St. Petersburg Federal Research Center of the Russian Academy of Sciences (SPC RAS), 199178 St. Petersburg, Russia.
Sensors (Basel). 2022 Jul 5;22(13):5063. doi: 10.3390/s22135063.
Nowadays, the whole driver monitoring system can be placed inside the vehicle driver's smartphone, which introduces new security and privacy risks to the system. Because of the nature of the modern transportation systems, the consequences of the security issues in such systems can be crucial, leading to threat to human life and health. Moreover, despite the large number of security and privacy issues discovered in smartphone applications on a daily basis, there is no general approach for their automated analysis that can work in conditions that lack data and take into account specifics of the application area. Thus, this paper describes an original approach for a security and privacy analysis of driver monitoring systems based on smartphone sensors. This analysis uses white-box testing principles and aims to help developers evaluate and improve their products. The novelty of the proposed approach lies in combining various security and privacy analysis algorithms into a single automated approach for a specific area of application. Moreover, the suggested approach is modular and extensible, takes into account specific features of smartphone-based driver monitoring systems and works in conditions of lack or inaccessibility of data. The practical significance of the approach lies in the suggestions that are provided based on the conducted analysis. Those suggestions contain detected security and privacy issues and ways of their mitigation, together with limitations of the analysis due to the absence of data. It is assumed that such an approach would help developers take into account important aspects of security and privacy, thus reducing related issues in the developed products. An experimental evaluation of the approach is conducted on a car driver monitoring use case. In addition, the advantages and disadvantages of the proposed approach as well as future work directions are indicated.
如今，整个驾驶员监控系统都可以安装在车载智能手机中，这给系统带来了新的安全和隐私风险。由于现代交通系统的性质，此类系统中的安全问题可能会产生至关重要的后果，导致对人类生命和健康的威胁。此外，尽管每天都有大量的智能手机应用程序中发现安全和隐私问题，但针对这些问题，还没有一种通用的自动化分析方法，能够在缺乏数据的情况下工作，并考虑到应用领域的具体情况。因此，本文描述了一种基于智能手机传感器的驾驶员监控系统安全和隐私分析的原创方法。该分析使用白盒测试原理，旨在帮助开发人员评估和改进其产品。所提出方法的新颖之处在于将各种安全和隐私分析算法结合到针对特定应用领域的单一自动化方法中。此外，所提出的方法是模块化和可扩展的，考虑了基于智能手机的驾驶员监控系统的特定功能，并在数据缺乏或无法访问的情况下工作。该方法的实际意义在于基于所进行的分析提供的建议。这些建议包含已检测到的安全和隐私问题及其缓解方法，以及由于缺乏数据而导致的分析的局限性。假设这种方法可以帮助开发人员考虑安全和隐私的重要方面，从而减少开发产品中的相关问题。在驾驶员监控用例中对该方法进行了实验评估。此外，还指出了所提出方法的优缺点以及未来的工作方向。
