As an extension of Internet of Things (IoT) in transportation sector, the Internet of Vehicles (IoV) can greatly facilitate vehicle management and route planning. With ever-increasing penetration of IoV, the security and privacy of driving data should be guaranteed. Moreover, since vehicles are often left unattended with minimum human interventions, the onboard sensors are vulnerable to physical attacks. Therefore, the physically secure authentication and key exchange (AKE) protocol is urgently needed for IoV to implement access control and information protection. In this paper, physical unclonable function (PUF) is introduced in the AKE protocol to ensure that the system is secure even if the user devices or sensors are compromised. Specifically, PUF, as a hardware fingerprint generator, eliminates the storage of any secret information in user devices or vehicle sensors. By combining password, biometrics with PUF, the user device cannot be used by someone else to be successfully authenticated as the user. Finally, the elaborate security analysis demonstrates that the proposed protocol is free from the influence of known attacks and can achieve expected security properties, and the performance evaluation indicates the efficiency of our protocol.

车辆物联网（IoV）作为交通运输领域物联网（IoT）的扩展，可以极大地促进车辆管理和路线规划。随着IoV的不断普及，应确保驾驶数据的安全性和私密性。此外，由于车辆经常在无人干预的情况下无人看管，因此车载传感器容易受到物理攻击。因此，IoV迫切需要物理安全的身份验证和密钥交换（AKE）协议来实现访问控制和信息保护。在本文中，在AKE协议中引入了物理不可克隆功能（PUF），以确保即使用户设备或传感器受到损害，系统也能保持安全。具体来说，PUF作为硬件指纹生成器，消除了将任何秘密信息存储在用户设备或车辆传感器中的麻烦。通过将密码，生物识别技术与PUF结合使用，其他人无法使用该用户设备成功将其认证为用户。最后，详尽的安全性分析表明，所提出的协议不受已知攻击的影响，并且可以实现预期的安全性，而性能评估则表明了该协议的有效性。