Framework for the detection of misbehavior
Misbehavior can be caused both by faulty devices and by malicious actors. Malfunctioning devices can provide incorrect data, for example a GPS position. The cause of the malfunction could be a defective device, incorrect implementation or behavior in particular edge cases.
Two types of attacker can be distinguished in the case of malicious actors:
- “Malicious” V2X devices with necessary hardware, software and valid V2X credentials that allow them to inject fake information into the V2X network and other “unsuspecting” devices.
- External attackers who manipulate the environment to cause sensors to malfunction or cause sensors to read data incorrectly.
The potential presence of misbehavior makes it necessary for the ego vehicle to check the received data locally. Various methods could be used to validate incoming data:
- Check the protocol parameters
- Check the plausibility of values against threshold values, for example speed < 400 km/h
- Check the consistency of data with previous messages, for example change of direction by 90° in milliseconds
- Data synchronization with external data, for example positioning in HD maps
- Data synchronization with internal sensor data and the environment model
It is advantageous from a network operations standpoint to remove numerous faulty or compromised devices from the V2X network. Otherwise, the network's integrity would be compromised by these preexisting issues.
Different regions are currently working on developing standards to identify and address instances of misbehavior in end devices. These standards aim to establish guidelines for reporting such incidents and outline the procedures that central authorities, also known as misbehavior authorities, should follow when handling these reports. Mechanisms for revoking end devices have already been defined. Nevertheless, identifying and correcting misbehavior comes with costs. For the vehicle, for example, the early implementation in China shows that updating revocation lists for end entities in the vehicle can account for up to 25% of the messages exchanged with the security backend and 90% of the data volume.
Despite having a system in place to identify misbehavior, the ego vehicle still faces the challenge of determining the reliability and usability of the data it receives for safety-critical functions.