RFC 9365: IPv6 Wireless Access in Vehicular Environments (IPWAVE): Problem Statement and Use Cases

3.1. V2V

The use cases of V2V networking discussed in this section include:¶

The above use cases are examples for using V2V networking, which can be extended to other terrestrial vehicles, river/sea ships, railed vehicles, or UAM end systems.¶

A Context-Aware Safety Driving (CASD) navigator [CASD] can help drivers to drive safely as a context-aware navigation service [CNP] by alerting them to dangerous obstacles and situations. That is, a CASD navigator displays obstacles or neighboring vehicles relevant to possible collisions in real time through V2V networking. CASD provides vehicles with a class-based automatic safety action plan that considers three situations, namely, the Line-of-Sight unsafe, Non-Line-of-Sight unsafe, and safe situations. This action plan can be put into action among multiple vehicles using V2V networking.¶

A service for collision avoidance of in-air UAM end systems is one possible use case in air vehicular environments [UAM-ITS]. This use case is similar to that of a context-aware navigator for terrestrial vehicles. Through V2V coordination, those UAM end systems (e.g., drones) can avoid a dangerous situation (e.g., collision) in three-dimensional space rather than two-dimensional space for terrestrial vehicles. Also, a UAM end system (e.g., flying car), when only a few hundred meters off the ground, can communicate with terrestrial vehicles with wireless communication technologies (e.g., DSRC, LTE, and C-V2X). Thus, V2V means any vehicle to any vehicle, whether the vehicles are ground level or not.¶

Cooperative Adaptive Cruise Control (CACC) [CA-Cruise-Control] helps individual vehicles to adapt their speed autonomously through V2V communication among vehicles according to the mobility of their predecessor and successor vehicles on an urban roadway or a highway. Thus, CACC can help adjacent vehicles to efficiently adjust their speed in an interactive way through V2V networking in order to avoid a collision.¶

Platooning [Truck-Platooning] allows a series (or group) of vehicles (e.g., trucks) to follow each other very closely. Vehicles can use V2V communication in addition to forward sensors in order to maintain constant clearance between two consecutive vehicles at very short gaps (from 3 to 10 meters). Platooning can maximize the throughput of vehicular traffic on a highway and reduce the gas consumption because the lead vehicle can help the following vehicles experience less air resistance.¶

Cooperative-environment-sensing use cases suggest that vehicles can share environmental information (e.g., air pollution, hazards, obstacles, slippery areas by snow or rain, road accidents, traffic congestion, and driving behaviors of neighboring vehicles) from various vehicle-mounted sensors, such as radars, LiDAR systems, and cameras, with other vehicles and pedestrians. [Automotive-Sensing] introduces millimeter-wave vehicular communication for massive automotive sensing. A lot of data can be generated by those sensors, and these data typically need to be routed to different destinations. In addition, from the perspective of driverless vehicles, it is expected that driverless vehicles can be mixed with driver-operated vehicles. Through cooperative environment sensing, driver-operated vehicles can use environmental information sensed by driverless vehicles for better interaction with the other vehicles and environment. Vehicles can also share their intended maneuvering information (e.g., lane change, speed change, ramp in-and-out, cut-in, and abrupt braking) with neighboring vehicles. Thus, this information sharing can help the vehicles behave as more efficient traffic flows and minimize unnecessary acceleration and deceleration to achieve the best ride comfort.¶

To support applications of these V2V use cases, the required functions of IPv6 include (a) IPv6-based packet exchange in both control and data planes and (b) secure, safe communication between two vehicles. For the support of V2V under multiple radio technologies (e.g., DSRC and 5G V2X), refer to Appendix A.¶

3.2. V2I

The use cases of V2I networking discussed in this section include:¶

A navigation service (for example, the Self-Adaptive Interactive Navigation Tool [SAINT]) that uses V2I networking interacts with a TCC for the large-scale/long-range road traffic optimization and can guide individual vehicles along appropriate navigation paths in real time. The enhanced version of SAINT [SAINTplus] can give fast-moving paths to emergency vehicles (e.g., ambulance and fire engine) to let them reach an accident spot while redirecting other vehicles near the accident spot into efficient detour paths.¶

Either a TCC or an ECD can recommend an energy-efficient speed to a vehicle that depends on its traffic environment and traffic signal scheduling [SignalGuru]. For example, when a vehicle approaches an intersection area and a red traffic light for the vehicle becomes turned on, it needs to reduce its speed to save fuel consumption. In this case, either a TCC or an ECD, which has the up-to-date trajectory of the vehicle and the traffic light schedule, can notify the vehicle of an appropriate speed for fuel efficiency. [Fuel-Efficient] covers fuel-efficient route and speed plans for platooned trucks.¶

The emergency communication between vehicles in an accident (or emergency-response vehicles) and a TCC can be performed via either IP-RSUs or 4G-LTE or 5G networks. The First Responder Network Authority [FirstNet] is provided by the US government to establish, operate, and maintain an interoperable public safety broadband network for safety and security network services, e.g., emergency calls. The construction of the nationwide FirstNet network requires each state in the US to have a Radio Access Network (RAN) that will connect to the FirstNet's network core. The current RAN is mainly constructed using 4G-LTE for communication between a vehicle and an infrastructure node (i.e., V2I) [FirstNet-Report], but it is expected that DSRC-based vehicular networks [DSRC] will be available for V2I and V2V in the near future. An equivalent project in Europe is called Public Safety Communications Europe [PSCE], which is developing a network for emergency communications.¶

An EV charging service with V2I can facilitate the efficient battery charging of EVs. In the case where an EV charging station is connected to an IP-RSU, an EV can be guided toward the deck of the EV charging station or be notified that the charging station is out of service through a battery charging server connected to the IP-RSU. In addition to this EV charging service, other value-added services (e.g., firmware/software update over-the-air and media streaming) can be provided to an EV while it is charging its battery at the EV charging station. For a UAM navigation service, an efficient battery charging plan can improve the battery charging schedule of UAM end systems (e.g., drones) for long-distance flying [CBDN]. For this battery charging schedule, a UAM end system can communicate with a cloud server via an infrastructure node (e.g., IP-RSU). This cloud server can coordinate the battery charging schedules of multiple UAM end systems for their efficient navigation path, considering flight time from their current position to a battery charging station, waiting time in a waiting queue at the station, and battery charging time at the station.¶

In some scenarios, such as vehicles moving on highways or staying in parking lots, a V2V2I network is necessary for vehicles to access the Internet since some vehicles may not be covered by an IP-RSU. For those vehicles, a few relay vehicles can help to build the Internet access. For the nested NEMO described in [RFC4888], hosts inside a vehicle shown in Figure 3 for the case of V2V2I may have the same issue in the nested NEMO scenario.¶

To better support these use cases, the existing IPv6 protocol must be augmented either through protocol changes or by including a new adaptation layer in the architecture that efficiently maps IPv6 to a diversity of link-layer technologies. Augmentation is necessary to support wireless multihop V2I communications on a highway where RSUs are sparsely deployed so that a vehicle can reach the wireless coverage of an IP-RSU through the multihop data forwarding of intermediate vehicles as packet forwarders. Thus, IPv6 needs to be extended for multihop V2I communications.¶

To support applications of these V2I use cases, the required functions of IPv6 include IPv6 communication enablement with neighborhood discovery and IPv6 address management; reachability with adapted network models and routing methods; transport-layer session continuity; and secure, safe communication between a vehicle and an infrastructure node (e.g., IP-RSU) in the vehicular network.¶

3.3. V2X

The use case of V2X networking discussed in this section is for a protection service for a vulnerable road user (VRU), e.g., a pedestrian or cyclist. Note that the application area of this use case is currently limited to a specific environment, such as construction sites, plants, and factories, since not every VRU in a public area is equipped with a smart device (e.g., not every child on a road has a smartphone, smart watch, or tablet).¶

A VRU protection service, such as the Safety-Aware Navigation Application [SANA], using V2I2P networking can reduce the collision of a vehicle and a pedestrian carrying a smartphone equipped with a network device for wireless communication (e.g., Wi-Fi, DSRC, 4G/5G V2X, and Bluetooth Low Energy (BLE)) with an IP-RSU. Vehicles and pedestrians can also communicate with each other via an IP-RSU. An ECD behind the IP-RSU can collect the mobility information from vehicles and pedestrians, and then compute wireless communication scheduling for the sake of them. This scheduling can save the battery of each pedestrian's smartphone by allowing it to work in sleeping mode before communication with vehicles, considering their mobility. The location information of a VRU from a smart device (e.g., smartphone) is multicasted only to the nearby vehicles. The true identifiers of a VRU's smart device shall be protected, and only the type of the VRU, such as pedestrian, cyclist, or scooter, is disclosed to the nearby vehicles.¶

For Vehicle-to-Pedestrian (V2P), a vehicle can directly communicate with a pedestrian's smartphone by V2X without IP-RSU relaying. Light-weight mobile nodes, such as bicycles, may also communicate directly with a vehicle for collision avoidance using V2V. Note that it is true that either a pedestrian or a cyclist may have a higher risk of being hit by a vehicle if they are not with a smartphone in the current setting. For this case, other human-sensing technologies (e.g., moving-object detection in images and wireless signal-based human movement detection [LIFS] [DFC]) can be used to provide motion information to vehicles. A vehicle by V2V2I networking can obtain a VRU's motion information via an IP-RSU that either employs or connects to a human-sensing technology.¶

The existing IPv6 protocol must be augmented through protocol changes in order to support wireless multihop V2X or V2I2X communications in an urban road network where RSUs are deployed at intersections so that a vehicle (or a pedestrian's smartphone) can reach the wireless coverage of an IP-RSU through the multihop data forwarding of intermediate vehicles (or pedestrians' smartphones) as packet forwarders. Thus, IPv6 needs to be extended for multihop V2X or V2I2X communications.¶

To support applications of these V2X use cases, the required functions of IPv6 include IPv6-based packet exchange; transport-layer session continuity; secure, safe communication between a vehicle and a pedestrian either directly or indirectly via an IP-RSU; and the protection of identifiers of either a vehicle or smart device (such as the Media Access Control (MAC) address and IPv6 address), which is discussed in detail in Section 6.3.¶

4.1. Vehicular Network Architecture

Figure 1 shows an example vehicular network architecture for V2I and V2V in a road network. The vehicular network architecture contains vehicles (including IP-OBU), IP-RSUs, Mobility Anchor, Traffic Control Center, and Vehicular Cloud as components. These components are not mandatory, and they can be deployed into vehicular networks in various ways. Some of them (e.g., Mobility Anchor, Traffic Control Center, and Vehicular Cloud) may not be needed for the vehicular networks according to target use cases in Section 3.¶

Existing network architectures, such as the network architectures of PMIPv6 [RFC5213], RPL (IPv6 Routing Protocol for Low-Power and Lossy Networks) [RFC6550], Automatic Extended Route Optimization [AERO], and Overlay Multilink Network Interface [OMNI], can be extended to a vehicular network architecture for multihop V2V, V2I, and V2X, as shown in Figure 1. Refer to Appendix B for the detailed discussion on multihop V2X networking by RPL and OMNI. Also, refer to Appendix A for the description of how OMNI is designed to support the use of multiple radio technologies in V2X. Note that though AERO/OMNI is not actually deployed in the industry, this AERO/OMNI is mentioned as a possible approach for vehicular networks in this document.¶

As shown in Figure 1, IP-RSUs as routers and vehicles with IP-OBU have wireless media interfaces for VANET. The three IP-RSUs (IP-RSU1, IP-RSU2, and IP-RSU3) are deployed in the road network and are connected with each other through the wired networks (e.g., Ethernet). A Traffic Control Center (TCC) is connected to the Vehicular Cloud for the management of IP-RSUs and vehicles in the road network. A Mobility Anchor (MA) may be located in the TCC as a mobility management controller. Vehicle2, Vehicle3, and Vehicle4 are wirelessly connected to IP-RSU1, IP-RSU2, and IP-RSU3, respectively. The three wireless networks of IP-RSU1, IP-RSU2, and IP-RSU3 can belong to three different subnets (i.e., Subnet1, Subnet2, and Subnet3), respectively. Those three subnets use three different prefixes (i.e., Prefix1, Prefix2, and Prefix3).¶

Multiple vehicles under the coverage of an IP-RSU share a prefix just as mobile nodes share a prefix of a Wi-Fi access point in a wireless LAN. This is a natural characteristic in infrastructure-based wireless networks. For example, in Figure 1, two vehicles (i.e., Vehicle2 and Vehicle5) can use Prefix1 to configure their IPv6 global addresses for V2I communication. Alternatively, two vehicles can employ a "Bring Your Own Addresses (BYOA)" (or "Bring Your Own Prefix (BYOP)") technique using their own IPv6 Unique Local Addresses (ULAs) [RFC4193] over the wireless network.¶

In wireless subnets in vehicular networks (e.g., Subnet1 and Subnet2 in Figure 1), vehicles can construct a connected VANET (with an arbitrary graph topology) and can communicate with each other via V2V communication. Vehicle1 can communicate with Vehicle2 via V2V communication, and Vehicle2 can communicate with Vehicle3 via V2V communication because they are within the wireless communication range of each other. On the other hand, Vehicle3 can communicate with Vehicle4 via the vehicular infrastructure (i.e., IP-RSU2 and IP-RSU3) by employing V2I (i.e., V2I2V) communication because they are not within the wireless communication range of each other.¶

As a basic definition for IPv6 packets transported over IEEE 802.11-OCB, [RFC8691] specifies several details, including Maximum Transmission Unit (MTU), frame format, link-local address, address mapping for unicast and multicast, stateless autoconfiguration, and subnet structure.¶

An IPv6 mobility solution is needed for the guarantee of communication continuity in vehicular networks so that a vehicle's TCP session can be continued or that UDP packets can be delivered to a vehicle as a destination without loss while it moves from an IP-RSU's wireless coverage to another IP-RSU's wireless coverage. In Figure 1, assuming that Vehicle2 has a TCP session (or a UDP session) with a correspondent node in the Vehicular Cloud, Vehicle2 can move from IP-RSU1's wireless coverage to IP-RSU2's wireless coverage. In this case, a handover for Vehicle2 needs to be performed by either a host-based mobility management scheme (e.g., MIPv6 [RFC6275]) or a network-based mobility management scheme (e.g., PMIPv6 [RFC5213], NEMO [RFC3963] [RFC4885] [RFC4888], and AERO [AERO]). This document describes issues in mobility management for vehicular networks in Section 5.2. For improving TCP session continuity or successful UDP packet delivery, the Multipath TCP (MPTCP) [RFC8684] or QUIC protocol [RFC9000] can also be used. IP-OBUs, however, may still experience more session time-out and re-establishment procedures due to lossy connections among vehicles caused by the high mobility dynamics of them.¶

4.2. V2I-Based Internetworking

This section discusses the internetworking between a vehicle's internal network (i.e., mobile network) and an EN's internal network (i.e., fixed network) via V2I communication. The internal network of a vehicle is nowadays constructed with Ethernet by many automotive vendors [In-Car-Network]. Note that an EN can accommodate multiple routers (or switches) and servers (e.g., ECDs, navigation server, and DNS server) in its internal network.¶

A vehicle's internal network often uses Ethernet to interconnect Electronic Control Units (ECUs) in the vehicle. The internal network can support Wi-Fi and Bluetooth to accommodate a driver's and passenger's mobile devices (e.g., smartphone or tablet). The network topology and subnetting depend on each vendor's network configuration for a vehicle and an EN. It is reasonable to consider interactions between the internal network of a vehicle and that of another vehicle or an EN. Note that it is dangerous if the internal network of a vehicle is controlled by a malicious party. These dangers can include unauthorized driving control input and unauthorized driving information disclosure to an unauthorized third party. A malicious party can be a group of hackers, a criminal group, and a competitor for industrial espionage or sabotage. To minimize this kind of risk, an augmented identification and verification protocol, which has an extra means, shall be implemented based on a basic identity verification process. These extra means could include approaches based on certificates, biometrics, credit, or One-Time Passwords (OTPs) in addition to Host Identity Protocol certificates [RFC8002]. The parties of the verification protocol can be from a built-in verification protocol in the current vehicle, which is pre-installed by a vehicle vendor. The parties can also be from any verification authorities that have the database of authenticated users. The security properties provided by a verification protocol can be identity-related information, such as the genuineness of an identity, the authenticity of an identity, and the ownership of an identity [RFC7427].¶

The augmented identification and verification protocol with extra means can support security properties such as the identification and verification of a vehicle, driver, and passenger. First, a credit-based method is when a vehicle classifies the messages it received from another host into various levels based on their potential effects on driving safety in order to calculate the credit of that sender. Based on accumulated credit, a correspondent node can verify the other party to see whether it is genuine or not. Second, a certificate-based method includes a user certificate (e.g., X.509 certificate [RFC5280]) to authenticate a vehicle or its driver. Third, a biometric method includes a fingerprint, face, or voice to authenticate a driver or passenger. Lastly, an OTP-based method lets another already-authenticated device (e.g., smartphone and tablet) of a driver or passenger be used to authenticate a driver or passenger.¶

                                                 +-----------------+
                        (*)<........>(*)  +----->| Vehicular Cloud |
     (2001:db8:1:1::/64) |            |   |      +-----------------+
+------------------------------+  +---------------------------------+
|                        v     |  |   v   v                         |
| +-------+          +-------+ |  | +-------+          +-------+    |
| | Host1 |          |IP-OBU1| |  | |IP-RSU1|          | Host3 |    |
| +-------+          +-------+ |  | +-------+          +-------+    |
|     ^                  ^     |  |     ^                  ^        |
|     |                  |     |  |     |                  |        |
|     v                  v     |  |     v                  v        |
| ---------------------------- |  | ------------------------------- |
| 2001:db8:10:1::/64 ^         |  |     ^ 2001:db8:20:1::/64        |
|                    |         |  |     |                           |
|                    v         |  |     v                           |
| +-------+      +-------+     |  | +-------+ +-------+   +-------+ |
| | Host2 |      |Router1|     |  | |Router2| |Server1|...|ServerN| |
| +-------+      +-------+     |  | +-------+ +-------+   +-------+ |
|     ^              ^         |  |     ^         ^           ^     |
|     |              |         |  |     |         |           |     |
|     v              v         |  |     v         v           v     |
| ---------------------------- |  | ------------------------------- |
|      2001:db8:10:2::/64      |  |       2001:db8:20:2::/64        |
+------------------------------+  +---------------------------------+
   Vehicle1 (Mobile Network1)            EN1 (Fixed Network1)

   <----> Wired Link   <....> Wireless Link   (*) Antenna

As shown in Figure 2, as internal networks, a vehicle's mobile network and an EN's fixed network are self-contained networks having multiple subnets and having an edge router (e.g., IP-OBU and IP-RSU) for communication with another vehicle or another EN. The internetworking between two internal networks via V2I communication requires the exchange of the network parameters and the network prefixes of the internal networks. For the efficiency, the network prefixes of the internal networks (as a mobile network) in a vehicle need to be delegated and configured automatically. Note that a mobile network's network prefix can be called a Mobile Network Prefix (MNP) [RFC3963].¶

Figure 2 also shows the internetworking between the vehicle's mobile network and the EN's fixed network. There exists an internal network (Mobile Network1) inside Vehicle1. Vehicle1 has two hosts (Host1 and Host2) and two routers (IP-OBU1 and Router1). There exists another internal network (Fixed Network1) inside EN1. EN1 has one host (Host3), two routers (IP-RSU1 and Router2), and the collection of servers (Server1 to ServerN) for various services in the road networks, such as the emergency notification and navigation. Vehicle1's IP-OBU1 (as a mobile router) and EN1's IP-RSU1 (as a fixed router) use 2001:db8:1:1::/64 for an external link (e.g., DSRC) for V2I networking. Thus, a host (Host1) in Vehicle1 can communicate with a server (Server1) in EN1 for a vehicular service through Vehicle1's mobile network, a wireless link between IP-OBU1 and IP-RSU1, and EN1's fixed network.¶

For the IPv6 communication between an IP-OBU and an IP-RSU or between two neighboring IP-OBUs, they need to know the network parameters, which include MAC layer and IPv6 layer information. The MAC layer information includes wireless link-layer parameters, transmission power level, and the MAC address of an external network interface for the internetworking with another IP-OBU or IP-RSU. The IPv6 layer information includes the IPv6 address and network prefix of an external network interface for the internetworking with another IP-OBU or IP-RSU.¶

Through the mutual knowledge of the network parameters of internal networks, packets can be transmitted between the vehicle's mobile network and the EN's fixed network. Thus, V2I requires an efficient protocol for the mutual knowledge of network parameters. Note that from a security point of view, perimeter-based policy enforcement [RFC9099] can be applied to protect parts of the internal network of a vehicle.¶

As shown in Figure 2, the addresses used for IPv6 transmissions over the wireless link interfaces for IP-OBU and IP-RSU can be IPv6 link-local addresses, ULAs, or IPv6 global addresses. When IPv6 addresses are used, wireless interface configuration and control overhead for Duplicate Address Detection (DAD) [RFC4862] and Multicast Listener Discovery (MLD) [RFC2710] [RFC3810] should be minimized to support V2I and V2X communications for vehicles moving fast along roadways.¶

Let us consider the upload/download time of a ground vehicle when it passes through the wireless communication coverage of an IP-RSU. For a given typical setting where 1 km is the maximum DSRC communication range [DSRC] and 100 km/h is the speed limit on highways for ground vehicles, the dwelling time can be calculated to be 72 seconds by dividing the diameter of the 2 km (i.e., two times the DSRC communication range where an IP-RSU is located in the center of the circle of wireless communication) by the speed limit of 100 km/h (i.e., about 28 m/s). For the 72 seconds, a vehicle passing through the coverage of an IP-RSU can upload and download data packets to/from the IP-RSU. For special cases, such as emergency vehicles moving above the speed limit, the dwelling time is relatively shorter than that of other vehicles. For cases of airborne vehicles (i.e., aircraft), considering a higher flying speed and a higher altitude, the dwelling time can be much shorter.¶

4.3. V2V-Based Internetworking

This section discusses the internetworking between the mobile networks of two neighboring vehicles via V2V communication.¶

                        (*)<..........>(*)
     (2001:db8:1:1::/64) |              |
+------------------------------+  +------------------------------+
|                        v     |  |     v                        |
| +-------+          +-------+ |  | +-------+          +-------+ |
| | Host1 |          |IP-OBU1| |  | |IP-OBU2|          | Host3 | |
| +-------+          +-------+ |  | +-------+          +-------+ |
|     ^                  ^     |  |     ^                  ^     |
|     |                  |     |  |     |                  |     |
|     v                  v     |  |     v                  v     |
| ---------------------------- |  | ---------------------------- |
| 2001:db8:10:1::/64 ^         |  |         ^ 2001:db8:30:1::/64 |
|                    |         |  |         |                    |
|                    v         |  |         v                    |
| +-------+      +-------+     |  |     +-------+      +-------+ |
| | Host2 |      |Router1|     |  |     |Router2|      | Host4 | |
| +-------+      +-------+     |  |     +-------+      +-------+ |
|     ^              ^         |  |         ^              ^     |
|     |              |         |  |         |              |     |
|     v              v         |  |         v              v     |
| ---------------------------- |  | ---------------------------- |
|      2001:db8:10:2::/64      |  |       2001:db8:30:2::/64     |
+------------------------------+  +------------------------------+
   Vehicle1 (Mobile Network1)        Vehicle2 (Mobile Network2)

   <----> Wired Link   <....> Wireless Link   (*) Antenna

Figure 3 shows the internetworking between the mobile networks of two neighboring vehicles. There exists an internal network (Mobile Network1) inside Vehicle1. Vehicle1 has two hosts (Host1 and Host2) and two routers (IP-OBU1 and Router1). There exists another internal network (Mobile Network2) inside Vehicle2. Vehicle2 has two hosts (Host3 and Host4) and two routers (IP-OBU2 and Router2). Vehicle1's IP-OBU1 (as a mobile router) and Vehicle2's IP-OBU2 (as a mobile router) use 2001:db8:1:1::/64 for an external link (e.g., DSRC) for V2V networking. Thus, a host (Host1) in Vehicle1 can communicate with another host (Host3) in Vehicle2 for a vehicular service through Vehicle1's mobile network, a wireless link between IP-OBU1 and IP-OBU2, and Vehicle2's mobile network.¶

As a V2V use case in Section 3.1, Figure 4 shows a linear network topology of platooning vehicles for V2V communications where Vehicle3 is the lead vehicle with a driver, and Vehicle2 and Vehicle1 are the following vehicles without drivers. From a security point of view, before vehicles can be platooned, they shall be mutually authenticated to reduce possible security risks.¶

     (*)<..................>(*)<..................>(*)
      |                      |                      |
+-----------+          +-----------+          +-----------+
|           |          |           |          |           |
| +-------+ |          | +-------+ |          | +-------+ |
| |IP-OBU1| |          | |IP-OBU2| |          | |IP-OBU3| |
| +-------+ |          | +-------+ |          | +-------+ |
|     ^     |          |     ^     |          |     ^     |
|     |     |=====>    |     |     |=====>    |     |     |=====>
|     v     |          |     v     |          |     v     |
| +-------+ |          | +-------+ |          | +-------+ |
| | Host1 | |          | | Host2 | |          | | Host3 | |
| +-------+ |          | +-------+ |          | +-------+ |
|           |          |           |          |           |
+-----------+          +-----------+          +-----------+
   Vehicle1               Vehicle2               Vehicle3

 <----> Wired Link   <....> Wireless Link   ===> Moving Direction
 (*) Antenna

As shown in Figure 4, multihop internetworking is feasible among the mobile networks of three vehicles in the same VANET. For example, Host1 in Vehicle1 can communicate with Host3 in Vehicle3 via IP-OBU1 in Vehicle1, IP-OBU2 in Vehicle2, and IP-OBU3 in Vehicle3 in the VANET, as shown in the figure.¶

In this section, the link between two vehicles is assumed to be stable for single-hop wireless communication regardless of the sight relationship, such as Line-of-Sight and Non-Line-of-Sight, as shown in Figure 3. Even in Figure 4, the three vehicles are connected to each other with a linear topology, however, multihop V2V communication can accommodate any network topology (i.e., an arbitrary graph) over VANET routing protocols.¶

     (*)<..................>(*)<..................>(*)
      |                      |                      |
+-----------+          +-----------+          +-----------+
|           |          |           |          |           |
| +-------+ |          | +-------+ |          | +-------+ |
| |IP-OBU1| |          | |IP-RSU1| |          | |IP-OBU3| |
| +-------+ |          | +-------+ |          | +-------+ |
|     ^     |          |     ^     |          |     ^     |
|     |     |=====>    |     |     |          |     |     |=====>
|     v     |          |     v     |          |     v     |
| +-------+ |          | +-------+ |          | +-------+ |
| | Host1 | |          | | Host2 | |          | | Host3 | |
| +-------+ |          | +-------+ |          | +-------+ |
|           |          |           |          |           |
+-----------+          +-----------+          +-----------+
   Vehicle1                 EN1                  Vehicle3

 <----> Wired Link   <....> Wireless Link   ===> Moving Direction
 (*) Antenna

As shown in Figure 5, multihop internetworking between two vehicles is feasible via an infrastructure node (e.g., IP-RSU) with wireless connectivity among the mobile networks of two vehicles and the fixed network of an edge network (denoted as EN1) in the same VANET. For example, Host1 in Vehicle1 can communicate with Host3 in Vehicle3 via IP-OBU1 in Vehicle1, IP-RSU1 in EN1, and IP-OBU3 in Vehicle3 in the VANET, as shown in the figure.¶

For the reliability required in V2V networking, the ND optimization defined in the Mobile Ad Hoc Network (MANET) [RFC6130] [RFC7466] improves the classical IPv6 ND in terms of tracking neighbor information with up to two hops and introducing several extensible Information Bases. This improvement serves the MANET routing protocols, such as the different versions of Optimized Link State Routing Protocol (OLSR) [RFC3626] [RFC7181], Open Shortest Path First (OSPF) derivatives (e.g., [RFC5614]), and Dynamic Link Exchange Protocol (DLEP) [RFC8175] with its extensions [RFC8629] [RFC8757]. In short, the MANET ND mainly deals with maintaining extended network neighbors to enhance the link reliability. However, an ND protocol in vehicular networks shall consider more about the geographical mobility information of vehicles as an important resource for serving various purposes to improve the reliability, e.g., vehicle driving safety, intelligent transportation implementations, and advanced mobility services. For a more reliable V2V networking, some redundancy mechanisms should be provided in L3 in cases of the failure of L2. For different use cases, the optimal solution to improve V2V networking reliability may vary. For example, a group of platooning vehicles may have stabler neighbors than freely moving vehicles, as described in Section 3.1.¶

5.1. Neighbor Discovery

IPv6 ND [RFC4861] [RFC4862] is a core part of the IPv6 protocol suite. IPv6 ND is designed for link types including point-to-point, multicast-capable (e.g., Ethernet), and Non-Broadcast Multiple Access (NBMA). It assumes the efficient and reliable support of multicast and unicast from the link layer for various network operations, such as MAC Address Resolution (AR), DAD, MLD, and Neighbor Unreachability Detection (NUD) [RFC4861] [RFC4862] [RFC2710] [RFC3810].¶

Vehicles move quickly within the communication coverage of any particular vehicle or IP-RSU. Before the vehicles can exchange application messages with each other, they need IPv6 addresses to run IPv6 ND.¶

The requirements for IPv6 ND for vehicular networks are efficient DAD and NUD operations. An efficient DAD is required to reduce the overhead of DAD packets during a vehicle's travel in a road network, which can guarantee the uniqueness of a vehicle's global IPv6 address. An efficient NUD is required to reduce the overhead of the NUD packets during a vehicle's travel in a road network, which can guarantee the accurate neighborhood information of a vehicle in terms of adjacent vehicles and IP-RSUs.¶

The legacy DAD assumes that a node with an IPv6 address can reach any other node with the scope of its address at the time it claims its address, and can hear any future claim for that address by another party within the scope of its address for the duration of the address ownership. However, the partitioning and merging of VANETs makes this assumption not valid frequently in vehicular networks. The partitioning and merging of VANETs frequently occurs in vehicular networks. This partitioning and merging should be considered for IPv6 ND, such as IPv6 Stateless Address Autoconfiguration (SLAAC) [RFC4862]. SLAAC is not compatible with the partitioning and merging, and additional work is needed for ND to operate properly under those circumstances. Due to the merging of VANETs, two IPv6 addresses may conflict with each other though they were unique before the merging. An address lookup operation may be conducted by an MA or IP-RSU (as Registrar in RPL) to check the uniqueness of an IPv6 address that will be configured by a vehicle as DAD. Also, the partitioning of a VANET may make vehicles with the same prefix be physically unreachable. An address lookup operation may be conducted by an MA or IP-RSU (as Registrar in RPL) to check the existence of a vehicle under the network coverage of the MA or IP-RSU as NUD. Thus, SLAAC needs to prevent IPv6 address duplication due to the merging of VANETs, and IPv6 ND needs to detect unreachable neighboring vehicles due to the partitioning of a VANET. According to the partitioning and merging, a destination vehicle (as an IPv6 host) needs to be distinguished as a host that is either on-link or not on-link even though the source vehicle can use the same prefix as the destination vehicle [IPPL].¶

To efficiently prevent IPv6 address duplication (due to the VANET partitioning and merging) from happening in vehicular networks, the vehicular networks need to support a vehicular-network-wide DAD by defining a scope that is compatible with the legacy DAD. In this case, two vehicles can communicate with each other when there exists a communication path over VANET or a combination of VANETs and IP-RSUs, as shown in Figure 1. By using the vehicular-network-wide DAD, vehicles can assure that their IPv6 addresses are unique in the vehicular network whenever they are connected to the vehicular infrastructure or become disconnected from it in the form of VANET.¶

For vehicular networks with high mobility and density, DAD needs to be performed efficiently with minimum overhead so that the vehicles can exchange driving safety messages (e.g., collision avoidance and accident notification) with each other with a short interval as suggested by the National Highway Traffic Safety Administration (NHTSA) of the U.S. [NHTSA-ACAS-Report]. Since the partitioning and merging of vehicular networks may require re-performing the DAD process repeatedly, the link scope of vehicles may be limited to a small area, which may delay the exchange of driving safety messages. Driving safety messages can include a vehicle's mobility information (e.g., position, speed, direction, and acceleration/deceleration) that is critical to other vehicles. The exchange interval of this message is recommended to be less than 0.5 seconds, which is required for a driver to avoid an emergency situation, such as a rear-end crash.¶

ND time-related parameters, such as router lifetime and Neighbor Advertisement (NA) interval, need to be adjusted for vehicle speed and vehicle density. For example, the NA interval needs to be dynamically adjusted according to a vehicle's speed so that the vehicle can maintain its position relative to its neighboring vehicles in a stable way, considering the collision probability with the NA messages sent by other vehicles. The ND time-related parameters can be an operational setting or an optimization point particularly for vehicular networks. Note that the link-scope multicast messages in the ND protocol may cause a performance issue in vehicular networks. [RFC9119] suggests several optimization approaches for the issue.¶

For IPv6-based safety applications (e.g., context-aware navigation, adaptive cruise control, and platooning) in vehicular networks, the delay-bounded data delivery is critical. IPv6 ND needs to work to support those IPv6-based safety applications efficiently. [VEHICULAR-ND] introduces a Vehicular Neighbor Discovery (VND) process as an extension of IPv6 ND for IP-based vehicular networks.¶

From the interoperability point of view, in IPv6-based vehicular networking, IPv6 ND should have minimum changes from the legacy IPv6 ND used in the Internet, including DAD and NUD operations, so that IPv6-based vehicular networks can be seamlessly connected to other intelligent transportation elements (e.g., traffic signals, pedestrian wearable devices, electric scooters, and bus stops) that use the standard IPv6 network settings.¶

5.2. Mobility Management

The seamless connectivity and timely data exchange between two endpoints requires efficient mobility management including location management and handover. Most vehicles are equipped with a GNSS receiver as part of a dedicated navigation system or a corresponding smartphone app. Note that the GNSS receiver may not provide vehicles with accurate location information in adverse environments, such as a building area or a tunnel. The location precision can be improved with assistance of the IP-RSUs or a cellular system with a GNSS receiver for location information.¶

With a GNSS navigator, efficient mobility management can be performed with the help of vehicles periodically reporting their current position and trajectory (i.e., navigation path) to the vehicular infrastructure (having IP-RSUs and an MA in TCC). This vehicular infrastructure can predict the future positions of the vehicles from their mobility information (e.g., the current position, speed, direction, and trajectory) for efficient mobility management (e.g., proactive handover). For a better proactive handover, link-layer parameters, such as the signal strength of a link-layer frame (e.g., Received Channel Power Indicator (RCPI) [VIP-WAVE]), can be used to determine the moment of a handover between IP-RSUs along with mobility information.¶

By predicting a vehicle's mobility, the vehicular infrastructure needs to better support IP-RSUs to perform efficient SLAAC, data forwarding, horizontal handover (i.e., handover in wireless links using a homogeneous radio technology), and vertical handover (i.e., handover in wireless links using heterogeneous radio technologies) in advance along with the movement of the vehicle.¶

For example, as shown in Figure 1, when a vehicle (e.g., Vehicle2) is moving from the coverage of an IP-RSU (e.g., IP-RSU1) into the coverage of another IP-RSU (e.g., IP-RSU2) belonging to a different subnet, the IP-RSUs can proactively support the IPv6 mobility of the vehicle while performing the SLAAC, data forwarding, and handover for the sake of the vehicle.¶

For a mobility management scheme in a domain, where the wireless subnets of multiple IP-RSUs share the same prefix, an efficient vehicular-network-wide DAD is required. On the other hand, for a mobility management scheme with a unique prefix per mobile node (e.g., PMIPv6 [RFC5213]), DAD is not required because the IPv6 address of a vehicle's external wireless interface is guaranteed to be unique. There is a trade-off between the prefix usage efficiency and DAD overhead. Thus, the IPv6 address autoconfiguration for vehicular networks needs to consider this trade-off to support efficient mobility management.¶

Even though SLAAC with classic ND costs DAD overhead during mobility management, SLAAC with the registration extension specified in [RFC8505] and/or with AERO/OMNI does not cost DAD overhead. SLAAC for vehicular networks needs to consider the minimization of the cost of DAD with the help of an infrastructure node (e.g., IP-RSU and MA). Using an infrastructure prefix over VANET allows direct routability to the Internet through the multihop V2I toward an IP-RSU. On the other hand, a BYOA does not allow such direct routability to the Internet since the BYOA is not topologically correct, that is, not routable in the Internet. In addition, a vehicle configured with a BYOA needs a tunnel home (e.g., IP-RSU) connected to the Internet, and the vehicle needs to know which neighboring vehicle is reachable inside the VANET toward the tunnel home. There is non-negligible control overhead to set up and maintain routes to such a tunnel home [RFC4888] over the VANET.¶

For the case of a multihomed network, a vehicle can follow the first-hop router selection rule described in [RFC8028]. For example, an IP-OBU inside a vehicle may connect to an IP-RSU that has multiple routers behind. In this scenario, because the IP-OBU can have multiple prefixes from those routers, the default router selection, source address selection, and packet redirect process should follow the guidelines in [RFC8028]. That is, the vehicle should select its default router for each prefix by preferring the router that advertised the prefix.¶

Vehicles can use the TCC as their Home Network having a home agent for mobility management as in MIPv6 [RFC6275], PMIPv6 [RFC5213], and NEMO [RFC3963], so the TCC (or an MA inside the TCC) maintains the mobility information of vehicles for location management. Also, in vehicular networks, asymmetric links sometimes exist and must be considered for wireless communications, such as V2V and V2I. [VEHICULAR-MM] discusses a Vehicular Mobility Management (VMM) scheme to proactively do handover for vehicles.¶

Therefore, for the proactive and seamless IPv6 mobility of vehicles, the vehicular infrastructure (including IP-RSUs and MA) needs to efficiently perform the mobility management of the vehicles with their mobility information and link-layer information. Also, in IPv6-based vehicular networking, IPv6 mobility management should have minimum changes for the interoperability with the legacy IPv6 mobility management schemes, such as PMIPv6, DMM, LISP, and AERO.¶

6.1. Security Threats in Neighbor Discovery

For the classical IPv6 ND (i.e., the legacy ND), DAD is required to ensure the uniqueness of the IPv6 address of a vehicle's wireless interface. This DAD can be used as a flooding attack that uses the DAD-related ND packets disseminated over the VANET or vehicular networks. [RFC6959] introduces threats enabled by IP source address spoofing. This possibility indicates that vehicles and IP-RSUs need to filter out suspicious ND traffic in advance. [RFC8928] introduces a mechanism that protects the ownership of an address for 6LoWPAN ND from address theft and impersonation attacks. Based on the SEND mechanism [RFC3971], the authentication for routers (i.e., IP-RSUs) can be conducted by only selecting an IP-RSU that has a certification path toward trusted parties. For authenticating other vehicles, Cryptographically Generated Addresses (CGAs) can be used to verify the true owner of a received ND message, which requires using the CGA ND option in the ND protocol. This CGA can protect vehicles against DAD flooding by DAD filtering based on the verification for the true owner of the received DAD message. For a general protection of the ND mechanism, the RSA Signature ND option can also be used to protect the integrity of the messages by public key signatures. For a more advanced authentication mechanism, a distributed blockchain-based approach [Vehicular-BlockChain] can be used. However, for a scenario where a trustable router or an authentication path cannot be obtained, it is desirable to find a solution in which vehicles and infrastructure nodes can authenticate each other without any support from a third party.¶

When applying the classical IPv6 ND process to VANET, one of the security issues is that an IP-RSU (or IP-OBU) as a router may receive deliberate or accidental DoS attacks from network scans that probe devices on a VANET. In this scenario, the IP-RSU (or IP-OBU) can be overwhelmed by processing the network scan requests so that the capacity and resources of the IP-RSU (or IP-OBU) are exhausted, causing the failure of receiving normal ND messages from other hosts for network address resolution. [RFC6583] describes more about the operational problems in the classical IPv6 ND mechanism that can be vulnerable to deliberate or accidental DoS attacks and suggests several implementation guidelines and operational mitigation techniques for those problems. Nevertheless, for running IPv6 ND in VANET, those issues can be acuter since the movements of vehicles can be so diverse that there is a wider opportunity for rogue behaviors, and the failure of networking among vehicles may lead to grave consequences.¶

Strong security measures shall protect vehicles roaming in road networks from the attacks of malicious nodes that are controlled by hackers. For safe driving applications (e.g., context-aware navigation, cooperative adaptive cruise control, and platooning), as explained in Section 3.1, the cooperative action among vehicles is assumed. Malicious nodes may disseminate wrong driving information (e.g., location, speed, and direction) for disturbing safe driving. For example, a Sybil attack, which tries to confuse a vehicle with multiple false identities, may disturb a vehicle from taking a safe maneuver. Since cybersecurity issues in vehicular networks may cause physical vehicle safety issues, it may be necessary to consider those physical safety concerns when designing protocols in IPWAVE.¶

To identify malicious vehicles among vehicles, an authentication method may be required. A Vehicle Identification Number (VIN) (or a vehicle manufacturer certificate) and a user certificate (e.g., X.509 certificate [RFC5280]) along with an in-vehicle device's identifier generation can be used to efficiently authenticate a vehicle or its driver (having a user certificate) through a road infrastructure node (e.g., IP-RSU) connected to an authentication server in the Vehicular Cloud. This authentication can be used to identify the vehicle that will communicate with an infrastructure node or another vehicle. In the case where a vehicle has an internal network (called a mobile network) and elements in the network (e.g., in-vehicle devices and a user's mobile devices), as shown in Figure 2, the elements in the network need to be authenticated individually for safe authentication. Also, Transport Layer Security (TLS) certificates [RFC8446] [RFC5280] can be used for an element's authentication to allow secure E2E vehicular communications between an element in a vehicle and another element in a server in a Vehicular Cloud or between an element in a vehicle and another element in another vehicle.¶

6.2. Security Threats in Mobility Management

For mobility management, a malicious vehicle can construct multiple virtual bogus vehicles and register them with IP-RSUs and MAs. This registration makes the IP-RSUs and MAs waste their resources. The IP-RSUs and MAs need to determine whether a vehicle is genuine or bogus in mobility management. Also, for the confidentiality of control packets and data packets between IP-RSUs and MAs, the E2E paths (e.g., tunnels) need to be protected by secure communication channels. In addition, to prevent bogus IP-RSUs and MAs from interfering with the IPv6 mobility of vehicles, mutual authentication among the IP-RSUs, MAs, and vehicles needs to be performed by certificates (e.g., TLS certificate).¶

6.3. Other Threats

For the setup of a secure channel over IPsec or TLS, the multihop V2I communications over DSRC or 5G V2X (or LTE V2X) is required on a highway. In this case, multiple intermediate vehicles as relay nodes can help to forward association and authentication messages toward an IP-RSU (or gNodeB/eNodeB) connected to an authentication server in the Vehicular Cloud. In this kind of process, the authentication messages forwarded by each vehicle can be delayed or lost, which may increase the construction time of a connection or cause some vehicles to not be able to be authenticated.¶

Even though vehicles can be authenticated with valid certificates by an authentication server in the Vehicular Cloud, the authenticated vehicles may harm other vehicles. To deal with this kind of security issue, for monitoring suspicious behaviors, vehicles' communication activities can be recorded in either a centralized approach through a logging server (e.g., TCC) in the Vehicular Cloud or a decentralized approach (e.g., an ECD and blockchain [Bitcoin]) by the help of other vehicles and infrastructure.¶

There are trade-offs between centralized and decentralized approaches in logging of vehicles' behaviors (e.g., location, speed, direction, acceleration/deceleration, and lane change) and communication activities (e.g., transmission time, reception time, and packet types, such as TCP, UDP, SCTP, QUIC, HTTP, and HTTPS). A centralized approach is more efficient than a decentralized approach in terms of log data collection and processing in a central server in the Vehicular Cloud. However, the centralized approach may cause a higher delay than a decentralized approach in terms of the analysis of the log data and counteraction in a local ECD or a distributed database like a blockchain. The centralized approach stores log data collected from VANET into a remote logging server in a Vehicular Cloud as a central cloud, so it takes time to deliver the log data to a remote logging server. On the other hand, the decentralized approach stores the log data into a nearby edge computing device as a local logging server or a nearby blockchain node, which participates in a blockchain network. On the stored log data, an analyzer needs to perform a machine learning technique (e.g., deep learning) and seek suspicious behaviors of the vehicles. If such an analyzer is located either within or near the edge computing device, it can access the log data with a short delay, analyze it quickly, and generate feedback to allow for a quick counteraction against such malicious behaviors. On the other hand, if the Vehicular Cloud with the log data is far away from a problematic VANET with malicious behaviors, the centralized approach takes a longer time with the analysis of the log data and the decision-making on malicious behaviors than the decentralized approach. If the log data is encrypted by a secret key, it can be protected from the observation of a hacker. The secret key sharing among legal vehicles, ECDs, and Vehicular Clouds should be supported efficiently.¶

Log data can release privacy breakage of a vehicle. The log data can contain the MAC address and IPv6 address for a vehicle's wireless network interface. If the unique MAC address of the wireless network interface is used, a hacker can track the vehicle with that MAC address and can track the privacy information of the vehicle's driver (e.g., location information). To prevent this privacy breakage, a MAC address pseudonym can be used for the MAC address of the wireless network interface, and the corresponding IPv6 address should be based on such a MAC address pseudonym. By solving a privacy issue of a vehicle's identity in logging, vehicles may observe each other's activities to identify any misbehaviors without privacy breakage. Once identifying a misbehavior, a vehicle shall have a way to either isolate itself from others or isolate a suspicious vehicle by informing other vehicles.¶

For completely secure vehicular networks, we shall embrace the concept of "zero-trust" for vehicles where no vehicle is trustable and verifying every message (such as IPv6 control messages including ND, DAD, NUD, and application-layer messages) is necessary. In this way, vehicular networks can defend against many possible cyberattacks. Thus, we need to have an efficient zero-trust framework or mechanism for vehicular networks.¶

For the non-repudiation of the harmful activities from malicious vehicles, as it is difficult for other normal vehicles to identify them, an additional and advanced approach is needed. One possible approach is to use a blockchain-based approach [Bitcoin] as an IPv6 security checking framework. Each IPv6 packet from a vehicle can be treated as a transaction, and the neighboring vehicles can play the role of peers in a consensus method of a blockchain [Bitcoin] [Vehicular-BlockChain]. For a blockchain's efficient consensus in vehicular networks having fast-moving vehicles, either a new consensus algorithm needs to be developed, or an existing consensus algorithm needs to be enhanced. In addition, a consensus-based mechanism for the security of vehicular networks in the IPv6 layer can also be considered. A group of servers as blockchain infrastructure can be part of the security checking process in the IP layer.¶

To prevent an adversary from tracking a vehicle with its MAC address or IPv6 address, especially for a long-living transport-layer session (e.g., voice call over IP and video streaming service), a MAC address pseudonym needs to be provided to each vehicle; that is, each vehicle periodically updates its MAC address, and the vehicle's IPv6 address needs to be updated accordingly by the MAC address change [RFC4086] [RFC8981]. Such an update of the MAC and IPv6 addresses should not interrupt the E2E communications between two vehicles (or between a vehicle and an IP-RSU) for a long-living transport-layer session. However, if this pseudonym is performed without strong E2E confidentiality (using either IPsec or TLS), there will be no privacy benefit from changing MAC and IPv6 addresses because an adversary can observe the change of the MAC and IPv6 addresses and track the vehicle with those addresses. Thus, the MAC address pseudonym and the IPv6 address update should be performed with strong E2E confidentiality.¶

The privacy exposure to the TCC via V2I is mostly about the location information of vehicles and may also include other in-vehicle activities, such as transactions of credit cards. The assumed, trusted actors are the owner of a vehicle, an authorized vehicle service provider (e.g., navigation service provider), and an authorized vehicle manufacturer for providing after-sales services. In addition, privacy concerns for excessively collecting vehicle activities from roadway operators, such as public transportation administrators and private contractors, may also pose threats on violating privacy rights of vehicles. It might be interesting to find a solution from a technological point of view along with public policy development for the issue.¶

The "multicasting" of the location information of a VRU's smartphone means IPv6 multicasting. There is a possible security attack related to this multicasting. Attackers can use "fake identifiers" as source IPv6 addresses of their devices to generate IPv6 packets and multicast them to nearby vehicles in order to cause confusion that those vehicles are surrounded by other vehicles or pedestrians. As a result, navigation services (e.g., Google Maps [Google-Maps] and Waze [Waze]) can be confused with fake road traffic by those vehicles or smartphones with "fake identifiers" [Fake-Identifier-Attack]. This attack with "fake identifiers" should be detected and handled by vehicular networks. To cope with this attack, both legal vehicles and legal VRUs' smartphones can be registered with a TCC and their locations can be tracked by the TCC. With this tracking, the TCC can tell the road traffic conditions caused by those vehicles and smartphones. In addition, to prevent hackers from tracking the locations of those vehicles and smartphones, either a MAC address pseudonym [MAC-ADD-RAN] or secure IPv6 address generation [RFC7721] can be used to protect the privacy of those vehicles and smartphones.¶