Proposed Use Case #2 

Sticking with the automobile theme, I am concerned about authorization to access data stored within a vehicles computer systems.

As autos become smarter and more of them have built-in navigation and emergency communications systems, the data accumulating in these systems becomes increasingly personal.  The data is of value to many parties.  At a minimum these include the following:
  1. the vehicle "owner" 
    1. who may need emergency assistance
    2. who may want to look up some historical facts of his travel (distance traveled to a client site that may be reimbursable)
    3. who may want to update the information when he replaces parts or performs maintenance
    4. who may need to prove that he wasn't the driver when the car caused an accident or was used for criminal purposes
    5. erase his personal driving data when the car is sold or junked
  2. the mechanic 
    1. who may use the information for diagnostic purposes
    2. who may update the information with parts replaced, maintenance performed, or accident information
  3. the vehicle lessor (in case the vehicle is leased and not purchased)
    1. who may bill by mileage
    2. who may charge a premium for driving in certain areas (e.g., foreign countries)
  4. the insurance company who may charge lower rates for safe driving behavior
  5. a prospective second-hand buyer 
    1. who want to know both the driving history 
    2. the maintenance/repair history
    3. the accident history
  6. law enforcement
    1. who may use the information to investigate an accident
    2. who may use the information as evidence of negligent driving
    3. who may use the information to track a vehicle
  7. the auto manufacturer 
    1. who may use it to detect flaws
    2. who may use it to improve future models 
  8. wrongdoers 
    1. who may use it to track down their victims.
    2. may attempt to falsify the history to avoid insurance liability (e.g., in an accident)
    3. may attempt to falsify the history to improve resale value
    4. may attempt to falsify various information to disguise auto theft.

Unlike Ingo's use case which appears only to require uniquely identifying a vehicle, this scenario requires selectively authorizing read and write access to a large amount of personal data by a variety of parties.

Use Case #3
Electric refueling at a friend's house

As electric cars become more common, the scenario is likely to evolve where Bob drives Carole's electric car to visit Alice.  Once at Alice's house, he wants to recharge his vehicle using Alice's electric hookup.  But he wants the bill for the electricity used for charging to go to his account, rather than hers.  

Currently, to do this would likely require having Alice go online to her account to tell the electricity supplier that all electricity going through the car charge for the next three hours should be charged to Bob.   And Bob will have to go into his account to authorize the charges coming from Alice's charger.

As we migrate towards IoT, it may be possible to make this transaction more automated.  One obvious way is to allow the electric hookup to interrogate each car and change any charging to the registered owner of the vehicle.  This would solve many problems.  But in this case, it would mean that Carole would be charged for Bob's use of the electricity.  

Another option would be to use the scenario above, but allow for an override function.  The system may default to charging Alice, but by entering a command (through some interface which might be a hardware switch), Bob could authenticate and direct the charges to his account or credit card.

I don't consider this as interesting as Use Case #2.  But it does involve true authentication, not just identification.

Thank you.

Jeff

--
Jeff Stollman
stollman.j@gmail.com
1 202.683.8699

Truth never triumphs — its opponents just die out.
Science advances one funeral at a time.
                                    Max Planck