CUBE-PUF-Based Anonymous Mutual Authentication Protocol for Internet of Vehicles

The Internet of Vehicle (IoV) is a core component of smart city development. However, data interactions between IoV entities involve personal privacy, and once maliciously attacked, they may threaten the stable operation of the entire transportation system. Traditional authentication protocols suffer from high computational and communication overheads and are vulnerable to various threats, including physical attacks, entity impersonation, and replay attacks. Moreover, due to their reliance on centralized trusted authority (TA), traditional protocols are prone to single-point failures, especially when handling large-scale vehicle access. To address these challenges, this article proposes a lightweight mutual authentication protocol based on physical unclonable function (PUF), which not only ensures vehicle anonymity and traceability but also supports a pseudonym update function after authentication. The protocol employs an architecture in which the main TA (MTA) is responsible for registration and data storage, while the sub-TA (STA) handles authentication, thereby effectively mitigating the risk of a single-point failure. Additionally, to counter the exposure of a large number of challenge-response pair in traditional PUF-based authentication—making them susceptible to machine learning (ML)-based modeling attacks—this article introduces a CUBE-PUF scheme based on digital Rubik’s Cube and random numbers. This approach enhances response unpredictability and randomness. We conduct both formal and informal security analyses of the proposed protocol and rigorously verify its security using the ProVerif verification tool. Furthermore, comparative evaluations with existing protocols demonstrate that our approach significantly reduces communication and computational overhead while offering enhanced security.