  Future smart cities and intelligent world will have connected vehicles and
smart cars as its indispensable and most essential components. The
communication and interaction among such connected entities in this vehicular
internet of things (IoT) domain, which also involves smart traffic
infrastructure, road-side sensors, restaurant with beacons, autonomous
emergency vehicles, etc., offer innumerable real-time user applications and
provide safer and pleasant driving experience to consumers. Having more than
100 million lines of code and hundreds of sensors, these connected vehicles
(CVs) expose a large attack surface, which can be remotely compromised and
exploited by malicious attackers. Security and privacy are serious concerns
that impede the adoption of smart connected cars, which if not properly
addressed will have grave implications with risk to human life and limb. In
this research, we present a formalized dynamic groups and attribute-based
access control (ABAC) model (referred as \cvac) for smart cars ecosystem, where
the proposed model not only considers system wide attributes-based security
policies but also takes into account the individual user privacy preferences
for allowing or denying service notifications, alerts and operations to
on-board resources. Further, we introduce a novel notion of groups in vehicular
IoT, which are dynamically assigned to moving entities like connected cars,
based on their current GPS coordinates, speed or other attributes, to ensure
relevance of location and time sensitive notification services to the
consumers, to provide administrative benefits to manage large numbers of smart
entities, and to enable attributes and alerts inheritance for fine-grained
security authorization policies. We present proof of concept implementation of
our model in AWS cloud platform demonstrating real-world uses cases along with
performance metrics.
