## 3 Neighbor Verification through Low-Power Beacons
### Further Check Based on Credit  
An attacker within \(d_{W}\) of the roadside can still hear the whispers of the target vehicles and mount the attack. In order to cope with such attackers, we can extend the whisper scheme by incorporating the notion of credit. In this extension, each vehicle \(V\) tracks the credit \(C_{V}(U)\) for each neighbor vehicle \(U\). Without further sophistication, we simply let the credit increase by one point per each passed whisper test and decrease by one point each second. In Algorithm 1, we showed how the credit for each neighbor is increased. To prevent the attacker from arbitrarily inflating the credit, the increase for each neighbor can be bounded by the whispering frequency \(f_{W}\), so that the reception of whispers beyond \(f_{W}\) does not add to the credit. Assuming the minimum whisper rate cannot fall below 1 Hz, legitimate neighbors within \(d_{W}\) of \(V\) will maintain a non-zero credit at \(V\). Given the whispering frequency of \(f_{W}=7\) Hz, for instance, the maximum credit that one neighbor can accumulate per second is \(7-1=6\). Based on this observation, we can set the credit threshold over which we can trust a given neighbor vehicle at \(V\) as  
\[\theta_{V}=(f_{W}-1)\cdot d_{X}/v(V),, \tag{2}\]  
where \(v(\cdot)\) is the speed of the given vehicle. The threshold \(\theta\) is essentially the credit that a roadside attacker can maximally accumulate at \(V\) while \(V\) travels a distance \(d_{X}\) at \(v\), or equivalently, during \(d_{X}/v(V)\) seconds. Here, \(d_{X}\) is the maximum distance that a vehicle can use the same whisper ID, as in Equation (1). To show how long a neighbor vehicle should travel with a host vehicle to be considered credible, Figure 5 plots \(d_{X}/v(V)\) as a function of \(t_{u}\) and \(v\) for \(d_{W}=170\) m.  
A single-hop whisper check will roughly halve \(\theta\). Therefore, in reality, the time that neighbor vehicles should be in the communication range of a host vehicle to be trusted can be small. The credit-based enhancement ascertains \(C_{V}(U)>\theta_{V}\) for \(V\) to trust the message from \(U\). Namely, if the neighboring vehicle \(U\) can accumulate more than a roadside attacker maximally can, \(V\) trusts \(U\).  
Obviously, there is a risk of completely ignoring the legitimate vehicles whose credit falls short of \(\theta\), e.g., due to message losses arising from adverse channel conditions. Or, a new vehicle can join the traffic from a junction. But Figure 5 is a very conservative estimate considering that we define \(d_{W}\) to be the maximum distance at which the whisper reception probability is non-zero. The whisper ID can change much faster, as long as the binding with the certificate digest is maintained. Using small \(t_{u}\) reduces \(\theta\), helping vehicles within the whisper range \(d_{W}\) quickly exceed the threshold for each other.  
Figure 5: Elapsed time required for trust vs. whisper time allowed for the attacker, \(d_{W}=170\) m.  
Using smaller \(d_{W}\) would reduce the threshold even further, especially when \(v\) is small, reducing \(d_{W}\) by using smaller Tx powers can be useful because the smaller distance is driven in a given time than in high-speed driving so that credibility checking may be more focused on closer neighborhood.