# Secure Automatic Identification System (SecAIS): Proof-of-Concept Implementation
## 2 Related Work  
Several proposals for offering AIS-secure services have appeared in the literature. In [21], a security-enhanced AIS implementation that needs certificates from a cryptographic infrastructure was proposed. In [22], the IMO provided guidelines to promote the safe and effective use of shipborne automatic identification systems (AIS), in particular to inform the mariner about the operational use, limits, and potential uses of AIS. These guidelines do not improve the security of the AIS; they only show how to use the AIS as a communication channel to endow authentication capabilities to the ships. In [23], a global, x509-like Maritime PKI coordinated by the IMO and the National Maritime Authorities was proposed. Despite the advantages of the proposed solution, the global scale of the PKI and the use of resource-demanding certificates in the overloaded maritime wireless communication environment pose many implementation difficulties. The International Association of Marine Aids to Navigation and Lighthouse Authorities (IALA) presents, in its \"e-Navigation Portal\" [24], a number of proposals that may affect the future of AIS security. One of these proposals is to leverage the VHF Data Exchange System (VDES) [25] to address maritime security issues. However, the roadmap towards the universal adoption of the VDES is not yet clear; a debate in the maritime community about its deployment and operation cost is ongoing. In [26], the authors propose _SecureAIS_, a key agreement scheme that allows any pair of vessels in range of an AIS radio to agree on a shared session key of the desired length to be used for subsequent communications. This scheme allows for secure communication between two vessels only; thus, the broadcasting feature of AIS is not preserved. In a later paper [27], the same authors proposed Auth-AIS, a software-only solution that uses the TESLA authentication protocol and the Bloom filter tool to provide two modes of authentication, the \"Deterministic Security Configuration' with a message overhead of 75% and the \"Probabilistic Security Configuration\" with a message overhead of 35%. According to the authors, the Auth-AIS, similar to the SecAIS proposed herein, is a software solution that offers authenticated AIS messages with similar security properties, cryptographic techniques, and small false rates. However, a message confidentiality service is not offered. The TESLA protocol has also been leveraged to propose an authentication protocol that enhances the security of the AIS by providing it with a message-integrity and broadcast-authentication feature [28]. [PERSON] [29] has proposed a name-protected-AIS (pAIS), a concept similar to the authentication mode (mode 2) of the proposed SecAIS. However, the use of a 256-RSA key may lead to a private key compromise. Further, the use of RSA carries over the problems of certificate-based public key infrastructures. The use of public key cryptography (PKC) for authenticating AIS messages is also proposed in [30]. However, a separate VHF Data Exchange System (VDES) side channel is required to carry PKC digital signatures. Several backwards-compatible signature schemes for AIS messages are reviewed and compared concerning their applicability in [31]. Identity-based encryption (IBE) schemes are certifateless public key cryptosystems that were originally proposed by [PERSON] in 1985 [32]. Their advantage is that their public and private keys are derived from the identifiers of the participating entities [33; 34; 35; 36] (e.g., their MMSI numbers, as in [13; 14]). IBE schemes were also proposed in [37; 38; 39] to address the security issues of the automatic dependent surveillance-broadcast (ADS-B) system,an aviation system with functionality similar to that of the AIS. However, these proposed solutions cannot be transferred to the maritime environment or to the case of the AIS, as they have been designed for the specific ADS-B environment.