Quantum Secure Authentication and Key Exchange Protocol for UAV-Assisted VANETs

Abstract

The integration of unmanned aerial vehicles (UAVs) into vehicular ad hoc networks (VANETs) has emerged as a promising solution to overcome the limited coverage of conventional roadside unit (RSU)-based infrastructures. However, UAVs operate in open environments and cannot be fully trusted, while the rapid advancement of quantum computing threatens the long-term security of classical public-key cryptographic systems. As a result, many existing UAV-based VANET authentication schemes face fundamental limitations in future deployments. Most existing schemes either lack post-quantum security or incur excessive computational and communication overhead, making them unsuitable for real-time and high-mobility vehicular environments. In addition, the common assumptions of trusted UAVs do not align with realistic threat models. To address these issues, this paper proposes a lightweight post-quantum authentication and key exchange protocol based on the module learning with errors (MLWE) problem and physically unclonable functions (PUFs). The proposed scheme treats UAVs as untrusted relay nodes and excludes them from session key generation. Its security is evaluated using informal analysis, the real-or-random (RoR) model, BAN logic, and AVISPA, while performance evaluation indicates improved efficiency compared to existing schemes.

1. Introduction

The advancement of quantum computing has demonstrated the potential to solve the integer factorization and discrete logarithm problems that underpin public-key cryptography, as shown by Shor in 1994 [1] and Grover in 1996 [2]. Consequently, there has been an increasing need for research on post-quantum cryptography capable of replacing conventional public-key systems [3,4,5]. Among post-quantum cryptographic schemes, lattice-based cryptography derives its security from the mathematical hardness of high-dimensional lattice problems and offers high computational efficiency since its operations mainly consist of matrix additions and multiplications. Due to its strong resistance to quantum-computer-based attacks as well as its efficiency, lattice-based cryptography is regarded as one of the most promising approaches in modern cryptography [6,7,8,9].

Research on authentication schemes utilizing lattice-based post-quantum cryptography (PQC) is actively progressing across various fields, and among them, vehicular ad hoc networks (VANETs) are regarded as one of the most critical application domains. VANETs are a core component of smart urban transportation systems that enhance traffic efficiency and safety through communication between vehicles and roadside units (RSUs). If security vulnerabilities exist in this network, the entire urban traffic management infrastructure may face serious disruption [10]. For example, replay attacks and Sybil attacks can inject false traffic information into the system, potentially causing large-scale traffic congestion or interfering with the priority routes of emergency vehicles. In addition, eclipse attacks can isolate a specific vehicle from the network and force it to receive incomplete and adversary-manipulated information instead of legitimate data. Such situations may cause autonomous vehicles to make decisions based on incorrect information, which could ultimately lead to severe accidents. Therefore, VANET security is not merely a matter of traffic control but a fundamental requirement that must be ensured to maintain the overall safety and reliability of the urban transportation ecosystem. However, due to the inherent characteristics of VANETs, where vehicles move at high speeds, it is necessary to achieve a balance between security and efficiency by considering not only security but also the suitability for communication scenarios, fast authentication speed, and continuity of network connectivity [11,12,13].

Meanwhile, in addition to security vulnerabilities, the conventional VANET architecture also suffers from structural limitations. Since RSUs are installed at fixed locations, vehicles may move outside the communication coverage of RSUs when road structures change or urban areas expand, which can result in communication failure. Furthermore, if an excessive number of vehicles are concentrated on a particular RSU, communication delays may occur due to increased computational load. In addition, if physically installed RSUs are damaged by disasters, all vehicles within the affected area may experience communication outages. Consequently, although authentication is a highly critical component in VANETs, the current architectural constraints raise the possibility that the authentication process itself may not be performed reliably. To address these problems, an architecture that integrates unmanned aerial vehicles (UAVs) into the VANET environment has been proposed. Unlike fixed RSUs, UAVs can be rapidly deployed to appropriate locations when necessary and can dynamically move according to traffic density and road conditions. As a result, issues such as coverage gaps, overload, and communication failures caused by physical damage to conventional RSUs can be effectively mitigated. Figure 1 schematically demonstrates how these limitations in traditional VANETs can be alleviated through the use of UAVs. UAVs can extend communication coverage, distribute the traffic load of congested RSUs, and temporarily replace malfunctioning or damaged RSUs, thereby enhancing the overall reliability and service continuity of the network [14].

However, UAVs are more vulnerable to threats such as eavesdropping, spoofing, node compromise, and man-in-the-middle (MITM) attacks than traditional RSUs, since they operate in open environments, have limited physical protection, and rely on wireless communication links. Therefore, to integrate UAVs into VANETs, it is essential to develop authentication and key exchange (AKE) mechanisms that are both robust and efficient. Nevertheless, many of the currently proposed schemes still depend on traditional public-key cryptography, which cannot withstand future quantum-computer-based attacks, and they also suffer from insufficient authentication structures between vehicles and UAVs, making them vulnerable to impersonation attacks. Since UAV-assisted vehicular communication must support real-time decision making and high mobility, an AKE protocol must ensure computational efficiency while providing security not only against existing network threats but also against future quantum attacks. Accordingly, this paper proposes an AKE scheme based on module learning with errors (MLWE) that satisfies the characteristics of the VANET environment while providing resilience against future quantum-computer based attacks.

1.1. Contributions

The main contributions of this paper are as follows:

• We clearly analyze the limitations of the conventional RSU-based VANET architecture and justify the introduction of a UAV-assisted structure as an effective solution.
• To ensure secure AKE in the proposed architecture, we design an AKE scheme that combines an MLWE-based key encapsulation mechanism (KEM) and a physical unclonable function (PUF), thereby achieving both security and efficiency.
• We verify the security of the proposed scheme through formal and informal analyses using AVISPA, the real-or-random (RoR) model, and Burrows–Abadi–Needham (BAN) logic.
• Through a comparative evaluation with existing studies, we demonstrate that the proposed scheme outperforms previous approaches in terms of both security and efficiency.

1.2. Organization

The remainder of this paper is organized as follows. In Section 2, we analyze how UAV-assisted VANETs have evolved through prior research and examine their remaining limitations. In Section 3, we introduce MLWE and PUFs, which are utilized for AKE in the proposed scheme, and we summarize the attack models used for security analysis along with the notation employed throughout this paper. In Section 4, we present the proposed system model and describe the AKE procedures in detail within this model. In Section 5, we analyze the security of the proposed scheme using both informal and formal methods. In Section 6, we evaluate the superiority of the proposed scheme in terms of security features and computational cost by comparing it with existing VANET authentication protocols. Finally, in Section 7, we present the conclusion of this paper and discuss future research directions.

2. Related Works

VANETs are a core enabling technology of intelligent transportation systems (ITSs). However, conventional VANET infrastructures mainly rely on fixed RSUs, which results in limited communication coverage, increased deployment and maintenance costs, and performance degradation in environments with many physical obstacles or high disaster vulnerability. Due to these structural constraints, traditional VANETs face challenges in ensuring large-scale connectivity with high reliability and low latency. As an alternative to overcome these limitations, the integration of UAVs into VANETs, referred to as UAV-assisted VANETs, has been proposed. This approach has emerged as a significant technological advancement that extends communication coverage and enhances network resilience through a mobile aerial infrastructure. Although UAV-assisted VANETs have become an essential component of ITSs due to these advantages, various security limitations have continuously been raised throughout their development.

From 2016 to 2017, research in this area was in its early stage and primarily focused on communication topology and routing management, while security issues were relatively overlooked. Gupta et al. [15] pointed out that UAV networks operate in highly dynamic environments, fundamentally different from traditional MANETs and VANETs, due to rapidly changing topology, intermittent connectivity, and limited energy resources. They argued that such characteristics are difficult to adequately address using existing network architectures alone. However, their study did not propose specific authentication or cryptographic mechanisms. Similarly, Menouar et al. [16] proposed an architecture that utilizes UAVs as an extended infrastructure to support ITS functionalities such as traffic monitoring, law enforcement, and emergency assistance. Nevertheless, security and privacy protection were not reflected as core design considerations and were instead mentioned only as future research directions. As a result, early UAV-VANET studies largely concentrated on expanding connectivity and improving communication efficiency, while failing to sufficiently address threats such as message falsification, location tracking, and unauthorized access.

Since 2018, UAVs have evolved to serve as auxiliary infrastructure supporting the internet of vehicles (IoV), playing a crucial role in various applications such as data collection, communication relaying, and emergency communication. This transition further emphasized the need for secure communication mechanisms; however, concrete and systematic security designs were still insufficient. For example, Ng et al. [17] discussed the use of UAVs as relay nodes to support federated learning in IoV environments, aiming to enhance data reliability and model integrity. Nonetheless, their work did not sufficiently address potential threats such as adversarial data manipulation or eavesdropping.

As UAV-assisted communication technologies continued to expand, security requirements became increasingly critical, and since 2023, cryptography-based approaches have begun to emerge as a major research trend. El-Zawawy et al. [18] proposed an authentication protocol that integrates ECC with blockchain in an attempt to defend against UAV hijacking and data injection attacks. However, the delay and computational overhead introduced by blockchain verification posed limitations to its applicability in real-time vehicular environments. Similarly, the ECC-based mutual authentication scheme proposed by Miao et al. [19] was criticized for its high computational complexity. In addition, the lightweight authentication method introduced by Cui et al. [20], which utilizes chaotic maps and honeywords, still suffered from synchronization failures and reauthentication overhead in highly mobile environments. Consequently, the trade-off between enhanced security strength and real-time performance and energy efficiency became increasingly evident.

Since 2024, research has expanded beyond purely cryptography-centric approaches toward a broader security paradigm that incorporates trust management and privacy protection. Guo et al. [21] designed a zero-trust-based framework that enables continuous trust verification; however, it did not fully resolve issues related to communication overhead caused by frequent reauthentication and concerns regarding personal data collection. More recently, Choi et al. [22] and Lin et al. [23] proposed lightweight security and privacy-preserving mechanisms that combine PUFs with the concept of dynamic identities. Nevertheless, challenges such as synchronization inconsistencies in multi-UAV environments, insider threats, and the lack of standardized key management remain unresolved. In addition, Telikani et al. [24] highlighted that despite the rapid progress of UAV–ITS integration, the absence of unified security standards and interoperable authentication frameworks continues to be a major obstacle to large-scale practical deployment.

In summary, research on UAV-assisted VANETs has gradually evolved from its initial focus on extending connectivity and designing network architectures to a security-oriented direction that encompasses cryptography-based authentication schemes, trust management, and privacy-preserving mechanisms. However, a lightweight and highly reliable security framework that simultaneously satisfies the characteristics of UAV environments, including real-time constraints, high mobility, and resource limitations, has not yet been fully established. Moreover, the lack of unified security standards and interoperability issues remains a significant barrier to practical deployment. In addition, most existing studies rely on classical public-key cryptographic systems such as ECC, and therefore fail to address the fundamental vulnerabilities that arise in quantum computing environments. Considering these factors, it is essential to develop a new security framework for UAV-assisted VANETs that ensures lightweight operation, real-time performance, and scalability, while also maintaining a stable level of security in the post-quantum era. To meet this need, this study focuses on the design of quantum-resistant security mechanisms for UAV-assisted VANET environments and aims to address the limitations of existing security research.

Table 1. Overview of research trends and security limitations in UAV-assisted VANETs.

Author	Main Contributions	Limitations/Challenges
Gupta et al. [15]	Identified UAV networks as fundamentally different from MANETs/VANETs due to high mobility, intermittent connectivity, and limited energy.	Did not propose authentication or encryption mechanisms; focused mainly on topology characteristics.
Menouar et al. [16]	Proposed UAVs as extended ITS infrastructure supporting traffic monitoring, law enforcement, and emergency assistance.	Security and privacy not incorporated as core design factors; only mentioned as future research directions.
Ng et al. [17]	Utilized UAVs as relay nodes in IoV to support federated learning and enhance data reliability and model integrity.	Did not sufficiently address adversarial data manipulation or eavesdropping threats.
El-Zawawy et al. [18]	Developed BDIVE protocol combining ECC and blockchain to defend against UAV hijacking and data injection.	Blockchain verification introduces high latency and computational overhead, limiting real-time applicability.
Miao et al. [19]	Designed ECC-based mutual authentication protocol for UAV–vehicle secure communication.	Computational complexity too high for resource-constrained UAV environments.
Cui et al. [20]	Proposed lightweight authentication using chaotic maps and honeywords for UAV–vehicle communication.	Synchronization failures and reauthentication overhead in highly dynamic mobility environments.
Guo et al. [21]	Introduced zero-trust-based UAVA framework for continuous trust verification.	Frequent reauthentication causes communication overhead; privacy concerns due to continuous data collection.
Choi et al. [22]	Proposed lightweight authentication using PUF and dynamic identity for UAV environments.	Synchronization mismatches, insider threats, and multi-UAV trust management challenges remain.
Lin et al. [23]	Proposed DIHE protocol enabling mutual authentication and anonymity between UAVs and control stations.	Lack of standardized key management limits interoperability and deployment scalability.
Telikani et al. [24]	Analyzed UAV–ITS integration status and categorized UAV roles across multiple dimensions.	Pointed out the absence of unified security standards and interoperable frameworks as key deployment barriers.

summarizes the previously discussed studies on UAV-assisted VANETs, providing an overview of the technological development trends in this field and the limitations of existing security research.

3. Preliminaries

3.1. MLWE

Lattice-based cryptography originates from the learning with errors (LWE) problem proposed by Regev [25], whose average-case hardness is reducible to worst-case lattice problems such as SVP and SIVP. However, conventional LWE-based schemes suffer from inefficiencies due to high-dimensional matrix operations, which motivated the introduction of the ring learning with errors (RLWE) problem by Peikert [26] to improve efficiency using polynomial ring structures. Despite its efficiency benefits, the ring structure in RLWE introduces additional algebraic constraints that may raise concerns regarding structural attacks and limit flexibility in cryptographic design. MLWE further generalizes both LWE and RLWE, providing a flexible framework that balances security and efficiency by combining the matrix-based structure of LWE with the ring structure of RLWE. Langlois and Stehlé [27] showed that MLWE admits average-case to worst-case reductions over standard lattice problems and naturally reduces to RLWE when $k=1$ and to LWE when $R_q={\mathbb{Z}}_q$.

3.1.1. Definition of the MLWE Problem

The MLWE problem is parameterized by $(n,q,k,\chi )$ over the polynomial ring $R_q={\mathbb{Z}}_q\left[X\right]/(X^n+1)$. Here, n denotes the degree of the polynomial ring, q is a prime modulus that defines the finite field over which the polynomial coefficients are represented, k denotes the dimension of the polynomial vector, and $\chi$ specifies the probability distribution from which the error terms are sampled. Let $A\in R_q^{k\times k}$ be sampled uniformly at random, and let secret vectors s and error vectors e be sampled from the distribution $\chi$. The MLWE assumption states that distinguishing valid MLWE samples $(A,As+e)$ from uniformly random samples is computationally infeasible. The hardness of MLWE relies on worst-case lattice problems, providing strong security guarantees in the post-quantum setting.

3.1.2. Crystals-Kyber KEM

In this paper, in order to design the proposed protocol based on the security of MLWE, we adopt the MLWE-based KEM construction proposed in Crystals-Kyber [28]. Crystals-Kyber was ultimately selected as the standard algorithm for the KEM mechanism in the NIST PQC standardization process, and its security and efficiency have been extensively evaluated.

A KEM is a technique that enables two parties to securely establish a shared secret using an asymmetric cryptographic system. According to the official specification, Crystals-Kyber achieves IND-CCA2 (indistinguishability under adaptive chosen-ciphertext attack) security by applying the Fujisaki–Okamoto (FO) transformation to a public-key encryption scheme that is IND-CPA (indistinguishable under chosen-plaintext attack) secure.

Crystals-Kyber consists of the following procedures: key generation, encapsulation, and decapsulation.

• Key generation: Secret vectors $s,e\leftarrow {\chi }^k$ are sampled, and for a random matrix $A\in R_q^{k\times k}$, the following values are computed:

  $$t=A·s+e,pk=(A,t),sk=s$$
• Encapsulation: Using the receiver’s public key $pk=(A,t)$, the sender performs the following procedure. A random message $m\in {\{0,1\}}^l$ is chosen, and $r,e_1,e_2\leftarrow {\chi }^k$ are sampled. Then, the following values are computed:

  $$u=A^{\top }·r+e_1,v=t^{\top }·r+e_2+\mathrm{Encode}\left(m\right)$$
  Here, u acts as a noise-based random component, while v is responsible for hiding the message. These two values together form the ciphertext, transmitted as

  $$ct=(u,v),SK=H\left(m\right)$$
• Decapsulation: The receiver recovers the message using the secret key s by computing

  $$m^{\prime }=\mathrm{Decode}(v-u^{\top }·s),SK=H\left(m^{\prime }\right)$$

3.1.3. Message Encoding and Decoding

In Crystals-Kyber schemes, the message m is not encrypted directly. Instead, it is embedded into the ${\mathbb{Z}}_q$ domain and included within the ciphertext. The following encoding and decoding functions are used for this purpose. These transformations improve the robustness of message recovery in the presence of noise and enable secure and efficient session key agreement without requiring a reconciliation step.

• Encode: Each bit $m_i$ of the binary message $m\in {\{0,1\}}^{\ell }$ is mapped as follows:

  $$\mathrm{Encode}\left(m_i\right)=\left\{\begin{array}{cc}0\hfill & \mathrm{if}{m}_i=0\hfill \\ ⌊{\displaystyle \frac{q}{2}}⌋\hfill & \mathrm{if}{m}_i=1\hfill \end{array}\right.$$
• Decode: For each polynomial coefficient $x\in {\mathbb{Z}}_q$ obtained during decryption, the following threshold function is applied to recover the corresponding binary value:

  $$\mathrm{Decode}\left(x\right)=\left\{\begin{array}{cc}1\hfill & \mathrm{if}x\ge ⌊{\displaystyle \frac{q}{4}}⌋\hfill \\ 0\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

3.2. Physical Unclonable Function

A PUF, which is designed as a hardware-based one-way hash function, is a physical microstructure characterized by low computational requirements. A PUF generates unique input–output pairs, referred to as challenge–response pairs, that are inherently formed during the fabrication process of semiconductors and integrated circuits. Recently, PUFs have been widely adopted as a key enabling technology to strengthen authentication and key management mechanisms in various lightweight security environments, including IoT, VANETs, drone networks, and wireless medical sensor networks. PUFs generate responses to given challenges by exploiting inherent, device-specific physical variations, typically using a random bit string as the challenge input. Because the fabrication process introduces uncontrollable randomness—even from the manufacturer’s perspective—exact replication is extremely difficult [29,30,31]. Consequently, each PUF produces a distinctive response to the same challenge, and PUFs are widely regarded as resistant to cloning, thereby helping to mitigate attacks such as device replication and physical capture [32].

However, when PUF stability is limited, environmental conditions (e.g., temperature or voltage fluctuations) can affect response reproducibility. To address this issue, several classes of so-called ideal PUFs have been proposed to improve stability across wide operating ranges. For instance, certain designs exploit the randomness of soft gate-oxide breakdown locations or deliberately introduced permanent physical defects to yield more stable responses [33,34]. By adopting such ideal PUF designs, it is possible to reduce computational and storage overhead and to lessen dependence on stability-enhancement mechanisms, such as helper data or fuzzy extractors [35], while still maintaining practical deployability [36].

In this paper, the challenge value is denoted as $CH$ and the corresponding response value as $RE$, which is expressed as $RE=PUF\left(CH\right)$. The fundamental properties of PUFs are as follows.

• A PUF is a hardware circuit that cannot be cloned, and there exists no $PU{F}^{\prime }\left(CH\right)$ such that $PU{F}^{\prime }\left(CH\right)=PUF\left(CH\right)$.
• Although $PUF\left(CH\right)=RE$ can be easily computed, predicting $RE$ for a given $CH$ within polynomial time is computationally infeasible.
• The output of a PUF is statistically unpredictable. By exploiting the inherent physical randomness of PUFs, intrusive physical attacks can be effectively mitigated.

3.3. Adversary Model

To evaluate the security of the proposed scheme, we adopt the Dolev–Yao (DY) model [37], which is a standard adversarial model in network security analysis. The DY model assumes that an adversary has complete control over the public communication channel, making it well suited for analyzing open and dynamic wireless VANET environments. The specific capabilities and assumptions of the adversary are described as follows.

• The adversary can eavesdrop on, intercept, modify, delete, and replay all messages transmitted over the wireless communication channel. In addition, the adversary can disrupt ongoing sessions or actively initiate new sessions.
• The adversary may register as a legitimate user within the network and communicate lawfully with other nodes. Furthermore, based on collected information, the adversary may impersonate a vehicle, UAV, or RSU to participate in the authentication procedure or generate forged messages.
• The adversary may physically capture a vehicle’s on-board unit (OBU) or a UAV and attempt to extract stored internal information. Therefore, resistance against physical capture attacks is also considered.
• Although the UAV performs message-relaying and verification functions, it is not assumed to be fully trusted. That is, the UAV is considered a potential attack vector that may behave maliciously or leak stored data. However, by design, the UAV is strictly prevented from directly accessing core secret information, such as users’ real identities or session keys.
• The adversary may obtain encrypted messages; however, under the assumption of a secure public-key cryptosystem, the adversary cannot recover the plaintext without possessing the corresponding decryption key.
• The adversary may perform offline guessing attacks, such as repeated hash computations, based on captured messages. Nevertheless, the protocol is designed such that user identity information and secret values are not simultaneously exposed, and disclosure of a single piece of information does not enable the recovery of meaningful secret data.

It is further assumed that the trusted authority is not compromised and that the underlying cryptographic primitives, such as the employed public-key encryption and hash functions, are secure. Attacks targeting physical-layer communication, including jamming or denial-of-service (DoS), as well as side-channel attacks are considered beyond the scope of this work.

3.4. Notation

Table 2. Notation used in the scheme.

Notation	Description
$V_i,U_j,R_l$	i-th vehicle, j-th UAV, l-th RSU
$VI{D}_i,UI{D}_j,RI{D}_l$	Identifier of $V_i,U_j,R_l$
$TI{D}_i$	Pseudonym identifier of $V_i$
$A^d$	Public matrix $A\in {\mathbb{R}}^{k\times l}$
$s,s^d$	Secret key of $RA,R^d$
$p,p^d$	Public key of $RA,R^d$
$c_i=(u_i,v_i)$	Ciphertext
$k_i$	Shared secret key
$\mathrm{Encode}(·)$	Encoding function
$\mathrm{Decode}(·)$	Decoding function
$C{H}_i,C{H}_j,C{H}_l^r$	PUF challenge of $V_i,U_j,R_l$
$R{E}_i,R{E}_j,R{E}_l^r$	PUF response of $V_i,U_j,R_l$
$T{S}_1,T{S}_2,T{S}_3,T{S}_4$	Timestamps
$S{K}_a$	Session key
$h(·)$	Hash function
⊕	Bitwise XOR operation
$\mid \mid$	Concatenation operator
$u^t$	Transpose of vector u

summarizes the notation and symbols used throughout the proposed protocol.

4. Proposed Scheme

We aim to overcome the limitations of conventional public-key cryptographic systems under quantum computing threats and to establish a secure and efficient AKE mechanism for UAV-assisted VANETs. To achieve this objective, we adopt an MLWE-based KEM to ensure resistance against quantum attacks, while maintaining lightweight operation and real-time communication performance suitable for the dynamic characteristics of VANETs. In this section, we first present the overall architecture of the proposed system and the roles of the participating entities. We then describe the initialization and registration procedures, followed by the detailed AKE execution process.

4.1. Communication Entities

The descriptions of the entities participating in the communication are as follows.

4.1.1. Trusted Authority

The trusted authority (TA) is responsible for system initialization and the registration procedures of RSUs, UAVs, and vehicles. The TA distributes the essential parameters that each entity must possess for AKE. Any entity that intends to participate in communication must complete the registration process through the TA before engaging in legitimate communication.

4.1.2. Roadside Units

RSUs are essential infrastructure installed along roadways to enable real-time communication with vehicles. However, they are vulnerable to physical attacks, may be damaged in disaster or emergency situations, and their fixed deployment makes it difficult to adjust coverage. To address these limitations, UAVs can be utilized as auxiliary communication support units. When vehicles receive messages relayed by UAVs, rigorous authentication is required to ensure the reliability of the transmitted information, since inadequate authentication may allow adversaries to introduce malicious UAVs that are difficult to distinguish from legitimate ones. Meanwhile, even when UAVs assist communication, the responsibility for processing vehicular information still remains with the RSUs, and therefore RSUs continually perform the role of establishing session keys with vehicles.

4.1.3. Unmanned Aerial Vehicles

UAVs are employed as auxiliary devices in situations where RSUs are unable to maintain communication or require additional support, and they function as relays that forward messages received from vehicles to the RSUs. However, similar to RSUs, UAVs are vulnerable to physical attacks. Therefore, sensitive or confidential information is not stored on UAVs, and since the RSUs are the final recipients of the messages, UAVs cannot access or interpret their contents. Consequently, UAVs only assist in the authentication process between vehicles and RSUs and do not participate in session key generation.

4.1.4. Vehicles

All vehicles are equipped with an OBU and can participate in communication after completing the user login process using the information obtained during registration. As the entity responsible for establishing the session key with the RSU, the vehicle initiates the entire session. Since UAVs are regarded as untrusted entities, the real identity of the vehicle is protected during the authentication process, and only the RSU is able to verify it. Ultimately, the session key is exclusively established between the vehicle and the RSU, ensuring that the UAV is completely excluded from the key exchange process.

Figure 2 illustrates the overall system architecture. It shows how the TA, RSUs, UAVs, and vehicles interact with each other through the initialization, registration, and authentication processes.

4.2. Initialization Phase

Before the entire network begins operation, the TA performs an initialization process to configure the public parameters required for secure communication. Figure 3 shows the initialization process of the TA, and the detailed procedure is as follows. The TA first selects a public matrix $A\in R_q^{k\times k}$ and a cryptographic hash function $h:{0,1}^{*}\to {0,1}^k$, which maps an input of arbitrary length to a fixed-length output. Then, the TA samples the secret key and error vector $s,e\leftarrow {\chi }^k$ and computes the corresponding public key as $P=A·s+e$. After completing these steps, the TA publishes the system parameters $A,h(·),P,{\chi }^k$, so that they can be used by all network entities.

4.3. Registration Phase

All RSUs, UAVs, and vehicles that intend to participate in communication are required to complete a registration process with the TA.

4.3.1. RSU Registration

The registration process of the RSU is illustrated in Figure 4, and the detailed procedure is as follows.

Step 1: 

The RSU $R_l$ selects a unique identifier $RI{D}_l$ and randomly samples two vectors $s_l$ and $e_l$ from the distribution ${\chi }^k$. It then computes $P_l=A·s_l+e_l$. The pair $\{RI{D}_l,P_l\}$ is transmitted to the TA through a secure channel.

Step 2: 

Upon receiving $RI{D}_l$ from $R_l$, the TA generates a challenge value $C{H}_l$ and sends it to $R_l$ via a secure channel.

Step 3: 

After receiving the challenge value $C{H}_l$, $R_l$ generates the response $R{E}_l=PUF\left(C{H}_l\right)$ using its internal PUF. To conceal the secret key, $R_l$ computes $S_l=s_l\oplus R{E}_l$. Finally, $R_l$ stores the set $\{RI{D}_l,C{H}_l,P_l,S_l\}$ for future authentication and verification.

4.3.2. UAV Registration

The registration process of the UAV is illustrated in Figure 5, and the detailed procedure is as follows.

Step 1: 

The UAV $U_j$ selects a unique identifier $UI{D}_j$ and generates a challenge value $C{H}_j$. By applying $C{H}_j$ to its internal PUF, $U_j$ generates the response $R{E}_j=PUF\left(C{H}_j\right)$. Using this response, $U_j$ computes $Z_j^1=h(UI{D}_j\mid R{E}_j)$. The computed pair $\{UI{D}_j,Z_j^1\}$ is then transmitted to the TA through a secure channel.

Step 2: 

Upon receiving $\{UI{D}_j,Z_j^1\}$ from $U_j$, the TA generates a random nonce $n_j$ and forwards the set $\{UI{D}_j,Z_j^1,n_j\}$ to $R_l$. After receiving it, $R_l$ computes the PUF response $R{E}_l=PUF\left(C{H}_l\right)$ and then calculates $Z_j^2=h(UI{D}_j\mid \mid n_j\mid \mid R{E}_l\mid \mid s_l)$. In addition, $R_l$ generates $Z_j^3=(n_j\mid \mid Z_j^1)\oplus h(R{E}_l\mid \mid s_l)$ and stores the tuple $\{UI{D}_j,Z_j^3\}$ for subsequent authentication.

Step 3: 

The TA sends $Z_j^2$ received from $R_l$ to $U_j$. The UAV then computes $Z_j^4=Z_j^1\oplus Z_j^2$ and stores the set $\{UI{D}_j,C{H}_j,Z_j^4\}$ to complete the registration procedure.

4.3.3. Vehicle Registration

The vehicle registration process is shown in Figure 6, and the detailed procedure is as follows.

Step 1: 

The vehicle $V_i$ selects a unique identifier $VI{D}_i$ and sends it to the TA through a secure channel.

Step 2: 

Upon receiving $VI{D}_i$, the TA generates a random nonce $n_i$ and forwards the set $\{VI{D}_i,n_i\}$ to the RSU $R_l$. Then, $R_l$ applies the challenge $C{H}_l$ to its PUF to obtain the response $R{E}_l=PUF\left(C{H}_l\right)$. Using this response, $R_l$ computes $Z_i^1=n_i\oplus h(VI{D}_i\mid R{E}_l)$ and stores the pair $\{VI{D}_i,Z_i^1\}$ for subsequent authentication.

Step 3: 

The TA sends the received $n_i$ to $V_i$. The vehicle then generates a random value $s_i$ and a challenge $C{H}_i$, and computes the corresponding PUF response $R{E}_i=PUF\left(C{H}_i\right)$. It then calculates $Z_i^2=n_i\oplus h(R{E}_i\mid \mid s_i)$ and derives $S_i=s_i\oplus R{E}_i$. Finally, $V_i$ stores the set $\{VI{D}_i,C{H}_i,Z_i^2,S_i\}$ to complete the registration procedure.

4.4. Authentication and Key Exchange Phase

The vehicle must establish a session key with the RSU while receiving relay support from the UAV for data transmission, and the protocol is designed to enable mutual authentication among the RSU, UAV, and vehicle to ensure secure communication. The AKE procedure is illustrated in Figure 7, and the detailed process is described as follows.

Step 1: 

The vehicle $V_i$ computes the PUF response $R{E}_i=PUF\left(C{H}_i\right)$ using its identifier $VI{D}_i$ as input, and derives $S_i=s_i\oplus R{E}_i$ and $n_i^{*}=Z_i^2\oplus h(R{E}_i\mid s_i)$. It then generates random vectors $r_i,t_i^1,t_i^2\in {\chi }^k$ and a message $m_i\in {\{0,1\}}^k$. After generating a timestamp $T{S}_1$, the following computations are performed: $u_i=A^T·r_i+t_i^1$, $v_i=P_i·r_i+t_i^2+Encode\left(m_i\right)$, $c_i=(u_i,v_i)$, and $k_i=h\left(m_i\right)$. The vehicle then computes $TI{D}_i=VI{D}_i\oplus h(k_i\mid \mid T{S}_1)$, $V_1=h(VI{D}_i\mid \mid n_i\mid \mid n_i^{*}\mid \mid k_i\mid \mid T{S}_1)$, $V_2=h(TI{D}_i\mid \mid UI{D}_j\mid \mid n_i)$, and $N_1=n_i\oplus h(VI{D}_i\mid \mid n_i\mid \mid k_i\mid \mid T{S}_1)$. Finally, $V_i$ sends $\{TI{D}_i,c_i,V_1,V_2,N_1,T{S}_1\}$ to $U_j$.

Step 2: 

Upon receiving the message, $U_j$ first verifies the validity of $T{S}_1$ and then generates its own timestamp $T{S}_2$. It subsequently computes $R{E}_j=PUF\left(C{H}_j\right)$, $Z_j^{1*}=h(UI{D}_j\mid \mid R{E}_j)$, and $Z_j^{2*}=Z_j^3\oplus Z_j^{1*}$. Next, it computes $V_3=h(TI{D}_i\mid \mid UI{D}_j\mid \mid V_1\mid \mid Z_j^{2*}\mid \mid T{S}_2)$. Finally, $U_j$ forwards the set $\{TI{D}_i,UI{D}_j,c_i,V_3,N_1,T{S}_1,T{S}_2\}$ to the RSU $R_l$.

Step 3: 

Upon receiving the request, $R_l$ verifies the timestamp $T{S}_2$ and computes its PUF response $R{E}_l=PUF\left(C{H}_l\right)$. It then derives $S_i^{*}=S_l\oplus R{E}_l$, $n_i=Z_j^3\oplus h(R{E}_l\mid \mid s_l)$, and $Z_j=h(UI{D}_j\mid \mid n_i\mid \mid R{E}_l\mid \mid s_l)$. After that, $R_l$ computes $V_3^{*}=h(TI{D}_i\mid \mid UI{D}_j\mid \mid V_1\mid \mid Z_j\mid \mid T{S}_2)$ and checks whether $V_3^{*}=V_3$. If the verification is successful, $R_l$ generates the session key $SK=h(VI{D}_i\mid \mid UI{D}_j\mid \mid RI{D}_l\mid \mid n_i\mid \mid k_i\mid \mid T{S}_3)$, computes $N_2=n_i^{*}\oplus h(Z_j\mid \mid T{S}_3)$, and generates $V_4=h(RI{D}_l\mid \mid UI{D}_j\mid \mid Z_j\mid \mid n_i^{*}\mid \mid T{S}_3)$ and $V_5=h(RI{D}_l\mid \mid VI{D}_i\mid \mid SK\mid \mid T{S}_3)$. Finally, $R_l$ sends $\{RI{D}_l,N_2,V_4,V_5,T{S}_3\}$ to $U_j$.

Step 4: 

After receiving the message, $U_j$ first verifies $T{S}_3$, and then computes $n_i=N_2\oplus h(Z_j\mid \mid T{S}_3)$ and $V_4^{*}=h(RI{D}_l\mid \mid UI{D}_j\mid \mid Z_j\mid \mid n_i\mid \mid T{S}_3)$ to verify whether $V_4^{*}=V_4$. It also computes $V_2^{*}=h(TI{D}_i\mid \mid UI{D}_j\mid \mid n_i)$ and checks whether $V_2^{*}=V_2$. If all verifications are successful, $U_j$ generates a new timestamp $T{S}_4$ and computes $V_6=h(TI{D}_i\mid \mid UI{D}_j\mid \mid n_i\mid \mid V_5\mid \mid T{S}_4)$. It then sends $\{RI{D}_l,UI{D}_j,V_5,V_6,T{S}_4\}$ to $V_i$.

Step 5: 

Finally, $V_i$ verifies the freshness of $T{S}_4$ and computes $V_6^{*}=h(TI{D}_i\mid \mid UI{D}_j\mid \mid n_i\mid \mid V_5\mid \mid T{S}_4)$ to check whether $V_6^{*}=V_6$. If the verification succeeds, the vehicle derives the session key $S{K}^{*}=h(VI{D}_i\mid \mid UI{D}_j\mid \mid RI{D}_l\mid \mid n_i\mid \mid k_i\mid \mid T{S}_3)$ and computes $V_5^{*}=h(RI{D}_l\mid \mid VI{D}_i\mid \mid S{K}^{*}\mid \mid T{S}_3)$ to verify whether $V_5^{*}=V_5$. Once all verification steps are successfully completed, mutual authentication among $V_i$, $U_j$, and $R_l$ is achieved. Thereafter, a secure session key is successfully established between $V_i$ and $R_l$, ensuring confidential communication.

4.5. Vehicle Revocation

The proposed scheme provides robust resistance against various network and physical attacks by utilizing Crystals-Kyber KEM and PUF. However, practical deployment requires consideration of additional threat scenarios, such as physical OBU damage, UAV capture, PUF spoofing, and long-term secret leakage. To address these issues, we define a dynamic revocation mechanism.

In this framework, a vehicle $V_i$ is designated for revocation if it meets any of the following criteria: (1) extraction of internal stored values due to OBU theft or damage; (2) compromise of long-term secret information; (3) repeated inconsistencies in PUF responses to the same challenge indicating hardware unreliability; or (4) repeated transmission of false information and violations of network operational policies.

Vehicles identified by these conditions are registered in a revocation list ($RL$) managed by the $TA$, with the specific procedure for revocation and authentication filtering detailed in Algorithm 1. During the authentication and key establishment process, the $RSU$ verifies the vehicle’s identity. If $V_i$ is found to be compromised, the $RSU$ immediately sends a revocation request containing $VI{D}_i$ to the $TA$. Upon receipt, the $TA$ updates the $RL$ and distributes it to all $RSUs$. Subsequently, any $RSU$ performing authentication cross-references the $RL$; if $VI{D}_i$ is present, the process is terminated, and the request is rejected to ensure network integrity.

Algorithm 1 Vehicle Authentication and Dynamic Revocation Procedure

Require:  $V_i$, $RSU$, $TA$, $RL$ Ensure:  Session Key $SK$ or $VI{D}_i$ added to $RL$   1: Step 1: Vehicle Authentication Request   2: $V_i$ sends authentication request with $VI{D}_i$ to $RSU$.   3: Step 2: RL Verification (by RSU)   4: if$VI{D}_i\in RL$then   5:    $RSU$ rejects the request and terminates the session. {Vehicle is revoked}   6: else   7:    $RSU$ proceeds with authentication.   8:    Step 3: Authentication and Anomaly Detection   9:    if Authentication is successful and No malicious behavior detected then 10:      $RSU$ and $V_i$ establish Session Key $SK$. 11:      Service granted to $V_i$. 12:    else 13:      {Condition: PUF mismatch, OBU compromise, or protocol violation} 14:      $RSU$ identifies $V_i$ as a malicious/compromised vehicle. 15:      $RSU\to TA:\{VI{D}_i, \text{Revocation\_Request}\}$ 16:    end if 17: end if 18: Step 4: RL Update and Distribution (by TA) 19: if$TA$ receives Revocation Request for $VI{D}_i$ then 20:    $TA$ updates Revocation List: $RL\leftarrow RL\cup \left\{VI{D}_i\right\}$. 21:    $TA$ broadcasts the updated $RL$ to all $RSUs$ in the network. 22: end if

5. Security Analysis

In this section, we analyze the robustness and mutual authentication guarantees of the proposed scheme against various attacks based on informal analysis, the RoR model, BAN logic, and AVISPA.

5.1. Informal Analysis

5.1.1. Replay Attack

Under the Dolev–Yao model, an adversary A can intercept, store, and replay previously transmitted messages over the public channel. For instance, A may replay the message $\{TI{D}_i,c_i,V_1,V_2,N_1,T{S}_1\}$ in a different session in an attempt to impersonate $V_i$. However, the protocol binds all authentication tokens to fresh timestamps and session-specific nonces. In particular, $TI{D}_i=VI{D}_i\oplus h(k_i\parallel T{S}_1)$, $V_1=h(VI{D}_i\parallel n_i\parallel n_1\parallel k_i\parallel T{S}_1)$, and $N_1=n_1\oplus h(VI{D}_i\parallel n_i\parallel k_i\parallel T{S}_1)$. Therefore, $TI{D}_i$, $V_1$, and $N_1$ are tightly coupled with the session timestamp $T{S}_1$ and nonce $n_1$. If A replays an old message, the freshness check of $T{S}_1$ fails. Even if A attempts to manipulate $T{S}_1$, the hash bindings involving $k_i$, $n_i$, and $VI{D}_i$ will not be satisfied, causing verification failure. Similarly, later messages such as $\{RI{D}_l,N_2,V_4,V_5,T{S}_3\}$ and $\{RI{D}_l,UI{D}_j,V_5,V_6,T{S}_3,T{S}_4\}$ are also bound to fresh timestamps and session-dependent secrets. Hence, previously captured messages cannot be reused in subsequent sessions, and the protocol is secure against replay attacks.

5.1.2. MITM Attack

An adversary A may attempt a man-in-the-middle attack by intercepting and modifying the exchanged messages among $V_i$, $U_j$, and $R_l$. However, mutual authentication and session key establishment ultimately depend on the MLWE-derived shared secret $k_i$. Specifically, $V_i$ generates a random message $m_i$ and computes $k_i=h\left(m_i\right)$, transmitting the ciphertext $c_i=(u_i,v_i)$. The RSU $R_l$ recovers $m_i^{*}=Decode(v_i-u_i^T·s_l^{*})$ using its private key $s_l$, and then computes $k_i^{*}=h\left(m_i^{*}\right)$. The session key is derived as $SK=h(VI{D}_i^{*}\parallel UI{D}_j\parallel RI{D}_l\parallel n_1^{*}\parallel k_i^{*}\parallel T{S}_3)$. Without the legitimate private key $s_l$, an adversary cannot recover $m_i$ or derive $k_i$. Any modification of $c_i$ results in an invalid $k_i$, which consequently invalidates $SK$ and the authentication tokens $V_4$, $V_5$, and $V_6$. Since forging a consistent session requires solving the underlying MLWE problem or recovering $s_l$, which is computationally infeasible, the protocol is secure against MITM attacks.

5.1.3. Insider Attack

A malicious insider who has completed registration may attempt to exploit stored registration information together with observed protocol messages to derive authentication credentials or session keys. In the proposed protocol, the authentication parameter $n_i$ is protected by the vehicle’s PUF. It is reconstructed during authentication as $R{E}_i^{*}=PUF\left(C{H}_i\right)$ and $n_i^{*}=Z_i^2\oplus h(R{E}_i^{*}\parallel S_i)$. Since $R{E}_i^{*}$ cannot be reproduced without access to the physical PUF device, $n_i$ cannot be reconstructed from registration records alone. Furthermore, the session secret $k_i=h\left(m_i\right)$ is derived from $m_i$, which is encapsulated in $c_i=(u_i,v_i)$ and recoverable only through MLWE decapsulation using the RSU private key $s_l$. Without $s_l$, an insider cannot obtain $m_i$ or $k_i$. Because the session key $SK=h(VI{D}_i^{*}\parallel UI{D}_j\parallel RI{D}_l\parallel n_1^{*}\parallel k_i^{*}\parallel T{S}_3)$ depends on both $n_i$-related values and $k_i$, an insider observing protocol messages cannot derive a valid session key. Therefore, the protocol is secure against insider attacks.

5.1.4. Privileged Insider Attack

A privileged insider with access to stored registration data such as $\{RI{D}_l,P_l,UI{D}_j,Z_j^1,VI{D}_i\}$ may attempt to exploit this information to impersonate entities or derive session secrets. However, these stored parameters do not include runtime secrets or PUF-derived responses. The authentication parameter $n_i$ depends on $R{E}_i^{*}=PUF\left(C{H}_i\right)$ and $n_i^{*}=Z_i^2\oplus h(R{E}_i^{*}\parallel S_i)$, which require access to the legitimate physical PUF. Similarly, the session secret $k_i=h\left(m_i\right)$ is derived from $m_i$, encapsulated in $c_i=(u_i,v_i)$ and recoverable only through MLWE decapsulation using the private key $s_l$. Since $s_l$ is not stored in registration records and cannot be derived from public information, $k_i$, and consequently $SK$, cannot be computed. Therefore, even a privileged insider with access to registration data cannot reconstruct authentication tokens or establish a valid session key. The protocol is secure against privileged insider attacks.

5.1.5. Vehicle Impersonation Attack

An adversary may attempt to impersonate a vehicle by forging the message $\{TI{D}_i,c_i,V_1,V_2,N_1,T{S}_1\}$. However, such an attempt cannot succeed due to the cryptographic dependencies embedded in these values. The verifier $V_1$ is computed as $V_1=h(VI{D}_i\parallel n_i\parallel n_1\parallel k_i\parallel T{S}_1)$, where $n_i$ is protected by the vehicle’s PUF and recovered through $R{E}_i^{*}=PUF\left(C{H}_i\right)$ and $n_i^{*}=Z_i^2\oplus h(R{E}_i^{*}\parallel S_i)$. Since the adversary cannot reproduce the PUF response $R{E}_i^{*}$, it cannot derive the correct $n_i$. Furthermore, $TI{D}_i$ is generated as $TI{D}_i=VI{D}_i\oplus h(k_i\parallel T{S}_1)$, which binds the true identity $VI{D}_i$ to the session secret $k_i$. Without knowledge of $VI{D}_i$ and $k_i$, the adversary cannot construct a valid $TI{D}_i$. Because both $n_i$ and $VI{D}_i$ remain unknown to the adversary, it is infeasible to compute a valid $V_1$ or related authentication tokens. Any forged message will therefore fail the verification procedures, and the proposed protocol is secure against vehicle impersonation attacks.

5.1.6. UAV Impersonation Attack

An adversary may attempt to impersonate a UAV by forging the message $\{TI{D}_i,UI{D}_j,c_i,V_1,V_3,N_1,T{S}_1,T{S}_2\}$. However, the computation of $V_3$ requires the value $Z_j^{2*}$, which is derived from the PUF response $R{E}_j^{*}=PUF\left(C{H}_j\right)$. Specifically, $Z_j^{1*}=h(UI{D}_j\parallel R{E}_j^{*})$ and $Z_j^{2*}=Z_j^4\oplus Z_j^{1*}$, and $V_3$ is computed as $V_3=h(TI{D}_i\parallel UI{D}_j\parallel V_1\parallel Z_j^{2*}\parallel T{S}_2)$. Since the adversary cannot obtain the legitimate PUF response $R{E}_j^{*}$, it cannot construct a valid $Z_j^{2*}$ and consequently cannot generate a correct $V_3$. Therefore, any forged UAV message will fail the RSU’s verification, and the proposed protocol is secure against UAV impersonation attacks.

5.1.7. RSU Impersonation Attack

An adversary may attempt to impersonate an RSU by forging the message $\{RI{D}_l,N_2,V_4,V_5,T{S}_3\}$. The values $V_4$ and $N_2$ depend on $Z_j^1$, which can only be derived through either the UAV’s PUF or the RSU’s PUF. Moreover, computing $V_5$ requires knowledge of the session key $SK$, and the construction of $SK$ depends on $k_i$, which is derived from $n_i$, obtained via the vehicle or RSU PUF, and the RSU’s private key $s_l$. Since $s_l$ is protected by the RSU’s PUF, the adversary cannot recover $k_i$ or $SK$. Therefore, the proposed protocol is secure against RSU impersonation attacks.

5.1.8. Vehicle Theft Attack

If an adversary physically steals a vehicle, they may extract stored data $\{VI{D}_i,C{H}_i,Z_i^2,S_i\}$ through invasive or exhaustive extraction techniques. However, the long-term secret information required for authentication remains protected by the vehicle’s PUF. In particular, during authentication the vehicle reconstructs $R{E}_i^{*}=PUF\left(C{H}_i\right)$ and derives $n_i^{*}=Z_i^2\oplus h(R{E}_i^{*}\parallel S_i)$ (and similarly recovers $s_i^{*}$ from $S_i\oplus R{E}_i^{*}$). Even if $C{H}_i$, $Z_i^2$, and $S_i$ are exposed, an adversary cannot reproduce the correct PUF response $R{E}_i^{*}$ without access to the genuine unclonable PUF, and thus cannot reconstruct valid $n_i$ (or related authentication materials). Consequently, the extracted data cannot be exploited to compute valid authenticators such as $V_1=h(VI{D}_i\parallel n_i\parallel n_1\parallel k_i\parallel T{S}_1)$ or to impersonate $V_i$ in the AKE phase. Therefore, the proposed protocol is secure against vehicle theft attacks.

5.1.9. UAV Capture Attack

An adversary may physically capture a UAV and extract the stored items $\{UI{D}_j,C{H}_j,Z_j^4\}$. However, the captured data alone is insufficient to forge valid UAV-side authentication tokens. In the proposed protocol, the UAV computes $R{E}_j^{*}=PUF\left(C{H}_j\right)$ and derives $Z_j^{1*}=h(UI{D}_j\parallel R{E}_j^{*})$, then obtains $Z_j^{2*}=Z_j^4\oplus Z_j^{1*}$, which is required to generate $V_3=h(TI{D}_i\parallel UI{D}_j\parallel V_1\parallel Z_j^{2*}\parallel T{S}_2)$. Without the genuine PUF response $R{E}_j^{*}$, an adversary cannot compute $Z_j^{1*}$ and thus cannot recover $Z_j^{2*}$ from $Z_j^4$. As a result, any attempt to forge $\{TI{D}_i,UI{D}_j,c_i,V_1,V_3,N_1,T{S}_1,T{S}_2\}$ will fail the RSU verification of $V_3$. Therefore, the proposed protocol is resistant to UAV capture attacks.

5.1.10. RSU Table Leakage Attack

An adversary may attempt to extract the table stored in the RSU, i.e., $\{RI{D}_l,C{H}_l,P_l,S_l,UI{D}_j,Z_j^3,VI{D}_i,Z_i^1\}$. Nevertheless, leaking these stored parameters does not enable the adversary to reconstruct the secret values required for authentication or to derive the session key. In the AKE phase, the RSU derives PUF-dependent secrets by computing $R{E}_l^{*}=PUF\left(C{H}_l\right)$ and recovering $s_l^{*}=S_l\oplus R{E}_l^{*}$, and it further computes $Z_j^{2**}=h(UI{D}_j\parallel n_j^{*}\parallel R{E}_l^{*}\parallel s_l^{*})$ to verify $V_3$ via $V_3^{*}=h(TI{D}_i\parallel UI{D}_j\parallel V_1\parallel Z_j^{2**}\parallel T{S}_2)$. Moreover, the RSU must decapsulate the MLWE ciphertext by computing $m_i^{*}=Decode(v_i-u_i^T·s_l^{*})$ and $k_i^{*}=h\left(m_i^{*}\right)$, which are subsequently used to derive $SK=h(VI{D}_i^{*}\parallel UI{D}_j\parallel RI{D}_l\parallel n_1^{*}\parallel k_i^{*}\parallel T{S}_3)$. Since the critical PUF response $R{E}_l^{*}$ cannot be derived from $C{H}_l$ alone and the private key material $s_l^{*}$ cannot be reconstructed without $R{E}_l^{*}$, the adversary cannot compute valid authentication tokens or the session key using only the leaked table information. Therefore, the proposed scheme is secure against RSU table leakage attacks.

5.1.11. Session Key Disclosure Attack

An adversary may attempt to recover the session key by combining previously obtained information with values observed over the public channel. In the proposed protocol, the session key is computed as $SK=h(VI{D}_i^{*}\parallel UI{D}_j\parallel RI{D}_l\parallel n_1^{*}\parallel k_i^{*}\parallel T{S}_3)$, where the critical component $k_i^{*}$ is established through the MLWE-based KEM. Specifically, $k_i^{*}=h\left(m_i^{*}\right)$ and $m_i^{*}=Decode(v_i-u_i^T·s_l^{*})$, which requires the RSU’s private key $s_l^{*}$ to decapsulate the ciphertext $c_i=(u_i,v_i)$. Since $s_l^{*}$ is protected via the RSU’s PUF by $s_l^{*}=S_l\oplus R{E}_l^{*}$ with $R{E}_l^{*}=PUF\left(C{H}_l\right)$, an adversary observing $c_i$ and public transcripts cannot reconstruct $s_l^{*}$ and thus cannot obtain $m_i^{*}$ or $k_i^{*}$. Furthermore, $n_1^{*}$ is also entangled with the authenticated transcript through $N_1=n_1\oplus h(VI{D}_i\parallel n_i\parallel k_i\parallel T{S}_1)$ and subsequent verifications, preventing an attacker from substituting values to derive a consistent $SK$. Therefore, under the assumed security of the MLWE problem and the unclonability of the PUF, neither passive observation nor combined attacks enable session key disclosure.

5.1.12. Key-Compromise Impersonation Attack

Consider the compromise of vehicle-side secrets such as $n_i$ or $s_i$ belonging to $V_i$. An adversary may attempt to use these leaked values to impersonate an RSU or UAV toward $V_i$, or to forge valid authentication messages. However, establishing a valid session still requires the computation of $k_i$, which is derived as $k_i=h\left(m_i\right)$, where $m_i$ is encapsulated in the MLWE ciphertext $c_i=(u_i,v_i)$. Recovering $m_i$ requires decapsulation using the RSU private key $s_l$ via $m_i^{*}=Decode(v_i-u_i^T·s_l^{*})$. Since $s_l^{*}$ is protected through the RSU’s PUF by $s_l^{*}=S_l\oplus R{E}_l^{*}$ with $R{E}_l^{*}=PUF\left(C{H}_l\right)$, an adversary cannot derive $k_i$ without access to the legitimate RSU device. Moreover, the session key is computed as $SK=h(VI{D}_i^{*}\parallel UI{D}_j\parallel RI{D}_l\parallel n_1^{*}\parallel k_i^{*}\parallel T{S}_3)$, which depends on $k_i$. Therefore, even if $n_i$ or $s_i$ are compromised, the adversary cannot impersonate another entity toward $V_i$ without knowledge of $k_i$. Hence, under the assumption that PUF-protected private keys remain secure, the protocol is resistant to KCI attacks.

5.1.13. Anonymity

In the proposed protocol, the vehicle communicates using a temporary identifier $TI{D}_i$ derived as $TI{D}_i=VI{D}_i\oplus h(k_i\parallel T{S}_1)$. Since $k_i$ is a session-dependent secret established via the MLWE-based KEM and known only to $V_i$ and $R_l$, the real identity $VI{D}_i$ is never transmitted over the public channel. Because recovering $VI{D}_i$ from $TI{D}_i$ requires knowledge of $k_i$, which in turn depends on the RSU’s private key, external observers cannot obtain the true identity of the vehicle. Therefore, the protocol provides anonymity for participating vehicles.

5.1.14. Untraceability

The pseudonym $TI{D}_i$ is generated using session-specific values $k_i$ and $T{S}_1$, both of which are freshly generated in each session. Since $k_i$ changes due to new randomness in $m_i$ and the MLWE encapsulation, and $T{S}_1$ varies per session, $TI{D}_i$ is unlinkable across different sessions. Consequently, an external adversary observing multiple protocol executions cannot correlate different $TI{D}_i$ values to the same $VI{D}_i$. Therefore, the proposed protocol achieves untraceability for vehicular communications.

5.1.15. Conditional Traceability

Although a fresh pseudonym $TI{D}_i$ is generated in each session to ensure anonymity and unlinkability, the RSU retains the capability to trace a pseudonym to the real identity when necessary. Since the RSU participates in the MLWE decapsulation process to recover $m_i^{*}$ and compute $k_i^{*}$, it can derive $VI{D}_i^{*}=TI{D}_i\oplus h(k_i^{*}\parallel T{S}_1)$ during authentication. Thus, in the event of malicious behavior, the RSU can correlate authentication transcripts with stored secret information and recover the true identity of the vehicle. This mechanism enables conditional traceability while preserving privacy under normal operation.

5.1.16. Perfect Forward Secrecy

All session-specific secrets in the AKE phase are freshly generated. The value $m_i$ is randomly chosen in each session, leading to a fresh $k_i=h\left(m_i\right)$. The nonce $n_1$ and timestamps such as $T{S}_3$ are also newly generated. Since the session key $SK=h(VI{D}_i^{*}\parallel UI{D}_j\parallel RI{D}_l\parallel n_1^{*}\parallel k_i^{*}\parallel T{S}_3)$ depends on fresh randomness and on $k_i$, which is derived from the MLWE encapsulation process, compromise of long-term stored data or previous session keys does not enable an adversary to derive future session keys. Therefore, the protocol achieves perfect forward secrecy under the MLWE hardness assumption.

5.1.17. Key Freshness

The session key is computed as $SK=h(VI{D}_i^{*}\parallel UI{D}_j\parallel RI{D}_l\parallel n_1^{*}\parallel k_i^{*}\parallel T{S}_3)$, where $n_1^{*}$, $k_i^{*}$, and $T{S}_3$ are session-dependent values. The nonce $n_1$ is randomly generated in each execution, and $k_i$ is derived from a freshly chosen $m_i$ encapsulated through MLWE. Because these inputs are independently regenerated in every session, each instance of $SK$ is independent from previous session keys. This prevents key reuse and ensures that compromise of one session does not affect others. Hence, the protocol guarantees key freshness.

5.1.18. Mutual Authentication

Three-party mutual authentication is achieved through the verification of hash-based authenticators. The RSU authenticates $V_i$ and $U_j$ by verifying $V_1$ and $V_3$. The UAV authenticates $V_i$ and $R_l$ through verification of $V_2$ and $V_4$. Finally, the vehicle authenticates $U_j$ and $R_l$ by verifying $V_5$ and $V_6$. Each authentication token is bound to session-specific nonces and timestamps, such as $V_1=h(VI{D}_i\parallel n_i\parallel n_1\parallel k_i\parallel T{S}_1)$ and $V_6=h(TI{D}_i\parallel UI{D}_j\parallel n_1\parallel V_5\parallel T{S}_4)$. Long-term secrets involved in these computations are protected by PUF-derived responses and private keys. Consequently, only legitimate entities can produce valid authenticators, and the protocol ensures secure three-party mutual authentication.

5.2. Formal Analysis Using AVISPA

To formally verify the proposed protocol, we employ AVISPA [38], a widely used tool for security evaluation. AVISPA is a well-known simulation framework for verifying the security of internet protocols and applications, and it is particularly effective in assessing vulnerabilities such as replay attacks and MITM attacks. The tool uses code written in the high-level protocol specification language (HLPSL) and supports four backend verification engines: the constraint-logic-based attack searcher (CL-AtSe), the on-the-fly model checker (OFMC), the SAT-based model checker (SATMC), and the tree automata-based protocol analyzer (TA4SP). For security property evaluation, HLPSL code is first translated into an intermediate format using the HLPSL2IF translator, after which the backend models perform formal verification.

To validate the security properties of the proposed protocol, the communication procedures described in Section 4 were implemented in HLPSL. Each participating entity (vehicle, UAV, and RSU) was modeled according to its defined operations in the AKE process. The corresponding HLPSL code for each entity is presented in Figure 8.

In this paper, the OFMC and CL-AtSe backend modules were used to simulate the proposed scheme. Figure 9 presents the simulation results, demonstrating that the outputs of both the OFMC and CL-AtSe backend models are classified as SAFE. Therefore, the proposed scheme is capable of resisting replay attacks and MITM attacks.

5.3. Formal Analysis Using the RoR Model

In this paper, we prove the semantic security of the proposed protocol using the RoR model [39]. This model has been widely adopted in prior studies [22,40] for analyzing the security of authentication protocols. In the RoR model, an adversary A interacts with protocol instances and attempts to distinguish the session key $SK$ from a random value. Each participating instance is denoted as $p^t$, where p represents the entity identifier (e.g., $V_i$, $U_j$, $R_k$) and t denotes the instance index. Under the RoR framework, the adversary A can perform both active and passive attacks by issuing a set of queries to reveal information about the session key, which are summarized in

Table 3. Queries and description in RoR model.

Query	Description
$Execute(p_{V_i}^{t_1},p_{U_j}^{t_2},p_{R_l}^{t_3})$	Simulates passive eavesdropping, where A collects all exchanged messages during the protocol run.
$Corrupt\left(p_{V_i}^{t_1}\right)$	Grants A access to the internal memory of the vehicle $V_i$, exposing stored parameters such as $\{VI{D}_i,C{H}_i,Z_i^2,S_i\}$.
$Send(p^t,M)$	Models active attacks by letting A send forged messages M to any participant instance and observe the output.
$Test\left({\mathsf{\Pi }}^{*}\right)$	Used once to challenge the security of the protocol. If $c=1$, the real session key $SK$ is returned; if $c=0$, a random string of the same length is returned. A must guess the value of c.

.

In this paper, $\mid PUF\mid$ and $\mid Hash\mid$ denote the output ranges of the PUF $PUF(·)$ and the hash function $H(·)$, respectively. In addition, $q_p$ and $q_h$ represent the number of PUF and hash queries performed by the adversary A.

Proof. 

Let $Adv\left(A\right)$ denote the advantage of adversary A in distinguishing the session key. The security is analyzed through a sequence of games $G_0$ to $G_4$ as follows:

• $G_0$: In the initial game, A has no information. Therefore,

  $$Adv\left(A\right)=Ad{v}_{G_1}\left(A\right)$$

  (1)
• $G_1$: A issues Execute queries and can observe the complete transcripts. Since $SK=h(VI{D}_i\mid \mid UI{D}_j\mid \mid RI{D}_l\mid \mid n_1\mid \mid k_i\mid \mid T{S}_3)$ and $k_i$ is derived through an IND-CCA-secure MLWE-based KEM, A cannot infer $SK$ through passive observation alone. Thus,

  $$Ad{v}_{G_0}\left(A\right)=Ad{v}_{G_1}\left(A\right)$$

  (2)
• $G_2$: A is allowed to perform Send and Hash queries. The only way to reveal $SK$ is to find a collision in the hash function $h(·)$. Using the birthday bound,

  $$\mid Ad{v}_{G_2}\left(A\right)-Ad{v}_{G_1}\left(A\right)\mid \le {\displaystyle \frac{q_h^2}{2\mid Hash\mid }}$$

  (3)
• $G_3$: A may issue malicious queries and attempt to extract the secret credentials $\{VI{D}_i,C{H}_i,Z_i^2,S_i\}$ from the vehicle via power analysis attacks. However, note that $N_1=n_1\oplus h(VI{D}_i\mid n_i\mid k_i\mid T{S}_1)$ and $n_i=Z_i^2\oplus h(R{E}_i\mid s_i)$. To expose the session key, A must guess $n_i$ using Send and PUF queries. Hence,

  $$\mid Ad{v}_{G_3}\left(A\right)-Ad{v}_{G_2}\left(A\right)\mid \le {\displaystyle \frac{q_p^2}{2\mid PUF\mid }}$$

  (4)
• $G_4$: Finally, the success of A depends on recovering $k_i$ by inverting the MLWE-based ciphertext $c_i$, which is computationally infeasible under the MLWE assumption:

  $$\mid Ad{v}_{G_4}\left(A\right)-Ad{v}_{G_3}\left(A\right)\mid \le Ad{v}_A^{MLWE}$$

  (5)

By the triangle inequality:

$$\begin{array}{cc}\hfill \mid Ad{v}_{G_4}\left(A\right)-Ad{v}_{G_1}\left(A\right)\mid & \le \mid Ad{v}_{G_4}\left(A\right)-Ad{v}_{G_3}\left(A\right)\mid +\mid Ad{v}_{G_3}\left(A\right)-Ad{v}_{G_2}\left(A\right)\mid \hfill \\ \hfill & +\mid Ad{v}_{G_2}\left(A\right)-Ad{v}_{G_1}\left(A\right)\mid \hfill \\ \hfill & \le {\displaystyle \frac{q_h^2}{2\mid Hash\mid }}+{\displaystyle \frac{q_p^2}{2\mid PUF\mid }}+Ad{v}_A^{MLWE}\hfill \end{array}$$

(6)

Therefore, the overall advantage of the adversary is bounded as

$$Adv\left(A\right)\le {\displaystyle \frac{q_h^2}{2\mid Hash\mid }}+{\displaystyle \frac{q_p^2}{2\mid PUF\mid }}+Ad{v}_A^{MLWE}$$

(7)

Thus, the proposed protocol is semantically secure under the RoR model, assuming the hardness of the hash function, the PUF, and the MLWE problem. □

5.4. Formal Analysis Using BAN Logic

To demonstrate the correctness of the proposed protocol, we employ BAN logic [41]. BAN logic is a formal analytical method used to verify whether a shared session key can be securely established among communicating entities within a security protocol.

The BAN logic-based analysis proceeds as follows. First, the security goals of the protocol are defined. Then, the protocol messages are transformed into their idealized abstract forms. Subsequently, the required initial assumptions are specified, and the axioms and inference rules of BAN logic are applied to verify whether each communicating party can derive the intended security properties.

Before conducting the BAN logic analysis, we define the notation used throughout the formal reasoning process, along with brief explanations. The primary BAN logic symbols employed in this paper are summarized in

Table 4. BAN logic notation.

Notation	Description
${\rho }_1,{\rho }_2$	Two principals
$s_1,s_2$	Two statements
${\rho }_1|$≡$s_1$	${\rho }_1$  believes  $s_1$
${\rho }_1|$∼$s_1$	${\rho }_1$ once said $s_1$
${\rho }_1$⇒$s_1$	${\rho }_1$  controls  $s_1$
${\rho }_1$⊲${\mu }_1$	${\rho }_1$  receives  $s_1$
$\#s_1$	$s_1$ is fresh
${\left(s_1\right)}_K$	$s_1$ is encrypted with K
${\rho }_1\stackrel{K}{\leftrightarrow }$${\rho }_2$	${\rho }_1$ and ${\rho }_2$ have shared key K
$SK$	The session key

.

5.4.1. BAN Logic Rules

1.

Message meaning rule (MMR):

$${\displaystyle \frac{{\rho }_1\mid \equiv {\rho }_1\stackrel{K}{\leftrightarrow }{\rho }_2,{\rho }_1⊲{\left(s_1\right)}_K}{{\rho }_1\mid \equiv {\rho }_2\mid \sim s_1}}$$

2.

Nonce verification rule (NVR):

$${\displaystyle \frac{{\rho }_1\mid \equiv \#\left(s_1\right),{\rho }_1\mid \equiv {\rho }_2\mid \sim s_1}{{\rho }_1\mid \equiv {\rho }_2\mid \equiv s_1}}$$

3.

Jurisdiction rule (JR):

$${\displaystyle \frac{{\rho }_1\mid \equiv {\rho }_2\mid ⟹s_1,{\rho }_1\mid \equiv {\rho }_2\mid \equiv s_1}{{\rho }_1\mid \equiv s_1}}$$

4.

Belief rule (BR):

$${\displaystyle \frac{{\rho }_1\mid \equiv (s_1,s_2)}{{\rho }_1\mid \equiv s_1}}$$

5.

Freshness rule (FR):

$${\displaystyle \frac{{\rho }_1\mid \equiv \#\left(s_1\right)}{{\rho }_1\mid \equiv \#(s_1,s_2)}}$$

5.4.2. Goals

The authentication goals are to establish that both the vehicle $V_i$ and the base RSU $RS{U}_d^d$ believe they share a common session key $SK$, and that each believes the other believes so as well.

Goal 1: 

$V_i\mid \equiv V_{i}SK{R}_l$

Goal 2: 

$R_l\mid \equiv V_{i}SK{R}_l$

Goal 3: 

$V_i\mid \equiv R_l\mid \equiv V_{i}SK{R}_l$

Goal 4: 

$R_l\mid \equiv V_i\mid \equiv V_{i}SK{R}_l$

5.4.3. Idealized Forms

The idealized message forms are defined as follows. $Ms{g}_1$ and $Ms{g}_2$ mean that $V_i$ and $R_l$ send the confidential values. In the proposed protocol, $U_j$ acts as an intermediary between the vehicle $V_i$ and the RSU $R_l$. Although $U_j$ participates in the mutual authentication process to verify the legitimacy of the communicating parties, it is not a trusted authority and does not contribute to the computation of the session key $SK$. Therefore, $U_j$ is excluded from the BAN logic derivation, and only $V_i$ and $R_l$ are considered for the formal analysis of the key exchange process.

MSG1: 

$V_i\to R_l:{\{VI{D}_i,n_1,T{S}_1\}}_{k_i}$

MSG2: 

$R_l\to V_i:{\{VI{D}_i,n_1,T{S}_3\}}_{k_i}$

5.4.4. Assumptions

$A1$: 

$R_l\mid \equiv \#\left(T{S}_1\right)$

$A2$: 

$R_l\mid \equiv V_i\stackrel{k_i}{\leftrightarrow }{R}_l$

$A3$: 

$R_l\mid \equiv V_i\Rightarrow \left(V_i\stackrel{SK}{\leftrightarrow }{R}_l\right)$

$A4$: 

$V_i\mid \equiv \#\left(T{S}_3\right)$

$A5$: 

$V_i\mid \equiv V_i\stackrel{k_i}{\leftrightarrow }{R}_l)$

$A6$: 

$V_i\mid \equiv R_l\Rightarrow \left(V_i\stackrel{SK}{\leftrightarrow }{R}_l\right)$

5.4.5. BAN Logic Proof

Proof. 

The process of analysis using BAN logic includes the detailed steps below.

Step 1: 

According to $Ms{g}_1$, $S_1$ is derived.

$$S_1:R_l⊲{\{VI{D}_i,n_1,T{S}_1\}}_{k_i}$$

Step 2: 

Applying $S_1$ and $A_2$ to the MMR, $S_2$ is obtained.

$$S_2:R_l\mid \equiv V_i\mid \sim (VI{D}_i,n_1,T{S}_1)$$

Step 3: 

Applying $A_1$ to the FR, $S_3$ is obtained.

$$S_3:R_l\mid \equiv \#(VI{D}_i,n_1,T{S}_1)$$

Step 4: 

Applying $S_2$ and $S_3$ to the NVR, $S_4$ is obtained.

$$S_4:R_l\mid \equiv V_i\mid \equiv (VI{D}_i,n_1,T{S}_1)$$

Step 5: 

According to $Ms{g}_2$, $S_5$ is obtained.

$$S_5:V_i⊲{\{VI{D}_i,n_1,T{S}_3\}}_{k_i}$$

Step 6: 

Applying $S_5$ and $A_5$ to the MMR, $S_6$ is obtained.

$$S_6:V_i\mid \equiv R_l\mid \sim (VI{D}_i,n_1,T{S}_3)$$

Step 7: 

Applying $A_4$ to the FR, $S_7$ is obtained.

$$S_7:V_i\mid \equiv \#(VI{D}_i,n_1,T{S}_3)$$

Step 8: 

Applying $S_6$ and $S_7$ to the NVR, $S_8$ is obtained.

$$S_8:V_i\mid \equiv R_l\mid \equiv (VI{D}_i,n_1,T{S}_3)$$

Step 9: 

$R_l$ and $V_i$ believe that the other party can compute the session key $SK=h(VI{D}_i\mid \mid UI{D}_j\mid \mid RI{D}_l\mid \mid n_1\mid \mid k_i\mid \mid T{S}_3)$. Because $SK$ can be calculated using the shared values,

$$S_9:R_l\mid \equiv V_i\mid \equiv V_i\stackrel{SK}{\leftrightarrow }{R}_l\left(\mathbf{Goal}\mathbf{4}\right)$$

$$S_{10}:V_i\mid \equiv R_l\mid \equiv V_i\stackrel{SK}{\leftrightarrow }{R}_l\left(\mathbf{Goal}\mathbf{3}\right)$$

Step 10: 

Applying $S_9$ and $A_3$ to the JR, $S_{11}$ is obtained. And applying $S_{10}$ and $A_6$ to the JR, $S_{12}$ is obtained.

$$S_{11}:R_l\mid \equiv V_i\stackrel{SK}{\leftrightarrow }{R}_l\left(\mathbf{Goal}\mathbf{2}\right)$$

$$S_{12}:V_i\mid \equiv V_i\stackrel{SK}{\leftrightarrow }{R}_l\left(\mathbf{Goal}\mathbf{1}\right)$$

□

6. Performance Analysis

6.1. Comparison of Security Features

A comparative analysis was conducted to evaluate the security capabilities of the proposed scheme and other related approaches [18,19,22,42,43]. The results are summarized in

Table 5. Comparison of security properties across protocols.

Security Property	Choi et al. [22]	Ghosh et al. [42]	Miao et al. [19]	El-Zawawy et al. [18]	Zhang et al. [43]	Proposed
Replay Attack	×	✓	×	✓	✓	✓
MITM Attack	×	×	×	×	×	✓
Insider Attack	✓	✓	✓	×	✓	✓
Vehicle Impersonation	×	×	×	×	×	✓
UAV Impersonation	×	×	×	×	×	✓
RSU Impersonation	✓	×	×	−	−	✓
Privileged Insider Attack	✓	✓	✓	✓	×	✓
Vehicle Theft	×	×	×	×	✓	✓
UAV Capture	×	×	×	×	×	✓
Session Key Disclosure	×	✓	×	×	✓	✓
RSU Table Leakage Attack	×	×	×	×	−	✓
Anonymity	✓	✓	×	✓	×	✓
Untraceability	×	✓	×	×	✓	✓
Session Key Inconsistency	✓	✓	✓	×	✓	✓
Post-Quantum Security	×	×	×	×	×	✓
ID Synchronization Problem	×	✓	×	−	−	✓

✓: guarantees the security feature, ×: does not guarantee the security feature, −: does not consider the security feature

. The comparison shows that the proposed scheme provides stronger and more comprehensive security guarantees than existing protocols.

6.2. Computational Cost Analysis

We analyze the computational costs incurred during the AKE phases of the proposed protocol and compare them with those of existing approaches [18,19,22,42,43]. The total computational overhead of each protocol is quantitatively evaluated based on the execution times of the cryptographic primitives employed in their authentication procedures.

Table 6. Execution times of cryptographic primitives.

Operation	Symbol	RSU (ms)	UAV/Vehicle (ms)
Hash	$T_h$	0.0004	0.0011
Fuzzy extractor	$T_f$	0.0354	0.0956
AES encryption	$T_{senc}$	0.0001	0.0003
AES decryption	$T_{sdec}$	0.0001	0.0004
ECC multiplication	$T_{em}$	0.0354	0.0956
ECC addition	$T_{ea}$	0.0006	0.0017
Kyber encapsulation	$T_{kenc}$	0.0274	0.0739
Kyber decapsulation	$T_{kdec}$	0.0349	0.0943

summarizes the measured execution times of the cryptographic primitives under both RSU and UAV/vehicle configurations, including SHA-256 hashing, AES-128 encryption and decryption, ECC multiplication and addition, and Kyber-512 encapsulation and decapsulation operations. To more realistically approximate resource-constrained environments, we constructed a virtualization-based hardware limitation setup using Oracle VM VirtualBox. Two representative configurations were defined as follows:

• RSU: 4 GB memory, six processor cores, and a CPU execution cap set to 100%.
• UAV/Vehicle: 4 GB memory, four processor cores, and a CPU execution cap set to 40%.

In the UAV/vehicle configuration, the number of processor cores was reduced from six to four and the CPU execution cap was limited to 40%. By combining the reduced core allocation (approximately 67% of the RSU configuration) with the execution cap constraint, the environment was modeled to provide approximately 27% of the effective processing capability of the RSU configuration. This configuration is intended to reflect the fact that vehicular OBUs and UAV onboard platforms typically rely on ARM-based low-power system-on-chip (SoC) architectures, which exhibit lower computational performance than desktop/server-class x86 CPUs in terms of core count, clock frequency, and cache capacity [44,45,46]. Furthermore, prior VANET and UAV platform studies report that embedded vehicular and UAV boards are subject to size, weight, and power constraints, resulting in substantially lower computational capabilities compared to infrastructure-grade or desktop environments [46,47,48]. Furthermore, according to Xia et al. [49], the execution time of the fuzzy extractor is considered equivalent to that of elliptic curve point multiplication. Therefore, we assume $T_f=T_{em}$ in both experimental settings for the computational cost analysis.

Table 7. Comparison cost comparison.

Protocol	Vehicle (ms)	UAV (ms)	RSU (ms)	Total Cost (ms)
Choi et al. [22]	$10T_h+T_f\approx 0.1065$	$8T_h\approx 0.0087$	$14T_h\approx 0.0055$	$0.1207$
Ghosh et al. [42]	$3T_h+4T_{em}+T_{ea}\approx 0.3874$	$4T_h+5T_{em}+T_{ea}\approx 0.4841$	$3T_h+3T_{em}\approx 0.1074$	$0.9789$
Miao et al. [19]	$6T_h+4T_{em}+4T_{ea}\approx 0.3907$	$4T_h+3T_{em}\approx 0.2911$	$8T_h+6T_{em}+T_{senc}+T_{sdec}\approx 0.2159$	$0.8977$
El-Zawawy et al. [18]	$6T_h+4T_{em}+4T_{ea}\approx 0.3959$	$11T_h+9T_{em}+8T_{ea}\approx 0.8863$	$6T_h+2T_{em}+4T_{ea}\approx 0.0758$	$1.3580$
Zhang et al. [43]	$5T_h+2T_{em}+T_{senc}\approx 0.1968$	$4T_h+T_{em}+T_{senc}+T_{sdec}\approx 0.1002$	$7T_h+T_{em}+T_{senc}+2T_{sdec}\approx 0.0386$	$0.3356$
Proposed	$8T_h+T_{kenc}\approx 0.0826$	$6T_h\approx 0.0065$	$11T_h+T_{kdec}\approx 0.0987$	$0.1878$

and Figure 10 present the summarized computational costs of each protocol, calculated using the operation times described above. The costs were analyzed based on the cryptographic operations performed by different entities, including the vehicle, UAV, and RSU, and the execution times are aggregated in milliseconds.

The total computational cost of the proposed scheme is approximately 0.07221 ms, achieving up to an 85% reduction compared with the schemes of Ghosh et al. (0.43013 ms), Miao et al. (0.46832 ms), and El-Zawawy et al. (0.55055 ms). This improvement primarily results from the structural design of the proposed protocol, in which mutual authentication and session key establishment are simultaneously achieved through a single pair of MLWE-based KEM encapsulation and decapsulation operations. Unlike existing approaches that rely on multiple ECC operations or repeated symmetric-key encryptions, the proposed method minimizes expensive computations and avoids redundant cryptographic primitives. In particular, the computational cost on the UAV side is only 0.00238 ms, which is the lowest among all the compared schemes, demonstrating high practicality in UAV-assisted VANET environments where UAVs must perform real-time relay and verification tasks. Furthermore, both RSU-side and vehicle-side computation costs remain low, confirming that the proposed scheme provides a balanced combination of efficiency and real-time performance across all participating entities.

Additionally, scalability with respect to an increasing number of vehicles must be considered. Figure 11 presents a comparison of the total computational cost as the number of vehicles increases. The proposed scheme incurs lower computational overhead than existing approaches, enabling efficient operation even in high-density vehicular environments.

6.3. Communication Cost Analysis

This section analyzes the communication overhead of the proposed scheme under bandwidth constraints in practical VANET environments. The vehicular communication setting is assumed to be based on dedicated short-range communications (DSRC), where the physical layers (PHY) and MAC layers comply with the IEEE 802.11p standard. IEEE 802.11p supports data rates ranging from 3 Mbps to 27 Mbps over a 10 MHz channel. The analysis is conducted based on the IEEE 802.11p-based DSRC standard described in [50].

According to the IEEE 802.11 specification, the maximum MAC frame body size is 2304 bytes. In the proposed scheme, the size of each message component is defined as follows: an ID and verification data occupy 32 bytes each, a timestamp requires 4 bytes, and the Crystals-Kyber KEM ciphertext has a size of 768 bytes. Based on these parameters, the message size of $\{TI{D}_i,c_i,V_1,V_2,N_1,T{S}_1\}$ is 900 bytes, whereas that of $\{TI{D}_i,UI{D}_j,c_i,V_1,V_3,N_1,T{S}_1,T{S}_2\}$ is 936 bytes. In addition, the message sizes of $\{RI{D}_l,N_2,V_4,V_5,T{S}_3\}$ and $\{RI{D}_l,UI{D}_j,V_5,V_6,T{S}_3,T{S}_4\}$ are 132 bytes and 136 bytes, respectively. The maximum message size is therefore 936 bytes, which is well below the MAC frame body limit of 2304 bytes. As a result, MAC-layer fragmentation is not required, thereby avoiding additional overhead and retransmission delays.

In terms of transmission latency, the largest message (936 bytes) corresponds to 7488 bits. At a PHY data rate of 3 Mbps, the transmission time is approximately 2.5 ms, while it decreases to approximately 1.25 ms at 6 Mbps. Even when additional protocol overhead, such as MAC headers and PHY preambles, is taken into account, the overall transmission delay remains within the millisecond range.

To reflect realistic traffic density, a medium-density VANET scenario is considered in which 50 vehicles broadcast authentication-related messages at a frequency of 10 Hz. Under this setting, each vehicle generates approximately $936\mathrm{bytes}\times 10=9360\mathrm{bytes}$ per second, corresponding to about 74.9 kbps. The aggregate channel load for 50 vehicles is therefore approximately 3.74 Mbps, corresponding to about 62% channel occupancy at a 6 Mbps PHY rate and approximately 31% at 12 Mbps.

IEEE 802.11p-based vehicular networks incorporate congestion control mechanisms, such as SAE J2945.1 and ETSI DCC [51], which dynamically adjust transmission rates under increased channel load conditions. Furthermore, considering the packet delivery ratio (PDR) degradation caused by distance and obstacles [52,53], the effective channel load perceived by a specific RSU or UAV is typically lower than the theoretical aggregate load. Therefore, in practical deployments, the channel occupancy is expected to remain below saturation levels. Overall, the communication overhead introduced by the proposed scheme remains within feasible bandwidth limits for medium-density VANET environments.

7. Conclusions

In this paper, we proposed a novel authentication and key exchange protocol that combines MLWE and PUF technologies to address security vulnerabilities in UAV-assisted VANET environments and overcome the limitations of conventional public key-based authentication frameworks. The proposed scheme enhances structural security by treating UAVs as untrusted relay nodes and ensures that a secure session key is established exclusively between vehicles and RSUs. Furthermore, the protocol is designed with lightweight computational operations, taking into account the characteristics of VANETs that require high mobility and real-time communication, thereby achieving both strong security and high efficiency.

Security evaluation demonstrated that the proposed scheme is secure against various attacks, including replay, MITM, impersonation, and insider attacks, validated through informal analysis, RoR model-based formal proof, BAN logic reasoning, and AVISPA-based simulation. In addition, performance analysis revealed that the proposed approach significantly reduces computational overhead compared with existing UAV-assisted VANET authentication protocols, particularly minimizing the burden on UAVs, which confirms its suitability for real-time vehicular communication environments.

Future work will focus on developing an extended security framework that considers load balancing and mobility management in large-scale vehicular networks with cooperative multi-UAV support, as well as optimizing the protocol and conducting further simulation studies for real-world deployment.