Integration of Attribute-based Access Control into Automotive Architectures

Rumez, Marcel; Duda, Alexander; Grunder, Patrick; Kriesten, Reiner; Sax, Eric

doi:10.1109/ivs.2019.8814265

Cited by 18 publications

(11 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A few papers that at least exhaustively define the space of contextual information used in their work can be roughly classified into key-value approaches (K/-), without following stringent notations. Two publications stand out, which use a markup-based approach [101] and an objectoriented model [120], [121].…”

Section: Comparison Findings Based On the Methodological Taxonomymentioning

confidence: 99%

“…Only five of the papers make data, ontologies, or implementation freely available online. Particularly positive here are the works [101], which provide both code and simulation environment, and [145], which offer a publicly accessible database including query interface.…”

Section: Comparison Findings Based On the Methodological Taxonomymentioning

confidence: 99%

“…Rumez et al [101] outline a distributed attribute-based access control (ABAC) mechanism for automotive architectures. The presented approach allows access control of ECU requests both within a domain and between different domains.…”

Section: ) ''Integration Of Attribute-based Access Control Into Automotive Architectures'' [101]mentioning

confidence: 99%

See 2 more Smart Citations

Context-Aware Security for Vehicles and Fleets: A Survey

2021

Self Cite

View full text Add to dashboard Cite

Vehicles are becoming increasingly intelligent and connected. Interfaces for communication with the vehicle, such as WiFi and 5G, enable seamless integration into the user's life, but also cyber attacks on the vehicle. Therefore, research is working on in-vehicle countermeasures such as authentication, access controls, or intrusion detection. Recently, legal regulations have also become effective that require automobile manufacturers to set up a monitoring system for fleet-wide security analysis. The growing amount of software, networking, and the automation of driving create new challenges for security. Context-awareness, situational understanding, adaptive security, and threat intelligence are necessary to cope with these everincreasing risks. In-vehicle security should be adaptive to secure the car in an infinite number of (driving) situations. For fleet-wide analysis and alert triage, knowledge and understanding of the circumstances are required. Context-awareness, nonetheless, has been sparsely considered in the field of vehicle security. This work aims to be a precursor to context-aware, adaptive and intelligent security for vehicles and fleets. To this end, we provide a comprehensive literature review that analyzes the vehicular as well as related domains. Our survey is mainly characterized by the detailed analysis of the context information that is relevant for vehicle security in the future.

show abstract

Section: Comparison Findings Based On the Methodological Taxonomymentioning

confidence: 99%

Section: Comparison Findings Based On the Methodological Taxonomymentioning

confidence: 99%

See 1 more Smart Citation

Context-Aware Security for Vehicles and Fleets: A Survey

2021

Self Cite

View full text Add to dashboard Cite

show abstract

“…3) Security mechanisms in IVNs: Firewalls and access control mechanisms can prevent attacks with stateful inspection, rate limiting, and filtering [36]. Gateways can filter messages between different sections of the IVN [37] and analyze event chains based on behavior specifications [38].…”

Section: In-vehicle Network Securitymentioning

confidence: 99%

Secure Time-Sensitive Software-Defined Networking in Vehicles

Häckel,

Meyer,

Korf

et al. 2022

Preprint

View full text Add to dashboard Cite

Current designs of future In-Vehicle Networks (IVN) prepare for switched Ethernet backbones, which can host advanced LAN technologies such as IEEE Time-Sensitive Networking (TSN) and Software-Defined Networking (SDN). In this work, we present an integrated Time-Sensitive Software-Defined Networking (TSSDN) architecture that simultaneously enables control of synchronous and asynchronous real-time and besteffort traffic for all IVN traffic classes using a central SDN controller. We validate that the control overhead of SDN can be added without a delay penalty for TSN traffic, provided protocols are properly mapped. Based on our TSSDN concept, we demonstrate adaptable and reliable network security mechanisms for in-vehicle communication. We systematically investigate different strategies for integrating in-vehicle control flows with switched Ether-networks and analyze their security implications for a software-defined IVN. We discuss embeddings of control flow identifiers on different layers, covering a range from a fully exposed mapping to deep encapsulations. We experimentally evaluate these strategies in a production vehicle which we map to a modern Ethernet topology. Our findings indicate that visibility of automotive control flows on lower network layers is essential for providing isolation and access control throughout the network infrastructure. Such a TSSDN backbone can establish and survey trust zones within the IVN and reduce the attack surface of connected cars in various attack scenarios.

show abstract

“…None of these approaches exposes context information about the control flows in networking protocols that are used for the forwarding decision in the network. Instead, Rumez et al [7] integrate access control in automotive gateways that shall filter unwanted messages based on policies and attributes.…”

Section: Background and Related Workmentioning

confidence: 99%

Strategies for Integrating Controls Flows in Software-Defined In-Vehicle Networks and Their Impact on Network Security

Häckel,

Schmidt,

Meyer

et al. 2020

Preprint

View full text Add to dashboard Cite

Current In-Vehicle Networks (IVNs) connect Electronic Control Units (ECUs) via domain busses. A gateway forwards messages between these domains. Automotive Ethernet emerges as a flat, high-speed backbone technology for IVNs that carries the various control flows within Ethernet frames. Recently, Software-Defined Networking (SDN) has been identified as a useful building block of the vehicular domain, as it allows the differentiation of packets based on all header fields and thus can isolate unrelated control flows.In this work, we systematically explore the different strategies for integrating automotive control flows in switched Ethernetworks and analyze their security impact for a softwaredefined IVN. We discuss how control flow identifiers can be embedded on different layers resulting in a range of solutions from fully exposed embedding to deep encapsulation. We evaluate these strategies in a realistic IVN based on the communication matrix of a production grade vehicle, which we map into a modern Ethernet topology. We find that visibility of automotive control flows within packet headers is essential for the network infrastructure to enable isolation and access control. With an exposed embedding, the SDN backbone can establish and survey trust zones within the IVN and largely reduce the attack surface of connected cars. An exposed embedding strategy also minimizes communication expenses.

show abstract

Integration of Attribute-based Access Control into Automotive Architectures

Cited by 18 publications

References 11 publications

Context-Aware Security for Vehicles and Fleets: A Survey

Context-Aware Security for Vehicles and Fleets: A Survey

Secure Time-Sensitive Software-Defined Networking in Vehicles

Strategies for Integrating Controls Flows in Software-Defined In-Vehicle Networks and Their Impact on Network Security

Contact Info

Product

Resources

About