March 14, 2017 By Larry Loeb 2 min read

As vehicles become more and more autonomous, they rely on computer systems to provide location services and communicate with other vehicles that may be on the road.

This dependence on systems that track a vehicle’s position contributes to the collection of personally identifiable position data. That, in turn, could lead to the automatic and routine surveillance of users’ everyday travels — data that would certainly be useful to various enterprises, such as insurance companies.

Tracking Location Services

Researchers at Hanyang University in Ansan, South Korea, may have come up with a way to confuse these tracking systems so they cannot establish a personally identifiable path for a vehicle. In their paper, “Preserving Location Privacy of Connected Vehicles With Highly Accurate Location Updates,” researchers explained how they took advantage of the two different communications systems that a vehicle can use: the location-based system (LBS) and the vehicle-to-vehicle (V2V) communication capability.

The LBS shouldn’t be trusted from a security standpoint. Operating much like a traditional tracker, an LBS usually uses an LTE internet network and can generate a time-series analysis of location samples. This gives the path information of the driver, which can establish a location history.

There is also a beacon for vehicle-to-vehicle communication within these automobiles. This technology shouts out local, safety-related messages to any vehicles that might be close in proximity.

Obfuscating V2V Communication Data

Researchers used both of these radio channels to implement their security method, called mutually obfuscating paths (MOPs). Once two vehicles are close enough to send beacon messages to each other, MOPs have the two vehicles stop independently sending location data to the LBS. Instead, each one sends the data from both of the vehicles.

This ends up generating multiple paths: the real one and the alternative taken by the other vehicle. However, the LBS doesn’t know which is which and discards the data.

Motherboard reported that the researchers evaluated the scheme via simulations. The best results were found in high-traffic situations, since this scenario offers the most V2V communication for location services. With multiple vehicles present, there were many alternate paths that could be sent to the LBS by the user vehicle to confuse any potential tracking systems.

Ultimately, this approach may pave the way for privacy to coexist with location mapping as part of the autonomous vehicles of the future.

More from

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

New proposed federal data privacy law suggests big changes

3 min read - After years of work and unsuccessful attempts at legislation, a draft of a federal data privacy law was recently released. The United States House Committee on Energy and Commerce released the American Privacy Rights Act on April 7, 2024. Several issues stood in the way of passing legislation in the past, such as whether states could issue tougher rules and if individuals could sue companies for privacy violations. With the American Privacy Rights Act of 2024, the U.S. government established…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today