Downloaded 93 times
Uploaded byChristie Dudley
Connected vehicles
This document discusses privacy considerations for connected vehicles that communicate using dedicated short range communications (DSRC). DSRC allows vehicles to broadcast basic safety messages to nearby vehicles to improve road safety by warning of hazards. However, these messages and the vehicle certificates could potentially be tracked and used to identify vehicles, violating privacy. Solutions proposed to address privacy include changing vehicle identifiers frequently and revoking certificates if the onboard system is compromised, but these require a trusted authority to manage certificates and many opportunities remain for privacy to be breached.
More Related Content
Connected vehicles
- 1. Privacy and theCar of the Future Consideration for the coming connected vehicle
- 2. whoami • BSEE, digital communications • Many years as a network engineer • Santa Clara University Law student • Research assistant providing technical expertise on privacy audits and reviews • Contracted by auto consortium to review privacy of proposed vehicle to vehicle safety network
- 3. Standard Disclaimer IANAL (Yet) But if you know anyone looking for summer interns....
- 4. Non-Standard Disclaimer A currentNDA covers some of my work here (but not very much) The focus will be on published information and standards.
- 5. What is ThisProject? • DSRC: Dedicated Short Range Communications • (Where “short” == 380m) • Vehicle to Vehicle • Vehicle to infrastructure in Europe - Not having to wait for a light on an empty street again. - Better traffic planning for better cities and roadways.
- 6. Why is Itbeing Developed? Safety Photo Credit: Jason Edward Scott Bain
- 7. Non-trivial Impact onAuto Deaths • World Health Organization estimates 25% of vehicle deaths each year can be prevented. • Fatigue and distracted driving accidents reduced. • Blind Corners, fog and limited visibility accidents reduced. Photo: Public Domain
- 8. Will This reallyHappen? IT ALREADY IS
- 9. How Soon? • Hardware is already being shipped. • Software issues still entirely in the air • More is being done in software these days. • The US Dept. of Transportation is considering mandating this for all new cars. (Decision to come later this year.) • Has already deployed in trucks in Europe
- 10. What is DSRC • Basic safety messages sent out every 1/10 seconds. • All message carry a standard glob: values for pre-defined vehicle trajectory and operational data. • Cars process data and warn driver. • Equipment integrated into vehicle Photo Credit: US Dept. of Transportation
- 11. Photo Credit: NIST AfterMarketInstallation A little cumbersome
- 12. What DSRC isnot • CANbus • OnStar (or any other remote service) • (Direct) support for autonomous driving mechanisms. Photo Credit: US Dept. of Transportation
- 13.
- 14. Radio protocol • 5.9GHz reserved in US and Europe • Signaling standard: IEEE 802.11p / 1609.4 / 1609.3 • Channels reserved for specific functions • No source address for vehicles defined by protocol • Recommendations include using certificates • Privacy challenges at each layer Photo Credit: NASA
- 15. Basic Safety Message • Standard: SAE J2735 • ~50 fixed data elements • “only” interface to radio (on this band)
- 16. Parameters for effectiveness • Density • Benefit derived from other vehicles’ use • Greater usage means greater effectiveness • Confidence • Most messages must be trustworthy • People must trust information broadcast
- 17. Validity? • All messages are cryptographically signed • Signing certificates issued by central authority • Issued based on system fingerprint • Revocation for “malfunctioning” Image source: US Dept. of Transportation equipment • System should invalidate itself if internal checks fail
- 18. Certificates • Limited time use to prevent tracking • Reused? • Periodically refreshed (and malefactors reported) • How often? • Permanent blacklist
- 19.
- 20. MAC Layer • Changeable source (for vehicles) / no destination • Unrouteable! (mostly) • No significant privacy concern as is. • Any algorithm to make network routeable will make vehicles trackable.
- 21. BSM • “Temporary” ID could become persistent with bad app • Open source apps suggested for processing and acting on message data • Is this the only thing the unit will transmit?
- 22. Certificates • Identity/Validity conflict • Solution: constantly changing certificates • Revocation by fingerprint • Issuing authority?
- 23. Fingerprints • “No” correspondence between fingerprint and car • “hard coded” into device • If revoked, entire unit must be replaced to function Photo Credit: NIST
- 24. Certificate Delivery • Haven’t figured out how certificates are delivered to vehicle • Proposals include cellular, wifi, infrastructure links • So many opportunities for failure
- 25. Worrisome Noise • Manufacturers want to use this system for commercial apps • Advertising and other “funding” schemes to pay for CA • Fixed infrastructure potentially operated by data brokers
- 26. Problem: Law Enforcement • What can they do with this? • Correlate location, speed to independent identification? (cameras?) Photo Credit: Alex E. Proimos
- 27. What you CanDo • Hack the radios • Commercially available now • Hack the protocols • Become politically engaged • Most decisions are not being made by elected officials • Help find a way to fund the infrastructure without selling out!
- 28.
- 29. Acknowledgements • Professor Dorothy Glancy, who requested my help on this project • DC 650 (especially Charles Blas) who gave me a reality check with current security and privacy capabilities
- 30. Contact • Christie Dudley • @longobord • c.dudley@ieee.org
Editor's Notes
- #3 Current law student. Privacy professor needed help
- #4 should not matter But I’m working on that whole “lawyer” thing.
- #5 little information to complete the audit. can talk about most published standards
- #6 DSRC is a series of protocols. Has changed over the years of development. Black Hat talk: protocols are no longer relevant
- #7 collision early warning system. - prevent accidents. - Save lives NHTSA “ distracted ” 2009 (US) stats: Almost 5,000 deaths, est 448,000 injuries Not including other inattention involving physical/emotional state of driver
- #8 Good Work - want it to happen . Anecdote: driving in pouring rain too afraid to slow down, too afraid not to.
- #9 Large scale testing in Ann Arbor Michigan started last August. Auto makers have already invested heavily in this technology. A few startups here in Silicon Valley to implement this.
- #10 American government won’t spend money on infrastructure May be related to “black box” recent US mandate. Trucks have no privacy concerns as they are commercial vehicles.
- #11 A system of protocols Not like asn.1 - not data pairs - Map of data
- #12 Designed claimed as a “sealed” system, with sensor integrity and accuracy checks.
- #13 Automakers lesson from CANbus: insecurity caused no real problems No new tech to mech tech - needs human intervention. “ sealed” sensor system with integrity checks.
- #14 HOW it works
- #15 Japan doesn’t have the same spectrum available ETSI and FCC approved operating parameters (Biggest difference: US allows more power.) 33 vs 44.7 dBm
- #16 Minimum requirement for system. Additional protocols considered in Europe. illustrates general and some specific fields data = whatever’s useful in avoiding collisions
- #17 More use = more effective People must trust the system Not just received, but what is sent about them Privacy is important or people will disable it Technological trust is better than laws
- #18 Signature and certificate management - on radio Sensor validation (beyond scope here)
- #19 Still not nailed down Ann Arbor test: came pre-loaded
- #20 This is where we start talking about the FUD
- #21 Already pressure for other apps - that need routing. Tension between routing and identifiability
- #22 F/OSS Apps kind of neat. Closer to autonomy... Fun: someone in blind spot: “I wouldn’t do that, Dave” - give your vehicle too much power? This is too neat a toy to not use for other things.
- #23 Permanent Blacklist? - may not be problem as internet - must replace entire blacklisted unit.
- #24 Another problem for anonymity Many schemes to deal with this. Current solution is “no paper trail” We already have certain mistrust of CAs
- #26 IEEE 1609 family beyond scope, won’t work - raises many more privacy concerns By the way 9 data brokers took the 5th before Congress in 2006 when asked to reveal the sources of their data.
- #27 Tracking, ticketing, whatever else they may want to do.
- #28 Fund certificate authority - funding has power.