Will robocars use V2V at all?
Submitted by brad on Mon, 2015-02-02 20:31I commonly see statements from connected car advocates that vehicle to vehicle (V2V) and vehicle to infrastructure communications are an important, even essential technology for robocar development. Readers of this blog will know I disagree strongly, and while I think I2V will be important (done primarily over the existing mobile data network) I suspect that V2V is only barely useful, with minimal value cases that have a hard time justifying its cost.
Of late, though, my forecast for V2V grows even more dismal, because I wonder if robocars will implement V2V with human-driven cars at all, even if it becomes common for ordinary cars to have the technology because of a legal mandate.
The problem is security. A robocar is a very dangerous machine. Compromised, it can cause a lot of damage, even death. As such, security will have a very strong focus in development. You don't want anybody breaking into the computer systems or your car or anybody else's. You really don't want it.
One clear fact that people in security know -- a very large fraction of computer security breaches caused by software faults have come from programs that receive input data from external sources, in particular when you will accept data from anybody. Internet tools are the biggest culprits, and there is a long history of buffer overflows, injection attacks and other trouble that has fallen on tools which will accept a message from just anyone. Servers (which openly accept messages from outside) are at the greatest risk, but even client tools like web browsers run into trouble because they go to vast numbers of different web sites, and it's not hard to trick people to sending them to a random web site.
We work very hard to remove these vulnerabilities, because when you're writing a web tool, you have no choice. You must accept input from random strangers. Holes still get found, and we pay the price.
The simplest strategy to improve your chances is to go deaf. Don't receive inputs from outside at all. You can't do that in most products, but if you can close off a channel without impeding functionality it's a good approach. Generally you will do the following to be more secure:
- Be a client, which means you make communications requests, you do not receive them.
- You only connect to places you trust. You avoid allowing yourself to be directed to connect to other things
- You use digital signature and encryption to assure that you really are talking to your trusted server.
This doesn't protect you perfectly. Your home server can be compromised -- it often will be running in an environment not as locked down as this. In fact, if it becomes your relay for messages from outside, as it must, it has a vector for attack. Still, the extra layer adds some security.