SECMACE: Scalable and Robust Identity and Credential Infrastructure in Vehicular Communication

Size: px

Start display at page:

Download "SECMACE: Scalable and Robust Identity and Credential Infrastructure in Vehicular Communication"

Pierce Reed
5 years ago
Views:

1 1 / 54 SECMACE: Scalable and Robust Identity and Credential Infrastructure in Vehicular Communication IEEE Transactions on Intelligent Transportation Systems (IEEE ITS), vol. 19, no. 5, May 2018 Mohammad Khodaei, Hongyu Jin, and Panos Papadimitratos Networked Systems Security Group

2 2 / 54 Introduction Vehicular communication systems (VCS) Illustration: C2C-CC

3 / 54 Introduction VCS security and privacy

In area (X,Y,Z); RSU Vehicular communication

!! Warning: Ambulance approaching at (x,y,z)

Conditional anonymity Slow down and yield

3 3 / 54 Introduction VCS security and privacy requirements Warning: Emergency vehicle approaching In area (X,Y,Z); RSU Vehicular communication Authentication & integrity RSU!!! Warning: Ambulance approaching at (x,y,z) Non-repudiation Authorization & access control Conditional anonymity Slow down and yield Unlinkability (long-term) Securing vehicular communications-assumptions, requirements, and principles, ESCAR 2006

4 4 / 54 Introduction VCS security and privacy: Basic ideas Loca%on: (x V,y V,z V ) Payload Time: t V Signature with k V Cert CA (V,K V,A V,T) Warning: Accident at (x,y,z)! Warning: Accident at (x,y,z)! Vehicle V Vehicle U Ephemeral pseudonymous credentials; conditional anonymity Digitally signed V2X communications Hybrid approach: combination of anonymous and pseudonymous authentication Secure vehicular communication systems: design and architecture, IEEE CommMag 2008

5 5 / 54 Introduction VCS security and privacy: Basic ideas (cont d) First demo, 2008 Final event, 2015

6 6 / 54 Introduction VCS security and privacy: Basic ideas (cont d) A certifies B Cross-certification Communication link Message dissemination A B RCA Domain A Domain B Domain C LTCA LTCA RA RA LTCA PCA X-Cetify PCA LDAP PCA LDAP RA RSU 3/4G B

7 7 / 54 Introduction VCS security and privacy: Basic ideas (cont d) Vehicles registered with one Long Term CA (LTCA) (home domain) Pseudonym CA (PCA) servers in one or multiple domains Vehicles can obtain pseudonyms from any PCA (in home or foreign domains) Establish trust among entities with a Root CA (RCA) or with cross-certification Resolve a pseudonym with the help of a Resolution Authority (RA)

8 8 / 54 Introduction VCS security and privacy: Basic ideas (cont d) Adversaries Malicious users/vehicles/nodes (On-Board Units (OBUs)) Arbitrary behavior Sybil users (each posing as multiple users) Collusion Selfish users Honest-but-curious system infrastructure (security & privacy infrastructure servers) Correct protocol execution Curious to infer private user information

9 9 / 54 VPKI Designing the VCS security infrastructure Focus: Vehicular Public-Key Infrastructure (VPKI) Design, analyze, implement and evaluate the VPKI Management of credentials: provisioning, revocation, resolution Protocols for all vehicle-to-vpki and intra-vpki interactions Challenges: complexity and constraints Security and privacy Multiple and diverse entities, global deployment, long-lived entities Short-lived credentials, very large numbers Cost-driven platform resource constraints

10 10 / 54 VPKI Designing the VCS security infrastructure: goals Resilience to honest-but-curious VPKI entities Eradication of Sybil-based misbehavior Standard-compliant implementation Scalability Multi-domain operation Efficiency Revocation and resolution

11 11 / 54 VPKI Designing the VCS security infrastructure: System instance A certifies B Communication link A B RCA Home Domain (A) H-LTCA RA LDAP Foreign Domain (B) F-LTCA RA I. f-tkt req. 1. LTC 2. n-tkt PCA II. f-tkt III. n-tkt PCA 3. psnym req. IV. psnym req. 4. psnyms acquisition V. psnyms acquisition

Pseudonym Γ P3 Γ P3 Γ P3 } } } } } } } } τ P τ P System Time P1 & P2: Requests could be user fingerprints : exact times of requests throughout the

12 VPKI Designing the VCS security infrastructure: Pseudonym acquisition policies User-controlled policy (P1) t start Trip Duration } } } } } τ P τ P τ P τ P τ P t end Unused Pseudonyms Oblivious policy (P2) Γ P2 Γ P2 } } } } } } τ P τ P τ P τ P τ P τ P Universally fixed policy (P3) Expired Pseudonym Γ P3 Γ P3 Γ P3 } } } } } } } } τ P τ P System Time P1 & P2: Requests could be user fingerprints : exact times of requests throughout the trip P3: Request intervals falling within universally fixed intervals Γ P 3; pseudonym lifetimes aligned with the PCA clock τ P τ P τ P τ P τ P τ P 12 / 54

13 13 / 54 VPKI Ticket and pseudonym acquisition V LTCA PCA 1. H(P CA ID Rnd 256 ), t s, t e, LT C v, N, t 2. Cert(LT C ltca, tkt) 3. tkt, N + 1, t 4. tkt, Rnd 256, t s, t e, {(K 1 v) σk 1 v,..., (K n v ) σk n v }, N, t 5. Cert(LT C pca, P i v) 6. {P 1 v,..., P n v }, N + 1, t

14 14 / 54 VPKI Ticket acquisition protocols Protocol 1 Ticket Request (from the LTCA) 1: procedure REQTICKET(P x, Γ P x, t s, t e, t date ) 2: if P x = P 1 then 3: (t s, t e ) (t s, t e ) 4: else if P x = P 2 then 5: (t s, t e ) (t s, t s + Γ P 2 ) 6: else if P x = P 3 then 7: (t s, t e ) (t date + Γ i P 3 ), t date + Γ i+1 P 3 ) 8: end if 9: ζ (Id tkt-req, H(Id P CA Rnd tkt ), t s, t e ) 10: (ζ) σv Sign(Lk v, ζ) 11: return ((ζ) σv, LTC v, N, t now ) 12: end procedure Run over Transport Layer Security (TLS) with mutual authentication Protocol 2 Issuing a Ticket (by the LTCA) 1: procedure ISSUETICKET((msg) σv, LTC v, N, t now ) 2: Verify(LTC v, (msg) σv ) 3: IK tkt H(LTC v t s t e Rnd IKtkt ) 4: ζ (SN, H(Id P CA Rnd tkt ), IK tkt, Rnd IKtkt, t s, t e, Exp tkt ) 5: (tkt) σltca Sign(Lk ltca, ζ) 6: return ((tkt) σltca, N + 1, t now ) 7: end procedure ticket identifiable key (IK tkt ): it binds a ticket to the corresponding Long Term Certificate (LTC) A faulty LTCA cannot resolve an LTC other than the one the ticket was issued for

15 15 / 54 VPKI Pseudonym acquisition protocols Protocol 3 Pseudonym Request (from the PCA) 1: procedure REQPSNYMS(t s, t e, (tkt) σltca ) 2: for i:=1 to n do 3: Begin 4: Generate(Kv, i kv) i 5: (Kv) i σk i Sign(k i v v, Kv) i 6: End 7: psnymreq (Id req, Rnd tkt, t s, t e, (tkt) σltca, {(Kv 1 ) σk 1,..., (K n v v ) σk n v }, N, t now ) 8: return psnymreq 9: end procedure Run over TLS with unidirectional (server-only) authentication Protocol 4 Issuing Pseudonyms (by the PCA) 1: procedure ISSUEPSNYMS(psnymReq) 2: psnymreq (Id req, Rnd tkt, t s, t e, (tkt) σltca, {(K 1 v ) σk 1 v,..., (K n v ) σk n v }, N, t now) 3: Verify(LT C ltca, (tkt) σltca ) 4: H(Id this-p CA Rnd tkt )? = H(Id P CA Rnd tkt ) 5: [t s, t e] =? ([t s, t e]) tkt 6: for i:=1 to n do 7: Begin 8: Verify(Kv, i (Kv) i σk i ) v 9: IK P i H(IK tkt Kv t i i s t i e Rnd IK i v ) 10: ζ (SN i, Kv, i IK P i, Rnd IK i v, t i s, t i e) 11: (Pv) i σpca Sign(Lk pca, ζ) 12: End 13: return ({(Pv 1 ) σpca,..., (Pv n ) σpca }, N+1, t now) 14: end procedure pseudonym identifiable key (IK P i ): it binds a pseudonym to the corresponding ticket A faulty PCA cannot resolve pseudonyms other than the ones issued for the ticket

16 16 / 54 VPKI Roaming user: Foreign ticket authentication

17 17 / 54 VPKI Ticket and pseudonym acquisition in a foreign domain

18 18 / 54 VPKI Pseudonym revocation and resolution RA P CA LT CA 1. P i, N, t 2.U pdate CRL 3. tkt, N + 1, t 4.SN tkt, N, t 5.Resolve LT C v 6.LT C v, N + 1, t

19 19 / 54 Analysis & evaluation Security analysis Communication integrity, confidentiality, and non-repudiation Certificates, TLS and digital signatures Authentication, authorization and access control LTCA is the policy decision and enforcement point PCA grants the service Discovery of available servers: Lightweight Directory Access Protocol (LDAP) Concealing PCAs, F-LTCA, and actual pseudonym acquisition times Sending H(P CA id Rnd 256 ), t s, t e, LT C v to the H-LTCA A PCA verifies whether [t s, t e ] [ts, te] Thwarting Sybil-based misbehavior An LTCA never issues valid tickets with overlapping lifetimes (for a given domain) A ticket is bound to a specific PCA A PCA keeps records of used tickets

20 20 / 54 Analysis & evaluation Pseudonym linkability based on timing information τp= 5 min τp= 5 min., ΓP 2= 15min τp= 5 min., ΓP 3= 15min System Time [min.] System Time [min.] System Time [min.] (a) P1: User-controlled policy (b) P2: Oblivious policy (c) P3: Universally fixed policy P1 & P2: Distinct lifetimes per vehicle make linkability easier (requests/pseudonyms could act as user fingerprints ) P3: Uniform pseudonym lifetimes eliminate the timing fingerprints

21 21 / 54 Experimental setup Analysis & evaluation VPKI testbed Implementation in C++ OpenSSL: TLS and Elliptic Curve Digital Signature Algorithm (ECDSA)-256 according to the standard [1] LTCA PCA RA Clients VM Number Dual-core CPU (Ghz) BogoMips Memory 2GB 2GB 1GB 1GB Database MySQL MySQL MySQL MySQL Web Server Apache Apache Apache - Emulated Threads

22 22 / 54 Analysis & evaluation Experimental setup (cont d) TAPAS Cologne LuST [2] Number of vehicles 75, ,259 Number of trips 75, ,939 Duration of snapshot (hours) Available duration of snapshot (hours) 2 (6-8 AM) 24 Average trip duration (seconds) Total trip duration (seconds) 44,655, ,766,924 Main metric: Pseudonym acquisition latency (note: termed end-to-end) From the initialization of the ticket acquisition protocol till the successful completion of pseudonym acquisition protocol Note: PRESERVE Nexcom boxes: dual-core 1.66 GHz, 2GB Memory

23 Analysis & evaluation Latency for P1, P2, and P3 TAPAS Cologne dataset pseudonyms, and frequent (P1) End-to-End Latency [ms] 120 Improved privacy, thus short-lived interactions with/high workload for the 140 End-to-End Latency [ms] (P2) System Time [min.] 100 Oblivious Policy (P2): 1 LTCA and 1 PCA τp = 0.5 min (P3) End-to-End Latency [ms] P3: Fx (t = 74 ms) = System Time [min.] System Time [min.] τp = 0.5 min. τp = 5 min τp = 0.5 min System Time [min.] Universally Fixed Policy (P3): 1 LTCA and 1 PCA τp = 0.5 min. 120 τp = 5 min Oblivious Policy (P2): 1 LTCA and 1 PCA Universally Fixed Policy (P3): 1 LTCA and 1 PCA 120 P2: Fx (t = 80 ms) = End-to-End Latency [ms] P1: Fx (t = 167 ms) = τp = 5 min LuST dataset (τp = 0.5 min): τp = 0.5 min. τp = 5 min Γ=5 min, τp =0.5 min, 5 min User-controlled Policy (P1): 1 LTCA and 1 PCA 120 τp = 5 min PCA 140 τp = 0.5 min. End-to-End Latency [ms] Parameters: LuST dataset User-controlled Policy (P1): 1 LTCA and 1 PCA End-to-End Latency [ms] 140 τp = 5 min System Time [min.] System Time [min.] 23 / 54

24 24 / 54 Analysis & evaluation Latency for P1, P2, and P3 (cont d) Average End-to-End Latency [ms] Average End-to-End Latency Comparison of P1, P2 and P3 P 1 P 2 (Γ P 2 = 10 min.) P 3 (Γ P 3 = 10 min.) Pseudonym Lifetime [min.]

25 Analysis & evaluation Pseudonym utilization Average Number of Unused Pseudonyms Pseudonym Utilization with Oblivious Policy (P2) Γ P 2 = 5 min. Γ P 2 = 10 min. Γ P 2 = 15 min. Γ P 2 = 20 min Pseudonym Lifetime [sec.] Average Number of Unused Pseudonyms Pseudonym Utilization with Universally Fixed Policy (P3) 5 Γ P 3 = 5 min. Γ P 3 = 10 min. Γ P 3 = 15 min. Γ P 3 = 20 min Pseudonym Lifetime [sec.] P2: Oblivious Policy P3: Universally Fixed Policy LuST dataset for P2 & P3 25 / 54

26 26 / 54 Analysis & evaluation Ticket and pseudonym acquisition Cumulative Probability LTCA Server Performance: LuST Dataset Processing Delay [ms] LTCA delay Cumulative Probability PCA Server Performance: LuST Dataset τ P= 1 min τ P= 3 min τ P= 5 min Processing Delay [ms] PCA delay Ticket Acquisition: F x (t=4ms)=0.95 Pseudonym Acquisition: F x (t=52ms)=0.95

27 27 / 54 Analysis & evaluation Pseudonym resolution and revocation Resolution & Revocation in a Single Domain Resolution & Revocation Across Domains End-to-End Latency [ms] Client Side Operations All RA Operations All PCA Operations All LTCA Operations End-to-End Latency [ms] Client Side Operations All RA Operations All PCA Operations All LTCA Operations All Cross Domain Operations Number of Pseudonyms in the PCA Database ( 10 6 ) Single domain Number of Pseudonyms in the PCA Database ( 10 6 ) Across domains On average 100 ms to resolve & revoke a pseudonym

28 28 / 54 Analysis & evaluation Comparison with other implementations Latency for 100 pseudonyms (without communication delay) Delay PCA CP U PCA VeSPA [3] 817 ms 3.4 GHz SEROSA [4] 650 ms 2.0 GHz PUCA [5] 1000 ms 2.53 GHz PRESERVE PKI (Fraunhofer SIT) [6] 4000 ms N/A C2C-CC PKI (ESCRYPT) [7] 393 ms N/A SECMACE 260 ms 2.0 GHz

29 29 / 54 Additional ongoing work Wrap-up Solution for a challenging problem at hand Security & privacy Complexity Cost and deployment constraints VC system constraints and scale Modest workstations running the PCA and LTCA servers can handle tens of thousands of vehicles More work Revocation: distribution of revocation information Misbehaviour/fault detection Dynamic scaling of the servers System can be used in different contexts Security and privacy for Location Based Services (LBSs) Common ideas with other large-scale mobile systems Security and privacy for Participatory Sensing systems

30 30 / 54 Additional ongoing work Efficient CRL distribution CRL distribution in VCS: Challenges and motivation Traditional PKI vs. Vehicular PKI Dimensions (5 orders of magnitude more credentials) Balancing act: security, privacy, and efficiency Honest-but-curious VPKI entities Performance constraints: safety- and time-critical operations Mechanics of revocation: Highly dynamic environment with intermittent connectivity Short-lived pseudonyms, multiple per entity Resource constraints

31 31 / 54 Additional ongoing work Efficient CRL distribution CRL distribution in VCS: Challenges and motivation (cont d) Efficient and timely distribution of Certificate Revocation Lists (CRLs) to every legitimate vehicle in the system Strong privacy for vehicles prior to revocation events Computation and communication constraints for On-Board Units (OBUs), intermittent connectivity to the infrastructure Peer-to-peer distribution is a double-edged sword: abusive peers could pollute the process, thus degrading the timeliness of the CRL distribution

Trip Duration: D Partitioned Interval: i CRL i CRL i+1

V2 : {ΓiCRL, Γi+1 CRL }; V3 : {Γi+2 CRL }; V4 : {Γi+3

32 Additional ongoing work Efficient CRL distribution Vehicle-Centric CRL Distribution Γ1 CRL Γ2 CRL Γ3 CRL Trip Duration: D Partitioned Interval: i CRL i CRL i+1 CRL i+3 CRL Dv3 Dv4 i+4 CRL { { { { { i+2 CRL Dv2... Dv5 Trip Duration Dv1 System Time Figure: CRL as a Stream: i+2 V1 subscribes to {ΓiCRL, Γi+1 CRL, ΓCRL }; Figure: A vehicle-centric approach: each vehicle only subscribes for pieces of CRLs corresponding to its trip duration. V2 : {ΓiCRL, Γi+1 CRL }; V3 : {Γi+2 CRL }; V4 : {Γi+3 CRL }; V5 : {Γi+4 CRL }. Efficient, Scalable, and Resilient Vehicle-Centric Certificate Revocation List Distribution in VANETs, ACM WiSec / 54

Additional ongoing work Efficient CRL distribution Vehicle-Centric CRL Distribution (cont d) i CRL V1 H() H() H() H() H() V2 V3 V4 V5 V6 V7 V8 V9 } } } } } } P P P P (a)revoked pseudonyms P P (b) CRL

33 Additional ongoing work Efficient CRL distribution Vehicle-Centric CRL Distribution (cont d) i CRL V1 H() H() H() H() H() V2 V3 V4 V5 V6 V7 V8 V9 } } } } } } P P P P (a)revoked pseudonyms P P (b) CRL fingerprint construction Figure: CRL piece & fingerprint construction by the PCA. CRL Fingerprint Signed, broadcast by Roadside Units (RSUs) Integrated in (a subset of) recently issued pseudonyms Notification about a new CRL-update (revocation event) 33 / 54

Additional ongoing work Efficient CRL distribution Quantitative Analysis OMNET++ & Veins framework using SUMO Cryptographic protocols and primitives (OpenSSL): ECDSA-256 and SHA-256 as per IEEE 1609.

34 Additional ongoing work Efficient CRL distribution Quantitative Analysis OMNET++ & Veins framework using SUMO Cryptographic protocols and primitives (OpenSSL): ECDSA-256 and SHA-256 as per IEEE and ETSI standards V2X communication over IEEE p Placement of the RSUs: highly-visited intersections with non-overlapping radio ranges Comparison with the baseline scheme [8]: under the same assumptions and configuration with the same parameters Evaluation Efficiency (latency) Resilience (to pollution/dos attacks) Resource consumption (computation/communication) Figure: The LuST dataset, a full-day realistic mobility pattern in the city of Luxembourg (50KM x 50KM) [Codeca et al. (2015)]. 34 / 54

35 35 / 54 Additional ongoing work Efficient CRL distribution Quantitative Analysis (cont d) Number of Cognizant Vehicles 3K 2.5K 2K 1.5K 1K 0.5K Total Number of Vehicles Baseline Scheme Vehicle-Centric Scheme System Time [s] (a) 7:00-7:10 am (B =25 KB/s) Cumulative Probability Baseline Scheme Vehicle-Centric Scheme Delay to Fetch CRL [s] (b) 7-9 am, 5-7 pm (B =25 KB/s) Figure: End-to-end delay to fetch CRLs (R = 1%, τ P = 60s). Converging more than 40 times faster than the state-of-the-art Baseline scheme: F x (t = 626s) = 0.95 Vehicle-centric scheme: F x (t = 15s) = 0.95

36 Additional ongoing work Location Based Services LBS Privacy Service Attribute {loc, restaurant} Adversary: honest-but-curious LBS server 36 / 54

37 37 / 54 Additional ongoing work Location Based Services LBS Privacy (cont d) Anonymizer LBS Server Advantages: Transparency for clients, effectiveness Why do we trust the (possibly honest-but-curious) anonymizer?

38 Additional ongoing work Decentralized LBS Privacy Location Based Services LBS Server No need for an anonymizer: reliance on peers Cache responses, contact the LBS server only when absolutely necessary Hiding in the Mobile Crowd: Location Privacy through Collaboration, IEEE TDSC, / 54

39 39 / 54 Additional ongoing work Location Based Services Decentralized LBS Privacy and Security Misbehaving peers? Active: Masquerading, tampering, DoS... Passive: Eavesdrop queries and responses Accountability Privacy protection

Additional ongoing work Location Based Services Decentralized LBS Privacy and Security (cont d) LTCA (Long Term CA) PCA (Pseudonym CA) 1. Ticket Request 2.

Responses Signed by the LBS Server LBS (Location Based Service) Leverage a VPKI-like solution for pseudonymous authentication of peer interactions Peer functionality

40 Additional ongoing work Location Based Services Decentralized LBS Privacy and Security (cont d) LTCA (Long Term CA) PCA (Pseudonym CA) 1. Ticket Request 2. Ticket Response 3. Pseudonym Request using Ticket 4.Pseudonym Response 5. Queries Signed with Pseudonyms 6. Responses Signed by the LBS Server LBS (Location Based Service) Leverage a VPKI-like solution for pseudonymous authentication of peer interactions Peer functionality resilient to misbehavior Run this scheme in parallel to the LBS, without shifting trust; motivation for privacy-cautious users Resilient Privacy Protection for Location-Based Services Through Decentralization, ACM WiSec / 54

41 41 / 54 Additional ongoing work Location Based Services Decentralized LBS Privacy and Security (cont d) The PCA randomly assigns a small fraction of system nodes as serving nodes The serving period can be coincide with pseudonym request interval Serving nodes proactive request Point of Interest (PoI) data for the whole region and announce their presence and available data Any interested node listens to beacons and requests PoI data Can request responses from N > 1 serving nodes for cross-checking

42 42 / 54 Additional ongoing work Location Based Services Security and Privacy Analysis - Quantitative ExpoDeg(Id LT C, C) = Id i ID(Id LT C,C) T (Id i ) T (Id LT C ) R H(Id i ) R(Id LT C ) (1) ID(Id LT C, C): set of identities corresponding to Id LT C exposed to honest-but-curious (possibly colluding) entities T (Id): trip duration of a node under identity Id R(Id): number of regions the node visits as Id R H (Id): number of visited regions exposed ExpoDeg: accuracy of reconstructed node trajectories based on recorded node queries, taking into account pseudonymous authentication

43 43 / 54 Additional ongoing work Location Based Services Security and Privacy Analysis - Quantitative (cont d) Exposure Degree No collusion with CA Collusion with PCA Collusion with LTCA and PCA Pr serve (a) Exposure Degree No collusion with CA Collusion with PCA Collusion with LTCA and PCA Ratio adv (b) Exposure Degree No collusion with CA Collusion with PCA Collusion with LTCA and PCA Ratio adv Figure: (a) Exposure degree to the LBS server as a function of P r serve. Exposure degree to colluding passive adversaries as a function of Ratio adv (b) with and (c) without encryption for P2P communication. (c)

44 44 / 54 Additional ongoing work Location Based Services Security and Privacy Analysis - Quantitative (cont d) Adv. Serving Node Ratio 0.08 Over All Nodes 0.07 Over Serving Nodes System Time (min) (a) Attacked Response Ratio 3.5 1e 2 1 false out of 1 response(s) false out of 2 response(s) 2 false out of 2 response(s) false out of 3 response(s) 2 false out of 3 response(s) false out of 3 response(s) Ratio adv Figure: (a) Malicious serving node ratio during simulation (1 p.m. - 2 p.m.) with default settings. (b) Attacked LBS query ratio as a function of Ratio adv. (b)

45 45 / 54 Additional ongoing work Urban Sensing Systems Participatory Sensing Illustration: complexitys.com

46 Additional ongoing work Participatory Sensing Security & Privacy Requirements Privacy Data Communication Security Data Trustworthiness Security Accountability User Anonymity Location Privacy Trustworthiness People- Centric Sensing Incentives Protect the users from the system (privacy) Anonymity (conditional) Unlinkability Protect the system from the users (security) Authentication & Authorization Accountability Misbehavior detection User incentives Trustworthy People-Centric Sensing: Privacy, Security and User Incentives Road-Map, IEEE/IFIP MedHocNet / 54

47 SPPEAR Overview Additional ongoing work Participatory Sensing Seperation of Duty SPPEAR: security & privacy-preserving architecture for participatory-sensing applications, ACM WiSec / 54

48 48 / 54 Additional ongoing work Participatory Sensing Analysis Confidentiality, integrity (TLS and digital signatures) Access control, authorization (GM = PDP and IdP = PEP) Sybil-proof (non-overlapping pseudonyms) GM does not know the user task(s) (OT for token retrieval) Unlinkable and unobservable interactions (TOR) Accountability, exculpability (Revocation protocol + interactive mode for BBS)

49 49 / 54 Additional ongoing work Participatory Sensing Analysis (cont d) ProVerif protocol checker Model with π-calculus Entities (infrastructure components and users) described as processes Protocol modelled as a parallel composition of multiple copies of the processes Basic cryptographic primitives modelled as symbolic operations over bit-strings representing messages, encoded with constructors and destructors Dolev-Yao adversaries (eavesdrop, modify, craft and inject messages based on the keys they possess) We can prove secrecy (i.e., values are secret) and strong-secrecy (the adversary cannot infer changes over secret values) properties

50 Additional ongoing work Participatory Sensing Secure and Privacy-preserving Participatory Sensing Classification Phase mi NB/NN predi Users [vi] Probability Mass Transformer mi Concept Drift Checker mi Composition yes training predi Training Phase DB- Scan/Region Merger mi Random Forest Security, Privacy and Incentive Provision for Mobile Crowd Sensing Systems, IEEE IoT Journal, / 54

51 51 / 54 Bibliography I Additional ongoing work Participatory Sensing [1] IEEE Standard for Wireless Access in Vehicular Environments - Security Services for Applications and Management Messages, Mar [2] L. Codeca and et al, Luxembourg Sumo Traffic (LuST) Scenario: 24 Hours of Mobility for Vehicular Networking Research, in IEEE VNC, Kyoto, Japan, Dec [3] N. Alexiou, M. Laganà, S. Gisdakis, M. Khodaei, and P. Papadimitratos, VeSPA: Vehicular Security and Privacy-preserving Architecture, in ACM HotWiSec, Budapest, Hungary, Apr [4] S. Gisdakis, M. Laganà, T. Giannetsos, and P. Papadimitratos, SEROSA: SERvice Oriented Security Architecture for Vehicular Communications, Boston, MA, USA, Dec. 2013, pp [5] D. Förster, F. Kargl, and H. Löhr, PUCA: A Pseudonym Scheme with User-Controlled Anonymity for Vehicular Ad-Hoc Networks, in IEEE VNC, Paderborn, Germany, Dec [6] PRESERVE Project, Jun [7] PKI Memo C2C-CC, Feb [8] J.-J. Haas, Y.-C. Hu, and K.-P. Laberteaux, Efficient Certificate Revocation List Organization and Distribution, IEEE JSAC, vol. 29, no. 3, pp , 2011.

52 52 / 54 Other publications Additional Publications S. Gisdakis, V. Manolopoulos, S. Tao, A. Rusu, and P. P., Secure and Privacy-Preserving Smartphone-based Traffic Information Systems, IEEE Trans. on ITS, Vol. 16, No. 3, pp , June 2015 M. Khodaei, H. Jin, and P. P., Towards Deploying a Scalable & Robust Vehicular Identity and Credential Management Infrastructure, IEEE VNC, Paderborn, Germany, Dec H Jin and P. P. Proactive Certificate Validation for VANETs, IEEE Vehicular Networking Conference (IEEE VNC), Columbus, OH, USA, December 2016 M. Khodaei and P. P., Evaluating On-demand Pseudonym Acquisition Policies in Vehicular Communication Systems, ACM MobiHoc Workshop on Internet of Vehicles and Vehicles of Internet (ACM MobiHoc IoV-VoI), Paderborn, Germany, July 2016 H. Jin and P. P., Scaling VANET Security Through Cooperative Message Verification, IEEE Vehicular Networks Conference (IEEE VNC), Kyoto, Japan, December 2015 K. Zhang, R. A. Tuhin, and P. P., Detection and Exclusion RAIM Algorithm against Spoofing/Replaying Attacks, International Symposium on GNSS, Kyoto, Japan, November 2015 K. Zhang and P. P., GNSS Receiver Tracking Performance Analysis under Distance-Decreasing Attacks, International Conference on Localization and GNSS (ICL-GNSS), Gothenburg, Sweden, June 2015 H. Jin, M. Khodaei, and P. P., Security and Privacy for Vehicular Social Networks, Vehicular Social Networks, A. M. Vegni, V. Loscri, A. V. Vasilakos, Eds., CRC Taylor & Francis Group, 2016 P. Ardelean and P. P., Secure and Privacy-Enhancing Vehicular Communication, IEEE Symposium on Wireless Vehicular Communications (IEEE WiVec), Calgary, AL, Canada, September 2008

53 53 / 54 Additional Publications Other publications (cont d) P. P. and A. Jovanovic, Method to secure GNSS based locations in a device having GNSS receiver, US Patent 8,159,391, April 2012 M. Khodaei and P. P., The Key To Intelligent Transportation: Identity and Credential Management in Vehicular Communication Systems, IEEE Vehicular Technology Magazine, Vol. 10, No. 4, pp , December 2015 S. Gisdakis, M. Lagana, T. Giannetsos, and P. P., SEROSA: Service Oriented Security Architecture for Vehicular Communications, IEEE VNC, Boston, MA, USA, Dec N. Alexiou, S. Gisdakis, M. Laganà, and P. P., Towards a Secure and Privacy-preserving Multi-service Vehicular Architecture, IEEE D-SPAN, Madrid, June 2013 N. Alexiou, M. Laganà, S. Gisdakis, and P. P., VeSPA: Vehicular Security and Privacy-preserving Architecture, ACM HotWiSec, Budapest, April 2013 V. Manolopoulos, S. Tao, A. Rusu, and P. P., HotMobile Demo: Smartphone-based Traffic Information System for Sustainable Cities, ACM MC2R, vol. 16, no. 4, pp , Oct M. Poturalski, P. P., and J.-P. Hubaux, Formal Analysis of Secure Neighbor Discovery in Wireless Networks, IEEE Transactions on Dependable and Secure Computing (IEEE TDSC), Vol. 10, No. 6, pp , Nov.-Dec M. Fiore, C. Casetti, C.-F. Chiasserini, and P. P., Discovery and Verification of Neighbor Positions in Mobile Ad Hoc Networks, IEEE Transactions on Mobile Computing (IEEE TMC), Vol. 12, No. 2, pp. 289?303, February 2013 M. Poturalski, M. Flury, P. P., J.-P. Hubaux, and J.-Y. Le Boudec, On Secure and Precise IR-UWB Ranging, IEEE Transactions on Wireless Communications (IEEE TWC), Vol.11, No.3, pp. 1087?1099, March 2012 G. Calandriello, P. P., A. Lioy, and J.-P. Hubaux, On the Performance of Secure Vehicular Communication Systems, IEEE Transactions on Dependable and Secure Computing (IEEE TDSC), Vol. 8, No. 6, pp. 898?912, Nov.-Dec P. P., L. Buttyan, T. Holczer, E. Schoch, J. Freudiger, M. Raya, Z. Ma, F. Kargl, A. Kung, and J.-P. Hubaux, Secure Vehicular Communication Systems: Design and Architecture, IEEE Communications Magazine, Vol. 46, No. 11, pp , November 2008

54 54 / 54 Additional Publications SECMACE: Scalable and Robust Identity and Credential Infrastructure in Vehicular Communication IEEE Transactions on Intelligent Transportation Systems (IEEE ITS), vol. 19, no. 5, May 2018 Mohammad Khodaei, Hongyu Jin, and Panos Papadimitratos Networked Systems Security Group

VPKIs: State-of-the-Art, Challenges and Extensions

VPKIs: State-of-the-Art, Challenges and Extensions VPKIs: State-of-the-Art, Challenges and Extensions Hongyu Jin, Mohammad Khodaei and Panos Papadimitratos Networked Systems Security Group www.ee.kth.se/nss