Lightweight identity authentication and key agreement scheme for VANETs based on SSL-PUF

Abstract

With the rapid development of smart cities and intelligent vehicles, the communication scale in Vehicular Ad-Hoc Networks (VANETs) is expanding significantly. Simultaneously, due to the low latency, and security requirements of the Internet of Vehicles (IoV), there is an increased demand for the performance of vehicle access authentication and key agreement protocols. Traditional identity authentication and key agreement protocols less frequently consider the impact of efficiency, and they use complex computations, which result in increased communication costs and reduced efficiency. As a result, these protocols are no longer suitable for resource-constrained VANETs applications. The Semiconductor Superlattice Physically Unclonable Function (SSL-PUF) which belongs to strong PUF has attracted significant attention from scholars worldwide and prompting extensive research into the applications of cryptography. This paper proposes a lightweight identity authentication and a group key agreement scheme based on SSL-PUF for vehicle–road coordination, providing information-theoretical security proofs. Finally, performance comparisons, considering communication load and computational costs, demonstrate that the proposed scheme offers significant advantages in both security and lightweight characteristics, and holds considerable significance for the security requirements in vehicle–road coordination scenarios.

Introduction

With the vigorous development of network technology, the Internet of Things has gradually entered various industries, and concepts such as smart cities, smart transportation, smart homes, and smart healthcare have emerged^1,2. Among them, the intelligent transportation system utilizes advanced information technology, sensor technology, network communication technology, electronic control technology, etc., and is comprehensively applied to the traffic management system, which can effectively improve the safety of the transportation system, reduce the incidence of accidents, and achieve efficient management of urban traffic^3,4. As an important component of intelligent transportation systems, VANETs are mainly composed of three components: Trusted Authority (TA), Roadside Unit (RSU), and Onboard Unit (OBU)^5,6.

In the application scenario of vehicle–road collaboration, VANETs have forever changed the intelligent transportation system through the connection of V2X (Vehicle to Everything). Traffic safety, congestion and road connections depend on the ability of the car to interact with each other and its surroundings. V2X communication has many benefits⁷. However, since VANETs are exposed to open networks, it is possible to receive various internal and external cyber-attacks at any time¹⁰, and users are very vulnerable to message modification, tampering, counterfeiting, signature forgery and side channel attacks⁸. In addition, VANETs are characterized by rapid changes in the network topology graph. Therefore, how to ensure the security of vehicle networking system communication in a complex and high-speed changing vehicle networking environment will become the primary problem to be solved in the future development of smart transportation^11,12.

To enhance the security of VANETs, researchers have integrated identity authentication technology into these networks. This approach safeguards the privacy and security of both communicating parties through the implementation of the Authentication Key Agreement (AKA) protocol¹³. The AKA protocols enable communication parties to authenticate each other’s identities, simultaneously generating session keys and constructing secure encrypted channels, which can ensure the privacy and security of information during vehicle operation. However traditional AKA protocols are mainly divided into schemes based on Public Key Infrastructure (PKI) or Identity Based Cryptography (IBC), among which the most widely used is PKI based authentication protocol¹⁴.

However, identity authentication schemes that utilize Public Key Infrastructure (PKI) mechanisms often depend on certificate management authorities for the distribution and administration of digital certificates. This reliance introduces complex management challenges, escalates resource expenditures, and results in diminished efficiency during key agreement processes. Identity authentication schemes based on IBC often require multiple bilinear pairing operations and communication interactions at each authentication terminal, which can result in longer delays in the authentication key agreement process¹⁵. Due to the characteristics of low latency, heterogeneity, and limited resources of the Internet of Vehicles (IoV)^16,17, and vehicles have the demand for high-speed mobility and periodic broadcasting of safety messages in the IoV, therefore, higher requirements have been put forward for the communication, computing, and storage costs of vehicle identity authentication¹⁸. The above solutions have the problem of not being able to balance efficiency and security. Vehicles are vulnerable to various security threats, including replay attacks, identity forgery attacks, etc. How to achieve secure key agreement in resource-constrained IoV devices has become an urgent problem.

The emergence of physical unclonable function (PUF)^19,20 can effectively solve the problem that efficiency and security cannot be considered. SSL-PUF is a typical time domain strong PUF, and its CRP number expands exponentially with the increase of the length of the challenge. Even if an attacker masters many CRPs, it is impossible to predict the response signal corresponding to unknown challenge signals, and the interface of its challenge response is not limited (i.e., the attacker can access the PUF at any time when the user is not using it). At present, SSL-PUF has been widely accepted as a basic security primitive and is mainly used in random number generators and identity authentication⁹. Superlattice has the characteristics of unclonability, stability, uniqueness and unpredictability. Unclonability is the fundamental guarantee for the PUF to realize security¹⁹. Using physical entities as unique authentication and identification is the most basic application method of PUF, which is exactly the same as the idea of authenticating based on human biometrics (fingerprints and iris, etc.). SSL-PUF is lightweight and high security, does not require additional resources and only runs when needed. It not only provides physical security, but also can operate conveniently and efficiently in resource-constrained devices, bringing new solutions to key generation and key storage problems. As a representative time-domain strong PUF, its CRP space expands exponentially with increasing challenge length. This exponential growth ensures computational infeasibility of predicting responses to unknown challenges, even when attackers possess numerous CRP samples. Currently recognized as a fundamental security primitive, SSL-PUF has gained widespread acceptance, particularly in random number generation and identity authentication applications.

Additionally, our main contributions are as follows:

• 1. SSL-PUF is introduced to implement authentication and key agreement scheme in VANETs, which is a strong PUF and does not need to store keys. The proposed scheme achieves approximately 75% reduction in communication latency. while providing information-theoretical security.

• 2. We propose an SSL-PUF-based identity authentication scheme for OBUs. By combining the inherent uniqueness of SSL-PUF with fuzzy extractor, this scheme enables the Trusted Authority (TA) to perform both unique identification and trusted authentication without requiring pre-shared keys.

• 3. We propose a key agreement scheme based on SSL-PUF. The proposed scheme enables information-theoretically secure key agreement among multiple OBU terminals integrated with SSL-PUFs, mediated by the TA. By disclosing only helper data and initial challenge over public channels, the solution is particularly suitable for VANETs scenarios that are highly sensitive to latency and communication overhead.

Related work

Research on identity authentication in IoV

In response to security requirements, many scholars have conducted research on privacy protection and identity authentication issues in the IoV and proposed many privacy protection identity authentication schemes. In 2005, Raya et al.²¹ proposed an anonymous certificate authentication scheme based on a public key infrastructure system. However, this scheme requires a large number of public and private key pairs and digital certificates to be preloaded on the vehicle nodes, resulting in significant storage overhead. In 2007, Calandriello et al.²² proposed to minimize the number of pseudonymous signatures while ensuring security, and reducing the storage overhead of digital certificates. However, this scheme lacks traceability and cannot resist replay attacks. To compensate for the shortcomings of PKI authentication schemes, Zhang et al.²³ constructed an identity based conditional privacy protection scheme that reduces storage and communication overhead. However, this scheme has a key custody issue. Once the master key of the trusted institution is leaked, it will threaten the communication security between the RSU and the vehicle. Zhang et al.²⁴ proposed a novel privacy protection authentication scheme for VANETs. Subsequently, Lee and Lai²⁵ claim that this scheme²⁴ is not efficient in resisting replay attacks and denial of service attacks. In addition, they proposed a key agreement scheme using bilinear pairing to provide more effective security features. However, Bayat et al.²⁶ pointed out that scheme²⁵ is susceptible to impersonation attacks. Bayat et al.²⁶ designed an improved key agreement scheme. This scheme performs computationally complex bilinear pairing operations during authentication, while also introducing key custody issues. Luo et al.⁵². proposed an efficient blockchain-assisted cross-domain authentication mechanism for bandwidth-constrained wide-area IoT scenarios. This scheme significantly improved the efficiency and scalability of cross-domain authentication by building a multi-chain parallel blockchain architecture and designing a lightweight consensus algorithm. Although the consensus communication volume has been optimized, the design of multi-round message interaction may still increase the complexity of the system when the node scale is expanded, which is not conducive to the deployment and maintenance of large-scale heterogeneous devices. Lin et al.⁵³. proposed a blockchain-assisted certificateless key negotiation protocol for the Internet of Vehicles scenario in intelligent transportation systems. The protocol combines blockchain technology with certificateless public key cryptography, ensuring secure communication while avoiding key escrow and certificate management issues in traditional PKI. However, these protocols involve a lot of elliptic curve cryptographic operations, which, although relatively efficient, still imposes a computational burden on resource-constrained onboard devices. Cui et al.⁴⁶. proposed an efficient message authentication scheme for VANETs based on edge computing. This scheme introduces a collaborative verification mechanism utilizing edge nodes and employs elliptic curve cryptography to replace bilinear pairing operations, significantly improving message processing efficiency in high-density traffic scenarios. However, the scheme relies on centralized management of temporary keys by edge nodes, which may introduce single-point failure risks. Additionally, it does not address the load balancing issue of edge nodes in dynamic network topologies. Zhong et al.⁴⁷. presented an identity-based broadcast encryption scheme tailored for key distribution in VANETs. By enabling single-time encryption to generate fixed-length ciphertexts for multiple vehicles, the scheme effectively reduces information redundancy. Nevertheless, the number of pairing operations in its encryption and decryption phases grows linearly with the group size, leading to a sharp increase in computational overhead during group expansion. This makes it challenging to meet the efficiency requirements of resource-constrained vehicles. Hong Zhong et al.⁴⁸ addressed the efficiency bottleneck of the TA in V2I communications within VANETs by proposing an optimized broadcast encryption scheme. The framework leverages bilinear pairing and hash functions to enable the TA to broadcast encrypted messages to multiple vehicles in a single operation. However, the computational burden of bilinear pairing operations remains significant.

All the aforementioned schemes exhibit the drawbacks of high computational costs; in contrast, our proposed scheme offers significant advantages in this regard. Our approach is lightweight than public key-based schemes and provides enhanced security compared to symmetric key-based methods, which require prior key establishment.

Research on identity authentication based on PUF

PUF is a physical cryptographic technique based on the intrinsic mechanisms of physical devices, with a mature research system. It introduces physical entities into the perspective of cryptographic applications for research and has formed a relatively mature theoretical research system for physical cryptography.

In 2012, Maes et al.²⁷ first proposed a protocol for key generation and storage using PUF. NXP Corporation uses SRAM PUF to store keys in smart card products, but weak PUFs have been reported to pose significant security threats²⁸. Brzuska et al.²⁹ were the first to consider PUF based key distribution protocols, but they only considered a key agreement between servers and devices, assuming a strong PUF model. Beckmann et al.³⁰ proposed a decentralized key exchange protocol based on public PUF (PPUF), but it requires exchanging a large amount of data and has a high computational cost, making it difficult to apply in resource constrained scenarios.

Zhang Zheng et al.³¹ proposed using PUF to replace the vulnerability of private keys and passwords in the Kerberos protocol, but this scheme only focuses on authentication and does not provide a corresponding key exchange protocol. Aman et al.³² implemented session key exchange for IoT terminal nodes equipped with PUFs through a trusted third-party server. This protocol increased the time for message exchange in exchange for zero storage of the terminal, resulting in multiple rounds of mutual authentication required for the complete protocol operation. Chuang et al.³³first proposed a PUF based authentication key exchange protocol in the context of the Internet of Things, and proved its security in the random oracle model. However, the CDH problem resulted in high computational resource consumption. Pehl et al.³⁴ proposed a key distribution protocol for terminal questioning based on Multi PUF, but did not provide a specific PUF model and detailed security analysis. In reference³⁵, PUF was combined with PKC on elliptic curves, and the private key was recovered with the help of PUF to achieve authentication and key exchange between nodes. However, completing this protocol requires 16 rounds of elliptic curve point multiplication, and the computational cost of the protocol is difficult to accept in lightweight devices. In reference³⁶, Zheng et al. proposed a PUF based terminal key exchange protocol, but only for point-to-point scenarios. In 2024, Bhattarai et al.⁵⁵. introduced a lightweight, anonymous, application-aware authentication and key agreement protocol for the Internet of Drones. The scheme simplifies computational processes using PUF, XOR operations, and hash functions, thereby reducing computational overhead. However, it lacks formal security proofs.

After inputting a challenge Ci into PUF, a stable response Ri can be obtained. The combination of challenges and responses (Ci, Ri) is called challenge-response pairs (CRP). According to the different quantities of CRP, different types of PUFs are classified into strong PUFs and weak PUFs. Strong PUFs have an exponentially complex one-way function input–output relationship, supporting enough of CRPs which grow exponentially with the size, while weak PUFs only provide a limited number of CRPs.

SSL-PUF is a typical time-domain strong PUF³⁷. From the perspective of material structure and physical mechanism, the key space of semiconductor SSL-PUF can reach 2^4500×50, with a huge number of challenge-response pairs, which can be used for typical cryptographic applications such as key generation³⁸. At present, SSL-PUFs have been widely accepted as basic security primitives, mainly used in random number generators, identity authentication, peer-to-peer key distribution technology, etc.^39,40. However, in the diversified communication network scenario, peer-to-peer key distribution can no longer meet the high concurrency interaction needs.

Chen et al.⁴¹ proposed to incorporate the physical function characteristics discovered in superlattice devices into the research under the framework of PUF cryptography theory. Wu Han^42,43 introduced the theoretical framework of PUF to analyze the inherent security mechanism and cryptographic application modes of superlattice devices, and proposed the physical mechanism analysis model, cryptographic characteristic detection and evaluation method for superlattice devices, which lays the theoretical foundation. Xu Liwei³⁸ proposed a set of access authentication and key distribution schemes based on universal SSL-PUF devices and twin devices for the application scenarios of the Space-Air-Ground Integrated Network (SAGIN).

PUF based identity authentication uses pre-shared CRP between the device and server to achieve identity authentication and key agreement. The server has restored a large amount of CRP. During the authentication process, the same challenge data is input to the PUF device and server, and the server uses the challenge data as an index to retrieve the corresponding response data. The PUF will generate response data that is consistent with the server-side, and the two will be compared to achieve identity authentication. A strong PUF which response data can be used as a key or derived to generate a completely consistent key for key agreement. CRPs need to be securely stored on the server to ensure that only the server can access them. Only by obtaining the physical device can the corresponding data be obtained. Security is based on the physical device, and the unclonability and unpredictability of PUF ensure that attackers cannot forge or guess to obtain key data.

The only difference is that the superlattices are analog devices, and the response signal obtained from the same challenge signal will have slight differences each time. Therefore, it is necessary to use fuzzy extraction techniques to eliminate differences in the superlattice response data and ensure the uniqueness of the output response data. Fuzzy extractor (FE) was proposed by Dodis et al. in 2004. It generally includes two parts: Information Reconciliation (IR) and Privacy Amplification (PA)⁴⁴. The IR process is used to correct the deviation of analog signals and generate error correction codes; In the PA process, sufficient entropy was extracted to generate the key.

Figure 1 shows the principal diagram of the key agreement for SSL-PUF. From the figure, the same challenge signal c is given to both the SSL-PUF and the authentication server. Under the stimulation of challenge signal c, the SSL-PUF generates a response signal r, which undergoes BCH encoding to generate an error correction code u, and finally generates a secret key K through a PA process.

Fig. 1

The principal diagram of the key agreement for universal superlattice devices³⁸.

The authentication server receives the challenge signal c and error correction code u from the superlattice device. Firstly, find the response data $r^{\prime}$ corresponding to the challenge signal c in the locally pre stored CRPs by looking up the table. The response data here is $r^{\prime}$, which participates in the BCH decoding process together with the error correction code u. With the help of error correction code u, error correction decoding is completed. Finally, after the PA process, we can get the secret identical key K.

There are two key points to focus on in Fig. 1: Firstly, the error correction code u can be sent through a public channel without a special secure channel, which can greatly reduce the management complexity of key agreement; Secondly, the challenge signal c cannot be reused, and the authentication server needs to be properly marked and judged to avoid replay attacks.

In summary, SSL-PUF has not yet been applied in the scenario of IoV, and the existing key agreement solutions cannot balance the relationship between privacy protection and costs.

Results

System model

In the vehicle road collaboration application scenario, the system model contains three components: Trusted Third-Party Agent (TA), Roadside Unit (RSU), and Vehicle. Figure 2 shows the system model of vehicle road collaboration.

• 1. Trusted Third Party Agent (TA): TA is the central authority for identity verification, responsible for registering and verifying vehicles, and storing confidential information such as CRP of other entities. TA has the highest communication and computing capabilities required to verify a large number of RSUs and vehicles. The SSL-PUF used in the vehicle needs to complete the registration of the corresponding CRP in TA. We believe that TA is completely trustworthy here and will not be attacked.

• 2. Roadside Unit (RSU): RSU is the central point of communication between TA and vehicles, responsible for forwarding communication between them. RSU is connected to TA through a public communication channel. All RSUs are located on the roadside, so all vehicles can easily exchange information with TA through RSUs. In addition, RSU is responsible for data collection and distribution, edge computing processing.

• 3. Vehicles: Each vehicle is integrated with an onboard unit (OBU) and equipped with SSL-PUF as the unique physical identifier for that terminal. The vehicle can communicate with TA through RSU with the help of OBU. In the V2I environment, OBU shares information with TA through RSU. OBU is attached to the vehicle, storing identity information and the actual identity of the vehicle to perform encryption functions.

Fig. 2

System model of vehicle road collaboration.

Security assumption

Assuming that TA is in a completely trusted environment, CRPs for all vehicles support safe storage and use. All vehicles implement the registration process in a secure channel environment and assume that the RSU is completely trusted. Assuming that the attacker has the attack capability in the Dolev-Yao attack model, that is, the attacker can interact with legitimate participants and attack the system, can initiate a dialogue with the vehicle, RSU, and TA, can obtain any information in the process of protocol interaction, know the details of the communication protocol, and have the ability to listen, modify or terminate the interaction protocol.

Based on the above security assumptions, the security objectives of this protocol are as follows:

• (1) Identity authentication: TA supports the identity authentication of vehicle OBU;

• (2) Key agreement: the access authentication scheme can realize the vehicle key agreement;

• (3) Confidentiality of messages: users who are not authenticated successfully and have access to the group cannot obtain messages within the group;

• (4) Resist common attacks and forward security: access authentication can resist counterfeiting attacks, replay attacks, man in the middle attacks, and other common attacks. Even when SSL-PUF devices are out of control, the protocol can maintain forward security.

Our proposed protocol

In this section, an identity authentication and key agreement scheme based on SSL-PUF is proposed for vehicle road collaboration scenarios. The symbols used in this paper are described in Table 1.

Table 1 Symbol description.

• Registration phase

Vehicles V_i (i = 1, 2,…, n) integrate OBU and are equipped with SSL-PUF universal device to achieve session key agreement without using asymmetric keys or preshared keys. RSU is responsible for establishing group communication within its communication range and acting as a relay communication, forwarding nonsensitive auxiliary information transmitted between the vehicle OBU and TA. Further, achieve key agreement between vehicles. The scheme is divided into two parts: vehicle registration phase, vehicle access authentication, and key agreement phase.

Vehicle registration is conducted over a secure channel and is unable to be attacked by attackers. TA registers CRPs for each PUF, i.e. stores a certain amount of CRPs for each PUF on the TA server. Taking the registration of vehicle V₁ as an example, the specific registration process is shown in Fig. 3.

• (1) Vehicle V₁ sends a registration Request and its unique identity ID_V1 to TA;

• (2) TA verifies the uniqueness and legality of ID_V1. After passing the verification, TA selects a random number c_start as the starting point for the challenge and stores it in the database. Then set challenge c₁ = c_start and sends it to vehicle V₁;

• (3) Vehicle V₁ stores c₁ as the starting point for the challenge. V₁ uses c₁ to challenge the SSL-PUF, and obtains the response r, then, calculates a new challenge c₂ = Hash (c₁). Next, V₁ use c₂ to stimulate the SSL-PUF again and obtains the new response r. Repeat this step N times, where N is the number of CRPs registered for each on-board OBU terminal, until N groups of CRPsare obtained. Finally V₁ sends the response CRPs to TA;

• (4) After receiving the CRPs, the TA calculates the index value Hash (ID_V1 ||c₁) corresponding to each group of CRPs and saves (Hash (ID_V1 || c₁), r) to the database. This step is repeated N times until all N groups of CRPs are successfully stored.

Fig. 3

The vehicle registration process.

Finally, vehicle V₁ completes registration. TA stores the vehicle ID, initial value of challenge signal c₁, and CRPs of N groups of vehicles in the database. The vehicles also store the initial value c_start of the challenge signal. After each authentication, update the challenge c₁ = Hash(c₁) and delete the CRPs that have been used by TA. Note that TA stores (Hash(ID_V1 || c₁),r) instead of the common c₁, to ensure forward security. Even if vehicle V₁ loses control, the attacker can obtain the superlattice device SSL, but they cannot reverse deduce c₁ from the (Hash(ID_V1 || c₁),r) stored in TA, so they cannot obtain the corresponding response r through the SSL-PUF.

• Vehicle access authentication and key agreement phase

Whether a vehicle can enter an RSU grouping is determined by the grouping list preset by the RSU to the TA in advance. When the TA confirms the identity of the vehicle and the information of the vehicle is on the RSU group list, it enters the key agreement phase. The group key K of RSU is also preset by the RSU to the TA in advance. The main process of vehicle access authentication and key agreement is as follows. Take vehicle V_i (i = 1, 2,…, n) as an example:

Vehicle access authentication phase:

• (1) Vehicle V_i reads the challenge starting point $c_{start}$ locally, sets the challenge $c_{i} = c_{start}$, and updates the challenge starting point $c_{start} = Hash(c_{start} )$ at the same time. And get the current time Time_i. After using $c_{i}$ to stimulate PUF_Vi, the response r is obtained. The error correction code $u_{i}$ is generated through BCH encoding link, and then the key K_Ci is generated through the security enhancement link, and then generated $m_{i} = ID_{Vi} ||c_{i} ||Time_{i} ||u_{i}$, $Hmac_{{K_{{Ci}} }} (m_{i} )$. Vehicle V_i sends {$m_{i}$, $Hmac_{{K_{{C_{i} }} }} (m_{i} )$} to RSU. RSU forwards {$m_{i}$, $Hmac_{{K_{{C_{i} }} }} (m_{i} )$} to TA.

• (2) Firstly, TA checks Time_i to prevent replay attacks. Then calculate $I_{i} = Hash(ID_{Vi} ||c_{i} )$. Use ID_Vi to find the registered CRP list, query the PUF response r corresponding to I_i, recover the key K_Ci with the help of an error correction code $u_{i}$, verify $Hmac_{{K_{{C_{i} }} }} (m_{i} )$ with K_Ci to verify the true identity, and determine whether the vehicle can join this group. If failed to pass the identity authentication, the key agreement service will be rejected. If pass the identity authentication, then enter the key agreement phase.

Key agreement phase:

• (1) Helper data generation phase: Calculate $c_{i} = Hash(c_{i} )$, $I_{i} = Hash(ID_{Vi} ||c_{i} )$, and TA retrieves the response corresponding to each PUF stimulus based on the registered CRP information, specifically $r = CRP_{Vi} (I_{i} )$. Subsequently, TA generates a physical random number w_AB of length N_k from the integrated random number generator, and selects an error correction code to encode the physical random number $O = encode_{i} (w_{AB} )$, resulting in the codeword $O$. The response r from the PUF is utilized to mask the codeword $O$, yielding the publicly accessible auxiliary file h_i, where $h_{i} = O \oplus r$. $m_{i}{\prime} = h_{i} ||Time_{i}$ and $Hmac_{{K_{{C_{i} }} }} (m_{i}^{\prime } )$ are transmitted to vehicle V_i via the RSU.

• (2) Vehicle V_i response recovery phase: Vehicle V_i initially verifies Time_i to avert replay attacks and verifies $Hmac_{{K_{{C_{i} }} }} (m_{i}^{\prime } )$. Subsequently, it sets the challenge $c_{i} = c_{start}$ and simultaneously updates $c_{start} = Hash(c_{start} )$. After stimulating PUF_Vi with $c_{i}$, a response $\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{r}$ is obtained. Owing to unavoidable disparities in the simulation system, slight differences exist between $\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{r}$ and r. By XORing the auxiliary file h_i with $\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{r}$, codeword Ō containing errors is derived. Subsequently, decoding Ō and recovering the random number $w_{AB}$ selected by TA, denoted as $w_{AB} = decode_{i} ()$. Since the disclosure and response entropy of the auxiliary file may leak information about $w_{AB}$, a strong extractor is employed to extract $w_{AB}$, thereby obtaining an unconditionally secure full entropy key K.

At this juncture, the key agreement process for vehicle V_i is concluded, enabling secure communication using the distributed key K. Figure 4 shows the process of vehicle access authentication and session key agreement.

Fig. 4

Vehicle access authentication and session key agreement.

After vehicle V_i extracts the group key, it can utilize this key to engage in symmetric encrypted communication with other vehicles within the group. The strong PUF properties of the superlattice guarantee the changing of key for each session. Only the OBU device in vehicle V_i, equipped with a legitimate SSL-PUF, can retrieve the correct key from the publicly available auxiliary data provided by TA. Consequently, both the TA and each terminal device inherently possess a self-authentication function, enabling them to verify the authenticity of each other’s identities mutually. Legal devices possess the capability to obtain the correct key through helper data, while illegal devices are unable to derive the same key as legal ones. Each device is assigned a unique ID, and before each key agreement, the ${\rm H}mac_{C||ID}$ must be verified for identity authentication to safeguard against man-in-the-middle attacks.

The protocol presented in this paper is designed for intra-group communication among multiple vehicles, with each RSU functioning as a group, and having the capability to schedule updates for the group key. This protocol exhibits remarkable flexibility, enabling it to adapt to key establishment in diverse network topologies. Due to significant variations in the physical environments of individual terminal devices, there may be substantial discrepancies between the actual and registered responses. Consequently, this protocol accommodates different vehicles in selecting varied error correction code parameters to counteract adaptability issues stemming from temperature fluctuations or other environmental changes. When applying randomness extraction, the choice of extraction parameters should be based on the minimum value among the parameters of the two (or multiple) parties involved, serving as the final extraction parameters for all devices.

Security analysis and proof

• Informal security analysis

  • (1) Impersonation attack. Assuming C is the attacker, it can intercept messages on a public channel transmitted by a legitimate vehicle B which can join a specific group. Attacker C may impersonate vehicle B to perform TA verification, thereby acquiring auxiliary data h_B. Nevertheless, owing to the unclonability of PUF, the attacker cannot derive an error codeword within the error correction range by XORing their own PUF output with h_B, rendering it impossible to retrieve the group key. Given that cloning a specific SSL-PUF entails immense costs and resources, it is virtually unachievable. Consequently, only legitimate vehicles can obtain the group key.

  • (2) Replay attack. During the process of vehicle A establishing a session key, attacker C intercepts the challenges sent between the vehicle and the TA, and replies them using the previous challenge, attempting to force them to communicate using the previous key. In this scheme, the TA deletes the used CRP after verifying each incentive signal, thereby preventing replay attacks.

  • (3) Forward Secrecy. As TA and the vehicles collaboratively select challenge signals to generate CRPs during vehicle registration, these random numbers are not disclosed through public transmission in the channel, with the TA’s database storing the index pair of (HASH(ID_V1||c),r). Even if the attackers manage to obtain the TA’s stored information, they remain unable to retrieve the CRPs. If the on-board OBU is compromised and an attacker gains access to the legitimate SSL-PUF. It’s worth noting that in our design, the challenge signal is uniquely and freshly generated between the vehicle and the TA for each communication session. This ensures the forward security in our scheme.

We selected schemes 46–48 as comparative schemes. These schemes are identity-based encryption systems that integrate elliptic curve and bilinear pairing technologies to facilitate identity verification and group communication. In Table 2, we analyzed five aspects (SF₁ to SF₅), including replay attack resistance (SF₁), man-in-middle attack resistance (SF₂), lightweight operation (SF₃), forward security (SF₄) and mutual authentication (SF₅). The comparison shows that our scheme has certain advantages in security and lightweight.

Table 2 Security and lightweight comparison of different schemes.

In summary, the multi-party key agreement protocol proposed in this paper, leveraging a trusted third party and the SSL-PUF, offers effectively defending against impersonation attacks, replay attacks, and more. Furthermore, given that a key agreement is conducted before each session and no key-related information is stored on the device side, forward security is guaranteed.

• Formal security proof

In this sub-section, we presented a formal security proof for the access authentication and key agreement scheme, leveraging the Mao Boyd logic⁵⁰ which was enhanced by Mao et al. based on BAN logic⁴⁹. The symbols and fundamental rules of Mao Boyd’s logic are introduced in the following section. Drawing on the flow of protocol and the process of logical proof, an idealized protocol is obtained detailed below:

• (a) $\begin{aligned} & V_{1} \to TA:Time_{1} {\kern 1pt} {\kern 1pt} {\kern 1pt} \Re {\kern 1pt} {\kern 1pt} {\kern 1pt} Hmac_{{K_{{c1}} }} (m_{1} ) \\ & V_{{\text{i}}} \to TA:Time_{i} {\kern 1pt} {\kern 1pt} {\kern 1pt} \Re {\kern 1pt} {\kern 1pt} {\kern 1pt} Hmac_{{K_{{ci}} }} (m_{i} )\,(i = 1,2,3 \ldots n) \\ \end{aligned}$

• (b) $\begin{aligned} & TA \leftarrow V_{1} :Time_{1} {\kern 1pt} {\kern 1pt} {\kern 1pt} \Re {\kern 1pt} {\kern 1pt} {\kern 1pt} Hmac_{{K_{{c1}} }} (m_{1}^{\prime } ) \\ & TA \leftarrow V_{i} :Time_{i} {\kern 1pt} {\kern 1pt} {\kern 1pt} \Re {\kern 1pt} {\kern 1pt} {\kern 1pt} Hmac_{{K_{{ci}} }} (m_{i}^{\prime } )\,(i = 1,2,3 \ldots n) \\ \end{aligned}$

In the above assumption, V₁ and V_i use different k_c. According to the idealized rules of BAN logic, irrelevant information in the protocol can be ignored. After presenting an idealized description of the protocol, it is also essential for BAN logic to outline the security assumptions of the protocol.

$$TA| \equiv V_{i} \mathop \leftrightarrow \limits^{{K_{ci} }} TA$$

(1)

$$V_{i} | \equiv TA\mathop \leftrightarrow \limits^{{K_{ci} }} V_{i}$$

(2)

$$TA| \equiv \# (Time_{i} )$$

(3)

$$V_{i} | \equiv \# (Time_{i} )$$

(4)

Propositions (1)–(4) are the security assumptions of the system. Specifically, key sharing between vehicle V and TA is facilitated by SSL-PUF, hence Proposition (1) and (2) are established as the system’s security assumption. The timestamp Time_i, being an instantaneous value within the protocol, is unique for each instance and non-reusable, establishing security assumption Proposition (3) and (4).

The formal security analysis given in Fig. 5.

Fig. 5

The process of formal security analysis.

The objective of proving the access authentication and key agreement scheme is to enable the key agreement can be conducted between vehicles, that is:

$$V_{1} \mathop \leftrightarrow \limits^{K} V_{i}$$

(5)

The following proposition can be obtained from message (a):

$$TA\mathop {{\kern 1pt} \triangleleft }\limits^{{{\kern 1pt} {\kern 1pt} {\kern 1pt} {\kern 1pt} K_{ci} }} {\kern 1pt} {\kern 1pt} m_{i}$$

(6)

Drawing upon (1) and (6), we deduce the following based on the authentication rules (16):

$$TA| \equiv V_{i} \mathop |\limits^{{K_{ci} }} \sim m_{i}$$

(7)

Considering the response observed by TA in the message (a) corresponding to the timestamp Time_i, alongside proposition (6), the subsequent proposition is derived:

$$TA\mathop \triangleleft \limits^{{{\kern 1pt} {\kern 1pt} K_{ci} }} {\kern 1pt} m{\kern 1pt} {\kern 1pt}_{i} {\kern 1pt} \Re {\kern 1pt} {\kern 1pt} {\kern 1pt} Time_{i}$$

(8)

By applying the freshness rule proposition (19) to assumption (3) and proposition (8), the following proposition emerges:

$$TA| \equiv \# (m_{i} )$$

(9)

By applying the nonce-verification rule (18) to assumption (8) and proposition (9), the following proposition emerges:

$$TA| \equiv V_{i} | \equiv TA\mathop \leftrightarrow \limits^{{K_{ci} }} V_{i}$$

(10)

Therefore, TA can confirm the authenticity of vehicle V_i.

The following proposition can be obtained from message (b):

$$V_{i} \mathop \triangleleft \limits^{{{\kern 1pt} {\kern 1pt} K_{ci} }} m^{\prime}_{i}$$

(11)

Drawing upon (2) and (11), we deduce the following based on the authentication rules (16):

$$V_{i} | \equiv TA\mathop |\limits^{{K_{ci} }} \sim m^{\prime}_{i}$$

(12)

Considering the response observed by V_i in the message (b) corresponding to the timestamp Time_i, alongside proposition (11), the subsequent proposition is derived:

$$V_{i} \mathop \triangleleft \limits^{{{\kern 1pt} {\kern 1pt} K_{ci} }} {\kern 1pt} m^{\prime}_{i} {\kern 1pt} {\kern 1pt} {\kern 1pt} \Re {\kern 1pt} {\kern 1pt} {\kern 1pt} Time_{i}$$

(13)

By applying the freshness rule proposition (19) to assumption (4) and proposition (13), the following proposition emerges:

$$V_{i} | \equiv \# (m^{\prime}_{i} )$$

(14)

By applying the nonce-verification rule (18) to proposition (12) and (14), the following proposition emerges:

$$V_{i} | \equiv TA| \equiv V_{i} \mathop \leftrightarrow \limits^{{K_{ci} }} TA$$

(15)

Therefore, V_i trusts the authenticity of TA, thereby completing the mutual identity authentication between TA and V_i. Simultaneously, V_i can acquire auxiliary data h_i from the trustworthy entity $m^{\prime}_{i}$, which enables the recovery of the group key K. Subsequently, V_i can derive W_AB through its local computation Ō =  $\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{r}$ ⊕ h_i. By applying the operation K = Ext(w_AB) to W_AB, K can be obtained. In summary:

$$V_{1} \mathop \leftrightarrow \limits^{K} V_{i}$$

(16)

The target proposition (4) aligns with the proposition (13), thereby confirming the target.

Experiment

The excitation signal travels through the IMX6ULL development board and reaches the SSL-PUF board. Once the SSL-PUF generates a response signal, it is converted into a digital signal by the analog-to-digital converter and subsequently sent back to the I.MX6ULL development board.

We implemented the entire experimental process in C. The OBU comprises the following software modules: challenge generation and transmission module, response reception and preprocessing module, fuzzy extractors, and communication module. TA includes four software modules: challenge generation module, fuzzy extractors, communication module, and hash module.

The initial value is hashed by the hash module to produce challenge data, which is then transmitted to the SSL-PUF via the challenge generation and transmission module. The response data is acquired in the response reception and preprocessing module, and a consistent key K is derived using the fuzzy extractors.

In this section, we also selected schemes^46,47,48,54 as comparative schemes. Given that they all rely on public-key encryption, their associated overhead is relatively high. In contrast, our scheme leverages semiconductor superlattice digital PUFs, eliminating the necessity for pre-installed keys and simplifying computational processes, thereby incurring a relatively lower overhead. Below, we will assess and compare the computational overhead and communication burden of these protocols.

In this protocol, we primarily analyze the computational overhead of vehicles (terminals) and TA. We selected the Cortex-A7 I.MX6ULL development board as the OBU processor and interconnected it with an SSL-PUF board (comprising of a digital-to-analog converter, an SSL-PUF chip, and an analog-to-digital converter) to establish a terminal experimental environment. The experimental environment of TA is shown in Table 3. For the experiment, we employed the OpenSSL-1.0.2e library to simulate cryptographic algorithm operations, with the basic operations and cryptographic operation durations listed in Table 4. Notably, T_puf, T_BCHE, T_BCHD, and T_PA, are exclusive operations of the SSL-PUF, signifying the response time of the SSL-PUF, the time required for BCH encoding/decoding operations, and the time for privacy enhancement operations, respectively. The parameter of BCH error correction code (n, k, t) = (255, 147, 14). We choose SM4 as the symmetric encryption algorithm, SM3 as the hash function. The computational overhead of the schemes compared to ours is calculated based on specific details outlined in their respective protocols. The specific operations are extracted from the protocol design, and the ultimate computational overhead is derived using the basic overhead figures provided in Table 4.

Table 3 Equipment parameter description.

Table 4 Time consumption of a single operation of each function.

• Computational costs

The identity authentication and key agreement phases serve as the primary considerations when determining computational overhead. In our protocol, each full key negotiation process for vehicle V_i entails 4 times of hash operations, 2 times of PUF operations, 1 time of BCH decoding operation, and 1 time of confidentiality-enhanced computation, resulting in a total computational overhead of 703.1 microseconds for V_i. The TA, on the other hand, executes 5 times of hash operations, 1 time of BCH encoding operation,1 time of confidentiality-enhanced computation, and 1 time of pseudo-random number operation, amounting to a total computational overhead of 17.53 microseconds. Consequently, the overall computational overhead of our protocol stands at 720.63 microseconds. The computational overheads of all pertinent protocols^46,47,48,54 have been measured similarly, as presented in Tables 4 and 5. To provide a more intuitive comparison of TA operation times, Fig. 6 illustrates how the time taken by TA to authenticate vehicle identity information and distribute extracted group key auxiliary information varies with an increasing number of authenticated vehicles. Our scheme demonstrates a clear advantage in terms of computational cost.

Table 5 Cost comparison of different schemes.

Fig. 6

Comparison of TA runtime across different schemes.

• Communication costs

In VANETs, given the limited capacity of smart devices, the communication cost is of paramount importance. Communication overhead signifies the number of bits exchanged among participants to finalize the identity verification process. In this subsection, we present a comparison of the communication overhead between the proposed protocol and related protocols, referencing^46,47,48,54. Our primary focus for calculating the communication overhead is on the messages exchanged during the authentication and key agreement phases between vehicle V_i and the TA. The lengths of the parameters utilized in this scheme are detailed in Table 6 Specifically, the lengths of the challenge c, response r, error correction code u, and key agreement auxiliary data h for the SSL-PUF are all configured to be 256 bits.

Table 6 Description of relevant parameter length settings.

In our protocol, any vehicle V_i is required to exchange an authentication message with the TA, which includes $m_{i} = c_{i} ||Time_{i} ||u_{i} ||ID_{Vi}$ and $Hmac_{{K_{C} }} (m_{i} )$, totaling 704 bits of data to be transmitted. The TA, in response, sends key negotiation data comprising Time_i and auxiliary data h_i and $Hmac_{{K_{C} }} (m_{i}^{\prime } )$ to V_i, amounting to 432 bits of data. The communication overhead for all pertinent protocols^46,47,48,54 has been measured similarly, with the comparison results presented in Table 7.

Table 7 Comparison of communication costs of different schemes.

It is evident that our scheme, which is based on semiconductor SSL-PUF, boasts lower overhead and is more lightweight compared to those relying on elliptic curve and bilinear pairing technologies.

Discussion

This paper focuses on the characteristics of high mobility, low latency, and high-security requirements of the VANETs. Leveraging the SSL-PUF, we proposed a lightweight access authentication and key agreement scheme tailored for VANETs. Drawing upon the system model of vehicle road collaboration, we meticulously designed the identity authentication and key agreement processes for vehicles, and conducted a thorough security analysis under various attack scenarios, including impersonation attacks, replay attacks, and man-in-the-middle attacks. Ultimately, through experimental validation and comparative analysis, we demonstrated that the scheme proposed in this paper exhibits substantial advantages in terms of both security and lightweight. In the future, we will further investigate the use of SSL-PUFs to enhance intra-group communication management functions, as well as to implement switching authentication functions between groups, enabling SSL-PUFs to play a greater role in VANETs.

Methods

BAN logic is a set of logical rules based on postulates and assumptions for defining trustworthy and secure message exchange protocols. Utilizing Ban logic to prove identity authentication protocols typically encompasses three stages: the idealization of protocol messages, the security assumptions of the protocol, and the process of reasoning and proof. Firstly, we will introduce the symbolic interpretations utilized in Ban logic proofs, followed by the presentation of fundamental proof rules. The Ban logic definition construction is described as follows^38,51:

• (a) $P| \equiv X$ denotes P believes X is true.

• (b) $P \triangleleft M$ denotes P sees M.

• (c) $P\mathop \triangleleft \limits^{K} M$ denotes P sees M decrypt with secret K.

• (d) $P|\sim M$ denotes P sent M.

• (e) $P \Rightarrow M$ denotes P can control M.

• (f) $\# (M)$ denotes that M is fresh and has never been sent before.

• (g) $P\mathop \leftrightarrow \limits^{K} Q$ denotes P and Q share a secret K.

• (h) $\{ M\}_{K}$ denotes M is hashed using a secret K.

• (i) $A{\kern 1pt} {\kern 1pt} \Re {\kern 1pt} {\kern 1pt} B$ denotes A concatenated with B.

W. Mao et al. further abstracted and categorized the protocol data of identity authentication protocols, utilizing Ban logic, into such classes as atomic messages, challenges, challenged responses, responses, and meaningless messages. Additionally, they introduced novel inference rules. For a comprehensive understanding, please consult the paper by W. Mao et al.⁵⁰. Here, the essential rules for analysis of our scheme are described as follows^49,50,51:

R1: The authentication rules:

$$\frac{{P| \equiv P\mathop \leftrightarrow \limits^{K} Q,P\mathop \triangleleft \limits^{K} M}}{{P| \equiv Q\mathop |\limits^{K} \sim M}}$$

(17)

R2: Nonce-verification rule:

$$\frac{{P| \equiv \# (M),P| \equiv Q\mathop |\limits^{K} \sim M}}{{P| \equiv Q| \equiv P\mathop \leftrightarrow \limits^{K} Q}}$$

(18)

R3: Freshness rule:

$$\frac{P| \equiv \# (M) \wedge P \triangleleft N\Re M}{{P| \equiv \# (N)}}$$

(19)