Exposing Congestion Attack on Emerging Connected Vehicle based Traffic Signal Control

Connected vehicle (CV) technology will soon transform today’s transportation systems by connecting vehicles and the transportation infrastructure through wireless communication. Having demonstrated the potential to greatly improve transportation mobility efficiency, such dramatically increased connectivity also opens a new door for cyber attacks. In this work, we perform the first detailed security analysis of the nextgeneration CV-based transportation systems. As a first step, we target the USDOT (U.S. Department of Transportation) sponsored CV-based traffic control system, which has been tested and shown high effectiveness in real road intersections. In the analysis, we target a realistic threat, namely CV data spoofing from one single attack vehicle, with the attack goal of creating traffic congestion. We first analyze the system design and identify data spoofing strategies that can potentially influence the traffic control. Based on the strategies, we perform vulnerability analysis by exhaustively trying all the data spoofing options for these strategies to understand the upper bound of the attack effectiveness. For the highly effective cases, we analyze the causes and find that the current signal control algorithm design and implementation choices are highly vulnerable to data spoofing attacks from even a single attack vehicle. These vulnerabilities can be exploited to completely reverse the benefit of the CV-based signal control system by causing the traffic mobility to be 23.4% worse than that without adopting such system. We then construct practical exploits and evaluate them under real-world intersection settings. The evaluation results are consistent with our vulnerability analysis, and we find that the attacks can even cause a blocking effect to jam an entire approach. In the jamming period, 22% of the vehicles need to spend over 7 minutes for an original halfminute trip, which is 14 times higher. We also discuss defense directions leveraging the insights from our analysis.

[1]  Salvatore J. Stolfo,et al.  A quantitative analysis of the insecurity of embedded network devices: results of a wide-area scan , 2010, ACSAC '10.

[2]  Saurabh Amin,et al.  Vulnerability of Transportation Networks to Traffic-Signal Tampering , 2016, 2016 ACM/IEEE 7th International Conference on Cyber-Physical Systems (ICCPS).

[3]  Matti Valovirta,et al.  Experimental Security Analysis of a Modern Automobile , 2011 .

[4]  J. Alex Halderman,et al.  Green Lights Forever: Analyzing the Security of Traffic Infrastructure , 2014, WOOT.

[5]  Aaron Hunter,et al.  A Security Analysis of an In-Vehicle Infotainment and App Platform , 2016, WOOT.

[6]  William Whyte,et al.  A security credential management system for V2V communications , 2013, 2013 IEEE Vehicular Networking Conference.

[7]  Ecnica De Catalunya.  RESOURCE AND PERFORMANCE TRADE-OFFS IN REAL-TIME EMBEDDED CONTROL SYSTEMS , 2011 .

[8]  Marc Emmelmann,et al.  Vehicular networking : automotive applications and beyond , 2010 .

[9]  Wilco Burghout,et al.  Hybrid Traffic Simulation with Adaptive Signal Control , 2007 .

[10]  Yiheng Feng,et al.  A real-time adaptive signal control in a connected vehicle environment , 2015 .

[11]  Suvrajeet Sen,et al.  Controlled Optimization of Phases at an Intersection , 1997, Transp. Sci..

[12]  Kevin Lee,et al.  Signal Timing Manual , 2015 .

[13]  Ross Anderson,et al.  Who Controls the off Switch? , 2010, 2010 First IEEE International Conference on Smart Grid Communications.

[14]  John B. Kenney,et al.  Dedicated Short-Range Communications (DSRC) Standards in the United States , 2011, Proceedings of the IEEE.

[15]  Kang G. Shin,et al.  Fingerprinting Electronic Control Units for Vehicle Intrusion Detection , 2016, USENIX Security Symposium.

[16]  Hovav Shacham,et al.  Comprehensive Experimental Analyses of Automotive Attack Surfaces , 2011, USENIX Security Symposium.

[17]  鹿田 成則,et al.  講座 HIGHWAY CAPACITY MANUAL 2000(3)2車線道路と多車線道路 , 2002 .

[18]  Yevgeniy Vorobeychik,et al.  Vulnerability of fixed-time control of signalized intersections to cyber-tampering , 2016, 2016 Resilience Week (RWS).

[19]  Dipak Ghosal,et al.  Security vulnerabilities of connected vehicle streams and their impact on cooperative driving , 2015, IEEE Communications Magazine.

[20]  Yang Xiao,et al.  Cyber Security and Privacy Issues in Smart Grids , 2012, IEEE Communications Surveys & Tutorials.

[21]  Narayanan Vijaykrishnan,et al.  Reliability concerns in embedded system designs , 2006, Computer.

[22]  Ryan M. Eustice,et al.  Risk Assessment for Cooperative Automated Driving , 2016, CPS-SPC '16.