TY - THES ID - 134638332 TI - VulCAN beyond CAN AU - Hubrechtsen, Mathijs AU - Piessens, Frank AU - Mühlberg, Jan Tobias AU - Alder, Fritz AU - KU Leuven. Faculteit Ingenieurswetenschappen. Opleiding Master in de ingenieurswetenschappen. Computerwetenschappen (Leuven) PY - 2022 PB - Leuven KU Leuven. Faculteit Ingenieurswetenschappen DB - UniCat UR - https://www.unicat.be/uniCat?func=search&query=sysid:134638332 AB - Connected vehicles have in recent years become a popular research topic. The research field is broad ranging from autonomous driving to 5G communication to V2X (vehicle-to-anything). While V2X solutions are crucial for connected vehicle applications, there are also important associated cyber security risks. Two security requirements are identified for V2X: authentic chain and privacy. Authentic chain is a strong authenticity guarantee enabling end-nodes (such as vehicles) to trace a received message back to the original verified physical entity that sent it (such as a traffic light). Privacy in V2X is tied to identity management, this guarantee requires a notion of anonymity or pseudonymity. Important challenges in implementing these objectives include: resource constraints, performance and availability, heterogeneity, maintainability, and decentralization. Previous V2X solutions for implementing the proposed security objectives fall short in implementing the established security guarantees and addressing the challenges, leading to the proposition of a new design based on DAA (Direct Anonymous Attestation) for securing V2X communication. The design is based on previous research and extends this work by using Intel SGX TEE, enclaves on the issuer side, and RSA key usage. Thus satisfying the authenticity and pseudonimity requirements through the underlying trusted DAAscheme as well as addressing several of the aforementioned challenges. A practical prototype of the design is implemented and a performance evaluation is provided. The implementation is in line with expected benchmarks such as previous work, standardized V2X latency period, and human reaction time showing the feasibility of privacy-preserving attestation with trusted execution in V2X applications. ER -