KTH ROYAL INSTITUTE OF TECHNOLOGY SECMACE: Scalable and Robust Identity and Credential Management Infrastructure in Vehicular Communication Systems M. Khodaei, H. Jin and P . Papadimitratos Networked Systems Security Group (NSS) In IEEE Transactions on Intelligent Transportation Systems (April 2018)
Outline Secure Vehicular Communication (VC) Systems Problem Statement System Model Security and Privacy Analysis Performance Evaluation Summary of Contributions and Future Steps 2/42
Vehicular Communication (VC) Systems Figure: Photo Courtesy of the Car2Car Communication Consortium (C2C-CC) 3/42
Security and Privacy for VC Systems 1 Basic Requirements ◮ Message authentication & integrity ◮ Message non-repudiation ◮ Access control ◮ Entity authentication ◮ Accountability ◮ Privacy protection Vehicular Public-Key Infrastructure (VPKI) ◮ Pseudonymous authentication ◮ Trusted Third Party (TTP): ◮ Certification Authority (CA) ◮ Issues credentials & binds users to their pseudonyms 1P . Papadimitratos, et al. “Securing Vehicular Communications - Assumptions, Require- ments, and Principles,” in ESCAR, Berlin, Germany, pp. 5-14, Nov. 2006. 4/42 P . Papadimitratos, et al. “Secure Vehicular Communication Systems: Design and Architec- ture,” in IEEE Communications Magazine, vol. 46, no. 11, pp. 100-109, Nov. 2008.
Security and Privacy for VC Systems (cont’d) ◮ Sign packets with the private key, corresponding to the current valid pseudonym ◮ Verify packets with the valid pseudonym ◮ Cryptographic operations in a Hardware Security Module (HSM) 5/42
State-of-the-art Standardization and harmonization efforts ◮ IEEE 1609.2 [1], ETSI [2] and C2C-CC [3] ◮ VC related specifications for security and privacy-preserving architectures Projects ◮ SEVECOM, EVITA, PRECIOSA, OVERSEE, DRIVE-C2X, Safety Pilot, PRESERVE, CAMP-VSC3 Proposals ◮ V-Token, CoPRA, SCMS , SEROSA, PUCA 6/42
Outline Secure Vehicular Communication (VC) Systems Problem Statement System Model Security and Privacy Analysis Performance Evaluation Summary of Contributions and Future Steps 7/42
Problem Statement and Motivation The design of a VPKI ◮ Resilience ◮ Stronger adversarial model (than fully-trustworthy entities) ◮ User privacy protection against “honest-but-curious” entities ◮ User privacy enhancement and service unlinkability (inference of service provider or time) ◮ Pseudonym acquistion policies ◮ How should each vehicle interact with the VPKI, e.g., how frequently and for how long? ◮ Should each vehicle itself determine the pseudonym lifetime? ◮ Operation across multiple domains, thus a scalable design ◮ Efficiency and robustness 8/42
Security and Privacy Requirements for the VPKI Protocols ◮ Authentication, communication integrity and confidentiality ◮ Authorization and access control ◮ Non-repudiation, accountability and eviction (revocation) ◮ Privacy ◮ Anonymity (conditional) ◮ Unlinkability ◮ Thwarting Sybil-based misbehavior ◮ Availability 9/42
Adversarial Model External adversaries Internal adversaries Stronger adversarial model Protection against honest-but-curious VPKI entities ◮ Correct execution of protocols but motivated to profile users ◮ Concealing pseudonym provider identity and acquisition time, and reducing pseudonyms linkability (inference based on time) Multiple VPKI entities could collude 10/42
Outline Secure Vehicular Communication (VC) Systems Problem Statement System Model Security and Privacy Analysis Performance Evaluation Summary of Contributions and Future Steps 11/42
Secure VC System RCA A certifies B A B Cross-certification Communication link Message dissemination Domain A Domain B Domain C RA RA LTCA RA LTCA LTCA ◮ Root Certification Authority (RCA) X-Cetify PCA PCA PCA ◮ LDAP LDAP Long Term CA (LTCA) ◮ Pseudonym CA (PCA) 3/4/5G RSU {Msg} (P iv ) , {P i v } (PCA) ◮ Resolution Authority (RA) ◮ Lightweight Directory Access Protocol (LDAP) {Msg} (P iv ) , {P i v } (PCA) B ◮ Roadside Unit (RSU) ◮ Trust established with RCA, or through cross Figure: VPKI Overview certification 12/42
System Model A certifies B A B RCA Communication link Home Domain (A) Foreign Domain (B) LDAP RA RA F-LTCA H-LTCA I. f-tkt req. PCA PCA 1. LTC 2. n-tkt II. f-tkt III. n-tkt 3. psnym req. IV. psnym req. 4. psnyms acquisition V. psnyms acquisition Figure: VPKI Architecture 13/42
Pseudonym Acquisition Policies t start t end Unused Trip Duration Pseudonyms User-controlled policy (P1) } } } } } τ P τ P τ P τ P τ P Γ P2 Γ P2 Oblivious policy (P2) } } } } } } τ P τ P τ P τ P τ P τ P Γ P3 Γ P3 Γ P3 Expired Pseudonym Universally fixed policy (P3) } } } } } } } } τ P τ P τ P τ P τ P τ P τ P τ P System Time ◮ P1 & P2: Requests could act as user “fingerprints” ; the exact time 14/42 of requests and all subsequent requests until the end of trip could
Vehicle Registration and Long Term Certificate (LTC) Update V H - LT CA 1 . LK v , Lk v 2 . ( LK v ) σ Lkv , N, t 3 . Cert ( LT C ltca , LK v ) 4 . LT C v , N + 1 , t 15/42
Ticket Acquisition Protocols Protocol 2 Issuing a Ticket (by the LTCA) Protocol 1 Ticket Request (from the LTCA) 1: procedure I SSUE T ICKET ( ( msg ) σ v , LTC v , N , t now ) 1: procedure R EQ T ICKET ( P x , Γ Px , t s , t e , t date ) Verify ( LTC v , ( msg ) σ v ) 2: if P x = P 1 then 2: IK tkt ← H ( LTC v || t s || t e || Rnd IK tkt ) 3: ( t s , t e ) ← ( t s , t e ) 3: ζ ← ( SN , H ( Id PCA � Rnd tkt ) , IK tkt , Rnd IK tkt , 4: else if P x = P 2 then 4: t s , t e , Exp tkt ) ( t s , t e ) ← ( t s , t s + Γ P 2 ) 5: ( tkt ) σ ltca ← Sign ( Lk ltca , ζ ) 5: else if P x = P 3 then 6: return (( tkt ) σ ltca , N + 1 , t now ) 6: P 3 ) , t date + Γ i + 1 ( t s , t e ) ← ( t date + Γ i P 3 ) 7: 7: end procedure end if 8: ζ ← ( Id tkt - req , H ( Id PCA � Rnd tkt ) , t s , t e ) 9: ◮ “ticket identifiable key” ( IK tkt ) binds a ticket to the ( ζ ) σ v ← Sign ( Lk v , ζ ) 10: return (( ζ ) σ v , LTC v , N , t now ) 11: corresponding LTC 12: end procedure ◮ Preventing a compromised LTCA from mapping a ◮ Run over Transport Layer Security (TLS) with mutual different LTC during resolution process authentication 16/42
Pseudonyms Acquisition Protocols Protocol 3 Pseudonym Request (from the PCA) Protocol 4 Issuing Pseudonyms (by the PCA) 1: procedure R EQ P SNYMS ( t s , t e , ( tkt ) σ ltca ) 1: procedure I SSUE P SNYMS ( psnymReq ) for i:=1 to n do psnymReq → ( Id req , Rnd tkt , t s , t e , ( tkt ) σ ltca , 2: 2: { ( K 1 v , ..., ( K n Begin v ) σ k 1 v ) σ kn v } , N , t now ) 3: Generate ( K i v , k i v ) 4: Verify ( LTC ltca , ( tkt ) σ ltca ) 3: ( K i v ← Sign ( k i v , K i H ( Id this - PCA � Rnd tkt ) ? v ) σ ki v ) 5: = H ( Id PCA � Rnd tkt ) 4: [ t s , t e ] ? End 6: = ([ t s , t e ]) tkt 5: psnymReq ← ( Id req , Rnd tkt , t s , t e , ( tkt ) σ ltca , 7: for i:=1 to n do 6: { ( K 1 v , ..., ( K n v ) σ k 1 v ) σ kn v } , N , t now ) Begin 7: Verify ( K i v , ( K i v ) σ ki v ) 8: return psnymReq 8: IK P i ← H ( IK tkt || K i v || t i s || t i 9: end procedure e || Rnd IK i v ) 9: ζ ← ( SN i , K i v , t i s , t i 10: v , IK P i , Rnd IK i e ) ◮ Run over TLS with unidirectional (server-only) ( P i v ) σ pca ← Sign ( Lk pca , ζ ) 11: End 12: authentication return ( { ( P 1 v ) σ pca , . . . , ( P n v ) σ pca } , N +1 , t now ) 13: 14: end procedure ◮ “pseudonym identifiable key” ( IK Pi ) binds a pseudonym to the corresponding ticket ◮ Preventing a compromised PCA from mapping a different ticket during resolution process 17/42
Ticket and Pseudonym Acquisition V H-LTCA PCA 1 . H ( PCA ID � Rnd 256 ) , t s , t e , LT C v , N, t 2 . Cert ( LT C ltca , tkt ) 3 . tkt, N + 1 , t 4 . tkt, Rnd 256 , t s ′ , t e ′ , { ( K 1 v , ..., ( K n v ) σ k 1 v ) σ kn v } , N ′ , t 5 . Cert ( LT C pca , P i v ) v } , N ′ + 1 , t 6 . { P 1 v , . . . , P n 18/42
Roaming User: Foreign Ticket Authentication V LDAP H - LT CA 1 . LDAP Req. 2 .LDAP Search 3 . LDAP Res. 4 . H ( F - LT CA ID � Rnd 256 ) , t s , t e , LT C v , N, t 5 . Cert ( LT C ltca , f - tkt ) 6 . f - tkt, N + 1 , t 19/42
Native Ticket and Pseudonym Acquisition in the Foreign Domain V F - LT CA PCA 1 . f - tkt, H ( PCA ID || Rnd ′ 256 ) , Rnd 256 , N, t 2 .Cert ( LT C ltca , n - tkt ) 3 . n - tkt, N + 1 , t 256 , t s ′ , t e ′ , { ( K 1 v , ..., ( K n 4 . n - tkt, Rnd ′ v ) σ k 1 v ) σ kn v } , N ′ , t 5 . Cert ( LT C pca , P i v ) v } , N ′ + 1 , t 6 . { P 1 v , . . . , P n 20/42
Pseudonym Revocation and Resolution RA PCA LT CA 1 . P i , N, t 2 .Update CRL 3 . tkt, N + 1 , t 4 .SN tkt , N ′ , t 5 .Resolve LT C v 6 .LT C v , N ′ + 1 , t 21/42
Outline Secure Vehicular Communication (VC) Systems Problem Statement System Model Security and Privacy Analysis Performance Evaluation Summary of Contributions and Future Steps 22/42
Recommend
More recommend
