Efficient and provably secure privacy-preserving two-factor authentication and key-agreement using blockchain and TEE for IoV environments

With the rapid advancement of wireless communication and cloud computing technologies, the Internet of Vehicles (IoV), which enables information sharing between vehicles, cloud servers, and infrastructure to support intelligent driving and road safety functionalities, has seen widespread adoption. However, transmitting information through public channels in IoV introduces significant privacy and security risks. For example, vehicle location trajectories and road users’ identity information are vulnerable to leakage, and the communication process may be subject to various forms of attacks. To address these issues, extensive research has focused on authentication and key agreement (AKA) protocols for intelligent vehicles and cloud servers in IoV. However, existing solutions have several drawbacks, including excessive reliance on third-party entities, such as registration authorities, high computational overhead, inadequate security features, and multiple interactions, all of which fail to meet the resource constraints and real-time communication requirements of IoV. To overcome these limitations, this paper introduces, for the first time, the Trusted Execution Environment (TEE) into IoV authentication and proposes an efficient and provably secure privacy-preserving two-factor authentication and key agreement scheme based on blockchain and TEE, called BPAKA. Compared to existing methods, BPAKA offers several significant improvements: First, it leverages TEE to eliminate the need for trusted third parties, enabling mutual anonymous authentication between intelligent vehicles and cloud servers in IoV scenarios, while ensuring a comprehensive set of security properties. Second, BPAKA incorporates a blockchain-based data-sharing framework, ensuring lightweight computational overhead. The AKA process requires only a single round of interaction, thereby fulfilling IoV’s real-time requirements and mitigating the impact of network fluctuations. Third, the security of BPAKA is formally proven using provable security techniques, demonstrating its robustness against various potential threats. Furthermore, performance evaluations show that, compared to existing IoV schemes, BPAKA achieves lower overall computational overhead. In addition, when compared with the state-of-the-art TEE-based scheme, the computation overhead in TEE of BPAKA is only 50.1% of that of the latter, while maintaining feasible communication and storage costs.