A Digital Contract-Driven Dynamic Usage Control Model for Trusted Data Sharing in the Internet of Vehicles

In cross-entity Internet of Vehicles (IoV) data sharing, a digital contract can define the authorized conditions of data use, but the actual usage behavior and the integrity of the connector responsible for policy enforcement may continue to change after authorization. Existing authorization and trusted-execution mechanisms address these conditions from different perspectives, leaving a need to relate them within a common runtime control process without expanding the contractual authorization boundary. This paper develops a digital contract-driven dynamic usage control model for trusted IoV data sharing. Contractual constraints on the authorized subject, data object, permitted operation, usage purpose, validity period, and number of uses are first mapped to connector-executable runtime policies. The model then represents the runtime usage state using the contract constraint state, behavioral deviation, and trusted execution state of the connector, and maps their joint state to Permit, Restrict, and Revoke decisions. The resulting decision mechanism preserves the digital-contract authorization boundary, adopts fail-safe revocation when trusted execution is lost, and maintains monotonic restriction as behavioral deviation increases. Experiments use an IoV data product derived from real vehicle trajectories in the NGSIM US-101 dataset together with reproducibly generated usage-request traces to construct controlled changes in contractual conditions, usage intensity, and connector integrity. In the steady-state comparison, the complete model satisfies all predefined scenario-level control requirements, corresponding to an SDC of 100%, whereas the Contract + Behavior and Contract-only configurations yield 86.26% and 53.60%, respectively. Sensitivity analysis further shows that the intended decisions remain stable over a range of behavioral thresholds. A prototype-level runtime evaluation further yields median per-request state-evaluation latencies of 131.6 and 133.0 μs in two independent runs, while behavioral-state computation exhibits approximately linear scaling with the number of requests retained in the sliding window (R2 > 0.999). These results validate the runtime decision behavior of the model under the constructed scenarios rather than estimating decision accuracy for arbitrary real-world IoV usage.