Vehicular Communications and VANETs · Instant messaging (between vehicles) Point-of-interest...
Transcript of Vehicular Communications and VANETs · Instant messaging (between vehicles) Point-of-interest...
Seite 1
Vehicular Communications and VANETsFrank Kargl ([email protected])
CCC Ulm, Ulm University
Photo © DaimlerChrysler
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 3
Overview
IntroductionMotivation and ApplicationsTechnology Overview
CommunicationIEEE 802.11pPosition-based Routing
Security and Privacy
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 4
Reasons for Vehicular Communications
1. Research Grants and PhD titles;-)
2. Sell more cars ;-)80% of innovation in new cars is electronics,mostly software
3. Active Safety
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 5
Motivation for Vehicle Comm.: Active Safety
Source: Statistisches Bundesamt, Audi AG
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 6
Accident Phases
SeriousAccident
SlightAccident
MinorImpact
MinorImpact
Accident Phase
WarningPhase
Phases 1-3 4-6 7
RecoveryPhase
Accident!
Active Safety Passive Safety
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 7
Car to Car /Car to Infrastructure Communication
Car to Car / Car to Infrastructure Communication
(C2C / C2I)
MinorImpact
Accident Phase
Phases 1-3
Navigation Phase WarningPhase
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 8
Telematics Horizon
On Board Systems(e.g. ESP)
Local Sensors(e.g. Laserrange/Radar)
Communication(C2C / C2I)
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 9
Vehicle Communication (VC)VC promises safer roads,
… more efficient driving,
Warning:Accident at (x,y)
Warning:Accident at (x,y)
!!
TOC
RSU RSU
Traffic Update:Congestion at (x,y)
!
Congestion Warning:At (x,y), use alt. route
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 10
Vehicle Communication (VC)… more fun,
MP3-Download
Text message:We'll stop at next roadhouse
… and easier maintenance.Software Update
Malfunction Notification:Arriving in 10 minuten,
need ignition plug
RSU
CarManuf.
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 11
Application Categories
eSafetyeSafety
Traffic ManagementTraffic Management
MaintenanceMaintenance
Enhanced DriverComfort
Enhanced DriverComfort
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 12
eSafety ApplicationsTraffic signal violation warningStop sign violation warningGeneral in-vehicle signageLeft turn assistantIntersection collision warningPedestrian crossing informationEmergency vehicle approaching warningEmergency vehicle signal preemptionEmergency vehicle at scene warningVehicle safety inspectionElectronic license plateElectronic driver's licenseIn-vehicle Amber alert (crime haunt)Stolen vehicles trackingPost-crash/breakdown warning
SOS servicesPre-crash sensingEvent data recordingWork zone warningCurve-speed warning (rollover warning)Vehicle-based road condition warningInfrastructure-based road condition warningCooperative (forward) collision warningEmergency electronic brake lightsBlind spot warning / lane change warningWrong way driver warningRail collision warning
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 13
Traffic Management Applications
Highway merge assistantCooperative adaptive cruise controlCooperative platooningAdaptive drivetrainmanagementIntelligent traffic flow controlRoad surface conditions to TOCVehicle probes provide weather data to TOC
Crash data to TOCOrigin and destination to TOCFleet managementArea access controlElectronic toll paymentRental car processingHazardous material cargo tracking
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 14
Maintenance and Enhanced Driver Comfort
Maintenance ApplicationsSafety recall noticeJust-in-time repair notificationWireless DiagnosticsSoftware update/flashing
Enhanced Driver ComfortVisibility enhancerCooperative glare reduction / headlamp aimingParking spot locatorEnhanced route guidance and navigation
Enhanced Driver Comfort (cont.)
Map download/updateGPS correctionCooperative positioning improvementInstant messaging (between vehicles)Point-of-interest notificationInternet service provisioning / info fuelingMobile media servicesMobile access to vehicle data (PDA, Handy,…)
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 15
Scope ofVehicular Communications Research
Today mostly warnings and assistance mechanisms
Potential for automatic reaction and driving, butUser acceptanceLegal issuesInsurance issues
<Videos go here>
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 16
Lot of Involved Parties
eSafetyFORUM
USAEuropean Projects
Standardization
FrequencyRegulation National Projects Stakeholders
Legislation
C2C-CC
COMeSafetyEASIS
Prevent
CarTALK2000
COOPERS
GST
CVIS
eSafetySupport
Safespot
Member
States
Road-Op.
InsuranceSuppl.
Telcos
Vehic.-manuf.Fleetnet
NOW
Invent
AIDA
INFONEBBIA
CEPT
ITU
ISO
IEEECEN
ETSI
AVS3Japan
AHSRA
CICAS VSC
VII
adopted fromCOMeSafety
SEVECOM
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 17
Overview
IntroductionMotivation and ApplicationsTechnology Overview
CommunicationIEEE 802.11pPosition-based Routing
Security and Privacy
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 19
Lot of Involved Technologies
Variable Message Sign
Terrestrial BroadcastRDS, DAB
UMTS GSM
Beacon•CALM-IR•CALM-M5•DSRC
GPS, GALILEO
50
Broadcaster Vehicle to VehicleRFID
WiMAX
RSU to RSU
Hot-Spot(Wireless LAN,
WiFi)
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 20
Overview
IntroductionMotivation and ApplicationsTechnology Overview
CommunicationIEEE 802.11pPosition-based Routing
Security and Privacy
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 21
DSRC – WAVE – IEEE 802.11p
DSRC: Dedicated Short Range Communication75 MHz spectrum set aside vor VC
WAVE: Wireless Access in Vehicular EnvironmentsSet of standards (incl. 802.11p) for VC
IEEE 802.11p: 802.11a modification for VCV2V: Vehicle-to-Vehicle CommunicationV2I: Vehicle-to-Infrastructure Communication
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 22
IEEE 802.11p Radio
Based on 802.11a7 channels á 10 MHz
Can combine two channels for additional bandwidth10MHz: 6 … 27 Mbps, 20 MHz: 6 … 54 Mbps
Maximum Range: 1000mDifferent transmission powers
Some details still missing, e.g. channel reservation protocol
Public SafetyV2V
Ch. 172
Public Safety/PrivateCh. 174
Public Safety/PrivateCh. 176
ControlChannelCh. 178
Public Safety/PrivateCh. 180
Public Safety/PrivateCh. 182
Public SafetyIntersections
Ch. 184
5.85
0
5.92
5
DedicatedPublic Safety
DedicatedPublic Safety
Shared Pub.Safety/PrivateMedium Range Serv.
Shared Pub.Safety/PrivateShort Range Serv.
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 23
DSRC Performance
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 24
Overview
IntroductionMotivation and ApplicationsTechnology Overview
TechnologyIEEE 802.11pPosition-based Routing
Security and Privacy
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 25
Classification
Ad-hoc Networks
Single-Hop Multi-Hop
Bluetooth 802.11 iBSS static dynamic
Mesh Netw. WSNs VANETsOthers•Military•Disaster-Rec.•Ubicomp
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 26
Example scenario for position-based routing: Road-Condition Warning
Vehicles sense hazardous roador weather conditions (e.g. icyroads) using their on-boardsensors (e.g. ESP)Information dissemination
Send weather and road conditionsto all approaching vehicles in anarea of interest
Special propertiescompared to regularMANETs
Highly dynamic network topologyDifferent movement patterns (cities vs. highways)Relatively good availability of resources (esp. energy)compared to small mobile devices
!
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 27
Routing in VANETsOften position based addressing
GeoBroadcast: send to all nodes within a region “All cars in the area of Ulm/B10: Accident on Adenauerbridge when heading towards Neu-Ulm”GeoAnycast: send to arbitrary node within a region “How are traffic conditions three km ahead?“
Fleetnet Routing ProtocolAddress surrounding nodes:
Direct flooding of message in target region (“Area-Forwarding“)Address remote nodes:
First „Line-Forwarding“, then Area-Forwarding
Cached Greedy Geocast (CGGC) Source: www.map24.de
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 28
CGGC Line ForwardingLine-Forwarding
Destination: remote geographic position/regionEach node announces its position periodically via broadcast to all reachable neighbors (Beaconing)
each node knows all other nodes and their positionin its neighborhood
Routing: if target region is not reached,nodes forward packets to neighborwhich is nearest todestination(Greedy-Forwarding)
Path:A → C → D → E
A
B
C
D E
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 29
How to select the best neighbor:Greedy Routing Strategies
S D
X
U
W
V
Greedy (W)
Most Forward progress within Radius - MFR (U)
Nearest with Forward Progress - NFP (X)
Compass (V)
Random
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 30
Local Maximum
S
DT
U
W
V
X
What to do when there is no better neighbor?Strategies
GPSR:parameter-Mode; left-hand rule to escape local maximumCGGC:cache and let mobility resolve the local maximum
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 31
Position-based Routing
AdvantagesApplications often relatedto positionNo route discovery/management
ScalabilityWell suited for high node mobility
DisadvantagesPosition needs to be known
VANETs: use GPS fromnavigation system
Unicast-routing needslocation service
Translate Node-ID → LocationOverhead
DSR
GPSR
DSR
GPSR
Source: Fleetnet Research Report
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 32
Overview
IntroductionMotivation and ApplicationsTechnology Overview
TechnologyIEEE 802.11pPosition-based Routing
Security and Privacy
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 33
Vehicle Communication (VC)VC promises safer roads,
… more efficient driving,
Warning:Accident at (x,y)
Warning:Accident at (x,y)
!!
TOC
RSU RSU
Traffic Update:Congestion at (x,y)
!
Congestion Warning:At (x,y), use alt. route
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 34
Vehicle Communication (VC)… more fun,
MP3-Download
Text message:We'll stop at next roadhouse
… and easier maintenance.Software Update
Malfunction Notification:Arriving in 10 minuten,
need ignition plug
RSU
CarManuf.
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 35
Sounds good
BUT …BUT …
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 36
Security and Privacy???Safer roads?
More efficient driving?
Warning:Accident at (x,y)
!
TOC
RSU RSU
Traffic Update:Congestion at (x,y)
!
Congestion Warning:At (x,y), use alt. route
!
!
!
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 37
Security and Privacy???More fun, but for whom?
Position Beacon
Text message from silver car:You're an idiot!
… and a lot more …Your new
ignition-control-software
RSU
Location Tracking
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 38
Security of Position Based Routing
Attacking position based routing means to attack the beaconing mechanism
AttacksUsing position information
Modify / falsify own position information in beacons
Reroute dataIntercept data
Using node identifiersCreate (additional) node identifiers
Sybil AttackImpersonate other nodes
Discredit other nodes
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 39
Position Faking Roadside Attacker
Roadside attackers pretend to be part of the net and use properties of the comm. system to decrease net performanceExample: Attacker emulates two fake nodes (F1 and F2)
Correct path between vehicle A and vehicle D: A B C DAttacker broadcasts positions for two fake vehicles
Modified paths: A F2 C D, D C F1 AAttacker is able to intercept traffic in both directions in this area
A
BC D
F2
F1
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 40
Simulation Results:Stationary Roadside Attacker
Single roadside attacker is able to intercept and drop the entire data traffic in an area
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 41
Solutions
Provable PositioningRelated work on secure GPS etc.Change GPS???
Physical MeasurementTOA, TDOA, …Additional Hardware for positioning???
HeuristicsSimple, easySufficient effective?
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 42
Example: Acceptance Range ThresholdBased on the limited radio range Maximum ART := ∆maxAccept neighbors N wheredistance(Pos(Ni),Pos(Nj)) ≤ ∆max, otherwise ignore themThe bigger the distance between Arund Av, the more nodes will detect the falsified positionIssues
Fixed threshold is not flexible enoughFalse positions within reasonable distance will not be detected by some neighbors
ExampleM, K: distance([M|K],Av) > ∆max
ignoreL : distance(L,Av) ≤ ∆max
acceptQ, P: no beacon received
AvAr
K
MP
QL
Real Position of Node A Position
transmitted in Beacons
Radio Range Radio Range (Beacon Position)
r
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 43
Simulation Results: Delivery Success Ratio
Performance degradation reduces when applying the position verification system
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 45
Other SensorsMobility Grade Threshold (MGT)
Based on limited velocity of nodesMaximum node velocity := Vmax
OverhearingNodes monitor data traffic of neighboring nodes and try to identify irregularitiesOwn packet is routed to a less suitable neighbor at the next hopOther nodes forward packets to a node that normally should not be able to receive the packet
Maximum Density Threshold (MDT)Based on the fact that only a restricted number of physical entities can reside in a certain areaMaximum node density ρmax
Map-based VerificationBased on the assumption that vehicles move mainly on roads
…
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 46
Privacy in VANETs
Vehicles get traceableMacroscopic tracing – e.g. over the countryCoarse-grain tracing – e.g. down to certain roadsFine-grain tracing – exact positions and times
Map source: www.map24.de
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 47
Changing Pseudonyms
Concept: Nodes change their ID from time to timeObservations cannot (trivially) be linked
DrawbacksLinking pseudonyms might be possible due to
Correlation of identifiers between changesCross-layer issues, heuristics, hardware fingerprinting, …Context of the node (e.g. unique itinerary, few nodes)
Operability of system is influencedSessions may be interruptedCommunication protocols may stall
What is the impact of changing pseudonyms ongeographic routing?
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 48
Changing Pseudonyms
If pseudonyms change frequently, privacy profitsLinking different pseudonyms together gets harder
On the other hand, geographic routing performance declines due to invalid neighbor table entries
After a pseudonym change, old (ID,Position)-tupel remain in neighbor tables until expirationRouting metric only respects neighbor positionProbability of selecting outdated neighbors as next hop
A
B
C D
E
FC'
Selected route from A to F until beacon timeout still:A → C → D → E → F
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 49
Analytical Study of Impact
ParametersBeacon rate – bPacket rate – pExpiration timeout – t0Pseudonym changerate – c
Total loss probabilitywithin onet0 interval
ctP o
loss 2=
r
p1 op2nm
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 50
Simulation results support these findings
Notable decrease in delivery ratio with 5 seconds ID change interval
For 2000 x 2000 m, ~ 65% less packets delivered
40% absolute65% relative
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 51
SE-cure VE-hicle COM-munication
Mission:practical solution to the problem of V2V/V2I security
IST STREP Project. 1/1/2006-1/1/2009Partners
Trialog (Coordinator)DaimlerChryslerCentro Ricerche FiatPhilipsEcole Polytechnique Fédéral de LausanneUniversity of UlmBudapest University of Technology and Economics
2006 - Frank Kargl - CCC Ulm
Vehicular Communications and VANETsSlide 52
Security Mechanisms
Identified ~20 different security mechanisms needed to conquer the most attacksExamples
PKI for VANETPrevent sibyl attacksEfficient revocationCheap operation
Anonymization layerPseudonyms with revocation
Routing and forwarding securityConsistency ChecksIn-Vehicle protection mechanisms…
Sandbox
Filtering (e.g at intermediate nodes)
Closed user groups
Firewall/Checkpoint
Access control
Access Control/Authorization Concepts
Location verification
Attestation of sensor data
Consistency/context checking
Replay protection
DRM
Tamper-resistant comm. system
Jamming protection
Detection of protocol violation
Integrity protection
Encryption
Integrity Concepts
Location obfuscation
Total anonymity
Resolvable anonymity
Privacy Concepts
Authentication of intermediate nodes
Property authentication
Authentication of receiver
… and sender is
Authentication of sender
Identification
Identification & Authentication Concepts
Seite 53
THE END!!! Questions?Frank Kargl ([email protected])
IM: [email protected] Ulm, Ulm University
Photo © DaimlerChrysler