HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

The industry of shared self-driving is increasingly interested in the Message Queuing Telemetry Transport (MQTT) solution to develop and evaluate their autonomous and shared mobility services. This solution would have the advantage of making data exchange easier between autonomous vehicles themselves and between vehicles and infrastructure. Nevertheless, there are a number of security threats due to the design and the use of the MQTT protocol. Some of these threats are denial of service (DoS), spoofing, information disclosure and data corruption. These security issues can be caused by external attackers as well as internal entities that are successfully authenticated. This paper analyzes the impact of these attacks on the performance of MQTT protocol with TLS in terms of CPU/RAM usage and latency. For that, we provide in this paper an in-depth overview of cybersecurity attacks that can disrupt the MQTT protocol and we also present an evaluation platform using Security Information and Event Management (SIEM) architecture that automatically collects and aggregates system events from the server to assess the impact of the cyber attacks. The results indicate that these attacks have highly negative influence on the performance of broker. These results will contribute in the future to implement new countermeasures to improve cybersecurity of MQTT protocol.

No abstract

No abstract

Risk analyses of complex Cyber-Physical Systems represent a persistent challenge both in Functional Safety and in Cybersecurity. Those two domains traditionally conduct their risk analyses independently. However, that independence is now questioned. The emergence of Cybersecurity risks with Safety impacts, such as killwares, acts as a serious incentive to evolve conventional methods and risk cultures. The objective of this article is to define the potential links between Functional Safety and Cybersecurity risk analyses. To that end, we made our Safety and Cybersecurity teams work on two use cases and exchange their opinions on their respective methods: HARA in Safety and EBIOS RM in Cybersecurity. In the first use case, the Cybersecurity team studies with the EBIOS RM a safety-related function : the Safe Remote Control (SRC). In the second use case, the Safety team presents a SIL assessment for SRC to the Cybersecurity team which identifies parameters to influence. Through those activities, both teams identify several points of divergence and challenges to deal with in order to enrich Cybersecurity/Safety approaches.