LSAVO: Lightweight and Secure Attestation for Vehicle OBUs without Special Hardware

In large-scale Internet of Vehicles (IoV) networks, it is essential to periodically verify the safety of firmware and software in vehicle computers. Remote attestation of nodes in such swarm networks is necessary to ensure the absence of embedded malware in their code. However, most existing remote attestation schemes rely on public key infrastructure (PKI), which suffers from certificate management challenges, or require specialized hardware that may not be available on all device nodes. Some approaches use physically unclonable functions (PUFs), but these are often impractical due to the large memory required to maintain challenge-response pairs for each session and node in the swarm. Moreover, PUF-based methods are vulnerable to modeling attacks and sensitive to environmental variations. In this paper, we propose a practical and secure anonymous authentication and key agreement scheme, designed to implement a novel attestation algorithm in IoV environments. Our proposed attestation algorithm employs content-based pseudo-random traversal, eliminating the need for checksum computations after each memory read. Importantly, our scheme does not require special hardware, such as TPMs or PUFs, to be embedded in On-Board Units (OBUs). Additionally, it supports the heterogeneity, mobility, and scalability of swarm networks. We validate the security of our scheme through game-based proofs in the random oracle model and formal verification using the Tamarin Prover. Practical implementation results further highlight the superiority of our scheme, confirming its suitability for attesting prover nodes in swarm IoV networks.