No abstract

Automotive Ethernet is increasingly used in modern vehicles and complements or replaces legacy bus systems such as CAN. Ethernet also enables service-oriented communication with the Scalable service-Oriented MiddlewarE over IP (SOME/IP) middleware. In this paper, we present a formal and practical security analysis of SOME/IP, the identified Man-in-the-Middle (MITM) attacks, and propose two security extensions. The attacks are possible even if SOME/IP is used in combination with link layer security mechanisms. The attacker can impersonate a service offering server and a service consuming client. The two most common communication methods, request/response and publish/subscribe, are both vulnerable. In most communication scenarios, we are able to route all messages over the attacker. Our security extensions for authentication and authorization of service provisioning and usage protect against these attacks. We formally analyze the security and evaluate the overhead with practical implementations. CCS CONCEPTS• Security and privacy → Security protocols; Embedded systems security; • Applied computing → Transportation.

The Electric Vehicle (EV) charging architecture consists of several actors which communicate with different protocols. A serious issue is the lack of adequate privacy-preserving measures that enables the generation of movement profiles or inferring consumer habits by all of the involved actors. In this paper, we propose an extension of a Trusted Platform Module (TPM)-based Direct Anonymous Attestation (DAA) scheme to enable privacy-preserving charging authorization and billing. Our implementation shows that our solution can be easily integrated into existing protocols of the Plug-and-Charge (PnC) EV charging architecture and introduces only minor overhead. The formal analysis using the Tamarin prover shows the security and privacy of our protocol extension.

No abstract

No abstract