Embedded Policing and Policy Enforcement based Security in the era of Digital-Physical Convergence for Next-Generation Vehicular Electronics (original) (raw)
Related papers
Recent Advances in Cybersecurity and Safety Architectures in Automotive, IT, and Connected Services
JUCS - Journal of Universal Computer Science, 2021
This is a special issue in cooperation with EuroSPI (www.eurospi.net). EuroSPI represents a large international network of renowned experts and annual European conference series running successfully since its foundation in 1994. From 2013 onwards, an international functional safety and from 2016 onwards a functional safety and cybersecurity workshop has been established, to which leading European and Asian industry and research have been actively contributing to. High-quality, original papers about best practices for implementing functional safety and cybersecurity in automotive, IT, and connected services have been selected for this special issue. They provide insights into the current state of the art implementations in automotive safety and cybersecurity, IT security, and safety in future highly autonomous self-learning vehicles.
Resiliency in Connected Vehicle Applications: Challenges and Approaches for Security Validation
Proceedings of the Great Lakes Symposium on VLSI 2022
With the proliferation of connectivity and smart computing in vehicles, a new attack surface has emerged that targets subversion of vehicular applications by compromising sensors and communication. A unique feature of these attacks is that they no longer require intrusion into the hardware and software components of the victim vehicle; rather, it is possible to subvert the application by providing wrong or misleading information. We consider the problem of making vehicular systems resilient against these threats. A promising approach is to adapt resiliency solutions based on anomaly detection through Machine Learning. We discuss challenges in making such an approach viable. In particular, we consider the problem of validating such resiliency architectures, the factors that make the problem challenging, and our approaches to address the challenges. CCS CONCEPTS • Security and privacy → Systems security; • Computer systems organization → Embedded and cyber-physical systems.
A Comprehensive Solution for Securing Connected and Autonomous Vehicles
2022 Design, Automation & Test in Europe Conference & Exhibition (DATE)
With the advent of Connected and Autonomous Vehicles (CAVs) comes the very real risk that these vehicles will be exposed to cyber-attacks by exploiting various vulnerabilities. This paper gives a technical overview of the H2020 CARAMEL project (currently in the intermediate stage) in which Artificial Intelligent (AI)-based cybersecurity for CAVs is the main goal. Most of the possible scenarios are considered, by which an adversary can generate attacks on CAVs, such as attacks on camera sensors, GPS location, Vehicle to Everything (V2X) message transmission, the vehicle's On-Board Unit (OBU), etc. The countermeasures to these attacks and vulnerabilities are presented via the current results in the CARAMEL project achieved by implementing the designed security algorithms.
Security of Emergent Automotive Systems: A Tutorial Introduction and Perspectives on Practice
IEEE Design & Test, 2019
Survey be accomplished under hard real-time requirements. for example, a pedestrian detec tion algorithm must complete a slew of complex activities, including the capture of sensory data, aggregation, communication, analytics, image processing, security analysis, and so on, within the time constraints to enable successful completion of the appropriate actuarial response such as warning the driver or automatical braking. Furthermore, the complexity is anticipated to rise sharply with increasing autonomy levels in vehicles. For instance, a future self-driving car with autonomy level 4 will include several elements not available in today's (level 2) systems. The following are some example elements.
2020
The goal of this book is to provide a detailed, in-depth, state-of-the-art description of vehicle connectivity and cybersecurity with respect to developments, technologies, inventions, and services. This book outlines the development of functional safety and cyber security, threats, and creative innovations in intelligent and autonomous vehicles. The chapters of this book offer a suitable context for understanding the complexities of the connectivity and cyber security of intelligent and autonomous vehicles. A top-down strategy was adopted to introduce the vehicle features and functionality. This book thus provides important information on the cyber security challenges faced by the autonomous vehicles, and it seeks to address the mobility requirements of users with their need for desire, comfort, safety, and security. This book consists of eight chapters contributed by academia, practitioners, and researchers from reputed universities from different countries. Chapter 1 "Introduction to Automotive Cybersecurity" provides a brief overview of the topics covered in this book. It gives a brief summary of the automotive industry that explains the technological revolution that has transformed the automotive industry and eventually moves it toward new technologies such as intelligent autonomous vehicles to smart mobility. Chapter 2 "Intelligent Autonomous Vehicle" focuses on the development of the intelligent and autonomous vehicles empathizing the history and classification of autonomous vehicle driving levels based on SAE and NHTS classification. This chapter provides the latest trends and state-of-the-art intelligent and autonomous vehicle technologies and provides brief information regarding inter-vehicle and intra-vehicle communication. It discusses the technical global status of the autonomous vehicle industry, megatrends, technology adoption battle, market demand, and automotive cyber security. Chapter 3 "Security and Privacy in Intelligent Autonomous Vehicles" gives a detailed description of cryptography and cyber security used in intelligent and autonomous vehicles. It provides information related to security and privacy threats in intelligent and autonomous vehicles. It gives an overview of in-vehicle threat modeling, connected vehicle vulnerabilities, security, and privacy issues in vehicular networks. It gives a brief introduction on trust management issues in intelligent and autonomous vehicles and discusses on how blockchain can be used as a security v vi Preface Preface vii
Policy-Based Security Modelling and Enforcement Approach for Emerging Embedded Architectures
2018 31st IEEE International System-on-Chip Conference (SOCC), 2018
Complex embedded systems often contain hard to find vulnerabilities which, when exploited, have potential to cause severe damage to the operating environment and the user. Given that threats and vulnerabilities can exist within any layer of the complex ecosystem , OEMs face a major challenge to ensure security throughout the device life-cycle To lower the potential risk and damage that vulnerabilities may cause, OEMs typically perform application threat analysis and security modelling. This process typically provides a high level guideline to solving security problems which can then be implemented during design and development. However, this concept presents issues where new threats or unknown vulnerability has been discovered. To address this issue, we propose a policy-based security modelling approach, which utilises a configurable policy engine to apply new policies that counter serious threats. By utilising this approach, the traditional security modelling approaches can be enhanced and the consequences of a new threat greatly reduced. We present a realistic use case of connected car, applying several attack scenarios. By utilising STRIDE threat modelling and DREAD risk assessment model, adequate policies are derived to protect the car assets. This approach poses advantages over the standard approach, allowing a policy update to counter a new threat, which may have otherwise required a product redesign to alleviate the issue under the traditional approach.
Towards extended safety in connected vehicles
16th International IEEE Conference on Intelligent Transportation Systems (ITSC 2013), 2013
Current standards for vehicle safety consider only accidental failures; they do not consider failures caused by malicious attackers. The standards implicitly assume that the sensors and Electronic Control Units (ECUs) of each vehicle compose a secure in-vehicle network because no external entity communicates with the nodes of the network. These standards assume that safety and security aspects are independent. Connecting vehicles to external entities, e.g., through Vehicle to Mobile (V2M), Vehicle to Vehicle (V2V), and Vehicle to Infrastructure (V2I), proved to be useful: it enables using Intelligent Transportation Systems (ITS) applications that improve our safety, efficiency, and comfort; but vulnerable to security threats. This paper provides an overview of AGORA framework: a framework generating secure and tested boilerplate code needed for ITS applications, demonstrates that safety and security aspects in motor vehicles are not independent, and proposes extending safety assurance by considering security aspects. It also discusses a set of research challenges related to extended safety assurance in connected vehicles.
Towards a Standardized Mapping from Automotive Security Levels to Security Mechanisms
2018 21st International Conference on Intelligent Transportation Systems (ITSC), 2018
Modern vehicles are becoming targets and need to be secured throughout their lifetime. There exist several risk assessment models which can be used to derive security levels that describe to what extent components, functions and messages (signals), need to be protected. These models provide methods to gather application specific security requirements based on identified threat and item combinations that need to be coped with. However, a standardized mapping between security levels and required mandatory security mechanisms and design rules is currently missing. We address this problem first by suggesting that the risk assessment process should result in five security levels, similar to the functional safety standard ISO 26262. Second, we identify suitable security mechanisms and design rules for automotive system design and associate them with appropriate security levels. Our proposed methodology is as much as possible aligned with ISO 26262 and we believe that it should therefore be realistic to deploy in existing organizations.
Experimental Security Analysis of a Modern Automobile
2010 IEEE Symposium on Security and Privacy, 2010
Modern automobiles are no longer mere mechanical devices; they are pervasively monitored and controlled by dozens of digital computers coordinated via internal vehicular networks. While this transformation has driven major advancements in efficiency and safety, it has also introduced a range of new potential risks. In this paper we experimentally evaluate these issues on a modern automobile and demonstrate the fragility of the underlying system structure. We demonstrate that an attacker who is able to infiltrate virtually any Electronic Control Unit (ECU) can leverage this ability to completely circumvent a broad array of safety-critical systems. Over a range of experiments, both in the lab and in road tests, we demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver inputincluding disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on. We find that it is possible to bypass rudimentary network security protections within the car, such as maliciously bridging between our car's two internal subnets. We also present composite attacks that leverage individual weaknesses, including an attack that embeds malicious code in a car's telematics unit and that will completely erase any evidence of its presence after a crash. Looking forward, we discuss the complex challenges in addressing these vulnerabilities while considering the existing automotive ecosystem.