![](bg2.png)
location information to the cloud. MSs are authorized
based on a whitelist concept. A DC is authorized by
the cloud service by using a light-weight implemen-
tation of the OAuth 2.0 protocol. The accompanying
web platform will be an IoT cloud service where van
companies may sign up, authenticate themselves and
manage their vehicle data.
2 RELATED WORK
Real-time tracking systems have been a field of in-
terest for many researchers during the past decades.
Tracking systems have been introduced for various
purposes like vehicle position tracking systems, anti-
theft systems, fleet management systems and intel-
ligent transportation systems. Some of the propo-
sed systems involve the use of SMS communication
hence providing cost-effectiveness due to the low rate
for SMS and the restricted availability of later gene-
ration of mobile network infrastructures (i.e., 3G and
4G in developing countries).
Verma and Bhatia presented a tracking system
using GPS and GSM technologies (Verma and Bha-
tia, 2013). However, the system neglected to co-
ver security aspects of using SMS service to send
location data which may be considered as compro-
mising privacy. In another study, Lee et al. de-
pict a hybrid vehicle tracking system (GPRS alterna-
tive) able to send data over GSM (Lee et al., 2014).
Although the study includes many technical details
about how data is stored and later visually presen-
ted to the users, the authors seem not to have addres-
sed security and privacy concerns imposed when sen-
ding private information over SMS. A recent study
reports on a vehicle tracking and monitoring system
built on top of the GPS-GSM technology emphasi-
zing the provided security against possible vehicle
thefts but failing to address the security perspective
of the GSM networks and SMS itself (Kumar et al.,
2016). An extensive vehicle tracking and monitoring
system using a single-board computer (Raspberry Pi)
with an SIM900A module have been proposed and
designed (Shinde et al., 2015). Besides the exciting
features, they introduce such as interfacing a file sy-
stem of a single board computer from a smartphone to
select and load a pre-fixed path to ensure secure trave-
ling, SMS security aspects, and proposed rectification
mechanism are not depicted. In common, the above-
referenced studies all rely on the security provided in
SMS, which is known to be insufficient (Toorani and
Beheshti, 2008a).
Some studies report on solutions that aim to
provide authentication, integrity, confidentiality, and
non-repudiation for SMS. SMSSec is a protocol
founded on a combination of asymmetric-key and
symmetric-key cryptography that relies on a two-
factor authentication strategy for their initial hands-
haking phase (Lo et al., 2008). A major drawback
of the protocol is the implications produced by their
inclusion of Rivest, Shamir, & Adleman (RSA) en-
cryption scheme with 2048-bit keys resulting in cip-
hertext block that exceeds 140 bytes. Thus, two SMS
messages are needed for a single protocol message
in the initialization of the handshaking phase. For
their communication back from the server, a symme-
tric technique is used with smaller key-size to ensure
that the message sent back fits within a single SMS
message.
Another proposed solution called SMSS uses a
certificate-based protocol that suggests following ty-
pical rules of Public Key Infrastructures (PKIs) by is-
suing of a unique public-private key pair for each user
(subscriber) and the involvement of a Certificate Aut-
hority (CA) (Toorani and Beheshti, 2008b). It applies
an encryption scheme based on Elliptic Curve Cryp-
tography (ECC) that uses public keys for the esta-
blishment of a shared secret key. Moreover, each time
an entity tries to establish communication, it must pre-
conditionally query the OCSP server completely de-
legating validations to a trusted server. However, this
appears to be done in an insecure way using plain text
via SMS. The system has a number of vulnerabilities.
The OCSP server’s original address can be spoofed.
The SMS response, that the source entity expects to
receive after trying to establish and communicate with
the destination entity, can be forged. An attacker can
derive the signature and can replace the public key
of the destination entity to be used by the origina-
ting identity for encrypting its messages. This indu-
ces problems in decrypting of the incoming messa-
ges since they were not rightfully encrypted. Further-
more, the proposed protocol would require that net-
work operators modify their existing infrastructures.
Other protocols are based on the identity-based
cryptosystems, where users need to communicate
with a trusted agent providing a Private Key Gene-
rator (PKG) whose master key must be kept secret.
The requirement to have an authentic CAs public key
for verifying certificates in a solution as SMSS is re-
placed by the requirement to have authentic PKG’s
system to bootstrap the ID-based cryptosystems (Ja-
cobsen et al., 2015). The proposed ID-based encryp-
tion scheme will require network operators to adapt
their infrastructure as well as require them to pre-
load and configure secret information for their cor-
responding private key within the Subscriber Identity
Module (SIM) cards before distributing them to the
IoTBDS 2017 - 2nd International Conference on Internet of Things, Big Data and Security
158