Secure Long-Range Autonomous Valet Parking: A Reservation Scheme With Three-Factor Authentication and Key Agreement

1

Secure Long-range Autonomous Valet Parking: A Reservation Scheme with Three-factor Authentication and Key Agreement

arXiv:2608.03590v1 [cs.CR] 4 Aug 2026

Di Wang, Yue Cao, Senior Member, IEEE, Fei Yan, Member, IEEE, Yining Liu, Member, IEEE, Daxin Tian, Senior Member, IEEE, and Yuan Zhuang, Member, IEEE

Abstract—Long-range autonomous valet parking (LAVP) is a current trend, partly due to traffic congestion and parking headache. For large-scale parking demands, reservation is introduced to effectively manage valet parking. However, existing schemes focus on parking request verification and parking checkin, which aren’t applicable LAVP because they ignore identity legitimacy and communication security in the phase of picking up as well as dropping off passengers. One viable solution is authentication and key agreement (AKA) protocol. Generally, due to low entropy of passwords and dictionary attacks, threefactor (i.e. passwords, biometrics, and smart card) AKA is more secure than single- and two-factor AKA. Unfortunately, known attacks and high overheads hinder the application of three-factor AKA in real-world environments. Hence, one of the most tough tasks is to balance security and availability, especially how to address the potential threats introduced by each factor while taking full advantage of three factors. Inspired by the above challenges, we propose a provably secure threefactor AKA protocol for reservation services in LAVP, namely SecLAVP. Specifically, the passenger and the autonomous vehicle (AV ) complete mutual authentication with the assistance of the drop-off/pick-up point (DP ). After successful authentication, the session key is generated between the passenger, DP , and AV for secure communication. In the Real-Or-Random (ROR) model, we formally prove SecLAVP satisfies session-key security. Furthermore, we apply AVISPA to simulate our proposed protocol, to demonstrate that SecLAVP can resist man-in-the-middle attacks. Additionally, informal security analysis indicates that SecLAVP satisfies our defined 15 design goals concerning security. Finally, we evaluate performance of SecLAVP in terms of communication overheads, computational overheads, and scheduling, to manifest the feasibility. Index Terms—Long-range autonomous valet parking, authentication, key agreement, reservation services, secure communication.

I. I NTRODUCTION ARKING issues have become a commonplace and frustrating conundrum in urban life [1], partly attested that 30% of traffic jams are triggered by cruising for a parking space. More importantly, searching for an idle parking space

P

D. Wang, Y. Cao (Corresponding author), and F. Yan are with the School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China (e-mail:1065889068@qq.com; yue.cao@whu.edu.cn; yanfei@whu.edu.cn). Y. Liu is with the Institute for Artificial Intelligence Interdisciplinary Research, Guilin University of Electronic Technology Guilin 541004, China (e-mail:ynliu@guet.edu.cn). D. Tian is with the School of Transportation Science and Engineering, Beihang University, Beijing 100191, China (e-mail:dtian@buaa.edu.cn). Y. Zhuang is with the State Key Laboratory of Surveying, Mapping and Remote Sensing, Wuhan University, Wuhan 430072, China (e-mail: yuan.zhuang@whu.edu.cn).

causes air pollution [2]. For example, in 2006, searching for a vacant parking space gives rise to travel 945,000 additional miles, consume 47,000 gallons of gasoline and generate 728 tons of air pollution in Los Angeles [3]. As one of the foremost applications in the field of autonomous driving, autonomous valet parking (AVP) is divided into short-range autonomous valet parking (SAVP) [4]– [7] and long-range autonomous valet parking (LAVP) [8]– [11]. Daimler-Benz [12] took the lead in SAVP, which is semi-autonomous parking since passengers need park autonomous vehicles (AV s) at the entrance of the parking lot. Subsequently, ZongMu [13] deployed LAVP, which is fully autonomous parking since passengers only park AV s at a designated location (i.e. drop-off/pick-up points, DP s) near the destination. To improves last-kilometer experience, we focus on LAVP. Although navigation systems (e.g., BeiDou Navigation Satellite System and Baidu Map) can guide to parking lots near the destination, the parking space is still occupied after AV s arriving during rush hours. Additionally, for large-scale parking demands, the standard service of LAVP (e.g., firstcome-first-serve) causes traffic congestion and long waiting time, along with poor user experience and quality of service. The above challenges highlight the significance of proposing a reservation scheme to effectively manage valet parking. When proposing such a reservation, the relevant security and privacy requirements must be a top priority. Reservations sent by AV s to third parties include sensitive information (e.g., parking duration, identity and location). Once such information is captured, attackers can construct characteristics concerning passenger, such as work place and home address. Furthermore, situation is even grim as terrorists launch terrorist incidents based on the location and trajectory of AV s. Finally, service providers may sell users’ private message to others for increasing profits. Therefore, references [14]–[18] paid attention to location and trajectory privacy protection of SAVP. The above schemes ignore communication security, that is, confidentiality, unforgeability, and access control. First, attackers are easy to breach confidentiality by eavesdropping message in an open wireless environment. Next, tampered or deleted reservations will affect the accuracy of reservation decisions and user experience. Finally, illegal access exacerbates threats. For instance, attackers exploiting existing vulnerabilities to remotely control AV s to launch coordinated attacks.

2

The top priority is to propose an authentication and key agreement (AKA) scheme to secure communication. Initially, researchers focused on single factor AKA [19], [20] and twofactor AKA [21]–[23], facing issues such as smart card loss, passwords guessing, and biometrics leakage. Subsequently, three-factor (smart card, passwords, and biometrics) AKA [24]–[32] has attracted widespread attention. However, AKA that integrates three factors inevitably introduces threats faced by each factor. Therefore, the most tough task is to address the potential threats of each factor while taking full advantage of three factors. Motivated by the above challenge, we propose a secure reservation scheme for LAVP with three-factor authentication and key agreement (hereinafter referred to as SecLAVP), based on our prior parking optimization [10]. The main contributions of this paper are as follow:

1) To prevent AV s from being remotely controlled, unauthorized data access, and data eavesdropping, tampering, or forgery, we propose a three-factor AKA protocol based on smart card, passwords, and biometrics (i.e. SecLAVP). SecLAVP realizes authentication among passengers, DP s as well as AV s, and then session key is generated for secure communication. More specifically, SecLAVP supports passwords and biometrics update. No passwords verified table and smart card revocation are utilized to resist passwords guessing and smart card loss, respectively. Additionally, biometric extraction is applied to prevent biometrics leakage. 2) To further enhance security, we have conducted formal security proof and formal security verification. On the one hand, under the widely accepted Real-Or-Random (ROR) model [33], we prove that SecLAVP satisfies semantic security based on elliptic curve decisional Diffie Hellman (ECDDH) problem. On the other hand, we verify that SecLAVP resists man-in-the-middle attacks via Automated Validation of Internet Security Protocol and Applications (AVISPA) [34]. 3) Extensive simulations are carried out. First, we analyze the security to indicate that SecLAVP not only satisfies anonymity and forward security, but also resists common attacks such as offline dictionary attacks and replay attacks. Then, we evaluate efficiency of SecLAVP in term of computational overheads and communication overheads. Finally, to validate the practicability of SecLAVP, we evaluate the scheduling performance from AV density and DP density.

The remainder of our manuscript is organized as follows. Sections II and III respectively review the related work and introduce preliminaries. Network model and design goals are presented in Section IV. The implementation of SecLAVP is elaborated in Sections V. Security analysis and performance evaluation are provided in Sections VI and VII, respectively. At last, Section VIII concludes our work.

II. R ELATED W ORK A. AVP Scheduling Uhlemann [4] expounded the application prospect of valet parking by introducing Ford’s remote-control repositioning and Volvo’s pickup and dropoff service. Next, a distributed control method [5] was utilized to coordinate parking spaces and driving paths in AVP. Timpner et al. [6] proposed a VCharge project to implement AVP and charging scheduling simultaneously, which was validated via parking statistics from Hamburg Airport and Braunschweig. Qin et al. [7] proposed a path planning scheme for AVP, which respectively applied the hybrid A* algorithm and path coordination strategy to determine the global path and the transitional path. The above schemes [4]–[7] focus on SAVP, that is, passengers must drop off at the parking lot (semi-autonomous parking). Conversely, LAVP is fully autonomous parking because it allows passengers to be dropped off at a DP (i.e. Dropoff/pick-up Point) near the destination, reducing the walking distance of passengers. LAVP has been concerned, but up to now, it is still in its infancy. Given the parking price, fuel consumption, and distance from the parking lot, a cost-effective scheduling [8] was proposed, which doesn’t support parking reservations resulting in a low parking success rate. Therefore, based on the weighted value and heuristic method, Khalid et al. [9] proposed a reservation scheme to minimize the walking distance of passengers and driving distance from the drop-off point to the parking lot. Our prior work [10] proposed a reservation scheme to minimize passengers’ travel time and AV waiting time. Subsequently, from the perspective of electric vehicle charging reservation and parking waiting time, Zhang et al. [11] jointly optimized energy consumption and travel services. In summary, references [4]–[7] emphasize the path planning in SAVP. References [8]–[11] highlight parking reservations in LAVP. However, none of schemes [4]–[11] concern communication security in AVP. Tampered or forged messages (such as parking requests and parking reservations) can affect the accuracy of path planning and parking space matching.

B. AVP Security Huang et al. [14] proposed a privacy protection reservation, preventing AV s from reserving multiple parking spaces at the same time by zero-knowledge proof. However, the scheme can’t resist the conspiracy between parking lot terminals and parking service providers. Additionally, this scheme ignores that message may be tampered with or forged (i.e. confidentiality and unforgeability). To defend against attackers stealing or remotely controlling AV s, Ni et al. [15] proposed a two-factor AKA based on passwords and smartphones. Furthermore, BBS+ signature and Cukoo filter were applied to anonymous authentication and store pickup codes. However, with the increment of AV number, communication costs between local server and parking service provider increases sharply. Additionally, confidentiality and unforgeability are ignored.

3

Pokhrel et al. [16] utilized differential privacy and zeroknowledge proof to protect users’ location and identity privacy. To further improve the parking reservation rate, Markov decision-based reinforcement learning was applied to optimize parking space matching. Nonetheless, this work doesn’t authenticate the user’s identity in advance causing illegal access. Besides, multiple parking spaces are simultaneously reserved resulting in poor QoS. To prevent AV theft and location leakage, Fang et al. [17] proposed a privacy-preserving AVP based on blockchain (named B-park), which was upgrade of Pointcheval-Sander (PS) group signature. B-park was deployed in Etherums to realize anonymity and traceability, whereas this scheme can’t resist sybil attacks and man-in-middle attacks. Xu et al. [18] proposed a lattice-based ring signature to resist privacy leakage under quantum attacks. This solution not only protects identity privacy, but also satisfies unforgeability, unlinkability, and quantum attacks resistance. In short, the above schemes focus on the privacy protection of SAVP, ignoring confidentiality and unforgeability, as well as excessive overheads. Additionally, the above schemes are concentrated on parking request verification and parking check-in, which aren’t applicable LAVP because they ignore identity legitimacy and communication security in the phase of picking up as well as dropping off passengers. C. AKA Protocol Chien and Wu [19] proposed a passwords-based AKA protocol for secure authentication between users and servers. This protocol enables efficient addition of users, but doesn’t consider user revocation. With the prosperity of end-to-end communication, Byun et al. [20] proposed a passwords-based AKA protocol for client-to-client. Subsequently, Turkanović et al. [21] proposed an AKA for heterogeneous wireless networks, which doesn’t defend against smart card loss and sensor node spoofing attacks. Seeking to address the above challenges, Chang and Le [22] proposed a provably secure authentication scheme. Srinivas et al. [23] proposed a twofactor AKA based on smart card and passwords for healthcare. However, communication overheads are large. The above schemes focus on single factor AKA [19], [20] and two-factor AKA [21]–[23], facing issues such as smart card loss, passwords guessing, and biometrics leakage. Subsequently, three-factor (smart card, passwords, and biometrics) AKA has attracted widespread attention. To ensure reliable and secure charging from the smart grid, Wazid et al. [24] proposed an authentication scheme for secure communication between electric vehicles and charging piles. Nonetheless, this solution doesn’t support the revocation of charging piles captured by attackers. To prevent biometrics leakage, Zhang et al. [25] proposed a dynamic authentication based on biohash and hash functions to verify biometrics. Nonetheless, the dynamic verification table stored locally by the server has a large overhead. Srinivas et al. [26] proposed a biohashing-based AKA scheme integration of passwords and biometrics, which effectively resists impersonate attacks. For agriculture application, Ali et al. [27] proposed a remote AKA

to prevent monitoring data (such as temperature and humidity) from being illegally accessed and tampered with. However, solutions [26], [27] can’t resist offline dictionary attacks and internal attacks. Li et al. [28] proposed a robust three-factor authentication protocol based on a lightweight hash function for the Industrial Internet of Things, in which visitors can access sensors after being authenticated by gateways. Nevertheless, this scheme can’t resist offline dictionary attacks. Jiang et al. [29] combined biometrics, passwords, and smart card to achieve authentication between a cloud center, AV s, and users. This scheme prevents attackers from tampering, forging, and eavesdropping on data, but it can’t resist offline dictionary attacks and has large communication overheads. Sureshkumar et al. [30] proposed a three-factor AKA protocol for vehicle-to-grid to realize secure communication between electric vehicles and the smart grid, but this scheme can’t update biometrics. Based on the chaotic-maps discrete logarithm problem, Srinivas et al. [31] proposed a three-factor AKA, which was proven in ROR. Subsequently, based on the chaotic-maps computational Diffie-Hellman problem, Qiu et al. [32] introduced fuzzy-verifier and honeywords to achieve three-factor security. In conclusion, the above schemes [26]–[29] still face smart card loss, passwords guessing, and internal attacks. Additionally, the solution [25] lacks formal security verification and has a large overhead. Further to say, references [24], [28]–[30] lack formal security proof and formal security verification. Due to its advantages of unpredictability and uncertainty, chaotic maps are introduced into AKA [31], [32], but the computational efficiency is still not high. Table I compares state-of-the-art AKA protocols. Therefore, existing three-factor AKA protocols must balance security and availability. In other words, we should not only address potential security threats, provide formal security proof and formal security verification, but also minimize overheads. III. P RELIMINARIES A. Bilinear Pairing Note that G1 and G2 are multiplicative cyclic groups with the prime order p . The generator of G1 is g. Bilinear pairing [35] e : G1 × G1 → G2 satisfies the following

properties. 1) Bilinearity: e V λ , W ζ = e V ζ , W λ = e(V, W )λζ for any V, W ∈ G1 as well as λ, ζ ∈ Zp∗ . 2) Computability: for any V, W ∈ G1 , bilinear pairing e(V, W ) is capable of being computed effectively. 3) Non-degeneracy: e(V, W ) 6= 1 for all V, W ∈ G1 . B. Biometric Extraction In 2004, Dodis et al. [36] first proposed the fuzzy extractor, which can not only improve the matching efficiency of biometrics, but also prevent the exposure of biometrics. The fuzzy extractor consists of the following two algorithms. 1) (α, β) ← KPGen(Bio): Given the biometrics Bio and the public parameter generation algorithm KPGen, output the biometric key α and the public parameter β.

4

TABLE I S TATE - OF - THE - ART AKA PROTOCOLS COMPARISON Category Single factor

Scheme Chien and Wu [19]

Year 2009

Byun et al. [20]

2007

Turkanović [21]

2014

Chang and Le [22]

2016

Srinivas et al. [22] Wazid et al. [24]

2020 2017

Zhang et al. [25]

2018

Srinivas et al. [26]

2017

Ali et al. [27]

2018

Li et al. [28]

2018

Jiang et al. [29]

2020

Sureshkumar et al. [30]

2022

Srinivas et al. [31]

2020

Qiu et al. [32]

2022

Two-factor

Three-factor

Primitives ① Hash function ② XOR operation ③ Elliptic curve cryptography (ECC) ① Hash function ② Symmetric encryption ① Hash function ② XOR operation ① Hash function ② XOR operation ① Hash function ②XOR operation ① Hash function ② XOR operation ③ ECC ① Hash function ② Biohash function ③ XOR operation ① Hash function ② Biohash function ③ XOR operation ① Hash function ② Biohash function ③ Fuzzy extractor ④ XOR operation ① Hash function ② XOR operation ③ ECC ① Hash function ② XOR operation ③ Biometric extraction ① Hash function ② XOR operation ① Hash function ② Fuzzy extractor ③ XOR operation ① Hash function ② XOR operation ③ Fuzzy extractor ④ Honeywords

2) α ← KeyRet ( Bio ′ , β): The biometrics Bio′ and the public parameter β are input, then the biometric retrieval algorithm KeyRet generates the biometric key α only if the equation dis ( Bio′ , Bio) ≤ ε is satisfied. dis and ε represent statistical distance and specified distance, respectively. IV. N ETWORK M ODEL AND D ESIGN G OALS A. System Model Fig. 1 presents the system model and security threats, entities involving DP s, AV s, passengers, and parking lots. The above entities are defined in detail below. Break pickup matching

Drop off passenger at will No Parking

No Parking

Eavesdrop

Forge

Drop-off & Pick-up Only

Pick-up Point

Drop-off & Pick-up Only

Drop-off Point

AV

Delete

Remotely controlled AV

Forge Destination

Tamper Starting Point

Reserve multiple parking spaces P

Passenger Autonomous Attacker (P) Vehicle (AV) Inseure Driving track Communication of AV

PL

Parking Lot (PL) Walking track of P

Fig. 1. System model and security threats

1) Drop-off/pick-up points (DP s). DP s only allow autonomous vehicles (AV s) to drop off or pick up passengers,

Advantages Dynamic user addition.

Limitations Dynamic user revocation isn’t supported.

User authentication for two different domains. Lightweight.

Users cannot register and authenticate on multiple different servers. Can’t resist smart card loss and sensor node spoofing attacks. No communication overhead comparison.

Resist smart card loss and sensor node spoofing attacks. Resist privileged-insider attacks. Secure communication between users and smart meters. Users’ biometrics privacy protection. Resist smart card loss and protect biometrics privacy. Support anonymity and resist reply attacks. Support anonymity and passwords update. Resist reply attacks. Secure communication between users, cloud, and autonomous vehicle. Support passwords update and recovery. Support passwords and biometrics update, as well as smart card revocation. Secure communication between users and server.

High communication overheads. Malicious charging piles revocation isn’t supported. No formal security proof and verification. Dynamic verification table brings in high overheads. No formal security verification. No formal security proof. Can’t resist offline dictionary attacks and can’t support forward security. Smart card revocation and biometrics update aren’t supported. No formal security proof and verification. Can’t resist offline dictionary attacks. No formal security proof and verification. Can’t support biometrics update, formal security proof, and formal security verification. Can’t support forward security and low computational efficiency. Low computational efficiency.

and do not allow AV s to stay for a long time. DP s are responsible for passenger registration and AV registration. More than that, DP s collect and process parking reservations, which then determine the best drop-off point, suitable parking lot, and optimal AV . 2) Autonomous vehicles (AV s). AV s are registered with DP s. When the AV receives the matching results (i.e. pickup point, the best drop-off point, optimal parking lot, and matching passenger), the AV first drives to the pick-up point to pick up the passenger. Then the AV delivers the passenger to the drop-off point and finally travels to the parking lot for autonomous valet parking. 3) Passengers. Passengers get smart cards after registering at DP s. Passengers who need to ride send ride requests to adjacent DP s, and then walk to adjacent DP s to wait for AV pick-up. 4) Parking lots. Equipped with cameras, sensors, and communication facilities, parking lots (P Ls) supervise and manage the status of parking spaces, and then feed back parking spaces’ real-time status to DP s. B. Security Model The Real-Or-Random (ROR) model [33] is utilized to prove the session key security of our proposed SecLAVP. The ROR model has been widely used for formal security proof in existing AKA protocols [22], [24], [25], [31], [32]. Primitives in the ROR model are defined as follows. Participants. Π represents an instance (i.e. oracles). ΠiPi , j ΠDPi , and ΠkAVi denote i − th, j − th, k − th instances of Pi , DPi , and AVi , respectively. Accepted state. If an instance Π receives the expected message, it enters accepted state. Moreover, the identity (SID) of the current session consists of all sent and received messages.

5

Partnering. Two instances Πi and Πk satisfy the following three conditions, then Πi and Πk are partners. 1) Πi and Πk complete mutual authentication. 2) Πi and Πk are accepted state. 3) Πi and Πk are each other’s partners. Freshness. Supposing that an adversary A can’t obtain the session key between Pi and AVi through the Reveal query defined in the reference [22], then ΠiPi or ΠkAVi is freshness. Queries. The adversary A implements various attacks via the following queries. Execute(ΠiPi , ΠjDPi , ΠkAVi ): A eavesdrops on messages between Pi , DPi , and AVi by Execute(ΠiPi , ΠjDPi , ΠkAVi ) query, which simulates passive attacks. • Reveal(Π): A obtains the current session key of via the Reveal(Π) query. • Send(Π, M es): A sends a forged message to Π to get a response by the Send(Π, M es) query, which simulates active attacks. i • CorruptSC(ΠP ): A obtains secret parameters stored i in the stolen smart card for authenticating the passenger through CorruptSC(ΠiPi ) query, which simulates smart card loss attacks. k • CorruptAV (ΠAV ): The long-term secret key is obi tained by A through the CorruptAV (ΠkAVi ) query, which is used to prove perfect forward security. • T est(Π): Based on the indistinguishability of the ROR model, the T est(Π) query is used to prove the semantic security of the session key. A bit ℓ is randomly selected during experiment initialization to determine the output of T est(Π). A executes T est(Π) query. Only if the session has been established and is freshness, the session key is output when ℓ = 1, or else a random string is output. Otherwise, the T est(Π) query outputs ⊥. •

Under the ROR model, A must be able to distinguish between the real session key and the random key. A conducts a T est() query regarding ΠiPi or ΠkAVi , and the output of the ′ T est() query must be consistent with ℓ. If the guess bit ℓ output by A is equal to ℓ, A wins the game (The event is represented by ESuc (A)). Definition 1. AKA security (i.e. semantic security of the session key). Let AKA AdvA (pt) = |2 Pr[ESuc (A)] − 1| AKA is the advantage of the adversary A breaking where AdvA the semantic security of the session key (i.e. AKA security). Furthermore, Pr[ESuc (A)] is the probability of the event ESuc (A). In the ROR model, the protocol is AKA security AKA is negligible in polynomial time pt. if AdvA Definition 2. Elliptic curve decisional Diffie-Hellman (ECDDH) problem. Fp and P are respectively the finite field of prime order p and the generator of the cyclic group. Elliptic cyclic group Ea,b : y 2 = x3 + ax + b satisfies 4a3 + 27b2 6= 0 mod p. Given uP , vP , and wP , we can determine whether the equation uvP = wP holds, where u, v, w ∈ Zp∗ .

C. Adversary Model The Dolev-Yao (DY ) threat model [37] is applied to SecLAVP, in which communication parties transmit information through public channel. The adversary can control public channel, that is to say, he/she can tamper, forge, inject or delete information, as well as intercept and eavesdrop on information. Besides, the adversary obtains the parameters stored in the smart card through side channel or energy analysis when the smart card is lost. Now that Canetti and Krawczyk’s adversary model (CK-adversary model) [38] is regarded as a standard model for simulating AKA protocols, we introduce it into SecLAVP. Compared with the DY threat model, the adversary in the CK-adversary model can capture the previous session keys. Note that selfish AV s will meanwhile reserve multiple parking spaces for maximizing parking reservation rate. D. Design Goals Following our proposed system model, security model, and adversary model, the following design goals DGi must be met. 1) DG1 Anonymity: DP s can’t detect passengers’ identities and can’t infer two sessions sent by the same user. 2) DG2 Mutual Authentication: Communication entities must authenticate each other to ensure secure communication. 3) DG3 AKA Security: Passengers and DP s negotiate to generate the session key, so do AV s and DP s. 4) DG4 Forward Security: Although attackers obtain current session key, they can’t calculate previous session key. 5) DG5 Update: Support passwords update, biometrics update, and smart card revocation. 6) DG6 No Passwords Verified Table: DP s and AV s don’t store sensitive information related to passwords. 7) DG7 Passwords Security: DP s can’t infer passwords. 8) DG8 Anti Smart Card Loss: Passenger’s secret parameters won’t be disclosed when the smart card is lost. 9) DG9 Internal Attacks Resistance: Passengers won’t disclose sensitive information to DP s in the registration. 10) DG10 Replay Attacks Resistance: Attackers can’t repeatedly send ride requests to deceive DP s. 11) DG11 Offline Dictionary Guessing Attacks Resistance: Attackers can’t guess the passenger’s identity and passwords by a custom dictionary. 12) DG12 Multiple-reservation Resistance: Only one parking space can be successfully reserved at a time. 13) DG13 Efficiency: On the premise of ensuring security, we should minimize overheads and optimize scheduling performance. 14) DG14 Formal Security Proof: Formal security proof is indispensable to strictly ensure the security of the protocol. 15) DG15 Formal Security Verification: The official protocol verification software shall be used for verifying security. V. T HE P ROPOSED S CHEME A. Overview This section expounds on the implementation process of SecLAVP, mainly including Setup, Pick up, Drop off & Parking, as well as Update & Revocation, as shown in Fig. 2. Key symbols are shown in Table II.

6

TABLE II K EY SYMBOLS

No Parking Drop-off & Pick-up Only

PL

Passenger

DP

AV

Setup

System initialization Passenger registration AV registration

Pick Up

Login & Authention & Ride request

DP matching & PL matching & AV matching Pick up passenger & Authentication

Drop Off & Parking

Symbol Pi IDPi ; P WPi ; BioPi DPi G3 ; P IDDPk ; IDP Li ; IDAVi ADSK P DSK P ASK h(); ||; ⊕ Des TP arking ; tP arking L

Description the passenger Pi Pi ′ s identity, passwords, and biometrics the neighboring pick-up point additive cyclic groups; the generator the identities of the best drop-off point, the optimal P L as well as the optimum AV the session key between AVi and DPi the session key between Pi and DPi the session key between Pi and AVi hash function; concatenation; XOR operation Pi ′ s destination parking moment; parking duration the list counting the number of inputting wrong passwords

Parking request Drop off passenger & Authentication

Fig. 3 shows the detailed process of passenger registration (hereinafter referred to as P R) in SecLAVP.

Parking check-in Update & Revocation Password and biometric update & Smart card revocation

Passenger ( Pi )

Drop-off/Pick-up Point (DPi ) Secure channel No Parking Drop-off & Pick-up Only

Fig. 2. The implementation process diagram of SecLAVP

1) Setup: ① The parameters required by the system are generated in system initialization. ② Passengers register at the adjacent DP . ③ AV s register at the adjacent DP . 2) Pick Up: ① Passengers who have completed registration and need to take a ride must login and authenticate. After successful authentication, a session key is generated and a ride request is sent to the adjacent DP . ② DP matches passengers with the best drop-off point, optimal parking lot and suitable AV after receiving the ride request. ③ The matched AV drives to the pick-up point and authenticates with the passenger to ensure picking up a matched passenger. 3) Drop Off & Parking: ① The AV sends parking request and parking reservation to DP s of route. ② DP s of route send the best drop-off point and optimal parking lot to the AV . The AV drives to the best drop-off point and verifies the best drop-off point. After the verification is passed, the AV drops off the passenger. ③ The AV drives to matching parking lot for parking check-in. 4) Update & Revocation: ① Passengers update passwords and biometrics locally. ② Revoke smart card when the passenger loses smart card. B. Setup 1) System Initialization First, DP s select additive cyclic groups G3 with the prime order p. Second, DP s randomly select xDP as the private key to calculate the public key XDP = xDP P , where P is the generator of G3 . Supposing that IDDP is the identity of DP and {xDP , IDDP } is stored locally by DP s. Finally, DP s assign a unique identity IDAV to the autonomous vehicle AV . The AV and DP s store IDAV locally. 2) Passenger Registration

Step 1 Inputs {IDPi , PWPi , BioPi } Generates T Pi Computes (D Pi , E Pi ) KPGen( BioPi ) APWPi h( PWPi || D Pi || T Pi )

Step 2 Computes xPi h( IDPi || xDPi || T0 ) AP' xPi † h( APWPi || i ID ) P i {IDPi , APWPi } Stores {IDPi , T0 , L} into loacl memory database Step 3 Writes{ AP' , X DPi , P}into i Generates T P' i and n smart card smart card Computes xPi h( APWPi || IDPi ) † AP' i BPi h( IDPi || PWPi || D Pi || xPi ) mod n ' ' APWP h( PWPi || D Pi || T Pi ) i APi xPi † h( APW P' || IDPi ) i Replaces AP' i with APi Stores {BPi ,T P' i , E Pi , n, h(), KPGen, KP Re t}

Fig. 3. Passenger registration

Step P R1 : The passenger Pi chooses IDPi as the identity and sets custom string P WPi as own passwords. Next, Pi calculates the biometric key αPi and public parameter βPi via biometric extraction (see the Section III. B for details), namely (αPi , βPi ) = KP Gen (BioPi ). Eventually, Pi chooses a random number θPi to calculate AP WPi = h (P WPi kαPi k θPi ) and forwards {IDPi , AP WPi } to the adjacent DP (hereinafter defined as DPi ). Step P R2 : DPi checks whether IDPi exists in the local database after receiving {IDPi , AP WPi }. Pi must reselect the identity if IDPi already exists, or else DPi calculates xPi = h (IDPi kxDPi k T0 ) and A′Pi = xPi ⊕ h (AP WPi kIDPi ), where T0 is the timestamp. DPi then creates a list L to count the number of inputting wrong passwords. Note that the initial value and the threshold value of L are 0 and 5. Note that the smart card will be frozen for 30 minutes as long as L is greater than 5. After DPi stores {IDPi , T0 } and L locally,  ′ APi , XDPi , P is written into the smart card, which is sent

7

Passenger ( Pi )

No Parking

Public channel

Drop-off & Pick-up Only

Inputs {IDP* , PWP* , Bio* } i Pi Computes i

D *P

Key Re t ( Bio*P , E Pi ) i i APWP*i h( PWP* || D *P || T P' ) i i i x*P APi † h( APWP*i || IDP*i ) i BP* h( ID*P || PWP* || D *P || x*P ) i i i i mod n If BP* z BP , abort i i Step 2

y1 X DPi M 1 h( x pi || ID*P || Y1 || Y2 ) i M 2 ID*P † h(Y1 || Y2 ) i PIDAVi IDAVi † h( ID*P || Y2 ) i MSG1 {Y1 , M 1 , M 2 , PIDAVi }

Step 5

Public channel

Login

Step 1

Generates y1 Computes Y1 y1 P and Y2

Autonomous vehicle ( AVi )

Drop-off/Pick-up point ( DPi )

Step 3

Computes Y2*

xDPi Y1 * ID** M † h ( Y 2 1 || Y2 ) Pi x 'p h( ID** || xDPi || T0 ) Pi i M 1* h( x 'p || ID** || Y1 || Y2* ) Pi i * If M 1 z M 1 , L L  1 Else authentication is successful

Authentication Step 1

Generates y2 Computes

ID 'AV PIDAVi † h( IDP**i || Y2* ) i ' x*AVi h( IDAV || xDPi ) i ' M 3 h( IDAVi || Y1 || x*AVi || y2 ) ' M 4 y2 † h( x*AVi || IDAV || Y1 ) i ** PDSK h( IDPi || IDDPi || Y1 || Y2* ) MSG2 {Y1 , M 3 , M 4 ,

Computes

Step 2

Computes

y2' M 4 † h( x AVi || IDAVi || Y1 ) M 3* h( IDAVi || Y1 || x AVi || y2' ) If M 3* z M 3 , abort Else turn to Step 3 Step 3

Generates y3 Computes Y3 y3 P and Y4 y3Y1 M 5 h( y2' || Y3 || x AVi || IDAVi || Y1 ) ADSK h( IDAVi || IDDPi || Y3 || y2 ) PASK h( IDP**i || IDAVi || Y1 || Y4 )

E X AV ( IDDPi || ID** )} Pi i M 6* h( xP*i || Y1 || Y2 || ID*P || IDAVi || Y5 ) Step 4 i * MSG3 If M 6 z M 6 , abort Computes ' Else turn to Step 6 M 5* h( y2 || Y3 || x*AVi || IDAV || Y 1) i If M 5* z M 5 , abort Step 6 Computes

{Y3 , M 5 }

Else

' M 6 h( xP' i || Y1 || Y2* || ID** || IDAV || Y3 ) Pi i Y4* y1Y3 ADSK h( IDAVi || IDDPi || Y3 || y2 ) * PDSK h( IDPi || IDDPi || Y1 || Y2 ) MSG4 {M 6 , Y3 , E X P ( IDDPi )} i PASK h( IDP*i || IDAVi || Y1 || Y4* )

Fig. 4. Login and authentication

to Pi . Step P R3 : Pi calculates xPi = h (AP WPi kIDPi ) ⊕ A′Pi , = h (IDPi kP W
Pi k αPi kxPi ) mod n, BPi = AP WP′ i = h P WPi kαPi k θP′ i , and APi
′ ′ ⊕ h AP W x kID . θ and n are random numbers. Pi Pi Pi Pi is Api , BPi , θP′ i , βPi , XDPi , P, n, h(), KP Gen, KP Ret stored in the smart card SC. 3) AV Registration AV sends the identity IDAV and a registration request ReqAV to the DP , which calculates the private key xAV = h (IDAV kxDP ) and sends xAV to AV by a secure channel. C. Pick Up 1) Login Fig. 4 presents the detailed step of login (hereinafter referred to as Lg) in the green dotted box. Step Lg1 : The smart card SC calculates the biomet
ric key α∗Pi = KeyRet Bio∗Pi , βPi after Pi inputs the identity IDP∗ i , passwords P WP∗i , and biometrics Bio∗Pi . Af
terwards, SC calculates AP WP∗i = h P WP∗i α∗Pi θP′ i ,

x∗Pi = APi ⊕ h AP WP∗i kIDPi as well as BP∗ i = h(IDP∗ i ||P WP∗i ||α∗Pi ||x∗Pi )mod n and verifies whether the equation BP∗ i = BPi holds. Once the above equation is established, turn to Step Lg2 and DPi sends the matched AV ′ s identity (i.e. IDAVi ) to Pi , otherwise terminate login. Step Lg2 : SC selects a random number y1 to calculate Y1 = y1 P , Y2 = y1 XDPi , M1 = h(xpi ||IDP∗ i ||Y1 ||Y2 ) M2 = IDP∗ i ⊕ h(Y1 ||Y2 ), and P IDAVi = IDAVi ⊕ h(IDP∗ i ||Y2 ), where IDAVi is obtained by SC inquiring Pi . Pi generates the message M SG1 including Y1 , M1 , M2 , and P IDAVi , then sends M SG1 to DPi . Step Lg3 : DPi calculates Y2∗ = xDPi Y1
, IDP∗∗i = M2 ⊕ h (Y1 kY2∗ ), and x′pi = h IDP∗∗i kxDPi k T0 after receiving M SG1 . DPi then calculates M1∗ = h(x′pi ||IDP∗∗i ||Y1 ||Y2∗ ). Finally, DPi checks whether the equation M1∗ = M1 holds. Provided that the above equation set up, login is successful, or else login is terminated and L is updated as L = L + 1. 2) Authentication Fig. 4 presents the detailed step of login (hereinafter referred to as Au) in the orange dotted box.

8

Step Au1 : AVi sends ACK to DPi after arriving ′ at DPi . DPi randomly
selects y2 to calculate IDAV = i
∗ ′ ∗∗ ∗ P IDAVi ⊕ h IDPi kY2 and xAVi = h IDAVi kxDPi
. ′ Next, DPi calculates M3 = h IDAV kY1 k x∗AVi ky2 i ′ ∗ M4 = y2 ⊕ h(xAV
i ||IDAVi ||Y1 ), and P DSK = M SG2 h IDP∗∗i kIDDPi k Y1 kY2∗ . Finally, DPi generates
including Y1 , M3 , M4 , and EXAVi IDDPi kIDP∗∗i , then sends M SG2 to AVi . Step Au2 : AVi computes y2′ = M4 ⊕ h (xAVi kIDAVi k Y1 ) and M3′ = h (IDAVi kY1 k xAVi ky2′ ), then checks whether the equation M3∗ = M3 holds. Turn to Step Au3 if M3∗ = M3 , otherwise terminate authentication. Step Au3 : AVi chooses a random number y3 to calculate Y3 = y3 P Y4 = y3 Y1 , M5 = h (y2′ kY3 k xAVi kIDAVi k Y1 ), ADSK = h (IDAVi
kIDDPi k Y3 ky2 ), and P ASK = h IDP∗∗i kIDAVi k Y1 kY4 . AVi generates M SG3 containing Y5 and M5 , then sends M SG3 to DPi . Step Au4 : DPi calculates M5∗ = ′ ∗ h(y2 ||Y3 ||xAVi ||IDAVi ||Y1 ) and checks if the equation M5∗ = M5 holds. Note that DPi and AVi complete mutual authentication if M5∗ = M5 , or else terminate authentication. ′ kY3 ) Next, DPi computes M6 = h(x′Pl ||Y1 ||Y2∗ ||IDP∗∗i ||IDAV i and ADSK = h (IDAVi kIDDPi k Y3 ky2 ). Finally, DPi generates M SG4 , M6 , Y3 , and EXPi (IDDPi ), then sends M SG4 to DPi . Step Au5 : Pi decrypts EXPi (IDDPi ) to obtain IDDPi and calculates M6∗ = h(x∗Pl ||Y1 ||Y2 ||IDP∗ i ||IDAVi ||Y5 ). Note that Pi and DPi finish mutual authentication if M6∗ = M6 , then turn to Step Au6 , otherwise terminate authentication. Step Au6 : DPi calculates Y4∗ = y1 Y3 , P DSK = h(IDP∗ i ||IDDPi ||Y1 ||Y2 ), and P ASK = h(IDP∗ i ||IDAVi ||Y1 ||Y4∗ ). 3) Ride Request After Pi finishes login and authentication, he / she sends a ride request including identity IDP∗ i , destination Des, parking moment TP arking , parking duration tP arking , and timestamp T1 to the adjacent pick-up point DPi . 4) Matching DPi chooses the DP with the shortest passengers travel time as the best drop-off point (hereinafter defined as IDDPk ) and the P L with the smallest parking time cost as the optimal parking lot (hereinafter defined as IDP Li ). The matching AV (hereinafter defined as IDAVi ) is selected based on the earliest available moment of AV s. 5) Pick Up Passenger & Authentication DPi sends IDAVi to Pi and sends the acknowledgment message ACK to AVi . Pi walks to DPi waiting for AVi . Additionally, Pi sends EP ASK (h(IDAVi ), locDPk , IDPi ) to AVi , which will pick up Pi only if h(IDAVi ) is valid. D. Drop Off & Parking 1) Parking Request During taking Pi to locDPk , AVi generates ciphertext
M SG5 = {EADSK IDAVi kT2 k Reqparking , IDDPi } via the session key ADSK, where T2 and Reqparking are the timestamp and parking request. Moreover, AVi sends M SG5 to the adjacent DP (hereinafter defined as DPj ), which

forwards M SG5 to DPi . Unsurprisingly, DPi verifies the validity of T2 and whether IDAVi exists in the local database. If the above verification is successful, DPi sends the acknowledgment message ACK and M SG6 = EADSK (locP Li , T3 ) to DPj , which forwards M SG6 to AVi . Moreover, DPj selects the random string P arkAVi and signs it to generate the signature Sig = xDPj h(P arkAVi ). Subsequently, DPj sends (P arkAVi , Sig) to AVi . In response, AVi sends the confirmation message ConAVi to DPk , indicating that AVi is willing to park at P Li . DPk generates the parking code CodeP arking and signature Sig∗ = xDPk h(CodeP arking ). At last, DPk respectively sends (CodeP arking , Sig ∗ ) and CodeP arking to AVi and P Li . CodeP arking is stored in the local database by P Li . 2) Drop Off Passenger & Authentication After arriving at DPk , AVi sends (P arkAVi , Sig) to DPk , which verifies whether e(Sig, P ) = e(h(P arkAVi ), XDPj ) holds. If the above equation holds, Pi can get off at DPk . 3) Parking Check-in AVi sends (CodeP arking , Sig ∗ ) to P Li after arriving at P Li . P Li first retrieves whether CodeP arking exists in the local database, AVi is prohibited to enter P Li in case nonexistent CodeP arking . Otherwise, P Li verifies the signature validity, that is, to check whether the equation e (Sig∗ , P ) = e (h(CodeP arking ), XDPk ) holds. AVi can drive into P Li if the above equation is established, and then P Li deletes CodeP arking from the local database. E. Update & Revocation 1) Passwords and Biometrics Update Passengers can update their passwords and biometrics (hereinafter defined as P BU ) locally. The detailed process is as follows. Step P BU1 : Pi inputs identity IDP∗ i , original passwords P WP∗i , biometrics Bio∗Pi , and the random numcalculates biometric key α∗Pi = ber θPi to SC, which
∗ KeyRet BioPi , βPi . Then SC calculates AP WP
∗i = h(P WP∗i ||α∗Pi ||θPi ), x∗Pi = APi ⊕ h AP WP∗i kIDP∗ i , and BP∗ i = h(h(IDP∗ i ||P WP∗i ||α∗pi kx∗Bi )mod n). Afterwards, SC judges whether the equation BP∗ i = BPi holds, terminate the update if BP∗ i = BPi isn’t established.
Otherwise, SC calculates AP
WP′∗i = h P WP∗i α∗Pi θP′ i and A′∗ pi = h AP WP∗i kIDP∗ i ⊕ x∗Pi , where θP′ i is a random number chosen by Pi . Finally, SC prompts Pi to input the updated passwords P WPnew and updated biometrics Bionew Pi . i Step P BU2 : SC calculates the updated biometric key αnew and the updated public parameter βPnew (i.e. Pi i
new new = KP Gen(Bionew αPi , βPi Pi ) when Pi inputs ′ new P WPnew and Bionew = Pi . Next, SC calculates AP WPi i new new new ′∗ ′new h(P WPi ||αPi ||θPi ), xPi = APi ⊕ h(AP WPi ||IDP∗ i ), new BPnew = h(h(IDP∗ i ||P WPnew ||αnew n), Pi ||xPi mod i i new new new ′ AP WPi = h(P WPi ||αPi ||θPi ), and Anew = Pi new ∗ xnew ⊕ h(AP W ||ID ). Pi Pi Pi Step P BU3 : SC updates the paramas eter {APi , BPi , θP′ i , βPi , XDPi , P, n, h()} new ′ new {Anew , B , θ , β , P, n, h()}. , X DP i Pi Pi Pi Pi 2) Smart Card Revocation

9

The detail process of smart card revocation (hereinafter defined as SCR) is as follows. Step SCR1 : Pi sends identity IDP∗ i and smart card revocation request to the adjacent DP , which retrieves whether IDP∗ i exists in the local database. If IDP∗ i doesn’t exist, terminate the smart card revocation. Otherwise, DP verifies if L is less than or equal to 5. Only if L isn’t
greater′ than 5, DP calculates xnPi = h IDP∗ 1 kxDPi k T7 and APni = ∗ ) ⊕ xnPi , where T7 is the timestamp. h (AP WPi kIDR Step SCR2 : The adjacent DP creates a new list Lnew to count the number of inputting wrong passwords. Moreover, the initial value and the threshold value of Lneware 0 and 5. Then, ∗ new the adjacent DP updates .  ′n {IDPi , T0 , L} as IDPi , T7 , L Finally, DP writes APt , XDPi , P into the new smart card, which is sent to Pi . Step SCR3 : This step is the same as Step P R3 and we won’t repeat it.

Game Gm3 : A simulates CorruptSC queries via Gm3 . A can guess low-entropy passwords by offline dictionary attacks, but SecLAVP restricts A to enter wrong passwords at most 5 times. Therefore QSend (4) | Pr[SucGm3 ] − Pr[SucGm2 ]| ≤ |D| Game Gm4 : A simulates CorruptAV queries via Gm4 . ECDDH Let Y1 = uP and Y3 = vP . AdvA is the advantage of breaking ECDDH problem. Given uP and vP , A can distinguish between uvP and a random number. Therefore ECDDH (pt) | Pr[SucGm4 ] − Pr[SucGm3 ]| ≤ AdvA

(5)

After A runs all queries, the probability of guessing the correct bit ℓ is 0.5, so Pr[SucGm4 ] = 1/2

(6)

According to equations (1)(2)(6), we get VI. S ECURITY A NALYSIS A. Formal Security Proof Theorem 1. Let A be the adversary of breaking AKA security in polynomial time pt, then the advantage of A breaking AKA security is estimated as follows Q2 QSend SecLAV P ECDDH AdvA (pt) ≤ hash + 2( + AdvA (pt)) |hash|

|D|

Where Qhash and QSend are the times of hash queries and Send queries, respectively. |hash| and |D| represent the space of the hash function and the size of the password dictioECDDH nary, respectively. AdvA is the advantage of breaking ECDDH problem (Definition 2.). Proof. Set Pr[SucGmi ] and AdvGmi be the probability and advantage of A winning games Gmi (i = 0, 1, 2, 3, 4), respectively. AdvGmi = Pr[SucGmi ] and games Gmi (i = 0, 1, 2, 3, 4) are defined as follows. Game Gm0 : Gm0 simulates real attacks with a random oracle model. A can challenge all queries. By Definition 1., we have SecLAV P AdvA (pt) = |2 Pr[SucGm0 ] − 1|

(1)

Game Gm1 : In Gm1 , A conducts eavesdropping attacks via Execute(ΠiPi , ΠjDPi , ΠkAVi ) queries. After Gm1 is over, A performs a T est query to determine whether the output of Gm1 is a real session key or a random string. Since messages M SGi (i = 1, 2, 3, 4) will not disclose the privacy information about the session key, the probability of winning the game will not be affected. So we have Pr[SucGm1 ] = Pr[SucGm0 ]

(2)

Game Gm2 : A deceives a participant via Gm2 to receive forged message. Additionally, A launches active attacks via Send queries. M SGi (i = 1, 2, 3, 4) are associated with random numbers and identities, so the collision probability in Send queries can be ignored. Based on the birthday paradox, we can get | Pr[SucGm2 ] − Pr[SucGm1 ]| ≤

Q2hash |hash|

(3)

1 1 SecLAV P AdvA (pt) = | Pr[SucGm0 ] − | 2 2 = | Pr[SucGm1 ] − Pr[SucGm4 ]|

(7)

Based on equations (3)-(5), we get | Pr[SucGm1 ] − Pr[SucGm4 ]| ≤ | Pr[SucGm1 ] − Pr[SucGm2 ]| + | Pr[SucGm2 ] − Pr[SucGm4 ]| ≤ | Pr[SucGm1 ] − Pr[SucGm2 ]| + | Pr[SucGm2 ] − Pr[SucGm3 ]| + | Pr[SucGm3 ] − Pr[SucGm4 ]| QSend Q2 ECDDH + AdvA (pt) ≤ hash + 2|hash| |D| (8) Based on equations (7) and (8), we have SecLAV P AdvA (pt) ≤

Q2hash QSend ECDDH + 2( + AdvA (pt)) |hash| |D| (9)

B. Formal Security Verification We apply AVISPA [34] to formally verify the security of SecLAVP. AVISPA is a widely accepted protocol evaluation tool, which utilizes HLPSL (High Level Protocol Specification Language) to describe message interaction and entity roles. Moreover, AVISPA includes four backends, namely OFMC, CL-AtSe, SATMC, and TA4SP, where OFMC is widely used in verifying protocol security [39]. The output of SUMMARY is ‘SAFE’ if the protocol is secure, otherwise ‘UNSAFE’ and the attack process are output. We implement passenger registration, AV registration, login, and authentication through HLPSL. The defined goals are to ensure the confidentiality of passwords and biometrics. In Login phase, DP authenticates passenger via M1 . In authentication phase, AV authenticates DP via M2 . Similarly, DP authenticates AV via M3 and passenger authenticates DP via M4 . Intruders can not only eavesdrop and tamper with messages, but also act as intermediaries to intercept message. Fig. 5 shows the formal verification results of SecLAVP, which indicates that SecLAVP can resist man-in-the-middle attacks.

10

′

澳 Fig. 5. Formal verification results of SecLAVP

C. Informal Security Analysis We conduct informal security analysis based on design goals DGi . The strengths of SecLAVP are shown in Table III. TABLE III C OMPARISON OF SECURITY Security DG1 DG2 DG3 DG4 DG5 DG6 DG7 DG8 DG9 DG10 DG11 DG12 DG13 DG14 DG15

Ref [27] × X X × × X X X × X × × × × X

Ref [28] X X X × X X X × × X × × X × ×

Ref [29] X X X X X X X X × X × × × × ×

Ref [30] X X X X × X X X X X X × × × ×

SecLAVP X X X X X X X X X X X X X X X

1) DG1 Anonymity: Attackers get the passenger’s identity via Y1 Y2 and M2 , in which the calculation of Y2 = xDPi Y1 must obtain DP ′ s private key xDP i . However, xDP i is only known to DPi . So SecLAVP satisfies anonymity. 2) DG2 Mutual Authentication: The SC authenticates the passenger via BP∗ i . Additionally, the DP and the AV achieve mutual authentication by M3 and M5 . The DP and the passenger achieve mutual authentication by M1 and M6 . 3) DG3 AKA Security: See part A of this Section for details. 4) DG4 Forward Security: In polynomial time, due to ECDDH problem, attackers can’t calculate Y2 = y1 XDPi based on Y1 and P . Therefore, the session key between the passenger and the DP won’t be compromised. Furthermore, due to the confidentiality of y2 and y3 , the session key between the passenger and the AV as well as the session key between the DP and the AV won’t be compromised. 5) DG5 Update: Passwords and biometrics update can effectively resist passwords guessing and biometrics leakage. 6) DG6 No Passwords Verified Table: Secret parameters related to passwords aren’t disclosed because DP only store IDPi , T0 , and L in the registration phase.

7) DG7 Passwords Security: A random number θPi selected by the passenger prevents DP from obtaining passwords. 8) DG8 Anti Smart Card Loss: Supposing that attackers can obtain the parameters ′ {APi , BPi , θPi , βPi , XDPi , P, n, h()} and the biometrics when SC is lost. Since passwords are obfuscated by BPi and the hash function is collision resistance, attackers can’t infer passwords based on the known information. 9) DG9 Internal Attacks Resistance: In SecLAVP, internal attacks [40] means that DP can guess passwords. Even though DP obtains IDPi , AP WPi , BioPi , ′ and {APi , BPi , θPi , βPi , XDPi , P, n, h()}, DP can’t calculate AP WPi = h(P WPi ||αPi ||θPi ). Consequently, DP can’t confirm whether the guessed passwords are correct. 10) DG10 Replay Attacks Resistance: DP verifies the validity of message via timestamp to resist replay attacks. 11) DG11 Offline Dictionary Guessing Attacks Resistance: Supposing that the attacker applies the scanner and side channel attacks to steal the biometrics ′ and parameters{APi , BPi , θPi , βPi , XDPi , P, n, h()} stored in the smart card. Attackers guess the passenger’s identity and passwords as {idPi , pwPi }. Next, attackers calculates α∗P = KeyRet(BioPi , βPi ), i apwPi = h(pwPi ||α∗P | |θP∗ ), x∗P = h(apwPi ||idPi ) ⊕ APi , i i i and BP∗i = h(idPi ||pwPi ||α∗Pi ||x∗Pi ) mod n. Attackers judges whether the identity and passwords are guessed correctly according to the equation BP∗i = BPi . There are 232 {idPi , pwPi } satisfying BP∗ = BPi [41], but attackers can i only guess 5 times at most.  32So the probability−9of guessing passwords correctly is 5 2 ≈ 1.16 × 10 , which is negligible. 12) DG12 Multiple-reservation Resistance: DP generates a one-time parking code for parking check-in and stores it in the local database. Additionally, DP will delete the historical parking code once AV enters the P L, which is convenient for DP to check multiple-reservation in next round. 13) DG13 Efficiency: SecLAVP is efficient under the premise of ensuring security, which is mainly reflected in communication overheads (see Section VII. A), computational overheads (see Section VII. B), and scheduling performance (see Section VII. C). 14) DG14 Formal Security Proof: See part A of this Section for details. 15) DG15 Formal Security Verification: See part B of this Section for details. VII. P ERFORMANCE E VALUATION A. Communication Overheads Communication overheads generated by SecLAVP are mainly message (M SG1 ∼ M SG4 ). The comparison of communication overheads is shown in Table IV. The identity, random number, hash function and the key of ECC are 128bits, 128bits, 160bits and 160bits. Fig. 6 is a comparison diagram about communication overheads. Y1 , M1 , M2 , and P IDAVi are all

11

TABLE IV C OMPARISON OF COMMUNICATION OVERHEADS ( IN BITS ) Scheme Ref [27] Ref [28] Ref [29] Ref [30] SecLAVP

MSG1 992 763 864 768 640

MSG2 960 576 960 1344 736

MSG3 448 288 288 960 320

MSG4 864 576 576 480 448

Total 3264 2203 2688 3552 2144

160bits. Therefore, communication overheads of M SG1 = {Y1 , M1 , M2 , P IDAVi } is 160 × 4 = 640bits. M3 and M4 are all 160bits. IDDPi and IDAVi are all 128bits. Thus, communication overheads of M SG2 = {Y1 , M3 , M4 , EXAVi (IDDPi , IDAVi )} is 160 × 3 + 128 × 2 = 736bits. Similarly, M5 , M6 , and Y3 are all 160bits. Hence, communication overheads of M SG3 = {Y3 , M5 } and M SG4 = {M6 , Y3 , EXAVi (IDDPi )} are respectively 160 × 2 = 320bits and 160 × 2 + 128 = 448bits. Communication overheads have been reduced by 23.92% on average.

Communication overheads (bits)

1400

1200

Ref [27]

Ref [28]

Ref [29]

Ref [30]

SecLAVP 1000

800

600

400

200

0

MSG1

MSG2

MSG3

MSG4

Messages

Fig. 6. Communication overheads comparison

B. Computational Overheads Table V shows the comparison of computational overheads. Provided that TECM and TECA are multiplication operations and addition operations on ECC. Moreover, TH and TE are hash operations and encryption (or decryption) operations. A mobile phone with a memory of 3GB and a frequency of 2.45GHz simulates the passenger. Furthermore, the laptop computer with 16GB memory and a frequency of 3.1GHz emulates the autonomous vehicle. Besides, the desktop computer with 32GB memory and a frequency of 4.0 GHz serves as the drop-off/pick-up point [29]. For the mobile phone, TECM , TECA , TH , and TE take 0.537ms, 0.601ms, 11.260ms, and 13.434ms. Concerning the laptop computer, TECM , TECA , TH , and TE take 0.050ms, 0.051ms, 0.728ms, and 1.587ms. As for the desktop computer, TECM , TECA , TH , and TE take 0.041ms, 0.045ms, 0.483ms, and 0.978ms. In SecLAVP, the passenger calculates AP WP∗i , x∗Pi , BP∗ i , M1 , M2 , P IDAVi , M6∗ , P DSK, and P ASK consuming 9TH , then calculates Y1 , Y2 , and Y4∗ consuming 3TECM . Furthermore, the passenger obtains the identity of DPi consuming TE . As a result, the passenger’s computational overheads are 9TH + 3TECM + TE . Similarly, computational overheads of

DP s and AV s are respectively 11TH + TECM + 2TE and 5TH + 2TECM + TE . Computational overheads comparison of passengers is presented in Fig. 7 (a), which indicates computational overheads augment with the quantity of messages. More importantly, compared with the reference [29], computational overheads of passengers in SecLAVP are preponderant with the increment of messages’ amount. Compared with the solution [27], SecLAVP introduces Y1 and Y2 to defend attackers against guessing passwords via M1 , resulting in greater computational overheads. What’s more, BPi is applied to fuzzy processing passwords to resist smart card loss existing in the scheme [28]. SecLAVP has greater computational overheads than the reference [30], because biometric extraction is applied to prevent biometrics leakage and biometrics update, which aren’t included in [30]. Fig. 7 (b) shows computational overheads comparison of DP s. Simulation results manifest computational overheads of DP s are linearly related to the number of messages. Along with the growth of messages, SecLAVP is superior to schemes [27]–[29]. SecLAVP takes 7.31s for 1000 messages, but schemes [27]–[29] take respectively 8.754s, 7.817s, and 8.002s. SecLAVP enhances the security level by authenticating passengers through M1 in the login, resulting in larger computational overheads than that of the scheme [30]. Fig. 7 (c) compares computational overheads of AV s, which demonstrates computational overheads of AV s increase linearly with the number of messages. Compared with references [28], [30], computational overheads of AV s in SecLAVP have more significant advantages with the increase of messages. Additionally, SecLAVP introduces y2 and Y4 to support AKA security, which isn’t included in [27]. Even if computational overheads of AV s in SecLAVP are greater than that of the scheme [29], computational overheads of both passengers and DP s are less than that of the scheme [29]. C. Scheduling Performance The scheduling performance is simulated on Opportunistic Network Environment (ONE) [42]. We deploy 6 P Ls and 15 DP s in the network, each P Ls containing 100 parking spaces [10]. Additionally, the duration of AV requesting for drop-off and parking duration are set 3200s and 7200s respectively. We compare the scheduling performance between LAVP regardless of security [10] (hereinafter referred to as LAVP-RS) and SecLAVP including AKA, authentication in the pick-up phase, authentication in the drop-off phase, and parking check-in. The scheduling performance is evaluated from the following three aspects: • Waiting duration for parking spaces: The time interval between arriving at the parking lot and obtaining available the parking space (hereinafter referred to as waiting duration). • Passenger travel time: The travel duration from the pickup point to the drop-off point, plus the walking duration from the drop-off point to the destination. • AV travel time: The driving time from the pick-up point to the drop-off point, plus that from the drop-off point to the parking lot.

12

TABLE V C OMPARISON OF THE COMPUTATIONAL OVERHEADS ( IN MILLSECONDS ) Scheme Ref [27] Ref [28] Ref [29] Ref [30] SecLAVP

Passenger 7TH + 2TE 7TH + 2TE + 2TECM 9TH + TE + 5TECM + TECA 10TH 9TH + TE + 3TECM

AV 4TH + TE 4TH + 2TE 4TH + TE 11TH 5TH + TE + 2TECM

Ref [28]

100

Ref [29] Ref [30]

75

SecLAVP

50

25

Ref [27]

Computational overheads (s)

Computational overheads (s)

Ref [27]

Ref [28]

8

Ref [29] Ref [30]

6

SecLAVP

4

2

0

200

400

600

800

1000

The number of messages

0

200

400

600

800

1000

1) Influence of AV Density Table VI shows the influence of AV density on scheduling performance. In LAVP-RS and SecLAVP, waiting duration increases linearly with the quantity of AV s, whereas SecLAVP supports AKA for secure communication. Moreover, parking check-in guarantees that AV drives to the matching parking lot. In the context of 300, 400, 500 and 600 AV s, the waiting duration of SecLAVP is slightly longer than or equal to that of LAVP-RS, but SecLAVP has certain advantages as AV s rise to 700. TABLE VI T HE INFLUENCE OF AV DENSITY ON SCHEDULING PERFORMANCE ( IN SECONDS )

300 400 500 600 700

Passenger travel time LAVP-RS SecLAVP 805.488 805.977 792.358 793.431 791.949 790.581 781.180 786.130 775.940 773.957

Ref [28] Ref [29]

6

Ref [30] SecLAVP

4

2

AV travel time LAVP-RS SecLAVP 558.207 559.398 551.956 553.248 559.484 558.348 564.938 564.731 572.766 572.865

The passenger travel time decreases with the increase of AV . Compared with LAVP-RS, that of SecLAVP is slightly longer. Nonetheless, SecLAVP supports authentication in the pick-up phase and authentication in the drop-off phase, to prevent AV from picking up the wrong passenger or casually dropping off a legitimate passenger. In light of the fact that AV travel duration is more affected by destination location, pick-up/drop-off point location, and parking lot location, the AV density has a negligible effect on AV travel duration. 2) Influence of DP Density Table VII shows the influence of DP density on scheduling performance. Under the condition of 4 DP s, LAVP-RS causes the parking hotspot in which AV s are centrally allocated to a parking lot, resulting in a long waiting duration. In SecLAVP,

0

200

400

600

800

1000

The number of messages

The number of messages

(a) Computational overheads comparison for passengers (b) Computational overheads comparison for DP s Fig. 7. Computational overheads comparison

Waiting duration LAVP-RS SecLAVP 0 0.045 22.525 27.309 236.112 235.873 495.557 495.565 1076.217 1061.276

Ref [27]

8

0

0

0

AV

Total 118.941 120.665 130.561 123.023 129.022

10

125

Computational overheads (s)

DP 8TH + 5TE 8TH + 4TE + TECM 12TH + 2TE + 5TECM + TECA 5TH 11TH + 2TE + TECM

(c) Computational overheads comparison for AV s

the delay of parking check-in is so small that the scheduling performance isn’t affected. Additionally, a small delay may lead DP s to receive more reservations, which allows DP s to make a better matching decision, resulting to less waiting duration. With the increase of DP s, although the waiting duration of SecLAVP is slightly longer than that of LAVP-RS, AKA and authentication at various phase included in SecLAVP enhance the security of reservation services. So SecLAVP has more strengths from the overall perspective. TABLE VII T HE INFLUENCE OF DP DENSITY ON SCHEDULING PERFORMANCE ( IN SECONDS ) DP 4 10 15

Waiting duration LAVP-RS SecLAVP 778.8761 760.8562 173.1871 202.0649 0 0.045

Passenger travel time LAVP-RS SecLAVP 1578.5951 1581.6658 1130.7221 1128.435 805.488 805.977

AV travel time LAVP-RS SecLAVP 961.5527 965.4355 721.5275 718.7321 558.207 559.3975

With the increase of DP , the optional drop-off points near the destination also increase, resulting in a decrease in passenger travel time. Besides, under the condition of the same DP density, the passenger travel time of SecLAVP is almost equal to that of LAVP-RS . The AV travel duration decreases with the increase of DP s. Under the condition of 4 DP s, the AV travel duration of SecLAVP is slightly longer than that of LAVP-RS. However, along with the amount of DP increasing, the gap between LAVP-RS and SecLAVP gradually reduces and tends to zero. VIII. C ONCLUSION In this paper, we propose a secure reservation scheme with three-factor AKA for LAVP, which generates the session key for secure communication. We then prove its security from formal security proof and formal security verification. Additionally, security analysis manifests that SecLAVP satisfies

13

design goals (DG1 −DG15 ). Compared with state-of-the-art AKA protocols, communication overheads have been reduced by 23.92% on average. More importantly, the scheduling performance of SecLAVP is almost unaffected. To sum up, SecLAVP provides a theoretical foundation and guideline to construct a reservation scheme with a good balances security and availability for LAVP. R EFERENCES [1] R. Lu, X. Lin, H. Zhu, and X. Shen, “An intelligent secure and privacypreserving parking scheme through vehicular communications,” IEEE Transactions on Vehicular Technology, vol. 59, no. 6, pp. 2772–2785, 2010. [2] H. Li, M. Dong, and K. Ota, “Control plane optimization in softwaredefined vehicular ad hoc networks,” IEEE Transactions on Vehicular Technology, vol. 65, no. 10, pp. 7895–7904, 2016. [3] D. C. Shoup, “Cruising for parking,” Transport policy, vol. 13, no. 6. [4] E. Uhlemann, “Autonomous vehicles are connecting...[connected vehicles],” IEEE Vehicular Technology Magazine, vol. 10, no. 2, pp. 22–25, 2015. [5] M. Kneissl, A. K. Madhusudhanan, A. Molin, H. Esen, and S. Hirche, “A multi-vehicle control framework with application to automated valet parking,” IEEE Transactions on Intelligent Transportation Systems, vol. 22, no. 9, pp. 5697–5707, 2021. [6] J. Timpner and L. Wolf, “Design and evaluation of charging station scheduling strategies for electric vehicles,” IEEE Transactions on Intelligent Transportation Systems, vol. 15, no. 2, pp. 579–588, 2013. [7] Z. Qin, X. Chen, M. Hu, L. Chen, and J. Fan, “A novel path planning methodology for automated valet parking based on directional graph search and geometry curve,” Robotics and Autonomous Systems, vol. 132, p. 103606, 2020. [8] M. Khalid, Y. Cao, X. Zhang, C. Han, L. Peng, N. Aslam, and N. Ahmad, “Towards autonomy: Cost-effective scheduling for longrange autonomous valet parking (lavp),” in 2018 IEEE Wireless Communications and Networking Conference (WCNC). IEEE, 2018, pp. 1–6. [9] M. Khalid, Y. Cao, N. Aslam, M. Raza, A. Moon, and H. Zhou, “AVPark: Reservation and cost optimization-based cyber-physical system for longrange autonomous valet parking (l-avp),” IEEE Access, vol. 7, pp. 114 141–114 153, 2019. [10] X. Zhang, F. Yuan, Y. Cao, and S. Liu, “Reservation enhanced autonomous valet parking concerning practicality issues,” IEEE Systems Journal, vol. 16, no. 1, pp. 351–361. [11] X. Zhang, X. Xia, S. Liu, Y. Cao, J. Li, and W. Guo, “An integrated framework on autonomous-ev charging and autonomous valet parking (avp) management system,” IEEE Transactions on Transportation Electrification, 2022, doi:10.1109/TTE.2022.3145198. [12] D. B. Company, “Driverless in the parking lot. automated valet parking,” [EB/OL], https://www.daimler.com/innovation/case/autonomous/ driverless-parking.html, Accessed Oct 12, 2020. [13] Z. Technology, “Zongmu showcases its first low-speed high-automation product to ces 2018,” [EB/OL], https://www.linkedin.com/today/author/ zongmutech, Accessed Jan 9, 2018. [14] C. Huang, R. Lu, X. Lin, and X. Shen, “Secure automated valet parking: A privacy-preserving reservation scheme for autonomous vehicles,” IEEE Transactions on Vehicular Technology, vol. 67, no. 11, pp. 11 169– 11 180, 2018. [15] J. Ni, X. Lin, and X. Shen, “Toward privacy-preserving valet parking in autonomous driving era,” IEEE Transactions on Vehicular Technology, vol. 68, no. 3, pp. 2893–2905, 2019. [16] S. R. Pokhrel, Y. Qu, S. Nepal, and S. Singh, “Privacy-aware autonomous valet parking: Towards experience driven approach,” IEEE Transactions on Intelligent Transportation Systems, vol. 22, no. 8, pp. 5352–5363, 2021. [17] Y. Fang, Y. Zhao, Y. Yu, H. Zhu, X. Du, and M. Guizani, “Blockchainbased privacy-preserving valet parking for self-driving vehicles,” Transactions on Emerging Telecommunications Technologies, vol. 32, no. 4, p. e4239, 2021. [18] S. Xu, X. Chen, C. Wang, Y. He, K. Xiao, and Y. Cao, “A lattice-based ring signature scheme to secure automated valet parking,” in International Conference on Wireless Algorithms, Systems, and Applications. Springer, 2021, pp. 70–83.

[19] H.-Y. Chien and T.-C. Wu, “Provably secure password-based threeparty key exchange with optimal message steps,” The Computer Journal, vol. 52, no. 6, pp. 646–655, 2009. [20] J. W. Byun, D. H. Lee, and J. I. Lim, “Ec2c-paka: An efficient clientto-client password-authenticated key agreement,” Information Sciences, vol. 177, no. 19, pp. 3995–4013, 2007. [21] M. Turkanović, B. Brumen, and M. Hölbl, “A novel user authentication and key agreement scheme for heterogeneous ad hoc wireless sensor networks, based on the internet of things notion,” Ad Hoc Networks, vol. 20, pp. 96–112, 2014. [22] C.-C. Chang and H.-D. Le, “A provably secure, efficient, and flexible authentication scheme for ad hoc wireless sensor networks,” IEEE Transactions on wireless communications, vol. 15, no. 1, pp. 357–366, 2015. [23] J. Srinivas, A. K. Das, N. Kumar, and J. J. Rodrigues, “Cloud centric authentication for wearable healthcare monitoring system,” IEEE Transactions on Dependable and Secure Computing, vol. 17, no. 5, pp. 942–956, 2018. [24] M. Wazid, A. K. Das, N. Kumar, and J. J. Rodrigues, “Secure threefactor user authentication scheme for renewable-energy-based smart grid environment,” IEEE Transactions on Industrial Informatics, vol. 13, no. 6, pp. 3144–3153, 2017. [25] L. Zhang, Y. Zhang, S. Tang, and H. Luo, “Privacy protection for ehealth systems by means of dynamic authentication and three-factor key agreement,” IEEE Transactions on Industrial Electronics, vol. 65, no. 3, pp. 2795–2805, 2017. [26] J. Srinivas, S. Mukhopadhyay, and D. Mishra, “Secure and efficient user authentication scheme for multi-gateway wireless sensor networks,” Ad Hoc Networks, vol. 54, pp. 147–169, 2017. [27] R. Ali, A. K. Pal, S. Kumari, M. Karuppiah, and M. Conti, “A secure user authentication and key-agreement scheme using wireless sensor networks for agriculture monitoring,” Future Generation Computer Systems, vol. 84, pp. 200–215, 2018. [28] X. Li, J. Peng, J. Niu, F. Wu, J. Liao, and K.-K. R. Choo, “A robust and energy efficient authentication protocol for industrial internet of things,” IEEE Internet of Things Journal, vol. 5, no. 3, pp. 1606–1615, 2017. [29] Q. Jiang, N. Zhang, J. Ni, J. Ma, X. Ma, and K.-K. R. Choo, “Unified biometric privacy preserving three-factor authentication and key agreement for cloud-assisted autonomous vehicles,” IEEE Transactions on Vehicular Technology, vol. 69, no. 9, pp. 9390–9401, 2020. [30] V. Sureshkumar, P. Chinnaraj, P. Saravanan, R. Amin, and J. Rodrigues, “Authenticated key agreement protocol for secure communication establishment in vehicle-to-grid environment with fpga implementation,” IEEE Transactions on Vehicular Technology, 2022, doi:10.1109/TVT.2022.3146409. [31] J. Srinivas, A. K. Das, M. Wazid, and N. Kumar, “Anonymous lightweight chaotic map-based authenticated key agreement protocol for industrial internet of things,” IEEE Transactions on Dependable and Secure Computing, vol. 17, no. 6, pp. 1133–1146, 2018. [32] S. Qiu, D. Wang, G. Xu, and S. Kumari, “Practical and provably secure three-factor authentication protocol based on extended chaotic-maps for mobile lightweight devices,” IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 2, pp. 1338–1351, 2022. [33] M. Abdalla, P.-A. Fouque, and D. Pointcheval, “Password-based authenticated key exchange in the three-party setting,” in International workshop on public key cryptography. Springer, 2005, pp. 65–84. [34] T. AVISPA, “Automated validation of internet security protocols and applications,” [EB/OL], 2015, http://www.avispaproject.org/. [35] C. Tartary, S. Zhou, D. Lin, H. Wang, and J. Pieprzyk, “Analysis of bilinear pairing-based accumulator for identity escrowing,” IET Information Security, vol. 2, no. 4, pp. 99–107, 2008. [36] Y. Dodis, L. Reyzin, and A. Smith, “Fuzzy extractors: How to generate strong keys from biometrics and other noisy data,” in International conference on the theory and applications of cryptographic techniques. Springer, 2004, pp. 523–540. [37] D. Dolev and A. Yao, “On the security of public key protocols,” IEEE Transactions on information theory, vol. 29, no. 2, pp. 198–208, 1983. [38] R. Canetti and H. Krawczyk, “Analysis of key-exchange protocols and their use for building secure channels,” in International conference on the theory and applications of cryptographic techniques. Springer, 2001, pp. 453–474. [39] P. Bagga, A. K. Das, M. Wazid, J. J. Rodrigues, K.-K. R. Choo, and Y. Park, “On the design of mutual authentication and key agreement protocol in internet of vehicles-enabled intelligent transportation system,” IEEE Transactions on Vehicular Technology, vol. 70, no. 2, pp. 1736–1751, 2021.

14

[40] C. Wang, D. Wang, F. Wang, and G. Xu, “Multi-factor user authentication scheme for multi-gateway wireless sensor networks,” Chinese Journal of Computers, vol. 43, no. 4, pp. 683–700, 2020. [41] D. Wang and P. Wang, “Two birds with one stone: Two-factor authentication with security beyond conventional bound,” IEEE Transactions on Dependable and Secure Computing, vol. 15, no. 4, pp. 708–722, 2016. [42] A. Keränen, J. Ott, and T. Kärkkäinen, “The one simulator for dtn protocol evaluation,” in Proceedings of the 2nd international conference on simulation tools and techniques, 2009, pp. 1–10.

Related documents

• Requirements for Password-Authenticated Key Agreement (PAKE) Schemes#262425
• A Policy-Sensitive Model of Parking Choice for Commercial Vehicles in Urban Areas#449311
• A STUDY ON THE CAR-PARKING POLICY AND CAR-PARKING PROBLEMS IN BANGKOK AREA#69948
• IP Authentication using Keyed SHA#133711
• Context or Digits? Balancing Memorability and Efficiency in Virtual Reality Authentication#622466