Analysis of Attack Methods on Car-to-X Communication Using Practical Tests

Transcription

1 Analysis of Attack Methods on Car-to-X Communication Using Practical Tests Analyse von Angriffsmethoden auf die Car-to-X Kommunikation durch Anwendung praktischer Tests Master-Thesis von Henrik Schröder Betreuer: Norbert Bißmeyer M.Sc. April 2013

2 Analysis of Attack Methods on Car-to-X Communication Using Practical Tests Analyse von Angriffsmethoden auf die Car-to-X Kommunikation durch Anwendung praktischer Tests Vorgelegte Master-Thesis von Henrik Schröder Betreuer: Norbert Bißmeyer M.Sc. 1. Gutachten: Norbert Bißmeyer MSc. 2. Gutachten: Prof. Dr. Michael Waidner Tag der Einreichung:

3 Abstract With the introduction of Car-to-Car or Car-to-X Communication vehicles become able to exchange location and mobility data via ad hoc communication. This way, drivers can be warned about potential dangers on the road and both traffic safety and traffic efficiency can be increased. Since attacks on this system could endanger the safety of drivers, the security of the system plays an important role. In this master thesis different attack methods on Car-to-X Communication are analyzed in terms of attractiveness for an attacker and potential impact on the system. Subsequently, the most probable attack method is considered further. An attacker is assumed that is able to introduce a malware into the on-board system of a vehicle. This malware sends out messages with false location and mobility data and thus simulates a ghost vehicle that performs emergency braking maneuvers. That way warning messages are triggered in neighboring vehicles which could misguide drivers or even lead to dangerous driving maneuvers. The attacks are evaluated in both a laboratory environment and with test vehicles on a dedicated test site. Based on the results of this work defense mechanisms against such attacks can be refined in future work. 1

4

5 Erklärung zur Master-Thesis Hiermit versichere ich, die vorliegende Master-Thesis ohne Hilfe Dritter nur mit den angegebenen Quellen und Hilfsmitteln angefertigt zu haben. Alle Stellen, die aus Quellen entnommen wurden, sind als solche kenntlich gemacht. Diese Arbeit hat in gleicher oder ähnlicher Form noch keiner Prüfungsbehörde vorgelegen. Darmstadt, den 22. April 2013 (H. Schröder) 3

6

7 Contents 1 Introduction Motivation Basic Concepts Mobile Ad Hoc Networks Wireless Sensor Networks Vehicular Ad Hoc Networks Attacks on Vehicular Ad Hoc Networks Classification of Attackers Classification of Attacks Risk Analyses PreServe EVITA ETSI simtd Related Work A model of a roadside attacker Simulations of position forging attacks Defense mechanisms against position forging attacks Analysis of Attack Methods Attack Methods Assessment Criteria Assessment of Attack Methods System Model Concept EBL application Choosing of a victim Attack sequence Attacker parameters Implementation Evaluation 47 5 Discussion 51 6 Conclusion 53 5

8

9 1 Introduction With the increasing amount of road traffic the security of road users has to be ensured. According to the World Health Organization, 1.24 million road deaths occurred in 2012 worldwide [27]. Furthermore, efficient traffic flow has to be maintained. One approach that could help to achieve these goals is the introduction of Car-to-Car (C2C) communication. With this technology, all the vehicles taking part in traffic are equipped with radio communication devices that enable the exchange of location and mobility data among vehicles. Thus, vehicles become aware of neighboring cars and their movement. By comparing the received data with its own position, speed and heading a vehicle can check for dangerous traffic situations that could lead to accidents. As soon as such a dangerous situation is detected the driver can be informed using visual and acoustic warnings. This way, drivers can be made aware of situations that require appropriate driving maneuvers and that might lead to accidents when no action is taken. In addition to inter-vehicle communication the more general term Car-to-X (C2X) communication also includes the exchange of information between vehicles and road infrastructures. By communicating with traffic lights vehicles may for example inform drivers about the remaining time of a green light phase. A system that provides C2X communication is also called a Vehicular Ad Hoc Network (VANET). In the next section the motivation of this work is presented. After that basic concepts are introduced on which this work is based. In the remaining sections of this chapter an overview of attacks on VANETs is given and the assessments of such attacks in various risk analyses are presented. The chapter concludes with a presentation of related work. In Chapter 2 different attack methods, that could be applied by attackers in a VANET, are analyzed. The attack methods are evaluated in terms of required effort and potential impact. In Chapter 3 the implementation of the most probable attack method is described. The results of test runs in which the implemented attacks were carried out are presented in Chapter 4. After a discussion of the results in Chapter 5 a conclusion of this work is given. 1.1 Motivation A VANET has the potential of a significant increase of both, the safety of road users and the efficiency of traffic flow. However, with the use of ad hoc communication, attacks on the systems may become possible. Therefore securing the system against such attacks plays an important role. Only if attacks can effectively be prevented or detected a reliable functioning of the C2X communication can be ensured. While many works exist that propose various defense mechanisms only a few works focus on possible attacker methods. However, only with the knowledge of these methods and their possible impact on a VANET, appropriate defense mechanisms can be implemented. Therefore, in this work different attack methods are analyzed that could be applied by attackers in the system. The outcome of the analysis is the most probable attack method, that is subsequently considered in more deetail. After implementing an exemplary attack in a laboratory environment, the attack is then evaluated using test vehicles that are equipped with prototypic C2X communication devices. By using real systems for the evaluations a better understanding of the potential impact of the executed attack can be derived. Though the test runs are performed on a dedicated test site, similar attacks could also occur in a later deployment of a VANET. The results of this work aim to be helpful for the development and refinement of defense mechanisms. By implementing appropriate countermeasures the considered attacks must be prevented in a real VANET. 7

10 1.2 Basic Concepts This section starts by introducing the concept of Mobile Ad Hoc Networks (MANET). After that Wireless Sensor Networks (WSN) as a subtype of a MANET are presented. Finally, the concept of a VANET as a further subtype of a MANET is introduced in detail providing the background for further chapters Mobile Ad Hoc Networks Over the last decades, MANETs have received a lot of attention among researchers. In contrast to wired networks, in which connections between nodes are determined by the infrastructure, connections between nodes in MANETs are made ad hoc. This means that any two nodes of the network establish a connection between each other if they are within their respective radio transmission range. With respect to the communicating nodes in a MANET, two types of networks are distinguished. In a single-hop network only direct neighboring nodes can communicate with each other, i.e. every node only communicates with other nodes that can be reached in a single hop. Usually though, a MANET is assumed to be a multi-hop network, in which communication is also possible between distant nodes that are further apart than the single-hop distance. In a MANET, the individual network nodes are assumed to be mobile whereat the extent of mobility varies depending on the specific use case of the network. Due to this mobility of network nodes the set of nodes that are connected to each other is subject to constant change. New connections may become available or nodes are cut off from the network. This means that the network has to constantly reconfigure itself in terms of network routes or address allocation. The obvious advantage of a MANET is that such a network can be established without the need of a preexistent infrastructure. Once network nodes are deployed and are within radio transmission range, they automatically set up network routes for example. Furthermore, in the case that a network infrastructure has been destroyed, a MANET can be used as backup. For example, MANETs are proposed to be used by emergency response teams after earthquakes or volcanic eruptions where no conventional network communication is possible. Further proposed use cases include military operations since MANETs can be used during hostile battlefield operations where no usable network infrastructure exists. As described in [18] or [25] the evolution of MANETs began in the 1970s. In the beginning, devices were big and needed considerably more energy than today. Furthermore, the possible data throughput was small and only simple routing protocols were used. Due to the possible application of MANETs in battlefield operations, the U.S. military performed several projects in the following years to reduce the size and energy-consumption of the used devices. Over the years, new technologies and standards like IEEE for wireless networking have become available and the prices for the needed mobile devices have dropped significantly. There are two prominent groups of routing protocols used in MANETs [18]. The group of reactive routing protocols only establishes network routes on demand. This implies a certain delay at the beginning of a communication between nodes since a network path has to be established first. However, reactive routing protocols can be very efficient in terms of energy consumption since the routing overhead is low. This is especially the case in networks with only little communication. The second group are proactive routing protocols that constantly maintain network routes between nodes. Thus, the route is available immediately when a communication between two nodes is about to be initiated. Because of the higher amount of routing overhead these protocols are rather suitable for networks with a lot of communication. In the end it always depends on the use case of the MANET which type of routing protocol should be chosen. 8

11 1.2.2 Wireless Sensor Networks A special type of MANET are WSNs. Similar to MANETs, a WSN is a self-organizing network of independent nodes that also typically use multi-hop communication. Though, a WSN differs from a MANET in several aspects [38] as listed in the following: Communication: In a MANET communication is mainly done on a point-to-point basis. In a WSN, the nodes do not typically communicate with each other but forward data to a single sink node. Thus, the communication goes from many sources to one sink. Mobility: Whereas the mobility of nodes in a MANET can be very high depending on the use case, the individual sensor nodes in a WSN are not mobile. Energy: In a WSN energy is a limited resource. Thus, efficient use of the available energy is important for both hardware and software. In MANETs, shortage of energy is typically not a problem because the devices can easily be recharged or have a constant power supply. Node count: While a WSN with only a few nodes may make sense in some use cases, in general the number of nodes in a WSN is much higher than in a MANET. This way the coverage of large areas is possible. The main focus of applications for WSNs include data collection, monitoring and surveillance of certain environments [38]. Each node consists of the sensing hardware, a processor, memory, the power supply and a transceiver for wireless communication [40]. Depending on the use case, the cheap and smart devices are deployed on the ground or in water, on vehicles or even on humans. The individual nodes then observe or sense specific events and forward this data to one sink node. Advances in sensor technology have generated many kinds of small, low-power sensors which include acoustic, infrared, magnetic or seismic sensors [4]. The data that is collected by the sensor nodes may be processed or aggregated in part by the nodes itself i.e. in the network. But often this is only done to reduce the amount of data that has to be transmitted. The collected data is then forwarded to a sink node located out of the network where further processing takes place. At the sink node, an administrating instance is able to monitor the network and react to the observed events. According to [4], modern research of WSNs began around As with MANETs, military projects were the main driver for early research in the field of WSNs. An example for this is the DARPA Distributed Sensor Network Project. In this project a WSN was used to track vehicles by using acoustic sensors. Over the years the energy consumption of sensing devices could be decreased while processing power and transmission range increased. Apart from military purposes, prominent use cases for WSNs include habitat and environment monitoring or traffic surveillance [2]. The flexibility, easy deployment because of the absent infrastructure and the ever-decreasing cost of the hardware constantly allow for newlyevolving use-cases for WSNs in many different areas. In the following, two exemplary use cases of WSNs are described. In [26], the authors describe ExScal, a project in which a WSN of more than 1000 nodes was used for the surveillance of an area of 1.3 km by 200 m in Florida in Intruders like people or vehicles could accurately be detected, tracked and classified using infrared sensors. In similar deployments WSN could be used to effectively protect pipelines or borders at low cost and low human effort. Another exemplary use case of a WSN is the SMART system described in [6]. In this system a WSN was used over a 18 month period to track vital signs of patients in an emergency room in Boston. The motivation of this project was that many patients entering an emergency room are not immediately seen by a doctor but have to wait for a considerable amount of time. The WSN was used to track vital signs like electrocardiogram or oxygenation level of waiting patients and to generate alarms in case the condition of a patient worsened. 9

12 1.2.3 Vehicular Ad Hoc Networks A VANET is a special MANET that is established by vehicles and road infrastructure. Before the different aspects of a VANET are described in more detail, this section lists the differences between a VANET and a general MANET according to Schoch [36]. Communication: Several communication patterns are proposed for a VANET. In addition to the point-to-point communication found in MANET, these include periodic single-hop broadcast messages for position updates as well as event-based multi-hop information dissemination within a specific area. Mobility: In a MANET the mobility of nodes will usually be similar for all nodes in a specific application. In contrast, the mobility of vehicles in a VANET varies heavily from zero for a standing vehicle or a road-side unit up to more than 200 km/h for a vehicle on a highway. Energy: Energy consumption in a VANET is less of an issue as in a MANET. Whereas MANET nodes can typically be recharged from time to time, the batteries of VANET nodes could constantly be recharged when in operation. Node density: The node density varies heavily in a VANET. The number of neighboring nodes within communication range can vary from zero on rural roads up to more than 100 in traffic jams on big highways. In a MANET, node density will often be similar within the network. Node count: The number of nodes in a VANET will increase in the deployment phase when more and more vehicles are equipped with C2X communication devices. Eventually, the node count in a VANET will be much higher than in typical MANETs with millions of vehicles worldwide. Node types: In contrast to a MANET, there are various node types taking part in a VANET. Even though most of the nodes will be private vehicles, also Road-Side-Units (RSU) and public service vehicles with additional privileges are taking part in a VANET. Computing power: In consequence of the better energy supply in vehicles more powerful equipment can be employed in a VANET in comparison to a MANET. Also due to the increasing CPU performance at decreasing power consumption, computing power will most likely not be an issue in a future VANET. Entities of a VANET In general, the authors of [5] distinguish three different domains within a VANET: The in-vehicle domain, the ad hoc domain and the infrastructure domain. The in-vehicle domain refers to the subsystem that is located in each C2X-enabled vehicle and road-side station. This system consists of one or more Application Units (AU) that run the various VANET applications and one On-Board Unit (OBU) that provides C2X communication capabilities. The ad hoc domain stands for C2X-enabled vehicles and possibly RSUs within a geographically limited area. When these nodes are within single-hop communication distance of each other they establish an ad hoc communication channel to enable safety or traffic efficiency applications. In special cases multi-hop communication is also used. An example for this is a warning about a road hazard that has to be disseminated within a certain area. Finally, the infrastructure domain refers to the network infrastructure that is provided by some public authority. It basically provides access to external networks like the Internet via RSUs. Furthermore, this allows for connections to a Traffic Management Center and a Certification Authority (CA). In the following list the different entities of a VANET are described. 10

13 AU: The AU is usually a dedicated device that is embedded into each C2X-enabled vehicle and RSU. On the AU different VANET applications are running like traffic safety applications or navigation software. To be able to show information to the driver, the AU can be connected to a Human- Machine Interface (HMI). For communicating with other entities the AU uses the communication capabilities provided by the OBU. OBU: The main purpose of the OBU is providing access to the wireless communication to the AU. Each OBU has a wireless communication device that is used by the vehicles to exchange information related to road safety and traffic efficiency. Most likely this communication device will use the IEEE p standard [37]. Additionally, an OBU may be equipped with further communication devices e.g. for access to mobile networks. This allows an OBU to communicate with entities like the Traffic Management Center even if no connection via a RSU is possible. When within communication range, OBUs exchange messages via ad hoc communication. Being connected to its own internal vehicle network, the OBU has access to location and mobility data which is broadcasted regularly to nearby vehicles. Also, the OBU is capable of routing. Thus, it may forward data sent by other nearby OBUs. Finally, the OBU applies security mechanisms e.g. signing and encryption of the sent data. The OBU may also be called Communication and Control Unit (CCU). RSU: A RSU is a fixed communication device that is located near the roads. Similar to OBUs, RSUs are equipped with a wireless communication device that uses the IEEE p standard. By ad hoc communication with nearby OBUs the RSUs can enhance the communication capabilities of the vehicles. For example, RSUs may forward data received from a nearby OBU in order to increase its communication range. On the other hand RSUs could support safety applications by disseminating information about fixed road hazards or road layouts of crossroads. Finally, RSUs may provide Internet access to OBUs allowing them to communicate with a central traffic management center. Traffic Management Center: According to [20], Traffic Management Centers are operated by public or commercial institutions. They are responsible for collecting and providing traffic information in order to optimize the traffic efficiency. Traditionally, the information about traffic flows is gathered with cameras or special sensors nearby roads and crossroads. In turn, the Traffic Management Center can influence the traffic flow by controlling variable information signs or the intervals of traffic lights. By introducing VANET communications, the capabilities for information gathering and dissemination of the Traffic Management Center could be increased significantly. By receiving anonymized traffic flow data of C2X-enabled vehicles the current traffic situation can be analyzed more precisely and the drivers can better be informed. For example, local route advices could be delivered via C2X communication to drivers in the relevant geographic area. CA: A CA could be located at the Traffic Management Center. It is responsible for providing digital certificates to vehicles that are taking part in a VANET. This way it is possible for vehicles to validate signatures of received messages. In case an attacker is detected in the system the CA is able to revoke his certificate. By disseminating this information to the vehicles, the attacker is practically excluded from the system. Other vehicles can quickly detect data received from the attacker and discard it. More details concerning the security of a VANET will be discussed later. Architecture The architectural layers of the C2X system running on each Intelligent Transport System (ITS), i.e. vehicles and RSUs, are depicted in Figure 1.1. As can be seen, only the Applications Layer is implemented on the AU. All the other layers are implemented on the CCU. In the following, an overview of their main responsibilities is given [10]. 11

14 Applications AU MA FA SA Management MF MN MI Facilities NF Network & Transport IN Access SF SN SI Security CCU MS Figure 1.1: ITS station reference architecture as standardized by the ETSI [10] Applications Layer: The applications layer is where the individual VANET applications are located. The European Telecommunications Standards Institute (ETSI) categorizes the applications into the three groups road safety, traffic efficiency and other applications. An overview of the range of applications is given in a later section. According to their respective purpose, the applications are assigned with a certain priority which determines among other things their possibilities to use the communication channels. Facilities Layer: The facilities layer provides a range of functionalities, that are shared among the applications running in the Application Layer. For example, it provides access to a HMI. This way, applications may present information or warnings to the driver when required. Furthermore, common information about the respective station is made available to the applications. This includes information about the surrounding area e.g. a digital map but also data like the current time and position or information concerning the currently available communication channels and their capabilities. Finally, this layer supports the management of the communication with other stations in the system. It is ensured that messages are sent in accordance to the requirements of the station. Also the repeated sending of event-based messages is handled by this layer which can be triggered by applications. Network and Transport Layer: This layer basically contains implementations of the needed network and transport protocols. UDP and TCP may be examples for transport protocols among others. As network protocol this may be a special type of IPv6 or further protocols specifically designed for VANETs. Different communication patterns that may be used in a VANET will be introduced in the next section. Access Layer: The access layer provides physical connections to the various communication channels like ITS-G5 or 3G. The access to communication mediums is controlled here and the priorities of applications and messages are considered during this process. Management Layer: This layer contains various management functionalities that ensure the correct operation of the ITS station. One group of functionalities concerns application management, for example functionality for installing and updating applications. Also application error handling or detection of harmful application behavior is implemented here. Next, this layer is responsible for the congestion control of the communication channels. For this purpose, the priorities of messages may be changed depending on the current communication load. 12

15 Security Layer: In the security layer all of the security related functionality is located. Besides controlling intrusion detection this includes signing and encryption of outbound messages as well as the verification and decryption of received messages. Finally, the cryptographic material is managed in this layer. The security aspects of a VANET are covered in more detail in a separate section. Communication The communication technology that will most likely be used in a VANET is introduced first. After that the two main message types are defined that are most important for traffic safety and efficiency functions in VANETs. Finally, various communication patterns for the typical VANET applications are described. The main communication standard to be used by the core safety applications is IEEE p [37] defined by the IEEE for both C2C and C2X communication. Based on the family of IEEE standards that are widely used for wireless networking, IEEE p takes into account VANET-specific requirements. For instance, it allows higher communication ranges and better tolerates the high mobility of network nodes. In the Unites States, the frequency spectrum between GHz and GHz has been allocated by the Federal Communications Commission (FCC) for so-called Dedicated Short-Range Communication (DSRC) in vehicular networks. In Europe, the term ITS is more commonly used in the area of vehicular communication. Here, the frequency spectrum between GHz and GHz has been allocated for this purpose by the European Commission. Based on these frequency spectrum regulations, the ETSI defined several standards among which ITS-G5A is the core part to be used for safety applications. A dedicated frequency range assures that safety-related messages are transferred in a timely manner and interferences with other applications using these frequencies are prevented. Apart from IEEE p, a wide range of further communication technologies can be used for nonsafety applications. For example, it is supposed to use other protocols of the IEEE group for media streaming. Furthermore, mobile networks like GSM, UMTS or LTE might be used for the communication between vehicles and the traffic management center in case no connection via RSUs is possible. After MAC Data Network Data Security Data C2X Payload Data Figure 1.2: General structure of a C2X message describing the communication technology, the structure of a C2X message is explained. The general structure of such a message is depicted in Figure 1.2. As can be seen each message consists of four sections. The first section contains common data like the length of the message and the protocol version. The network data section contains data concerning the routing of the message. This includes the location and mobility data of the sender as well as the destination of the message. The content of the network data section is exclusively used by the network layer. The fourth section of a C2X message contains the actual payload which is used by the applications layer. This data is set and read by the applications running on the AU. Among other data, this section again contains the location and mobility data of the sender. Finally, the security data section contains data concerning the security. This includes the signature and certificate for the message. This data is used by the security layer. All of the layers introduced in Section are operating strictly separated from each other. This means that the data of each message section is only used within one architectural layer. Furthermore, no consistency checks of data of different layers are performed. For example, the locations stored in the network data section and the payload data section are not checked for consistency. In the next two paragraphs the two main C2X payload data types are defined in more detail. The messages are called Cooperative Awareness Message (CAM) and Decentralized Environmental Notification Message (DENM). 13

16 CAM The CAM as standardized in [13] is sent periodically by every vehicle taking part in a VANET to inform nearby vehicles about its presence and mobility. The message is sent as single-hop broadcast using the ITS-G5A network so that all vehicles within radio transmission range get informed. In the following, the most important information contained in a CAM is listed: StationID Position Heading Speed Further defined data fields include for example the length and width of the vehicle and the current acceleration. Depending on the situation, a CAM is sent out with different frequencies between 1 Hz and 10 Hz. Each vehicle stores the data received from nearby vehicles in the so-called neighborhood table which stores the data and always holds a up-to-date view of the surrounding area. By using the neighborhood table applications can assess the situation on the road to perform use cases like generating a warning message in case a collision becomes imminent. DENM The DENM is the second main message type [14]. In contrast to the periodically sent CAM, the sending of a DENM is event-triggered. DENMs are mainly used to alert drivers about road hazards. The standard TS [14] defines 13 events that trigger the sending of a DENM, for example road-works or a vehicle performing an emergency brake. Also, DENMs can be used in terms of traffic efficiency e.g. warning about traffic jams. The main data fields contained in a DENM are Event type Geographic area / position Detection time Duration Once a vehicle detects an event that triggers a DENM it starts transmitting the warning message at a certain frequency. In contrast to a CAM, a DENM should be disseminated to as many vehicles as located within the geographically relevant area which is defined in the message. Therefore, vehicles may forward the message upon reception. Furthermore, the sending of the warning message can also be relayed to other vehicles in case the originating vehicle has already left the geographically relevant area. The dissemination of the DENM either ends at a predefined expiry time or until the end of the event is explicitly announced e.g. when road-works are finished. The characteristic mobility of the nodes in a VANET also influences the communication among them. On the one hand the speed of participating nodes varies heavily. When two vehicles pass each other at high speeds and in opposite directions they are only able to communicate during a small timeframe of a few seconds. This includes that communication links between neighboring vehicles are cut off regularly and new connections are established. A further characteristic in a VANET that influences the communication is the varying node density. On rural roads that are only used by a few cars at a time it is likely that there are no vehicles within communication range. On the contrary, the number of vehicles within range can well exceed 100 in traffic jams on highways. In such a scenario it has to be made sure that the communication channel does not get overloaded by too many simultaneously sending vehicles. This could be achieved by reducing the transmission frequency in such cases. 14

17 In [35], the authors distinguish five communication patterns that are applicable in a VANET. In the following these patterns are explained and examples are given on how they might be used. The first communication pattern is called Beaconing. It is for example used for the already described CAM that is sent out regularly by every vehicle containing location and mobility data. Another example for communication using Beaconing are RSUs that provide information about crossroad layouts to nearby vehicles. Geobroadcast is the second communication pattern. Its purpose is to disseminate an information about a certain local event within a defined geographic area. Typically the DENM is used for this purpose. A broken-down vehicle on a road may for example trigger this pattern to warn approaching vehicles about its position. As soon as the event is detected by a vehicle it broadcasts the corresponding message so that all nearby vehicles are informed. Each vehicle that receives the message at first checks whether it is located within the relevant area that is defined in the message. If this is the case, the contained data is forwarded to the application layer for further processing. Additionally, the message is broadcasted again and thus passed on to further vehicles that may not be within communication range of the originating vehicle. This way all vehicles within the relevance area get informed about the event. Vehicles that receive the message but are located outside of the relevance area simply discard the message and do not re-broadcast it. Thus, the message is not further disseminated in areas where it is not relevant. In case the node density remains high enough throughout the relevant timespan, the information about the event stays known to all affected vehicles as long as the message is sent once by the originator. But it is also possible that the node density is too low so that the information gets lost. In this case it makes sense for the originating vehicle to resend the message on a regular basis. This might be the case for a broken-down vehicle. Usually, Unicast Routing refers to the transmission of a message from one network node to another. But in a VANET specifically, also a geographic area could be defined as the destination of the message. Here, the message would be transmitted to all vehicles located within that area. Since sender and receiver in general are not within single-hop distance to each other, Unicast Routing is assumed to use multi-hop communication. According to the authors of [35], position-based routing has proven to be effective for this purpose since it takes into account the mobility of the vehicles. In general, this communication pattern is used by non-safety related applications. Advanced Information Dissemination is described as information dissemination to vehicles throughout a certain timespan. It should be possible to tolerate network partitioning and define priorities for certain information that are considered with respect to bandwidth for example. Using this communication pattern also vehicles are informed that can only be reached at a later time. For the actual information dissemination there exist several approaches. In the Abiding Geocast (store-and-forward) approach [23], each vehicle stores the received information for a certain timespan. This makes it possible to send out this information once a new neighboring vehicle is detected. In another approach called Context-Adaptive Message Dissemination [19] context information is stored within each message. Again, receivers of the message store the data and send out messages according to their current importance. By evaluating the attached context information the importance of a message can be updated regularly. Using this approach, the available bandwidth could be used according to the calculated importance for example. Contrary to safety-related applications, this communication pattern will rather be used to make known certain information to all the vehicles within a possibly large area. An exemplary application could be an update of the on-board digital maps or a Certificate Revocation List (CRL). In Information Aggregation, the received information is processed and possibly altered. Though information is to be made known to vehicles the transmitted size of data shall be reduced by aggregating it. In Information Aggregation each vehicle has a certain amount of local knowledge that is maintained. 15

18 This knowledge may be gained by the local sensors but also by received data from other vehicles. Each time when new information arrives, it is integrated into the existing knowledge. This way, the vehicle has always access to the latest data which is also sent out to other vehicles. If for example a traffic jam is detected by several vehicles on a highway, not all of the associated messages do need to be forwarded but only one condensed message. Applications There is a widespread spectrum of applications that may be introduced into a VANET [5, 11, 28, 41]. In this section examples of possible applications are described using a common classification into the groups safety, traffic efficiency and others. Safety The applications of this group aim at directly improving the safety of drivers. These applications are a main driver for the development of a VANET. One application is the forward/rear collision warning. In today s road traffic a lot of rear-end collisions occur. Reasons for such collisions include the distraction of drivers in dense traffic or sudden brake maneuvers combined with low distance between the vehicles. Also, at low visibility the brake intensity of vehicles in front may be underestimated by drivers. In a VANET, vehicles are aware of the mobility data of surrounding vehicles and thus are able to detect situations where collisions become possible. In this case the application could warn the driver visually, acoustically or even haptically in order to prevent collisions. Already, there are systems that aim at avoiding collisions with vehicles in the front by using radar sensors that detect nearby objects. However, if the braking vehicle is not visible because it is hidden by another vehicle or also in bad weather this may not work. By using C2X communication, the effectiveness of such applications will be improved. Similar to the forward/rear collision warning, electronic brake lights (EBL) may help to reduce collisions due to vehicles performing emergency brakings that are not adequately recognized by following vehicles. Again, vehicles in between could block the sight on the braking vehicle for example. Also, when emergency-braking is performed, following drivers have to react quicker and may need to brake harder themselves in order to prevent a collision. The EBL application can be seen as an enhancement of the conventional brake lights. Once a vehicle detects a hard braking maneuver of its driver it sends out a warning message in order to notify surrounding vehicles about this event. Based on the location and mobility data contained in the message each receiving vehicle is now able to determine whether the brake maneuver may interfere with its own movement path. In this case the driver can be warned based on the locally calculated time to a possible imminent collision. Apart from brake maneuvers, collisions may occur due to misbehaving or misjudging driving at intersections. Since in these situations vehicles are driving within low distance to each other, drivers can only react during short timespans in case a vehicle does not comply with the traffic lights or the priority in traffic. Applications that may help to prevent collisions in this case include the left turn assistant or the traffic signal violation warning / intersection collision warning. Especially in scenarios with dense traffic it is not always easy for drivers to judge when a left turn at an intersection can safely be performed in order not to risk a collision with vehicles driving in the opposite direction. In these cases a left turn assistant could support the driver during these maneuvers. When the application detects a left turn by the driver, it could evaluate C2X messages received from crossing vehicles and warn the driver in case a collision could occur. Another scenario would be that the application advices the driver beforehand whether a left turn can safely be performed without interfering with crossing vehicles. Since this could only reliably be done if all vehicles are equipped with C2X devices, additional sensors could be used at intersections to check for crossing traffic. Also the regular transmission of the intersection layout by stationary RSUs could help to increase the precision of this application. 16

19 In case the signaling phases of traffic lights are also transmitted, it becomes possible to warn drivers when they are about to violate a red light. Additionally, in case the traffic light violation is not prevented on time, nearby vehicles could be informed similar to the emergency braking warning. Traffic Efficiency Apart from preventing collisions, the transmission of signaling phases could also help to increase traffic efficiency as well as driving experience. With an application called Green Light Optimal Speed Advisory (GLOSA) vehicles are enabled to provide speed advisories to their drivers based on the received signaling phase data and their own position and speed. Thus, the likelihood of reaching the intersection during a phase of a green traffic light can significantly be increased. Apart from increasing the possible traffic flow, stops due to red lights are minimized which also increases the driving experience for the driver. For this purpose, additionally the remaining time of the current green and red light phases could be presented to the driver allowing him to achieve a smoother and more relaxed driving. With an increase in traffic volume an efficient traffic flow control will further gain importance. Already today navigational systems are able to display information about traffic jams or road works to drivers and consider this information while finding the best route. In a future VANET system the accuracy of this information could be significantly increased by dynamically updating the information using mobility data from vehicles. When this mobility data is processed in traffic management centers additionally dynamic traffic signs can be updated accordingly or route guidance information can directly be sent to vehicles on a certain route. Finally, a parking spot locator application could help drivers to find the nearest parking spot in their vicinity. For this purpose information about free parking capacities of parking garages or locations of free parking spots in a city can be used. Others Many different applications belong to this group. Although safety and efficiency applications are more important there are also applications providing less use but that are still improving the driving experience. It is believed that these applications could help during the deployment phase of a VANET by providing benefit to the first users. As long as the percentage of vehicles equipped with C2X devices is low the safety applications will not yield a significant benefit. Thus, the technology could be rejected by possible users e.g. due to the additional cost. An often named application in the literature is the possible Internet access in vehicles. This indeed would be possible if RSUs act as access points. However, it is questionable if the relevance of this will still be as high as today given the fast evolution of mobile networks that already enable Internet access on smart phones for example. Maybe RSUs could provide free access in order to increase the attractiveness of the system. Furthermore, payment services may become possible to be performed via C2X communication. This way, toll collection could be automatically be performed. Further examples where this could be used are parking garages or gas stations. Finally, remote diagnostic services or information about nearby points of interest are further possible applications. Security The safety of drivers within a VANET can be threatened by attacks on the system. For this reason the security plays an important rule in such a system. In this section, first general definitions of security goals are given and their roles in a VANET are stated. After that the main security mechanisms are presented that should be included in a VANET in order to achieve the defined security goals. The definitions of the general security goals are based on [9]. The discussions of these security goals and the consequences concerning a VANET are based on the respective elaborations in [16], [20], [31] and [36]. 17

20 Authenticity: Authenticity refers to the genuineness and trustworthiness of an object or a subject. The authenticity can be verified with an unique identity and characteristic features. The verification of authenticity is referred to as authentication. A user could for example use a password to prove his identity. Furthermore, authentication is very important for communication in networks. By using authentication techniques, a receiver of a message is able to determine whether a message originates from the reported sender. In a VANET, authenticity is one of the most important security goals. Only entitled nodes are allowed to participate in the C2X communication. Since vehicles have to rely on the received data, they have to authenticate the senders of each received message. This way it can be determined if the sender is a valid participant of the system. Furthermore, it is important to be able to define different roles in a VANET. Emergency vehicles for example could be able to preempt traffic lights in case of an emergency. It has to be determined whether a vehicle that requests such an action is entitled to do so. This process is also referred to as authorization. An other example where authenticity needs to be determined are software updates for the on-board applications. Without authentication it would not be possible to decide whether a new software originates from a trustworthy source or if a software may be malware. Integrity: Within a system that provides integrity, it is not possible to alter data without the right to do so. Deletion or addition of data also counts as alteration in this case. This definition implies that it has to be specified, who is allowed to change which data. In order to provide data integrity one could make unauthorized alteration of data impossible. In systems where this is not possible it has to be able to detect each unauthorized data alteration afterwards. The integrity of sent data has to be ensured in a VANET. This guarantees that attackers are not able to change the contents of a sent C2X message. This is important because messages are often forwarded by various participants before reaching their destination. If the integrity is not guaranteed, an attacker could modify the content of received messages before forwarding them. Apart from the intentional alteration of data also non-intentional data alteration has to be considered. Due to technical defects or software faults this can not fully be prevented. Thus, there have to exist mechanisms that detect this unintentional data alteration afterwards. Cryptographic hash functions are an example for this. Confidentiality: The confidentiality ensures that no unauthorized gain of information is possible. This guarantees that information only reaches participants that are entitled to access it. Similar to integrity, this implies a definition of data access rights for each participant. In principle, confidentiality can be achieved using various techniques of encryption. As long as only authorized participants possess credentials that are needed to access the encrypted data, this makes sure that the confidentiality of a sent message is provided. Requirements regarding confidentiality are application specific in a VANET. Most traffic safety and efficiency applications do not require confidentiality or even not want it. Examples for this are the transmission of CAMs to nearby vehicles or messages warning about road hazards. For this data there are no requirements regarding confidentiality because this information is to be made known to all of the affected vehicles. Other applications like Internet access in cars have to be secured using confidentiality. Availability: In a system that provides availability, it is not possible to hinder authorized and authenticated users to perform a certain action. Note, that such a hindrance can also be induced by permitted actions. Thus, it can not always be determined, whether the hindrance was caused on purpose or not. For example, if one user s access of a shared resource increases, this could reduce the possible access to that resource for other users. Many of the security relevant VANET applications are based on time-critical communication with other vehicles. To provide a fault-free operation of these applications, the availability of the system 18