New Session Protocol Keeps Connected Vehicles Safe, Private, and Online

Every time a connected car pulls into or out of a smart parking facility, it carries out a small financial transaction. The vehicle must be identified, access must be granted, a fee must be settled, and a gate must rise on time. Behind that mundane exchange lies a surprisingly fragile chain of events: a camera may misread a plate, a payment message may arrive twice, the link to the cloud may vanish mid-session, and the record tying a driver to a plate and a payment may linger long after the car has gone. A new study published in Frontiers in Future Transportation presents a session protocol designed to make that everyday transaction cyber-resilient and privacy-preserving, and it backs the design with both mathematical proof and a full wireless simulation.

The research, conducted by a team at Kyungdong University in the Republic of Korea, targets software-defined vehicular edge infrastructure, an architecture in which time-critical decisions are made at the roadside rather than in a distant data center. The vehicle’s on-board unit exchanges entry, payment, exit, and closure messages with a roadside edge service over the IEEE 802.11p radio standard. Instead of using the license plate as the routine identifier, the edge service issues a short-lived pseudonymous token that holds the session together. Payment and exit invariants are enforced locally at the edge, session state is cached while the cloud is unreachable, and license-plate readings that the system cannot trust are routed to a human or automated review queue rather than triggering automatic penalties.

The privacy motivation is straightforward. A parking record that links a user account, a payment method, a location, and a timestamp becomes, across many such records, a detailed mobility-finance history. By keeping routine edge decisions on a token that is short-lived and session-bound, the design separates the fast, local control path from the long-term identity records held in the cloud. The authors are careful to bound their claim: the scheme reduces direct-identifier exposure during a live transaction, but it does not prove full anonymity or unlinkability, since an authorized cloud service can still map a token back to a registered profile under defined exception conditions.

The safety case rests on formal verification. The researchers modeled the session controller in UPPAAL 5.0.0, a tool based on timed automata that can exhaustively explore every reachable state of a system rather than just sampling executions. Their model pairs a single-session FogController with a dedicated receipt deadline observer that tracks whether a receipt follows a confirmed payment within five model time units. Every query came back satisfied: no session can record more than one accepted payment, a paid session can never be penalized, an active dispute blocks penalties, an exit mismatch forces dispute mode and prevents exit completion, a verified exit clears the active-session flag, and the model is entirely free of deadlock. Reachability checks confirmed that normal closure and cloud recovery paths are genuinely executable, not just theoretically possible.

Formal proof alone cannot show how the protocol behaves over a real radio. For that, the team built a co-simulation using SUMO for traffic, OMNeT++ 6.3.0 for networking, and Veins 5.3.1 for the IEEE 802.11p stack. The scenario placed 200 vehicles, 50 parking bays, two entry gates, and two exit gates under a single roadside unit across an 11,000-second horizon. Vehicles were divided into four cohorts experiencing 0, 5, 10, or 20 percent injected message loss before transmission. The radio was fixed at 20 milliwatts transmit power, 6 megabits per second, and a 5.890 GHz center frequency with a simple path-loss model.

The results reveal both strengths and honest weaknesses. Of the 200 vehicles, 159 sessions became active with regular or temporary tokens, 135 received payment confirmations, 132 received receipts, and 74 completed the full local lifecycle through exit verification and session closure. Mean application-level response times were roughly 50 milliseconds for token, payment, duplicate-payment, and exit responses, and about 100 milliseconds for receipts, comfortably fast enough for gate control. Response-side success fell steadily with loss, from 95.58 percent in the lossless cohort to 75.25 percent at 20 percent loss, and completed sessions dropped from 54 percent to 14 percent across the same cohorts.

The fault-handling paths behaved as designed. Nineteen injected low-confidence license-plate recognition events all entered dispute review, seventeen of which successfully delivered temporary tokens to vehicles. Eight duplicate payment requests were rejected at the edge rather than billed twice. Ten simulated fog-cloud outages moved through a pending-synchronization state and recovered after the configured ten-second interval, and five exit mismatches passed through review to manual resolution within the configured five seconds. At peak, the edge held 176 active sessions with a serialized state estimate of just 6,118 bytes, illustrating how lightweight the per-session footprint can be.

One finding stands out as a candid admission: token revocation performed poorly. Although 74 vehicles reached local session closure, only five closure notices actually arrived at the roadside unit to mark their tokens revoked. Because the experiment used one-shot messages with no acknowledgments and no retransmission, best-effort closure simply does not survive loss. The authors argue this is precisely the kind of gap a simulation is meant to expose, and they identify acknowledgment-based retransmission, idempotent request identifiers, timeout recovery, persistent revocation queues, and broader roadside-unit coverage as prerequisites for deployment.

The interplay between safety and availability emerges as the study’s central engineering insight. The formal invariants held regardless of radio conditions: a lost message halts a session without ever producing duplicate billing or an unsafe transition. Safety survives even as the service degrades. This is a deliberate trade-off. Unlike blockchain-based parking schemes that buy immutability through distributed consensus, the design places no ledger transaction behind a gate event, relying instead on a local session table and a receipt record, which keeps latency low but forgoes ledger-grade guarantees.

The authors also sketch where the pattern could go next. The same formally constrained session logic, combining temporary authorization, uncertain-evidence review, and local invariant enforcement, could extend to drone landing pads, electric-vehicle charging stations, and edge-managed vertiports, though each would need its own sensing and safety validation. For now, the study stands as a rare example of a connected-vehicle protocol whose claims are bounded on purpose: formal guarantees proven for an abstract controller, wireless feasibility demonstrated in simulation, and the remaining resilience gaps stated plainly for the next generation of implementation.

Subject of Research: A cyber-resilient, privacy-preserving session protocol for connected-vehicle parking transactions in software-defined vehicular edge infrastructure

Article Title: A cyber-resilient and privacy-preserving session protocol for connected vehicles in software-defined edge infrastructure

Article References: Ajax, N. D. C., Meshack, T., Gabriel, D. G. N., & Al-Athwari, B. (2026). A cyber-resilient and privacy-preserving session protocol for connected vehicles in software-defined edge infrastructure. Frontiers in Future Transportation, 7, Article 1924100. https://doi.org/10.3389/ffutr.2026.1924100

Image Credits: AI Generated

DOI: 10.3389/ffutr.2026.1924100

Keywords: connected vehicles, vehicular edge computing, smart parking, formal verification, UPPAAL, IEEE 802.11p, privacy-preserving protocols, automated license plate recognition, software-defined vehicles, cybersecurity, V2I communication, SUMO simulation