try to obtain temporary information of one party
In both cases, ECDLP needs to be solved to compute the session keySK. For SK=hPVIDinewPRIDjai⋅Rj, in the first case, even if Mi and PVIDi are calculated by xj, the random number rj is unknown. While getting ai through CorruptIVx, A cannot get VIDi,PVIDi. In the second case, even if ai⋅Rj is calculated through ai, the long-term private key is unknown. Similarly, for the second formula SK=hPVIDinewPRIDjrj⋅Ni also holds, PrSuccAGM4ξ−PrSuccAGM3ξ≤qsendAdvAECDLPξ.(i)
GameGM5:GM5 uses CorruptIVx to query; A can get the information PVIDi,Authi,HPi,θi in OBU. The user uses the password and biological information to register. A wants to guess +, but the possibility of guessing the biological characteristics is 1/2l, which can be almost ignored. Using Zipf’s law, we can get PrSuccAGM5ξ−PrSuccAGM4ξ≤maxC′qsends,qsend/2l.(ii)
GameGM6: the purpose of this game is to verify forgery attacks. In GM6, if A issues hPVIDinewPRIDjrj⋅Ni or hPVIDinewPRIDjai⋅Rj query, the game is terminated. At this point, the probability of A guessing SK is PrSuccAGM6ξ−PrSuccAGM5ξ≤qhash2/2l+1AdvAECDLPξ. Because the probability of success and unsuccess of GM6 is half, PrSuccAGM6ξ = 1/2.
In summary, we can get the following conclusions:(17)12AdvAPξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤PrSuccAGM6ξ−PrSuccAGM5ξ+PrSuccAGM5ξ−PrSuccAGM4ξ+PrSuccAGM4ξ−PrSuccAGM3ξ+PrSuccAGM3ξ−PrSuccAGM2ξ+PrSuccAGM2ξ−PrSuccAGM1ξ=qhash22l+1AdvAECDLPξ+maxC′qsends,qsend2l+qsendAdvAECDLPξ+qsend+qexe22p+qhash22l+1+qsend2l.
Thus, we can obtain(18)AdvAPξ=qhash22lAdvAECDLPξ+2maxC′⋅qsends,qsend2l+2qsendAdvAECDLPξ+qsend+qexe2p+qsend2l−1.


## 4.3. ProVerif Security Analysis

ProVerif [53] is a formal cryptographic protocol security verification tool proposed by Bruno Blanchet in 2001 and developed using the Prolog language. The tool is based on the DY model and can handle basic cryptographic operations such as symmetric encryption and decryption, public-key encryption and decryption, hash operations, and XOR operations. The security attributes that can be verified are confidentiality, authentication, consistency, and equivalence between processes. Through the use of code to achieve the registration and authentication phases of vehicle users, RSU, and cloud server, a protocol simulation experiment is created in this section. The following is the whole process:(1)
The definition of the channel isch and sch. The former is a common channel used in the login and authentication phases, and the latter is a secure channel used in the registration phase. SKv and SKr are the session keys generated by OBUi and Sj. The subsequent definitions are string concatenation operations, XOR operations, hash functions, and fuzzy extractor functions. Next is to use some queries to verify the security requirements. The entire definition is shown in Figure 6.(2)
The process ofVi is shown in Figure 7.(3)
The process ofRSUj is shown in Figure 8.(4)
The process ofCS is shown in Figure 9.(5)
In Figure10, we show the results of the verification. We use VehicleStarted(), VehicleAuthed(), ServerAcVehicle(), ServerAcRSU(), RSUAcServer(), and VehicleAcRSU() to declare the beginning and the end of the agreement and whether the mutual authentication between the vehicle user, RSU, and CS is correct. The verification result shows that the session key we established has withstood the attack, and the mutual authentication is successful and correct. The protocol proposed in this chapter has passed the security verification of ProVerif.Figure 6
Predefinition code.Figure 7
The process ofVi.Figure 8
The process ofRSUj.Figure 9
The process ofCS.Figure 10
Verification result.


## 5. Security and Performance Comparisons

This section will analyze the performance of the proposed protocol and verify the performance of the protocol by comparing its security, computing consumption, and communication consumption among similar protocols.


### 5.1. Security Comparisons

In this section, we compare the security of the proposed protocol with Ma et al.’s scheme [30], Jia et al.’s scheme [31], Eftekhari et al.’s scheme [38], and Liu et al.’s scheme [54]. The details are shown in Table 2. According to the informal security analysis above, it can be seen that the current common network attacks mainly include A1: mutual authentication; A2: man-in-the-middle attacks, A3: replay attacks, A4: known session-specific temporary information attacks, A5: perfect forward secrecy, A6: internal attacks, A7: user anonymity, A8: three-factor secrecy, A9: no key control, and A10: impersonation attacks. Yes means that it can resist this attack or has this security feature.Table 2
Security comparison.
Attack methodsLiu et al.Ma et al.Jia et al.Eftekhari et al.Our schemeA1YesYesNoYesYesA2YesYes——YesA3—YesYesYesYesA4NoNoNoYesYesA5NoYesYesYesYesA6NoNoYesYesYesA7NoNoYesYesYesA8—NoYes—YesA9YesYesYesYesYesA10YesYesYesYesYes


### 5.2. Performance Comparisons

In the performance analysis of the AKE protocol, the computation cost is an important part to be considered. In the VANETs environment, due to the mobility of vehicles, the required computational time needs to be less, which reduces the time required for key establishment and makes the proposed protocol more practical. The experimental environment we used here is shown in Table3 to test the time-consuming performance of different encryption and decryption algorithms. The algorithm was run 30 times on the device to find the average value. The results are shown in Table 4. We found that the time of the fuzzy extraction function is similar to that of the hash function during the experiment, so we use the fuzzy extraction function as a hash function.Table 3
Experimental environment.
DenominationDescriptionHardware equipmentLaptopProcessorAMD Ryzen 5 4600HRunning memory16 GBSystemWindows 10SoftwareIntelliJ IDEA 2019.3Cryptography libraryJPBC-2.0.0Table 4
The computational cost of complex operations.
OperationDefinitionExecution time (ms)TpmElliptic curve scalar point multiplication8.8TpaElliptic curve scalar point addition0.057ThHash function0.0058TbpBilinear pairing11.43Th2pString to point hash operation26.1TseSymmetric encryption18.37Compared with other phases, in order to ensure the security of the session key, the authentication phase will be executed multiple times, so the calculation cost in this section only considers the calculation performed in the authentication phase. The comparison is shown in Table5. Substitute the execution data in Table 4 to get the computation cost histogram in Figure 11.Table 5
Computation cost comparison.
SchemeViRSUjCSTotalLiu et al.Tpm+2Th2p+Tbp+TseTpm+2Th2p+Tbp+2TseTpm+2Th2p+Tse3Tpm+6Th2p+2Tbp+4TseJia et al.2Tpm+5Th+Tbp2Tpm+4Th+Tbp3Tpm+11Th+Tbp7Tpm+21Th+3TbpMa et al.3Tpm+3Th4Tpm+3Th6Tpm+9Th13Tm+15TsEftekhari et al.3Tpm+13Th+Tpa2Tpm+15Th+Tpa3Tpm+17Th+2Tpa8Tpm+45Th+4TpaOurs2Tpm+5Th3Tpm+5Th4Tpm+8Th9Tpm+18ThFigure 11
Computation cost histogram.Next, we analyze the communication consumption of the proposed protocol and compare it with related protocols. We use the number of bits specified in [11]. For example, the point of the ECC is 320 bits, the hash function is set to 256 bits, the length of the identity information is 64 bits, and the length of the random number and timestamp is 32 bits.The protocol we propose has four transmission rounds in the authentication phase, and the transmitted information is {Rj,Ni,C1,C2,T1,Rj,C3,C4,T2,C5,C6C7,Ns,T3,C8,T4}. It contains 4 ECC points, 8 hash function outputs, and 4 timestamps’ information. That is, a total of 3456 bits of information are transmitted.The protocol of Liu et al. transmits 4 rounds, and the transmitted information isAIDi,Ai,TSi,riP,ppub, C,AIDi,AIDj,MAC,TSr,Pr, and AIDm,TDm,Exmqrmrt,TSt,σ,Mm, including 3 hash outputs, 4 identification information, 4 timestamps’ information, 3 ECC points, and 3 symmetric encryptions’ information (calculated according to 128 bits). Therefore, a total of 2496 bits of information are transmitted.The protocol of Jia et al. transmits 4 rounds, and the transmitted information isA,PIDi,Ni,Tu, A,B,PIDi,PIDj,Ni,Lj,Tu,Tf, C,Authi,Authj,Tc, and B,C,Authi,Tc. It includes 6 ECC points, 9 hash function outputs, and 5 timestamps’ information. Therefore, a total of 4384 bits of information are transmitted.The protocol of Ma et al. transmits 4 rounds, and the transmitted information is {AIDUi,TUi,R1,α,AIDFNj,TFNi,R2,R2′,β,R3,R3′,R3″,TCS,γ,γ′,R2}. It contains 7 ECC points, 3 hash function outputs, and 4 timestamps’ information. A total of 3904 bits of information are transmitted.The protocol of Eftekhari et al. transmits 4 rounds, and the transmitted information isRidDR,XVE,yVE,hVECS,T, RIdFS,RIdDR,XFS,yVE,hFSCS,T, mRIdCSDRnew,mRIdCSFSnew,XCS,hCSFS,hCSFS, and mRIdCSDRnew,XFS,XCS,T. It contains 6 ECC points, 14 hash function outputs, and 2 timestamps’ information. A total of 5568 bits of information are transmitted. The comparison of communication consumption is shown in Table 6. In order to see the comparison effect more clearly, we have generated Figure 12.Table 6
Comparison of communication and massage rounds.
SchemeCommunication cost (bits)Massage roundsLiu et al.24964Jia et al.43844Ma et al.39044Eftekhari et al.55684Our scheme34564Figure 12
Comparison of communication cost.Combined with Tables2, 5, and 6, we discussed the results of the performance analysis. The protocol of Eftekhari et al. has no obvious security vulnerabilities, and the computation cost is similar to that of the protocol we proposed; the main computation cost gap is on the server side. Because the server has strong computing power, it has little effect on the overall computation cost; and, from Table 6 we can see that the communication cost of Eftekhari et al.’s protocol is much higher than that of the proposed protocol. Also, the proposed protocol is similar to Jia et al.’s protocol in terms of computation cost, but Jia et al.’s protocol has security vulnerabilities. The communication cost of all the schemes participating in the comparison is slightly higher than that of the protocol of Liu et al. It can be seen from Figure 11 that the computation cost of the protocol of Liu et al. is the highest, and the security performance is very poor. The computation cost and communication cost of Ma et al.’s protocol are relatively average, but both are slightly higher than those of our proposed protocol, and their protocol is vulnerable to known session-specific temporary information attacks and internal attacks and cannot guarantee user anonymity. In general, it is more reasonable for the proposed protocol to combine security, computation cost, and communication cost analysis.


## 5.1. Security Comparisons

In this section, we compare the security of the proposed protocol with Ma et al.’s scheme [30], Jia et al.’s scheme [31], Eftekhari et al.’s scheme [38], and Liu et al.’s scheme [54]. The details are shown in Table 2. According to the informal security analysis above, it can be seen that the current common network attacks mainly include A1: mutual authentication; A2: man-in-the-middle attacks, A3: replay attacks, A4: known session-specific temporary information attacks, A5: perfect forward secrecy, A6: internal attacks, A7: user anonymity, A8: three-factor secrecy, A9: no key control, and A10: impersonation attacks. Yes means that it can resist this attack or has this security feature.Table 2
Security comparison.
Attack methodsLiu et al.Ma et al.Jia et al.Eftekhari et al.Our schemeA1YesYesNoYesYesA2YesYes——YesA3—YesYesYesYesA4NoNoNoYesYesA5NoYesYesYesYesA6NoNoYesYesYesA7NoNoYesYesYesA8—NoYes—YesA9YesYesYesYesYesA10YesYesYesYesYes


## 5.2. Performance Comparisons

In the performance analysis of the AKE protocol, the computation cost is an important part to be considered. In the VANETs environment, due to the mobility of vehicles, the required computational time needs to be less, which reduces the time required for key establishment and makes the proposed protocol more practical. The experimental environment we used here is shown in Table3 to test the time-consuming performance of different encryption and decryption algorithms. The algorithm was run 30 times on the device to find the average value. The results are shown in Table 4. We found that the time of the fuzzy extraction function is similar to that of the hash function during the experiment, so we use the fuzzy extraction function as a hash function.Table 3
Experimental environment.
DenominationDescriptionHardware equipmentLaptopProcessorAMD Ryzen 5 4600HRunning memory16 GBSystemWindows 10SoftwareIntelliJ IDEA 2019.3Cryptography libraryJPBC-2.0.0Table 4
The computational cost of complex operations.
OperationDefinitionExecution time (ms)TpmElliptic curve scalar point multiplication8.8TpaElliptic curve scalar point addition0.057ThHash function0.0058TbpBilinear pairing11.43Th2pString to point hash operation26.1TseSymmetric encryption18.37Compared with other phases, in order to ensure the security of the session key, the authentication phase will be executed multiple times, so the calculation cost in this section only considers the calculation performed in the authentication phase. The comparison is shown in Table5. Substitute the execution data in Table 4 to get the computation cost histogram in Figure 11.Table 5
Computation cost comparison.
SchemeViRSUjCSTotalLiu et al.Tpm+2Th2p+Tbp+TseTpm+2Th2p+Tbp+2TseTpm+2Th2p+Tse3Tpm+6Th2p+2Tbp+4TseJia et al.2Tpm+5Th+Tbp2Tpm+4Th+Tbp3Tpm+11Th+Tbp7Tpm+21Th+3TbpMa et al.3Tpm+3Th4Tpm+3Th6Tpm+9Th13Tm+15TsEftekhari et al.3Tpm+13Th+Tpa2Tpm+15Th+Tpa3Tpm+17Th+2Tpa8Tpm+45Th+4TpaOurs2Tpm+5Th3Tpm+5Th4Tpm+8Th9Tpm+18ThFigure 11
Computation cost histogram.Next, we analyze the communication consumption of the proposed protocol and compare it with related protocols. We use the number of bits specified in [11]. For example, the point of the ECC is 320 bits, the hash function is set to 256 bits, the length of the identity information is 64 bits, and the length of the random number and timestamp is 32 bits.The protocol we propose has four transmission rounds in the authentication phase, and the transmitted information is {Rj,Ni,C1,C2,T1,Rj,C3,C4,T2,C5,C6C7,Ns,T3,C8,T4}. It contains 4 ECC points, 8 hash function outputs, and 4 timestamps’ information. That is, a total of 3456 bits of information are transmitted.The protocol of Liu et al. transmits 4 rounds, and the transmitted information isAIDi,Ai,TSi,riP,ppub, C,AIDi,AIDj,MAC,TSr,Pr, and AIDm,TDm,Exmqrmrt,TSt,σ,Mm, including 3 hash outputs, 4 identification information, 4 timestamps’ information, 3 ECC points, and 3 symmetric encryptions’ information (calculated according to 128 bits). Therefore, a total of 2496 bits of information are transmitted.The protocol of Jia et al. transmits 4 rounds, and the transmitted information isA,PIDi,Ni,Tu, A,B,PIDi,PIDj,Ni,Lj,Tu,Tf, C,Authi,Authj,Tc, and B,C,Authi,Tc. It includes 6 ECC points, 9 hash function outputs, and 5 timestamps’ information. Therefore, a total of 4384 bits of information are transmitted.The protocol of Ma et al. transmits 4 rounds, and the transmitted information is {AIDUi,TUi,R1,α,AIDFNj,TFNi,R2,R2′,β,R3,R3′,R3″,TCS,γ,γ′,R2}. It contains 7 ECC points, 3 hash function outputs, and 4 timestamps’ information. A total of 3904 bits of information are transmitted.The protocol of Eftekhari et al. transmits 4 rounds, and the transmitted information isRidDR,XVE,yVE,hVECS,T, RIdFS,RIdDR,XFS,yVE,hFSCS,T, mRIdCSDRnew,mRIdCSFSnew,XCS,hCSFS,hCSFS, and mRIdCSDRnew,XFS,XCS,T. It contains 6 ECC points, 14 hash function outputs, and 2 timestamps’ information. A total of 5568 bits of information are transmitted. The comparison of communication consumption is shown in Table 6. In order to see the comparison effect more clearly, we have generated Figure 12.Table 6
Comparison of communication and massage rounds.
SchemeCommunication cost (bits)Massage roundsLiu et al.24964Jia et al.43844Ma et al.39044Eftekhari et al.55684Our scheme34564Figure 12
Comparison of communication cost.Combined with Tables2, 5, and 6, we discussed the results of the performance analysis. The protocol of Eftekhari et al. has no obvious security vulnerabilities, and the computation cost is similar to that of the protocol we proposed; the main computation cost gap is on the server side. Because the server has strong computing power, it has little effect on the overall computation cost; and, from Table 6 we can see that the communication cost of Eftekhari et al.’s protocol is much higher than that of the proposed protocol. Also, the proposed protocol is similar to Jia et al.’s protocol in terms of computation cost, but Jia et al.’s protocol has security vulnerabilities. The communication cost of all the schemes participating in the comparison is slightly higher than that of the protocol of Liu et al. It can be seen from Figure 11 that the computation cost of the protocol of Liu et al. is the highest, and the security performance is very poor. The computation cost and communication cost of Ma et al.’s protocol are relatively average, but both are slightly higher than those of our proposed protocol, and their protocol is vulnerable to known session-specific temporary information attacks and internal attacks and cannot guarantee user anonymity. In general, it is more reasonable for the proposed protocol to combine security, computation cost, and communication cost analysis.


## 6. Conclusion

Based on ECC, this paper designs a new provably safe AKE scheme before transmitting road condition information. We first reviewed the research status of AKE protocol in the VANET environment and found that it is necessary to propose a scheme to protect vehicle data in the information reading phase. We conducted an informal security analysis of the proposed protocol from mutual authentication, anonymity, perfect forward secrecy, man-in-the-middle attacks, internal attacks, and so forth and passed strict formal security analyses, such as the ROR model and ProVerif security verification tools, indicating that the proposed protocol is secure. Through the comparison of security and performance, the proposed protocol is secure, more effective, and more reasonable than the existing protocol. The application of authentication and key exchange in the VANETs environment is the general trend of the development of the VANETs. With the continuous development of the VANETs, subsequent application scenarios are also diverse, such as social Internet of Vehicles, which involve more user privacy information, and this topic will have great research value and research space in the future. Therefore, the communication security of the VANETs environment must also be a key research topic for scholars.



---

*Source: 9944460-2021-06-29.xml*