Cryptanalysis of Two-Factor Authentication in the Internet of Vehicles Network Environment

Abstract

An Intelligent Transportation System (ITS) plays a vital role in smart city ecosystems by enabling vehicles to communicate with roadside units, cloud servers, and other vehicles through the Internet. Numerous authentication protocols have been proposed to secure communications in the Internet of Vehicles (IoV), and recent studies have focused on enhancing user privacy through two-factor authentication. However, a detailed cryptanalysis conducted in this study reveals that an existing authentication protocol still suffers from several security vulnerabilities. Furthermore, under a stronger attacker model, an adversary who physically captures a device may extract the stored credentials, impersonate a legitimate user, and clone the device. To address these limitations, this study first presents a cryptanalysis of the existing protocol and then proposes a new authentication protocol. The proposed protocol integrates biometric authentication with a fuzzy extractor to derive cryptographic keys from fingerprint data, thereby preventing attackers from obtaining valid secret credentials even if a device is physically captured. Formal security analysis based on the Real-or-Random (RoR) model demonstrates that the proposed authentication protocol achieves strong anonymity, mutual authentication, resilience against desynchronization, and perfect forward and backward secrecy while resisting replay, impersonation, denial-of-service (DoS), and physical attacks. Furthermore, formal verification using the Scyther tool confirms that the proposed authentication protocol satisfies all specified security claims without identifying any potential attacks. Performance evaluation demonstrates that the proposed authentication protocol achieves the lowest execution time among the compared protocols, indicating its suitability for resource-constrained IoV devices.