A Privacy-Preserving Solution for Intelligent Transportation Systems: Private Driver DNA

Costantino, Gianpiero; Vincenzi, Marco De; Martinelli, Fabio; Matteucci, Ilaria

doi:10.1109/tits.2022.3217358

Cited by 7 publications

(3 citation statements)

References 64 publications

(70 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To the best of our knowledge supported by the survey [24], the work [7] is the only relevant study that proposes an attack concerning the post-payment PPETC schemes. In [7], the authors present an attack to find drivers' possible traces in a toy example of an ETC system.…”

Section: Attacks On Privacy In Etcmentioning

confidence: 99%

Why Privacy-Preserving Protocols Are Sometimes Not Enough: A Case Study of the Brisbane Toll Collection Infrastructure

Adavoudi Jolfaei,

Rupp,

Schiffner

et al. 2024

PoPETs

View full text Add to dashboard Cite

The use of Electronic Toll Collection (ETC) systems is on the rise, as these systems have a significant impact on reducing operational costs. Toll service providers (TSPs) access various information, including drivers' IDs and monthly toll fees, to bill drivers. While this is legitimate, such information could be misused for other purposes violating drivers' privacy, most prominent, to infer drivers' movement patterns. To this end, privacy-preserving ETC (PPETC) schemes have been designed to minimize the amount of information leaked while still allowing drivers to be charged. We demonstrate that merely applying such PPETC schemes to current ETC infrastructures may not ensure privacy. This is due to the (inevitable) minimal information leakage, such as monthly toll fees, which can potentially result in a privacy breach when combined with additional background information, such as road maps and statistical data. To show this, we provide a counterexample using the case study of Brisbane's ETC system. We present two attacks: the first, being a variant of the presence disclosure attack, tries to disclose the toll stations visited by a driver during a billing period as well as the frequency of visits. The second, being a stronger attack, aims to discover cycles of toll stations (e.g., the ones passed during a commute from home to work and back) and their frequencies. We evaluate the success rates of our attacks using real parameters and statistics from Brisbane's ETC system. In one scenario, the success rate of our toll station disclosure attack can be as high as 94%. This scenario affects about 61% of drivers. In the same scenario, our cycle disclosure attack can achieve a success rate of 51%. It is remarkable that these high success rates can be achieved by only using minimal information as input, which is, e.g., available to a driver's payment service provider or bank, and by following very simple attack strategies without exploiting optimizations. As a further contribution, we analyze how the choice of various parameters, such as the set of toll rates, the number of toll stations, and the billing period length, impact a driver's privacy level regarding our attacks.

show abstract

Section: Attacks On Privacy In Etcmentioning

confidence: 99%

Why Privacy-Preserving Protocols Are Sometimes Not Enough: A Case Study of the Brisbane Toll Collection Infrastructure

Adavoudi Jolfaei,

Rupp,

Schiffner

et al. 2024

PoPETs

View full text Add to dashboard Cite

show abstract

“…The four attributes that relate to privacy in CAVs: are unlinkability, anonymity, pseudonymity, and unobservability. [42,80] Numerous surveys [81][82][83][84][85][86][87][88][89] have been conducted regarding the privacy in VANETs. These suggest privacy schemes such as tree-based risk assessment, cryptography, location cloaking [90], encryption-pseudoduyms [91], and obfuscation [92].…”

Section: Attacks On Privacymentioning

confidence: 99%

“…The issue of concern is whether all this information gathered by the trust mechanisms/or models is private. To solve such concerns studies in [42,[80][81][82][83][84][85][86][87][88][89] have proposed trust mechanisms that make use cryptography techniques despite the high computational resource requirement [10]. This raises the issue of whether privacy solutions in connected vehicles can be implemented without cryptography if not then there is need to minimize resource usage.…”

Section: Privacymentioning

confidence: 99%

Cyber security analysis of connected vehicles

Mwanje,

Kaiwartya,

Aljaidi

et al. 2024

IET Intelligent Trans Sys

View full text Add to dashboard Cite

The sensor‐enabled in‐vehicle communication and infrastructure‐centric vehicle‐to‐everything (V2X) communications have significantly contributed to the spark in the amount of data exchange in the connected and autonomous vehicles (CAV) environment. The growing vehicular communications pose a potential cyber security risk considering online vehicle hijacking. Therefore, there is a critical need to prioritize the cyber security issues in the CAV research theme. In this context, this paper presents a cyber security analysis of connected vehicle traffic environments (CyACV). Specifically, potential cyber security attacks in CAV are critically investigated and validated via experimental data sets. Trust in V2X communication for connected vehicles is explored in detail focusing on trust computation and trust management approaches and related challenges. A wide range of trust‐based cyber security solutions for CAV have been critically investigated considering their strengths and weaknesses. Open research directions have been highlighted as potential new research themes in CAV cyber security area.

show abstract

Formal analysis of an AUTOSAR-based basic software module

Bodei,

De Vincenzi,

Matteucci

2024

Int J Softw Tools Technol Transfer

View full text Add to dashboard Cite

The widespread use of advanced driver assistance systems in modern vehicles, together with their integration with the Internet and other road nodes, has made vehicle more vulnerable to cyber-attacks. To address these risks, the automotive industry is increasingly focusing on the development of security solutions: formal methods and software verification techniques, which have been successfully applied to a number of safety-critical systems, could be a promising approach in the automotive area. In this work, we concentrate on in-vehicle communications, provided by many Electronic Control Units (ECUs) that work together thanks to serial protocols such as Controller Area Network (CAN). However, increasing connectivity exposes the internal network to a variety of cyber-risks. Our aim is to formally verify the AUTOSAR-based Basic Software module called CINNAMON, designed to ensure confidentiality, integrity, and authentication at the same time for traffic exchanged over CAN protocol. More precisely, it adds confidentiality guarantees to the Secure Onboard Communication (SecOC) module. We formally analyze CINNAMON with the verification tool Tamarin. Our analysis shows that CINNAMON could be an effective security solution, as it can ensure the desired properties, in particular, confidentiality in a send-receive scenario between two ECUs. Finally, we describe a potential application scenario.

show abstract

A Privacy-Preserving Solution for Intelligent Transportation Systems: Private Driver DNA

Cited by 7 publications

References 64 publications

Why Privacy-Preserving Protocols Are Sometimes Not Enough: A Case Study of the Brisbane Toll Collection Infrastructure

Why Privacy-Preserving Protocols Are Sometimes Not Enough: A Case Study of the Brisbane Toll Collection Infrastructure

Cyber security analysis of connected vehicles

Formal analysis of an AUTOSAR-based basic software module

Contact Info

Product

Resources

About