KR101917777B1 - Vulnerability detection system and method for judging fraud in v2x communication environment - Google Patents

Abstract

Discloses a system and a determination method of a cheating behavior in a V2X (Vehicle to everything) communication environment. A malicious activity determination system according to an embodiment of the present invention includes a terminal for generating a fraud report message in a V2X (Vehicle to everything) communication environment; And a V2X (Vehicle to everything) communication environment, validity judgment for judging the validity of the message through the location information and the fraud reporting message generation time information included in the fraud report message generated at the terminal server; .

Description

[0001] VULNERABILITY DETECTION SYSTEM AND METHOD FOR JUDGING FRAUD IN V2X COMMUNICATION ENVIRONMENT [0002]

The present invention relates to a malicious activity determination system and a malicious activity determination method in a V2X communication environment, and more particularly, to a malicious activity determination system and a malicious activity determination method in a V2X communication environment using a location information of a reporter terminal generating a fraud report message, And a system and method for judging illegal activities.

Unless otherwise indicated herein, the contents set forth in this section are not prior art to the claims of this application and are not to be construed as prior art to be included in this section.

V2X (Vehicle to everything) is a technology that provides information through wired / wireless networks centering on vehicles. It is used for wireless communication (V2V: Vehicle to Vehicle) between vehicle and vehicle, Vehicle to Infrastructure (V2I) In-Vehicle Networking (IVN), and Vehicle to Pedestrian (V2P). Herein, X of V2X means everything, that is, Infra / Vehicle / Nomadic / etc. It refers to all types of communication methods applicable to a vehicle. In general terms, 'Connected Vehicle' or 'Networked Vehicle' Which means a specific communication technology.

Currently, vehicles capable of applying V2X technology, which is a communication technology between a vehicle and a vehicle or a mobile communication device, are increasing. Communication technology for V2X is actively being studied in the USA and Europe as well as domestic.

Meanwhile, in WAVE (IEEE) 1609.2 standard and SCMS (Serial Copy Management System) document, a certificate communication standard for security is defined. In a typical V2X communication environment, it is possible to increase the reliability of a communication message by using signature verification of a certificate for security. And the process of issuing and revoking certificates to and from mobile devices that communicate with vehicles and vehicles is defined in the SCMS document.

However, WAVE (IEEE) 1609.2 and SCMS have no definition of validity judgment process of fraud reporting. If WAVE (IEEE) 1609.2 and SCMS process all fraud reports without validity judgment process, all data processing until invalid fraud report must be performed. This increases the frequency of occurrence of communication errors, and may cause inconvenience to the use of the V2X network such as a communication delay.

1. Korean Patent Registration No. 10-1584001 (2016.01.04) 2. Korean Patent Publication No. 10-2017-0093693 (2017.08.16)

(IEEE) 1609.2 through a fraud detection system and an irregularity detection method in a V2X communication environment according to an exemplary embodiment of the present invention, and a process of determining the validity of a message format and an irregularity report message for a fraud report not defined in the SCMS define.

In the V2X communication environment, the validity determination procedure for the fraud report message is defined and a follow-up procedure of the fraud report message is provided.

Also, in case of an illegal actor such as a hacker in the V2X environment, a malformed report message format for reporting fraudulent activity in the vehicle is provided.

Further, the present invention is not limited to the technical problems as described above, and another technical problem can be derived from the following description.

A malicious activity determination system in a V2X (Vehicle to everything) communication environment according to an embodiment of the present invention includes: a terminal for generating a fraud report message in a V2X (Vehicle to everything) communication environment; And a V2X (Vehicle to everything) communication environment, validity judgment for judging the validity of the message through the location information and the fraud reporting message generation time information included in the fraud report message generated at the terminal server; .

A method of determining an illegal behavior of a malicious activity determination system in a V2X (Vehicle to everything) communication environment according to another embodiment includes the steps of: (A) accepting a malicious activity report message from a malicious activity report terminal in a validity determination server; (B) extracting location information and message generation time information of the reporting terminal that generated the fraud report message at the validity determination server; And (C) determining validity of the fraud report message by comparing positional information of the fraud report message extracted from the validity judgment server with time information and time information, and positional information with which the fraudulent activity occurs; .

(IEEE) 1609.2 through a fraud detection system and an irregularity detection method in a V2X communication environment according to an exemplary embodiment of the present invention, and a process of determining the validity of a message format and an irregularity report message for a fraud report not defined in the SCMS By defining, it improves the reliability of communication in V2X environment by blocking the cheating of cheaters such as hackers.

It should be understood that the effects of the present invention are not limited to the above effects and include all effects that can be deduced from the detailed description of the present invention or the configuration of the invention described in the claims.

Brief Description of the Drawings Fig. 1 is a diagram showing a configuration of a cheating behavior determination system in a V2X (Vehicle to everything) communication environment according to an embodiment
2 is a diagram showing a data processing configuration of the validity determination server 100 according to the embodiment
3 is a flowchart illustrating a data processing procedure of a malicious activity determination method of a malicious activity determination system in a V2X (Vehicle to everything) communication environment according to an embodiment of the present invention;

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention and the manner of achieving them will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like numbers refer to like elements throughout.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

1 is a diagram illustrating a configuration of a malicious activity determination system in a V2X (Vehicle to everything) communication environment according to an embodiment.

Referring to FIG. 1, the malicious activity determination system according to an embodiment of the present invention may include a terminal 200 or 300 and a validity determination server 100 that generate a fraud report message in a V2X (Vehicle to everything) communication environment.

The terminals 200 and 300 may include a vehicle equipped with a communication module and a smart terminal of a user as a digital device that is a main body of data transmission / reception in a V2X communication environment. When the terminal 200 or 300 detects an irregularity in the communication process, the terminal 200 or 300 generates an irregularity report message and transmits the generated irregularity report message to the validity determination server 100.

The validity judgment server 100 may be configured to determine whether the cheating action is received from the terminal 20, 300 or the communication data management server (not shown) in a V2X (Vehicle to everything) communication environment, The validity of the fraud report message is determined through the fraud report message generation time information.

The terminals 200 and 300 may be a tablet PC, a laptop, a personal computer (PC), a smart phone, a personal digital assistant (PDA) A mobile communication terminal, or the like. That is, the terminals 200 and 300 refer to terminals having a memory for storing a specific application for connecting to the validity determination server 200 in a V2X network environment, and a microprocessor for executing and controlling programs and the like.

2 is a diagram illustrating a data processing configuration of the validity determination server 100 according to the embodiment.

Referring to FIG. 2, the validity determination server 100 may include an information extraction module 110, an information comparison module 130, and a determination module 150. The term " module ", as used herein, should be interpreted to include software, hardware, or a combination thereof, depending on the context in which the term is used. For example, the software may be machine language, firmware, embedded code, and application software. As another example, the hardware may be a circuit, a processor, a computer, an integrated circuit, an integrated circuit core, a sensor, a micro-electro-mechanical system (MEMS), a passive device, or a combination thereof.

The information extraction module 110 extracts the location of the fraud reporting agent and the message generation time information in the fraud report message when the fraud report is received in the V2X communication environment. Further, the position and time information in which the cheating has occurred are extracted.

       The information comparison module 130 compares the location information where the cheating behavior report message extracted from the information extraction module 110 is generated and the location information where the cheating behavior occurred and generates the time information in which the cheating behavior report message is generated and the cheating behavior And compares the obtained time information.

      The determination module 150 determines the validity of the fraud report message according to the difference between the position information and the time information compared by the information comparison module 130. [ For example, the determination module compares the location information of the reporter terminal included in the fraud report message with the location information of the fraud area, and determines that the fraud report message within a certain distance is valid.

In addition, the determination module 150 determines that the report message generated within the predetermined period of time at the generation time of the message included in the fraud report message is valid.

The validity determination server 100 according to the embodiment extracts the location and time information included in the fraud message and the fraud report message and determines the validity of the fraud report message. The validity judgment server 100 may determine that the device information of the fraudulent agent, the Basic Safety Message (BSM) transmitted from the fraudulent agent, the Basic Safety Message (BSM) of the fraudulent agent, A sensor information, a GPS information of the cheating behavior reporter, and a cheating behavior report generation time information.

The following script 1 is an example of the format of a fraud report message defined in the conventional SCMS.

Script 1

MisbehaviorReportContents :: = SEQUENCE {

version Uint8 (1),

misbehavingDeviceInfo Opaque, - placeholder

misbehavingDeviceBSMs OCTET STRING OPTIONAL, - non-OER encoded ASN.1 messages

reporterDeviceBSMs OCTET STRING OPTIONAL, - non-OER encoded ASN.1 messages

sensorInfo Opaque OPTIONAL, - placeholder: non-V2V related sensor information,

if available}

* / version: Version of the cheating report message (currently defined version is 1)

misbehavingDeviceInfo: Device information of the cheater (Currently Not Used)

misbehavingDeviceBSMs: BSM (Basic Safety Message) transmitted from cheater

reporterDeviceBSMs: BSM (Basic Safety Message)

sensorInfo: Detected sensor information (Currently Not Used) *

The irregularity report message format used in the irregularity determination system according to the embodiment further includes location information of the irregular actor, location information of the irregular actor, and irregularity report generation time information in the conventional irregularity report message format. The format of the fraud report message according to the embodiment is shown in the script 2.

Script 2

MisbehaviorReportContents :: = SEQUENCE {

version Uint8 (1),

misbehavingDeviceInfo Opaque, - placeholder

misbehavingDeviceBSMs OCTET STRING OPTIONAL, - non-OER encoded ASN.1 messages

reporterDeviceBSMs OCTET STRING OPTIONAL, - non-OER encoded ASN.1 messages

sensorInfo Opaque OPTIONAL, - placeholder: non-V2V related sensor information,

if available

misbehavingGPS OCTET STRING

repoterGPS OCTET STRING

createTime OCTET STRING}

* / misbehavingGPS: cheater's GPS information

repoterGPS: GPS information of complainant

createTime: create fraud report time information *

The judgment module 150 judges whether the misrepresentation has occurred through the misbehavingGPS, repoterGPS, createTime, the location information of the fraudulent agent, the location information of the fraudulent agent, and the fraudulent reporting generation time information described in the fraud reporting message line 11 to line 13 according to the embodiment The validity of the behavior report message can be determined. In the embodiment, if the difference between the position where the fraud report is generated and the location where the fraud is generated is greater than or equal to a predetermined value, the judging module 150 determines that the fraud report message is a message generated by the malicious agent. Also, if the difference between the time at which the fraud reporting message is generated and the time at which the fraud is generated is greater than a predetermined value, the fraud reporting message can be determined to be a message generated by a malicious agent.

In the format of the fraud report message such as the script 2, the location information is the location information of the reporter (reporter) reporting the fraud, and the location information of the fraud area. The judging module 150 for the reported misconduct acts as a verifier. For example, when the two positional information (position information of the reporter and position information of the irregularity occurrence area) included in the irregularity report message are compared with each other and the distance of the irregularity report message is generated, If it is within the time, the fraud reporting message is judged to be a valid fraud report.

If it is assumed that the position information of the caller can not be arbitrarily changed if the position information of the cheating action (location of the terminal generating the cheating report message and location of the cheating action occurrence) exceeds a certain distance in the cheating action report message The fraud report message is the basis for judging by the message created by the malicious agent.

In addition, in the embodiment, when the difference between the time of generating the fraud report message and the time when the fraud is generated is equal to or greater than a certain level, it can be determined that the malicious agent collects an arbitrary message and performs a retransmission attack. In addition, if the difference between the generation time of the fraud report message and the time of occurrence of fraud exceeding a predetermined time, it is determined that the remaining messages excluding the fraud report messages exceeding a predetermined time are valid.

FIG. 3 is a diagram illustrating a data processing process of a malicious activity determination method of a malicious activity determination system in a V2X (Vehicle to everything) communication environment according to an embodiment.

In step S10, the validity determination server 100 receives the report of the fraudulent behavior from the terminal including the vehicle of the V2X network.

In step S20, the validity determination server 10 receives the fraud report, and extracts the fraud report message generation location and time information from the fraud report.

In step S30, the validity determination server 100 extracts the time and location of the fraud action occurrence time information.

In step S40, the validity determination server 100 determines whether the place of generating the fraud report message and the location of the fraud action are within a certain range. If it is within the predetermined range, the process proceeds to step S50, and if it exceeds the predetermined range, the fraud report message is discarded in step S60.

 In step S50, the validity determination server 100 determines whether a fraud reporting message generation time and a fraud behavior occurrence time are within a predetermined range. If it is within a certain range, the process proceeds to step S70, and if it exceeds the predetermined range, the fraud report message is discarded in step S60.

In step S70, the registration of the fraud report message for which the validity determination is completed is completed using the generation time of the fraud report message and the location information of the terminal where the fraud message is generated.

(IEEE) 1609.2 through the fraud detection system and the irregularity detection method in the V2X communication environment according to the embodiment of the present invention and the process of determining the validity of the message format and the fraud report message for the fraud report not defined in the SCMS By defining this, cheating of cheaters such as hackers is blocked, and communication reliability of V2X environment is improved.

It is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. It is not limited to the embodiment.

100: Validation server
110: information extraction module
130: Information comparison module
150: Judgment module

Claims (11)

1. A malicious behavior determination system in a V2X (Vehicle to everything) communication environment,
A terminal for generating a fraud report message in a V2X (Vehicle to everything) communication environment; And
When a fraud report message is received in the V2X (Vehicle to everything) communication environment, the validity of the message is determined through the location information and the fraud reporting message generation time information included in the fraud report message generated at the terminal A validity determination server; Including the
The validity determination server
Extracting location and time information of the cheating behavior when the cheating behavior report message is received in the V2X communication environment and extracting information for extracting location information and cheating behavior report message generation time information of the terminal where the cheating behavior report message is generated module;
The information extracting module compares the location information of the terminal where the irregularity report message extracted is generated and the location information of the irregularity, and compares the time information in which the message is generated with the time information in which the irregularity occurred A comparison module; And
According to the difference between the position information and the time information compared by the information comparison module
When the location information of the terminal generating the irregularity report message is within a certain distance from the location information of the area where the irregularity occurs and the irregularity report message generation time is within a predetermined time from the irregularity occurrence time, A determination module that determines that the message is valid; Wherein the malicious activity determining system comprises:
delete delete delete The method of claim 1, wherein the fraud reporting message
(BSM) transmitted by a cheater, BSM (Basic Safety Message) of a cheater, GPS information of a cheater, sensor information detected by a cheater, GPS information of a cheater, and cheating And message generation time information.
2. The apparatus of claim 1,
If the difference between the location information of the terminal generating the fraud report message and the location information of the fraudulent activity is equal to or greater than a certain distance, the fraud report message is determined to be a message generated by the malicious agent,
Wherein the malicious activity report message is a message generated by a malicious agent when the difference between the malicious activity report message generation time and the malicious activity occurrence time is more than a predetermined value.

A method for determining an illegal behavior of a malicious activity determination system in a vehicle to everything (V2X) communication environment,
(A) receiving a fraud report message from a fraud reporting terminal in a validity determination server;
(B) extracting location information and message generation time information of the reporting terminal that generated the irregularity reporting message in the validity determination server; And
(C) determining validity of the irregularity report message by comparing positional information of the extracted irregularity report message with time information and time information of the irregularity, and comparing the time information with the time information; Lt; / RTI >
Comparing the position information of the extracted irregularity report message with the time information and the time information where the irregularity occurred and the time information in the validity judgment server (C), and judging the validity of the irregularity report message; The
Extracting location and time information of a cheating behavior when the cheating behavior report message is received in the V2X communication environment and extracting location information and cheating behavior report message generation time information of the terminal where the cheating behavior report message is generated;
Comparing the location information of the terminal where the cheating behavior report message extracted from the information extraction module is generated and the location information of the cheating action and comparing the time information in which the message was generated with the time information in which the cheating behavior occurred; And
The location information of the terminal that generated the irregularity report message is within a certain distance from the location information of the area where the irregularity occurred, according to the difference between the position information and the time information compared in the information comparison module, Determining that the fraud report message is valid if the fraud detection is within a predetermined time from the fraud occurrence time; And determining whether a malicious action is detected.
delete delete The method as claimed in claim 7, wherein the validity judgment server (C) judges the validity of the fraud report message by comparing the position information of the extracted fraud report message with the time information and the time information of the time information and the time information of the fraud step; The
According to the difference between the position information and the time information compared in the information comparison module, the location information of the terminal that generated the irregularity report message exceeds a certain distance from the location information of the area where the irregularity occurs, And discarding the fraud report message if the difference between the time of occurrence of the fraud and the time of occurrence of the fraud is a predetermined level or more.
8. The method according to claim 7,
(D) registering a fraud report message judged to be valid in the validity judgment server; Further comprising the steps of:

Images