Which types of people are expected customers for this device?

The expected users of device are all consumers or for car driver or anyone need to record the driving condition and protect their assets. The expected organizations of device include individual home users, enterprises and governments, etc. Device would be mainly used in consumer's vehicle.

Which types of organizations are expected customers for this device?
Individual home users, small retail businesses, taxi operating companies, car insurance companies,logistics companies and commercial fleets, etc.
How will the device be used?
For recording the driving condition, monitoring driving behaviours, deterring crime, recording bad motorists, and more quickly resolving disputes resulting from traffic accidents.
Where geographically will the device be used?
More than 60 key sales countries and regions in the world.
What physical environments will the device be used in?
Inside different kinds of vehicles.
How long is the device expected to be used for?
The device is expected to be used for 3 years. Jimiprovides a 13-month warranty for all tracking and DVR devices. App upgrades at least once every 2 weeks and the firmware for products on sale upgrade at least once every 3 months.
What dependencies on other systems will the device likely have?
The device can work independently. For remote operations, it must connect to internet (Cloud).
What other aspects of device use might be relevant to the device’s cybersecurity risk?

Privacy:Scope of personal information collection

We will handle all types of personal information, including the data clearly provided by you and your device data and personal information generated from the use of our services, specifically:

When you register or log in, we will collect your email address, password, nickname, and profile photo that you use in registration.

When you download or use the app, we may read information about your mobile device, such as information of the hardware model, IMEI number or other unique device identifier, MAC address, IP address, operating system version, and location. We may also read information about the use of your appliances through the Internet of Things (IoT) app, such as the device model, operating status, frequency of usage, and the use of cameras built into the device. We may also receive and record information about your conversations, audios, videos, pictures, etc. in voice interaction with IoT devices.

When you use bonded and controlled devices, we will collect the information of device model, IP address, location, and device status. We collect your current location information, not track your whereabouts, open the location service can directly obtain your location information to provide you with services, such as weather service, intelligent scene service, network function. The device will save Wi-Fi SSID and password when connected to a home Wi-Fi router, and such information will not be uploaded to the cloud.

When you use an Internet of Things (IoT) device, we may collect information that you communicate during the voice service interaction, including the recordings of your voice commands (such as your questions, requests, and instructions), and information that you receive from the service (such as responses, answers, and content).

When you use an IoT device, you can view the real-time and historical video footage captured by the camera through the software. You can also save the video locally. To enable the mention function, we will send all videos captured by the camera to your app in an encrypted manner. We will neither store your video footage on our server nor use it for any other purpose or share it with any third party.

When you use a product or service, we will automatically receive and record information about your browser and computer or App client, such as your IP address, browser type, language used, and access date and time, hardware and software feature information and web page records you need; when you apply for after-sales service, we may also collect your phone number and address.

To help us understand the operation of App, we will use the mobile analysis software SDK. We may record information of your frequency of usage data, corrupted data, overall usage data, performance data, etc. We will not associate information stored in the analysis software with any of your personal information.

It is important to note that separate device information or service log information cannot identify a particular natural person. If we combine such non-personal information with other information to identify a particular natural person or use it in conjunction with personal information, such non-personal information will be treated as personal information during the period combined use, and we will de-identify such information unless we have your authorization or unless otherwise stipulated.

As mentioned above, we will store your account information in the database so that you can get your personal data every time you visit our website and use our App or other services.

Your data will be stored in our server as log files and used for analysis and research. After being processed in the server, your data will be transmitted to the database.

We will back up data on a regular basis to prevent data loss due to server failure or human error and will delete them immediately at your request.

How will the IoT device interact with the physical world?

Remote engine cut-off,I/O ports to support multiple external types of equipment for various applications,

Video/audio recording and upload to the server.

How will the IoT device need to be accessed, managed, and monitored by authorized people, processes, and other devices?

Besidescontrollingdevicephysically,onlydevice’sownercanremotelycontrolthedeviceviaTracksolid PROapplication. There is an authentication mechanism in application to prevent unauthorized user to control device. All remote communications are protected using cryptographic methods to ensure only device’s owner has the permission forcontrolling. Only customers can control the device, manufacturer can manage the running status of the device and provide upgrades.

What are the known cybersecurity requirements for the IoT device?
Not found yet.
How might the IoT device’s use of device cybersecurity capabilities be interfered with by the device’s operational or environmental characteristics?

After the device is powered on, there is a certain time threshold for binding, which may have the security risks brought by the long-term opening of Bluetooth broad casting and AP hot spots. The device will turn off Bluetooth broadcast or AP hotspot after a certain period (default is 5 minutes, determined by business).

If using a publicly accessible network to connect the device with Jimi cloud, it needs to ensure that the network state is secure. OTA updates have a breakpoint continuation mechanism and the ability to roll back a previously available state.

At unattended state, the IoT device is vulnerable to physical attack. But the risks of products are manageable because of their work environment is inside the car and the installation is covered.
What is the degree of trust in the IoT device that customers may need?

Communication protocols follow the principles of confidentiality, integrity and availability. There is an authentication mechanism for communication between device and APP, device and cloud, and cloud and APP. The session key is obtained through TLS1.2 handshake. TLS 1.2 is used for integrity verification during data transmission. And local data is stored in encryption, such as the account and password of AP is encrypted with Root Key, which is derived from the IMEI of the chip hardware.

In general, Jimi uses strong secure cryptographic algorithms and secure protocol to protect all the traffic between device and cloud, device and application.
What complexities will be introduced by the IoT device interacting with other devices, systems, and environments?
It does not add complexity to other devices, systems or environments. When the user uses the device, the device will only interact with the mobile APP and the cloud server without affecting other devices and systems. The function of the device itself is to improve the physical environment without complicating it.
List the configuration’s settings that can be modified. List the user profiles. List the mapping between user profiles and access rights for configuration settings.

1. The production firmware file is burned in the device, and no other configuration files need to be changed during use.

2. Only device’s owner have remote access to the device as there is relationship binding during initialization.

How do you protect the configuration from unauthorized modification?

The debug interface has been closed, and unauthorized users cannot access it, and Wi-Fi and BLE interface can't be access without authorization.

1.Physical protection: There isn’t any external interfaces on device that allows reading / writing firmware data or configuration data.

2.Network connection protection: There is authentication mechanisms sitting in both cloud, application and device to prevent any malicious/unauthenticated connections.

What is the secure default configuration (if applicable for the device)? Who defines it?

The device factory setting is a secure default configuration, the DVR performs predetermined functions according to the default configuration, and the attacker cannot access the device without authorization, the secure default configuration is defined by manufacturer.

Does the device generate logs or notifications of security events? List the types of security events that are generated. If not, can the device indicate a cybersecurity status (e.g., through notifications)? List the status information.

The module has a log reporting mechanism, which only supports error log reporting at present. The crash log includes the connection fail info of the router or server, etc. The mechanism is not a real-time reporting. After login on the server, upload the crash log. And the log data can be viewed through the backend.

Who can review the logs or notifications? Please describe the authentication and authorization procedures to protect the logs and notifications from unauthorized access?

if different storages are used, please describe the authentication and authorization procedures respectively.

Due to limited local storage capacity, the device does not store log information locally, but uploads it to cloud storage through an encrypted channel. In the cloud service, only the database management account has the authority to view log information. If the account is not authorized, access to the device log information is prohibited.

Please describe the method to prevent any entity from editing the logs.
Setting the properties of the database to read-only permissions, and the unauthorized users cannot log in and modify data.