IoT applications in transportation involve an interconnected network of devices and systems, such as sensors, actuators, analytics platforms, and cloud-based solutions [7]. Core components include:

Sensors and GPS: these devices collect data on vehicle location, traffic patterns, and environmental factors

RFID and cameras: RFID tags help track vehicles, while cameras monitor congestion, supporting effective traffic management and automated tolling [8].

Communication protocols: technologies such as 5G, Wi-Fi, Zigbee, and Dedicated Short-Range Communication (DSRC) enable real-time data exchange between devices and central systems, ensuring high-speed, low-latency communication, which is essential to IoT [9].

Together, these components create a framework for smart traffic management, vehicle tracking, and improved passenger safety, forming the foundation of intelligent transportation networks [10].

As IoT increasingly integrates into critical infrastructure, such as transportation, specific security and privacy practices have been developed to address unique challenges [11]. Initial research concentrated on device security and encryption for communication and data management [12]. As IoT systems expanded, the focus shifted to network security, intrusion detection, and privacy measures to address new threats and safeguard user data from unauthorized access [13].

Several studies have examined security issues in IoT-powered transportation networks. For example, Wu et al. [14] analyzed intrusion detection methods for vehicular networks, while Zhang et al. [15] researched privacy-preserving techniques for data aggregation. Emerging work on blockchain applications within IoT highlights the potential of decentralized security for transportation systems [16]. However, further research is needed to address challenges such as high mobility and dynamic network connectivity, especially for real-time security responses [17].

Despite progress in IoT security, there are still areas that need attention, such as managing real-time threats and designing systems capable of meeting high-speed, low-latency demands. Moreover, balancing user privacy with data usability for operational purposes remains underexplored [6]. This paper addresses these gaps by evaluating existing approaches and proposing new directions to enhance security and privacy in smart transportation systems [17].

Network-level threats target the communication infrastructure of IoT-based transportation systems. Key examples include:

Distributed Denial of Service (DDoS) attacks: DDoS attacks overwhelm networks, hindering legitimate service access. In a transportation context, such attacks can disrupt traffic signal operations or Vehicle-to-Vehicle (V2V) communication, resulting in congestion and an increased likelihood of accidents [19].

Eavesdropping and spoofing: attackers may intercept or manipulate communications between devices, impersonating legitimate users or injecting false information to disrupt transportation operations [20].

Unauthorized access: insufficient access controls can allow unauthorized individuals to access network resources, potentially leading to the misuse of sensitive information or operational disruptions [21].

Device-level threats target vulnerabilities inherent to individual IoT devices in transportation networks. Common issues include:

Weak authentication: Many IoT devices operate with default or inadequate passwords, making them easy targets for unauthorized access.

Firmware vulnerabilities: devices with unpatched firmware are exposed to malware, which may compromise functionality or allow attackers to access sensitive information.

Physical tampering: when IoT devices are physically accessible, as in public transportation or roadside installations, they are compromised, underscoring the need for robust security measures.

Data-related threats jeopardize the confidentiality, integrity, and availability of information within IoT-enabled transportation systems:

Data manipulation: tampered data can lead to incorrect traffic management and route optimization decisions [22].

Data breaches: unauthorized access to personal data, such as user travel patterns, can violate privacy and expose individuals to risks, including stalking [23].

Data loss: hardware failures or cyberattacks can result in data loss, negatively affecting transportation operations and the reliability of predictive analytics [24].

Recent incidents illustrate the real-world consequences of security breaches in IoT-enabled transportation. For instance, in 2017, a hacker accessed traffic light control systems in Dallas, Texas, resulting in significant congestion and operational delays. Additionally, vulnerabilities in the wireless communication protocols of autonomous vehicles have exploited, allowing attackers to interfere with vehicle control systems. These cases highlight the urgent need for enhanced security measures to safeguard transportation infrastructure against malicious threats.

IoT systems in transportation continually track vehicle locations and travel paths, offering comprehensive insights into individual movements. If this information is improperly accessed or exploited, it could violate user privacy by exposing sensitive details about personal habits and locations. The issue of location tracking is particularly contentious in public transport, where users may be unaware of or not consent to data collection.

In addition to tracking locations, IoT systems gather information on user preferences, travel history, and payment information. While this data collection can enhance service efficiency, it also poses risks, such as identity theft and targeted surveillance, if not adequately protected. Furthermore, data originally collected for operational reasons might be reused for commercial purposes without users' explicit consent, thereby infringing on essential data privacy rights.

Data that is not properly anonymized can often be traced back to specific individuals through re-identification methods. When IoT transportation systems aggregate data for analytical purposes, safeguarding user privacy becomes increasingly difficult. Studies have shown that aggregated data, when analyzed alongside other datasets, can lead to privacy breaches even when personal identifiers have been removed [25].

Privacy regulations, such as the EU's General Data Protection Regulation (GDPR), are designed to protect individual data by requiring transparency, user consent, and data protection. However, the international nature of transportation networks makes compliance challenging due to differing privacy laws across regions. Additionally, ethical considerations arise, as transportation operators must protect personal information while striving for operational efficiency and service enhancements.

There have been numerous incidents of privacy breaches within IoT-enabled transportation systems worldwide. Examples include unauthorized surveillance in London's public transport systems and the mishandling of passenger data by third-party companies across various ride-sharing services. Such breaches undermine user trust and expose transportation agencies to legal liability, underscoring the urgent need for effective privacy protection strategies.

Robust authentication and access control measures are crucial for protecting IoT devices and networks. Multi-Factor Authentication (MFA): MFA enhances security by requiring users to provide two or more verification forms before granting access. For example, transportation authorities could adopt MFA for system administrators managing traffic control systems, utilizing a combination of passwords, security tokens, and biometric identification. It significantly lowers the chances of unauthorized access [26].

Role-Based Access Control (RBAC): Implementing RBAC allows organizations to assign permissions based on user roles within the system. For instance, only designated personnel should be allowed to adjust traffic signal settings or access sensitive user information. This approach reduces exposure and safeguards critical infrastructure from insider threats [27].

Encryption is essential for securing data during transmission and at rest within IoT networks.

End-to-End Encryption (E2EE): E2EE ensures that data exchanged between IoT devices and central servers remains encrypted throughout transmission. It means that even if an attacker intercepts the data, they cannot decrypt it without the appropriate keys. For example, vehicle-to-vehicle (V2V) communications can use end-to-end (E2EE) encryption to protect against eavesdropping.

Public Key Infrastructure (PKI): PKI enables secure device-to-device communication through asymmetric encryption. In the transportation sector, PKI can verify devices before they interact, ensuring only trusted devices are connected to the network.

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) monitor network traffic and device activity to identify and respond to potential threats.

Network-based and host-based IDS: A network-based IDS monitors traffic across the network, while a host-based IDS evaluates activities on individual devices. Both systems can identify anomalies that may indicate security breaches. For instance, an IDS might detect unusual traffic patterns from a specific vehicle, suggesting a possible compromise [28].

Machine learning in intrusion detection: leveraging machine learning algorithms in IDS enhances the system's ability to learn from historical data and more effectively identify emerging threats. By continuously adapting to new normal behavior patterns, these systems can provide timely alerts for potential security incidents.

Blockchain technology is innovative in enhancing security and privacy in IoT-enabled transportation networks.

Immutable ledger for transaction security: blockchain creates an unchangeable record of all transactions, particularly useful for documenting vehicle interactions and traffic data. This transparency ensures that data cannot be altered retroactively, providing an audit trail that increases accountability [29].

Smart contracts for automated security protocols: Smart contracts enable automated enforcement of predefined security measures when specific conditions are met. For example, a smart contract could automatically revoke access to a vehicle's control system if a potential security breach is detected [30].

Federated learning is a decentralized approach to machine learning that enables devices to collaboratively develop a shared model while keeping their data local.

Data locality and privacy: rather than transmitting raw data to a central server, devices train a model locally and only share model updates. This method significantly reduces the risk of data exposure, as sensitive information remains on the device. For example, public transportation systems can analyze passenger usage patterns without disclosing individual identities [31].

Differential privacy introduces noise into datasets to protect individual entries while permitting meaningful data analysis.

Safeguarding user identity: differential privacy ensures that the results of data analyses do not disclose sensitive information about any particular user by adding randomness to datasets. For instance, traffic data can be aggregated to remain valuable for operational decisions without compromising individual drivers' privacy [32].

Secure Multiparty Computation (SMPC) allows multiple parties to compute functions based on their inputs while keeping those inputs confidential.

Collaborative data analysis: in the transportation sector, stakeholders (such as public transport agencies and vehicle manufacturers) can analyze data together to generate shared insights without exposing sensitive information. For example, a city might study traffic patterns using data from different ride-sharing services without needing access to proprietary user data from those companies [33].

Many IoT devices have restricted processing power and storage capabilities, which can impede the deployment of sophisticated security measures. These devices are often designed to focus on efficiency and cost-effectiveness, making it difficult to implement strong encryption or advanced security protocols [34].

The expenses for implementing advanced security solutions can be substantial, especially for smaller municipalities or organizations with constrained budgets. Financial investments in security measures often compete with other operational costs, leading to insufficient funding for essential security initiatives.

The absence of standardized security protocols across various IoT devices and platforms complicates the development of unified security frameworks. Moreover, the international nature of transportation networks means that adhering to differing regional regulations can be cumbersome, making it challenging for organizations to ensure comprehensive data protection.

Future research should focus on developing IoT devices with built-in security features, such as Hardware Security Modules (HSMs) that provide secure key management and storage. This approach would significantly bolster the network's overall security.

Progress in Artificial Intelligence (AI) and machine learning has the potential to greatly improve threat detection capabilities. Future studies could investigate the development of AI-based models that continuously learn from emerging threats and adapt their responses in real-time [28].

Collaboration among public agencies, private-sector companies, and academic institutions can enable the sharing of threat intelligence, resources, and best practices, thereby strengthening security standards across the transportation industry.

As quantum computing advances, conventional encryption methods may become vulnerable. Therefore, researching quantum-resistant cryptographic algorithms is essential to ensure the long-term security of IoT-enabled systems.