Framework for security and privacy in automotive telematics

ABSTRACT

Automotive telematics may be defined as the information-intensive applications that are being enabled for vehicles by a combination of telecommunications and computing technology. Telematics by its nature requires the capture of sensor data, storage and exchange of data to obtain remote services. In order for automotive telematics to grow to its full potential, telematics data must be protected. Data protection must include privacy and security for end-users, service providers and application providers. In this paper, we propose a new framework for data protection that is built on the foundation of privacy and security technologies. The privacy technology enables users and service providers to define flexible data model and policy models. The security technology provides traditional capabilities such as encryption, authentication, non-repudiation. In addition, it provides secure environments for protected execution, which is essential to limiting data access to specific purposes.

REFERENCES

• 1: Donna L. Hoffman , Thomas P. Novak , Marcos Peralta, Building consumer trust online, Communications of the ACM, v.42 n.4, p.80-85, April 1999 [doi>10.1145/299157.299175]
• 2: [2] Kingpin and Mudge, "Analysis of Potable Devices and Their Weaknesses Against Malicious Code Threats", RSA Conference, San Francisco, CA, April 11, 2001.
• 3: Kingpin Kingpin , Mudge Mudge, Security analysis of the palm operating system and its weaknesses against malicious code threats, Proceedings of the 10th conference on USENIX Security Symposium, p.11-11, August 13-17, 2001, Washington, D.C.
• 4: [4] Bohrer, K., Liu, X., Kesdogan, D., Schonberg, E., Singh, M. and Spraragen, S.L. "Personal Information Management and Distribution", Proceedings of the 4th International Conference on Electronic Commerce Research, Dallas, TX, November 8-11, 2001.
• 5: [5] Bohrer, K., Kesdogan, D., Liu, X., Podlaseck, M., Schonberg, E., Singh, M. and Spraragen, S. L. "How to Go Shopping On the World Wide Web Without Having Your Privacy Violated", Proceedings of the 4th International Conference on Electronic Commerce Research, Dallas, TX, November 8-11, 2001.
• 6: [6] Novell Inc, "digitalMe: Making life easier on the net," http://www.digitalme.com
• 7: [7] Lumeria, "An Informediary Approach to Privacy Problem," http://www.lumeria.com/whitepaper.shtml
• 8: [8] Zero-Knowledge-Systems, Inc. "The Freedom Network Architecture," http://www.freedom.net/
• 9: [9] Microsoft Inc., "A platform for user-centric application," http://www.microsoft.com/myservices/
• 10: [10] AT&T, "Privacy Minder," http://www.research.att.com/projects/p3p/pm
• 11: [11] "The Platform for Privacy Preferences 1.0 (P3P1.0) Specification". April, 2002 http://www.w3.org/TR/P3P
• 12: [12] CPExchange, "Global standards for privacy-enabled customer data exchange," http://www.cpexchange.org/standard/
• 13: [13] IBM, "Enterprise Privacy Architecture (EPA)," http://www.ibm.com/services/security/epa.html
• 14: [14] Karjoth, G., Schunter, M., and Waidner, M., "Platform for Enterprise Privacy Practices: Privacy-enabled Management of Customer Data", Proceedings of the 2nd Workshop on Privacy Enhancing Technologies, 2002.
• 15: Deborah Russell , G. T. Gangemi, Sr., Computer security basics, O'Reilly & Associates, Inc., Sebastopol, CA, 1991
• 16: [16] Karger, P., Yair, F., "Security and Privacy Threats to ITS", The Second World Congress on Intelligent Transport Systems, pp. 2452-2458, November 1995.
• 17: Sean W. Smith , Steve Weingart, Building a high-performance, programmable secure coprocessor, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.31 n.9, p.831-860, April 23, 1999
• 18: [18] Dyer, J., Perez, R., Sailer, R., Van Doorn, L., "Personal Firewalls and Intrusion Detection Systems", 2nd Australian Information Warfare and Security Conference 2001, November 2001.
• 19: [19] Arbaugh, W. A., Farber, D. J., and Smith, J. M. "A Secure and Reliable Bootstrap Architecture." 1997.
• 20: [20] Security-Enhanced Linux, http://www.nsa.gov/selinux
• 21: [21] Bastille Linux, http://www.bastille-linux.org
• 22: Marc Langheinrich, Privacy by Design - Principles of Privacy-Aware Ubiquitous Systems, Proceedings of the 3rd international conference on Ubiquitous Computing, p.273-291, September 30-October 02, 2001, Atlanta, Georgia, USA
• 23: [23] Agre, P., "Looking Down the Road: Transport Informatics and the New Landscape of Privacy Issues", CPSR Newsletter 13(3). 1995.
• 24: Didier Samfat , Refik Molva , N. Asokan, Untraceability in mobile networks, Proceedings of the 1st annual international conference on Mobile computing and networking, p.26-36, November 13-15, 1995, Berkeley, California, United States [doi>10.1145/215530.215548]
• 25: [25] Reed, J., Krizman, K., Woerner, B., Rappaport, T., "An Overview of the Challenges and Progress in Meeting the E- 911 Requirement for Location Service," IEEE Communications Magazine, 30-37, April 1998.
• 26: Michael J. Covington , Wende Long , Srividhya Srinivasan , Anind K. Dev , Mustaque Ahamad , Gregory D. Abowd, Securing context-aware applications using environment roles, Proceedings of the sixth ACM symposium on Access control models and technologies, p.10-20, May 2001, Chantilly, Virginia, United States [doi>10.1145/373256.373258]
• 27: [27] Simone Fischer-Hubner, editor. IT-Security and Privacy - Design and Use of Privacy-Enhancing Security Mechanisms. LNCS. Springer. 2001.
• 28: [28] Pfitzmann, A., and Koehntopp, M.. Anonymity, unobservability, and pseudonymity - a proposal for terminology. In Workshop on Design Issues in Anonymity and Unobservability. 2000.
• 29: [29] Blacksher, S., Foley. T. Boulder HOPs Aboard GPS Tracking. In GPS World, January 01, 2002
• 30: [30] Open Services Gateway Initiative, http://www.osgi.org/

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Information flow controls

General Terms:
Security

Keywords:
automotive telematics, privacy, privacy policies, security