Formal models for automotive systems and vehicular networks: Benefits and challenges

Abstract

Formal models have seen widespread use in the development of safety-and security-critical systemsprimarily as a means of providing increased assurance. In particular, formal models of threats have the potential to give rise to numerous benefits: they can help in the understanding of vulnerabilities (and the communication of such); they also provide a means by which these vulnerabilities can be reasoned about. We give consideration to how formal models of threats might be beneficial in the development of modern automotive systems and vehicular networks, which are increasingly interconnected. To achieve this we present a formal threat model of an idealised system. We use Predicate/Transition (PrT) Nets, a graphical mathematical formalism, to represent threats and plausible attacks. In addition to understanding and analysis, the approach also has the potential to provide benefits to the design and testing of vehicles' distributed IT systems -thus contributing to an improved sense of security, privacy and safety. To this end, we give consideration to the challenges that lie ahead in terms of adopting such an approach.

Evaluating the Functioning Quality of Data Transmission Networks in the Context of Cyberattacks

“…It should be noted that, when we simulate the delivery process, the Hurst index value, close to H ≈ 0.5, is the limiting value for the Pareto flow, because if H ≥ 0.5, dispersion for this distribution is not determined [21] (Figure 9), therefore the simulated results of the delivery process obtained at these H values will be wrong. Analysis of the received results shows that they correspond completely with the data of works published previously by other authors [13,16,17,[19][20][21][22]33] devoted to the development of quality evaluation methods of the functioning of telecommunication networks when self-similar and stationary Poisson traffic is transmitted. This confirms the adequacy of the developed model and the consistency of the received results.…”

“…In the case of the availability and implementation of an information impact by an attacker on network elements, the probability of the successful delivery of data packets in a given time significantly worsens (Figure 10). Analysis of the received results shows that they correspond completely with the data of works published previously by other authors [13,16,17,[19][20][21][22]33] devoted to the development of quality evaluation methods of the functioning of telecommunication networks when self-similar and stationary Poisson traffic is transmitted. This confirms the adequacy of the developed model and the consistency of the received results.…”

“…In [10,[13][14][15][16][17], an approach is proposed for the calculation of the packet loss probability, based on the usage of fundamental expressions, obtained for queuing systems M/M/1, taking into account the flow categorization and the claim operation discipline with the introduction of equalizing coefficients, considering the traffic variability [13], the Hurst index [10,14] and related parameters [15][16][17]. These works surely make a noticeable contribution to the development of the methods of teletraffic theory, but they do not take into account the impact of cyberattacks on packets losses.…”

Building an automotive security assurance case using systematic security evaluations

“…Security engineering (and security testing as part of that process) is still relatively novel in mainstream automotive production [3,4], and typically security is incidental and a by-product of achieving performance and safety goals [5,6,7,8]. Even with advanced formal methods for modelling and testing, the need for and number of demands, features and increased connecting power means that, even had security been considered, the scale of the problem facing security testers is now much broader [9].…”

A Formal Model to Facilitate Security Testing in Modern Automotive Systems

“…While we recognise penetration testing's role, we believe that there is the potential for other security testing approaches to play a complementary role, with one candidate being the testing of a system's security from models -in short, model-based security testing. Thus, the focus of this paper, which builds upon the initial work described in [3], is on answering how might a model-based testing (MBT) framework support the automatic security testing of a modern car's subsystems? This work falls into the category of formal and model-driven approaches to engineering safety-critical and security-critical systems.…”