Efficient & Reliable Transportation of Consigments (ERTOC)

该小组主要负责拟议系统的信息安全和保证方面，特别是关于数据收集（从各种来源）、存储（在中央数据中心）和提供数据访问（通过拟议的开放式API）。拟议的工作将调查和评估技术和程序机制，以确保：（1）访问中央数据中心得到授权，并严格监测操作合规性。协议，基于相互认证，和访问日志，为不可否认的，将被设计和评估。（2）匿名和隐私的乘客，司机和车辆保持。这可能涉及在访问时强制中央集线器的部分和受限视图，并且在应用程序严格必要的情况下，使用匿名性来提供数据的一致视图，（3）所有形式的网络通信都经过认证，并在必要时保持机密性。车辆数据的收集和各利益相关者对中央枢纽的访问都应受到保护。将评估通过互联网协议（IP）提供这种措施的工业标准协议，例如IPSec、SSH和SSL，最后（4）该系统被设计为提供对数据的全面和灵活的可配置访问，以便为系统管理员提供控制和调解访问。将提出定期审查信息安全的程序机制，以帮助管理员在必要时改变和优化访问。一旦系统实施并准备试用，该团队将进行专门设计的渗透测试，以验证系统是否存在任何漏洞，特别是由于底层操作系统和应用程序平台造成的漏洞。这种测试应有助于对系统的严格设计和执行提供信心。

This team is largely responsible for information security and assurance aspects of the proposed system, particularly with regards to data collection (from a variety of sources), storage (in a central data hub), and provision of access to the data (through the proposed open API). The proposed effort will investigate and evaluate technical and procedural mechanisms to ensure that: (1) access to the central data hub is authorised and strictly monitored for operational conformity. Protocols, based on mutual authentication, and access logging, for non-repudiation, will be designed and evaluated, (2) anonymity and privacy of consignments, drivers and vehicles is maintained. This may involve forcing partial and restricted views of the central hub upon access, and where strictly necessary for the purposes of application, pseudonymity is used to provide a coherent view of data, (3) all forms of networked communication are authenticated, and preserve confidentiality where necessary. Both collection of vehicle data and access to the central hub by various stakeholders is to be protected as such. Industry standard protocols such as IPSec, SSH and SSL, providing such measures over Internet Protocol (IP) will be evaluated for purpose, and finally (4) the system is designed to provide configurable access to data that is both comprehensive and flexible, with a view to providing administrators of the system to control and mediate access. Procedural mechanisms will be proposed for periodic reviews of information security to help administrators change and optimise access as and when necessary. Once the system is implemented and ready for trial, the team will undertake purpose-designed penetration tests to validate the system against any vulnerabilities, particularly due to the underlying operating system and application platforms. Such tests should serve to provide confidence in the rigorous design and implementation of the system.