Identity Management for Interoperable PTC Systems in Bandwidth-Limited Environments: The Final Report, Part 3 (of three parts) The Proposed Solution

Positive Train Control is a wireless based system designed to provide comprehensive safety coverage for passenger and cargo trains operating on U.S. railroads by 2015. Mandated by Rail Safety Improvement Act of 2008 (RISA 2008), major railroads have designed a broad architecture consisting of two networks; namely the Signaling Network (SN) and the Wayside Interface Network (WIN) powered by software-defined radios (SDRs) that use the same 220MHz range. The Signaling Network provides authorities for trains to enter fixed blocks of track and other signal functions and the Wayside Interface Network provide sensory information about the vicinity of the tracks. The railroad community has decided that both networks require message integrity and availability but not confidentiality for both networks. From published documents, the Wayside Interface Network uses truncated SHA-1 hashed keys to ensure the integrity of the Wayside Interface Unit (WIU) messages. The authors have found that this choice may weaken the security requirements of WIU message broadcasts. The authors demonstrate these vulnerabilities using the details of the proposed protocols. Part 2 of this report showed that the existing wayside interface protocol has vulnerabilities. This part (Part 3) describes a solution that overcomes those vulnerabilities. The solution to overcome the hash breaking attack is to use a different hash for every hash at the every time moment. This way the beacon's integrity values will not be repeated over for a long time. Given that to change hashes frequently requires precise clocks, the authors first show a solution that operates under this strict assumption and show a relaxed version that does not depend on precisely synchronized clocks.