V2V’s Place in an Increasingly Connected World

You’re probably tired of reading that the Internet of Things is the hottest thing going, and that IoT is a boon to technology and, simultaneously, a potential disaster for security and privacy. However, over the past few years, another IoT-related technology has been growing: vehicle to vehicle.

V2V is a way for automobiles to communicate directly with other vehicles on the road. Vehicles communicating with stationary checkpoints positioned along roadways sometimes is referred to as “vehicle to infrastructure,” or V2I.

The National Highway Traffic and Safety Association sees V2V as a way for “vehicles ranging from cars to trucks and buses to trains” to relay safety and mobility information.

Since its inception, though, there have been cybersecurity concerns. How will a vehicle communicate with another vehicle or infrastructure system it has never encountered, let alone been authenticated to connect with it?

Enter PKI

V2V uses a mesh network. In a mesh network, each device communicates with each surrounding device creating a “mesh” of communications. Vehicles communicating with other vehicles or infrastructure in their path can relay information about road hazards and other safety issues in order to alert advancing drivers. This technology initially can be used to signal drivers, but in future incarnations, it could allow vehicles to brake or steer away from the danger.

Of course, one of the issues with this technology is “spoofing.” If a malicious actor were able to trick the system or spoof the telemetry signal, the actor could create chaos by braking certain vehicles and failing to warn others. Thus, a solution for authenticating each vehicle and piece of infrastructure needs to be in place.

PKI, or public key infrastructure, is a standard method for communicating securely between parties. In the PKI system, each user or device has a “private key” that no one else can hold. Each user or device also has a “public key” to distribute freely. The private key can be used to authenticate itself to a device that can use the published public key to verify the private key.

In the world of email, the private key is used to sign an email and the public key verifies the signature as valid.

In the same manner, a vehicle could use its private key to authenticate itself to another vehicle.

The difference with the V2V PKI solution is that the system would be massive. Each device would not only need to hold its private key, but also be able to find and use other vehicles’ public keys. There currently is no PKI infrastructure that functions on such a scale.

Additionally, with most PKI solutions there is an arbiter that serves as a central authority. With Department of Defense applications, for example, the DoD has control over the root keys that authenticate the other authorized keys. With a massive PKI solution like the one proposed, it is unclear which entity would serve as the arbiter.

Privacy Concerns

Assuming that the PKI solution were overcome, there then would be privacy challenges to face. A driver whose vehicle had a static public/private keypair would become identifiable by that key. Very likely, the driver’s location also would be divinable.

The National Highway Traffic Safety Administration’s answer is for each vehicle to rotate a pool of certificates on a regular interval. Unfortunately, that approach really would not solve the problem. While it might be difficult for a person to track multiple certificates used by a vehicle, that is exactly the type of problemcomputers are designed to handle well. An attacker attempting to determine the identity of a driver could do so by tracking that vehicle’s pool of certificates.

Possible Answers

The NHTSA has issued guidance addressing the cybersecurity issues of V2V communications. The documents are very high level at this point, relying on standards and best practices set by other bodies for standard IoT security.

There is also a lot of “should” language rather than “must.” The NHTSA guidance is light on security answers and does not address the privacy concerns. There will be much to figure out in the next few years — and they will be expensive years.

Some experts believe that retrofitting highways and other infrastructure for V2V and V2I solutions will cost billions of dollars. With the rapid pace of technological change, it is not even clear that a retrofit could be completed before a new standard would emerge.

For strictly V2V solutions, each vehicle would need to be equipped with V2V hardware and software. Since vehicles are staying on the road for longer and longer periods, it is hard to imagine that the critical mass necessary will be on the road in the next three to five years.

In conclusion, V2V communications could be a boon to safety and reduce road accidents, but there are many security, privacy and implementation issues to be addressed before this important technology can mature.