Establishing safety and trust in the V2X ecosystem

Privacy is particularly challenged by the authentication requirements, especially for vehicles, cyclists, and pedestrians. This would make it possible, for example, for traffic infrastructure (for example, traffic lights) to create movement profiles of passing vehicles. Consequently, a two-step approach has been established for the registration of end users, resulting in their anonymization.

• First step: Registering an end entity through a RootCA guarantees the basic authorization required to participate in the V2X ecosystem. The RootCA generates an “enrollment certificate” that assigns a unique ID to the end entity.
• Second step: With the issued “enrollment certificate”, the end entity can request a number of authorization tickets/certificates (authorization). These tickets are valid for approximately one week. During this period, the end entity uses the tickets randomly to sign V2X messages. The recipient cannot link the tickets to each other or to a specific end entity.
• The implementation of this mechanism differs somewhat between the EU and the USA/CN.
• Various approaches are examined regarding the utilization of authorization tickets, such as employing a ticket for a two-kilometer distance or for a duration of five minutes prior to switching to a different ticket. This mechanism is important for the later discussion on building trust among end entities. Each time a ticket is switched, the transferring entity appears as a new instance. As a result, the frequency of ticket switching should be kept at a moderate level.

The successful enrollment and validation of an end entity indicates to the other members in the V2X network that this end entity adheres to the local V2X standards and has implemented the necessary system profiles. Therefore, a successfully authenticated end entity indicates that the received data meets the basic quality requirements of V2X.

Framework for the detection of misbehavior

Misbehavior can be caused both by faulty devices and by malicious actors. Malfunctioning devices can provide incorrect data, for example a GPS position. The cause of the malfunction could be a defective device, incorrect implementation or behavior in particular edge cases.

Two types of attacker can be distinguished in the case of malicious actors:

• “Malicious” V2X devices with necessary hardware, software and valid V2X credentials that allow them to inject fake information into the V2X network and other “unsuspecting” devices.
• External attackers who manipulate the environment to cause sensors to malfunction or cause sensors to read data incorrectly.

The potential presence of misbehavior makes it necessary for the ego vehicle to check the received data locally. Various methods could be used to validate incoming data:

• Check the protocol parameters
• Check the plausibility of values against threshold values, for example speed < 400 km/h
• Check the consistency of data with previous messages, for example change of direction by 90° in milliseconds
• Data synchronization with external data, for example positioning in HD maps
• Data synchronization with internal sensor data and the environment model

It is advantageous from a network operations standpoint to remove numerous faulty or compromised devices from the V2X network. Otherwise, the network's integrity would be compromised by these preexisting issues.

Different regions are currently working on developing standards to identify and address instances of misbehavior in end devices. These standards aim to establish guidelines for reporting such incidents and outline the procedures that central authorities, also known as misbehavior authorities, should follow when handling these reports. Mechanisms for revoking end devices have already been defined. Nevertheless, identifying and correcting misbehavior comes with costs. For the vehicle, for example, the early implementation in China shows that updating revocation lists for end entities in the vehicle can account for up to 25% of the messages exchanged with the security backend and 90% of the data volume.

Despite having a system in place to identify misbehavior, the ego vehicle still faces the challenge of determining the reliability and usability of the data it receives for safety-critical functions.

Your experts at msg

Are you engaged in the ever-evolving realm of V2X communication, connectivity, and autonomous driving? You undoubtedly comprehend the intricacy and difficulties associated with these technologies. msg's experts are available to offer guidance throughout your journey and cater to your unique requirements.

We possess vast knowledge and experience in systems engineering, encompassing architecture, safety, and security. Additionally, we specialize in testing advanced, widely distributed vehicle architectures. This expertise allows us to offer you comprehensive assistance in developing and implementing cloud-based remote ADAS solutions. We not only assist you in designing, but also in ensuring the protection of these functionalities to transform the concept of autonomous driving into a tangible reality.

Furthermore, we leverage our proficiency in machine learning and analytics to efficiently examine and harness the vast amounts of data produced throughout the development of these cutting-edge technologies.  It is essential to have these capabilities in place to guarantee the reliability and safety of driving functions.