Security of Emergent Automotive Systems: a Tutorial Introduction and Perspectives on Practice
Total Page:16
File Type:pdf, Size:1020Kb
Survey Security of Emergent Automotive Systems: A Tutorial Introduction and Perspectives on Practice Anthony Lopez, Arnav Vaibhav Malawade, Srivalli Boddupalli and Sandip Ray and Mohammad Abdullah Al Faruque University of Florida at Gainesville University of California at Irvine be accomplished under hard real-time Editor’s note: requirements. for example, a pedestrian Emerging automotive systems are governed by various complicated detec tion algorithm must complete a hardware and software systems. Hence, security is an important issue in slew of complex activities, including the highly interconnected automotive systems. This article presents a survey of capture of sensory data, aggregation, current automotive security research. communication, analytics, image pro- —Partha Pratim Pande, Washington State University cessing, security analysis, and so on, within the time constraints to enable THE LAST FEW DECADES have seen a transfor- successful completion of the appropriate actuarial mation in automotive systems from mechanical response such as warning the driver or automatical or electromechanical systems to electronic, soft- braking. Furthermore, the complexity is anticipated ware-based systems. Modern automotive systems are to rise sharply with increasing autonomy levels in complex distributed systems involving the coordina- vehicles. For instance, a future self-driving car with tion of hundreds of electronic control units (ECUs) autonomy level 4 will include several elements not communicating through a variety of in-vehicle available in today’s (level 2) systems. The following networks and the execution of several hundred are some example elements. megabytes of software. However, they induce two • Vehicle-to-vehicle ( V2V) and vehicle-to-infra- additional constraints that result in significant design structure ( V2I) communications with a variety of complexities beyond traditional distributed systems. networks of different levels of trustworthiness. First, the systems are cyber–physical: the ECUs coor- • A diversity of sensors to detect driving conditions dinate, monitor, and control a variety of sensors (e.g., potholes, moisture, pedestrians, etc.). and actuators including light detection and ranging • Distributed computing elements to perform (LIDAR), cameras, radar, light matrices, devices for in- vehicle analytics and react to evolving condi- sensing angular momentum of the wheels, devices for tions on the fly. automated brake and steering control, and so on. Second, many computation and communi ca tion tasks Security is obviously of paramount impor- across different ECUs, sensors, and actuators must tance for automotive systems. Given that the sys- tem involves the complex interaction of sensory, actuarial, and computational elements, an inno- Digital Object Identifier 10.1109/MDAT.2019.2944086 Date of publication: 27 September 2019; date of current cent misconfiguration or error in one component version: 31 October 2019. may result in a subtle vulnerability that can be 10 2168-2356/19©2019 IEEE Copublished by the IEEE CEDA, IEEE CASS, IEEE SSCS, and TTTC IEEE Design&Test exploited in field with potentially catastrophic This article represents the first step to address consequences. A recent work has shown that it the above problem. Our goal is to provide a com- is viable, and even relatively straightforward, to prehensive, systematic overview of both research hack a vehicle remotely, get control over its driv- and practice in automotive security. We develop a ing functionality, and cause an accident. The sit- systematic categorization of research advances in uation will be exacerbated in the future with the various aspects of both attacks and defenses on increase in autonomy level and the reliance on automotive electronics. Furthermore, we discuss sensors and communications—an attacker may current practices in security assurance, point out the hack a vehicle remotely through the interception constraints and tradeoffs, and provide perspectives or tampering of sensor data and/or V2V and V2I on the rationale involved. Our objective is to make messages without requiring physical access or this article a comprehensive one for a researcher to even proximity to the vehicle under attack, thus begin investigation on all aspects of the security of resulting in a sharp increase in the attack surface. connected and autonomous vehicles. Consequently, the proliferation and adoption of Background autonomous, self-driving cars critically depend on our ability to ensure that they perform securely Electronics and software in modern in a potentially adversarial environment [125], automotive systems [126]. Unsurprisingly, there has been a large inter- The transformation of automotive systems from est in recent years in the security of automotive a mechanical or an electromechanical system to systems, with a flurry of publications demon- a chiefly electronic one arguably began with the strating a diversity of security vulnerabilities and development of engine control and fuel injection exploits, as well as techniques for defense against systems in the 1970s. Starting from the 1990s, the these vulnerabilities. design complexity of automotive systems has been Unfortunately, in spite of this interest, there has dominated by electronic parts, with more focus on been little effort to consolidate, structure, and unify software components in the last decade. Today’s this large body of research. Consequently, pub- cars include electronics and software for infotain- lications in the area typically appear as isolated ment, driver assistance [advanced driver-assistance approaches for specific attacks or defenses, rather system (ADAS)], and energy efficiency (e.g., emis- than a disciplined study of security challenges or sion control), to name a few. The electronic and soft- systematic approaches to counter them. Further- ware components in an automobile (which we will more, much of the research on automotive secu- loosely refer to as electronics) are typically divided rity is conflated with other related areas on security into five functional domains: assurance with analogous but different challenges, • Telematics: This includes the multimedia and info- including wearables, the Internet of Things (IoT), tainment components of the car, including radio, or even traditional hardware and software designs. rear-seat entertainment, and navigation systems. Finally, there has been an increasing divergence • Body: This includes air-conditioning and climate between academic research and industrial prac- control, the electronic dashboard, power doors, tice in the area, each of which has evolved inde- seats, windows, mirrors, lights, park distance pendently with little interaction and, in some control, and so on. cases, with little understanding of the assump- • Chassis: This includes features such as the anti- tions, issues, tradeoffs, and scales considered by lock braking system (ABS), stability control, the other. All this leaves a researcher getting initi- adaptive cruise control, and so on. ated in this area with the daunting tasks of sifting • Powertrain: This includes the electronics for con- through the various challenges, complexities, and trolling the engine, fuel injection, transmission research directions; identifying approaches appli- gear, ignition timing, and so on. cable to automotive systems in particular; and • Passive safety: This includes all the electronics comprehending evolving challenges caused by the designed to add safety mechanisms, including rising complexity of these systems through the past, roll-over sensors, airbags, belt pretensioners, present, and future. and so on. November/December 2019 11 Survey Obviously, many automotive features cross- Security requirements cut a variety of functional domains. For example, Traditionally, the security of functional safety of many modern cars include speed-compensated electrical/electronic/programmable electronic (E/E/ volume adjustment, that is, adjustment of multi- PE) safety-related system includes the following media volume in response to increasing speed of foundational pillars: confidentiality, integrity, and the car. This requires communication between the availability, also referred to as the CIA pillars [57]. radio (part of telematics) and ADAS components. More recently, authentication and repudiation have Other similar examples include automatic brak- been added as additional pillars, particularly for ing while reversing if the backup camera senses a communicating systems and devices. child or small obstacle and showing the reversing trajectory on display (which requires computation • Confidentiality: This refers to the requirement that of angular momentum of the wheels). To enable sensitive, critical system information and data these features, automotive system architectures are not perceivable by parties who are not the involve significant and complex communication intended recipients. among the different in-vehicle components. This • Integrity: This refers to the requirement that an is implemented through a variety of protocols unauthorized entity cannot corrupt or modify including controller area network bus (CAN-Bus), sensitive data or information. In the context of local interconnect network (LIN), FlexRay, and communicating agents, integrity involves the media- oriented systems transport (MOST). Figure 1 requirement that data received is not different shows a representative automotive architecture. from what was originally intended to be sent. Fur- In addition to