Browse Topic: Cybersecurity
This SAE Technical Information Report (TIR) establishes the instructions for the documents required for the variety of potential functions for PEV communications, energy transfer options, interoperability, and security. This includes the history, current status, and future plans for migrating through these documents created in the Hybrid Communication and Interoperability Task Force, based on functional objective (e.g., [1] If I want to do V2G with an off-board inverter, what documents and items within them do I need, [2] What do we intend for V3 of SAE J2953
Cybersecurity, particularly in the automotive sector, is of paramount importance in today’s digital age. With the advent of connected commercial vehicles, which leverage telematics for efficient fleet management, the landscape of automotive cybersecurity is rapidly evolving. These vehicles, integral to logistics and transportation businesses, are becoming increasingly connected, thereby escalating the risks associated with cybersecurity threats. These commercial vehicles are becoming prime targets for cyber-attacks due to their connectivity and the valuable data they hold. The potential consequences of these cyber-attacks can range from data breaches to disruptions in fleet operations, and even safety risks. This paper analyses the unique challenges faced by the commercial vehicle sector, such as the need for robust telematics systems, secure communication channels, and stringent data protection measures. Case studies of notable cybersecurity incidents involving commercial vehicles are
A research team led by Rice University’s Edward Knightly has uncovered an eavesdropping security vulnerability in high-frequency and high-speed wireless backhaul links, widely employed in critical applications such as 5G wireless cell phone signals and low-latency financial trading on Wall Street
Virtualization features such as digital twins and virtual patching can accelerate development and make commercial vehicles more agile and secure. There is one sure-fire way to secure commercial vehicles from cyber-attacks. “You just remove the connectivity,” quipped Brandon Barry, CEO of Block Harbor Cybersecurity and the moderator of a panel session on “cybersecurity of virtual machines” at the SAE COMVEC 2024 conference in Schaumburg, Illinois. Obviously, that train has left the station - commercial vehicles of all types, including trains, are only becoming more automated and connected, which increases the risks for cyber-attacks. “We have very connected vehicles, so attacks can be posed not just through powertrain solutions but also through telemetry, infotainment systems connected to different applications and services, and also through cloud platforms,” said Trisha Chatterjee, current product support and data specialist for fuel cell and hydrogen technology at Accelera by Cummins
ABSTRACT The automotive and defense industries are going through a period of disruption with the advent of Connected and Automated Vehicles (CAV) driven primarily by innovations in affordable sensor technologies, drive-by-wire systems, and Artificial Intelligence-based decision support systems. One of the primary tools in the testing and validation of these systems is a comparison between virtual and physical-based simulations, which provides a low-cost, systems-approach testing of frequently occurring driving scenarios such as vehicle platooning and edge cases and sensor-spoofing in congested areas. Consequently, the project team developed a robotic vehicle platform—Scaled Testbed for Automated and Robotic Systems (STARS)—to be used for accelerated testing elements of Automated Driving Systems (ADS) including data acquisition through sensor-fusion practices typically observed in the field of robotics. This paper will highlight the implementation of STARS as a scaled testbed for rapid
ABSTRACT This paper describes an approach to secure previously deployed vehicles by using bus monitoring and segmentation to remove malicious messages from the CAN bus. Modern automotive buses were designed for reliability rather than security. This lack of security means that any node on the bus can transmit a message to any other node and the receiver cannot verify the sender or that the message is unaltered. The intrusion detection and prevention system seeks to solve that issue by actively monitoring traffic on all connected busses, alerting an operator when an error is detected and removing flagged messages from the bus. The system will eventually be installed on an Interim Armored Vehicle (IAV) Stryker. Citation: R. Elder, C. Westrick, P. Moldenhauer, “Cyberattack Detection and Bus Segmentation in Ground Vehicles”, In Proceedings of the Ground Vehicle Systems Engineering and Technology Symposium (GVSETS), NDIA, Novi, MI, Aug. 11-13, 2020
ABSTRACT Ransomware is not a new method of malware infection. This historically had been experienced in the enterprise in nearly every industry. This has been especially problematic in the medical and manufacturing fields. As the attackers saturate the specifically targeted industries, the attackers will expand their target industries. One of these which has not been significantly explored by the ransomware groups are the embedded systems and automobile environment. This set of targets is massive and provides for a vast attack potential. While this has not experienced this attack methodology at length, the research and efforts are creeping towards this as a natural extension of the business. The research focusses on the history of ransomware, uses in the enterprise, possible attack vectors with automobiles, and defenses to be explored and implemented to secure automobiles, fleets, and the industries. Citation: Parker, C., “Ransomware Vehicle Embedded System Attacks”, In Proceedings of
ABSTRACT Addressing the well-established need for accurate cyber situational awareness on military vehicles and weapons platforms, we developed a well-tested, robust Intrusion Detection System – Fox Shield™ – currently rated TRL-8. The system is described and the lessons learned during its development are discussed. The basic principles of our anomaly detectors are outlined, and the details of our innovative warning-aggregating Fuser are presented. Many attack detection examples are presented, using a publicly available CANbus dataset. Citation: E.I. Novikova, V. Le, M. Weber, C. Andersen, S.N. Hamilton, “Best Practices For Ground Vehicle Intrusion Detection Systems”, In Proceedings of the Ground Vehicle Systems Engineering and Technology Symposium (GVSETS), NDIA, Novi, MI, Aug. 13-15, 2020
ABSTRACT Bitcoin and other digital currencies utilize blockchain. Blockchain, in summary, is a collection of blocks. Within each block is a collection of transactions. Each computer (node) has the same list of blocks and transactions, which they can see as the blocks are filled with the transactions. While this is the traditional application experienced, there are other applications relevant to cybersecurity. As part of the blockchain technology, the nodes are responsible for decision-making. The blockchain technology may be used for this function in these systems. In adjusting the data flow, this is an option to increase the cybersecurity for a complete system. This addition to the cybersecurity system provides a clear benefit. Citation: Parker, C., “Blockchain Vehicle Applications and Cybersecurity: An Appropriate Use or Use Appropriately?”, In Proceedings of the Ground Vehicle Systems Engineering and Technology Symposium (GVSETS), NDIA, Novi, MI, August 10, 2021
ABSTRACT The advent of both new bidirectional communications capabilities and increasing levels of automation to offload driver workload is requiring the vehicle’s architecture to evolve substantially. Military vehicles of the US Armed Forces are subject to even greater cybersecurity threats. New vehicle hardware includes many sensors, cameras and other systems to capture road, weather and traffic conditions. These systems will be communicating the data both internally and externally from the vehicle. In addition, the vehicles will send and receive data via multiple communications protocols. Each of these communication protocols have unique capabilities and inherent weaknesses with regard to secure communications. With this vehicle evolution, and with the pervasive cyber threats, the vehicle will have to be architected for holistic vehicle cyber situational awareness. The US Army and US Marine Corps need to be fully versed and trained to recognize threats and effectively deal with them
ABSTRACT There has been a lot of interest in the secure embedded L4 (seL4) microkernel in recent years as the basis of a cyber-security platform because it has been formally proven to be correct and free of common defects. However, while the seL4 microkernel has a formal proof of correctness, it does so at the cost of deferring functionality to the user space that most developers and system integrators would deem necessary for real life products and solutions, and use of formal proofs for user space can be prohibitively expensive. DornerWorks took an approach to bypass the need for native seL4 user space applications to develop a representative real-world system for GVSC VEA based on seL4 by enabling its virtual machine monitor functionality for ARMv8 platforms, allowing feature rich software stacks to be run in isolation guaranteed by the seL4 formal proofs. This paper describes that system and the efforts undertaken to achieve real world functionality. Citation: R. VanVossen, J
ABSTRACT The growing sophistication and emergence of widespread cyber threats today has driven the DOD to place Cyber Resiliency requirements on new and legacy defense systems. The DOD has recently garnered a massive defensive DevSecOps effort aimed at defining structured practices to unify software (Dev), Security (Sec), and operations (Ops) under the umbrella of more OpSec-driven engineering practices. According to the DOD DevSecOps practicum referenced in this document [1], “Practicing DevSecOps provides demonstrable quality and security improvements over the traditional software lifecycle, enabling application security, secure deployments, and secure operations in close alignment with mission objectives.” Modern systems often contain greater networking capability and are therefore more exposed to cyber-threats. Legacy systems were often conceived prior to the field of cyber warfare maturing, resulting in unpatched potential vulnerabilities that could be exploited through trusting
ABSTRACT The growing sophistication and emergence of widespread cyber threats today has driven the DOD to place Cyber Resiliency requirements on new and legacy defense systems. The DOD has recently garnered a massive defensive DevSecOps effort aimed at defining structured practices to unify software (Dev), Security (Sec), and operations (Ops) under the umbrella of more OpSec-driven engineering practices. According to the DOD DevSecOps practicum referenced in this document [1], “Practicing DevSecOps provides demonstrable quality and security improvements over the traditional software lifecycle, enabling application security, secure deployments, and secure operations in close alignment with mission objectives.” Modern systems often contain greater networking capability and are therefore more exposed to cyber-threats. Legacy systems were often conceived prior to the field of cyber warfare maturing, resulting in unpatched potential vulnerabilities that could be exploited through trusting
ABSTRACT Today’s platform systems (satellites, aircraft, surface ships, ground vehicles, and subsurface vehicles) have large numbers of electronic components including microprocessors, microcontrollers, sensors, actuators, and internal (onboard) and external (off-board) communication networks. Hardening and securing these systems is currently performed using checklist approaches like the Risk Management Framework (RMF) that derive from decades of information technology (IT) best practices. However, these approaches do not translate well to platforms because they inadequately address security issues that are unique to cyber-physical and the embedded nature of platform systems. In this paper, we describe key resilience concepts and two analytic models for improving platform cyber resilience. These models balance knowledge of offensive attack vectors with Resilience-in-Depth™ controls. The Platform Cyber Attack Model (PCAM) provides a multi-scale construct for identifying, describing, and
ABSTRACT The Modular Active Protection System (MAPS) Science and Technology Objective (STO) program led by the CCDC- Ground Vehicle Systems Center (CCDC-GVSC) has undertaken and committed to delivering a product baseline that can readily support performance requirements for Vehicle Protection System (VPS) capabilities while meeting cybersecurity requirements. DoD investments in a cyber-secure common kit can provide many benefits to the DoD as each program (i.e., Abrams, Bradley, Stryker, AMPV) will be able to leverage the initial investments without having to create their own technical solution per platform. It is broadly acknowledged that implementing security controls early in the product’s life cycle provides better capabilities, reduces vulnerabilities, reduces program schedule, and reduces program cost compared to attempting to add cybersecurity later in the production and test phases. As the MAPS open-architecture enables programs to leverage occupant and vehicle protection
ABSTRACT This paper explores a holistic approach to increasing the cyber resiliency of Army and USMC ground vehicles. Today’s current approach to securing weapon systems focuses on complying with the Risk Management Framework and applying required security controls to obtain government authority to operate (ATO). This method of securing our weapon systems is better than nothing, but runs the risk of giving us a false sense of security. Citation: D. Woolrich, “Holistically Increasing Cyber Resilience of Ground Vehicles”, In Proceedings of the Ground Vehicle Systems Engineering and Technology Symposium (GVSETS), NDIA, Novi, MI, Aug. 13-15, 2019
ABSTRACT Modern vehicular systems are comprised of numerous electronics control units (ECUs) that consist of thousands of microelectronics components. Individual ECU systems are reliant upon “trust” in the supply chain for defense. This paper describes an approach utilizing historically offensive-based cybersecurity technology, side-channels, to quantify and qualify malicious ECU states in a bus-agnostic, logically-decoupled method of assurance and verification. Providing a measure of supply chain assurance to end-users. Citation: Yale Empie, Matthew Bayer, “Assurance and Verification of Vehicular Microelectronic Systems (AV2MS): Supply Chain Assurance through Utilization of Side Channel Radio Frequency Emissions for Improved Ground Vehicle Cybersecurity,” In Proceedings of the Ground Vehicle Systems Engineering and Technology Symposium (GVSETS), NDIA, Novi, MI, Aug. 16-18, 2022
ABSTRACT This paper describes the strategies and challenges involved to secure vehicles which use automotive Ethernet-based networks. Since the early 1990’s, the Controller Area Network (CAN) bus has been the standard in automotive networking systems. However, automotive Ethernet is becoming more common in recent years and is considered the future in automotive networking. This new technology has unique advantages over traditional CAN bus networks (e.g. higher bandwidth that can support hashing and encryption), and it still requires additional security measures such as monitoring and detection of anomalies to better secure the vehicle. Southwest Research Institute (SwRI) has previously developed a CAN-only intrusion detection system (IDS) which protects a vehicle’s CAN bus by actively monitoring traffic and flagging messages that are identified as anomalies. SwRI successfully implemented the ability to read, train, and detect on automotive Ethernet data in the IDS. The integration of
ABSTRACT Model Based System Engineering (MBSE) offers the ability to connect an ever expanding set of disciplines through the system model into specialty areas, having a dramatic impact early and lasting throughout the system lifecycle. System safety and cybersecurity are two such areas that are far too often “patched” into a system design versus properly integrated. MBSE and the use of a system model provides a methodology to integrate these areas early in the design process. Addressing system safety and cybersecurity concerns from the beginning stages of development will enforce adoption of principals and best practices throughout the life of the system
Abstract Increased connectivity, burgeoning functionality, as well as surging software and integration complexity all conspire to blur the lines for requirements sourcing and implementation of new Ground Vehicles
ABSTRACT Automotive electrical/electronic (E/E) architectures are continuously evolving to meet the technological challenges of the highly connected, software-defined vehicle. Advances are being made in µController/µProcessor compute hardware, software, and cyber security methodologies, to provide enhanced security, safety, flexibility and functionality. These advancements will mature through millions of miles of road/lab testing and reach TRLs suitable for use by the Army to implement safe and secure cyber-resilient platforms for manned and unmanned ground vehicle systems. This paper will describe three specific advances that will benefit Army vehicle programs of the future: Software that leverages the Modular Open Systems Approach (MOSA) as a secure and flexible Service Oriented Architecture (SOA) framework; Hardware-based Communication Engines for high bandwidth/low latency network communications; and a Hardware Security Module (HSM) that enhances the cyber-resilience of the next
Items per page:
50
1 – 50 of 517