# Security Threats in Intelligent Transportation Systems and Their Risk Levels
## 3 Risk Analysis Study
### Risk Analysis Study in ITSs
#### 3.1.4 Security Objectives  
Restricting to the system assets discussed below, we outline the security targets that must be addressed when specifying the security configuration and protocols. These security goals are [PERSON] et al. (2012): (1) secure V2X communications; (2) secure the physical entities of the VANET (ITS infrastructure).  
To secure communication between ITS entities, multiple security requirements need to be guaranteed:  
* Availability: ITS entities and applications require a high level of availability for data and services, and require that at all times, authorized entities should never be denied access to requisite services.
* Authentication: Authentication ensures that entities involved in communication are correctly identified and authentic. Entity authorization is necessary for applications that need definition of the rights that an entity (vehicle or infrastructure) has.
* Integrity: Integrity ensures that exchanged information and data used inside the vehicle (sensor data, data used by software, etc...) are not modified.
* Confidentiality: Confidentiality consists of preventing sensitive information from reaching the wrong people.
* Privacy: Privacy is a crucial security concern because ITS systems share private information, including positional data, via wireless communications. The key to developing an ITS security solution is to consider policies that guarantee the protection of private data.  
We classify threats in ITSs into two categories: attacks targeting authentication (Table 1) and attacks targeting availability (Table 2).  
\begin{table}
\begin{tabular}{p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt}} \hline \hline
**Attack** & **Asset** & **Vulnerability** & **Threat** & **Solution** & **Violated Security Requirement** \\ \hline Sybil Attack & Infrastructure communication & Flaws in the routing table and unencrypted messages & Data leakage on back-end channel & Verification of the position of neighboring nodes ([PERSON] et al., 2006), VANET PKI ([PERSON] et al., 2006) & Authentication/ Availability \\ \hline User privacy disclosure & Vehicle user & Vulnerabilities of OBU; unsecured wireless communication & Revelation of user identity & Holistic approach to data transmission ([PERSON] and [PERSON], 2013) & Privacy/ Authentication \\ \hline Eavesdropping & Information & Nature of message delivery via a wireless communication channel & Revelation of sensitive information and private user IDs & Strong encryption of messages for user communication & Strong encryption of Privacy/ Authentication \\ \hline Impersonation attack & Information & Unsecured wireless communication channel & Message changes Message modifications & & Use variable MAC and IP addresses for V2V and V2I communications ([PERSON], 2012), Authenticate via digital certificates \\ \hline Spoofing attack & Information & Vulnerable wireless communication channel & Manipulation and abandonment of messages & Multi-antenna system with known motions (Montgomery verification in the region [PERSON] et al., 2008) & Authentication \\ \hline Sensor impersonation & Vehicle & Defects of vehicle equipments & Disclosure of sensitive information & SPECS ([PERSON] et al., 2011) & Authentication \\ \hline Wormhole attack & Infrastructure communication & Unencrypted back-end communication channel & Delete messages & Packet leash ([PERSON] et al., 2006); HEAP ([PERSON] et al., 2009) & Confidentiality/ Authentication \\ \hline \hline \end{tabular}
\end{table}
Table 1: Attacks targeting authentication.