Payment is an essential part of e-commerce. Merchants usually rely on third-parties, so-called payment processors, who take care of transferring the payment from the customer to the merchant. How a payment processor interacts with the customer and the merchant varies a lot. Each payment processor typically invents its own protocol that has to be integrated into the merchant’s application and provides the user with a new, potentially unknown and confusing user experience.Pushed by major companies, including Apple, Google, Master-card, and Visa, the W3C is currently developing a new set of standards to unify the online checkout process and “streamline the user’s payment experience”. The main idea is to integrate payment as a native functionality into web browsers, referred to as the Web Payment APIs. While this new checkout process will indeed be simple and convenient from an end-user perspective, the technical realization requires rather significant changes to browsers.Many major browsers, such as Chrome, Firefox, Edge, Safari, and Opera, already implement these new standards, and many payment processors, such as Google Pay, Apple Pay, or Stripe, support the use of Web Payment APIs for payments. The ecosystem is constantly growing, meaning that the Web Payment APIs will likely be used by millions of people worldwide.So far, there has been no in-depth security analysis of these new standards. In this paper, we present the first such analysis of the Web Payment APIs standards, a rigorous formal analysis. It is based on the Web Infrastructure Model (WIM), the most comprehensive model of the web infrastructure to date, which, among others, we extend to integrate the new payment functionality into the generic browser model.Our analysis reveals two new critical vulnerabilities that allow a malicious merchant to over-charge an unsuspecting customer. We have verified our attacks using the Chrome implementation and reported these problems to the W3C as well as the Chrome developers, who have acknowledged these problems. Moreover, we propose fixes to the standard, which by now have been adopted by the W3C and Chrome, and prove that the fixed Web Payment APIs indeed satisfy strong security properties.

The ACME certificate issuance and management protocol, standardized as IETF RFC 8555, is an essential element of the web public key infrastructure (PKI). It has been used by Let's Encrypt and other certification authorities to issue over a billion certificates, and a majority of HTTPS connections are now secured with certificates issued through ACME. Despite its importance, however, the security of ACME has not been studied at the same level of depth as other protocol standards like TLS 1.3 or OAuth. Prior formal analyses of ACME only considered the cryptographic core of early draft versions of ACME, ignoring many security-critical low-level details that play a major role in the 100 page RFC, such as recursive data structures, long-running sessions with asynchronous sub-protocols, and the issuance for certificates that cover multiple domains.

We present$\text{DY}^{\star}$, a new formal verification framework for the symbolic security analysis of cryptographic protocol code written in the$\mathrm{F}^{\star}$programming language. Unlike automated symbolic provers, our framework accounts for advanced protocol features like unbounded loops and mutable recursive data structures, as well as low-level implementation details like protocol state machines and message formats, which are often at the root of real-world attacks. Our work extends a long line of research on using dependent type systems for this task, but takes a fundamentally new approach by explicitly modeling the global trace-based semantics within the framework, hence bridging the gap between trace-based and type-based protocol analyses. This approach enables us to uniformly, precisely, and soundly model, for the first time using dependent types, long-lived mutable protocol state, equational theories, fine-grained dynamic corruption, and trace-based security properties like forward secrecy and post-compromise security.$\text{DY}^{\star}$is built as a library of$\mathrm{F}^{\star}$modules that includes a model of low-level protocol execution, a Dolev-Yao symbolic attacker, and generic security abstractions and lemmas, all verified using$\mathrm{F}^{\star}$. The library exposes a high-level API that facilitates succinct security proofs for protocol code. We demonstrate the effectiveness of this approach through a detailed symbolic security analysis of the Signal protocol that is based on an interoperable implementation of the protocol from prior work, and is the first mechanized proof of Signal to account for forward and post-compromise security over an unbounded number of protocol rounds.

Lane change maneuver is a cause for many severe highway accidents and automatic lane change has great potentials to reduce the impact of human error and number of accidents. Previous researches mostly tried to find an optimal trajectory and ignore the behavior model. Presented methods can be applied for simple lane change scenario and generally fail for complicated cases or in the presence of time/distance constraints. Through analysis and inspiring of human driver lane change data, we propose a multi segments lane change model to mimic the human driver for challenging scenarios. We also propose a method to convert behavior/motion selection to a time-based pattern recognition problem. We developed a simulation platform in PreScan and evaluated proposed automatic lane change method for challenging scenarios.

This paper introduces a novel path planning method under non-holonomic constraint for car-like vehicles, which associates map discovery and heuristic search to attain an optimal resultant path. The map discovery applies fast marching method to investigate the map geometric information. After that, the support vector machine is performed to find obstacle clearance information. This information is then used as a heuristic function which helps greatly reduce the search space. The fast marching is performed again, guided by this function to generate vehicle motions under kinematic constraints. Experimental results have shown that this method is able to generate motions for non-holonomic vehicles. In comparison with related methods, the path generated by proposed method is smoother and stay farther away from the obstacles.

We propose a path planning method for autonomous vehicle in cluttered environment with narrow passages. Different from traditional methods, we use a learning approach based on RBF kernel SVM to maximize the safety margin for driving. We use the Lagrange multipliers of SVM dual model to find most critical points in map and generate optimized hyperplane for path. The method is implemented on autonomous vehicle for outdoor parking and compared to well-known method in autonomous vehicle literatures. The experiments prove that the method is able to generate smooth and safe path in shorter time compared to other methods.

Maneuvering autonomous vehicles in constrained environments, such as autonomous vehicle parking, is not a trivial task and has received increasing attention from both the academy and industry. However, the traditional methods divide the problem into parallel parking, perpendicular parking, and echelon parking, then different methods are applied for the parking motion planning. In this paper a Rapidly-exploring Random Tree (RRT) based path planner is implemented for autonomous vehicle parking problem, which treats all the situations in a unified manner. As the RRT method sometimes generates some complicated paths, a smoother is also implemented for smoothing generated paths. The proposed algorithm is verified in simulation and generates applicable solutions for the proposed application scenarios.

This paper proposed a practical path-planning algorithm for an autonomous vehicle or a car-like robot in an unknown semi-structured (or unstructured) environment, where obstacles are detected online by the vehicle's sensors. The algorithm is based on particle filter, Bézier curves and support vector machine to provide a safe path among various static and moving obstacles and to satisfy the vehicle's curvature constraints. The algorithm has been implemented and verified on the simulation software. Experimental results demonstrate the effectiveness of the proposed method in complicated conditions with existing of multi objects.

This paper presents a Bézier curve based path planner which enables the anti-collision behavior of an electronic car. The anti-collision system is a fundamental module in the architecture. The path tracking implementation uses pure pursuit algorithm. The anti-collision system based on laser scanner data consists of estimating the trajectories and behavior of surrounding objects, and a Bézier curve based path planner. Experimental results are presented showing the effectiveness of the overall navigation control system.