VANET Security and Privacy. V-Sec April 2012

Transcription

1 VANET Security and Privacy V-Sec April 2012

2 A Brief Introduction to VANET Mobile Ad-hoc Network (MANET) Vehicle to Infrastructure (V2I) Vehicle to Vehicle (V2V) 2

3 3 Applications Safety Congestion P2P I've can haz internets I'm here. 911! I am incoming. There's a lot of people over here. Hmmm...

4 4 Physical Layer Challenges Differences from classic MANET QoS Time Variability in density Delay Tolerant Networks Store-carry-forward CSMA a p Prevailing protocol for traffic simulations Can be improved for flooding

5 Safety Routing Constraints Time Flooding Suggested Protocols Core Assisted Mesh Protocol On-Demand Multicast Routing Protocol Multicast AODV Multicast OLSR

6 An Example of Flooding Geographic Aware Flooding Accident Site Biswas et al. from VEHICLE AD HOC NETWORKS: APPLICATIONS AND RELATED TECHNICAL ISSUES

7 Data Dissemination Limitation It's all about relevance Limit by geographic area Limit by hop count

8 Packet Storm AODV 5.9 GHz, 10MHz channel, 20mW transmission power, receiver sensitivity threshold -95dBm N. WISITPONGPHAN et al. BROADCAST STORM MITIGATION TECHNIQUES IN VEHICULAR AD HOC NETWORKS

9 Introduction Questions Questions on these topics? Implementation Application Flooding

10 An Introduction to Security Get your security hat on Integrity Privacy Authenticity / Liability Verification of Data Consistency Availability (Timeliness) Who is the adversary? Insider vs Outsider (Not a Stephen King villain!) Malicious vs Rational Active vs Passive Local vs Extended M. Raya and J.-P. Hubaux / Securing vehicular ad hoc networks

11 PKI Every vehicle obtains trust from a trust authority Do you see problems with this?

12 Key Storage and Management Keys stored psuedo-securely within the vehicle TPM Identity Electronic License Plate Electronic Chassis Number ID paired to Key Anonymous Keys Preserve Privacy Define a set of authenticated psuedonyms

13 Key Revocation Send a revocation message to the vehicle Send a revocation to the region Send a revocation to the world! Do you see a problem here?

14 Alternate Keying Schemes In short, why we don't use these. Pairwise keys Does not scale Short connection times Group Communication Fast fragmentation Fast join Rekeying Vehicles traveling in the opposite direction

15 Geographic Grouping Group membership defined by road segment Preloaded segments and GPS needed Leader needed No Non-repudiation

16 Anonymity Key changing Interval Lower bound Upper bound Number of Messages This makes no sense to me d r d v d r datt

17 More Problems Questions? Secure Geocast DoS Hopeless for now, but can we notify the driver? Data Verification This is the same as MANET node consensus Secure GPS Non-existent

18 Flooding-Resilient Broadcast Authentication for VANETs Hsu-Chun Hsiao, Ahren Studer, Chen Chen, Adrian Perrig Carnegie Mellon University Fan Bai, Bhargav Bellur, Aravind Lyer General Motors

19 Vehicular Ad Hoc Network (VANET)! Each vehicle possesses an On Board Unit (OBU) " Broadcast information for safety and convenience Location, Speed Obstacle ahead Obstacle ahead Location, Speed Flooding-Resilient Broadcast Authentication for VANETs

20 Broadcast Signatures! Secure wireless communications 1. Origin Authentication G at (x,y ) 2. Message Authentication G at (x,y ) G at (x,y) 3. Non-repudiation G at (x,y) G at (x,y)! IEEE VANET security standard " Digitally signs every message using ECDSA algorithm Flooding-Resilient Broadcast Authentication for VANETs

21 Signature Flooding! Expensive verification " 22ms to verify ECDSA signature on 400MHz processor! Many messages may arrive in a short time period " Every vehicle broadcasts location every 100ms Signature flooding severely limits effectiveness of VANET applications. Flooding-Resilient Broadcast Authentication for VANETs

22 Outline! Background and Motivation! Entropy-aware authentication! Flooding-resilient schemes " FastAuth: single-hop periodic messages " SelAuth: multi-hop messages! Conclusion Flooding-Resilient Broadcast Authentication for VANETs

23 Entropy-Aware Authentication Scheme s overhead should match the entropy of broadcast messages.! Fast Authentication (FastAuth) --- exploits predictability of future messages " Replaces expensive ECDSA sigs! Selective Authentication (SelAuth) --- selective verification before forwarding " Avoid checking sigs with high certainty of validity Flooding-Resilient Broadcast Authentication for VANETs

24 Cryptographic Primitives! One-Time Signature (OTS) " To sign 1-bit messages m " Two key pairs: {pk0, sk0} and {pk1, sk1} (pk=h(sk))! Merkle Tree Signature " To sign 2-bit messages " v 0 =00,, v 3 =11 " Sig for v 2 is {h 0-1, h 3, r 2 } h 0 1 PK h 0 = H(v 0 r 0 ) h 2 3 h 0 h 1 h 2 h 3 Per-signature overhead ECDSA-256 OTS Generation 7ms 320µs Verification 22 ms 160µs Public key size 256 bits 320 hashes (1 hash) Signature size 512 bits 160 hashes (160 hashes) h 1 = H(v 1 r 1 ) h 2 = H(v 2 r 2 ) h 3 = H(v 3 r 3 ) h 0 1 = H(h 0 h 1 ) h 2 3 = H(h 2 h 3 ) PK = H(h 0 1 h 2 3 ) Flooding-Resilient Broadcast Authentication for VANETs

25 FastAuth: First Attempt 1. Predict location 2. Create verifiable ACK 3. Broadcast ACK L 0 L 1 L 2 L 3 L 1 L 2 L 3 A 1 A 1 A 2 P A 3 A i = H(A i+1 ) : Hash function H P : public value Ai : ACK of location Li : ECDSA signature 4. Verification P is signed & P = H(A 1 ) so blue car indeed said L 1 Verify Ai 22000x faster than Li Flooding-Resilient Broadcast Authentication for VANETs

26 Location Uncertainty Ideal case: perfect prediction Avg overhead 1 us P Loc A 1 A 2 A 3 Verification time Ai : 1 us : us Unfortunately incorrect prediction requires re-prediction Avg overhead >> 1 us P Loc A 1 P Loc! Challenge: commit all possible movements into ACKs A 3 Flooding-Resilient Broadcast Authentication for VANETs

27 Location Predication! Sender predicts its own movements! Narrow down possible movements for efficiency " Laws of physics and road topology e.g., slower than 110mph cannot move > 5m per 0.1s " Coarse-grained position 5m Δ y Δ x past trajectory D l D f D r movement D f =(1,0) D l =(1,1) D r =(1, 1) Prediction table probability Flooding-Resilient Broadcast Authentication for VANETs

28 Verifiable ACK Construction 2.-Verifiable-ACK-Construc5on- Possible Movement (L i L i-1 ) Stay (D S ) Forward (D F ) Forward left (D L ) Forward right (D R ) : Hash function H : public value : ACK of location Li : ECDSA signature L 0 P Commit movements using Merkle Hash Tree H(H(D L ) H(D R )) H(D R ) D S,1 D F,1 D L,1 D R,1 D S,2 S D F,2 F D L,2 L D R,2 R Flooding-Resilient Broadcast Authentication for VANETs

29 Signed Location Broadcast 3.-Signed-Loca5on-Broadcast- L 0 P A 2 A 3 A 11 A 20 A 100 A 211 D F,1 D S,1 D F,1 D L,1 D R,1 D L,2 D S,2 D F,2 D L,2 D R,2 A 211 A 3 L 0 P A 100 A 2 D F,1 A 11 D L,2 A 20 Flooding-Resilient Broadcast Authentication for VANETs

30 Verification Flooding-Resilient Broadcast Authentication for VANETs

31 Further Improvement! Verification overhead reduced " Expensive ECDSA => lightweight Merkle tree sigs! How to reduce the communication overhead? " Location predictability Possible Movement (L i L i-1 ) Stay (Ds) Forward (Df) Forward left (Dl) Forward right (Dr) Probability???? Flooding-Resilient Broadcast Authentication for VANETs

32 Huffman and Merkle Tree Possible Movement (L i L i-1 ) Stay (D S ) Forward (D F ) Forward left (D L ) Forward right (D R ) Probability P S P F P L P R Re-arrange based on probability (Huffman encoding) D F D S D F D L D R D L D S D R Flooding-Resilient Broadcast Authentication for VANETs

33 Dealing with Packet Loss! Trade-offs " Pros: instant verification, low comp. & comm. Overhead " Cons: low update frequency! Low update frequency due to verification dependency " Missing messages prevent verification of subsequent msgs! Reed-Solomon Coding (RS(w,u)) " Beacon B i " u out of w succeeding beacons (B i+1, B i+2,, B i+w ) Flooding-Resilient Broadcast Authentication for VANETs

34 Public Key Rebinding! Public key is broadcasted at the beginning of the predication period L 0 P! Every I E beacons, vehicle signs its beacon by ECDSA in addition to OTS Flooding-Resilient Broadcast Authentication for VANETs

35 Evaluation Settings! Data collection " 4 traces, each by driving along a 2-mile path for 2 hours " default prediction model " use the first half of each trace as the training data and evaluate FastAuth using the second half of trace Δ y Δ y Δ x Δ x (a) default (b) trained Flooding-Resilient Broadcast Authentication for VANETs

36 Simulation Comm. Overhead ratio of communication trained, I E = 20 default, I E = 20 trained, I E = 50 default, I E = prediction interval (I) Fig. 1 Communication Overhead compared to ECDSA Flooding-Resilient Broadcast Authentication for VANETs

37 Simulation Comp. Overhead ratio of sender comp. ratio of receiver comp RS(5,2), I E = 20 RS(3,2), I E = 20 RS(5,2), I E = 50 RS(3,2), I E = ratio of comm. ratio of update frequency Flooding-Resilient Broadcast Authentication for VANETs

38 Outline! Background and Motivation! Entropy-aware authentication! Flooding-resilient schemes " FastAuth: single-hop periodic messages " SelAuth: multi-hop messages! Conclusion Flooding-Resilient Broadcast Authentication for VANETs

39 SelAuth Overview! Promptly isolates malicious parties! Quickly adjusts P xy s.t. " P xy = Pr{y verifies signatures forwarded by x} " P xy goes to 0 for benign x and goes to 1 for malicious x A Y G B Send invalid sig S A Relay S A Relay S A Verify S A 1. Increase P GB 1. Increase P YG 2. Pushback [S A is bad] 1. Increase P AY 2. Pushback [S A is bad] 2. Pushback [S A is bad] Flooding-Resilient Broadcast Authentication for VANETs

40 Fast Isolation Propagation of invalid signatures (hops) NS-2 simulation time (sec) time (sec) time (sec) time (sec) time (sec) Flooding-Resilient Broadcast Authentication for VANETs One verification prob. for all neighbors One verification prob. for all neighbors + Pushback warning Per-neighbor verification prob. SelAuth Per-neighbor verification prob. + Pushback warning Verify every signature with p = 1 21

41 SelAuth: Low Overhead overall computation (# of verification) initial probability overall communication (KB) SelAuth Verify-All one-prob-for-all-neighbors initial probability Flooding-Resilient Broadcast Authentication for VANETs

42 Conclusion! Flooding-resilient broadcast signature " Required for timely verification of safety messages " Unachievable in current standard even in benign settings! Entropy-aware authentication to mitigate flooding " FastAuth: instant verification for on-hop messages " SelAuth: selective authentication for multi-hop messages Flooding-Resilient Broadcast Authentication for VANETs

43 Questions? 2012/04/05

44 Providing VANET Security Through Active Position Detection Click to edit Master subtitle style Gongjun Yan, Stephan Olariu, Michele C. Weigle Department of Computer Science, Old Dominion University

45 Introduction Assumption: Majority (~85%) of vehicles are honest and behave responsibly. Main contribution: Detect and isolate malicious cars using GPS and radar-provided data. Key Points: Achieve local security On-board radar Extend to global security Preset position based groups and dynamic challenges Measured results using simulations

46 Related work Cryptography based methods Significant overhead using PKI Using hard thresholds to detect false locations Not flexible because of uncertainties in VANETs Measure signal strength Could be forged, bounced off another car, etc..

47 VANET Applications Two categories of VANET applications: Non-Position Related Online payment services Online shopping Position Related Traffic condition reports Collision avoidance Emergency alert Cooperative driving Resource availability

48 Position Related Attacks Dropping packets Accidents Modifying existing or inserting bogus packets Traffic Jam Illusion Replaying packets Pretend to be at a fake position Well-known, dangerous attack: Sybil Attack Forge multiple identities to create illusions o Could trigger collision warning

49 Proposed Solution Seeing is Believing Hear : Report of GPS coordinates See : on-board radar Reduce fender-benders, advanced cruise control Limited by short range Compare the two: Corroborate real positions Isolate malicious vehicles Result: Achieve local security in a cell

50 Cells Preset position-based cell Within cell: Vehicles can directly communicate Verify position of specific vehicle in cell Outside of cell: Radar not strong enough Use radar in oncoming traffic to challenge and confirm

51 Acquired Data Each vehicle has three types of data: Local radar-detected data from itself Remote radar detected data from oncoming traffic Agreed-upon data from cell neighbors Achieve global security: Apply cosine similarity, using defined thresholds Construct history of vehicle movement o Help determine if newly received data is valid

52 Cell Positioning Creating the preset position-based cell: Compare GPS coords with pre-set maps Broadcast GPS coords to other cars Creates rough topology Cars in overlap act as routers, notify cell leaders

53 Cell Leaders Responsibilities: Verifies GPS position of all vehicles in cell Aggregates the data Broadcasts it intra-cell Other cars now know of all cars in their cell Sends it inter-cell Picking a Cell Leader Closest to Center Approaching current cell leader

54 Cell Routers Routers 2 per cell forward and backward Communicate aggregate data Picked by proximity to overlap region and traveling direction Leader and Routers are watched by cell members and neighbors Silence if all is good Send out protest packets otherwise Leader put into question table Majority vote determines if leader is malicious --> distrust table

55 Radar Detection Radar gives us: Relative velocity Angle Position Two events trigger radar detection: Reactive: Timeout threshold Proactive: Randomly during communication Both combine to give us Active Position Detection

56 Position Verification Active Position Verification Need Overlap of GPS and Radar with tolerance Accept/Reject

57 Global Security Attacks Global Security: An adversary can launch three types of attacks: Sybil attack Continually lying about position Occasionally lying about position To detect latter two: Message routing

58 Preventing Sybil Attacks Vehicle claims to be several vehicles at the same time or in succession. Very detrimental: o Example: 100s of vehicles worth of network overhead Even more dangerous: Sybil + position attack Possible when: Local vehicle has no direct physical knowledge of remote car In other words, only has abstract data. Solution proposed: Using weighted data: o When radar is working: highest weight o When radar isn t working: neighbor data has highest weight

59 Map History Purpose: Classify new data as real or fake Basic idea: Any vehicle without history is highly suspect Build database of history on local car Don t trust new cars with router or leader position Once it behaves for quite a while and falls within probably speeds and distances travelled, trust it

60 Isolating Malicious Cars Isolating malicious vehicles using tables: Trust, Question, Distrust Tables Procedure: 1. New vehicle broadcasts HELLO 2. Cell Leader responds with IDs: It s own, routers, cell members; 3. Members put new car in question table Builds history 4. If it behaves, members promote to trust table 5. if it misbehaves, it gets put into distrust table

61 Simulation and Testing Parameters: Two direction, 3km highway with two lanes in each direction Cell radius = Traffic arrival rate = Mean velocity = 100m 1600 cars/h 33.3 m/s Transmission radius = 100m 16 malicious cars, a single observer, varying number of other cars Procedure: Observer enters road Initiates request to find malicious vehicles Ends when it reaches 3 km traveled

62 Results of Simulation Metric: Time required to detect 16 adversaries Varying Total Car Number Varying Transmission Range

63 Future Work Future work: Effective Size of Map History Impersonating a long-standing honest vehicle that just let the highway Colluding groups of malicious vehicles

64 Questions? 2012/04/05