Urban defense using mobile sensor platforms surveillance protection

Urban defense using mobile sensor platforms: surveillance, protection and privacy Homeland Security Workshop, Baia, Naples Sept 21, 2009 Mario Gerla Computer Science Dept, UCLA www. cs. ucla. edu/NRL

Outline • Vehicular Ad Hoc Networks (VANETs) – Opportunistic ad hoc networking • V 2 V applications – Content distribution – Urban surveillance - Mob. Eyes (UCLA) – Mob. Eyes vs roadside CCTV • Case study: tracking terrorist attack path • Security and Privacy in urban surveillance • UCLA CAMPUS Testbed

Traditional Mobile Ad Hoc Network • Instantly deployable, re-configurable (no fixed infrastructure) • Satisfy a “temporary” need • Mobile (eg, PDAs) – Low energy • Multi-hopping ( to overcome obstacles, etc. ) • Challenges: Ad hoc routing, multicast, TCP, etc Examples: military, civilian disaster recovery

Vehicular Ad Hoc Network (VANET) • No fixed infrastructure? – Several “infrastructures”: Wi. Fi, Cellular, Wi. MAX, Satellite. . • “Temporary” need? – For vehicles, well defined, permanent applications • Mobile? – YES!!! But not “energy starved” • Multi-hop routing? – Most of the applications require broadcast or “proximity” routing – Infrastructure offers short cuts to distant destinations – Multihop routing required only in limited situations (eg, Katrina scenario) • VANET => Opportunistic Ad Hoc Network – Access to Internet readily available, but. . – opportunistically “bypass it” with “ad hoc” if too costly or inadequate

The Enabling Standard: DSRC / IEEE 802. 11 p • Car-Car communications at 5. 9 Ghz • Derived from 802. 11 a • three types of channels: Vehicle-Vehicle service , a Vehicle-Roadside service and a control broadcast channel. • Ad hoc mode; and infrastructure mode • 802. 11 p: IEEE Task Group for Car-Car communications

V 2 V Applications • • • Safe Navigation Efficient Navigation/Commuting (ITS) Location Relevant Content Distr. Urban Sensing Advertising, Commerce, Games, etc

V 2 V for Safe navigation • Forward Collision Warning, • Intersection Collision Warning……. • Advisories to other vehicles about road perils – “Ice on bridge”, “Congestion ahead”, ….

Car to Car communications for Safe Driving Vehicle type: Cadillac XLR Curb weight: 3, 547 lbs Speed: 75 mph Acceleration: + 20 m/sec^2 Coefficient of friction: . 65 Driver Attention: Yes Etc. Vehicle type: Cadillac XLR Curb weight: 3, 547 lbs Speed: 65 mph Acceleration: - 5 m/sec^2 Coefficient of friction: . 65 Driver Attention: Yes Etc. Alert Status: None Alert Status: Inattentive Driver on Right Alert Status: Slowing vehicle ahead Alert Status: Passing vehicle on left Vehicle type: Cadillac XLR Curb weight: 3, 547 lbs Speed: 75 mph Acceleration: + 10 m/sec^2 Coefficient of friction: . 65 Driver Attention: Yes Etc. Alert Status: Passing Vehicle on left Vehicle type: Cadillac XLR Curb weight: 3, 547 lbs Speed: 45 mph Acceleration: - 20 m/sec^2 Coefficient of friction: . 65 Driver Attention: No Etc.

V 2 V for Efficient Navigation • GPS Based Navigators • Dash Express (just came to market in 2008): • Synergy between Navigator Server and Dept of Transp

Location relevant content delivery • Traffic information • Local attractions • Tourist information, etc Car. Torrent : cooperative download of location multimedia files

You are driving to Vegas You hear of this new show on the radio Video preview on the web (10 MB)

One option: Highway Infostation download Internet file

Incentive for opportunistic “ad hoc networking” Problems: Stopping at gas station for full download is a nuisance Downloading from GPRS/3 G too slow and quite expensive 3 G broadcast services (MBMS, Media. FLO) only for TV Observation: many other drivers are interested in download sharing Solution: Co-operative P 2 P Downloading via Car-Torrent (like Bit Torrent in the Internet)

Car. Torrent: Basic Idea Internet Download a piece Outside Range of Gateway Transferring Piece of File from Gateway

Co-operative Download: Car Torrent Internet Vehicle-Vehicle Communication Exchanging Pieces of File Later

Car Torrent inspired by Bit. Torrent: Internet P 2 P file downloading Uploader/downloader Tracker Uploader/downloader

Selection Strategy Critical

Simulation Results • Completion time density 200 nodes 40% popularity Time (seconds)

Vehicles as Mobile Sensor Platforms • Environment – Traffic density/congestion monitoring – Urban pollution monitoring – Pavement, visibility conditions • Civic and Homeland security – Forensic accident or crime site investigations – Terrorist alerts

Vehicular Sensor Network

Accident Scenario: storage and retrieval • • Public/Private Cars (eg, busses, taxicabs, police, commuters, etc): – Continuously collect images on the street (store data locally) – Process the data and detect an event – Classify the event as Meta-data (Type, Option, Loc, time, Vehicle ID) – Distribute Metadata to neighbors probabilistically (ie, “gossip”) Police retrieve data from public/private cars Meta-data : Img, -. (10, 10), V 10

Mobility-assisted Meta-data Diffusion/Harvesting HREP HREQ Agent harvests a set of missing meta-data from neighbors Periodical meta-data broadcasting + Broadcasting meta-data to neighbors + Listen/store received meta-data

How to store/retrieve the Metadata? Several options: • Upload to nearest Access Point (Dash Express; Cartel project, MIT) • “Flood” data to all vehicles (eg, bomb threat) • Publish/subscribe model: publish to a mobile server (eg, an “elected”vehicle) • Distributed Hash Tables (eg, Virtual Ring Routing - Sigcomm 06) • “Epidemic diffusion” -> our proposed approach

Mob. Eyes: Mobility-assisted Diffusion/Harvesting • Mobeyes exploit “mobility” to disseminate metadata! • Source periodically broadcasts meta-data to neighbors – Only source advertises meta-data to neighbors – Neighbors store advertisements in their local memory – Drop stale data • A mobile agent (the police) harvests meta-data from vehicles by actively querying them (with Bloom filter)

Simulation Experiment • Simulation Setup – – NS-2 simulator 802. 11: 11 Mbps, 250 m tx range Average speed: 5 to 25 m/s Mobility Models • Random waypoint (RWP) • Real-track model (RT) : – Group mobility model – merge and split at intersections • Westwood map

Meta-data harvesting delay with RWP Number of Harvested Summaries • Higher mobility decreases harvesting delay V=25 m/s V=5 m/s Time (seconds)

Harvesting Results with “Real Track” Number of Harvested Summaries • Restricted mobility results in larger delay V=25 m/s V=5 m/s Time (seconds)

Urban Surveillance via CCTV • In urban areas, the first line of defense has traditionally been fixed video cameras • Chicago, the leader in the US: – 2, 000 remote-control cameras and motion-sensing software planned to spot crimes or terrorist acts – 1, 000 already installed at O'Hare International Airport • A few links below: – 1. http: //www. usatoday. com/news/nation/2004 -09 -09 -chicagosurveillance_x. htm – 2. http: //www. securityinfowatch. com/online/The-Latest/Chicago-to-Increase. Presence-of-Surveillance-Cameras-on-Streets/9578 SIW 306 – 3. http: //blog. publiceye. silkblogs. com/City-of-Chicago. 1771. category

Emerging City Wide Surveillance Systems With 4 millions CCTV cameras around the country, Britain is to become the first country in the world where the movements of all vehicles on the roads are recorded. Jennifer Carlile, MSNBC CHICAGO — A surveillance system that uses 2, 000 remote-control cameras and motionsensing software to spot crimes or terrorist acts as they happen is being planned for the city. Debbie Howlett, USA TODAY

Urban Defense - Britain • More than 4 million CCTV cameras operating around the country: – – – Britain has more video surveillance than anywhere else in the world. 96 cameras at Heathrow airport, 1, 800 in train stations, 6, 000 on the London Underground, 260 around parliament, 230 used for license plate recognition in the city center, and the dozens surveying West End streets. • In London it's said that the average resident is viewed by 300 cameras a day. • References http: //www. msnbc. msn. com/id/5942513 http: //news. independent. co. uk/uk/transport/

CCTV Limitations • CCTV surveillance has benefits: – Data centrally collected via high speed wired infrastructure – High resolution video enables face recognition • However: – Cameras cannot be installed at all locations – Cameras can be taken out (avoided) by terrorists – Central data collection facility can be sabotaged • Mobile video collection/storage platforms: – Vehicles, People, Robots – Cannot be predicted, avoided, sabotaged • Mobile “eyes” are an excellent complement to CCTV

Terrorist Bomb Van Tracking • The American Embassy in Paris has been bombed by a suicide truck • Police wants to reconstruct the approach path to uncover possible “escort” vehicles - eg conspirators who guided the VAN until the last few minutes before the attack • Street Video cameras may not be dense enough they may also be “avoided” by motivated terrorists • Proposed solution: forensic investigation of civilian vehicles (unconscious witnesses)

Simulated Urban Scenario – Each car reads a license plate every 2 s; it generates a 60 record summary every 120 s. • Each car continually transmits (every few seconds) own last summary (no forwarding of summaries received by other cars) • Average car speed: 5 to 25 m/s • Mobility Model: Random waypoint (RWP) – Westwood map – Data Harvesting: 100 cars are “interrogated” by single agent immediately after the attack

Attack Scenario map (Westwood) Embassy

Uncovered time gap per monitored node Agent monitors 100 nodes to extract their traces Looking for “conspirators”

Actual vs monitored trajectory START Embassy Sample points collected by agent for the “worst” vehicle (ie, 200 s gap)

How secure must vehicle apps be? • Safe navigation: – Forward collision warning – Advisories to other vehicles: ice on bridge, congestion ahead, etc Non safety applications ◦ ◦ ◦ Traffic monitoring (with navigator) Pollution probing Pavement conditions (e. g. , potholes) Content distribution Urban surveillance Forward Collision Warning • Primary security goals: – Message integrity, secrecy and authentication – Detect misuse by naïve or malicious drivers. – Guarantee message sender privacy Potholes

Vehicular Security requirements Sender authentication Verification of data consistency Protection from Denial of Service Non-repudiation Privacy Challenge: Real-time constraint

Privacy Attack: Tracking

New security requirements for urban dissemination/sensing Dissemination must be selective, private : • Example #1: A driver wants to alert all taxicabs of company A on Washington Street between 10 -11 pm that convention attendees need rides • Example #2: A Police Agent has detected a dangerous radiation leak: – He selectively warns private cars in the radiation area ONLY (to avid panic and chaos!) – He alerts ALL paramedics and firemen in a larger surrounding area • Example #3: FBI broadcast request to participating cars to look for specific drivers – Operation is covered; also only vehicles with proper equipment and going in a specific direction should be “volunteered”

Situation Aware Trust (SAT) critical for “selective” dissemination Situation? Attribute based Trust time place Dynamic attributes can be predicted Proactive Trust affiliation Attributes bootstrapped by social networks • Situation elements are encoded into some attributes • Static attributes (affiliation) • Dynamic attributes (time and place) Social Trust • Bootstrap initial trust • Transitive trust relations • predict dyn attributes based on mobility and location service • establish trust in advance An attribute based situation example: Yellow Cab AND Taxi AND Washington Street AND 10 -11 pm 8/22/08

Security: attributes and policy group A driver wants to alert all taxicabs of company A on Washington Street between 10 -11 pm that convention attendees need rides Central Key Master Extension of Attribute based Encryption (ABE) scheme [IEEE S&P 07] to incorporate dynamic access tree Attribute (company. A AND taxi AND Washington St. AND 10 -11 am) plaintext Extended ABE Module Ciphertext Receivers who satisfy those encoded attributes (have the corresponding private key) can Signature decrypt the message

Attribute-Based Encryption(ABE) Ø Encrypt Data with descriptive “Attributes” Ø Users’ Private Keys reflect Attributes and Decryption Policies Ø Based on Identity based Encryption and Secret Sharing; no need for “published key” (as in PKI) as long as the “attribute based policy” is known sender Encrypt w/attributes receiver CA/PKG Authority is offline master-key 56

Access Control via Situation-aware Policy Tree MSK= Master Secret Key AND company. A 10 -11 am SKSarah: “company. A” “ 10: 30 am” “Washtington St. ” AND Washington St. Authority Sandra the sender SKKevin: “company. A” “ 10: 20 am” “Westwood” 57

Social Trust to overcome failures How are you? • • Leader Future work: People like to socialize => Social trust Suppose infrastructure fails, e. g. , Road Side Unit is attacked/destroyed Social network helps maintain trust – – – People gang up into communities Elected Leader plays role of RSU ie, becomes MASTER and constructs policy group (ie, Attribute Tree) Mobile users are situation aware ABE based Authenticate and encrypt ◦ establish social networks securely (eg authentication of social graph) ◦ incorporate social relations into SAT: social network => dynamic attributes

Do NOT hire a cab without SAT

C -V e T Campus - Vehicular Testbed E. Giordano, A. Ghosh, G. Marfia, S. Ho, J. S. Park, Ph. D System Design: Giovanni Pau, Ph. D Advisor: Mario Gerla, Ph. D

The Plan • We plan to install our node equipment in: – 30 Campus operated vehicles (including shuttles and facility management trucks). • Exploit “on a schedule” and “random” campus fleet mobility patterns – 30 Commuting Vans: Measure urban pollution, traffic congestion etc – 12 Private Vehicles: controlled motion experiments – Cross campus connectivity using 10 node Mesh (Poli Milano).

C-Ve. T Goals Provide: • • A shared virtualized environment to test new protocols and applications Full Virtualization – – Mad. Wi. Fi Virtualization (with on demand exclusive use) Multiple OS support (Linux, Windows). Allow: • Collection of mobility traces and network statistics • Provide a platform for Urban Sensing, Geo routing etc • Deployment of innovative V 2 V/V 2 I applications

Preliminary Experiments • Equipment: – 6 Cars roaming the UCLA Campus – 802. 11 g radios – Routing protocol: OLSR – 1 EVDO interface in the Lead Car – 1 Remote Monitor connected to the Lead Car through EVDO and Internet • Experiments: – Connectivity map computed by OLSR – Azureus P 2 P application

Campus Initial Coverage Using Mobi. Mesh

“Instrumenting” the vehicle

Campus Demo: connectivity via OLSR

Conclusions VANETs will play important urban surveillance role Key research still required in several areas: • Mobility models: – Impact data collection, dissemination, harvesting • Network layer protocols: – Geo routing, Delay tolerant routing, Network Coding, • Robust Applications: – Content storage, harvesting – Pollution monitoring – Emergency Networking • Security: – Private dissemination – Situation Aware Trust

The Future • Still, lots of exciting research ahead • And, need a testbed to validate it! – – Realistic assessment of radio, mobility characteristics Account for user behavior Interaction with (and support of ) the Infrastructure Scalability to thousands of vehicles using hybrid simulation • We are building C-Ve. T at UCLA - come and share!

Thank You!