Connected Cars, and especially cooperative connected and automated mobility, are very important for the future of transportation. They can improve traffic efficiency, reduce emissions, enhance road safety, and provide better mobility services for users.

TECNALIA has set up a pilot to enable the platforms’ connectivity so as to provide a cooperative maneuver of platooning, which is dependent on communication systems for its tight control of inter-distance between vehicles. The pilot includes the Twizy vehicle platforms, which have connectivity and automated capabilities, and a control station as infrastructure, which monitors and provides high-level control to the cooperative maneuvers.

Figure 1 IoTAC platform in the Connected Car pilot

Cybersecurity remains a concern for these connected systems, which could hamper or even impede the correct functioning of the vehicle systems. TECNALIA’s automated vehicles make use of V2V communications for the platooning use cases, as well as internet connectivity via 4G. In the context of the connected car pilot, the IoTAC modules have been placed both (1) in the control station infrastructure, which will handle the platooning, to provide appropriate coverage for threats in the platooning service and (2) in the automated vehicle itself.

To this extent, the development and deployment being done in the IoTAC project referred to as this pilot, can be split into the following:

1. Control station security, where one of the main concerns is the security of the information being exchanged with the vehicles’ platforms. A second concern is the availability of the platform itself and its potential exposure to attacks, which could render the service availability.
2. Automated Vehicle Platform security, which tackles the possibility of attacks in the vehicle network itself, either by having a physical entry point or by exposure to internet connectivity. A second concern is the correctness of the data reported by the vehicle, and the appropriate functioning of the platform.

To this end, the IoTAC project serves as a testing ground for connected vehicle cybersecurity, by fully integrating the designed platform to tackle these concerns. The modules have been placed in accordance with the aforementioned risks, both in the vehicle and infrastructure for the control station.

The development of a monitoring framework in the IoTAC project – by aggregating different modules thus maximizing coverage – is critical to the connected car pilot. The Attack Detection module and the Security Gateway have been placed in the vehicle, monitoring all traffic data exchanged between sensors, computational equipment, and communication devices, which allows an assessment of the network state. The Honeypot module has been put adjacent to the control station, protecting it from possible malicious intruders and informing directly to a centralized IoTAC framework via a data bus.

The Front-end Access Management (FEAM) module is deployed to target the control station, specifically the authentication layer and role assignment. This module introduces a secure registration process as well as adds an additional layer of security over IoT connectivity by assigning specific roles to each user. This removes the concern regarding unauthorized access to the control station capabilities as well as manages the specific functionalities given to each role in the administration of the platoon.

A Runtime Monitoring System (RMS) is also deployed and connected via the data bus which inspects messages from the vehicle platform, the FEAM, and the Honeypot modules. From the vehicle data, it checks its correct deployment (i.e. kinematic variables within range, vehicles in the correct area, etc) and provides information via a dashboard solution. In the case of the FEAM and the Honeypot, specific messages are also shared for monitoring purposes to assess in real-time via a dashboard the correct functioning of the system.

The lessons learned from the assessment results of these IoTAC modules deployed in the connected car demonstrator will follow at the end of the project.

The new IoTAC security model for IoT architectures will be deployed and validated in four different pilots, representing diverse industry domains.

In the case of the connected car, the pilot will provide a cooperative, connected and automated (CCAM) scenario, where V2X (Vehicle to Everything) data exchange enables cooperative manoeuvres integrating decision-making algorithms, at different SAE (Society of Automotive Engineers) levels of automation; and avails information exchange between the different Intelligent Transportation Systems (ITS) components.

Platooning technology has been researched extensively, it brings improvements in efficiency, increases road capacity, and traffic flow. With the increased automated capabilities and communication technology, a higher level of cooperation can be enabled. In this pilot, the deployment consists of two different use case scenarios: Platoon Driving and Platoon Merging. The first platoon is designed to test the control capabilities of the system, considering the communication channel delays and security features integrated. In the second scenario, a higher-level manoeuvre will be performed by merging two different platoons.

Figure 1 – General platooning scheme

These cooperative scenarios require the use of real-time low latency communication vehicle-to-vehicle (V2V) to complete the manoeuvre safely and successfully. V2V (Vehicle-to-Vehicle) communications based on DSRC (Dedicated Short-Range Communication) will be available for all cars in the use case. This low latency communication channel poses a challenge to protect and guarantee its integrity, without incurring significant overhead for the control of the manoeuvre.

A control station will monitor telemetry data for the vehicles and enable or disable platooning capabilities depending on the zones mapped for the environment. The control station will communicate with each vehicle using the MQTT protocol. As an example, the map in Figure 2 shows the zones available to perform the platoon merging manoeuvre.

The platforms for the pilot are two automated Renault Twizys, and two simulated Twizys. The demonstrations will take place at the Technological Park of Zamudio in Bizkaia, Spain, which allow for a realistic test and implementation of the Connected Car Pilot, with complex road segments. Multiple agents will pose a challenge to test the capabilities of the technology embedded in the vehicles.

For each use case, a zone is specified where the manoeuvre will coordinate the vehicles to engage, in platoon driving, or platoon merging, other zones are assumed to be driven in automated driving mode.

Figure 2 – Platoon Merging Route

Platoon driving scenario:

As a precondition for this use case, all vehicles must be equipped with their own Automated Driving Systems (ADS) and be able to communicate through V2X; vehicles must be in automated mode; and each vehicle will report data to the control station through MQTT, for monitorization and control.

Figure 3 shows platoon driving, using Renault Twizy models in a simulation environment, the general sequence for the manoeuvre follows:

• Each vehicle is driving towards the same destination in automated mode.
• The control station will take notice and signal that a platoon is to be formed, with the vehicles in the designated area.
• Each vehicle will independently transition to a platoon manoeuvre and follow a leader (vehicle furthest ahead).
• At any moment the control station might disable the platooning manoeuvre in the area.
• Vehicles will communicate through V2X (ETSI-G5¹) to negotiate the formation of a platoon.
• Once the platoon is successfully formed, the vehicles will drive towards their destination. Low-level control for platooning requires constant V2X communication. The vehicles must be always able to communicate with all agents in the platoon.
• The manoeuvre ends once the vehicles reached their destination.

Figure 3 – Platoon Driving Simulation

Platoon merging scenario:

As a precondition for this case all vehicles must be equipped with their own ADS, there must already be at least one platoon formed (in automated driving mode) and a vehicle or a second platoon (in automated driving mode) should require merging into the first platoon. Each vehicle needs to be reporting data to the control station through MQTT, for monitorization and control.

The general sequence is described below, in Figure 2 a simulation of the manoeuvre using Renault Twizys is shown. A further technical explanation of the manoeuvre to perform can be found in Hidalgo (2021) ²

• A first platoon is driving towards its destination, in the right lane of the road.
• A vehicle (or second platoon) in another lane reaches a merging point (roundabout, end of the lane or obstruction in the road)
• Vehicles will communicate through V2X to negotiate the formation of a single platoon.
• At any moment, the control station might disable the platooning manoeuvre in the area.
• Once the platoon(s) is (are) merged, the vehicles will drive towards their destination. Low-level control for platooning requires constant V2X communication.
• The manoeuvre ends once the vehicles reach the destination.

Figure 4 – Platoon Merging Simulation

References:

1. ETSI-G5: ETSI standards: automotive Intelligent Transport Systems (ITS) https://www.etsi.org/technologies/automotive-intelligent-transport (last visited 25/08/2021)
2. Hidalgo, C., Lattarulo, R., Flores, C., & Rastelli, J. P. (2021). Platoon Merging Approach Based on Hybrid Trajectory Planning and CACC Strategies. Sensors, 21(8), 2626.