Technical Report: Automating Vehicle SOA Threat Analysis using a Model-Based Methodology

TL;DR

This paper introduces an automated, model-based approach for vehicle threat analysis in SOA environments, enhancing security guarantees and enabling systematic attack path enumeration, validated on the Apollo autonomous driving system.

Contribution

It presents a novel automated threat analysis methodology using a model-based engineering approach with an intruder model for automotive SOA systems.

Findings

Automatically enumerates attack paths on Apollo

Identifies attack paths not previously reported

Provides precise security guarantees with respect to safety goals

Abstract

While the adoption of Service-Oriented Architectures (SOA) eases the implementation of features such as autonomous driving and over-the-air updates, it also increases the vehicle's exposure to attacks that may place road-users in harm. To address this problem, standards (ISO 21434/UNECE) expect manufacturers to produce security arguments and evidence by carrying out appropriate threat analysis. As key threat analysis steps, e.g., damage/threat scenario and attack path enumeration, are often carried out manually and not rigorously, security arguments lack precise guarantees, e.g., traceability w.r.t. safety goals, especially under system updates. This article proposes automated methods for threat analysis using a model-based engineering methodology that provides precise guarantees with respect to safety goals. This is accomplished by proposing an intruder model for automotive SOA which together with the system architecture and the loss scenarios identified by safety analysis are used as input for computing assets, impact rating, damage/threat scenarios, and attack paths. To validate the proposed methodology, we developed a faithful model of the autonomous driving functions of the Apollo framework, a widely used open-source autonomous driving stack. The proposed machinery automatically enumerates several attack paths on Apollo, including attack paths not reported in the literature.