## 4 ITS Threats Analysis and Classification
### Classification of ITS Attacks and Cryptographic Countermeasures
#### 4.4.3 Attacks on Integrity/Data Trust and Countermeasures  
The main goal of integrity protection is to ensure that the exchanged messages are not altered during their transmission by malicious users. Moreover, it gives the ability to resist destruction, unauthorized creation and alteration of data. Several methods can be used to violate the integrity property, and consequently, the protocol would be deemed flawed [72]. The main cryptographic solution consists of appending a signature to each exchanged message. However, this kind of protection cannot be applied when a data aggregation process is applied. A legitimate node within a network can be vulnerable to both external and internal attacks. The effect of external attacks remains small in comparison with the effect of internal ones (_i.e._, authenticated attacker). Cryptographic hash functions form the essential solution for integrity problems. In the following, several examples of integrity attacks are described briefly with their countermeasures. * Masquerading attacks: This kind of attack is hidden, uses a valid identity (known as a mask) to ensure that it has the appearance of an authentic node, tries to produce false messages and broadcasts them to neighbor vehicles in order to attain specific objectives, for example to slow down the speed of a vehicle. A malicious node attempts to act as an emergency vehicle and, thus, cheats the other vehicles. To overcome this attack, a certificate revocation list (CRL) is used to maintain the identities of the detected malicious vehicles, which is furthermore distributed to the overall nodes within the ITS network. Even though this solution can reduce the effects of the masquerading attack [47], it requires the implementation of an efficient malicious nodes detection technique;
* Data playback attacks: This attack consists of replaying (broadcasting) a previously transmitted message [73], for example to manipulate the vehicle location and/or the nodes' routing tables [51]. To provide robustness against this kind of attack, a cache can be implemented at the OBUs and RSUs stations to compare the recently received messages with the oldest ones in order to reject the duplicated messages (e.g., based on sequence numbers or timestamping information). Moreover, secure session tokens can be generated to uniquely identify a communication session between two legitimate entities, and nonces (_i.e._, a random number used only once in cryptographic systems) can be exploited to ensure that each message is processed only once;
* Data alteration attacks: This kind of attack consists of breaking the integrity of the exchanged messages by modifying, deleting, constructing or altering their content [66]. Additionally, it can affect the availability and the non-repudiation services. The attacker falsifies received messages to achieve its own benefits by leading the driver to change the decision, such as by indicating that a given route is congested or not. Another dangerous threat consists of the injection of false safety messages, thus impacting the safety of the drivers and vehicles [15]. Several techniques can be employed to overcome this threat, such as vehicular public key infrastructure (VPKI) or zero-knowledge to ensure the authentication between vehicles and for signing ITS messages [74,75]. Another efficient method consists of establishing group communications,as discussed in [75, 76], where the keys can be managed by a group key management (GKM) system [77]. This means that an intruder should not be able to communicate with the group members;
* Map database poisoning attacks: Based on the exchanged messages (e.g., broadcast safety messages), each OBU builds and maintains a local map database to keep track of all surrounding vehicles, events and points of interest. This attack consists of sending malicious messages to impact the accuracy of the local map databases of ITS entities and, thus, to impact the safety of ITS applications and users.