Skip to main content
SpringerLink
Log in

A Survey of Security and Privacy in Connected Vehicles

  • Chapter
Wireless Sensor and Mobile Ad-Hoc Networks

Abstract

Electronic control units (ECUs) of a vehicle control the behavior of its devices—e.g., break and engine. They communicate through the in-vehicle network. Vehicles communicate with other vehicles and road side units (RSUs) through vehicular ad-hoc networks (VANets), with personal devices through wireless personal area networks (WPANs), and with service center systems through cellular networks. A vehicle that uses an external network, in addition to the in-vehicle network, is called connected vehicle.

A connected vehicle could benefit from smart mobility applications: applications that use information generated by vehicles, e.g., cooperative adaptive cruise control. However, connecting in-vehicle network, VANet, WPAN, and cellular network increases the count and complexity of threats to vehicles, which makes developing security and privacy solutions for connected vehicles more challenging.

In this work we provide a taxonomy for security and privacy aspects of connected vehicle. The aspects are: security of communication links, data validity, security of devices, identity and liability, access control, and privacy of drivers and vehicles. We use the taxonomy to classify the main threats to connected vehicles, and existing solutions that address the threats. We also report about the (only) approach for verifying security and privacy architecture of connected vehicle that we found in the literature. The taxonomy and survey could be used by security architects to develop security solutions for smart mobility applications.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 84.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 109.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info
Hardcover Book
USD 109.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Notes

  1. 1.

    Infotainment devices are in most cases connected to the in-vehicle network; they are not members of the WPAN.

  2. 2.

    We do not enumerate all (possible) communication mediums—e.g., satellite communication—for vehicles. Instead, we discuss the networks that are commonly used and reported (in the literature) to impact the security and privacy of vehicles.

  3. 3.

    An OBU in general—e.g., OBU dedicated to VANets—does not act as a gateway to the in-vehicle network.

  4. 4.

    Terms smart mobility and ITS are often considered similar in the literature. In this work, we use vehicle to refer to car and truck when we discuss smart mobility and all transport means when we discuss ITS.

  5. 5.

    In the USA and Europe privacy violation is prohibited by the law.

  6. 6.

    We survey security and privacy threats and solutions for only connected vehicles, which may not include all security and privacy threats and solutions for smart mobility applications or ITS.

  7. 7.

    The identity of an unidentified entity is anonymous. Anonymous entities have access to public resources, if any.

  8. 8.

    The authors use the term intra-vehicle network to refer to in-vehicle network.

  9. 9.

    Session keys are symmetric keys shared by communicating parties and are valid for a duration of the communication.

  10. 10.

    This definition of anonymity is specific to the standard.

  11. 11.

    Encryption assures confidentiality of messages. Digital signature assures integrity and authenticity of messages.

  12. 12.

    Secure group communication is communication between a group whose members share a secret key, which they use to encrypt messages they exchange.

  13. 13.

    A cooperative driving application allows a set of vehicles, members of a VANet, to coordinate their actions by exchanging data through a VANet.

  14. 14.

    Confidentiality is required by few applications, such as platooning: vehicles follow each other such that they do not collide.

  15. 15.

    Value of n may depend on the memory of the device.

  16. 16.

    In this section we use mobile device to refer to OBU that has mobile device communication and processing capabilities. The reason is that the work that we refer to is about mobile device and not explicitly OBU; but, in general it applies to OBU.

  17. 17.

    The reader may consult Katz and Lindell [31] for background on cryptography—if needed.

  18. 18.

    Security processing is computations for the purpose of security, such as data encryption and signature.

  19. 19.

    WTLS supports both its own digital certificate format and X509.x format [37].

  20. 20.

    The difference between the reported locations of a vehicle by two other vehicles is smaller than an error margin.

  21. 21.

    The similarity test considers an error threshold in checking the equality of the computed distances.

  22. 22.

    Quadrilateral is a polygon with four edges and four vertices or corners. Quadrilateral (A, B, C, D) is convex if the product of the cross products \((\overrightarrow{AB} \times \overrightarrow{ BC})(\overrightarrow{BC} \times \overrightarrow{ CD})(\overrightarrow{CD} \times \overrightarrow{ DA})(\overrightarrow{DA} \times \overrightarrow{ AB})\) is positive.

  23. 23.

    The human–machine interface could be, for example, a mobile phone, or a device installed in the vehicle.

  24. 24.

    It checks if a computed ECU configuration register (ECR) (a signature of the firmware) is equal to the reference ECR received from the OEM.

  25. 25.

    The paper addresses ITS applications which, as we discussed in Sect. 2, includes connected vehicles.

  26. 26.

    An ontology is a representation of knowledge as a set of concepts and the relationships between them in a specific domain.

References

  1. Brooks R, Sander S, Deng J, Taiber J (2009) Automobile security concerns. IEEE Veh Technol Mag 4(2):52–64

    Article  Google Scholar 

  2. Mahmud S, Shanker S (2006) In-vehicle secure wireless personal area network (swpan). IEEE Trans Veh Technol 55(3):1051–1061

    Article  Google Scholar 

  3. Zhang J, Stojmenovic I (2005) Cellular networks. In: M. Gill (ed) Handbook of security, vol I, Part 2. Wiley, New York, pp 654–663

    Google Scholar 

  4. Intelligent Transport Systems (ITS)  Communications Architecture (2010) The European Telecommunications Standards Institute (ETSI) Std. ETSI EN 302 665, Rev. V1.1.1, 09 2010. http://www.webapp.etsi.org/workprogram/Report_WorkItem.asp?WKI_ID=28554

  5. Koscher K, Czeskis A, Roesner F, Patel S, Kohno T, Checkoway S, McCoy D, Kantor B, Anderson D, Shacham H, Savage S (2010) Experimental security analysis of a modern automobile. In: Proceedings of IEEE symposium on security and privacy, San Diego, CA, May 2010, pp 447–462

    Google Scholar 

  6. Johansson KH, Torngren M, Nielsen L (2005) Vehicle applications of controller area network. In: D Hristu-Varsakelis, W Levine (eds) Handbook of networked and embedded control systems. Springer, New York, pp 741–765

    Chapter  Google Scholar 

  7. Uzcategui R, Acosta-Marum G (2009) Wave: a tutorial. IEEE Commun Mag 47(5):126–133

    Article  Google Scholar 

  8. (2011) ecall: Time saved = lives saved. http://www.ec.europa.eu/information_society/activities/esafety/ecall/index_%en.htm

    Google Scholar 

  9. van Arem B, van Driel C, Visser R (2006) The impact of cooperative adaptive cruise control on traffic-flow characteristics. IEEE Trans Intell Transp Syst 7(4):429–436

    Article  Google Scholar 

  10. Markoff J Google cars drive themselves, in traffic. http://www.nytimes.com/2010/10/10/science/10google.html?_r=1&hp=&pagewa%nted=all

    Google Scholar 

  11. Kihl M (2009) Vehicular network applications and services. Vehicular networks techniques, standards, and applications. Auerbach Publications, Boston, pp 21–39

    Google Scholar 

  12. Karagiannis G, Altintas O, Ekici E, Heijenk G, Jarupan B, Lin K, Weil T (2011) Vehicular networking: A survey and tutorial on requirements, architectures, challenges, standards and solutions. IEEE Commun Surv Tutorials 13(4):584–616

    Article  Google Scholar 

  13. Westin A (1967) Privacy and freedom. Atheneum, New York

    Google Scholar 

  14. Shirey R (2007) Internet security glossary, Version 2. RFC 4949 (Informational). http://www.ietf.org/rfc/rfc4949.txt

  15. Parno B, Perrig A (2005) Challenges in securing vehicular networks. In: Workshop on hot topics in networks (HotNets-IV), College Park, Nov 2005. http://www.sparrow.ece.cmu.edu/~parno/pubs/vehicles.pdf

  16. (2012) Mobile phone spy cell phone monitoring and tracking system. http://www.mobilephonespyx.com/

  17. Raya M, Hubaux J-P (2007) Securing vehicular ad hoc networks. J Comput Secur 15(1):39–68

    Google Scholar 

  18. Wolf M, Weimerskirch A, Wollinger TJ (2007) State of the art: embedding security in vehicles. EURASIP J Embed Syst 2007:074706

    Article  Google Scholar 

  19. Pedroza G, Idrees M, Apvrille L, Roudier Y (2011) A formal methodology applied to secure over-the-air automotive applications. In: 2011 IEEE Vehicular technology conference (VTC Fall), Sept 2011, pp 1–5

    Google Scholar 

  20. Zhou T, Choudhury RR, Ning P, Chakrabarty K (2007) Privacy-preserving detection of sybil attacks in vehicular ad hoc networks. In: The 4th annual international conference on mobile and ubiquitous systems: computing, networking and services, Philadelphia, Aug 2007, pp 1–8. http://www.dx.doi.org/10.1109/MOBIQ.2007.4451013

  21. Wolf M, Weimerskirch A, Paar C (2004) Security in automotive bus systems. In: Workshop on embedded security in cars (escar)’04, Bochum, Germany, Nov 2004

    Google Scholar 

  22. Schweppe H, Idrees S, Roudier Y, Weyl B, Khayari RE, Henniger O, Scheuermann D, Pedroza G, Apvrille L, Seudie H, Platzdasch H, Sall M (2011) Deliverable d3.3: secure on-board protocols specification. Technical report, July 2011. http://www.evita-project.org/Deliverables/EVITAD3.3.pdf

  23. Bar-El H (2009) Intra-vehicle information security framework. In: Proceedings of the 7th ESCAR embedded security in cars conference, Dïsseldorf, Germany, Nov 2009

    Google Scholar 

  24. IEEE (2006) Trial-use standard for wireless access in vehicular environments - security services for applications and management messages. IEEE Std. http://www.ieeexplore.ieee.org/servlet/opac?punumber=11000

  25. Kargl F, Papadimitratos P, Buttyan L, Müter M, Wiedersheim B, Schoch E, Thong T-V, Calandriello G, Held A, Kung A, Hubaux J-P (2008) Secure vehicular communication systems: implementation, performance, and research challenges. IEEE Commun Mag, 46(11):110–118

    Article  Google Scholar 

  26. Papadimitratos P, Buttyan L, Holczer T, Schoch E, Freudiger J, Raya M, Ma Z, Kargl F, Kung A, Hubaux J-P (2008) Secure vehicular communication systems: design and architecture. IEEE Commun Mag 46(11):100–109

    Article  Google Scholar 

  27. Raya M, Hubaux J-P (2005) The security of vehicular ad hoc networks. In: The 3rd ACM workshop on security of Ad Hoc and sensor networks, series SASN ’05, Alexandria, VA, Nov 2005, pp 11–21

    Google Scholar 

  28. (2011) Secure vehicle communication. http://www.sevecom.org/Pages/Publications.html

  29. Randall S, Houmb S-H (2012) Experience in developing standards for cooperative systems. In: Workshop personal data protection and security aspects related to its applications, Brussels

    Google Scholar 

  30. Padgette J, Scarfone K, Chen L (2010) Guide to bluetooth security: recommendations of the national institute of standards and technology. National Institute of Standards and Technology (US), Gaithersburg

    Google Scholar 

  31. Katz J, Lindell, Y (2007) Introduction to modern cryptography. Chapman & Hall/CRC, Boca Raton

    Google Scholar 

  32. Lu Y, Meier W, Vaudenay S (2005) The conditional correlation attack: a practical attack on bluetooth encryption. In The 25th annual international conference on advances in cryptology, series CRYPTO’05. Springer, Santa Barbara, pp 97–117. http://www.dx.doi.org/10.1007/11535218_7

  33. Freier A, Karlton P, Kocher P (2011) The secure sockets layer (SSL) protocol version 3.0, internet engineering task force (IETF) Std. http://www.tools.ietf.org/html/rfc6101

  34. Postel J (1981) Transmission control protocol, Std. RFC793. http://www.tools.ietf.org/html/rfc793

  35. Ravi S, Raghunathan A, Kocher P, Hattangady S (2004) Security in embedded systems: design challenges. ACM Trans Embed Comput Syst 3(3):461–491

    Article  Google Scholar 

  36. L. Wireless Application Protocol Forum. Wireless transport layer security, Std, 2001. http://www.openmobilealliance.org/wapdocs/wap-261-wtls-20010406-a.pdf

  37. Housley R, Ford W, Polk W, Solo D (1999) Internet X.509 public key infrastructure certificate and CRL profile, Std. rfc2459. http://www.ietf.org/rfc/rfc2459.txt

  38. Jormalainen S, Laine J (1999) Security in WTLS. http://www.hut.fi/jtlaine2/wtls/

  39. Saarinen M-JO (1999) Attacks against the WAP WTLS protocol. In: The IFIP TC6/TC11 joint working conference on secure information networks: communications and multimedia security, Leuven, Belgium, Sept 1999, pp 209–215. http://www.dl.acm.org/citation.cfm?id=647800.736984

  40. Golle P, Greene D, Staddon J (2004) Detecting and correcting malicious data in VANETs. In: Proceedings of the 1st ACM international workshop on Vehicular ad hoc networks, series VANET ’04, Philadelphia, Oct 2004, pp 29–37. http://www.doi.acm.org/10.1145/1023875.1023881

  41. Su X, Boppana R (2008) Mitigating wormhole attacks using passive monitoring in mobile ad hoc networks. In: IEEE global telecommunications conference, 2008. IEEE GLOBECOM 2008, New Orleans, Dec 2008, pp 1–5

    Google Scholar 

  42. Shokri R, Poturalski M, Ravot G, Papadimitratos P, Hubaux J-P (2009) A practical secure neighbor verification protocol for wireless sensor networks. In: Proceedings of the 2nd ACM conference on wireless network security, series WiSec ’09, New York, pp 193–200. http://www.doi.acm.org/10.1145/1514274.1514302

  43. Dietzel S, Schoch E, Könings B, Weber M, Kargl F (2010) Resilient secure aggregation for vehicular networks. Netw Mag Glob Internetw 24(1):26–31. http://www.dx.doi.org/10.1109/MNET.2010.5395780

  44. Zadeh LA (1975) Fuzzy logic and approximate reasoning. Synthese 30:407–428. doi:10.1007/BF00485052. http://www.dx.doi.org/10.1007/BF00485052

  45. Hubaux J, Capkun S, Luo J (2004) The security and privacy of smart vehicles. IEEE Secur Privacy 2(3):49–55

    Article  Google Scholar 

  46. (2012) Evita project: E-safety vehicle intrusion protected applications. European commission research grant fp7-ict-224275. www.evita-project.org

  47. Apvrille L, Khayari RE, Henniger O, Roudier Y, Schweppe H, Seudié H, Weyl B, Wolf M (2010) Secure automotive on-board electronics network architecture. In: FISITA 2010 world automotive congress, Budapest, Hungary, May–June 2010

    Google Scholar 

  48. (2012) Autosar. http://www.autosar.org/

  49. Hersteller Initiative Software - Security Working Group (2009) SHE-functional specification v1.1, rev 439

    Google Scholar 

  50. Idrees MS, Schweppe H, Roudier Y, Wolf M, Scheuermann D, Henniger O (2011) Secure automotive on-board protocols: a case of over-the-air firmware updates. In Proceedings of the 3rd international conference on Communication technologies for vehicles. Springer, Berlin/Heidelberg, pp 224–238. http://www.dl.acm.org/citation.cfm?id=1987310.1987333

  51. Studer A, Bai F, Bellur B, Perrig A (2009) Flexible, extensible, and efficient vanet authentication. J Commun Networks 11(6):574–588

    Article  Google Scholar 

  52. Wolf M (2010) A secure and privacy-preserving electronic license plate. In Automotive: safety & security, Stuttgart, Germany, 21–23 June 2010

    Google Scholar 

  53. (2012) Oversee. https://www.oversee-project.com/

  54. (2012) Preciosa-privacy enabled capability in co-operative systems and safety applications. http://www.preciosa-project.org/

  55. Kargl F, Schaub F, Dietzel S (2010) Mandatory enforcement of privacy policies using trusted computing principles. In: AAAI spring symposium: intelligent information privacy management, Stanford, CA, Mar 2010

    Google Scholar 

  56. Kung A, Freytag J, Kargl F (2011) Privacy-by-design in ITS applications. In: 2011 IEEE international symposium on a world of wireless, mobile and multimedia networks (WoWMoM), Lucca, Italy, June 2011, pp 1–6

    Google Scholar 

  57. Kost M, Freytag J-C, Kargl F, Kung A (2011) Privacy verification using ontologies. In: The 1st international workshop on privacy by design, Vienna, Austria, Aug 2011, pp 627–632

    Google Scholar 

  58. Pedroza G, Apvrille L, Knorreck D (2011) AVATAR: a SysML environment for the formal verification of safety and security properties. In: The 11th annual international conference on new technologies of distributed systems (NOTERE), Paris, France, Mar 2011, pp 1–10

    Google Scholar 

  59. TTool - an open-source UML and SysML toolkit. http://www.ttool.telecom-paristech.fr/

  60. Object Management Group Inc (OMG) (2010) OMG systems modeling language (OMG SysML). http://www.sysml.org/docs/specs/OMGSysML-v1.2-10-06-02.pdf

  61. Blanchet B (2009) Automatic verification of correspondences for security protocols. J Comput Secur 17(4):363–434. http://www.dl.acm.org/citation.cfm?id=1576303.1576304

  62. Dolev D, Yao AC (1981) On the security of public key protocols. Technical report, Stanford

    Book  Google Scholar 

Download references

Acknowledgements

This work is supported by the Dutch national HTAS innovation program; HTAS being an acronym for High Tech Automotive Systems. More information on this innovation program is accessible via the document http://www.htas.nl/files/pdf%20bestanden/HTAS_Innovatie_Programma_-_september_2007[2].pdf. Any opinions expressed in this chapter are those of the authors and do not necessarily reflect those of Dutch national HTAS innovation program.

The authors thank Dr. Arno Spinner, from The Federal Highway Research Institute (BASt), Germany, and Pelin Anguin, from Purdue University, for providing valuable comments on an earlier draft of this book chapter.

Author information

Authors and Affiliations

  1. Department of Mathematics and Computer Science, Eindhoven University of Technology, Eindhoven, The Netherlands

    Lotfi Ben Othmane & Harold Weffers

  2. Faculty of Computer Science and Information System, Universiti Teknologi Malaysia, Johor, Malaysia

    Mohd Murtadha Mohamad

  3. ESCRYPT GmbH–Embedded Security, Munich, Germany

    Marko Wolf

Authors
  1. Lotfi Ben Othmane
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Harold Weffers
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Mohd Murtadha Mohamad
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Marko Wolf
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Lotfi Ben Othmane .

Editor information

Editors and Affiliations

  1. Engineering Technology Department, University of Houston College of Technology, Houston, Texas, USA

    Driss Benhaddou

  2. Department of Computer Science, Western Michigan University, Kalamazoo, Michigan, USA

    Ala Al-Fuqaha

Rights and permissions

Reprints and permissions

Copyright information

© 2015 Springer New York

About this chapter

Cite this chapter

Othmane, L.B., Weffers, H., Mohamad, M.M., Wolf, M. (2015). A Survey of Security and Privacy in Connected Vehicles. In: Benhaddou, D., Al-Fuqaha, A. (eds) Wireless Sensor and Mobile Ad-Hoc Networks. Springer, New York, NY. https://doi.org/10.1007/978-1-4939-2468-4_10

Download citation

  • DOI: https://doi.org/10.1007/978-1-4939-2468-4_10

  • Publisher Name: Springer, New York, NY

  • Print ISBN: 978-1-4939-2467-7

  • Online ISBN: 978-1-4939-2468-4

  • eBook Packages: EngineeringEngineering (R0)

Publish with us

Policies and ethics

Search

Navigation