Browse Topic: Cybersecurity

Items (528)
The growing ubiquity of autonomous vehicles (AVs) has introduced a new attack surface for malicious actors: the embedded systems that govern a vehicle's critical operations. Security breaches in these systems could have catastrophic consequences, potentially leading to loss of control, manipulation of sensor data, or even physical harm. To mitigate these risks, robust cybersecurity measures are paramount. This research delves into a specific threat – side-channel attacks – where attackers exploit data leakage through unintentional physical emanations, like power consumption or electromagnetic waves, to steal cryptographic keys or sensitive information. While various software and hardware countermeasures have been proposed, this study focuses on the implementation of masking techniques within the realm of embedded security. Masking techniques aim to obfuscate sensitive data during cryptographic operations, making it significantly harder for attackers to exploit side-channel
Deepan Kumar, SadhasivamR, Vishnu Ramesh KumarM, BoopathiManojkumar, RR, GobinathM, Vignesh
Connected and autonomous vehicles (CAVs) rely on communication channels to improve safety and efficiency. However, this connectivity leaves them vulnerable to potential cyberattacks, such as false data injection (FDI) attacks. We can mitigate the effect of FDI attacks by designing secure control techniques. However, tuning control parameters is essential for the safety and security of such techniques, and there is no systematic approach to achieving that. In this article, our primary focus is on cooperative adaptive cruise control (CACC), a key component of CAVs. We develop a secure CACC by integrating model-based and learning-based approaches to detect and mitigate FDI attacks in real-time. We analyze the stability of the proposed resilient controller through Lyapunov stability analysis, identifying sufficient conditions for its effectiveness. We use these sufficient conditions and develop a reinforcement learning (RL)-based tuning algorithm to adjust the parameter gains of the
Javidi-Niroumand, FarahnazSargolzaei, Arman
The increased connectivity of vehicles expands the attack surface of in-vehicle networks, enabling attackers to infiltrate through external interfaces and inject malicious traffic. These malicious flows often contain anomalous semantic information, potentially leading to misleading control instructions or erroneous decisions. While most semantic-based anomaly detection methods for in-vehicle networks focus on extracting semantic context, they often overlook interactions and associations between multiple semantics, resulting in a high false positive rate (FPR). To address these challenges, the Adaptive Structure Graph Attention Network Model (AS-GAT) is proposed for in-vehicle network anomaly detection. Our approach combines a semantic extractor with a continuously updated graph structure learning method based on attention weight similarity constraints. The semantic extractor identifies semantic features within messages, while the graph structure learning module adaptively updates the
Luo, FengLuo, ChengWang, JiajiaLi, Zhihao
Modern vehicles are increasingly integrating electronic control units (ECUs), enhancing their intelligence but also amplifying potential security threats. Vehicle network security testing is crucial for ensuring the safety of passengers and vehicles. ECUs communicate via the in-vehicle network, adhering to the Controller Area Network (CAN) bus protocol. Due to its exposed interfaces, lack of data encryption, and absence of identity authentication, the CAN network is susceptible to exploitation by attackers. Fuzz testing is a critical technique for uncovering vulnerabilities in CAN network. However, existing fuzz testing methods primarily generate message randomly, lacking learning from the data, which results in numerous ineffective test cases, affecting the efficiency of fuzz testing. To improve the effectiveness and specificity of testing, understanding of the CAN message format is essential. However, the communication matrix of CAN messages is proprietary to the Original Equipment
Shen, LinXiu, JiapengZhang, ZhuopengYang, Zhengqiu
It is the tenth anniversary of SAE International’s Surface Vehicle Recommended Practice effort SAE J3016 to establish a nomenclature standard for driving automation systems and levels of automation. While not exhaustive, this report covers motivation, initiation, and continued development of J3016 regarding driving automation systems, noting that J3016 evolved as a learning device that facilitated the evolution of driving automation systems. It initially worked by establishing common terminology for the technical learning in the field, but over time, J3016 expanded to recognize the human roles in driving automation systems, with later iterations considering broader transportation ecosystems, including fleet operations and remote assistance centers. SAE J3016 as a Learning Device for the Driving Automation Community: Technical, Socio-technical, and Systemic Learning emphasizes ongoing learning to integrate diverse insights about technical, social, and socio-technical challenges of
Eley IV, T.C.King, John L.Lyytinen, KalleNickerson, Jeffrey V.
This SAE Technical Information Report (TIR) establishes the instructions for the documents required for the variety of potential functions for PEV communications, energy transfer options, interoperability, and security. This includes the history, current status, and future plans for migrating through these documents created in the Hybrid Communication and Interoperability Task Force, based on functional objective (e.g., [1] If I want to do V2G with an off-board inverter, what documents and items within them do I need, [2] What do we intend for V3 of SAE J2953, …).
Hybrid - EV Committee
In an era where automotive technology is rapidly advancing towards autonomy and connectivity, the significance of Ethernet in ensuring automotive cybersecurity cannot be overstated. As vehicles increasingly rely on high-speed communication networks like Ethernet, the seamless exchange of information between various vehicle components becomes paramount. This paper introduces a pioneering approach to fortifying automotive security through the development of an Ethernet-Based Intrusion Detection System (IDS) tailored for zonal architecture. Ethernet serves as the backbone for critical automotive applications such as advanced driver-assistance systems (ADAS), infotainment systems, and vehicle-to-everything (V2X) communication, necessitating high-bandwidth communication channels to support real-time data transmission. Additionally, the transition from traditional domain-based architectures to zonal architectures underscores Ethernet's role in facilitating efficient communication between
Appajosyula, kalyanSaiVitalVamsi
Cybersecurity, particularly in the automotive sector, is of paramount importance in today’s digital age. With the advent of connected commercial vehicles, which leverage telematics for efficient fleet management, the landscape of automotive cybersecurity is rapidly evolving. These vehicles, integral to logistics and transportation businesses, are becoming increasingly connected, thereby escalating the risks associated with cybersecurity threats. These commercial vehicles are becoming prime targets for cyber-attacks due to their connectivity and the valuable data they hold. The potential consequences of these cyber-attacks can range from data breaches to disruptions in fleet operations, and even safety risks. This paper analyses the unique challenges faced by the commercial vehicle sector, such as the need for robust telematics systems, secure communication channels, and stringent data protection measures. Case studies of notable cybersecurity incidents involving commercial vehicles are
Mahendrakar, ShrinidhiMadarla, ManojGangapuram, SivaDadoo, Vishal
Autonomous vehicles (AVs) are positioned to revolutionize transportation, by eliminating human intervention through the use of advanced sensors and algorithms, offering improved safety, efficiency, and convenience. In India, where rapid urbanization and traffic congestion present unique challenges, AVs still hold a significant promise. This technical paper discusses the relevance of autonomous vehicles in the Indian context and the challenges that need to be addressed before the widespread adoption of autonomous vehicles in India. These challenges include the lack of infrastructure, concerns regarding road safety, software vulnerabilities, adaptability of change towards autonomous vehicles, and the management of traffic. The paper also highlights the government's initiatives to encourage the development and adoption of autonomous vehicles, ideology behind the legal framework and the required changes in terms of technological advancements, and urban planning. In a brief manner, this
Mishra, AdarshMathur, Gaurav
Virtualization features such as digital twins and virtual patching can accelerate development and make commercial vehicles more agile and secure. There is one sure-fire way to secure commercial vehicles from cyber-attacks. “You just remove the connectivity,” quipped Brandon Barry, CEO of Block Harbor Cybersecurity and the moderator of a panel session on “cybersecurity of virtual machines” at the SAE COMVEC 2024 conference in Schaumburg, Illinois. Obviously, that train has left the station - commercial vehicles of all types, including trains, are only becoming more automated and connected, which increases the risks for cyber-attacks. “We have very connected vehicles, so attacks can be posed not just through powertrain solutions but also through telemetry, infotainment systems connected to different applications and services, and also through cloud platforms,” said Trisha Chatterjee, current product support and data specialist for fuel cell and hydrogen technology at Accelera by Cummins.
Gehm, Ryan
A research team led by Rice University’s Edward Knightly has uncovered an eavesdropping security vulnerability in high-frequency and high-speed wireless backhaul links, widely employed in critical applications such as 5G wireless cell phone signals and low-latency financial trading on Wall Street.
Automated vehicles (AVs) can get additional information from infrastructure and other vehicles via vehicle-to-everything (V2X) communication. However, how can an AV decide if the surrounding V2X field can reliably provide qualitative, relevant, and trustworthy information? Related research analyzes V2X performance from various angles. However, not only are there identified open gaps in the analysis of loaded channels, but there has also not yet been an effort to design a lightweight metric for rating the quality of the surrounding V2X field. Hence, this work aims to close this existing performance measurement gap and develop a metric for rating the quality of the surrounding V2X field. This article first highlights the gaps identified in performance analysis before closing them with a dedicated measurement campaign. Next, it combines these findings with related research to design a straightforward V2X field rating metric. The resulting V2X field rating metric is a starting point for
Pilz, ChristophKuschnig, LukasSteinberger, AlinaSammer, PeterPiri, EsaCouturier, ChristopheNeumayr, ThomasSchratter, MarkusSteinbauer-Wagner, Gerald
In today’s world, Vehicles are no longer mechanically dominated, with increased complexity, features and autonomous driving capabilities, vehicles are getting connected to internal and external environment e.g., V2I(Vehicle-to-Infrastructure), V2V(Vehicle-to-Vehicle), V2C(Vehicle-to-Cloud) and V2X(Vehicle-to-Everything). This has pushed classical automotive system in background and vehicle components are now increasingly dominated by software’s. Now more focus is made on to increase self-decision-making capabilities of automobile and providing more advance, safe and secure solutions e.g., Autonomous driving, E-mobility, and software driven vehicles, due to which vehicle digitization and lots of sensors inside and outside the vehicle are being used, and automobile are becoming intelligent. i.e., intelligent vehicles with advance safe and secure features but all these advancements come with significant threat of cybersecurity risk. Therefore, providing an automobile that is safe and
Kumar, ArvindGholve, AshishKotalwar, Kedar
In recent times there has been an upward trend in “Connected Vehicles”, which has significantly improved not only the driving experience but also the “ownership of the car”. The use of state-of-the-art wireless technologies, such as vehicle-to-everything (V2X) connectivity, is crucial for its dependability and safety. V2X also effectively extends the information flow between the transportation ecosystem pedestrians, public infrastructure (traffic management system) and parking infrastructure, charging and fuel stations, Etc. V2X has a lot of potential to enhance traffic flow, boost traffic safety, and provide drivers and operators with new services. One of the fundamental issues is maintaining trustworthy and quick communication between cars and infrastructure. While establishing stable connectivity, reducing interference, and controlling the fluctuating quality of wireless transmissions, we have to ensure the Security and Privacy of V2I. Since there are multiple and diverse
Sundar, ShyamPundalik, KrantiveerUnnikrishnan, Ushma
Based on advanced Automotive functionality, Vehicle networks has enabled the exchange of data to multiple domains and to meet these demands, more complex software applications, some of which require service-based cloud are developed. Exposure of data creates multiple threats for attacker to tamper security and privacy. Automotive cybersecurity topic has gained momentum based on multiple gaps identified in Automotive In vehicle and around the vehicle networks. In this paper, we provide an extensive overview on V2C (Vehicle to Cloud) and In-vehicle data protection, we also highlight methods to identify threats on any vehicle network connected to V2C and identify methods to verify security functionality using Fuzz or Penetration test protocol, we have identified gaps in existing security solutions and outline possible open issues and probable solution.
Panda, JyotiprakashJain, Rushabh Deepakchand
When cybersecurity firm Crowdstrike's platform went down in July, it became the most significant outage in the history of information technology, according to The Guardian. About 8.5 million Microsoft operating systems were affected, including almost every sector of the economy. In the wake of the crash, which was traced to a faulty software update pushed by Crowdstrike, the automotive business is among those developing new policies to avoid repeat incidents.
Clonts, Chris
This document specifically pertains to cybersecurity for road vehicles. This document encompasses the entire vehicle lifecycle of key management. It has been developed by SAE Committee TEVEES18F, Vehicle Security Credentials Interoperability (VSCI), a subcommittee of SAE Committee TEVEES18A, Vehicle Cybersecurity Systems Engineering Committee. This committee is authorized under the scope and authority fo the SAE Electronic Design Automation Steering Committee (also known as the Electronic Systems Group) that is directly under the scope and authority fo the SAE Motor Vehicle Council. The SAE Motor Vehicle Council’s stated scope of influence and authority, as defined by the SAE includes, passenger car and light truck in conjunction with ISO/SAE 21434.
Vehicle Electrical System Security Committee
Data encryption is an essential part of keeping patient information private. It’s also remained relatively unchanged in recent decades — a rarity for anything in the cybersecurity space. The dawn of quantum computing will change that.
While weaponizing automated vehicles (AVs) seems unlikely, cybersecurity breaches may disrupt automated driving systems’ navigation, operation, and safety—especially with the proliferation of vehicle-to-everything (V2X) technologies. The design, maintenance, and management of digital infrastructure, including cloud computing, V2X, and communications, can make the difference in whether AVs can operate and gain consumer and regulator confidence more broadly. Effective cybersecurity standards, physical and digital security practices, and well-thought-out design can provide a layered approach to avoiding and mitigating cyber breaches for advanced driver assistance systems and AVs alike. Addressing cybersecurity may be key to unlocking benefits in safety, reduced emissions, operations, and navigation that rely on external communication with the vehicle. Automated Vehicles and Infrastructure Enablers: Cybersecurity focuses on considerations regarding cybersecurity and AVs from the
Coyner, KelleyBittner, Jason
Usage of cloud technology is essential for aftersales tester providers. It eases the rollout of new tester content - for example, diagnostic data of new vehicle types, updated repair manuals or ECU software for flash programming. Cloud technology also implements security services such as user authentication information. Figure 1 shows a typical setup as it is implemented for the service of vehicles such as trucks and buses. The vehicle is parked (vehicle speed = zero) in the service workshop, and its E/E system is connected to the vehicle communication interface (VCI) via CAN or Ethernet. On the tester (TST) side, the TST-to-VCI connection is either USB or WiFi.
This document provides an information report to the readers for the management of confidential data associated with hardware protected security environment (HPSE). The scope of the present document is common principles of confidential data, methodologies, conformance of SAE J3101 with regulations and standards, and use cases.
Vehicle Electrical System Security Committee
Supply chain management is key to industry efficiency, while information security and transparency are at the core of operations management. Blockchain technology shows great potential in this regard and can effectively make up for existing shortcomings. This article deeply explores the application of blockchain in new energy vehicle supply chain management, focusing on enhancing the systematization and collaboration of the supply chain through smart contract mechanisms. We established a collaborative contract model for the three-level supply chain. Especially from the perspective of the intermediate supply chain, we designed a smart contract mechanism to optimize key links such as order processing, payment, and logistics tracking, and used the alliance chain to ensure the safe sharing and sharing of information. At the same time, we have also developed an interactive system for each link of the supply chain and achieved smooth interaction in the new energy vehicle supply chain by
Wang, Peng
To gain an understanding of the software Application Programming Interface (API) landscape for SAE J3101 [SAEJ3101] devices, the SAE Vehicle Electrical Hardware Security Task Force conducted an analysis of various automotive-relevant crypto APIs. The purpose of this analysis was to identify how well the existing APIs cover the SAE J3101 requirements and to highlight the areas of coverage within these APIs. By examining these APIs, the Task Force aimed to gain insights into the current state of API support for SAE J3101 devices and identify any gaps in coverage that need to be addressed.
Vehicle Electrical System Security Committee
The global time that is propagated and synchronized in the vehicle E/E architecture is used in safety-critical, security-critical, and time-critical applications (e.g., driver assistance functions, intrusion detection system, vehicle diagnostics, external device authentication during vehicle diagnostics, vehicle-to-grid and so on). The cybersecurity attacks targeting the global time result in false time, accuracy degradation, and denial of service as stated in IETF RFC 7384 [2]. These failures reduce the vehicle availability, robustness, and safety of the road user. IEEE 1588 [3] lists four mechanisms (integrated security mechanism, external security mechanism, architectural solution, and monitoring & management) to secure the global time. AUTOSAR defines the architecture and detailed specifications for the integrated security mechanism “Secured Global Time Synchronization (SGTS)” to secure the global time on automotive networks (CAN, FlexRay, Ethernet). However, there are also
Kumaraswamy, PavithraRus, Andrei
The UN R155 regulation is the first automotive cybersecurity regulation and has made security a mandatory approval criterion for new vehicle types. This establishes internationally harmonized security requirements for market approval, presenting a challenge for manufacturers and suppliers to demonstrate compliance throughout the product life cycle. An issued type approval is internationally recognized by the member states of the UN 1958 Agreement. International recognition implies that uniform assessment criteria are applied to demonstrate compliance and to decide whether security efforts are sufficient. Independent accredited assessors assess the security engineering results during type approval. Considering the risk-based approach of ISO/SAE 21434 to security engineering, assessing whether threats have been appropriately addressed is a challenge. While there are currently no uniform assessment criteria at product level, the question arises as to which development artifacts serve as
Hellstern, MonaLanghanki, StefanGrün, FlorianKriesten, ReinerSax, Eric
In the increasingly connected and digital world, businesses are sprinting to integrate technological advancements into their corporate fabric. This is evident with the emerging concept of “digital twinning.” Digital twins are virtual representations of real-world objects or systems used to digitally model performance, identify inefficiencies, and design solutions. This helps improve the “real world” product, reduces costs, and increases efficiency. However, this replication of a physical entity in the digital space is not without its challenges. One of the challenges that will become increasingly prevalent is the processing, storing, and transmitting of Controlled Unclassified Information (CUI). If CUI is not protected properly, an idea to save time, money, and effort could result in the loss of critical data. The Department of Defense's (DoD) CUI Program website defines CUI as “government-created or owned unclassified information that allows for, or requires, safeguarding and
Smart devices can be hacked. That makes the electric grid vulnerable to bad actors who might try to turn off the power, damage the system, or worse. Recently, a team of experts at the Department of Energy’s Pacific Northwest National Laboratory put forth a new approach to protect the grid.
Advanced two-dimensional materials discovered in the last two decades are now being produced at scale and are contributing to a wide range of performance enhancements in engineering applications. The most well known of these novel materials is graphene, a nearly transparent nanomaterial comprising a single layer of bonded carbon atoms. In relative terms, it has the highest level of heat and electrical conductivity, protects against ultraviolet rays, and is the strongest material ever measured. These properties have made graphene an attractive potential material for a variety of applications, particularly for transportation-related uses, and especially for aerospace engineering. The goals of reducing greenhouse gas emissions and creating a world that achieves net-zero emissions have prioritized the electrification of transportation, the decarbonization of industry, and the development of products that require less energy to make, last longer, and are fully recyclable. These aspects have
Barkan, TerranceWalthall, RhondaDixit, SunilDavid, AharonWebb, PhilipFletcher, Sarah
On-road vehicles equipped with driving automation features are entering the mainstream public space. This category of vehicles is now extending to include those where a human might not be needed for operation on board. Several pilot programs are underway, and the first permits for commercial usage of vehicles without an onboard operator are being issued. However, questions like “How safe is safe enough?” and “What to do if the system fails?” persist. This is where remote operation comes in, which is an additional layer to the automated driving system where a human assists the so-called “driverless” vehicle in certain situations. Such remote-operation solutions introduce additional challenges and potential risks as the entire chain of “automated vehicle, communication network, and human operator” now needs to work together safely, effectively, and practically. And as much as there are technical questions regarding network latency, bandwidth, cybersecurity, etc., aspects like human
Beiker, SvenBock, ThomasTaiber, Joachim
On-road vehicles equipped with driving automation features are entering the mainstream public space. This category of vehicles is now extending to include those where a human might not be needed for operation on board. Several pilot programs are underway, and the first permits for commercial usage of vehicles without an onboard operator are being issued. However, questions like “How safe is safe enough?” and “What to do if the system fails?” persist. This is where remote operation comes in, which is an additional layer to the automated driving system where a human assists the so-called “driverless” vehicle in certain situations. Such remote-operation solutions introduce additional challenges and potential risks as the entire chain of “automated vehicle, communication network, and human operator” now needs to work together safely, effectively, and practically. And as much as there are technical questions regarding network latency, bandwidth, cybersecurity, etc., aspects like human
Beiker, SvenMuelaner, Jody E.Razdan, Rahul
This chapter delves into the field of multi-agent collaborative perception (MCP) for autonomous driving: an area that remains unresolved. Current single-agent perception systems suffer from limitations, such as occlusion and sparse sensor observation at a far distance. To address this, three unsettled topics have been identified that demand immediate attention. First, it is crucial to establish normative communication protocols to facilitate seamless information sharing among vehicles. Second, collaboration strategies need to be defined, including identifying the need for specific collaboration projects, determining the collaboration partners, defining the content of collaboration, and establishing the integration mechanism. Finally, collecting sufficient data for MCP model training is vital. This includes capturing diverse modal data and labeling various downstream tasks as accurately as possible.
Chen, GuangChalmers, SethZheng, Ling
The U.S. Air Force (USAF) deploys flying units with readiness spares packages (RSPs) to try to ensure that the units are stocked with enough parts to be self-sufficient for 30 days. This report is the third in a five-volume series addressing how AI could be employed to assist warfighters in four distinct areas: cybersecurity, predictive maintenance, wargames, and mission planning, with predictive maintenance in focus. Predicting which parts are likely to fail - and, therefore, which parts should be included in the RSPs - is important because overstocking can be expensive and understocking can threaten mission readiness. This report presents a discussion of whether and when artificial intelligence (AI) methods could be used to improve parts failure analysis, which currently uses a model that assumes a probability distribution. To do this, several machine learning (ML) models were developed and tested on historical data to compare their performance with the optimization and prediction
Following its annual report detailing the growing cybersecurity threats to vehicles, fleets, and the networks they rely on, Upstream Security announced the launch of a generative AI tool to enhance its ability to reduce the risk posted by global threats. Israel-based Upstream, which has a vehicle security operations center (VSOC) in Ann Arbor, Mich., monitors millions of connected vehicles and Internet of Things (IoT) devices and billions of API transactions monthly. Ocean AI is built into the company's detection and response platform, called M-XDR, enabling its analysts, as well as those from OEMs and IoT vendors, to efficiently detect threat patterns and automate investigations before prioritizing a response.
Clonts, Chris
Items per page:
1 – 50 of 528