A Semi-centralized Dynamic Session Key Agreement Protocol Based on CL-PKC for In-vehicle Network

Many existing session key agreement schemes of the in-vehicle network are based on centralized group key negotiation, which are vulnerable to the long-term key leakage risk and single point of failure problem. Some cryptography-based session key exchange approaches brought expensive communication and computation cost of the resource-constraint ECUs. In this article, we introduce a novel semi-centralized dynamic session key agreement protocol designed for the in-vehicle network of automobiles. This protocol leverages the physical unclonable function (PUF) for ECU identity authentication and utilizes the certificateless public key cryptosystem (CL-PKC) to generate a public-private key pair for each ECU and derive session keys for each CAN ID. Then we conduct a formal security analysis of the protocol and validate its security attributes using AVISPA, ensuring compliance with session key negotiation security requirements. Experimental results demonstrate the effectiveness of the proposed session key protocol in resisting various known attacks, and its superior lightweight nature in terms of communication and computation time overhead compared to other in-vehicle session key agreement schemes.