Abstract: The present disclosure is related to vehicle-to-everything (V2X) and Intelligent Transport System (ITS) communications technologies, and in particular, to misbehavior detection and misbehavior reporting services for Collective Perception Messages (CPMs). The misbehavior detection mechanisms include one or more data consistency checks, including a multi-step systematic data consistency check within individual CPMs, across multiple CPMs from the same transmitter, and across multiple CPMs from different transmitters. Potential misbehaviors are reported to a misbehavior authority in one or more misbehavior reports.

Abstract: Logic may implement observation layer intrusion detection systems (IDSs) to combine observations by intrusion detectors and/or other intrusion detection systems. Logic may monitor one or more control units at one or more observation layers of an in-vehicle network, each of the one or more control units to perform a vehicle function. Logic may combine observations of the one or more control units at the one or more observation layers. Logic may determine, based on a combination of the observations, that one or more of the observations represent an intrusion. Logic may determine, based at least on the observations, characteristics of an attack, and to pass the characteristics of the attack information to a forensic logging system to log the attack or pass the characteristics of the attack to a recovery system for informed selection of recovery procedures. Logic may dynamically adjust a threshold for detection of suspicious activity.

Abstract: Various embodiments are generally directed to providing authentication and confidentiality mechanisms for message communication over an in-vehicle network. For example, authentication data associated with a communicating node may be transmitted over the network by encoding different predefined voltage levels on top of the message bits of the message being communicated. Different voltage levels may represent different encodings, such as a bit-pair or any bit combination of the authentication data. In a further example, messaging confidentiality between at least two communicating nodes may be achieved by pseudo-randomly flipping, or scrambling, the dominant and recessive voltages of the entire message frame at the analog level based on a pseudo-random control bit sequence.

Abstract: Systems, apparatus, methods, and techniques for reporting an attack or intrusion into an in-vehicle network are provided. The attack can be broadcast to connected vehicles over a vehicle-to-vehicle network. The broadcast can include an indication of a sub-system involved in the attack and can include a request for assistance in recovering from the attack. Connected vehicles can broadcast responses over the vehicle-to-vehicle network. The responses can include indications of data related to the compromised sub-system. The vehicle can receive the responses and can use the responses to recover from the attack, such as, estimate data.

Abstract: Systems, apparatus, methods, and techniques for an ego vehicle to respond to detecting misbehaving information from remote vehicles are provided. An ego vehicle, in addition to reporting misbehaving vehicles to a misbehavior authority via a vehicle-to-anything communication network, can, take additional actions based in part on how confident the ego vehicle is about the evidence of misbehavior. Where the confidence is high the ego vehicle can simply discard the misbehaving data and provide an alternative estimate for such data from alternative sources. Where the confidence is not high the ego vehicle can request assistance from neighboring vehicles and roadside units to provide independent estimates of the data to increase confidence in the evidence of misbehavior.

Abstract: Systems, apparatus, methods, and techniques for functional safe execution of encryption operations are provided. A fault tolerant counter and a complementary pair of encryption flows are provided. The fault tolerant counter may be based on a gray code counter and a hamming distance checker. The complementary pair of encryption flows have different implementations. The output from the complementary pair of encryption flows can be compared, and where different, errors generated.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed to detect attacks in V2X networks. An example apparatus includes a challenge handler to (a) transmit a first challenge packet to a first vehicle to request a transmission of a first response, (b) instruct a second challenge packet to be transmitted to a second vehicle to request a transmission of a second response, (c) increment a first counter when the first response is not obtained, (d) increment a second counter when the second response is not obtained, and (e) after repeating (a)-(d), determine that the first and second vehicles are phantom vehicles associated with an attacker with a half-duplex radio when at least one of the first or second counters satisfy a threshold, and a network interface to instruct a third vehicle associated with the V2X network to ignore future messages from the phantom vehicles based on the determination.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed to validate data communicated by a vehicle. An example apparatus an anomaly detector to, in response to data communicated by a vehicle, at least one of compare an estimated speed with a reported speed or compare a location of the vehicle with a reported location. The apparatus including the anomaly detector further to generate an indication of the vehicle in response to the comparison. The apparatus further includes a notifier to discard data sent by the vehicle and notify surrounding vehicles of the data communicated by the vehicle.

Abstract: Various embodiments are generally directed to techniques for providing improved privacy protection against vehicle tracking for connected vehicles of a vehicular network. For example, at least one road side unit may: identify a set of vehicles that require pseudonym changes and send an invitation for a pseudonym change event to each of the vehicles, determine at least a total number of the acceptances, determine whether the total number meets or exceeds a predetermined threshold number, send acknowledgement messages to the accepting vehicles if the threshold number is met, and form a vehicle group to coordinate the pseudonym change event during a privacy period. During the privacy period, the RSU and the vehicles may communicate with each other in a confidential and private manner via key-session-based unicast transmission, and coordinate transmission power and vehicle trajectory adjustments to maximize the benefits for safety and obfuscation for privacy.

Abstract: A first roadway system receives a communication from a second roadway system over a wireless channel, where the communication includes a description of a physical object within a driving environment. Characteristics of the physical object are determined based on sensors of the first roadway system. The communication is determined to contain an anomaly based on a comparison of the description of the physical object with the characteristics determined based on the sensors of the first roadway system. Misbehavior data is generated to describe the anomaly. A remedial action is initiated based on the anomaly.

Abstract: Systems, methods, computer program products, and apparatuses for low latency, fully reconfigurable hardware logic for ensemble classification methods, such as random forests. An apparatus may comprise circuitry for an interconnect and circuitry for a random forest implemented in hardware. The random forest comprising a plurality of decision trees connected via the interconnect, each decision tree comprising a plurality of nodes connected via the interconnect. A first decision tree of the plurality of decision trees comprising a first node of the plurality of nodes to: receive a plurality of elements of feature data via the interconnect, select a first element of feature data, of the plurality of elements of feature data, based on a configuration of the first node, and generate an output based on the first element of feature data, an operation, and a reference value, the operation and reference value specified in the configuration of the first node.

Abstract: Systems, methods, computer-readable storage media, and apparatuses to provide active attack detection in autonomous vehicle networks. An apparatus may comprise a network interface and processing circuitry arranged to receive a first data frame from a first electronic control unit (ECU) via the network interface, determine a voltage fingerprint of the first data frame, compare the voltage fingerprint to a voltage feature of the first ECU, determine that the first data frame is an authentic message when the voltage fingerprint does match the voltage feature of the first ECU, and determine that the first data frame is a malicious message when the voltage fingerprint does not match the voltage feature of the first ECU. Other embodiments are described and claimed.

Abstract: In one example a prover device comprises one or more processors, a computer-readable memory, and signature logic to store a first cryptographic representation of a first trust relationship between the prover device and a verifier device, the first cryptographic representation based on a pair of asymmetric hash-based multi-time signature keys, receive an attestation request message from the verifier device, the attestation request message comprising attestation data for the verifier device and a hash-based signature generated by the verifier device, and in response to the attestation request message, to verify the attestation data, verify the hash-based signature generated by the verifier device using a public key associated with the verifier device, generate an attestation reply message using a hash-based multi-time private signature key and send the attestation reply message to the verifier device. Other examples may be described.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed to validate data communicated by a vehicle. An example apparatus an anomaly detector to, in response to data communicated by a vehicle, at least one of compare an estimated speed with a reported speed or compare a location of the vehicle with a reported location. The apparatus including the anomaly detector further to generate an indication of the vehicle in response to the comparison. The apparatus further includes a notifier to discard data sent by the vehicle and notify surrounding vehicles of the data communicated by the vehicle.

Abstract: A first roadway system receives a communication from a second roadway system over a wireless channel, where the communication includes a description of a physical object within a driving environment. Characteristics of the physical object are determined based on sensors of the first roadway system. The communication is determined to contain an anomaly based on a comparison of the description of the physical object with the characteristics determined based on the sensors of the first roadway system. Misbehavior data is generated to describe the anomaly. A remedial action is initiated based on the anomaly.

Abstract: Logic may implement protocols and procedures for vehicle-to-vehicle communications for platooning. Logic may implement a communications topology to distinguish time-critical communications from non-time-critical communications. Logic may sign time-critical communications with a message authentication code (MAC) algorithm with a hash function such as Keccak MAC or a Cipher-based MAC. Logic may generate a MAC based on pairwise, symmetric keys to sign the time-critical communications. Logic may sign non-time-critical communications with a digital signature. Logic may encrypt non-time-critical communications. Logic may append a certificate to non-time-critical communications. Logic may append a header to messages to create data packets and may include a packet type to identify time-critical communications. Logic may decode and verify the time-critical messages with a pairwise symmetric key. And logic may prioritize time-critical communications to meet a specified latency.

Abstract: Logic may reduce the latency and increase the confidence in message time series (MTS) intrusion detection systems (IDSs). Logic may capture traffic on an in-vehicle network bus during a first traffic window. Logic may filter the traffic within the first traffic window to determine more than one observation window, wherein the more than observation window comprises at least a first observation window and a second observation window. Logic may evaluate the more than one observation window to determine a first output based on a first observation window and a second output based on a second observation window, the first and second outputs to indicate if an intrusion is detected. Logic may determine, based on a combination of the outputs, that the traffic during the first traffic window comprises an intrusion. Logic may output an indication of the intrusion.

Abstract: The present disclosure describe methods, apparatuses, storage media, and systems for a device disposed at an edge of a vehicular communication network or vehicles within a coverage area of the device. The device is to generate a list of vehicle security data to be distributed to vehicles currently within a coverage area of the device, based at least in part on a context related to the vehicles. The device is further to announce, on a control channel communicatively coupling the device and the vehicles, that the list of vehicle security data are available and a service channel to receive the list of vehicle security data. The list of vehicle security data are to be provided to the vehicles via the service channel. Other embodiments may be described and claimed.

Abstract: A first roadway system receives a communication from a second roadway system over a wireless channel, where the communication includes a description of a physical object within a driving environment. Characteristics of the physical object are determined based on sensors of the first roadway system. The communication is determined to contain an anomaly based on a comparison of the description of the physical object with the characteristics determined based on the sensors of the first roadway system. Misbehavior data is generated to describe the anomaly. A remedial action is initiated based on the anomaly.

Abstract: Systems, apparatuses, and methods to identify an electronic control unit transmitting a message on a communication bus, such as an in-vehicle network bus, are provided. ECUs transmit messages by manipulating voltage on conductive lines of the bus. Observation circuitry can observe voltage transitions associated with the transmission at multiple points on the in-vehicle network bus. A voltage waveform can be generated from the observed voltage transitions. ECUs can be identified and/or fingerprinted based on the generated waveforms.