A Connected and Autonomous Vehicle Reference Architecture for Attack Surface Analysis
Source abstract
Abstract
Connected autonomous vehicles (CAVs) will be deployed over the next decade with autonomous functionalities supported by new sensing and communication capabilities. Such functionality exposes CAVs to new attacks that current vehicles will not face. To ensure the safety and security of CAVs, it is important to be able to identify the ways in which the system could be attacked and to build defences against these attacks. One possible approach is to use reference architectures to perform an attack surface analysis. Existing research has developed a variety of reference architectures but none for the specific purpose of attack surface analysis. Existing approaches are either too simple for sufficiently detailed modelling or require too many details to be specified to easily analyse a CAV’s attack surface. Therefore, we propose a reference architecture using a hybrid Functional-Communication viewpoint for attack surface analysis of CAVs, including the Devices, Edge and Cloud systems CAVs interact with. Using two case studies, we demonstrate how attack trees can be used to understand the attack surface of CAV systems.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Vehicular Ad Hoc Networks (VANETs) · Distributed systems and fault tolerance · Simulation Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Warwick Manufacturing Group, University of Warwick, Coventry CV4 7AL, UK
Funding
Engineering and Physical Sciences Research Council · Innovate UK
References (75)
Show source-provided references
1. GOV.UK (2018, July 31). Winners of £51 Million Government Competition to Develop World-Leading Self-Driving Car Testing Infrastructure Unveiled, Available online: https://www.gov.uk/government/news/winners-of-51-million-government-competition-to-develop-world-leading-self-driving-car-testing-infrastructure-unveiled.
2. A Survey of the Connected Vehicle Landscape—Architectures, Enabling Technologies, Applications, and Development Areas10.1109/TITS.2017.2749459 ↗
3. Autonomous Cars: Research Results, Issues, and Future Challenges10.1109/COMST.2018.2869360 ↗
4. Wyld, D.C., Wozniak, M., Chaki, N., Meghanathan, N., and Nagamalai, D. (2011). An Insight into the Hardware and Software Complexity of ECUs in Vehicles. Advances in Computing and Information Technology, Springer.10.1007/978-3-642-22555-0 ↗
5. The Institution of Engineering and Technology, and The Knowledge Transfer Network (2015). Automotive Cyber Security: An IET/KTN Thought Leadership Review of Risk Perspectives for Connected Vehicles, The Institution of Engineering and Technology. Technical Report.
6. SAE (2016). J3061: Cybersecurity Guidebook for Cyber-Physical Vehicle Systems, SAE. J3061_201601.
7. Dominic, D., Chhawri, S., Eustice, R.M., Ma, D., and Weimerskirch, A. (2016). Risk Assessment for Cooperative Automated Driving. Proceedings of the CPS-SPC ’16 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy, Vienna, Austria, ACM.10.1145/2994487.2994499 ↗
8. The Architecture Team (2019, November 20). Architecture Reference for Cooperative and Intelligent Transportation. Available online: https://local.iteris.com/arc-it/index.html.
9. Connected and autonomous vehicles: A cyber-risk classification framework10.1016/j.tra.2018.06.033 ↗
10. Petit, J., Stottelaar, B., and Feiri, M. (2015, January 10–13). Remote Attacks on Automated Vehicles Sensors: Experiments on Camera and LiDAR. Proceedings of the Black Hat Europe, Amsterdam, The Netherlands.
11. Miller, C., and Valasek, C. (2015, January 1–6). Remote Exploitation of an Unaltered Passenger Vehicle. Proceedings of the Black Hat USA, Las Vegas, NV, USA.
12. Cyber Threats Facing Autonomous and Connected Vehicles: Future Challenges10.1109/TITS.2017.2665968 ↗
13. Koornneef, F., and van Gulijk, C. (2015). A Combined Safety-Hazards and Security-Threat Analysis Method for Automotive Systems. Computer Safety, Reliability, and Security, Springer International Publishing.
14. Autonomous Ground Vehicles—Concepts and a Path to The Future10.1109/JPROC.2012.2189803 ↗
15. Schneier, B. (2000). Secrets & Lies: Digital Security in a Networked World, John Wiley & Sons.
16. Alberts, C.J., and Dorofee, A. (2002). Managing Information Security Risks: The Octave Approach, Addison-Wesley Longman Publishing Co., Inc.
17. UcedaVelez, T., and Morana, M.M. (2015). Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis, John Wiley & Sons.10.1002/9781118988374 ↗
18. McCarthy, C., Harnett, K., and Carter, A. (2014). Characterization of Potential Security Threats in Modern Automobiles: A Composite Modeling Approach, Technical Report DOT HS 812 074.
19. (2018). Taxonomy and Definitions for Terms Related to On-Road Motor Vehicle Automated Driving Systems. Standard J3016_201401, SAE.
20. Bartels, A., Eberle, U., and Knapp, A. (2015). System Classification And Glossary, Automated Driving Applications and Technologies For Intelligent Vehicles (Adaptive). Technical Report D2.1.
21. Koscher, K., Czeskis, A., Roesner, F., Patel, S., Kohno, T., Checkoway, S., McCoy, D., Kantor, B., Anderson, D., and Shacham, H. (2010, January 22–25). Experimental Security Analysis of a Modern Automobile. Proceedings of the 2010 IEEE Symposium on Security and Privacy, Berkeley, CA, USA.10.1109/SP.2010.34 ↗
22. Foster, I., Prudhomme, A., Koscher, K., and Savage, S. (2015). Fast and Vulnerable: A Story of Telematic Failures. Proceedings of the 9th USENIX Workshop on Offensive Technologies (WOOT 15), Washington, DC, USA, 10–11 August 2015, USENIX Association.
23. Potential Cyberattacks on Automated Vehicles
24. The Concept of Reference Architectures10.1002/sys.20129 ↗
25. (2008). Reference Architecture For Space Data Systems. Recommended Practice 311.0-M-1, Consultative Committee For Space Data Systems (CCSDS).
26. Lin, S.W., Miller, B., Durand, J., Bleakley, G., Chigani, A., Martin, R., Murphy, B., and Crawford, M. (2017). The Industrial Internet of Things Volume G1: Reference Architecture, Industrial Internet Consortium. Technical Report IIC:PUB:G1:V1.80:20170131.
27. CEN-CENELEC-ETSI Smart Grid Coordination Group (2012). Smart Grid Reference Architecture, ETSI. Version 3.
28. A functional reference architecture for autonomous driving10.1016/j.infsof.2015.12.008 ↗
29. Camarinha-Matos, L.M., Boucher, X., and Afsarmanesh, H. (2010). Towards A Reference Architecture for a Collaborative Intelligent Transport System Infrastructure. Collaborative Networks For A Sustainable World, Springer.10.1007/978-3-642-15961-9 ↗
30. United States Department of Transportation (2019, November 20). Functional. Version 8.3. Available online: https://local.iteris.com/arc-it/html/viewpoints/functional.html.
31. United States Department of Transportation (2019, November 20). Communications. Version 8.3. Available online: https://local.iteris.com/arc-it/html/viewpoints/communications.html.
32. Stevens, A., Dianati, M., Katsaros, K., Han, C., Fallah, S., Maple, C., McCullough, F., and Mouzakitis, A. (2017, January 19–22). Cooperative automation through the cloud: The CARMA project. Proceedings of the 12th ITS European Congress, Strasbourg, France.
33. Sheik, A.T., and Maple, C. (2019, January 1–2). Key Security Challenges for Cloud-Assisted Connected and Autonomous Vehicles. Proceedings of the Living in the Internet of Things: Cybersecurity of the IoT, London, UK.10.1049/cp.2019.0142 ↗
34. Passchier, I., and van Sambeek, M. (2019, November 20). Architecture For C-ITS Applications In The Netherlands. Technical report, Dutch Round Tables For Smart Mobility. Available online: https://smartmobilitycommunity.eu/sites/default/files/AI_CITSArchitectureNL_v1.00.pdf.
35. Heise, C.D. (2015). Architecture Reference of ITS in the USA. Intelligent Transport Systems, Wiley-Blackwell. Chapter 2.10.1002/9781118894774.ch2 ↗
36. Begoña, M., Sergio, C., Iñaki, O.I., and Isabel, T.A. (2015). Reference ITS Architectures in Europe. Intelligent Transport Systems, Wiley-Blackwell. Chapter 1.10.1002/9781118894774.ch1 ↗
37. Puñal, O., Aguiar, A., and Gross, J. (2012). In VANETs We Trust: Characterizing Rf Jamming in Vehicular Networks. Proceedings of the Ninth ACM International Workshop on Vehicular Inter-Networking, Systems, and Applications, VANET ’12, Low Wood Bay, Lake District, UK, ACM.10.1145/2307888.2307903 ↗
38. Davis, A. (2015). Broadcasting Your Attack: Security Testing DAB Radio in Cars, Black Hat. Black Hat USA, Las Vegas, Nevada, USA.
39. AMOEBA: Robust Location Privacy Scheme for VANET10.1109/JSAC.2007.071007 ↗
40. Gu, P., Khatoun, R., Begriche, Y., and Serhrouchni, A. (2016, January 12–14). Vehicle Driving Pattern Based Sybil Attack Detection. Proceedings of the 2016 IEEE 14th International Conference on Smart City, Sydney, Australia.10.1109/HPCC-SmartCity-DSS.2016.0182 ↗
41. Xu, W., Wegner, M., Wolf, L., and Kapitza, R. (2017, January 26–29). Byzantine Agreement Service For Cooperative Wireless Embedded Systems. Proceedings of the 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W), Denver, CO, USA.10.1109/DSN-W.2017.45 ↗
42. Francillon, A., Danev, B., and Capkun, S. (2011, January 6–9). Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars. Proceedings of the Network And Distributed Systems Security (NDSS) Symposium, San Diego, CA, USA.
43. Currie, R. (2017). Hacking The CAN Bus: Basic Manipulation of a Modern Automobile through CAN Bus Reverse Engineering, SANS Institute. Technical Report.
44. (2018, June 21). USB Kill. Available online: https://usbkill.com.
45. Nie, S., Liu, L., and Du, Y. Free-Fall: Hacking Tesla From Wireless To CAN Bus. Proceedings of the Black Hat USA, Las Vegas, Nevada, USA, 26–27 July 2017.
46. Evenchick, E. (2015). Hopping on the CAN Bus. Black Hat Asia, Singapore, 24–27 March 2015, Black Hat.
47. Munir, A., and Koushanfar, F. (2018). Design And Analysis Of Secure And Dependable Automotive CPS: A Steer-By-Wire Case Study. IEEE Trans. Dependable Secur. Comput.
48. Rouf, I., Miller, R., Mustafa, H., Taylor, T., Oh, S., Xu, W., Gruteser, M., Trappe, W., and Seskar, I. (2010). Security And Privacy Vulnerabilities Of In-car Wireless Networks: A Tire Pressure Monitoring System Case Study. Proceedings of the 19th USENIX Conference on Security, USENIX Security’10, Washington, DC, USA, 10–13 August 2010, USENIX Association.
49. Papernot, N., McDaniel, P., Sinha, A., and Wellman, M. (2018, January 24–26). SoK: Security And Privacy in Machine Learning. Proceedings of the 3rd IEEE European Symposium on Security and Privacy, London, UK.10.1109/EuroSP.2018.00035 ↗
50. GPS.gov (2008). GPS Standard Positioning Service (SPS) Performance Standard, USA Department of Defence. [4th ed.]. Standard.
51. Athalye, A., Engstrom, L., Ilyas, A., and Kwok, K. (2018, January 10–15). Synthesizing Robust Adversarial Examples. Proceedings of the 35th International Conference on Machine Learning (ICML 2018), Stockholmsmässan, Stockholm, Sweden.
52. Golson, J. (2018, July 31). Tesla Driver Killed in Crash with Autopilot Active, NHTSA Investigating. Available online: https://www.theverge.com/2016/6/30/12072408/tesla-autopilot-car-crash-death-autonomous-model-s.
53. Sasiadek, J.Z., and Hartana, P. (2000, January 10–13). Sensor data fusion using Kalman filter. Proceedings of the Third International Conference on Information Fusion, Paris, France.10.1109/IFIC.2000.859866 ↗
54. Attack-Resilient Sensor Fusion for Safety-Critical Cyber-Physical Systems10.1145/2847418 ↗
55. Davidson, D., Wu, H., Jellinek, R., Singh, V., and Ristenpart, T. (2016). Controlling UAVs with Sensor Input Spoofing Attacks. Proceedings of the 10th USENIX Workshop on Offensive Technologies (WOOT 16), Austin, TX, USA, 8–9 August 2016, USENIX Association.
56. Checkoway, S., McCoy, D., Kantor, B., Anderson, D., Shacham, H., Savage, S., Koscher, K., Czeskis, A., Roesner, F., and Kohno, T. (2011). Comprehensive Experimental Analyses of Automotive Attack Surfaces. Proceedings of the 20th USENIX Conference on Security, SEC’11, San Francisco, CA, USA, 8–12 August 2011, USENIX Association.
57. A Practical Wireless Attack on The Connected Car and Security Protocol for In-Vehicle Can
58. Kikuchi, H., and Yokomizo, T. (2013, January 4–6). Location Privacy Vulnerable From Bluetooth Devices. Proceedings of the 16th International Conference on Network-Based Information Systems, Gwangju, Korea.10.1109/NBiS.2013.89 ↗
59. (2018, June 21). Volkswagen Apps. Available online: http://www.volkswagen.co.uk/about-us/innovation/mobile-apps.
60. Location Privacy Violation Via Gps-agnostic Smart Phone Car Tracking
61. I Know Your Mac Address: Targeted Tracking of Individual Using Wi-Fi10.1007/s11416-013-0196-1 ↗
62. Bellalta, B., Vinel, A., Jonsson, M., Barcelo, J., Maslennikov, R., Chatzimisios, P., and Malone, D. (2012). Analysis of Inter-RSU Beaconing Interference in Vanets. Multiple Access Communications, Springer.10.1007/978-3-642-34976-8 ↗
63. Fielding, R.T. (2000). Architectural Styles and the Design of Network-Based Software Architectures. [Ph.D. Thesis, University of California].
64. NIST cloud computing reference architecture
65. Cloud Attack and Risk Assessment Taxonomy10.1109/MCC.2015.2 ↗
66. Cuppens, F., Wang, L., Cuppens-Boulahia, N., Tawbi, N., and Garcia-Alfaro, J. (2017). Threat Modeling for Cloud Data Center Infrastructures. Foundations and Practice of Security, Springer International Publishing.10.1007/978-3-319-51966-1 ↗
67. The growth and evolution of DDoS10.1016/S1353-4858(15)30092-1 ↗
68. Duncan, A.J., Creese, S., and Goldsmith, M. (2012, January 25–27). Insider Attacks In Cloud Computing. Proceedings of the 2012 IEEE 11th International Conference On Trust, Security and Privacy in Computing and Communications, Liverpool, UK.10.1109/TrustCom.2012.188 ↗
69. Aggarwal, C.C., and Yu, P.S. (2008). A Survey of Quantification of Privacy Preserving Data Mining Algorithms. Privacy-Preserving Data Mining: Models and Algorithms, Springer US.10.1007/978-0-387-70992-5 ↗
70. Henniger, O., Apvrille, L., Fuchs, A., Roudier, Y., Ruddle, A., and Weyl, B. (2009, January 20–22). Security requirements for automotive on-board networks. Proceedings of the 9th IEEE International Conference on Intelligent Transport Systems Telecommunications (ITST), Lille, France.10.1109/ITST.2009.5399279 ↗
71. Boudguiga, A., Boulanger, A., Chiron, P., Klaudel, W., Labiod, H., and Seguy, J.C. (2015, January 27–29). RACE: Risk analysis for cooperative engines. Proceedings of the 7th IEEE International Conference on New Technologies, Mobility and Security (NTMS), Paris, France.10.1109/NTMS.2015.7266516 ↗
72. Monteuuis, J.P., Boudguiga, A., Zhang, J., Labiod, H., Servel, A., and Urien, P. (2018). SARA: Security Automotive Risk Analysis Method. Proceedings of the 4th ACM Workshop on Cyber-Physical System Security, Incheon, Republic of Korea, ACM. CPSS ’18.10.1145/3198458.3198465 ↗
73. Rosenquist, M. (2009). Prioritizing Information Security Risks with Threat Agent Risk Assessment, Intel Corporation. White paper.
74. Object Management Group (2017). OMG Systems Modeling Language, Object Management Group. Version 1.5.10.1016/B978-1-78548-171-0.50001-3 ↗
75. The future of risk assessment10.1016/j.ress.2018.04.020 ↗