A car sharing company provides a fleet of 20 vehicles, with the following features:
Each user of the sharing scheme has an individual smart-card enabling them to open the car, as long as they have booked the car for the corresponding period (see for instance how Co-Wheels operates).
The company provides a 24/7 emergency service, where an employee can come and unlock a car if needed. All vehicles are electric and must be returned to Vehicle-to-Grid charger at the end of the rental period.
All vehicles have a constant GPS tracking, in case of car theft, as well as external noise and pollution sensors monitoring surrounding traffic, which feed into the local Data Observatory
This is for an assignment for a Network Security module. I'm not asking anyone to do it for me, I just need this to start it off and I've been staring at the spec for a few hours and I can't think of a valid security risk. We can also make assumptions as long as they are reasonable.
Answering Peter's points here:
- We don't have much information about that but I would assume that once a car is not booked but in motion the GPS tracking will flag it and someone will look into it (although that isn't stated)
- That is a good one but I think every user and the service people will have their own smartcard so the system will know who has unlocked the car
- In this case, there should be a penalty to the user who failed to return the car in time but he should still be able to return it.
- For this, I would say it tracks the location at all times. As for outages, nothing is said but how would you use that in an attack?
- I think it will be encrypted with a private key so theoretically, it should be safe.
- I think it's safe to assume it's nonrepudable
- The system admin will be able to monitor all cars and individuals will only see the location of where the car they have booked will be available to pick up let's say a few hours prior to booking
- You will have to pay when you book the car so this is not a problem
- If you can think of a legit way to obtain them then I guess it could work Thanks for your suggestions, overall they seem to go into too much detail about how the system works which is not wrong, I just think that for the assignment we need to look more globally. For example, a possible attack is stealing a smart card to obtain access to a car but then the booking requirements takes care of that case and I can't think of anything like that.