The version in the Kent Academic Repository may differ from the final published version. Users are advised to check http://kar.kent.ac.uk for the status of the paper. Users should always cite the published version of record.

No abstract

The automotive industry is witnessing an accelerated growth in digital innovations that turn modern vehicles into digital systems. Such innovations include services that entertain, support and guide drivers and passengers such as fleet management, autonomous driving, shared mobility and private renting. This makes the security of modern vehicles a crucial concern as they have evolved into cyber-physical and safety-critical systems. Therefore, a continuous and stateful monitoring of the usage of vehicular resources has become a paramount requirement. Indeed, several Identity and Access Management (IAM) frameworks have been proposed in the automotive field, but context awareness and continuity of control remain overlooked. To address these challenges, we present a stateful smart-car IAM that is based on Usage Control (UCON) and Verifiable Credentials (VCs) to protect in-car resources. The system uses Attribute Based Access Control (ABAC) policies to issue privileges to subjects (i.e. drivers, passengers or applications) according to their credentials and claims. The issued privileges are then used to decide whether to grant or deny access to in-car resources. Furthermore, the system continuously monitors subject claims, resource attributes and environmental conditions (e.g. location or time). Hence, if a change occurs, the system re-evaluates policies and updates or revokes issued privileges and usage decisions accordingly. In addition, the system enforces the Principle of Least Privilege (PoLP) by only asking for the minimum privileges that are required to make a decision about a particular action. Finally, we describe the architecture and implementation of the proposed IAM, discuss the evaluation results, and define future directions.

No abstract