P2 DAP-Sybil Attacks Detection in

Vehicular Ad hoc Networks. .

OUTLINE

INTRODUCTION.EXITING SYSTEM.PROBLEM STATEMNET.PROPOSED WORK.REFERENCE.

INTRODUCTION

What is ad hoc network ? Adhoc network refer to a network connection established for

single session.What is VANET ? The vehicular ad hoc network (VANET) is a special

communication pattern to provide communication information within the roadside box-to-vehicle and inter-vehicle with the aid of wireless network .

VANET are begin increasingly supported for traffic control, accident avoidance and management of parking lots and public area.

Architecture of VANET

RSB

Overheard traffic information

V2R V2

V1 V2V

V3

Overheard traffic info or DMV

Assumption on VANET Architecture1.DMV is a trusted party that maintains vehicles records and

distributes certified pseudonyms to vehicles.DMV has enough resources to generate pseudonyms (certified public key )quickly and store all vehicles related information.

2.Vehicles are untrusted party. they communicate with each other in a multihop manner. A message exchange among vehicles is singed with a DMV certified pseudonyms.

3.RSB are wireless access point .they are scattered along the road and connected to DMV via a backhaul network, acting as intermediate to the DMV.

the RSB monitor vehicular activity, identify suspicious behavior and report to DMV for confirmation and punishment

There are two type of communication in VANET.1.Vehicular to Vehicular Communication(V2V). Vehicles communicates with each other through wireless

medium. 11.Vehicular to Road Side Box(V2R) It is the direct wireless exchange of relevant information

between vehicles and the communication units placed on the side of roads i.e. road side box.

Application of VANET1. Traffic Information2. Road Condition and weather Info.3. Increase Traveler Safety.4. Electronic Toll Collection5. Accident avoidance in road.

Sybil Attack

What is Sybil Attack ? If vehicle use multiple pseudonyms to sign an event such that other

thing multiple vehicle report same event the action consider as Sybil Attack

A Sybil attack is a type of attack in which a malicious node illegally create duplicate multiple vehicle identities.

Fig. Node Participate in Sybil Attack

Node in Sybil Attack

Sybil NodeMalicious Node or

Sybil Attacker

Malicious node/Sybil Attacker:- The node which copy the identities of other nodes.Sybil node:- Additional identities created by the malicious node are known

as Sybil nodes

Exiting System

P2 DAP Scheme are used for handling Sybil attack. The main purpose is to detect Sybil attacks and revoke malicious vehicles immediately after detection.

this scheme is distributed in three stage 1.Complete Two-Stage P2DAP Scheme 2.E-P2DAP – Detecting Events Instead of Sybil Attack. 3.T-P2DAP – Detecting Collusion

Complete Two-Stage P2DAP Scheme

The DMV knows the total number of vehicles, and sequentially generates a sufficient number of yearly pseudonyms for all the vehicles.

After generating a pseudonym p, the DMV first hashes (p | κc) using a one-way hash function, where κc is a global key.

It then selects a set of bits from the hashed result to create hash collisions. The selected bits are referred as “coarse-grained hash value”.

After that, the pseudonym p is placed into a group, which stores the pseudonyms with the same coarse-grained hash values.

In other words, for each pseudonym pl in the m-th coarse-grained group, we have H(pl|κc) = Γm, where H is a one-way hash function, and Γm is the coarse-grained hash value for group m

We refer such groups as “coarse-grained groups”. The key κc will be distributed to all the RSBs.

DMV calculates the hash value for the above p with a new key κf , and selects a set of bits from the result.

The bits selected from the new hash value are referred as the “fine-grained hash value”. The pseudonym p is then placed into a subgroup of the coarse-

grained group, namely fine grained group, in which all the pseudonyms have the same fine-grained hash value.

For each pseudonym pl in the n-th fine-grained group under the m-th coarse-grained group, we have H(pl |κf) = Θn, where Θn is the fine-grained hash value for the subgroup n.

H(p|κc) = H(p|κc), H(p|κf) = H(p|κf ), In Simplest Coarse Gained Hash Value is Calculated at RSB Site DMV Calculates Fine Gained Hash Value because DMV do not

give Secret Key to RSB

E-P2DAP – Detecting Events Instead of Sybil Attack. In the C-P2DAP scheme, an RSB reports to the DMV whenever it finds

any set of pseudonyms that hash to the same coarse-grained values. when an event is reported by a large number of vehicles, C-P2DAP can

cause false alarms. Assumptions (1). Each false (faked) event is generated by only one malicious

vehicle. (2). Benign vehicles will not report false events. For an event (ti, lj, ek), the RSB collects a list of pseudonyms Li,j,k

used to sign the event. If p, p Li,j,k, H(p|κc) = H(p|κc), i.e., all the ∀ ∈pseudonyms used to sign (ti, lj, ek) have the same coarse-grained hash value, then the event is probably sent from only one vehicle, and is likely a faked event. In this case, the RSB generates a report with the

same format as in C-P2DAP and sends it to the DMV.

DMV only needs to examine the pseudonyms in two cases: 1) an attacker reports a false event and carries out a Sybil attack; 2) a true event is reported by multiple benign vehicles whose

pseudonyms have the same coarse-grained hash value, which is a false alarm

The number of false alarms is likely to be small comparedto the total number of the pseudonyms that RSBs process. That Reduces the overhead of DMV.

T-P2DAP – Detecting Collusion One issue with the E-P2DAP scheme is that it cannot detect

colluding vehicles, i.e., two or more malicious vehicles reporting the same faked event.

Faked event is generated by minimum two vehicles but vehicle number will not be exceed the threshold τ.

for a pseudonym list Li,j,m, the RSB calculates the coarse-grained hash value for each pseudonym p Li,j,k, and ∈ obtains a set of coarse-grained hash values Sc. If |Sc| ≤ τ and two or more pseudonyms in Li,j,k map to the same coarsegrained hash value, the RSB suspects the event to be fake and reports to the DMV.

Drawback of Existing System. By this Three Scheme we Only detect the sybil attack but can not

revoke it. By this scheme overhead of traffic increases because malicious

vehicle try to get the pseudonyms from DMV so overhead increases.

Proposed Work1. Network Generation and Vehicle

Registration with public authentication Key.

2.Detection of Sybil Attack. 2.1 Encryption of Message 2.2 Key Exchange 2.3 Decryption3. Revoking The Sybil Attack

Block Diagram

Network Generation and Vehicle Registration with public authentication Key Create Region Create DMV OR RSB. Create Node or Vehicle With Parameter IP Address, ID, UID, Max

and min wait time, Max and Min Speed. DMV Can Register the Vehicle with Public Authentication Key

before vehicle can transmit the message.

Detection Of Sybil Attack Encryption of Message In this Phase Source Node can Encrypt the with Public Key

Cryptography. In phase1, each vehicle should be registered in a group and receive

its public authentication key (AK) before any message transmission. For signing a message, the vehicle uses group authentication key and encryption function and sends it along with original message to other vehicle and RSU

Key Exchange Algorithm RSU don’t have Private Key of Regional DMV so it sends request

to Regional DMV for OBUid decryption. Regional DMV don’t have private key of Vehicle so it sends

request to Home DMV for getting Private key of Vehicle. Home DMV reply private key to Regional DMV.

Alice and Bob agree to use a modulus p = 23 and base g = 5 (which is a primitive root modulo 23).

Alice chooses a secret integer a = 6, then sends Bob A = ga mod p◦ A = 56 mod 23 = 8

Bob chooses a secret integer b = 15, then sends Alice B = gb mod p◦ B = 515 mod 23 = 19

Alice computes s = Ba mod p◦ s = 196 mod 23 = 2

Bob computes s = Ab mod p◦ s = 815 mod 23 = 2

Alice and Bob now share a secret (the number 2).

Algorithm used for Sybil attack detection

1- EH(PUAK(M)) from source node S 2- EH(SKA(IDA| HAK(M))) from source node S 3- E(PUCA(IDA, HSKA(IDA| HAK(M)))) from node S 4- SEND(RQST(M,HAK(M),CAh,OBUId) from source node S to

local RSU other vehicle in local region) 5- EH(PUAK(M)) in RSU and IF(HAK(M)==HAK(M)) THEN go

to step 7 else go to step 6 6- REPORT to CAl “the message is fault” 7- D(SKCl(IDA, HSKA(IdA| HAK(M))) in CAl 8- REQST(PUA) to CAh 9- RPLY(PUA) to CAl 10- EH(SKA(IDA|HAK(M))) and IF(HSKA(IDA|

HAK(M))==HSKA(IDA|HAK(M))) THEN Sybil attack detect.

Revoking the Sybil Attack When any Home DMV Detects the sybil Attack it then Sends the

request to regional DMV for revoking the node or Vehicle. So Regional DMV now Block or remove the node from region. So now Node Ultimately removes from root as well as Network.