Georgia Lykou

George Stergiopoulos

Antonios Papachrysanthou

Dimitris Gritzalis

Protecting the transportation sector from the negative impacts of climate change

Keywords: Climate change, transportation sector, adaptation options 1

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Modeling studies indicate that global average temperatures will increase more than two degrees Celsius over the next century [START_REF] Burkett | Point of departure, in Climate Change 2014: Impacts, Adaptation and Vulnerability, Part A: Global and Sectoral Aspects, Contribution of Working Group II to the Fifth Assessment Report of the Intergovernmental Panel on Climate Change[END_REF]. The United Nations Intergovernmental Panel on Climate Change (IPCC) [START_REF] Allen | Summary for policymakers, in Managing the Risks of Extreme Events and Disasters to Advance Climate Change Adaptation, Special Report of the Intergovernmental Panel on Climate Change[END_REF] has provided evidence that these changes will have significant implications on extreme weather events, economic development and stability, population and environmental health. Climate change concerns with regard to the critical infrastructure focus on climate variations and extreme weather events that will increase in magnitude, frequency and/or duration [START_REF] Burkett | Point of departure, in Climate Change 2014: Impacts, Adaptation and Vulnerability, Part A: Global and Sectoral Aspects, Contribution of Working Group II to the Fifth Assessment Report of the Intergovernmental Panel on Climate Change[END_REF]. Critical infrastructure assets are typically designed to withstand weather-related stressors common in specific localities, but shifts in climate patterns increase the ranges and types of potential risks. Most infrastructure assets that are being constructed today are expected to last for decades or even centuries [START_REF] Mclean | Modeling and Simulation of Critical Infrastructure Systems for Homeland Security Applications[END_REF]. Investing in infrastructures that are not designed to cope with climate change will almost certainly result in significant increases in future costs and amplify the potential for unplanned outages and failures.

Transportation is a critical infrastructure that supports the smooth functioning of society and the prosperity and viability of local, regional and national economies [START_REF] Transportation | Potential Impacts of Climate Change on U[END_REF]. It facilitates access to services that are vital to commerce and the quality of human life. Gradual climate changes such as increases in temperature, sea level and rainfall along with the projected growth in the frequency and intensity of extreme weather events will seriously challenge the transportation sector. While mitigation efforts are of great importance, critical infrastructures such as transportation must be adapted to reduce the emission of anthropogenic gases and their contributions to climate change.

This research examines a number of climate change adaptation approaches, strategies and action plans with the goal of understanding adaptation measures that are applicable to the transportation sector. Also, it provides a detailed classification and analysis of each adaptation measure according to established methodologies. It focuses on the impacts on the transportation sector and examines national and sectoral adaptation plans for best practices and efficient adaptation options.

Transportation Sector

Transportation involves the movement of people and goods from one location to another [START_REF]European Commission, Roadmap to a Single European Transport Area -Towards a Competitive and Resource-Efficient Transport System, Directorate-General for Mobility and Transport[END_REF]. The transportation sector comprises: (i) transportation infrastructure -fixed installations such as roads, railroads, bridges, canals, pipelines and terminals (e.g., airports, railroad stations, bus stations and seaports); (ii) vehicles -cars, buses, trucks, railroad cars and locomotives, ships, aircraft, drones, etc.; and (iii) operations -people, institutions, laws, policies and information systems that transform infrastructure and vehicles into working transportation networks [START_REF] Bierbaum | Adaptation[END_REF]. Modes of transportation include road, rail, pipelines, water, air and space.

Transportation activities are the result of bringing together diverse resources. Service providers put together these resources to provide different modes of transportation that collectively offer a variety of transportation services to customers. Regulators at various administrative levels provide the basic rules to enable transportation operations to run smoothly, efficiently and with minimal impacts [START_REF]European Commission, Roadmap to a Single European Transport Area -Towards a Competitive and Resource-Efficient Transport System, Directorate-General for Mobility and Transport[END_REF]. Finally, the numerous users of the transportation modes make their choices and shape the demand for transportation.

Disruptions to transportation systems can cause large economic and human losses. For this reason, the transportation sector is characterized as a critical infrastructure -an important pillar of economy and society [START_REF]Adaptation of Transport to Climate Change in Europe -Challenges and Options Across Transport Modes and Stakeholders[END_REF]. Since most stakeholders may only have a partial perspective of the transportation systems they manage or use [START_REF] Transportation | Potential Impacts of Climate Change on U[END_REF], without a national protection strategy, the stakeholders would react autonomously and in an uncoordinated manner to address the challenges imposed by climate change. Given the broad impacts of climate variations and the strong interconnectivity within the transportation sector, such a fragmented approach would lead to great inefficiencies and negative impacts on the sustainability and resilience of the transportation infrastructure.

Climate Change Impacts on Transportation

Rising temperatures and extended periods of heatwaves increase rail buckling, road pavement deterioration and thermal discomfort for vehicular passengers [START_REF]Adaptation of Transport to Climate Change in Europe -Challenges and Options Across Transport Modes and Stakeholders[END_REF]. Weather extremes cause floods and landslides that result in short-term delays and interruptions in multiple transportation modes as well as long-term interruptions and detours when land-side infrastructures are damaged or destroyed. Sea-level rise threatens harbors and other transportation infrastructure assets and services in coastal areas. Air transport is impacted by changing wind patterns, floods and other extreme weather events. Additionally, climate impacts can trigger changes to society (e.g., different tourist destinations) and the economy (e.g., reduced agricultural production). Tables 1 and2 present the climatic events and risks of climate change for various transportation modes based on a literature analysis [START_REF] Transportation | Potential Impacts of Climate Change on U[END_REF][START_REF]Adaptation of Transport to Climate Change in Europe -Challenges and Options Across Transport Modes and Stakeholders[END_REF][START_REF] Stergiopoulos | Risk mitigation strategies for critical infrastructures based on graph centrality analysis[END_REF].

The effects of malfunctions, disturbances and broken transportation links may stretch far beyond the originally-affected areas [START_REF] Stergiopoulos | Time-based critical infrastructure dependency analysis for largescale and cross-sectoral failures[END_REF]. The transportation system has a transboundary character and is highly interconnected within and across the various transportation modes; hence, disturbances in one portion of a transportation network could have domino effects in other parts of the network [START_REF] Mclean | Modeling and Simulation of Critical Infrastructure Systems for Homeland Security Applications[END_REF]. The effects typically involve service disruptions that prevent the movement of passengers and goods. The interdependencies could result in losses that are many times higher than the direct costs to the transportation sector itself [START_REF] Transportation | Potential Impacts of Climate Change on U[END_REF][START_REF] Kotzanikolaou | Accessing n-order dependencies between critical infrastructures[END_REF].

The European Joint Research Centre [START_REF] Forzieri | Resilience of Large Investments and Critical Infrastructures in Europe to Climate Change, Final Report for DG CLIMA[END_REF] has presented a comprehensive quantitative assessment of the impacts of current and future climate extremes on critical infrastructures in Europe. The dynamics of climate hazards were analyzed throughout the 21st century using physical models and adaptation tools. The assessment reveals that damage in Europe as a result of climate extremes could triple by the 2020s and amount to more than ten times the current damage of 3.4 billion euros per year by 2100. According to the study, heat waves will cause the most damage, primarily to roads and railroad tracks. These transportation modes will also suffer losses from coastal flooding, which will increase drastically over time. Inland waterway transport will be impacted by droughts while sea-level rise and increased storm surges will significantly increase the damage to ports. These projections create an urgent need to develop and implement an adaptation approach with a long-term, systemic perspective.

Approaches for Climate Change Adaptation

Adaptation involves actions that respond to current and future climate change impacts and vulnerabilities [START_REF]Adaptation in Europe -Addressing Risks and Opportunities from Climate Change in the Context of Socio-Economic Developments[END_REF]. This involves protecting against the negative impacts of climate change as well as building resilience and leveraging any benefits it may provide. This section discusses adaptation assessment, adaptation options and classification, and global adaptation initiatives.

Adaptation Assessment

Adaptation assessment is the practice of identifying options to adjust to climate change and evaluating them based on criteria such as availability, benefits, costs, effectiveness, efficiency and feasibility [START_REF] Burkett | Point of departure, in Climate Change 2014: Impacts, Adaptation and Vulnerability, Part A: Global and Sectoral Aspects, Contribution of Working Group II to the Fifth Assessment Report of the Intergovernmental Panel on Climate Change[END_REF]. Two main types of analyses are used to assess potential adaptation: (i) identification of adaptation options; and (ii) evaluation of adaptation options [START_REF] Niang-Diop | Formulating an adaptation strategy, in Adaptation Policy Frameworks for Climate Change: Developing Strategies[END_REF]:

Identification of Adaptation Options: Adaptation options are intended to address climate vulnerabilities and build resilience by reduc-ing the negative impacts to acceptable levels. Adaptation options may also leverage positive opportunities that arise from climate change [START_REF]United Kingdom Climate Impacts Programme, Identifying Adaptation Options[END_REF]. Adaptation options range from actions that build adaptive capacity (e.g., sharing information and creating supportive institutional frameworks) to concrete adaptation measures (e.g., technical solutions, warning systems and insurance mechanisms). Limits to adaptation options are imposed by the specific times when the actions can be implemented and the geographical locations where the actions may be executed. Additionally, there exist inherent limits and uncertainty about the extent to which the actions can enhance the adaptive capacity and protect regions, economic sectors and communities. It is also challenging to decide on the most appropriate protection levels to implement based on the knowledge of current and projected climate change impacts and damage costs.

Evaluation of Adaptation Options:

After a set of adaptation options has been identified, the next step is to evaluate the options in order to guide decisions regarding their selection and implementation. World Resources Institute and World Bank guidance documents [START_REF]The National Adaptive Capacity Framework: Key Institutional Functions for a Changing Climate Institute, Pilot Draft[END_REF] list several criteria for evaluating the suitability of an adaptation option in contributing to an objective: (i) cost analysis, including total costs and cost effectiveness; (ii) environmental implications; (iii) secondary or cross-sectoral impacts, externalities or co-benefits; (iv) social implications, including implications for sensitive groups; (v) short-, medium-and long-term efficacy; (vi) effectiveness at reducing the impacts of extreme events; (vii) effectiveness under different climate scenarios; (viii) limiting factors for implementation and sustainability (e.g., resource constraints); (ix) consultation with a broad set of stakeholders; (x) provision for reviewing options based on changing assessments of risk; and (xi) transparency in the process and justification of option selection.

Classification of Adaptation Options

The European Environment Agency [START_REF]Adaptation in Europe -Addressing Risks and Opportunities from Climate Change in the Context of Socio-Economic Developments[END_REF] classifies adaptation actions into three broad categories:

Green Actions: These actions involve ecosystem-based approaches that leverage nature-provided services to achieve cost effective and possibly more feasible adaptation solutions. Examples include green earthworks to combat landslides, renewable energy sources and low energy demand infrastructures.

Soft Actions: These actions involve managerial, legal and policy approaches that alter human behavior and governance styles such as new policies and procedures, land-use controls, information dissemination and economic incentives that reduce or prevent disaster vulnerability. Examples include legislation, standards and best practices, and public information campaigns.

Gray Actions: These actions involve various technological and engineering solutions for infrastructure, corresponding to physical interventions, construction measures and using engineering services to enable infrastructures to withstand extreme events. Examples include coastal and river flood defenses, early warning systems, redundant equipment and networks.

Green and soft actions specifically focus on decreasing the sensitivity and increasing the adaptive capacity of human and natural systems to foster resilience; these actions are often less resource intensive and provide multiple benefits. Gray actions involve innovative technological solutions that typically cost more and require more research, experience and training to be implemented.

Adaptation has an extremely important role in reducing the economic costs of climate change. While adaptation has a cost, it significantly reduces the financial consequences of inaction and, in many cases, provides benefits that dramatically outweigh the costs [START_REF]Adaptation of Transport to Climate Change in Europe -Challenges and Options Across Transport Modes and Stakeholders[END_REF]. Since it is important to enable cost-effective and proportionate adaptation to climate change, options that can achieve adaptation while minimizing the associated risks and uncertainties are especially appropriate.

In addressing adaptation risk and uncertainty, the United Kingdom Climate Impacts Programme (UKCIP) [START_REF]United Kingdom Climate Impacts Programme, Identifying Adaptation Options[END_REF], categorizes options as no regrets, low regrets, win-win and adaptive/flexible management options that target incremental adaptation:

No Regret Adaptation Options: These adaptation actions are worthwhile regardless of the extent of future climate change. They include justified and cost-effective measures under current climate conditions that are further justified when their introduction is consistent with addressing risks associated with projected climate changes.

Low Regret Adaptation Options: These adaptation actions have relatively low costs and their benefits, although primarily realized under projected climate changes, may be relatively large.

Win-Win Adaptation Options:

These adaptation actions minimize climate risks and exploit potential opportunities; additionally, they support mitigation and other social and environmental objectives. Some of these actions may have been introduced for reasons other than addressing climate risks, but they also deliver the desired adaptation benefits.

Adaptive Management Options: These adaptation actions are incremental and flexible, and do not effect large-scale adaptation. The actions are based on assessments of the current environment, but are designed for incremental change (including changing the direction) as knowledge, experience and technology evolve.

In contrast, maladaptation options hinder or reduce climate change adaptation and must be avoided to the extent possible: Maladaptation Options: These maladaptation actions: (i) do not increase resilience and adaptive capacity or do not reduce vulnerabilities; (ii) are not sustainable from an environmental, economic or social perspective (e.g., over-exploitation of water resources); or (iii) conflict with other long-term policy objectives.

Maladaptation can be prevented by considering the climatic and socioeconomic elements that constitute vulnerabilities to climate change.

Global Adaptation Initiatives

A variety of adaptation initiatives are underway around the world. The U.S. Department of Homeland Security has developed a climate change adaptation roadmap and climate action plan that align with the President's climate action plan, preparing the United States for the impacts of climate change [START_REF] Bierbaum | Adaptation[END_REF]. As of 2016, fifteen states have published climate adaptation plans.

The European strategy for adaptation to climate change sets out a framework and mechanisms to prepare for current and future impacts [START_REF]An EU Strategy on Adaptation to Climate Change[END_REF]. The strategy encourages and supports actions by European Union member states and creates a basis for informed decision-making on adaptation in the years to come. The majority of the member states have adopted national adaptation plans and strategies that outline their implemented and planned actions to facilitate the adaptation of transportation and other sectors to climate change.

The Australian Government has developed the ACT Climate Change Adaptation Strategy that coordinates efforts focused on adapting to climate change. This strategy identifies key adaptation policies to enable communities to become more resilient by communicating the risks and impacts of climate change and incorporating climate change risk considerations and adaptation actions in government policies.

Adaptation in the Transportation Sector

This section, which constitutes the core of the chapter, identifies and analyzes climate change adaptation actions in the transportation sector. The actions are drawn from national adaptation strategies and relevant publications such as U.S. Government reports, European Union directives and publiclyavailable adaptation action plans [START_REF] Bierbaum | Adaptation[END_REF][START_REF] Eurocontrol | Challenges of Growth 2013, Task 8: Climate Change Risk and Resilience[END_REF][START_REF]Adaptation of Transport to Climate Change in Europe -Challenges and Options Across Transport Modes and Stakeholders[END_REF][START_REF]Railway Safety and Standards Board, Tomorrow's Railway and Climate Change Adaptation (T1009)[END_REF][START_REF] Wall | Risk-Based Adaptation Frameworks for Climate Change Planning in the Transportation Sector: A Synthesis of Practice[END_REF].

This section also introduces and categorizes the adaptation options for the transportation sector using the classification categories discussed above. Seven types of options are analyzed, each dealing with a different aspect of adaptation: (i) effective governance; (ii) infrastructure planning; (iii) redundancies within and between transportation modes; (iv) operational contingencies; (v) early warning systems; (vi) building adaptive capacity; and (vii) collaboration. In the following, each adaptation option is presented along with a table that summarizes the classification of the adaptation options. The presentation and classification of adaptation actions are intended to stimulate further research and discussion by transportation sector stakeholders.

Adaptation to Climate Change

The transportation sector routinely deals with extreme events that cause disruptions, whether they stem from natural hazards or human-initiated events such as accidents and power outages, and has developed resilience strategies. Therefore, the adaptation of transportation systems to climate change requires a wide perspective that embeds adaptation in broader transition strategies [START_REF]Adaptation of Transport to Climate Change in Europe -Challenges and Options Across Transport Modes and Stakeholders[END_REF] instead of leaving it to be implemented by individual stakeholders such as infrastructure owners/operators or regulatory authorities.

Transportation is specifically addressed in most of the national strategies and plans studied in this research. The national strategies and plans primarily focus on the transportation infrastructure and aspects of transportation services, such as the development of alternative routes and means of transportation, traffic management, reviews of technical conditions of vehicles and vehicular operations, and support to transportation infrastructure owners/operators in developing their adaptation assessments and actions. The literature (see, e.g., [START_REF] Wall | Risk-Based Adaptation Frameworks for Climate Change Planning in the Transportation Sector: A Synthesis of Practice[END_REF]) reveals that stakeholders such as railroad companies [START_REF]Railway Safety and Standards Board, Tomorrow's Railway and Climate Change Adaptation (T1009)[END_REF], airports and port authorities, and air traffic control operators [START_REF] Eurocontrol | Challenges of Growth 2013, Task 8: Climate Change Risk and Resilience[END_REF] are well aware of the potential climate change impacts and the need to adapt, and have started taking action. The prospects of significant reconstruction costs, lengthy recovery processes and severe disruptions have influenced transportation infrastructure owners/operators to undertake comprehensive assessments of their assets.

Effective Governance for Adaptation

The primary role of government is to enable adaptation actions at the local and regional levels by creating an appropriate framework [START_REF]European Commission, Roadmap to a Single European Transport Area -Towards a Competitive and Resource-Efficient Transport System, Directorate-General for Mobility and Transport[END_REF][START_REF]The National Adaptive Capacity Framework: Key Institutional Functions for a Changing Climate Institute, Pilot Draft[END_REF]. This includes effective institutions, knowledge, supportive policy, laws and regulations, and funding. As such, transportation should also be a part of national adaptation strategies and action plans.

Since stakeholders acting at the local, regional or company levels implement actions such as climate-proofing infrastructure and operations, it is vital that authorities create synergies and engage all the stakeholders in the transportation sector. Enhancing legislation with national standards for earth and public works and requiring climate risk assessments as a prerequisite for new asset construction can ensure the integrity and future protection of the transportation infrastructure.

Public funding for new or existing infrastructure reinforcement should incorporate adaptation assessments to ensure infrastructure sustainability. Table 3 presents the effective governance actions categorized according to adaptation option type. Note that most of actions proposed are soft measures, except for funding issues. This is not surprising because the roles of government are mostly managerial and policy setting, which create the appropriate framework for executing adaptation actions at the local, regional and national levels.

Infrastructure Design and Planning

Smooth and effective operations of transportation systems rely heavily on infrastructures that are intended to last for many decades, possibly more than a century. Investments in the transportation infrastructure are usually costly. Therefore, an anticipatory approach is necessary for planning new infrastructure assets, and for existing infrastructure renovation, improvements and maintenance. Considering future climate trends now will help keep adaptation costs at manageable levels and avoid future unsustainable development paths for transportation systems.

Climate change adaptation must be considered at all relevant levels from network planning to project management. Concrete methodological guidance must be provided on how the integration can be implemented effectively [START_REF]Adaptation of Transport to Climate Change in Europe -Challenges and Options Across Transport Modes and Stakeholders[END_REF]. Certain soft actions require relatively low investments. However, further mainstreaming of adaptation into transportation infrastructure investments can have substantial implications for infrastructure resilience and adaptation costs over the long term. In general, adaptation integrated in new and upgraded infrastructures comes at a lower cost than future integration.

Green actions include earthwork projects that combat landslides and green transportation networks that enhance energy efficiency, engage renewable en- ergy sources and reduce carbon footprints. Table 4 presents the infrastructure design and planning actions categorized according to adaptation option type. The majority of the actions are classified as win-win -they reduce climate risk while providing other benefits and incremental actions for adaptive management.

Redundancies in Transportation Modes

Designing, building and using redundant infrastructure such as alternative roadways and rail links can enhance the resilience of transportation operations. Procuring and maintaining ready-to-use backup equipment and vehicles for emergencies and adding backup power generation capacity for critical facilities are important redundancy measures. Such strategies involve extra costs to establish and maintain redundancy that may not be needed during normal conditions. Nevertheless, redundancy strategies will become more important and more common as the number of extreme weather events and their magnitudes increase as a result of climate change.

Multi-modal transportation offers redundancies at multiple levels [START_REF]Adaptation of Transport to Climate Change in Europe -Challenges and Options Across Transport Modes and Stakeholders[END_REF]. If different transportation modes are available, passengers would be able to select the best modes that meet their needs and switch from one mode to another as necessary. Smart and flexible ticketing enables passengers to switch operators and modes in the event of disruptions. Building and maintaining ready-touse backup equipment and vehicles for emergencies and adding backup power generation capacity for critical facilities also support adaptation efficiency.

Table 5 presents the redundancy planning actions categorized according to adaptation option type. As expected, redundancy actions correspond to gray measures because they require more funding and additional resources. The actions are categorized as win-win because redundancy options offer social benefits to transportation users and enhance adaptive management.

Operational Contingency

The transportation sector has traditionally implemented approaches to cope with the impacts of extreme weather events; these approaches also serve as valuable options for adapting to climate change. Preparation for risk situations is accomplished via contingency planning, business continuity planning and disaster recovery planning for extreme weather events. Emergency reporting, emergency equipment preparedness, surveillance and maintenance plans can enhance the integrity of critical facilities during adverse events. It is also important to position transportation assets away from vulnerable areas and Relocate critical movable assets before events to reduce damage and impact X X Establish surveillance and maintenance plans X X Establish insurance policies for infrastructure assets in vulnerable areas X X provide staff with personal protective equipment for use in operations during extreme events. Insurance schemes are also important because they can support key infrastructure funding and restoration in vulnerable areas. Table 6 presents the operational contingency actions categorized according to adaptation option type. The actions are classified as either gray or soft. Green actions are missing because it is difficult to find green solutions that enhance operational contingencies for transportation assets. The listed options range from cost-effective measures to proportionate adaptive measures.

Early Warning Systems

Early warning systems enable transportation personnel to prepare for extreme weather events induced by climate change or climate variability. For example, Eurocontrol [START_REF] Eurocontrol | Challenges of Growth 2013, Task 8: Climate Change Risk and Resilience[END_REF] has developed a natural hazards and weather resilience tool that provides information about the potential vulnerabilities of airports and en route sectors in Europe. Warning systems should leverage information and communications technologies to enhance transportation management. These include sensors and other devices that provide real-time information on traffic conditions such as temperature, vehicle speed, obstacles, deformations and other surface characteristics [START_REF] Grant-Muller | Intelligent transport systems: The propensity for environmental and economic benefits[END_REF]. Information and communications tech- nologies enable this information to be accessed in real time by transportation infrastructure managers, service operators and users. Vehicles and users are increasingly serving as data collectors, enabling infrastructure managers and operators to gain unprecedented real-time information about transportation systems. Handling these enormous flows of information requires advanced technologies that link vehicles to other vehicles and infrastructure, and process and disseminate the information. Transportation system operators and users in their vehicles can receive vital information about infrastructure conditions, infrastructure managers can obtain detailed descriptions of traffic conditions from users and disseminate the information. This greatly facilitates traffic management and enables passengers to adapt their plans and find alternative transportation options. It also improves the quality of transportation services and provides benefits to all the stakeholders, especially users and operators.

Table 7 presents the early warning systems categorized according to adaptation option type. Note that the early warning systems primarily correspond to gray and soft actions that require technological innovation and engineering support. They are also classified as win-win actions because they offer social and other benefits to stakeholders.

Building Adaptive Capacity

Global initiatives and transnational and national adaptation platforms are collecting relevant information pertaining to all stages of the policy process and making it easily accessible. For example, the European Climate Adaptation Platform (climate-adapt.eea.europa.eu) enables stakeholders to access and share data and information on climate change, current and future vulnerabilities of regions and sectors, national and transnational adaptation strategies and actions, adaptation case studies and tools that enhance adaptation performance and planning. Information collected on past weather events and their impacts is a valuable starting point for assessing vulnerabilities and developing strategies to adapt to climate change. Sharing knowledge about adaptation best practices and benchmarking implementation case studies help accelerate new initiatives. Additionally, education, training and public awareness efforts on climate change vulnerabilities and impacts also improve adaptation performance.

Table 8 presents the building adaptive capacity actions categorized according to adaptation option type. The (mainly) soft actions increase transportation resilience to climate change and are often cost-effective. However, this research has revealed that public platforms primarily provide information of a general nature; detailed technical and event data are scarce. These platforms should be upgraded and expanded to systematically collect and disseminate data about transportation disruption events at the national level.

Comprehensive Collaboration

Climate experts should make the various transportation stakeholders aware of the fact that climate-related topics cannot be addressed through traditional, deterministic methods and that alternative approaches for managing the risks brought upon by climate change should be explored. Transportation experts should collaborate to specify their climate forecasting needs in scientific terms, enabling meteorologists to better understand their needs and implement the appropriate solutions. Cooperative efforts by experts from diverse fields would enable transportation stakeholders to increase their management and decisionmaking flexibility. Table 9 presents the collaboration actions categorized according to adaptation option type. The collaboration actions are primarily of the soft and win-win types. Cooperation among experts from different domains is a fruitful means to further adaptation efficiency and transportation system resilience.

Conclusions

Transportation systems are complex; they play a fundamental role in the economy and society and are characterized by long lifespans and high costs. These characteristics suggest the need for an adaptation approach with a longterm, systemic perspective that also prevents unsustainable development paths and maladaptation.

Several countries have begun to develop adaptation strategies and action plans that focus on the implementation of climate change adaptation measures in the critical infrastructure sectors, including transportation. The actions include information dissemination, capacity building, reviews of technical standards and the incorporation of new information and communications technologies. The engagement of all the principal stakeholders in the transportation sector is very important from the perspective of equity and efficiency. Therefore, regulatory authorities, policymakers and researchers should make strong efforts to engage transportation sector stakeholders in their research and information dissemination activities.

Most climate change adaptation measures for the transportation infrastructure are soft actions (60%). Gray actions are also quite popular (35%) in existing adaptation plans. However, only 5% are green measures -this is a concern because the transportation sector is environmentally-invasive and consumes significant natural resources. It is imperative that climate change adaptation measures for the transportation infrastructure focus on improving energy efficiency and leveraging renewable energy. In general, low regret and win-win actions increase the resilience of transportation systems while providing advantages such as smooth operation, quality of service and efficiency.

Tools and measures for managing risks and impacts, such as early warning systems and contingency plans, can be used to enhance the resilience of the transportation infrastructure to climate change. Adaptation actions that focus on climate-proofing the transportation infrastructure should integrate adaptation requirements into the design of new and upgraded infrastructure -now as opposed to the future -in order to reduce costs over the long term. Another key adaptation action is to provide functionally-redundant options that build capacity and enable flexibility in the event of disasters and other interruptions.

Adaptation actions in the transportation sector should be continually monitored and analyzed. This would enable the principal stakeholders to improve the effectiveness and efficiency of climate change adaptation policy and its implementation. Stakeholders within and outside the transportation sector should also collaborate to ensure that the knowledge gained in other critical infrastructure sectors is leveraged to develop and implement innovative and effective solutions for adapting the transportation infrastructure to cope with the highly disruptive impacts of future climate change.

Table 1 .

 1 Climate change events and risks on transportation (Part 1).

	Type Climatic Events	Risks
		Summer heat	Rail buckling, material fatigue, increased insta-
	Land Transport -Rail	Winter cold and ice Extreme precipi-tation Extreme storms	bility of embankments, overheating of equipment, increase in wildfires and infrastructure damage Ice on trains and catenaries, damage to infrastruc-ture due to low temperatures Damage to infrastructure due to floods and land-slides, scouring of structures, destabilization of embankments Damage to infrastructure such as signals and power cables (e.g., due to falling trees)
		In general:	Reduced safety, increased repair and maintenance
			costs, disruption of just-in-time delivery of goods
			and passengers
	Land Transport -Roads	Summer heat Extreme precipi-tation and floods Extreme storms In general:	Pavement deterioration, melted tarmacs, reduced life of asphalt road surfaces, increase in wildfires and infrastructure damage, expansion and buck-ling of bridges Damage to infrastructure, road submersion, un-derpass flooding, over-strained drainage systems, landslides, destabilization of embankments Damage to infrastructure, fallen trees block roads Reduced speed, road closures and road safety haz-ards, disruption of goods delivery, welfare losses,
			higher repair and maintenance costs

Table 2 .

 2 Climate change events and risks on transportation (Part 2).

	Type Climatic Events	Risks
	Air Transport -Airports	Summer heat Extreme precipi-tation Sea-level rise	Greater need for ground cooling, degradation of runways and foundations, reduced engine effi-ciency due to higher air density at high alti-tudes, decreased airport lift and increased runway lengths Flood damage to runways and other infrastruc-tures, water run-off exceeds capacity of drainage systems Flooding of runways, outbuildings and access roads
		In general:	Interruption and disruption of services and ground
			access, delays and passenger loss of confidence,
			periodic airport closures and higher maintenance
			costs
		Changes in sea	More severe storms and extreme waves, restric-
	Maritime Transport	conditions Sea-level changes Fewer days below freezing	tions on loading capacities and routes, navigation problems Navigation affected by changes in sedimentation rates, inland shipping disruptions Reduced problems due to ice accumulation on ves-sels, decks, riggings and docks, occurrence of dan-gerous ice fog
		Reduced sea ice	Improved access, longer shipping seasons, new
			routes
		In general:	Disruption of just-in-time delivery of goods, in-
			land shipping limitations, welfare losses
	Ports	Extreme storms, sea-level rise, floods, landslides	Devastation of infrastructure, increased maintenance and restoration costs, flow bottlenecks and interruptions, welfare losses

Table 3 .

 3 Effective governance actions proposed in adaptation plans.

	Adaptation Action	Actions Risk Aspect
		Green	Soft	Gray	No Regrets	Low Regrets	Win-Win	Adaptive
	Develop strategic plan for sustainable transporta-		X		X
	tion
	Develop national adaptation strategy and action		X				X
	plan
	Create an adaptation framework that engages		X			X
	stakeholders in the transportation sector
	Incorporate adaptation requirements in legislation		X			X
	and regulatory norms
	Enhance standards and national/regional require-		X				X
	ments
	Require climate risk and environmental assess-		X				X
	ments for all new infrastructure
	Ensure funding for new infrastructure and exist-			X				X
	ing infrastructure reinforcement
	Coordinate future infrastructure plans		X				X

Table 4 .

 4 Infrastructure design and planning actions proposed in adaptation plans.

	Adaptation Action	Actions Risk Aspect
		Green	Soft	Gray	No Regrets	Low Regrets	Win-Win	Adaptive
	Revise obsolete designs and infrastructure stan-		X		X
	dards
	Create new standards and recommended practices		X				X
	for infrastructure resilience
	Improve green design earthworks to combat land-	X					X
	slides, subsidence, heaves and wind damage
	Perform regular civil engineering checks of infras-			X				X
	tructure foundations and actions to combat ero-
	sion
	Review piping and networks to identify vulnera-			X		X
	bilities
	Strengthen drainage elements and improve storm			X				X
	drain capacity
	Proactively inspect and maintain guidance for in-			X			X
	frastructure assets
	Use design limits to explore if heating, cooling,			X				X
	insulation or drying measures are required
	Design green transportation networks by improv-	X					X
	ing energy efficiency, use renewable energy sources
	and reduce the carbon footprint of transportation

Table 5 .

 5 Redundancy planning actions proposed in adaptation plans.

	Adaptation Action	Actions Risk Aspect
		Green	Soft	Gray	No Regrets	Low Regrets	Win-Win	Adaptive
	Design and build redundant infrastructure in ar-			X				X
	eas vulnerable to climate change
	Design and construct resilient vehicles for all			X			X
	transportation modes
	Explore multi-modal opportunities (e.g., multi-			X			X
	modal stations and flexible ticketing options)
	Build and maintain ready-to-use backup equip-			X				X
	ment and vehicles for emergencies
	Add backup power generation capacity for critical			X				X
	facilities

Table 6 .

 6 Operational contingency actions proposed in adaptation plans.

	Adaptation Action	Actions Risk Aspect
		Green	Soft	Gray	No Regrets	Low Regrets	Win-Win	Adaptive
	Establish preparedness and prevention plans		X		X
	Establish business continuity and disaster recov-		X		X
	ery plans
	Establish emergency reporting and emergency			X		X
	equipment preparedness activities
	Position records, materials and assets away from		X			X
	vulnerable areas
	Provide staff with personal protective equipment			X			X
	for use in weather events

Table 7 .

 7 Early warning systems proposed in adaptation plans.

	Adaptation Action	Actions Risk Aspect
		Green	Soft	Gray	No Regrets	Low Regrets	Win-Win	Adaptive
	Fixed warning systems with GPS technology, me-			X			X
	teorological instruments and other sensors that
	detect extreme weather events
	Vehicle sensors and devices that transmit real-			X			X
	time information
	User devices that transmit real-time information		X		X
	Weather warning and incident warning networks			X			X
	Warnings and awareness efforts for staff about the		X				X
	increased risks during inclement weather events

Table 8 .

 8 Building adaptive capacity actions proposed in adaptation plans.

	Adaptation Action	Actions Risk Aspect
		Green	Soft	Gray	No Regrets	Low Regrets	Win-Win	Adaptive
	Create a public adaptation platform		X		X
	Share information about adaptation best prac-		X		X
	tices
	Benchmark implementations of adaptation ac-		X X
	tions
	Document and share institutional knowledge		X		X
	Build datasets to understand territorial and sec-		X		X
	toral vulnerabilities to climate change
	Increase awareness, education and training on cli-		X				X
	mate change vulnerabilities and impacts

Table 9 .

 9 Collaboration actions in adaptation plans.

	Adaptation Action	Actions Risk Aspect
		Green	Soft	Gray	No Regrets	Low Regrets	Win-Win	Adaptive
	Communicate plans and information to stakehold-		X				X
	ers and the public
	Cooperate with stakeholders to expand the shar-		X				X
	ing of knowledge and best practices
	Interact with experts and scientists to expand re-		X				X
	search on adaptation issues
	Cooperate with experts in other fields to increase		X				X
	knowledge about climate science and adaptation


Uday Kanteti

Bruce Mcmillin

Multiple security domain model of a vehicle in an automated platoon

Keywords:

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Automated vehicle systems are likely to be the future of transportation. The concept of a vehicle platoon where 8-25 vehicles follow each other and each vehicle mimics the actions performed by the vehicle in front of it is compelling. The Partners for Advanced Transit and Highways (PART) Project was introduced in 1986 to make this concept a reality. It was believed that introducing platoons would increase road capacity, reduce trip delays and limit energy consumption. A major reason for the PATH Program was to reduce accidents and breakdowns [START_REF] Shladover | The California PATH Program of IVHS research and its approach to vehicle-highway automation[END_REF]. However, many people are hesitant to trust the decision making of driverless vehicles. As such, the approach taken in this research is to reduce the security threats that may impede vehicle decision making, reducing the barrier to the adoption of driverless vehicle technologies.

An automated vehicle is a cyber-physical system in which significant cyber, communications and physical components work together. The information present in the system may be cyber in nature or it may pertain to the physical properties of the system. Preserving correct information flows treats the security issues in the cyber-physical system uniformly. Disruption of information leads to the lack of deducibility of the system state.

The main contribution of this research is the development of a cyber-physical platoon model in which attacks are deducible. The goal is to create security domains such that, if an attack occurs in one domain, then the compromised domain can be detected with the help of information paths from the other domains. This research and its case scenarios demonstrate the potential to detect security problems in a cyber-physical system.

System Model

Figure 1 presents a vehicle platoon and its information transfer paths. The vehicle platoon works in the following manner [START_REF] Wasef | PPGCV: Privacy preserving group communications protocol for vehicular ad hoc networks[END_REF]:

The vehicle in front of the platoon is assigned the role of the lead vehicle. The lead vehicle decides the movements of the platoon. The vehicles behind the lead vehicle follow.

Each vehicle in the platoon (except for the lead vehicle) receives information from the previous vehicle and maneuvers accordingly.

If the lead vehicle wishes to slow down or take a turn, it indicates this via a beacon message and the other vehicles follow suit.

Each vehicle checks and compares the information it receives from sensors and from the communications network. If the information is consistent, the vehicle proceeds; otherwise, it raises a flag.

Other vehicles check the flagged vehicle information and decide whether to keep the vehicle in the platoon or remove it from the platoon.

Communications between autonomous vehicles create a vehicular ad hoc network. In platooning, each vehicle is connected directly to the vehicle in front, to the vehicle behind it and also to the lead vehicle (since each vehicle mimics the lead vehicle). This results in a constant number of connections (i.e., three connections) for each vehicle. All the vehicles in the platoon stay connected and the scalability problem is reduced.

This cyber-physical system consists of embedded computers, control units, a physical system, the vehicles and their sensors, and a message-passing communications network, each residing in its own security domain. Information flows among the various security domains.

The proposed model includes the following components:

Communications Network: A platoon may use any wireless networking technology, the most prominent being a short range radio technology such as WLAN (standard Wi-Fi or ZigBee). Cellular technologies or LTE can also be used. In the United States, the IEEE 1609 WAVE (wireless access in vehicular environments) protocol stack builds on IEEE 802.11p WLAN that operates on seven reserved channels in the 5.9 GHz frequency band. The WAVE protocol stack is designed to provide multi-channel operation (even for vehicles equipped with a single radio), security and lightweight application layer protocols.

Sensors: Velodyne and HDL-64E LiDAR sensors are designed for obstacle detection and navigation by autonomous vehicles. Their durability, 360 • field of view and very high data rates render the sensors ideal for the most demanding perception applications as well as for 3D mobile data collection and mapping applications. The information received from a LiDAR sensor is sent to the vehicle control unit. RADAR sensors are currently used in advanced cruise control systems to measure vital parameters such as range, angle and Doppler velocity. This information is used to assess the driving situation and signal the control unit about potentially dangerous events.

Control Unit:

The control unit is the brain of a vehicle and gives it directions. The control unit makes decisions based on the inputs it receives from the sources mentioned above. If discrepancies in the information paths are detected, the control unit alerts other vehicles by sending special-purpose messages. If enough information paths are available, the control unit can take corrective actions itself.

Monitor: Invariant equations (e.g., distance = speed × time (t)) are evaluated by an embedded monitor to compute where the vehicle would be at time t. The assumption is that the vehicle would have its own speed calculation mechanism such as a speedometer and a clock to tell the time. At each instant, the monitor computes the distance information and sends it to the control unit. The monitor evaluates the invariant using each information source to check for consistency.

Messages with information about speed and distance are passed from the lead vehicle to other vehicles in the platoon in the form of beacons (messages transmitted in the network from one vehicle to another) as shown in Figure 1. Beacons contain information about the speeds and distances of all the vehicles in front of a given vehicle. A control unit gathers information directly from the sensors and from the communications network that exists between the vehicles.

Related Work

Various security threats target confidentiality (e.g., an attacker tracks a vehicle), integrity (e.g., an attacker changes beacon information) and availability (e.g., an attacker jams the network that communicates speed and distance values). The attacker is defined as someone/something that is not authorized to access or modify the vehicle or system components, but is able to do so. The attacker may intend to cause a traffic jam or even a crash.

Confidentiality

Much research on confidentiality or privacy has focused on securing the entity itself. Separate access control [START_REF] Lang | Managing security in intelligent transport systems[END_REF] can prevent changes to vehicle control commands. Dividing each section on the control board restricts information flow based on the type of control implemented by the section. This preserves the privacy of the vehicle.

A virtual trip lane (VTL) with multiple zones (e.g., V T L 1 and V T L 2 ) [14] can preserve privacy by using the lane to regulate location and speed reports. The estimated time for V T L 1 is computed when the vehicle enters the next zone V T L 2 and is compared against the actual arrival time in V T L 2 . Releasing trajectory data only within a single virtual trip lane zone helps protect privacy.

Integrity

Research has focused on securing information using encryption [START_REF] Huang | PACP: An efficient pseudonymous authentication-based conditional privacy protocol for VANETs[END_REF], but this only provides conditional privacy (i.e., only the entities involved in the communications know about the communications). Several integrity attacks have targeted vehicles via direct access to the hardware or via a wireless channel. The main goal of an attacker is to access the controller area network (CAN) of a vehicle and control the vehicle.

Koscher et al. [START_REF] Koscher | Experimental security analysis of a modern automobile[END_REF] discuss the vulnerabilities of controller area networks. Controller area network packets contain no authentication fields or even source identifier fields, meaning that any component can "invisibly" send packets to any other component in the network. This means that just one compromised component can be used to control all the other components on the controller area network bus. Koscher et al. report that broadcasting malicious data from an infected controller area network can enable an attacker to seize control of a vehicle.

A widely-reported wireless attack [START_REF] Miller | Remote exploitation of an unaltered passenger vehicle[END_REF] took control of the engine control unit (ECU) of a Jeep that sends commands to the other components in the vehicle. The attack leveraged a cellular network connected to the vehicle entertainment system in order to compromise the controller area network. The attack was able to kill the brakes, steer the vehicle and control the horn and parking lights at will. Koscher et al. [START_REF] Koscher | Experimental security analysis of a modern automobile[END_REF] have also worked on wireless access, which is discussed in [START_REF] Checkoway | Comprehensive experimental analyses of automotive attack surfaces[END_REF]. Access to the engine control unit is gained via Bluetooth and reverse engineering. Once access is gained, the attacker can make changes to the braking system and modify the speed of the vehicle.

Another recent attack targeted a Tesla S model by gaining wireless access to the controller area network of the vehicle [START_REF] Abueh | Message authentication in driverless cars[END_REF]. The attack was launched when the driver connected to a malicious Wi-Fi hotspot. The researchers were able to devise an alternate authentication scheme using ECDSA with omission techniques and TESLA++. However, the problem of scalability still exists because each new vehicle has to be authenticated with every other vehicle in a group by a roadside unit (despite the fact that the authentication overhead is reduced when two groups intend to communicate). A special message is sent when the information is not authentic; the verification is performed by the engine control unit using information from another vehicle.

Availability

An attack that impacts the availability of information can cause serious problems to connected vehicles. Traditional techniques such as beamforming (i.e., actively steering wireless transmission and reception beams to maximize useful signal reception while minimizing interfering signal reception) can combat jamming attacks on sensors [START_REF] Patounas | Evaluating defense schemes against jamming in vehicle platoon networks[END_REF].

A Sybil attack can be used to target connected vehicles. In this attack, the reputation system of a peer-to-peer network system is subverted maliciously by creating a large number of pseudonymous identities. Using these identities, the attacker can gain a disproportionately large influence on the functioning of the system. This attack can be detected efficiently using a less complex cryptographic technique and obtaining pseudonyms from roadside units at continuous intervals from a trusted source [START_REF] Al Mutaz | Leveraging platoon dispersion for Sybil detection in vehicular networks[END_REF]. Distinct roadside units that periodically collect reports from communicating vehicles in the neighborhood reduce the vulnerability.

In the long term, it is believed that vehicles involved in a Sybil attack would pass similar information as the benign vehicles. A trust-based system for detecting malicious vehicles can employ an iterative filtering algorithm to detect malicious vehicles and address the problem of collusion [START_REF] Hu | REPLACE: A reliable trust-based platoon service recommendation scheme in VANET[END_REF], where vehicles attempt to improve the trust ratings of false vehicles.

Denial-of-service (DoS) attacks can be detected easily. Lyamin et al. [START_REF] Lyamin | Real-time detection of denialof-service attacks on IEEE 802.11p vehicular networks[END_REF] use time intervals to listen on a channel and determine whether or not all the beacons have been received. If there is a beacon loss, two nodes may be involved in a collision within the same group. To prevent collisions, the nodes must have an initialization phase. The initialization phase ensures that the nodes start from safe states (i.e., no attacks) and do not collide with each other. Some attacks are difficult to detect and mitigate using only one vehicle [START_REF] Miller | Remote exploitation of an unaltered passenger vehicle[END_REF]. When multiple vehicles are present, the vehicles could examine the information they receive and determine that a vehicle is under attack. This is possible because the attacked vehicle would send information that would not match the information available to the other vehicles.

Sun et al. [START_REF] Sun | Evaluation of privacy preserving algorithms using traffic knowledge based adversary models[END_REF] have shown that the use of virtual trip lane zones can address privacy concerns. Their approach relies on real-time data. Therefore, if an attacker were to know the position of a vehicle in a virtual trip zone, the attacker would be track the movement of the vehicle in real time.

Certain attacks spoof data originating from a communications network and beacons [START_REF] Checkoway | Comprehensive experimental analyses of automotive attack surfaces[END_REF][START_REF] Koscher | Experimental security analysis of a modern automobile[END_REF]. Cryptography can be used to secure messages between vehicles [START_REF] Abueh | Message authentication in driverless cars[END_REF][START_REF] Huang | PACP: An efficient pseudonymous authentication-based conditional privacy protocol for VANETs[END_REF]. Using a strong encryption method can secure communications, but the assumption is that the cryptographic keys are exchanged securely before communications are initiated. Another underlying assumption is that the vehicle itself is not compromised. In real-time scenarios involving vehicles it may not be possible to securely share information while the vehicles are in motion. The denial-of-service attacks discussed in [START_REF] Lyamin | Real-time detection of denialof-service attacks on IEEE 802.11p vehicular networks[END_REF][START_REF] Patounas | Evaluating defense schemes against jamming in vehicle platoon networks[END_REF] are based on reducing interference and listening to the channel periodically, but hazardous weather conditions could make it difficult to listen to the channel. Instead of treating all these issues separately, the proposed methodology adopts a scientific approach that uniformly models the interactions of distinct security domains.

Multiple Security Domain Nondeducibility

Nondeducibility was introduced by Sutherland [START_REF] Sutherland | A model of information[END_REF] in an attempt to model infrastructures that secure information using a partitioned model. The partitions are grouped into two or more sets. These sets are usually labeled as high and low with all the information restricted to one side of the partition or the other. Information that cannot be determined from the other side of the domain is said to be nondeducibility secure. However, the partition must be absolute and simple. Overlapping security domains present severe difficulties for nondeducibility as do information flows that cannot be evaluated because the model lacks the required valuation functions.

V is a set of valuation functions such that V i sx (w) returns the value of a state variable s x as seen by an entity i in world w. For example, if a vehicle control unit c obtains distance information from sensor d s , then V c ds (w) returns true; otherwise, it returns false. Definition. A system is multiple security domain nondeducible (MSDND) secure if there exists a world with a pair of states where one state must be true and the other false (exclusive or), but an entity i has no valuation function for the states. An entity i in security domain SD i cannot know which state is true and which state is false [START_REF] Howser | A multiple security domain model of a driveby-wire system[END_REF]. In particular: where s x and s y are states, V i x and V i y are the valuation functions of s x in domain i and s y in domain i, respectively, and w is a world.

MSDND(ES) = ∃w ∈ W [ ( s x ∨ s y ) ] ∧ ∼( s x ∧ s y ) ∧ [ w |= ( ∃ V i sx ( w) ∧ ∃ V i sy ( w) ) ]

Problem Statement

It is possible to devise an attack -like Stuxnet [START_REF] Howser | A modal model of Stuxnet attacks on cyberphysical systems: A matter of trust[END_REF] -that changes the speed and distance values. However, it is important to be able to tell if the attack (i.e., changing sensor or network information) is MSDND. If the attack is MSDND, then the attacker has an advantage because the target would not know which component is malfunctioning. Therefore, the model should be designed to eliminate attacks that are MSDND secure.

Figure 2 shows the security domain partitions and the interactions between vehicle control units and communications points. A monitor positioned in a vehicle evaluates the invariants pertaining to the vehicle state. If a discrepancy exists in the distance information sent by one of the paths to the control unit, then the control unit would know that something is wrong.

The following entities can be evaluated to determine the interactions between a vehicle and the communications system: c : The vehicle control unit c obtains data and computes the movement.

s : Each LiDAR sensor s provides a distance value d(s). n : The communications network n between the vehicles provides the network value d(n).

ISV : The information source validator ISV is executed by the monitor to check if the information received from the information paths is valid. Table 1 shows that ISV sequentially checks sources against other sources and invariants that involve multiple sources.

Check Source

ch 1 d(s) = d(n) ch 2 d(s) = d(invariant 1 ) ch 3 d(n) = d(invariant 1 ) ch 4 d(s) = d(beacon) ch 5 d(s) = d(invariant 2 ) ch 6 d(n) = d(beacon) . . . . . .
The term d(c) denotes the distance that the control unit accepts based on information received from the paths. For a given state, the valuation functions return the values of the corresponding state variables (c, s, n) as seen by the entity in control.

The control unit detects a compromised information path if the information it receives from the corresponding sensor is not equal to the value it receives from the communications network. In other words, it uses the result of a check ch i . If the check value is false, then the control unit knows that one of the information paths has been compromised.

Five cases and their sub-cases are discussed in the following sections.

Case 1

Figure 1 shows that there are two information paths, sensor and network. Case 1 assumes that a vehicle has exactly one information path -either sensor or network -that provides information about the distance between the vehicle and the vehicle in front of it. In particular, the goal is to show that one information path can make the system MSDND secure as well as not MSDND secure. Four sub-cases are considered.

Case 1(a):

Assume that the vehicles are connected only to network n and that the network provides correct information (i.e., d(n) = true):

w |= (∃V c d(n) (w))
: Control unit receives distance information from the network.

It follows that:

MSDND(ES) = ∃w ∈ W : w (d(n) ⊕ ¬d(n)) ∧ [w |= (∃V c d(n) (w) ∨ V c ¬d(n) (w))]
The system is not nondeducible secure to the control unit according to the definition because ∃V c d(n) (w).

Case 1(b):

Assume that the vehicles connected to network n receive incor- rect information (i.e., ¬d(n) = true):

w |= ( V c ¬d(n) (w))
: Control unit receives distance information from the network.

It follows that:

MSDND(ES) = ∃w ∈ W : w (d(n) ⊕ ¬d(n)) ∧ [w |= ( V c d(n) (w) ∨ V c ¬d(n) (w))]
The system is nondeducible secure to the control unit according to the definition.

Case 1(c):

Assume that the vehicles are connected only to sensor s, which provides correct information (i.e., d(s) = true). This case is similar to Case 1(a).

Case 1(d):

Assume that the vehicles are connected to sensor s and receive incorrect information (i.e., ¬d(s) = true). This case is similar to Case 1(b).

Although the goal is to create a model that is not nondeducible secure, the control unit in Cases 1(b) and 1(d) would believe the data and direct the vehicle accordingly. Having no other information path for verification is potentially hazardous because it is nondeducible if the information received is incorrect.

Case 2

In Case 2, the sensor and communications network provide distance information to the control unit. Upon receiving the distance information, the control unit attempts to determine whether or not the information provided is correct. The control unit would know that an information path is corrupted if there is a discrepancy in the information provided by the two paths. In the following, two sub-cases are examined.

Case 2(a):

If n is faulty, then the system has been compromised. The attacker can manipulate the information and, thus, incorrect information is received by the control unit from the network (i.e., ¬d(n) = true and d(s) = true). From statement S3, the control unit would know that an information path has been compromised.

Combining statements S1 and S2 yields the following expression:

MSDND(ES) = ∃w ∈ W : w (¬d(n) ⊕ ch) ∧ [w |=(∃ V c d(ch1) (w)∨ V c ¬d(ch) (w))]
The system is not nondeducible to the control unit because the unit can deduce that something is wrong. But it cannot determine which information path is responsible. An additional information path is needed to determine the path that transmits incorrect data.

Case 2(b):

If s is faulty, then the system has been compromised. The attacker can manipulate the information and, thus, incorrect information is received by the control unit from the network (i.e., ¬d(s) = true and d(n) = true). The following statements hold:

S1: w |= ( V c
¬d(s) (w)) : Control unit receives information from the sensor.

S2: w |= (∃ V c d(n) (w)
) : Control unit receives information from the network.

S3: w |= (∃V c

ch1 ) : Information received from the sensor and network do not match.

From statement S3, the control unit would know that an information path has been compromised. Combining statements S1 and S2 yields the following expression:

MSDND(ES) = ∃w ∈ W : w (¬d(s) ⊕ ch) ∧ [w |= (∃V c d(ch1) (w) ∨ V c ¬d(s) (w))]
The system is not nondeducible to the control unit because the unit can deduce that something is wrong. But it cannot determine which information path is responsible for transmitting the incorrect data.

Invariants relate the properties of a vehicle in a manner that, if one portion of the model is compromised, then the invariant is falsified. The MSDND model is extended as follows: invariant dist (d(i)): distance = speed × time. Each vehicle has its own speedometer that enables it to compute the distance that it has traveled during a period of time.

Based on the model, the three sources that provide distance information are:

d t2 = ⎧ ⎪ ⎨ ⎪ ⎩ range calculated by LiDAR/RADAR -d t1 (s) speed × time -d t1 (i) distance calculated via network -d t1 (n)
The three sources, sensor, network and invariant, are shown in Figure 3.

Network vs. Invariant:

The network periodically updates the speed, location and other relevant information about a vehicle as shown in Figure 4. Specifically, the vehicle can calculate the distance covered in the t 2t 1 interval using the latitude (lat) and longitude (lon) and by computing: distance = speed × time. If at time t 1 , the network gives a certain location for vehicle V i+1 , and at t 2 , the network gives another location for V i+1 . Then, vehicle V i can compute the distance moved by V i+1 because it has its speed and the duration. If there is a discrepancy in the information, then the network has been compromised.

The control unit would have the correct distance information if a valuation function exists for any one of ch 1 , ch 2 or ch 3 .

Case 3

In Case 3, another information path (invariant path) is added to the model. This additional information path helps make the model not MSDND secure. The control unit would also have the correct distance information if a valuation function exists for any one of the checks ch 1 , ch 2 or ch 3 , which can indicate which path is compromised. Thus, the control unit can sense that something is wrong. This is not nondeducible secure because the control unit can deduce that something is wrong and can determine that the network is responsible for the incorrect data being transmitted.

MSDND(ES) = ∃w ∈ W : w (¬d(n) ⊕ ch 2 ) ∧ [w |= (∃V c d(ch2) (w) ∨ V c ¬d(n) (w))]
Case 3(b): s is faulty (i.e., ¬d(s) = true). This case is similar to Case 3(a).

It is assumed that the invariant is always true and that the information about the speed is unaltered. However, as discussed in [START_REF] Miller | Remote exploitation of an unaltered passenger vehicle[END_REF], the attacker can also change the information received by the control unit. In this situation, the other two components, sensor and network, can provide the correct information.

Assume that there are multiple vehicles in the platoon and multiple platoons are nearby. This situation is shown in Figure 5.

The sources of information are: beacon i : This provides information about speed i and velocity i of vehicle V i in the platoon.

s : Each LiDAR

Case 4

In Case 4, multiple vehicles are in a platoon and no other platoons are nearby. Vehicles communicate information between each other using beacons.

A beacon is an additional information path to the control unit that can help detect an incorrect information path.

Consider the situation where a vehicle provides incorrect information (i.e., ¬beacon = true). The following statements hold: It follows that:

MSDND(ES) = ∃w ∈ W : w (¬beacon i ⊕ ISV ) ∧ [w |= (∃V c d(c) (w) ∨ V c ¬d(c) (w))]
This is not nondeducible secure because the control unit can deduce that something is wrong and can determine that beacon i is responsible for the incorrect data being transmitted. Thus, it is possible to detect if a vehicle in the platoon has been compromised.

Case 5

In Case 5, there are multiple platoons as shown in Figure 5. Information paths exist between adjacent platoons. The information paths help detect an incorrect data path when multiple information paths are compromised.

Consider the situation where ¬beacon i = true. The following statements hold: This is not nondeducible secure because the control unit can detect that something is wrong and can determine that beacon i is responsible for the incorrect data being transmitted.

As demonstrated above, information from other platoons can be used to detect the compromised information path and, ultimately, the compromised vehicle. The case where platoons can detect if a vehicle has been compromised is considered because Case 4 demonstrates that it is possible to detect a compromised vehicle without a platoon. However, if other information sources are compromised, then having the additional source assists in attack detection.

Conclusions

MSDND is useful to model attacks where the goal is to hide critical information from an attacker. MSDND secure is a major disadvantage to a vehicle platoon and a boon to an attacker because information can be hidden by making it impossible to detect an attack or the valuation function could be falsified to produce an invalid valuation, rendering the information MSDND secure and undetectable. As demonstrated in the case study, the vehicle control units in a platoon may be unable to determine which vehicle has been compromised. This research has focused on securing vehicles in an automated platoon. Minimizing the number of assumptions made in the model is a topic of future research. It is also necessary to handle situations where more than half of the information sources are compromised. Another problem is to handle cases where two sets of information sources provide the same incorrect information. Other vehicular scenarios that will be considered include platoon joining, lane changing and platoon splitting.

Figure 1 .

 1 Figure 1. A vehicle platoon and its information transfer paths.

Figure 2 .

 2 Figure 2. Security domains of information flow.

S1: w

 w |= (∃V c d(s) (w)) : Control unit receives information from the sensor. S2: w |= ( V c ¬d(n) (w)) : Control unit receives information from the network. S3: w |= (∃V c ch1 ) : Information received from the sensor and network do not match.

Figure 3 .

 3 Figure 3. Invariant model with three information paths.

Figure 4 .

 4 Figure 4. Network vs. invariant.

Case 3 (

 3 a): n is faulty (i.e., ¬d(n) = true). The following statements hold: S1: w |= ( V c ¬d(n) (w)) : Control unit receives information from the network. S2: w |= (∃V c d(s) (w)) : Control unit receives information from the distance estimators. S3: w |= (∃V c d(i) (w)) : Control unit receives information from invariant dist . S4: w |= V c ch1 . S5: w |= ∃V c ch2 . S6: w |= V c ch3 . S7: w |= ∃V c d(c) (w) : From statement S5. It follows that:

Figure 5 .

 5 Figure 5. Multiple platoons.

  S1: w |= (∃V c d(n) ) : Control unit receives information from the network. S2: w |= (∃V c d(s) ) : Control unit receives information from the sensor. S3: w |= (∃V c inv1 ) : Control unit receives information from invariant 1 . S4: w |= ( V c beaconi ) : Control unit receives information from the beacon. S5: w |= ∃V c ISV : From statements S1, S2 and S3. S6: w |= ∃V c d(c) (w) : From statement S5.

S1: w

 w |= (∃V c d(n) ) : Control unit receives information from the network. S2: w |= (∃V c d(s) ) : Control unit receives information from the sensor. S3: w |= (∃V c inv1 ) : Control unit receives information from invariant 1 . S4: w |= ( V c beaconi ) : Control unit receives information from beacon 1 . S5: w |= (∃V c inv2 ) : Control unit receives information from invariant 2 . S6: w |= ∃V c inv2 : From statements S1, S2, S3 and S5. S7: w |= ∃V c d(c) (w) : From statement S5. It follows that: MSDND(ES) = ∃w ∈ W : w (¬beacon i ⊕ invariant 2 ) ∧ [w |=(∃V c d(c) (w)∨ V c ¬d(c) (w))]

Table 1 .

 1 Information source validation performed by ISV .

  Every vehicle has a speedometer with which it can compute the distance it has traveled during a period of time.ISV : The information source validator ISV is essentially an array data type that stores the true/false results after comparing the distance reported by each information source with another as shown in Table1. If more true values are reported than false values, then a valuation function for ISV exists. invariant 2 : As shown in Figure5, communications can occur between two platoons. In this case, vehicles A, B and P form an information path because each vehicle is equipped with proximity sensors. Vehicle P has the information {x, y}, vehicle A has the information {x, z A } and vehicle P has the information {y, z B }. Sending this information back to vehicles A, B and C yields the information {x, z A , z B }. If z A is not equal to z B , then no valuation function exists for invariant 2 ; otherwise, a valuation function exists.

sensor s provides a distance value d(s).

n : The communications network n between the vehicles provides the network value d(n).

Invariant 1 : distance = speed × time gives the value of d(invariant i ).

Acknowledgement

This research was supported, in part, by the Future Renewable Electric Energy Distribution Management Center, a National Science Foundation supported Engineering Research Center, under Grant EEC 0812121; by the National Science Foundation under Grant CNS 1505610; and by the National Institute of Standards and Technology under Grant 60NANB15D236.