New requirements from the customers’ and manufacturers’ point of view such as adding new software functions during the product life cycle require a transformed architecture design for future vehicles. The paradigm of signal-oriented communication established for many years will increasingly be replaced by service-oriented approaches in order to increase the update and upgrade capability. In this article, we provide an overview of current protocols and communication patterns for automotive architectures based on the service-oriented architecture (SOA) paradigm and compare them with signal-oriented approaches. Resulting challenges and opportunities of SOAs with respect to information security are outlined and discussed. For this purpose, we explain different security countermeasures and present a state of the section of automotive approaches in the fields of firewalls, Intrusion Detection Systems (IDSs) and Identity and Access Management (IAM). Our final discussion is based on an exemplary hybrid architecture (signal- and service-oriented) and examines the adaptation of existing security measures as well as their specific security features.

In this work, we present an approach to support penetration tests by combining safety and security analyses to enhance automotive security testing. Our approach includes a new way to combine safety and threat analyses to derive possible test cases. We reuse outcomes of a performed safety analysis as the input for a threat analysis. We show systematically how to derive test cases, and we present the applicability of our approach by deriving and performing test cases for a penetration test of an automotive electronic control unit (ECU). Therefore, we selected an airbag control unit due to its safety-critical functionality. During the penetration test, the selected control unit was installed on a test bench, and we were able to successfully exploit a discovered vulnerability, causing the detonation of airbags.

“The car is the ultimate mobile device” [1] and with its connectivity and a large number [2] of sensors and actuators an example for a cyber-physical system. The advantages of a service-oriented architecture (SOA) are shown in comparison to the classic signal-oriented design. A hybrid architecture which contains both static signal- and dynamic service-oriented elements is introduced. With an example we show how the benefits of a SOA can be achieved, even without migrating the whole vehicle away from the current static communication schemes. The “SuperTuxKart” application integrated into the Mercedes CLA as presented by Daimler on the Mobile World Congress 2019 [3] is an additional customer value application and used as our showcase. Its development and implementation can be greatly simplified if the target vehicle has an electric/electronic architecture, which is service-oriented. We introduce a new process to develop an application within a service-oriented vehicle and use software over the air (SOTA) updates to deploy it. The process is illustrated using a fictive, service-based application.

The transformation in the automotive industry continues and topics such as intelligent software applications and over-the-air connectivity push future vehicle innovations, which will lead to a further increase in the number of connected vehicles in the upcoming years. Many wireless connections between vehicles to the infrastructure or mobile devices arise. In order to protect this communication against security attacks, various protection mechanisms have to be integrated into the vehicle to ensure information security. One of these measures is the implementation of a distributed access control to protect different communication channels against unauthorized access attempts. This requires a well-defined assignment of access permissions for each communication node combined with certain environmental conditions such as location, time or vehicle state. However, current automotive systems do not have extensive access controls. Only for the execution of safety-critical diagnostic services an extended authorization level is available. In this publication, we present an attribute-based access control, which is specifically designed for an automotive E/E architecture with several domain controllers. Furthermore, we evaluate our approach with a proof-of-concept for an exemplary diagnostic service request.

In this work we present an approach to derive test cases for security testing by reusing threat modeling artefacts. We suggest to perform a threat modeling in an early stage of the product life cycle and show how these threat models, originally created for the security design phase, can be reused for security testing. We further show the practical applicability of our approach by describing the creation, execution and evaluation of a penetration test for an Electronic Control Unit (ECU). For the evaluation of our approach we selected a Pyrotechnic Control Unit (PCU) due to its safety critical functionality, which is commonly referred to as an Airbag-ECU. This scenario leads to a safety impact as a PCU is connected to pyrotechnic charges, e.g., airbags, that can lead to serious injury or death, if deployed in a non-appropriate scenario. During this penetration test, the selected PCU was installed on a test bench. We were able to successfully exploit a found vulnerability, causing the deployment of charges.

The presence of security vulnerabilities in automotive networks has already been shown by various publications in recent years. Due to the specification of the Controller Area Network (CAN) as a broadcast medium without security mechanisms, attackers are able to read transmitted messages without being noticed and to inject malicious messages. In order to detect potential attackers within a network or software system as early as possible, Intrusion Detection Systems (IDSs) are prevalent. Many approaches for vehicles are based on techniques which are able to detect deviations from specified CAN network behaviour regarding protocol or payload properties. However, it is challenging to detect attackers who secretly connect to CAN networks and do not actively participate in bus traffic. In this paper, we present an approach that is capable of successfully detecting unknown CAN devices and determining the distance (cable length) between the attacker device and our sensing unit based on Time Domain Reflectometry (TDR) technique. We evaluated our approach on a real vehicle network.