# Wireless Communication Technologies for Safe Cooperative Cyber Physical Systems
## 4 Safety and Security for SafeCOP Co-CPSs
### Autonomous Boat Platoons  
The primary scenario defined in this use case deals with one USV that is remotely controlled by a human operator located on another vessel. The wireless link connection between the USV and the manned vessel is maintained active by the continuous transmission of mode command messages from the manned vessel to the USV, to improve the reliability of the communication. If the message is not received within a given time-frame, the USV considers that the communication with the manned vessel is lost. Then, the USV will enter in fail-safe mode (e.g., stop). This mechanism is implemented at application level and independent of the underlying communication protocol.  
A crucial safety requirement that the cooperative bathymetry platoon has to fulfill is to guarantee that a safe distance is maintained between the USV and the manned vessel. The acceptable distance between the USV and manned vessel is calculated as the maximum distance that allows messages carrying vessel voyage information be reliably and timely transmitted over the wireless network. Since the signal strength in maritime wireless networks is subject to perturbations due to the sea movement, safety messages are subject to packet loss at communication level. Therefore, sending messages in a periodic manner is applied to compensate packet loss. The vessels speed is typically slower than other transportation systems (e.g., cars, trains, etc.). Thus, missing one message is acceptable if the following one can be received correctly and timely.  
Another safety requirement related to communication of safety-critical events emerges e.g., in the avoidance of potential collisions with obstacles such as another vessel, swimmer, or buoy. The manned vessel issues safety-control commands to the USV, which has to respond within a certain time to avoid collisions. To meet this requirement, the messages carrying control commands shall have higher priority than the messages sent out periodically. However, if a message carrying the safety-control command is lost during its transmission, the human operator may still have the chance to re-issue the same command if the message loss can be detected by timeout. It is worth noting that setting up a timeliness of the control command needs to take into account the movement of the USV and the distance to the obstacle. Thus, the timeliness of the control command may be varying from command to command.  
Additional safety and security requirements have to be fulfilled to ensure safe USV operations [62; 63]:  
* _Messages authentication_ ensures that the message is received in the same condition as it is sent out with no bits inserted, missing or modified. If the message is modified en route, then the receiver will certainly detect this. Without message authentication, the message, which is either corrupted or modified during transmission, carries the wrong information/command and may lead the USV to an unsafe-state, e.g., colliding with an obstacle.
* _Message timeliness_ mechanism effectively limits the age of validly of delivered messages. Thus, if an attack diverts the validated messages for replay much later, the receiver can detect the delay introduced by this attack. Without timeliness constraint, the message which is not modified/corrupted but delayed may lead the USV to an unsafe-state. For example, if the command that the USV shall reduce the speed to avoid a potential collision is delivered to the USV too late, the USV may not have sufficient time to reduce its speed to avoid collision.
* _Message sequence_ can be used to detect message loss, repetition and insertion. Without this mechanism, the attacker may intercept messages or insert malicious messages without being detected.  
NGHam does not support any of the security mechanisms listed above. Therefore, the corresponding security functions need to be specified and implemented separately.