Abstract

Abstract-Numerous technologies have been deployed to assist and manage transportation over the years. But recent concerted efforts in academia and industry point to a paradigm shift in intelligent transportation systems. Vehicles will carry computing and communication platforms and will have enhanced sensing capabilities. They will enable new versatile systems that enhance transportation safety and efficiency and will provide infotainment. This paper surveys the state-of-theart approaches, solutions, and technologies across a broad range of projects for vehicular communication systems.

Effective and robust operations, as well as security and privacy are critical for the deployment of vehicular ad hoc networks (VANETs). Efficient and easy-to-manage security and privacy-enhancing mechanisms are essential for the wide-spread adoption of the VANET technology. In this paper, we are concerned with this problem; and in particular, how to achieve efficient and robust pseudonym-based authentication. We design mechanisms that reduce the security overhead for safety beaconing, and retain robustness for transportation safety, even in adverse network settings. Moreover, we show how to enhance the availability and usability of privacy-enhancing VANET mechanisms: Our proposal enables vehicle on-board units to generate their own pseudonyms, without affecting the system security.

Significant developments took place over the past few years in the area of vehicular communication (VC) systems. Now, it is well-understood in the community that security and protection of private user information are a prerequisite for the deployment of the technology. This is so exactly because the benefits of VC systems, with the mission to enhance transportation safety and efficiency, are at stake. Without the integration of strong and practical security and privacy enhancing mechanisms, VC systems could be disrupted or disabled even by relatively unsophisticated attackers. We address this problem within the SeVeCom project, having developed a security architecture that provides a comprehensive and practical solution. We present our results in a set of two papers in this issue. In this first one, we analyze threats and types of adversaries, we identify security and privacy requirements, and present a spectrum of mechanisms to secure VC systems. We provide a solution that can be quickly adopted and deployed. Our progress towards implementation of our architecture, along with results on the performance of the secure VC system, are presented in the second paper. We conclude with an investigation, based on current results, of upcoming elements to be integrated in our secure VC architecture.

Initiatives to create safer and more efficient driving conditions have recently begun to draw strong support. Vehicular communications (VC) will play a central role in this effort, enabling a variety of applications for safety, traffic efficiency, driver assistance, and infotainment. For example, warnings for environmental hazards (e.g., ice on the pavement) or abrupt vehicle kinetic changes (e.g., emergency braking), traffic and road conditions (e.g., congestion or construction sites), and tourist information downloads will be provided by these systems.Vehicular networking protocols will allow nodes, that is, vehicles or roadside infrastructure units, to communicate with each other over single or multiple hops. In other words, nodes will act both as end points and routers, with vehicular networks emerging as the first commercial instantiation of the mobile ad hoc networking technology.The self-organizing operation and the unique features of VC are a double-edged sword: a rich set of tools are offered to drivers and authorities, but a formidable set of abuses and attacks becomes possible. Hence, the security of vehicular networks is indispensable, because otherwise these systems could make antisocial and criminal behavior easier, in ways that would actually jeopardize the benefits of their deployment. What makes VC security hard to achieve is the tight coupling between applications, with rigid requirements, and the networking fabric, as well as the societal, legal, and economical considerations. Solutions to this problem involve industry, governments, and academia, and can have a broad impact.In this article we are specifically concerned with the following problem: how to design and build vehicular communication protocols and systems that leave as little space as possible for misbehavior and abuse and, at the same time, remain resilient to ongoing attacks. We present an analysis of the vulnerabilities of vehicular networks and the salient challenges in securing their operation. Then we propose our architectural view of how VC can be secured, along with a brief (due to space limitations) overview of novel certificate revocation protocols tailored to the VC environment. Finally, we survey related works and discuss a few open issues in this emerging area of research. VULNERABILITIES AND CHALLENGES VULNERABILITIESAny wireless-enabled device that runs a rogue version of the vehicular communication protocol stack poses a threat. We denote such rogue devices deviating from the defined protocols as adversaries or attackers.The adoption of a variant of the widely deployed IEEE 802.11 protocol 1 by the vehicle manufacturers makes the attacker's task easier. And even possession of credentials cannot ensure alone the correct operation of the nodes. The effects of differing types of attackers (internal or external, rational or malicious, independent or colluding, persistent or random) can clearly differ. Here, rather than analyzing specific protocols, we are after a general exploration of VC vulnerabilities.Jamming -The jamm...

The vision of nomadic computing with its ubiquitous access has stimulated much interest in the Mobile Ad Hoc Networking (MANET) technology. However, its proliferation strongly depends on the availability of security provisions, among other factors. In the open, collaborative MANET environment practically any node can maliciously or selfishly disrupt and deny communication of other nodes. In this paper, we present and evaluate the Secure Message Transmission (SMT) protocol, which safeguards the data transmission against arbitrary malicious behavior of other nodes. SMT is a lightweight, yet very effective, protocol that can operate solely in an end-to-end manner. It exploits the redundancy of multi-path routing and adapts its operation to remain efficient and effective even in highly adverse environments. SMT is capable of delivering up to 250% more data messages than a protocol that does not secure the data transmission. Moreover, SMT outperforms an alternative singlepath protocol, a secure data forwarding protocol we term Secure Single Path (SSP) protocol. SMT imposes up to 68% less routing overhead than SSP, delivers up to 22% more data packets and achieves end-to-end delays that are up to 94% lower than those of SSP. Thus, SMT is better suited to support QoS for real-time communications in the ad hoc networking environment. The security of data transmission is achieved without restrictive assumptions on the network nodes' trust and network membership, without the use of intrusion detection schemes, and at the expense of moderate multi-path transmission overhead only.Portions of this article have been

Abstract-Vehicular Networks (VNs) are emerging, among civilian applications, as a convincing instantiation of the mobile networking technology. However, security is a critical factor and a significant challenge to be met. Misbehaving or faulty network nodes have to be detected and prevented from disrupting network operation, a problem particularly hard to address in the lifecritical VN environment. Existing networks rely mainly on node certificate revocation for attacker eviction, but the lack of an omnipresent infrastructure in VNs may unacceptably delay the retrieval of the most recent and relevant revocation information; this will especially be the case in the early deployment stages of such a highly volatile and large-scale system. In this paper, we address this specific problem. We propose protocols, as components of a framework, for the identification and local containment of misbehaving or faulty nodes, and then for their eviction from the system. We tailor our design to the VN characteristics and analyze our system. Our results show that the distributed approach to contain nodes and contribute to their eviction is efficiently feasible and achieves a sufficient level of robustness.

Abstract-Inter-vehicle communication (IVC) systems disclose rich location information about vehicles. State-of-the-art security architectures are aware of the problem and provide privacy enhancing mechanisms, notably pseudonymous authentication. However, the granularity and the amount of location information IVC protocols divulge, enable an adversary that eavesdrops all traffic throughout an area, to reconstruct long traces of the whereabouts of the majority of vehicles within the same area. Our analysis in this paper confirms the existence of this kind of threat. As a result, it is questionable if strong location privacy is achievable in IVC systems against a powerful adversary. I. INTRODUCTIONInter-vehicle communication (IVC) systems have been actively researched over the past years. Vehicles that can communicate with each other and road-side units (RSUs) enable a range of applications. For example, applications that provide warnings on road dangers and traffic jams, or those that offer comfort enhancements (e.g., automated update of point-ofinterest information to car navigation systems). Many of the envisioned IVC protocols and applications rely on position and time information. This requires all vehicles frequently broadcasting their position, combined with a time stamp of the message generation, openly to all of its neighbors.As vehicle transmissions can be eavesdropped by anyone within radio range, there exists a clear threat: location information could be collected and misused [18]. By establishing a network of RSUs, any public, private, commercial, or criminal attacker can collect these packets and create detailed location profiles of vehicles and consequently their drivers. Possession of such location profiles could easily breach the privacy of drivers, as there is usually a strong correlation between a vehicle and its driver; most vehicles are used by only very few drivers [8].IVC protocols and applications provide various identifiers of the vehicle, in particular the vehicular communication equipment. This can be an identifier for a networking protocol or an identifier for an application. We abstract away implementation details and consider the basic problem at hand: the correlation of an identifier ID with a time t and a location l. The (ID, t, l) tuple is called a location sample, and a location profile is set of multiple tuples (ID, t i , l i ) for the same identifier ID, with i simply the index of sample.In order to enhance privacy, one could blur the information such a profile provides. For example, by decreasing the