Security in hybrid ITS networks

Dissertação para obtenção do Grau de Mestre em Engenharia Informática e de ComputadoresSistemas de Transportes Inteligentes e Cooperativos (C-ITS) visam melhorar a segurança e a sustentabilidade dos transportes. No entanto, a comunicação dos sistemas Vehicleto-Everything é inerentemente aberta, levando a vulnerabilidades que atacantes podem explorar. Isto é uma ameaça a todos os utilizadores rodoviários, pois falhas de segurança podem levar a violações de privacidade ou a fatalidades. Além disso, elevadas taxas de mortalidade estão correlacionadas com utilizadores de mobilidade suave. Logo, no desenvolvimento de sistemas C-ITS, é crucial considerar, além dos veículos conectados, os utilizadores de mobilidade suave e os veículos sem a devida tecnologia. Este estudo apresenta uma nova abordagem desenvolvida no contexto emergente das redes híbridas, combinando tecnologias ITS-G5 e celulares. Dois protocolos, MFSPV e DLAPP, foram implementados e avaliados para introduzir garantias de segurança (como privacidade e integridade) nas comunicações dentro do ambiente híbrido C-ITS desenvolvido. Assim, este trabalho integra, com segurança, estações ITS conectadas por G5 e utilizadores de mobilidade suave, através de uma aplicação móvel via redes celulares. Para tal, utilizou-se equipamentos reais, incluindo on-board e roadside units. Tempos computacionais, de latência e de ponta-a-ponta (E2E) foram usados para avaliar o desempenho do sistema. O protocolo MFSPV supera o DLAPP em eficiência computacional, mas o DLAPP atinge uma latência de rede ligeiramente menor. No entanto, ambos introduzem apenas um atraso adicional de 11% nas comunicações híbridas E2E. A comunicação híbrida impõe, em média, 28.29ms extra de tempo E2E. A proposta mostra-se promissora, visto que atinge tempos de E2E abaixo dos requisitos de latência impostos na maioria dos casos de utilização do C-ITS.Cooperative Intelligent Transport Systems (C-ITS) continue to be developed to enhance transportation safety and sustainability. However, the communication of Vehicle-to-Everything systems is inherently open, leading to vulnerabilities that attackers can exploit.This represents a threat to all road users, as security failures can lead to privacy violations or even fatalities. Moreover, a high fatality rate is correlated with softmobility road users. So, in the development of C-ITS systems, it is crucial to broaden the perspective beyond connected vehicles to soft-mobility users and legacy vehicles. This study presents a novel approach developed in the context of emerging hybrid networks, combining ITS-G5 and cellular technologies. Two protocols, MFSPV and DLAPP, were implemented and evaluated to introduce security guarantees (such as privacy and integrity) in communications within the developed C-ITS hybrid environment. As a result, this work securely integrates G5-connected ITS stations and softmobility users through a smartphone application via cellular networks. Real equipment was utilised for this goal, including on-board and roadside units. Computational, latency and end-to-end times were used to assess the system performance.MFSPV outperforms DLAPP in computational efficiency, but DLAPP achieves a slightly lower network latency. Nevertheless, both only introduce an additional 11% delay in hybrid end-to-end communications. Hybrid communication imposes, on average, an extra 28.29ms of end-to-end time. The proposal shows promise as it reaches end-to-end times below the latency requirements imposed in most C-ITS use cases.N/

CONSTRUCTION OF EFFICIENT AUTHENTICATION SCHEMES USING TRAPDOOR HASH FUNCTIONS

In large-scale distributed systems, where adversarial attacks can have widespread impact, authentication provides protection from threats involving impersonation of entities and tampering of data. Practical solutions to authentication problems in distributed systems must meet specific constraints of the target system, and provide a reasonable balance between security and cost. The goal of this dissertation is to address the problem of building practical and efficient authentication mechanisms to secure distributed applications. This dissertation presents techniques to construct efficient digital signature schemes using trapdoor hash functions for various distributed applications. Trapdoor hash functions are collision-resistant hash functions associated with a secret trapdoor key that allows the key-holder to find collisions between hashes of different messages. The main contributions of this dissertation are as follows: 1. A common problem with conventional trapdoor hash functions is that revealing a collision producing message pair allows an entity to compute additional collisions without knowledge of the trapdoor key. To overcome this problem, we design an efficient trapdoor hash function that prevents all entities except the trapdoor key-holder from computing collisions regardless of whether collision producing message pairs are revealed by the key-holder. 2. We design a technique to construct efficient proxy signatures using trapdoor hash functions to authenticate and authorize agents acting on behalf of users in agent-based computing systems. Our technique provides agent authentication, assurance of agreement between delegator and agent, security without relying on secure communication channels and control over an agent’s capabilities. 3. We develop a trapdoor hash-based signature amortization technique for authenticating real-time, delay-sensitive streams. Our technique provides independent verifiability of blocks comprising a stream, minimizes sender-side and receiver-side delays, minimizes communication overhead, and avoids transmission of redundant information. 4. We demonstrate the practical efficacy of our trapdoor hash-based techniques for signature amortization and proxy signature construction by presenting discrete log-based instantiations of the generic techniques that are efficient to compute, and produce short signatures. Our detailed performance analyses demonstrate that the proposed schemes outperform existing schemes in computation cost and signature size. We also present proofs for security of the proposed discrete-log based instantiations against forgery attacks under the discrete-log assumption

Information Provenance for Mobile Health Data

Mobile health (mHealth) apps and devices are increasingly popular for health research, clinical treatment and personal wellness, as they offer the ability to continuously monitor aspects of individuals\u27 health as they go about their everyday activities. Many believe that combining the data produced by these mHealth apps and devices may give healthcare-related service providers and researchers a more holistic view of an individual\u27s health, increase the quality of service, and reduce operating costs. For such mHealth data to be considered useful though, data consumers need to be assured that the authenticity and the integrity of the data has remained intact---especially for data that may have been created through a series of aggregations and transformations on many input data sets. In other words, information provenance should be one of the main focuses for any system that wishes to facilitate the sharing of sensitive mHealth data. Creating such a trusted and secure data sharing ecosystem for mHealth apps and devices is difficult, however, as they are implemented with different technologies and managed by different organizations. Furthermore, many mHealth devices use ultra-low-power micro-controllers, which lack the kinds of sophisticated Memory Management Units (MMUs) required to sufficiently isolate sensitive application code and data. In this thesis, we present an end-to-end solution for providing information provenance for mHealth data, which begins by securing mHealth data at its source: the mHealth device. To this end, we devise a memory-isolation method that combines compiler-inserted code and Memory Protection Unit (MPU) hardware to protect application code and data on ultra-low-power micro-controllers. Then we address the security of mHealth data outside of the source (e.g., data that has been uploaded to smartphone or remote-server) with our health-data system, Amanuensis, which uses Blockchain and Trusted Execution Environment (TEE) technologies to provide confidential, yet verifiable, data storage and computation for mHealth data. Finally, we look at identity privacy and data freshness issues introduced by the use of blockchain and TEEs. Namely, we present a privacy-preserving solution for blockchain transactions, and a freshness solution for data access-control lists retrieved from the blockchain

Ensuring patients privacy in a cryptographic-based-electronic health records using bio-cryptography

Several recent works have proposed and implemented cryptography as a means to preserve privacy and security of patients health data. Nevertheless, the weakest point of electronic health record (EHR) systems that relied on these cryptographic schemes is key management. Thus, this paper presents the development of privacy and security system for cryptography-based-EHR by taking advantage of the uniqueness of fingerprint and iris characteristic features to secure cryptographic keys in a bio-cryptography framework. The results of the system evaluation showed significant improvements in terms of time efficiency of this approach to cryptographic-based-EHR. Both the fuzzy vault and fuzzy commitment demonstrated false acceptance rate (FAR) of 0%, which reduces the likelihood of imposters gaining successful access to the keys protecting patients protected health information. This result also justifies the feasibility of implementing fuzzy key binding scheme in real applications, especially fuzzy vault which demonstrated a better performance during key reconstruction

A Survey on Wireless Sensor Network Security

Wireless sensor networks (WSNs) have recently attracted a lot of interest in the research community due their wide range of applications. Due to distributed nature of these networks and their deployment in remote areas, these networks are vulnerable to numerous security threats that can adversely affect their proper functioning. This problem is more critical if the network is deployed for some mission-critical applications such as in a tactical battlefield. Random failure of nodes is also very likely in real-life deployment scenarios. Due to resource constraints in the sensor nodes, traditional security mechanisms with large overhead of computation and communication are infeasible in WSNs. Security in sensor networks is, therefore, a particularly challenging task. This paper discusses the current state of the art in security mechanisms for WSNs. Various types of attacks are discussed and their countermeasures presented. A brief discussion on the future direction of research in WSN security is also included.Comment: 24 pages, 4 figures, 2 table