Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/578 Thanks!
I would talk about week to week
a communication today, um,
um, I'm talking about two
about week to week.
Communication is things
because I'm working for
about four years about and on
these topics for Foxley.
Um, and yeah, I think
I have some knowledge about this.
So, um, whenever
I would talk about this and I
think I have to give you a sort
motivation on this,
after this, I will introduce some basic
concepts that this just really important
to understand for the standards
that I will go through some standards
afterwards. Yeah, some security
stuff.
In the end, I will talk about what
the challenges actually and
what we want to do in the future.
Um, OK, let's start
with the motivation.
Um, the very basic
motivation of week
to week of communication is that we want
to avoid any crashes
and accidents.
Um, and
this is becoming harder and harder
for the automotive industry because
we got
a lot.
Yeah. So, um.
Yeah.
We solved a lot of problems in the last
years, and the problem
is that there are some events we
cannot predict or
even it's hard to detect with
some sensors. So when
you have an emergency vehicles driving
around with its signals
on and such things that
we have some really
we have have accidents.
It's really not nice, actually.
And with enormous sensors,
it's really hard to detect
these emergency vehicles because
they behave in a strange
way. They don't
follow some rules which you have and, you
know, take things
that are similar to other things,
like a red light validation,
uh, violation that
is also very hard to detect
for an armored vehicle.
So and we
think we can solve this problem,
this communication between
cars.
Um, yeah.
Um, you may
heard about this technology already,
and
we all these
kind of hazards have
some things in common.
Um, one thing is that they
are really, um,
local. So we don't have some
influences in KM.
Race is really a local, um,
hazard.
And so we have,
uh, short distances.
We have we need to overcome this,
this communication
between the heat.
But we can also, um,
communicate between vehicles and
infrastructure like, uh, water units.
Um, this is
really important, this signalized
and such things. But I will not really
talk much about, um, infrastructure here.
Um, we also
think when you think about these use
cases and accidents,
you need to be really fast.
At least we want to fast.
I want to be faster than, um,
human in its reaction.
So I
think we need some communication agencies
and not ten milliseconds.
It's yeah. It's the gas
actually.
Uh, no, no, not actually.
But this was a gas at the beginning.
We also have the problem that
we cannot predict
who is really interested in this
information since the traffic
is constantly moving.
Um, and so the relevance
of this hazard can change
for every car in some minutes.
Seconds depends on the
hazard itself.
And, um, we got
in 2008, I think,
uh, we got in, um, we
got a who own, uh, frequency band
to for communication this.
So that's that's more or
less what we want to achieve
with these communications.
So, um, then
yeah. Um, I would
before I can go to the standards, I
have to introduce some basic concept.
This is really important to understand.
Let's make this really easy or easier.
So, um, imagine
you have an, um, use case
like in front of the
office in which you have an
emergency brake, um,
when this blue car is working
really hard. So then
Devide car cannot
see this emergency brake and the
emergency brake is for this Vitka
and um, important things.
Um, when this
truck is braking
distance between the cars is too load and
you have a crash.
The problem on this case is that
the white car cannot see this
blue car and
is therefore the DEEDI
event has some, um,
how to say it depends
on each car in this line.
So if the
driver of the truck reacts
to less than even the right car has
some problem in the end.
So you get the motive crash.
And that's not a nice thing
when you have when you use
communication for this.
We believe that we can shorten
this reaction time a lot because
we can uncouple these events.
The, um, when the blue car
is working and you can send out
a message to the red car, you can
increase the reaction of the vodka.
That's the simple idea behind this.
Um, um,
this is also working for another use
case. This is quite a broken
down Renuka.
There you have.
It's similar to the other things
we have an event in front
of the book, not only you can
you want to inform or following
in about this that the
simple idea behind us.
But you have to
think about a little bit more about
how to communicate this information.
So the
simplest solution to it is
when this blue car, for example,
works, then you
can detect is emergency brake
and send out a message so
the vodka can react.
That's straightforward.
And this kind of communication vehicle
event based communication.
But there's another approach for it.
Things
you can change the
detection position.
So when
when you send out with a blue car only
status information of the car, for
example, how far fast
it is, how is the acceleration
as the braking activated
in such things?
And then you
send it out in a frequent manner, then
you can detect these
events in the receiving car.
Did change a little bit, uh,
the the words.
But we will see later what
to be which
influences would have.
Um, but
what nanobot boof
boof approaches have Scevola us
have some advantages and disadvantages.
One disadvantage we can see
one disadvantage of the
awareness based communication.
Oh forget this.
He is sending out
his status information and
we call it awareness based communication.
And this event, space communication
has some problems.
You can detect that there
maybe a car in front of you and is
standing still somewhere, but you don't
know why it's a car defect
or is there in a
traffic jam or something else?
You can't not for safety
considerations does fine because, you
know, there is something and you can
reduce the speed and it's
really fine. But maybe
you have a different strategy for a
different kind of events,
for example, when that's broken down
vehicle. Yeah, OK, you can pass simply.
But if this is this vehicle
in the traffic jam, you may think, oh
no, I will leave this highway.
So that's a little bit
of a disadvantage.
But there's
several disadvantages or advantages
for each type.
And then you have this event based
communication.
You have simply
a message which describes this event
that's but then space
communication has and status message
about the vehicle.
And the problem
on this in the end space is that
you have a complex
interplay, interpretation of this,
who in many of these messages thinks
this is only an indication what may
be happening there. But in this
event based communication, you can have
this event described
and the interpretation is easy.
OK, um,
and on the
desk also the the advantage
of the event based communication that
you only need one message to receive
for this other for this event.
Space communication.
You may need a lot of messages
before you see what's happening, what is
going on.
But this event
based communication had the problem
that you have to because
you have to know which use
cases you need where you want to cover
with this technology.
So then,
um, um, so
when you have a news case, which you
cannot
anticipate for the future, then you have
the problem that you can't talk
about this and you can't
detect us in the end.
And this will be a problem then
you have a car for eight
years, 10 years, and then
you can eight years, 10 years,
this car cannot detect these
used cars or this event.
So it's just a small problem.
But then you have this and
then space communication and
you never talk about used cases
before in the beginning.
And you may develop some
use cases afterwards as the status
is possible. But that's
yet.
So, OK,
these basic concepts
will be really important for these
standards. So, um,
the problem is the standard is we
have not one that's almost the
same. So we have.
Yeah. Free standard yet
this is one in the US, one in Europe,
we have one in Japan and
then we have a lot of activities to
vehicle to vehicle communication.
This is in China and
on this slide I forget one country more.
Even in South Korea, there's some
activity regarding this technology.
Um, yeah,
I will in this talk only talk about
the US and Europe things.
That's more or less.
That's what I do at
work.
Um, what's too
important to know about this is that,
um, in Europe
we have the car to car communication
consortium with just, um, standardization
and does a lot of this.
And in the US Campas,
that's mostly OEM's and some
other interested
stakeholders.
So but the
US standards is
focused on awareness based communication,
whereas the EU is focused on
event based communication.
You will see this in standard unindexed.
So, um, here's
one small slide to see
who is involved in the development
of these standards in Europe.
It's mainly OEM's.
Then you have some suppliers
for authorities, research
institutions and such things.
OK.
I told you that
in Europe you have to use event
based communication and we have one.
The main message is we
use these decentralized
environmental and notification message
that's describing when
you enter the same position and
then called us on it and some extra
additional data for for some
special use case that it's
more or less what's in
the the
US send a message.
It's called these basic safety message.
And this is, of course, awareness based
message. And yeah, I
told you already does contain some
Setas information about you.
But when you
walk on this topic,
you will have
you have the advantage
of. So even in
the EU and the US and Europe, we
have and messages
called coÃ¶perative.
Then this message, of course, it's an
awareness based message is really similar
to the basic safety message.
Um, and yeah,
the US the have flagged
in these basic safety message,
which is also more an
event based communication.
So, um, after some
development that we mixed
up these advantages
of Puf approaches, but
you will see later, that is a little bit
different.
I will not talk more about this context
content of these messages, but
you can see on the left, on the right in
which not they are defined
and then you can have a closer look to
it.
Unfortunately, I think
as a as a son,
as a not public, or you have to buy them.
But these ETSI standards, you should
you should download it from the Internet.
It should be possible.
Um, um,
OK.
So then we have to
define this payload, what we
are, what we, what use cases we
want to cover.
Um, we have the problem that we
have not only these two messages,
three messages, we have a lot of
different messages.
So we need some kind of message
multiplexing.
Um, and
um, for example, the other messages,
better maps.
This is speaking of faith and timing,
just some things related to,
um, traffic lights and such thing.
Um.
OK, and you and you,
we have some, yeah, basic
transport protocol, it's a lesson on
how that is similar to UDP but has
no length indicator for yet or something
like this. But then source
path and destination port.
And what's also different
to the UDP is that the
location or the mapping from the pilot
to the application is not done
dynamically like a normal computer,
but it's defined in a standard
that's on, um, in
the US. You have not suchan
protocol between it, but there's
an implicit convention.
This is that you have
one element in the beginning of this
payload and this is an
enumeration and the F and switch
between the messages.
Um.
OK, um.
The problem now is you don't
know who to
inform you about some
traffic event, so
at least you have to think about how
to route these messages and
who could be interested in these
messages, therefore,
and for awareness based communication.
The really simple
solution and which we use is
that we simply broadcast this
information.
So since we don't know which
use cases might be happening, actually
we use this broadcast
approach.
We call it single hop broadcasts, things
we don't intend to forward these messages
forward.
That's simply OK.
But when you have
an event based communication,
then, you know,
which maybe who could
be interested in it?
And for example, for this broken
down, we don't have this.
We know that all the
following cars might be
interested in this information, but all
these cars, which has already passed,
that they have not
any advantage of this this information.
So you can define
and special area maybe
and send out
a message which can be read
or forwarded in this
area so that we can
inform all these cars which
are in this area.
You can find.
Um, yeah, that's so.
Yeah, that's too important.
Mooting mechanisms we're using.
Um, and
in the end you
have the protocol,
it's given gillnet, it's given that
this some D
to mooting algorithms,
but there are some more getting over it
and this is not important.
Um, but what you see is that
these new networking protocol history
has um the
basic and the common had to have some
normal now not normal, but have some,
um, controlling information about
this protocol.
And the extended header has some
additional data for these protocols,
for the algorithms we use to um.
Yeah. To broadcast this information.
Um, um,
the separation of the basic head and a
common head. I will talk about this
later.
Um, for the.
For us, they
have only one header at this,
and it's had a really simple
things, they was more focus on the
offense based communications.
They don't need these additional
algorithms. So this
header simply and
broadcast protocol.
And it's really easy,
as I already said,
is, um, the title of the Yes
talks said that is based
on eight hundred two point eleven
P. Um, the
boost standards are based on
this. So, um, eight
hundred two point eleven requires
and had a
logical link, control and
Subnetwork Access Protocol.
The simply Auslin um
message multiplexing.
Yeah. And each kind
of message has a fixed identifier
and to see this is a type's
at the top.
Um,
the P extension
of eight hundred two point eleven
is one flag.
Does this dot 11 OCB
activated.
Um that means outside
the context of s of the basic
service said um this
simply disables all
things um which has
to do with an access point.
So you have no access point.
Discovery, you have no authentification,
no association, no
assembly or things, which is
this basic access point.
And there are some other things we don't
need. And this so.
At least we use
a ten to two point eleven only
for broadcast at this point.
Um, yeah, I think that is,
um, almost all about this
ahead of us.
But I want to say
something about these frequencies
we are using. Actually, this is
the frequency band we use.
And, um,
this is not fixed to any
technology. So actually
you can use any technology
in these events, but they have
to be related to its
sync, so.
Um, and the U.S.
and the European is a little bit
different in the transmission power you
can use, but that's fine.
OK, this is basically
the standard, the concepts of this,
and that's digital.
Then you have to look at these standards,
um, how we use security.
And, um, we could we
could communication.
Um, we have some requirements.
Um, this is things we have
to deal with, safety related things
and accidents.
We want to have the possibility
to authenticate Dicenzo's a little
bit. So not anyone
should send any message as this is
dangerous in our view.
Um, but we all want to protect the
privacy of the drivers and we
have some standard attacks we don't want
to have. So we play attacks on such
things.
Um, but unfortunately,
I don't know so much at the US
of the US, the NATALYA'S, so I
will only talk of the U.S..
Um, well European standard.
Um.
Um, the problem
now is that we have
to think
about security in the case
this year.
Um, we want.
We want to have
some security and I want don't
want to change messages from anyone,
so, um, the problem
is now that we have to
put some signature at the end of the
security payload.
But when you use it,
um, um,
sorry, um,
we cannot use, um,
ISIS or something like this because
we have to use one shared secret
and shared secret about
sharing between
several million cars.
Maybe it's not a secret.
So we have to use um.
Um, so I got
in there, um, we have
to use something like,
um.
So.
And we have to use things like IEDs
or things like, um,
elliptic curves or something like this,
but, um, the
problem there is you have a private and
private and public key.
And this is a cobbled together
when you have one poverty here.
That's all we have when you reach
and identify and.
Um, the here
you can decrypts with a couple of key and
you have to problem that there's only one
private key to it and then
this isn't identified as unique.
So privacy is a problem with
this approach, but therefore we have
a screening certificate
and long term certificates in each car
to understand how it works.
And you have to look on the public
key infrastructure.
Um, each car
is provided with a long term certificate
and these long term A
is the act on
it. You get this certificate
and the protection time for each car.
So each car has its own
long term certificate
and things.
Um, we want to have this technology
to to work, um, this
differ and manufactured
of this cars from different
manufacturers.
We need an rootsier somehow because
each manufacturer will have its
own long term certificate, uh,
certificate authority.
Um, and
we have all the future a future
that is called cross certification,
things we need to do to
us because every country in Europe maybe
will have its own future.
So that's a political decision.
Um, but you
are not allowed to use these
long term certificate for communication
with other cars,
for the communication with other cars.
You use these 30
Ternium certificates.
And one feature about
this is that the car can change
this certificate as is vaunt.
So.
Um, and
you use these long term certificate
only for authentication authentification
for the new certificate
authority.
This, of course, knows about who they
are so that you don't know.
You don't have to know about
these long term certificates, sales
certificates, sorry,
uh, long term certificates
of authority.
So, um, and you can get
a lot of sort of certificates.
Um, therefore, you have some
kind of privacy because
you have a lot of pseudonyms.
Um, yeah.
How many certificates you have.
The thing is you have
more than 20 certificates in parallel
for more account about one week.
And you have some words when you have
to change your certificate.
That said, the ending, the start
and you have to change
these certificates every 10 to 30
minutes. But all
these things actually, and a discussion
that's not started yet and
will be done desert and the basic
standard profile of the car
to car communication consultant for the
European.
Um, yeah, maybe
it's not fixed, actually.
Um, OK,
but what means a sort of new change,
um.
As you see on the right is that
we have the security is not
a vertical layer and our stackers
and horizontal layer because
you have to change every
identifier you have.
It also includes the megadose
you use.
That also means you have any,
um, identifier in
the applications and such and things.
So I would personally say
that I the security
should be like this in the
static image.
Um, but we have
another problem.
These sort of identifiers.
When you think about, um,
communication, events, based
communication, we have something
we need hiccough dynamicists to
dimensions to work with us.
So, um,
and he dynamic,
um, it's a small problem.
And then you have to go off from
work. Seven a.m.
being vier a BMW or something
like this, it's all OK.
But when you drive a Lamborghini
it's a really unique, uh,
vehicle, then it's really
low, but it is wide and long.
So it's more or less unique when you
drive around with a Lamborghini and
you have the problem that is
also in debt and identifying things.
You are alone on the, um, on the
street, all the cars
around you will not look like a
Lamborghini.
And so therefore, we have
to reduce the accuracy.
Uh, we use the equity
of this
value. So that's on ten,
ten centimeters.
Um, yeah.
But you have to care about these things.
OK,
the long term certificates are
valid for several years,
but they happen
at one point, you have to exchange these
long term certificates.
That's even the same, this duty
certificates, but.
As you see already, we use
elliptic curves for it and
distance, and we
talk a lot a long time
about the standards and we actually used
in escort because, um,
and the standards.
But, um, yeah,
there's a discussion with the points
and position in the center
of Germany, and they want
to change this a little bit.
Um, and one change is that
they want to have different pull curves.
Um, for us it doesn't
matter. We need an OECD
is a 256
curve things.
Our hardware acceleration
actually works on you with these curves,
but it's not um,
we don't depend on the curve.
And actually we use these
elliptic curves for every certificate,
any standards, and they want to change
all those. But, uh, yeah,
that would be all the change things.
We'd only need it for the communication
between cars.
Um.
Um, one thing about this harpists
escalation is this is really important
for us to be
here. Yeah, we anticipate that
we have in the worst case,
around about 700 to
800 messages per second.
And then you get a problem, this
validation of these certificates.
So we need a million not salivation at
this point, but this is worst case
calculation. So, um,
in the beginning, we will not have this
problem.
OK, what else?
Um, yeah.
We need to think about
more things at the moment
we have in communication and we
can exchange data, but the problem
is the interpretation of this data.
We have to define
really strange things or things
you don't expect at the beginning
when you have an opposition that you
share with all of the cars around
you as an advance driver's
assistant system developer,
you have the problem where the French
position is in the center
of the cars is on your front
bumper or on the way above
bumper this position, because
that means maybe up to two meters
difference.
That's about
such things. You have to talk with
ideas and wimps.
And so the
sudden disasters and instead of
the tweaking conditions just about
then, you should send out and send a
message to indicate that there's an
event, something that is also not
and not so easy to define
in the United States.
We would have minimal
minimum performance or performance
requirements.
Um, yeah.
Um, and then there are some challenges,
all of things.
When we talk about safety,
you want to know how the
system works
at the boundaries and the system
boundaries. So what happens when the
schedule is full then you can
send any more messages
or what happens or how
fast the communication range, which
influences the
idea and then environmental
of these cars. So what which influences
and which on these communication
technology and such things.
And even we have to think about
coexistence with sterling gates and
phones, for example.
Um, yeah.
Um, then
also I want to introduce
that, uh, the technical
university in Prague is actually working
on a patch for the Linux kernel to
support these bees, um,
mode of um.
I took a year and a two point
eleven.
Um yeah.
I hope it's not finished
yet, but I hope this becomes finished
in the beginning of next year.
You find this on this
address, then you are interested
in the implementation of these
Appalachia's and you can find, um,
at least one that's, uh, from on
GitHub.
Um, I think there's some more
implementation, but there's actually
something we also use.
Um, yeah.
What in the future.
Um.
For the future, you have to
know a little bit about
the other system systems
when you sing as an engineer
about the solar system
systems and then you have to have
an control loop then and with
sensors at the beginning,
with many sensors at the beginning,
since these data are not so easy to
interpret it. So we have like
a fusion to to generate
one world view for this
car.
Then you have an interpretation and
evaluation until
you get some plan to what
you want to do, what you want to do in
traffic. And then you need
a controlling unit which controls all
you actuating things, which
affects the reward.
And then you can again measure
the new things you see.
Um, the standard
normally we have, uh,
um, we could we could
communications and sensor, um,
things. You can provide a lot of
information to these
driver assistance systems.
Um, but things,
um, you send out also
information. It's a kind of
actuating element.
So you tweak a communications,
not only a sensor.
Um.
Yeah, and this
is something this
divide said is something we will do a lot
in the future, but come
back to the left side
first.
Um, actually we sent
out with these events based communication
a lot of status information from
one vehicle, but we also
had some information about
other vehicles.
So when you see this, your
radar officer sends you a car,
for example, this car behind this
building. Then you can send out
these measurements, this
distance to this car, all
of us from the red cars
and then maybe the blue car.
We have some advantages to
know about this car on the right side.
Um.
Yeah, it does, actually.
And the second
idea is that, um,
we can, um, exchange
the plan to actuary's, of
course. So then use
precast this year.
Your plan
for seven seconds, five seconds
to 10 seconds maybe,
and you send it out to improve
the um.
Yeah.
Your your assumptions about how
the environment will evolve
and in the next seconds.
And this is really a nice information
for planning some maneuvers, um,
on the street.
Um, and maybe in
the end we all will be
able to cooperate
with these things to
plan maneuvers with
different cars together to
cooperate. So that's the ideas we
have in the future. But we are actually
in the concept phase of this phase of
this.
So, yeah, um, for
me, I'm ready.
Uh, finished now.
So do you have any questions?
The first two questions go to the
Internet.
Yes, thank you.
Um, instead of sending signal
events, why not broadcasting the
standardized set of sensor data
so every car can calculate what is
relevant to them?
This would maybe be more future
proof in terms of autonomous
driving.
Um, yeah, that's that's totally
right. This modest awareness based
communication which I've talked about.
Yeah. That's something we want to do,
actually. But we will not send out
the normal sensor data.
We will more send our distances
between cars and something like this.
But yeah, this is planned actually.
So next question from the Internet.
Yes, thank you. How much would a system
be affected when the Route C, a
private Kiev Urrutia is exposed like
we have seen from Sony,
Lenovo, etc.?
Yeah, that's this is a problem,
actually, which would have to cover.
But you saw already that we have
this cross certification.
And when you exploit this, maybe
you can solve this problem,
then you assume
that your costs that
you assign is
different. You say as one
long term certificate, then
it's not so important then want
you to not trust you cannot
trust one anymore.
Then you switch to the second tier.
So that's maybe that's a
solution to it.
OK, next question over here.
OK, uh, I'd like to thank you for your
work. Um,
I have seen that you are monitoring
also other activities in this area.
Um, do your, uh, first I
want to make you aware that there is,
um, one activity by Intel,
BMW and some British
university I can't remember,
uh, which is doing something
comparable, but competing.
Um, which is.
Yeah. OK.
I don't want to go into too much detail
what to make of this
three and the second.
Um, do you uh what
about the availability.
I know the Volkswagen is
strongly behind the car to car
concept, but I know that other
car makers, uh.
Going more to a server based
communication so that cars
are not really communicating to each
other, but wire service in
a while back and servers and
I know some other
things behind that.
Yeah, this is why
you have different possibilities
to solve this problem.
So in the end, you
will have some kind of vehicle
to vehicle communication.
But it's not so clear in
the end how you will solve this
problem. So you can use
wi fi like this or
you can use backend
communication.
The problem is backhands actually is
that you need coverage
with you. Um,
yeah. You need your coverage with your
mobile devices.
So if you are in a tunnel or
something, you don't have any more
vehicle to vehicle communication.
That's by far better solution has
coverage in this case
and you have maybe some trouble
with the latencies.
This will become less and less a problem
since the technology will become better.
But yeah, there are some
other issues with
backend based communication.
OK, next question over that,
I got a I got a question regarding
the concept, when I buy a car,
I receive a unit that is able to
send out messages that are
cryptographically signed or
whatever. How do I how do I keep
people from just using that to perform
denial of service attacks on the
autobahn?
It's not possible.
You can't deny services A, you
can't prevent songs,
but it's always the same.
So when you want to
make a detailed attack on this
technology, you can simply by
disturbing the frequencies we are using,
you can prevent it.
The trick is to
detect these.
So we need some
measures to detect these
attacks and then we
have to stop
the car or something like this.
We have to we need some backup
solutions for how to with
the car.
OK, thank you.
OK, next question over that.
Thanks for the talk.
Was really interesting overview.
I guess I have a question about
the pseudonymous certificates.
So I understand that this takes
away the, um,
the immediate danger or tries to
take away the immediate danger of
exposing your, uh,
location profile to
the cars or the
location history to the cars in your
immediate vicinity.
Uh, but you can still
build a complete, uh, location
history for, uh,
some car by just collecting all
the data because the Rusia clearly knows
what the, uh, what
what pseudonymous certificate belongs to
which car.
So, uh, or is there
something like blind signatures in place?
Um, and there's another problem
I think.
Um, so how do
you handle certificates, pseudonymous
certificates which because
you if you're going somewhere
and you keep receiving messages from
Certificate one and at one point
you just start receiving messages from
certificate to, uh,
you know, that certificate one is
now a certificate to um.
Yeah.
The second one is some problem for
the applications or for the driver's
license, um, systems.
Um, yeah.
This is you can overcome this because
you know that we can
jump.
So when I mean you
can clearly tell that that
is the same vehicle. So you lose the
privacy protection of that
pseudonymous certificates that
or am I wrong.
Yeah. You cannot use any more
identifiable
by the certificate.
That's right. But this
car is not jumping around.
So did cars driving a straight line.
And then you see that death
and um, certain, uh,
certain you miss vanished and there's a
new at the same point and
going the same line now
from the physics. Oh that should be the
same cop.
That's exactly what I'm what I'm trying
to say. So. So why even do
pseudonymous certificates if you can
still completely track that one.
Yeah.
That's, that's the other question.
Yeah. That's the first question I was
referring to the second question
actually. And the first question.
Yeah. That's the problem now
is yes, it's possible, um
but not you would see as knowing about
this because the only signs, these
certificates of DHEA and
sodium seei um
but um
the problem is this, is that
also technology is also
possible to use for the same reason.
So you have an idea on your license
plate driving around
all the time. So when you use a camera
it's much easier to do the same
thing. Yep. But I can change the license
plate.
Well even then you change
the license.
Yeah. Yeah.
But now it's kind of time to remind
everyone that the question is a short
sentence and then get a question mark.
And the
next question of that is um yeah.
At first, thank you for your talk.
And my question is who is
running the rootsier is it
the country or is it a company
running this or is it, um, an
independent, um, authority like
the car to car communication consortium?
It depends.
Uh, it's it's it's
a political decision in the
end, I think for
infrastructure in Germany, for example,
it's run by the government,
some institute of the government.
Of course, I think they wanted
to have a political decision.
But anyone.
And in the end, and you have to cosign
all this would.
That's the political decision.
I can't.
Say much about this, actually.
OK, we will see.
Yes, OK.
Next, two questions for the Internet.
No questions anymore.
OK, fine over that.
If you sign locally
in the car, the signature
key materials start on the car or
generate it on the car.
If you think about car
use times or that car's in
the field for 10 or 12 or 15
years, how do you guarantee that
the security of those security
chips is not compromised?
Yeah, that's hard.
But we will exchange
these certificates and these
ships at the service,
at the car dealer.
What's happened when these
algorithms are not safe anymore
is that we should exchange
this to car dealers at
the service.
Um, yeah.
Yes.
Yes, a follow up question to that,
I'm sorry if I'm an attacker, I will not
go to the service point, but just buy a
car and then five or 10 years
later,
use that car to send fake messages.
That would be my Mietek.
Yeah. Then
we we we actually
work on security measurements
inside the car, so it's not
so easy to exchange any
parts and
introduce any data on
you can in the end.
Actually it is possible at the moment,
but there will be some measurements
against these attacks.
OK, next question of the.
OK.
How do you I understand you're using
some kind of private key public key
encryption or disintegration,
so you said also you generate
20
certificates per week.
How do you transfer those public
keys to all the cards from the millions
on the car on the street?
Oh, OK.
I forget to mention that the
security had us at
the end.
Um, so it's a little
bit.
I think so the security,
you provide these certificates with
every message in the worst case,
so normally you have some measurement
to educed it, but when you
send out this message, you also add
this certificate at the end of the
message.
OK, so I have signed my own
stuff at.
This is the first certificate, um.
So he and.
Yeah, this one, yeah, yeah,
yeah, um oh.
So you don't sign your your
sodium certificates, you get these sodium
certificates from the sodium certificate
of quality.
But if I send out my messages and I
send out the public key
as is, I send out my
message and send out the public as well
so I can send anything.
Why you have to private keys in your car.
You can sign this message.
As you sign, this message was a private
key, it's a signature.
It's another privately, but the public,
he must be known to the receiver.
Yeah, you at this
publicly at the end of
your message.
And this is all this public.
He is signed by the person room
certificate.
And, you know, you need to know
who was Shane, of course.
And you can also send out
is you at the end.
You need to know about the Hoosier
certificate and your car.
There's something we have to put in the
car at the beginning
and maybe to add later.
But then you notice you can,
um, poof, authorities who
say, OK, next
question over that.
So when an attacker comes in a situation
to be able to sign messages with fake
data, is it possible to
deduce other cars by sending out
messages that trigger emergency breaks,
for example, in other cars?
And can this trigger
more accidents in the end?
So for cars that are not involved in a
system.
Yeah, you when you
have the possibility, of course,
you can send out these messages and
trigger some events you
don't want to have, but
then you have some some additional
sensor. So we don't rely only
on you to vehicle communication.
We also use all these other sensors
and you get an the problem that you
have, you invalidate some logic
in the car so you can detect
such things and then you
simply don't listen to these messages
anymore.
I'm sorry the when
I simulate the car all so if I just
take the hardware that sends the messages
and put it on you that
I totally control, then the messages
can be distinguished between real and
fake messages.
Yeah, you will
have to.
Yeah. When I have a
driver's license system,
you don't rely only on
vehicle communication.
That's you will not do.
It's the same this Arada.
You don't only rely on these
morada so you use a lot of sensors
and you have a sensor set and then you
send the sad test some logical
things, which is not logical.
Then you can detect it and
then stop the car or something like this.
You disable these
features and inform the
driver. This is the only solution to it
that you can detect.
Next question over here.
Can you say what is the average
length of care and then
messages and what
format and, uh,
what length has the certificate?
So will you use the
wave format from the U.S.
or an own developed
ETSI format that
we have to the only developed
format, the
length is that's
a hard question. Things we can
leave out some parts of the messages
depending on the sending
frequency and such things.
So we have around about
270 in the mean
and 270 and the mean.
We cannot buy them,
but um, for chem or
chem, for denim, it's a little bit
larger, but it's really hot.
It depends on your use case
and the ratio between,
uh, plaintext and and
security information.
So certificate signatures,
a 50 percent, 50 percent
security is really large at this point.
So that's the reason why we use, uh,
ellipticals. It's, uh, some small
certificate.
Next question of that.
Yeah, thank you.
One question is, is
it planned that the certificates
can be revoked and if so,
how does the information
get into the cars?
Sorry, can you repeat the second?
How do the revocation information
get into the cars?
Will there be some kind of
cereal's or osseous services
or whatever?
Revocation is not
defined yet?
Because you have to as
the thing is, you don't need to bring
the revocation in your car at
this public
infrastructure because you have
to live one week
with the problem things.
Then you need new certificates for
the new certificate.
So you only need your vacation
at the moment.
So New says the problem is
that when you never
know
which certificates
are used, things you have no identifier.
Um, you have to detect.
That's the more the problem, actually.
But as far as I see,
the typical.
Application of car to
car communication is just
cases when your sensors
actually can't help anything
because you don't see the car
in front of the vehicle
that is just breaking.
Um, yeah,
that we try to change the services
of one of these future suspects, so
when you have a car in
front of you, which you see much
action and you can have some
these measurements of other cars, too,
and you can validate it.
So that leads to a situation
when I have to
take all these cars around you to
make this make a logical
data validation
so that the validation of the data
somehow.
Yeah, that happens.
Right. So that's one thing we
like to do about this.
And um, yeah, it's
but it's still a problem.
So it's the reason.
Um.
But we assume
that you use
this data for planning
and you can use the state
of it yet,
um, how to the emergency
brake light is maybe really a problem
at this point.
But we try to
advance assistance and we try to
use this data for planning.
And then when you see the plan,
it's not working out.
Do you have to need you need a big
fallback somehow?
It's always about politics.
OK, thank you. At least one more question
over there.
Have you thought about the following
problem? I mean, do you have a lot of
cars in the world?
And do you have every car has a
lot of these platinum certificates,
so it shouldn't. And as an attacker who
wants to spoof messages,
you just need one valid Satnam
certificate to do a lot
of harm.
Shouldn't it be relatively easy to, I
don't know, spend some money on a cluster
and produce a lot of
private keys since there
are so many problems, certificates for so
many cars shouldn't be maybe
relatively easy to to get just one
valid certificate to do some
harm.
Um, you haven't
yeah, you haven't validated as
yet, you haven't time valid
a time of selection of
these solemn certificates.
So when you have this, you have it
for one week.
At the end and
yeah, you have to live
with this problem, but you have it's not
worldwide we have in Europe or in the
US, but yeah, it's part
of it.
So the the, um, the
lifetime cut, the short, um,
if the person of that can compress
the question in less than 20 seconds, we
may be able to do that as a last
question. Yeah.
OK, thanks.
Um, I just want to ask, uh, we see
every year breaking security,
uh, tips on this conference.
So how are you securing
your model with now?
And the standard defining act is a,
uh, two hundred fifty six and saying
we have hardware acceleration for this,
uh, with, uh, seeing that keycards,
even a long term product.
Um, yeah.
When this happens, you have to find a
solution and you have to exchange
when we change this behavior all the
time.
So thank you all very much.
We're out of time.
Um.