1. VEHICULAR AD-HOC NETWORKS
A Vehicular Ad-Hoc Network, or VANET, is a technology that uses moving cars as nodes in a
network to create a mobile network. VANET turns every participating car into a wireless router
or node, allowing cars approximately 100 to 300 metres of each other to connect and, in turn,
create a network with a wide range. As cars fall out of the signal range and drop out of the
network, other cars can join in, connecting vehicles to one another so that a mobile Internet is
created. It is estimated that the first systems that will integrate this technology are police and fire
vehicles to communicate with each other for safety purposes.
Vehicular Ad-Hoc Networks (VANET) are becoming an integral technology for connecting daily
life to computer networks. They could greatly improve the driving experience both in terms of
safety and efficiency. As shown in Figure 1.1, when multi-hop communication is implemented,
VANET enables a vehicle to communicate with other vehicles which are out of sight or even out
of radio transmission range. It also enables vehicles to communicate with roadside infrastructure.
Figure 1: Vehicular Communication
There has been a significant improvement in the Intelligent Transportation Systems (ITS) in the
recent years mainly due to the problems caused by traffic congestion in this developing world.
The various applications of ITS range from basic management systems such as car navigation,
1 | P a g e
automatic number plate navigation to more advanced applications that integrate live data and
feedback from a number of other sources, such as parking guidance and information systems,
weather information and the like. The Dedicated Short Range Communications (DSRC) band at
5.9GHz with a spectrum of 75MHz has been allocated in the US for ITS. The vehicles on the
road use this band for V2V (vehicle to vehicle) and for V2R (vehicle to road equipments)
communications. These vehicles create a Vehicular Ad-hoc Network (VANET) dynamically. In
this, a special electronic device will be placed inside each vehicle which will provide Ad-Hoc
Network connectivity for the passengers. This network tends to operate without any infra-
structure and server communication. Each vehicle equipped with VANET device will be a node
in the Ad-Hoc network and can receive and relay other’s messages through the wireless network.
To determine its own position, the vehicles are equipped with Global Positioning System (GPS).
It is a space based navigation satellite system that provides reliable location and time information
in all weather and at all times. In this, a number of Medium Earth Orbit (MEO) satellites are
involved which broadcasts signals from space and the GPS receiver then uses it to calculate its
location and time. These positions act as the address of a vehicle (node) in the network.
Vehicular Networks are an envision of the Intelligent Transportation Systems (ITS). Vehicles
communicate with each other via Inter-Vehicle Communication (IVC) as well as with roadside
base stations via Roadside-to-Vehicle Communication (RVC). The optimal goal is that vehicular
networks will contribute to safer and more efficient roads in the future by providing timely
information to drivers and concerned authorities.
2. THREATS AND SECURITY ASPECTS
2 | P a g e
Introduction
Before proposing security solutions for IVC (Inter Vehicle Communications), it is important
to construct a threat model able to encompass all possible attacks on vehicular networks. In
addition, describing specific attacks on these networks would enable us to choose the right set
of tools in order to counter these attacks.
2.1 Threats
We categorize security threats into three groups according to the application type that they
target:
2.1.1 Attacks on safety-related applications: Safety-related applications are the major
incentive behind the development of IVC. As they are required to provide a high level of
liability, their security should be no less important. The results of an attack on these
applications can be not only annoying (e.g., causing traffic congestion) but also disastrous
leading to accidents and losses of lives.
2.1.2 Attacks on payment-based applications: A considerable number of IVC applications
will involve financial transactions, e.g., for toll collection, payment for location-based
services, and insurance. This will inevitably create a set of corresponding financial frauds that
leverage on the open nature of wireless communications.
2.1.3 Attacks on privacy: One of the major concerns in future vehicular networks is the
question of privacy. In fact, enabling vehicles to communicate with each other will allow
tracking their drivers. This can be used by adversaries for unauthorized location tracking of
vehicles. Protecting the location privacy of vehicles is important because the lack of privacy
may hinder the future growth of this technology.
2.2 Specific Attacks
In this section we describe several example attacks on vehicular networks.
2.2.1 Bogus information attack: In this case, the attacker disseminates false information in
the vehicular network in order to affect the decisions of other drivers. For example, as Figure
2.2.1 shows, several drivers may collude in order to help each other arrive to their
3 | P a g e
destinations faster. Vehicle A2 sends messages indicating to all following vehicles that the
road they are taking is congested after a short distance. As a result, the drivers of these
vehicles may change their routes in order to avoid congestion by following different roads.
The result is that the road is freed in front of vehicle A1 that can go faster. Although this
example attack is rational, the same mechanism can be used to create congestions on specific
roads for malicious reasons. This attack belongs to the first category of threats.
Figure 2.2.1: Bogus information attack
2.2.2 Disruption of network operation: The aim of this attack is to prevent the network
from carrying out safety-related functions. There are many ways to perform this attack, either
by sending messages that would lead to improper results or by jamming the wireless channel
(this is called a Denial of Service, or DoS, attack) so that vehicles cannot exchange safety
messages. The example in Figure 2 illustrates the first case: a malicious attacker sends
contradictory messages to two vehicles, one behind the other, during a night drive. As one
vehicle receives a message warning it of congestion ahead and slows down, the following
vehicle receives a message saying that the road ahead is clear and hence it speeds up. The
worst-case scenario is when an accident results because of this manipulation. The DoS attack
consists in jamming the wireless channel thus interrupting all communications. It can be used
against both safety-related and payment-based applications and is one of the hardest security
problems in IVC.
4 | P a g e
Figure 2.2.2: Description of network operation attack
2.2.3 Cheating with identity, speed, or positioning information: In cases where liability is
involved, drivers may be tempted to cheat with some information that can determine the
location of their car at a given time. For example, as Figure 3 illustrates, a vehicle may be
involved in an accident and then claim that it was not on the spot when the accident
happened. This can be done by tweaking the reported speed or location information.
Although this example applied to safety-related applications, cheating with identity by
impersonation can also be very useful in attacks on payment-based applications.
Figure 2.2.3: Cheating attack
2.2.4 Identity disclosure attack: This is the Big Brother scenario, where a global observer
can monitor trajectories of targeted vehicles and use this data for a range of purposes (e.g.,
the way freight companies track their trucks). To monitor, the global observer can leverage
on the roadside infrastructure or the vehicles around its target (e.g., by using a virus that
infects neighbours of the target and collects the required data!). The attacker can be only
5 | P a g e
passive in this case (listening to the wireless transmissions of surrounding vehicles as Figure
4 shows), thus making the attack impossible to detect. We assume that the attacker does not
make use of cameras, physical pursuit, or onboard tracking devices to track his target;
otherwise, the tracking problem becomes simpler but also more expensive and tied to few
specific targets, and it can be done anyhow based on existing license plates. This attack
exemplifies the last category of threats.
Figure 2.2.4: Identity disclosure attack
3. Position-Based Routing Protocols
Introduction 6 | P a g e
Vehicles are equipped with GPS by which they know their positions in a network. A node, when
transmitting information to other nodes will transmit based on their positions. This forms the
basis of position based routing protocols. In this, routing decision is based on the location of
destination and neighbouring nodes. Every node determines its own position and broadcasts it in
periodic beacon messages. So, each vehicle in the transmission range is able to maintain a
neighbouring location table. The technique used here is greedy forwarding.
As mentioned above, a node has a neighbouring location table. In greedy forwarding algorithm, a
forwarding node looks at the table and finds out the node which is geographically closest to the
packet’s destination. It then sends the packet to that particular node.
Position-based routing protocols are prone to various security threats. Vehicles can
intentionally lie about their positions. By manipulating its own position information, a
malicious vehicle can be selected as an intermediate relay node. It can then either drop the
data packets or modify the content of the packets. This is called as position-spoofing attack
and is one of the most destructive threat faced by ITS and VANETs. The location information
can also be used to cause a so-called intelligent collision attack. Drivers may also cheat with
the location information of their vehicles at a given time, such as after an accident. The
location information of vehicles can also be used in adaptive cruise control and lane control
in a fully automated system without human intervention. Therefore, accurate information on
position is crucial in ITS and VANETs.
Fig. 3 shows an example of position-spoofing attack against position-based routing protocols
in VANET. Source vehicle S may select a neighbouring vehicle H, which is nearest to the
destination D, as the forwarder to the destination D. However, M can attract the traffic from S
to D by broadcasting False Location (FL) information periodically. After receiving data
packets, M can either drop or manipulate the received packets.
7 | P a g e
Figure 3: Position-spoofing attack in VANET
3.1 Position Verification Schemes
One of the techniques that can be utilized to prevent position-spoofing attack is in-region
verification. It is used to verify whether vehicles are actually located in their claimed region.
Position Verification Schemes are classified as:
Infrastructure-based (special hardware required) and
Infrastructure-less (no special hardware required).
These two can again be sub-divided into two classes: autonomous and cooperative
verification schemes. In autonomous verification scheme, each node individually verifies the
claimed position of another neighbouring node whereas in the case of cooperative verification
scheme, a node can overhear the transmission of location information of other nodes and
informs its view to the verifier cooperatively.
There are a number of verification schemes proposed in the literature. Some of those are:
3.2 Verifiable Multilateration (VM)
This is proposed to determine the position of a node from a set of reference points whose
positions are known in advance, based on the distances measured between the reference
points and the device. This utilizes distance bounding and multilateration techniques.
3.2.1 Distance bounding protocols enables a verifier to establish an upper bound on the
physical distance to a prover. It is based on timing the delay between sending out challenge
bits and receiving back the response bits. This delay time enables verifier to compute an
upper bound on the distance, as the round trip delay time divided into twice the speed of
light. It also says that a vehicle can only pretend that it is further from the verifier than it
really is but it can’t prove itself to be closer.
8 | P a g e
3.2.2 Multilateration is the process of locating an object by computing the Time Difference
of Arrival (TDoA) of a signal emitted from that object to three or more receiver. It is based
on the simple fact that if a pulse is emitted from a platform, it will arrive at slightly different
times at two spatially separated receiver sites, the TDoA being due to the different distances
of each receiver from the platform.
3.2.3 Verifiable multilateration works as follows: Four verifying base stations with known
locations perform distance bounding to the vehicle, the results of which give them four upper
bounds on distance from the vehicle. If the verifiers can uniquely compute the vehicle’s
location using these distance bounds, and if this location falls into the triangular pyramid
formed between the verifiers, then they conclude that the vehicle’s location is correct.
Equivalently, only three verifiers are needed to verify the vehicle’s location in two
dimensions; the verifiers still consider the car’s location correct if they can be uniquely
computed and if it falls in the triangle formed between them.
Figure 3.2.3: Example of verifiable multilateration
Figure 3.2.3 shows an example of verifiable multilateration. The intuition behind the
technique is that a vehicle might try to cheat about its location. As we mentioned earlier, the
vehicle can only pretend that it is further from the verifier than it really is because of the
distance bounding property. However, if it increases the measured distance to one of the
verifiers, it would need to prove that at least one of these distances is shorter than it actually
is, to keep its claimed location consistent with the increased distance. This property holds
9 | P a g e
only if the claimed location is within the triangular pyramid formed by the verifiers if an
object is located within the pyramid and it moves to a different location within the pyramid, it
will certainly reduce its distance to at least one of the pyramid vertices. The same holds in
two dimensions. Base stations v1, v2, v3, and v4 can verify a vehicle’s location in three
dimensions if the vehicle is located in the triangular pyramid that v1, v2, v3, and v4 forms.
Base stations v1, v3, and v5 can verify a vehicle’s location in two dimensions if the vehicle is
located in the triangle formed by v1, v3, and v5.
A major limitation of this could be the cost since we will have to use a number of base
stations to verify the location of a prover. Another could be the time required to verify the
position. This can be reduced by employing synchronous base stations that is transmitting the
challenge message at the same time to the prover. But, this could easily be defeated by the
malicious vehicle by making use of a sector antenna.
3.3 Triangulation
Triangulation (location determined using geometry) is used to determine the position of a device
from three reference points. Due to the upper bound of the distance between the reference points
and the device, attackers cannot decrease the distance between two neighbouring nodes.
In the network, some nodes equipped with GPS have their accurate positions. These nodes
periodically broadcast their location information to all other nodes in the network. Based on the
distance estimated from the nodes, position information is calculated.
An example is shown in Figure, where a node uses the estimate of its distance from 3 beacons
to compute its location.
10 | P a g e
Figure 3.3: Triangulation
3.4 Echo Protocol
In the Echo protocol, a prover sends its position information to the verifier. The verifier then
subsequently sends back a challenge message to the prover. When the prover receives the
challenge, it replies immediately to the verifier through an ultrasonic channel with a received
challenge message. The verifier then measures the total delay between two receptions of
challenge and response messages. It compares the measured delay to the delay estimated
according to the claimed position and the speed of light.
This protocol is quite simple as it eliminates the use of cryptographic keys to establish
communication between the devices. Even the hardware required for this is minimal. It does
not require time synchronization or any prior agreement between the prover and the verifier.
3.5 Stealth Nodes
In VANETs we have certain nodes that do no transmissions themselves. These nodes are
known as stealth nodes and can listen to the broadcasted information of the location and
distance-bounding communication and verify reported positions. If the claimant does not
know the positions of these nodes, it will not be able to cheat on its location.
11 | P a g e
In this concept, secure position verification is done with the help of road-side infrastructure.
This type of infrastructure can be created by using one active node that initiates distance
bounding challenges to passing vehicles and a passive stealth node that monitors distance
bounding communications and checks for inconsistencies. This passive node has to be
connected with the active node using a wired link.
During a distance bounding exchange an active node will send a ping to the vehicle and the
vehicle will reply. The passive node or the stealth node overhears the ping and the reply and
can measure the Time Difference of Arrival (TDoA) between the two messages. Since it
knows its own position and the position of verifier it can restrict the position of the prover to
an ellipse with the foci being the verifier and the stealth node. If the reported position of the
prover is not within a certain error distance of the ellipse, the stealth node can signal this
detected inconsistency to the verifier which will send out a warning to all other vehicles.
This concept is advantageous as long as the malicious vehicles are not able to detect the
position of the stealth node. It fails if the other vehicles are able to determine the positions of
stealth nodes.
Figure3.5: Stealth Nodes
From Fig.3.5, a stealth node S that overhears the exchange of challenge-response messages
between verifier V and prover P can measure the time difference of arrival (TDoA) between
two messages. Assuming that S knows its own position and the position of V, it can use the
measured TDoA to restrict the position of P to the ellipse with foci at both S and V.
12 | P a g e
3.6 Autonomous Position Verification
This type of verification is done with the help of autonomous sensors. It uses various
schemes:
3.6.1 Acceptance Range Threshold (ART) is based on the fact that all radio networks used
in VANETs have a limit on the maximum communication range. So by discarding position
beacons from nodes claiming to be at a distance greater than the maximum range, many types
of attack are avoided.
3.6.2 Mobility Grade Threshold (MGT) is based on the fact that nodes can move only at a
well-defined maximum speed. When receiving a beacon, nodes also receive a timestamp,
then, upon the reception of subsequent beacons from the same node, it is checked whether the
average speed of the node between the two positions exceeds the MGT. If yes, the beacon
and thus that node is discarded.
This sensor detects rapid changes in a node’s claimed position but it cannot detect gradual
changes of a node’s position claim towards a wrong direction.
3.6.3 Maximum Density Threshold (MDT) is based on the assumption that only a limited
number of devices can reside in a given area. If this threshold is exceeded further position
beacons for that area are rejected.
3.6.4 Map Based Verification is based on the assumption that vehicles involved in the
network make use of navigation systems where street maps are accessible. Upon receiving
the beacon, the system can check whether a neighbouring vehicle pretends to be at a location
that is not likely. If so, the beacon is rejected.
3.6.5 Position Claim Overhearing is a concept in which the nodes make use of so-called
promiscuous mode to capture packets that are sent by nodes in reception range but are
addressed to other nodes. It gives only indications that position information may have been
forged. This overhearing sensor is not very effective and might only be used in conjunction
with other sensors described above.
13 | P a g e
3.7 Drawback
Drawback of this verification system is that it uses hard thresholds. A solution to this
problem is to use adaptive thresholds that are set according to the location conditions. The
major drawback is that each node only has a local view that might not be enough to reliably
identify all position faking nodes.
14 | P a g e
4. SECURE LOCATION VERIFICATION
Introduction
This verification scheme focuses on solving the problem of in-region verification where a
verifier V wants to verify whether a prover P is in a region of interest. To design this we
consider the following requirements. First, it should be an infrastructure-less cooperative
scheme. This is because we want to minimize the hardware requirements so as to reduce the
costs that may incur due to the infrastructure. We have seen in the previous discussion that
autonomous verification is inefficient so we make use of cooperative verification. Second, it
should be able to detect attacks that are launched without violating threshold values such as
transmission range, speed limit, road map etc. Third, no other special hardware is required
except both GPS receiver and Tamper Resistant Module (TRM) since we are considering an
infrastructure-less approach.
TRM is used to protect the routing module. It is a hardware/software entity in which data and
program cannot be modified by the user. Thus, routing module tampering attacks can be
prevented. It keeps all the necessary cryptographic keys inside, and is capable of
cryptographic processing. It also provides a secure storage of all critical data.
To guarantee a secure key management, Public Key Infrastructure (PKI) with certificate
authority is assumed. A PKI is an arrangement that binds public keys with respective user
identities by means of a certificate authority (CA). CA is an entity that issues digital
certificates. The digital certificate certifies the ownership of a public key by the named
subject of the certificate. A communication is enabled between two nodes with the help of
keys (public keys and private keys). Two types of algorithms are present for this aspect:
symmetric key and asymmetric key algorithms. In the first one there is a single key for both
encryption and decryption. In the second case, messages are encrypted with the recipient’s
public key and can only be decrypted with the corresponding private key.
The three main steps used to verify the location of the prover are:
Use of distance bounding technique to bound the minimum distance between verifier
V and prover P. As explained earlier we know that a prover can only cheat by
15 | P a g e
appearing further from verifier than its actual location. So, any attempt to reduce that
minimum distance will be detected by the verifier. While estimating the distance to V,
it also considers the non-zero processing delay. We assume that the prover can
provide an upper bound to its processing delay.
V conducts plausibility checks after it has received a response from P. The checks
include maximum transmission range (P cannot claim to be located further from the
maximum transmission range of V), acceptable speed limit (no vehicle can move
farther away than the maximum feasible distance between two consecutive beacon
messages), roadway map (to check if P’s claimed location is on the roadway or not).
If prover passes all these plausibility checks then the verifier selects a common
neighbor which gives an estimated location of the prover. If the estimated location of
P is not within some error distance of the ellipse then V can detect the distance
enlargement of P.
4.1 Distance bounding techniques
Distance bounding techniques are used to bound the minimum distance between two devices.
These are used by the verifier V to verify that a prover P cannot claim to be at a distance
which is less than its actual distance. First, the verifier generates a random nonce, Nv and
sends a challenge message which is the Message Authentication Code (MAC). This can be
done only if there is a shared key between the two. So, before the data transmission starts
taking place the two vehicles can set up the secure symmetric key. The prover after receiving
the signal generates a response message with the current location, speed and direction
information and replies immediately with the MAC and the nonce Nv. The verifier then
checks if the nonce Nv and MAC are correct. In the last step, V checks the authenticity of the
response message. If both Nv and MAC are correct, the elapsed time is used to verify the
correctness of the location information of P in a response message (i.e., check whether the
elapsed time
∆t ≤ {2 d (V, P)/ c + ∂}).
16 | P a g e
4.2 Selection of the Best Common Neighbor
We discussed above that after the plausibility checks the verifier selects a common neighbor
to it and the prover, which helps in the verification of the claimed location. To select the best
common neighbor we follow a set of steps.
Consider Fig. 4.1, when the verifier sends a message to the prover, it sends a reply with an
additional delay that enlarges its position to P’. Due to the delay, the estimated location E and
the reported location P’ cannot alway be the same
Figure 4.1: Network topology for minimum distance guarantee
17 | P a g e
6. RESULT
In this report, we discussed the security aspects of VANETs like attacks on security, payment
based applications and attacks on privacy. Then we studied the various algorithms suggested
by different people to deal with these security threats. Later we discussed Secure Location
Verification (SLV) scheme which has the capability of detecting position spoofing attacks. It
is an infrastructure less cooperative scheme which uses techniques like distance bounding,
plausibility checks, TDoA, selecting a common neighbour so as to restrict the position of the
prover onto an ellipse. Mathematical results show that with the help of a common neighbor,
this scheme can efficiently show if any vehicle is enlarging its distance thereby protecting the
network from any kind of damage that could have occured.
18 | P a g e
REFERENCES
[1] Joo-Han Song, Vincent W.S. Wong, and Victor C.M. Leung, “Secure Location Verification
for Vehicular Ad-Hoc Networks”.
[2] B. Karp and H. Kung, “GPSR: Greedy perimeter stateless routing for wireless network,” in
Proc. of ACM Mobicom, Boston, MA, Aug. 2000.
[3] M. Raya and J.-P. Hubaux, “Security aspects of inter-vehicle communications in Proc. of
Swiss Transport Research Conference (STRC), Monte Verita, Ascona, Mar. 2005”.
[4] Jean-Pierre Hubaux, Srdjan C`apkun, Jun Luo “The security and privacy of smart vehicles”.
[5] K. Kang, N.Abu-Ghazaleh, and K. Liu, “Towards resilient routing in WSNs,” in Proc. of
ACM International Workshop on QoS and Security for Wireless and Mobile Networks
(Q2SWinet), Montreal, QC, Oct. 2005.
[6] N. Sastry, U. Shankar, and D. Wagner, “Secure verification of location claims,” in Proc. of
ACM Workshop on Wireless Security (WiSe), San Diego, CA, Sept. 2003.
[7] M.-Y. Iu, “Secure position verification through obfuscation,” in EPFL Mini Project, 2005.
[8] T. Leinmuller, C. Maihofer, E. Schoch, and F. Kargl, “Improved security in geographic ad
hoc routing through autonomous position verification,” in Proc. of ACM VANET, Los
Angeles, CA, Sept. 2006.
[9] Joo-Han Song, Vincent Wong and Victor Leung, “Poster: Secure Routing with Tamper
Resistant Module for Mobile Ad Hoc Networks”.
[10] W. Diffie, P. van Oorschot, and M. Wiener, “Authentication and authenticated key
exchanges,” Designs, Codes, and Cryptography, vol. 2, no. 2, pp. 107–125, June 1992.
19 | P a g e
Top Related