Privacy Threat Analysis for connected and autonomous vehicles

Abstract

Connected and autonomous vehicles produce, store and communicate a large amount of personal data (the route taken, the stop points, home and work addresses, etc.). The development of this type of vehicles brings the opportunity to offer new services to road users, with more software and hardware components on the vehicle. Many of these components suffer from weaknesses that can be exploited. The issue is that a single vulnerability in one element of the system will threaten the privacy of the vehicle's users (The weakest link principle of IT security). In this paper, we present a privacy threat analysis on the general architecture of connected and autonomous vehicles, to point out privacy risks according to formal privacy requirements. We present a use case modularization and its analysis that helps us to discern the privacy requirements of this use case, which can be enabled by manufacturers. To meet the previous objectives, we follow a LINDDUN methodology of privacy threat analysis