Abstract-Untraceability of vehicles is an important requirement in future vehicle communications systems . Unfortunately, heartbeat messages used by many safety applications provide a constant st ream of location data, and without any protection measures, they make tracking of vehicles easy even for a passive eavesdropper. One commonly known solution is to transmit heartbeats under pseudonyms that are changed regularly in order to obfuscate the trajectory of vehicles. However, this approach is effective only if some silent period is kept during the pseudonym change and several vehicles change their pseudonyms nearly at the same time and at the same location. Unlike previous works that proposed explicit synchronization between a group of vehicles and/or required pseudonym change in a designated physical area (i.e., a static mix zone), we propose a much simpler approach that does not need any explicit cooperation between vehicles and any infrastructure support. Our basic idea is that vehicles should not transmit heartbeat messages when their speed drops below a given threshold, say 30 km/h, and they should change pseudonym during each such silent period. This ensures that vehicles stopping at traffic lights or moving slowly in a traffic jam will all refrain from transmitting heartbeats and change their pseudonyms nearly at the same time and location. Thus, our scheme ensures both silent periods and synchronized pseudonym change in time and space, but it does so in an implicit way. We also argue that the risk of a fatal accident at a slow speed is low, and therefore, our scheme does not seriously impact safetyof-life. In addition, refraining from sending heartbeat messages when moving at low speed also relieves vehicles of the burden of verifying a potentially large amount of digital signatures, and thus, makes it possible to implement vehicle communications with less expensive equipments. . As deployment decision points for these projects draw nearer, the provision of adequate security mechanisms will be an important consideration for policy-makers. In addition to the usual security requirements of confidentiality, authentication and integrity, VANET security typically presents an additional requirement, that of privacy. Informally, the privacy requirement represents a user's expectation that only appropriately authorized parties will be able to determine where he or she was at a given time. This informal definition may be formalized in many ways, and the definition of appropriately authorized parties may vary according to the circumstances and from jurisdi ction to jurisdiction (or a user may expect that no entity can track them at all). As messages sent by the vehicles within the VANET may contain meta-information that endangers the privacy of the drivers, vehicle communication systems must satisfy the following two properties: pseudonymity and unlinkability. Pseudonymity means that identifiers in a message do not directly refer to the sender of the message, so an eavesdropper cannot easily determine the real identity of the sender. Unlinkability means that it is made difficult for an attacker to determine that two messages have come from the same vehicle. This second property is necessary to preserve privacy in the sense of our informal statement above because a physical observation of a vehicle at point A, and the ability to link its transmissions at A to transmissions at B, would allow an attacker to determine that the vehicle had also been at point B. Note that we do not address short-term linkability which is required in order to implement vehicle safety applications. Making the security subsystem designer's job more complicated, most proposed V2X communications systems make use of an additional type of highly privacy-threatening message, known as the heartbeat (in America) or beacon (in Europe) message (see [5] for an example). This message is sent with a high frequency (10Hz is often recommended) and contains the vehicle's current position and velocity, in order to improve the information that other drivers have about the traffic conditions in their immediate vicinity. An attacker can therefore attempt to trace a vehicle, and thereby break its
Buttyan et al. REF proposed the SLOW scheme under the consideration that the vehicle is less likely to collide at low speed.
SLOW: A Practical pseudonym changing scheme for location privacy in VANETs
2009 IEEE Vehicular Networking Conference (VNC)
2009 IEEE Vehicular Networking Conference (VNC)
Computer Science