Refine Your Search

Topic

Author

Affiliation

Search Results

Technical Paper

Requirements for the automated generation of attack trees to support automotive cybersecurity assurance

2022-03-29
2022-01-0124
Although ISO/SAE 21434 recommends the development of an assurance case for cybersecurity, the precise nature of a cybersecurity case is not explicitly defined within the standard. ...In the case of cybersecurity, this problem is exacerbated by the increasing complexity of vehicular onboard systems, their inherent obscurity due to their heterogenous architecture, emergent behaviours, and the disparate motivations and resources of potential threat agents.
Technical Paper

Functional verification and validation of secure controller area network (CAN) communication

2022-03-29
2022-01-0110
In agriculture industry, increasing use of Vehicle Internet of Things (IoT), telematics and emerging technologies are resulting in smarter machines with connected solutions. Inter and Intra Communication with vehicle to vehicle and inside vehicle - Electronic Control Unit (ECU) to ECU or ECU to sensor, requirement for flow of data increased in-turn resulting in increased need for secure communication. In this paper, we focus on functional verification and validation of secure Controller Area Network (CAN) for intra vehicular communication to establish confidentiality, integrity, authenticity, and freshness of data, supporting safety, advanced automation, protection of sensitive data and IP (Intellectual Property) protection. Network security algorithms and software security processes are the layers supporting to achieve our cause. Test environment setup with secured hardware and simulated models, test scenarios and test data created to achieve our objective.
Technical Paper

Applying blockchain to vehicle cybersecurity: Nuance to the standard application

2022-03-29
2022-01-0368
While this is the traditional application experienced, there are other applications relevant to cybersecurity. As part of blockchain technology, the nodes are responsible for decision-making. ...In adjusting the data flow, this is an option to increase the cybersecurity for a complete system. In certain modular environments, this may not be the optimal situation from a timing or processing view. ...This addition to the cybersecurity system provides a clear benefit. There are however attacks that have been experienced in the industry.
Technical Paper

Attacking vehicles with ransomware: Watch the horizon

2022-03-29
2022-01-0358
Ransomware use is rampant throughout most industries. With the number of successful ransomware attacks through the industrial economy, this feels like a tsunami of attacks. These attacks seemingly originate from anywhere with an internet connection. There are vast numbers of bad actors creating these attacks, all focused on your systems. With the large number of attacks, it is granted there have been many breaches. While there have been a large number of successful attacks, each attack’s objectives have varied. These have historically been to generate revenue in the form of fees for the decrypt key or a promise not to publish exfiltrated data. The landscape has become saturated with ransomware attacks on consumers and the enterprise. There has been extensive training for staff in an effort to mitigate these issues. The next potential targets are vehicles and ground systems. These, as targets, have not been evaluated via a full risk assessment to the recommended extent.
Technical Paper

Integrating Fuzz Testing into a CI Pipeline for Automotive Systems

2022-03-29
2022-01-0117
With the rapid development of connected and autonomous vehicles, more sophisticated automotive systems running large portions of software and implementing a variety of communication interfaces are being developed. The ever-expanding codebase increases the risk for software vulnerabilities, while at the same time the large number of communication interfaces make the systems more susceptible to be targeted by attackers. As such, it is of utmost importance for automotive organizations to identify potential vulnerabilities early and continuously in the development lifecycle in an automated manner. In this paper, we suggest a practical approach for integrating fuzz testing into a Continuous Integration (CI) pipeline for automotive systems. As a first step, we have performed a Threat Analysis and Risk Assessment (TARA) of a general E/E architecture to identify high-risk interfaces and functions.
Technical Paper

Strategy to adopt ISO/SAE 21434 Cyber security assurance level in the organization

2022-03-29
2022-01-0121
The study adopts an RVC (Rear-View Camera) system and performs a threat modeling to describe the details of the proposed process and helps cybersecurity experts, organizations to implement a structured process of CAL in their existing cybersecurity management system. Keywords: Cybersecurity, CAL, ISO21434, threat scenario, risk management, secure development lifecycle. ...This standard has introduced a new classification scheme, cybersecurity assurance level (CAL), that helps in validating the process rigor needed for mitigating different threat scenarios. ...CAL values can be determined at the earlier stages of the SDLC (cybersecurity concept phase) through the knowledge of attack vectors and attack severity specific to a system.
Technical Paper

UDS Security Access for highly-constrained ECUs

2022-03-29
2022-01-0132
Legacy electronic control units are, nowadays, required to implement cybersecurity measures, but they often do not have all the facilities that are necessary to realise industry-standard cybersecurity controls. ...Legacy electronic control units are, nowadays, required to implement cybersecurity measures, but they often do not have all the facilities that are necessary to realise industry-standard cybersecurity controls. Such systems must still be protected with a sufficient level of rigor against attackers who wish to modify their operation or extract confidential information from them. ...While the classic UDS service $27 (Security Access) has a reputation for poor cybersecurity, there is nothing inherent in the way it operates which prevents a secure access-control from being implemented.
Technical Paper

Future of Automotive Embedded Hardware Trust Anchors

2022-03-29
2022-01-0122
In this paper, we look at the upcoming trends in EE architectures, and investigate the underlying cyber-security threats and corresponding security requirements that lead to potential requirements for an “Automotive Embedded Hardware Trust Anchors” (AEHTA).
Research Report

Unsettled Issues in Remote Operation for On-road Driving Automation

2021-12-15
EPR2021028
On-road vehicles equipped with driving automation features—where a human might not be needed for operation on-board—are entering the mainstream public space. However, questions like “How safe is safe enough?” and “What to do if the system fails?” persist. This is where remote operation comes in, which is an additional layer to the automated driving system where a human remotely assists the so-called “driverless” vehicle in certain situations. Such remote-operation solutions introduce additional challenges and potential risks as the entire vehicle-network-human now needs to work together safely, effectively, and practically. Unsettled Issues in Remote Operation for On-road Driving Automation highlights technical questions (e.g., network latency, bandwidth, cyber security) and human aspects (e.g., workload, attentiveness, situational awareness) of remote operation and introduces evolving solutions.
Research Report

Unsettled Issues Concerning Automated Driving Services in the Smart City Infrastructure

2021-12-15
EPR2021030
Information and communication technology is fundamentally changing the way we live and operate in cities, such as instant access to events, transportation, bookings, payments, and other services. At the same time, three “megatrends” in the automotive industry—self-driving, electrification, and advanced manufacturing technology—are enabling the design of innovative, application-specific vehicles that capitalize on city connectivity. Applications could countless; however, they also need to be safe and securely integrated into a city’s physical and digital infrastructure, and into the overall urban ecosystem. Unsettled Issues Concerning Automated Driving Services in the Smart City Infrastructure examines the current state of the industry, the developments in automated driving and robotics, and how these new urban, self-driving city applications are different. It also analyzes higher level challenges for urban applications.
Technical Paper

Designing a Next Generation Trailer Braking System

2021-10-11
2021-01-1268
Passenger vehicles have made astounding technological leaps in recent years. Unfortunately, little of that progress has trickled down to other segments of the transportation industry leaving opportunities for massive gains in safety and performance. In particular, the electric drum brakes on most consumer trailers differ little from those on trailers over 70 years ago. Careful examination of current production passenger vehicle hardware and trailering provided the opportunity to produce a design and test vehicle for a plausible, practical, and performant trailer braking system for the future. This study equips the trailer with high control frequency antilock braking and dynamic torque distribution through use of passenger vehicle grade apply hardware.
Technical Paper

Connected Vehicles - A Testing Approach and Methodology

2021-09-22
2021-26-0450
With the introduction of Connected Vehicles, it is possible to extend the limited horizon of vehicles on the road by collective perceptions, where vehicles periodically share their information with other vehicles and servers using cloud. Nevertheless, by the time the connected vehicle spread expands, it is critical to understand the validation techniques which can be used to ensure a flawless transfer of data and connectivity. Connected vehicles are mainly characterized by the smartphone application which is provided to the end customers to access the connectivity features in the vehicle. The end result which is delivered to the customer is through the integrated telematics unit in the vehicle which communicates through a communication layer with the cloud platform. The cloud server in turn interacts with the final application layer of the mobile application given to the customer.
Technical Paper

Reliability-Oriented Distributed Test Strategy for FOTA/SOTA Enabled Edge Device

2021-09-22
2021-26-0476
In order to enhance customer experience [5] and to reduce time to market, the manufacturers are constantly in need of being able to update software/firmware of the Electronic Control units (ECU) when the vehicle is in field operations. The updates could be a bug fix or a new feature release. Until the recent years, the updation of software/firmware used to be done using a physical hardwired connection to the Vehicle in a workshop. However, with the element of connectivity being added to the vehicle, the updation of software can be done remotely and wirelessly over the air using a feature called Flash over the air (FOTA) [2] and Software over the air (SOTA) [2]. In order to safeguard the telematics [3] ECU from tampering or hacking, the manufacturers are doing away with the ports on the underlying hardware through which manual flashing used to be done. This means that, the only option available to flash or update the ECU is using FOTA/SOTA.
Technical Paper

Onboard Cybersecurity Diagnostic System for Connected Vehicles

2021-09-21
2021-01-1249
Here, we discuss the On-Board Diagnostic (OBD) regulations for next generation BEV/HEV, its vulnerabilities and cybersecurity threats that come with hacking. We propose three cybersecurity attack detection and defense methods: Cyber-Attack detection algorithm, Time-Based CAN Intrusion Detection Method and, Feistel Cipher Block Method. ...These control methods autonomously diagnose a cybersecurity problem in a vehicle’s onboard system using an OBD interface, such as OBD-II when a fault caused by a cyberattack is detected, All of this is achieved in an internal communication network structure.
Research Report

Unsettled Legal Issues Facing Data in Autonomous, Connected, Electric, and Shared Vehicles

2021-09-13
EPR2021019
Modern automobiles collect around 25 gigabytes of data per hour and autonomous vehicles are expected to generate more than 100 times that number. In comparison, the Apollo Guidance Computer assisting in the moon launches had only a 32-kilobtye hard disk. Without question, the breadth of in-vehicle data has opened new possibilities and challenges. The potential for accessing this data has led many entrepreneurs to claim that data is more valuable than even the vehicle itself. These intrepid data-miners seek to explore business opportunities in predictive maintenance, pay-as-you-drive features, and infrastructure services. Yet, the use of data comes with inherent challenges: accessibility, ownership, security, and privacy. Unsettled Legal Issues Facing Data in Autonomous, Connected, Electric, and Shared Vehicles examines some of the pressing questions on the minds of both industry and consumers. Who owns the data and how can it be used?
Research Report

Unsettled Topics Concerning Airport Cybersecurity Standards and Regulation

2021-09-13
EPR2021020
Their associated information technology and cyber physical systems—along with an exponentially resultant number of interconnections—present a massive cybersecurity challenge. Unlike the physical security challenge, which was treated in earnest throughout the last decades, cyber-attacks on airports keep coming, but most airport lack essential means to confront such cyber-attacks. ...These missing means are not technical tools, but rather holistic regulatory directives, technical and process standards, guides, and best practices for airports cybersecurity—even airport cybersecurity concepts and basic definitions are missing in certain cases. Unsettled Topics Concerning Airport Cybersecurity Standards and Regulation offers a deeper analysis of these issues and their causes, focusing on the unique characteristics of airports in general, specific cybersecurity challenges, missing definitions, and conceptual infrastructure for the standardization and regulation of airports cybersecurity. ...Unsettled Topics Concerning Airport Cybersecurity Standards and Regulation offers a deeper analysis of these issues and their causes, focusing on the unique characteristics of airports in general, specific cybersecurity challenges, missing definitions, and conceptual infrastructure for the standardization and regulation of airports cybersecurity.
Technical Paper

A Controller Area Network Bus Identity Authentication Method Based on Hash Algorithm

2021-07-14
2021-01-5077
With the development of vehicle intelligence and the Internet of Vehicles, how to protect the safety of the vehicle network system has become a focus issue that needs to be solved urgently. The Controller Area Network (CAN) bus is currently a very widely used vehicle-mounted bus, and its security largely determines the degree of vehicle-mounted information security. The CAN bus lacks adequate protection mechanisms and is vulnerable to external attacks such as replay attacks, modifying attacks, and so on. On the basis of the existing work, this paper proposes an authentication method that combines Hash-based Message Authentication Code (HMAC)-SHA256 and Tiny Encryption Algorithm (TEA) algorithms. This method is based on dynamic identity authentication in challenge/response made and combined with the characteristics of the CAN bus itself as it achieves the identity authentication between the gateway and multiple electronic control units (ECUs).
Technical Paper

It Takes a Village: A Case Study of Business Development and Innovation in a UAS/AUS Ecosystem to Address Critical Industry Challenges

2021-06-16
2021-01-1002
Entrepreneurial innovation that spurs economic development requires a collaborative cluster of cooperative effort, across a diverse ecosystem of partners. Literature provides resounding evidence to support the notion that an innovative, entrepreneurial ecosystem is critical to both successful economic development and industry sector growth. The UAS/AUS industry sector is a fast-growing sector across the United States, with regional leadership demonstrated in North Dakota, California, North Carolina, New York, Oklahoma, Texas and New Mexico. This case study is focused on investigating how the North Dakota autonomous systems ecosystem continues to evolves and develop mechanisms and partnerships to address industry pain points, facilitate cutting edge research, ensure high-quality UAS/AUS testing, and support an adaptive business development pipeline across the entrepreneurial life cycle.
Technical Paper

Safe Operations at Roadway Junctions - Design Principles from Automated Guideway Transit

2021-06-16
2021-01-1004
This paper describes a system-level view of a fully automated transit system comprising a fleet of automated vehicles (AVs) in driverless operation, each with an SAE level 4 Automated Driving System, along with its related safety infrastructure and other system equipment. This AV system-level control is compared to the automatic train control system used in automated guideway transit technology, particularly that of communications-based train control (CBTC). Drawing from the safety principles, analysis methods, and risk assessments of CBTC systems, comparable functional subsystem definitions are proposed for AV fleets in driverless operation. With the prospect of multiple AV fleets operating within a single automated mobility district, the criticality of protecting roadway junctions requires an approach like that of automated fixed-guideway transit systems, in which a guideway switch zone “interlocking” at each junction location deconflicts railway traffic, affirming safe passage.
X