English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

While the adoption of Service-Oriented Architectures (SOA) eases theimplementation of features such as autonomous driving and over-the-air updates,it also increases the vehicle's exposure to attacks that may place road-usersin harm. To address this problem, standards (ISO 21434/UNECE) expectmanufacturers to produce security arguments and evidence by carrying outappropriate threat analysis. As key threat analysis steps, e.g., damage/threatscenario and attack path enumeration, are often carried out manually and notrigorously, security arguments lack precise guarantees, e.g., traceabilityw.r.t. safety goals, especially under system updates. This article proposesautomated methods for threat analysis using a model-based engineeringmethodology that provides precise guarantees with respect to safety goals. Thisis accomplished by proposing an intruder model for automotive SOA whichtogether with the system architecture and the loss scenarios identified bysafety analysis are used as input for computing assets, impact rating,damage/threat scenarios, and attack paths. To validate the proposedmethodology, we developed a faithful model of the autonomous driving functionsof the Apollo framework, a widely used open-source autonomous driving stack.The proposed machinery automatically enumerates several attack paths on Apollo,including attack paths not reported in the literature.

Technical Report: Automating Vehicle SOA Threat Analysis using a Model-Based Methodology