Replay-Resistant Admission and Permissioned Quorum Consensus in Connected Vehicle Networks: A Fail-Closed, Implementation-Grounded Security Study

Imagine a city where every car, traffic light, and road sign can talk to one another instantly, sharing information about accidents, weather, and traffic jams to keep everyone safe. This is the promise of connected vehicle networks, a technology that relies on a constant stream of digital messages flying through the air. However, this open radio environment is vulnerable. A bad actor could pretend to be a car, send the same message over and over again to cause confusion, or trick the system into accepting a false report. To make this technology work, engineers must solve three specific problems: deciding who is allowed to join the conversation, ensuring that a message is new and not a recycled old one, and verifying that the people voting on what to do next are actually the authorized officials.

A new study by Md Shahanur Islam Shagor from Voronezh State University of Forestry and Technologies tackles these exact challenges. The research focuses on a specific security system called OmniGuard, designed to manage how vehicles join a network and how they reach agreements on shared information. Rather than trying to build a perfect, unbreakable system that works in every imaginable disaster scenario, the researchers built a practical, controlled environment. They created a "fail-closed" design, which means that if the system gets confused or overwhelmed, it simply stops accepting new inputs rather than making a risky guess. The study tests whether this approach can successfully block fake identities, stop replayed messages, and ensure that only the right people can vote on critical decisions, all while being transparent about where the system's limits lie.

The researchers started by separating the idea of "being real" from "being allowed." In many systems, if a car proves it has a valid digital ID, it is immediately let in. Here, the system takes a stricter approach. Even if a car has a perfect digital ID, it is still denied entry unless it is on a specific, pre-approved list managed by a registry. This registry acts like a gatekeeper that checks a master list of authorized vehicles. If a car tries to join without being on that list, or if the list is missing, the system automatically rejects the connection. This prevents a situation where a misconfigured system accidentally opens the door to anyone. Once a car is admitted, the system binds its connection to its specific identity. This means a car cannot borrow another vehicle's credentials to sneak into a voting session.

Next, the team addressed the problem of replay attacks, where a hacker captures a valid message and sends it again later to trick the system. To stop this, the system keeps a memory of every message it has seen recently, identified by a unique code called a nonce. If a message arrives with a code the system has already seen, it is rejected as a duplicate. The researchers designed the system to handle a flood of these unique codes in a very specific way. The memory for these codes has a fixed size, like a bucket that can hold only a certain amount of water. If a hacker tries to fill the bucket with thousands of new, unique codes to force the system to forget old ones, the system does not throw anything out. Instead, when the bucket is full, it simply stops accepting any new codes until the old ones naturally expire. This ensures that a valid message already in the system remains safe from being replayed, even if the system is under heavy attack, though it does mean that legitimate new traffic might be temporarily blocked during the flood.

The core of the study involves how these vehicles reach a decision. The system uses a group of authorized validators to vote on proposals, such as changing a traffic rule or confirming a safety alert. The researchers set up a rule where a proposal is only accepted if a specific majority of the validators vote yes. In their test setup with three validators, two votes were needed to pass a decision. The system checks that every vote comes from a validator who is currently on the list, that the vote is for the correct time period, and that the vote has not been cast twice. To ensure the votes are genuine, each one is signed with a secret key known only to that validator. If a hacker tries to change the content of a vote or pretend to be a different validator, the signature will not match, and the system will reject it.

To prove that this design works, the researchers ran a series of rigorous tests. They created a scenario where a computer acted as an attacker, trying to break the system in 192 different ways. The attacker tried to change the hash of a proposal, swap the time period, use a fake identity, corrupt the digital signature, or send a message from a validator who had already voted. In every single one of these 192 attempts, the system correctly identified the error and rejected the vote. The researchers then tested the system with valid votes. When two authorized validators cast correct votes, the system accepted them and finalized the decision. When a third vote was attempted after the decision was already made, the system correctly rejected it, preventing the outcome from being changed. A separate test confirmed that when the memory for message codes filled up, the system rejected new traffic without deleting the evidence of old, valid messages, keeping the replay protection intact.

The study also made it clear what this system cannot do. It is not designed to stop a group of authorized validators from acting together maliciously. If enough of the approved validators decide to vote for a bad idea, the system will accept it, because it trusts the majority of its authorized members. The researchers explicitly state that this is not a "Byzantine fault-tolerant" system, a term used for protocols that can withstand a certain number of traitors within a group. Instead, this system relies on the assumption that the people managing the list of authorized validators are trustworthy and that the list itself is secure. If the registry is compromised, the security of the whole network is compromised.

The results show that for a controlled, permissioned network of connected vehicles, this approach provides a solid, testable layer of security. It successfully separates the tasks of joining the network, proving freshness, and voting, ensuring that a failure in one area does not cascade into a total collapse. The system is designed to be transparent about its boundaries: it will block outsiders, stop replayed messages, and prevent double-voting, but it requires human oversight to manage the list of who is allowed to vote. By testing the system with a high volume of simulated attacks and recording zero unexpected failures, the researchers demonstrated that their design is robust against the specific threats it was built to handle. This work provides a clear, reproducible blueprint for how connected vehicle networks can manage trust and coordination without relying on complex, unproven theories, offering a practical path forward for safer, more secure roads.