德勤-应对新的汽车创新：网络安全和诊断的协同作用 Addressing new automotive innovations Synergies of cybersecurity and diagnostics

Addressingnewautomotiveinnovations:Synergiesof

cybersecurityanddiagnostics

October2024

Addressingnewautomotiveinnovations:SynergiesofCybersecurityandDiagnostics|WhitePaper

Copyright©2024DeloitteGlobal.Allrightsreserved.ii

Abstract

Theautomotiveindustryisundergoingatransformativephasecharacterizedbyincreasingsoft-andhardwarecomplexityandfunctionality.Inadditiontothedesiredbenefits,

theexpansioninfunctionalityofElectronicControlUnits(ECUs)andHigh-PerformanceComputers(HPCs)presentschallenges,includingariseinthreatsandpotentialharmtoroaduserscausedbymaliciousactors.

Inresponse,OEMsandsuppliersmustrethink

conventionalprocessesanddevelopnewapproachestosecuritysolutions.Increasingcooperationbetweenthe

securityanddiagnosticdepartmentsofOEMsappears

asaviableapproach,expandingtheavailableinformationandprocesses,providedbydiagnosticsystems,toensureenhancedcybersecuritywhileprotectingdiagnosticdatawithdedicatedcybersecuritymechanisms.

Asaconcludingoutcomeofthisstudy,animplementationstrategyhasbeenformulatedforthecollaborative

approach.Thisstrategyspecificallyemphasizesthe

implementationofdiverseuse-casesandoutlinesthe

optimaltimelinefortheirexecution.Theuse-cases

werespecificallycenteredaroundon-boarddiagnostic

withinHPCsrelevanttoService-OrientedVehicle

Diagnostics(SOVD)andtheirseamlessintegrationintothecontemporaryCybersecurityManagementSystem(CSMS)environment.Theimplementationtimelinespansfrom

theimmediatefuturetoinstancesrequiringdedicateddevelopmentresources.Theformulationofthestrategywasguidedbyanassessmentofthedescribeduse-

cases,andwassystematicallyorganizedintocorrelationidentification,use-caseanalysis,andimpactevaluation.

Thecorrelationidentificationfocusedoninterfacesand

combinationsbetweensecuritymeasuresanddiagnosticprocessesintopotentialuse-cases.Theanalysisexaminedpotentialuse-casesonmeasurabledata,usingmetrics

fornetworksecurityapplications.Inthefinalevaluation,eachuse-casewassystematicallyratedforfeasibilityand

potentialimpactonthevehicle’scybersecurity.

Thisiterativeprocesshighlightedthesignificanceof

dedicateddepartmentinterfaces,underliningthe

benefitsfortheintegrationofcybersecurityandon-boarddiagnosticwithintheautomotivedomain.

Theevaluationrevealedaspectrumofuse-caseswhich

weretransformedintotheimplementationstrategy.

Theuse-casesweresortedfromthoseapplicableinthenearfuturetoothersrequiringdedicateddevelopment

resources.Short-termuse-casesrelyonexisting

information,suchasfreezeframesandDiagnosticTroubleCodes(DTCs).FreezeframesandDTCs’comparisoncan

serveaspotenttoolsforforensicpurposesanddetectionmeasures.Derivedfromthisinformation,therespectiveThreatAnalysisandRiskAssessment(TARA)aswellas

countermeasurescanbeadjusted.Long-termsolutions,requiringmoredevelopmenttime,couldleverage

informationfromtheon-boarddiagnosticsystemto

enhanceIntrusionDetectionSystems(IDS)functionalityorserveasadditionalverificationmeasures.

Insummary,theformulatedstrategyfunctionsas

anavigationalframeworktailoredforOEMs,offering

guidancethroughthechallengesarisingfromtheongoingtransformationphase.Itsuccinctlyoutlinescurrently

availableuse-casesandprovidingastrategicroadmapforthefuturevehicledevelopments,encompassingtheinclusionofpotentialuse-cases.

Addressingnewautomotiveinnovations:SynergiesofCybersecurityandDiagnostics|WhitePaper

Contents

Tableoftables

iii

Tableoffigures

iv

Listofabbreviations

v

1lntroduction0

1

2Assessment0

2

3Conclusion1

5

Authors16

LiteratureReview1

6

Copyright©2024DeloitteGlobal.Allrightsreserved.iii

Addressingnewautomotiveinnovations:SynergiesofCybersecurityandDiagnostics|WhitePaper

Copyright©2024DeloitteGlobal.Allrightsreserved.iv

Tableoftables

Table1:Identification-Shortdescriptionofapproaches

02

Table2:Analysis-Metricswithdescription

04

Table3:Analysisresult–DTCanalysis0

5

Table4:Analysisresult-cross-domaincomparison0

5

Table5:Analysisresult-applicationvulnerabilitymonitoring0

6

Table6:Analysisresult-updatewhite-list0

6

Table7:Analysisresult–locationverification

07

Table8:Analysisresult–AI-basedbehavioranalysis

07

Table9:Evaluation-Criteria

08

Table10:Metricevaluationresult-DTCanalysis

08

Table11:Categoryevaluationresult-DTCanalysis

09

Table12:Metricevaluationresult-cross-domaincomparison

09

Table13:Categoryevaluationresult-cross-domaincomparison

09

Table14:Metricevaluationresult-applicationvulnerabilitymonitoring

10

Table15:Categoryevaluationresult-applicationvulnerabilitymonitoring

10

Table16:Metricevaluationresult–updatewhite-lists

10

Table17:Categoryevaluationresult–updatewhite-lists

11

Table18:Metricevaluationresult–locationverification

11

Table19:Categoryevaluationresult–locationverification

11

Table20:Metricevaluationresult–AI-basedbehavioranalysis

12

Table21:Metricevaluationresult–AI-basedbehavioranalysis

12

Table22:Evaluation-ResultSummary

12

Addressingnewautomotiveinnovations:SynergiesofCybersecurityandDiagnostics|WhitePaper

Tableoffigures

Figure1:EvaluationResult-Visualization13

Listofabbreviations

AIArtificialIntelligence

ASAMAssociationforStandardizationof

AutomationandMeasuringSystemsCSMSCybersecurityManagementSystem

DTCDiagnosticTroubleCode

ECUElectronicControlUnit

GPSGlobalPositioningSystem

HPCHighPerformanceComputer

IDSlntrusionDetectionSystem

ISOInternationalOrganizationforStandardization

OEMOriginalEquipmentManufacturer

OTAOver-the-Air

SAESocietyofAutomotiveEngineers

SOVDService-OrientedVehicleDiagnostics

TARAThreatAnalysisandRiskAssessment

Copyright©2024DeloitteGlobal.Allrightsreserved.v

Addressingnewautomotiveinnovations:SynergiesofCybersecurityandDiagnostics|WhitePaper

1Introduction

Asaresultofcurrentmarketdevelopments,inwhichvehiclesareincreasinglynetworkedanddependentonsoftware-controlledfunctionalities,theassuranceofcybersecurity

withinvehiclesisbecomingincreasinglyimportant.

Theevolvingthreatlandscaperepresentssignificant

challenges.1Thisdevelopmentrequiresproactive

measurestostrengthenthediagnosticcapabilitiesof

vehiclesandtoprotectagainstpossiblemisuse.

Thecomplexityofbothsoftwareandhardwareisrapidlygrowingintheautomotiveindustry,whichisundergoingasignificanttransitionfromconventionalECUstoHPCs.ThischangehaspromptedthedevelopmentoftheASAMSOVDstandard,whichwaspublishedin2022.2

Itacknowledgesthat“therearedifferentaspectsthatarenotcoveredbytheSOVDstandard,astheyarespecifictotheimplementationofaSOVDserver”.2Moreover,thestandardprovidesexamplesoftheseuncoveredaspects.

•“Preventionandquickreactiontoattack(s)(…)

•Recognitionofsecurityincidents

•Maintainingtheoperationalsafety(…)

•Managementofsecurityincidents

•Loadbalancingofconcurrentrequests”2

FocusingoncybersecurityimplementationstosupporttheSOVDfunctionalities,theprimaryfunctions

of“preventionandquickreactiontoattacks”and

“recognitionofsecurityincidents”formthecornerstonefor“maintainingtheoperationalsafety(…)”and

“managementofsecurityincidents”.2

Thisstudyaimstoassesspotentialimplementationsforthesefunctionsbyconductingacomprehensiveanalysisandevaluationofvariousapproaches.

Thisassessmentbeginsbyoutliningtheidentification

phase,whichemphasizesre-usingexistingon-board

diagnosisfunctionsorcreatingnewapproachesto

enhancevehiclecybersecuritycapabilities.Furthermore,theanalysisphasedelvesintothemeasurabledataandinsightsgleanedfromcomparablescenariosinnetworksecurityapplications.Theevaluationphasesynthesizesthefindingsfromtheanalysis,highlightingthestrengthsandlimitationsofeachapproach.

Copyright©2024DeloitteGlobal.Allrightsreserved.1

Addressingnewautomotiveinnovations:SynergiesofCybersecurityandDiagnostics|WhitePaper

2Assessment

2.1Identification

Theidentificationcenteredaroundwaystoimplement

measuresdirectlywithinthevehicletofortifyitsdiagnosticcapabilitiesagainstpotentialmisuse.Toachievethisgoal,leveragingexistingon-boarddiagnosticfunctionsprovesessential.Thesefunctionsshouldbeusedtocreate

additionalvehiclecybersecuritycapabilitiesinHPCs,usingSOVD.Forthis,multipleapproacheswere

identified.ThesearelistedinTable1andexplainedinthefollowingchapters.

Measure

Shortexplanation

DTCanalysis

AnalyzesetDTCsinlegacyECUstoidentifypotentialtampering.

Cross-domaincomparison

Comparesensordataacrossdifferentdomainstoensuredatareliability.

Applicationvulnerabilitymonitoring

Enhancesoftwarediagnosticcapabilitiestodetectattacksexploitingpotentialvulnerabilities.

Updatewhite-lists

Implementfunctionstoauthenticateupdates,ensuringtheirauthenticity.

Locationverification

Usevehiclelocationtoverifythelegitimacyofdiagnosticrequests.

AI-basedbehavioranalysis

Utilizeadaptivelearningalgorithmstodetectattacksbyanalyzingcommunicationbehavior.

Table1:Identification-Shortdescriptionofapproaches

2.1.1DTCanalysis

InconventionalITsystems,loganalysisstandsasamethodforforensicinvestigations,aidinginthedetectionof

anomaliesorirregularitiesinserverbehavior.Thisinvolvesmonitoringvariousparameterslikeloginattempts,file

access,andsystemactivitiestoflagpotentialsecurity

breachesorunauthorizedaccess.Drawingfromthis

method,acomparableapproachcanbeappliedtovehiclesbyanalyzingDTCsandfreezeframes.3

Traditionalvehiclediagnosticandfaultfindingheavily

dependontheaccuracyofdiagnostictroublecodesandproperenforcementofrulesgoverningwhentotriggeraDTC.TheseDTCswillstillbeusedinECUs,thatare

connectedtotheHPCviatheclassicadapter.

AnalyzingsetDTCsandtheircorrespondingfreeze

framescanhelpidentifyingissuesrelatedtobus

communicationandECUavailability.Moreover,by

checkingboththepresenceandabsenceofexpectedDTCs,alongsideanyexistingDTCs,itbecomespossibletoidentifypotentialtamperingwithdataorsignals.

Thisapproachholdssignificantforensicvalue,particularlyinrecognizingsecurityincidents.

Copyright©2024DeloitteGlobal.Allrightsreserved.2

Addressingnewautomotiveinnovations:SynergiesofCybersecurityandDiagnostics|WhitePaper

Copyright©2024DeloitteGlobal.Allrightsreserved.3

2.1.2Cross-domaincomparison

InmodernITsystems,organizationsleverage

cross-domaindataaggregationtocompilesecurity-

relevantinformationfromdiversesourceslikenetwork

devices,servers,andapplications.Thisconsolidationofdatawithinacentralrepositoryempowerssecurityteamstodiscerncorrelationsandanomalies,therebyflagging

potentialsecuritythreatsorattacks.Similarly,

amethodologyforidentifyingcyberattackstargetingthevehicleand,ideally,preventingthemcanbedeveloped,cross-referencingsensordatafromdifferentdomains.4

VerifyingthevalidityofreceivedsensordataisastandardpracticeinmostECUs.Thisverificationcouldbeextendedbygatheringsecurity-criticalsensordatainacentralHPCandcross-referencingitwithrelateddatafromother

sensors,HPCsordomains.Incorporatingthisfunctionalitycouldenableearlydetectionofmanipulatedsensorsor

ECUs.Thisearlydetectionwouldenhancetheintrusiondetectioncapabilityofavehicleandcouldenhanceitsabilitytopreventandquicklyreacttoattacks.

2.1.3Applicationvulnerabilitymonitoring

Todetectandmitigatecyberthreatswithinapplications,runtimeapplicationself-protectionisuseasareal-time

defensemechanism.Itoffersmonitoringandsafeguardsforwebapplicationsandserver-sidesoftware,effectivelycounteringprevalentexploittechniques.Throughruntimeanalysisofapplicationbehavior,runtimeapplication

self-protectionidentifiesandcountersmaliciousactions,includingbufferoverflows,injectionattacks,andothercode-levelvulnerabilities.ThiscapabilityholdspromiseforintegrationintoHPCsforbothon-boarddiagnosticandcybersecuritypurposes.5

TheSOVDstandardrecognizesthatthefocusfor

vehiclediagnosticshifts"fromcheckinghardwareto

checkingthesoftwarefunctionalityofapplications,whichcorrespondstoaparadigmshift".2Asakeymotivation

behindtheSOVDstandard,theabilitytodiagnose

softwarealsopresentsanopportunitytoenhancevehiclecybersecurity.2Byimplementingmechanismscapable

ofdetectingcommonexploitsvehiclescanproactivelyidentifyattemptstobreachcybersecuritymeasures.

Thisproactiveapproachnotonlyaidsinpreventing

subsequentattacksbutalsoenablesswiftreactionsfromthevehicle,therebybolsteringitsoverallsecurityposture.

2.1.4Updatewhite-lists

Fileintegritymonitoringsolutionsareusedtomonitor

criticalsystemfilesanddirectoriesforunauthorized

changesormodifications.Bycomparingthehashvaluesoffilesagainstknowngoodvaluesstoredinawhitelist,FIMcandetectandalertadministratorstoanydiscrepancies,indicatingpotentialtamperingorcompromise.Leveragingthismethodcansignificantlybolstertheresilienceofthevehicle’ssoftwareupdateprocess.6

UpdatingthesoftwareofanECUorHPCisafundamentalfunctionoftheSOVDstandard.Tofacilitatethisprocess,two

httpmethods

,putandpost,aredesignatedfor

thisuse-case.Ensuringtheintegrityofthesesoftware

updatesisvitalforthesafetyandreliabilityofthevehicle.

Implementingwhite-listsbasedonthehashvalues

ofcurrentupdatescanserveasanadditionallayer

ofverificationandadditionallyenablemeasuresfor

detectingattemptstotamperwiththesoftware.Bystoringthecomparisonvaluesonanexternalserverwithadirectcommunicationchanneltothevehicle,theverification

processcanbestreamlinedwithouttheneedforadditionalauthenticationmethodsontheworkshopside.

Thisapproachenhancesthesecurityandefficiencyofsoftwareupdateswithintheautomotiveecosystem.

2.1.5Locationverification

Comparabletogeofencing,location-basedaccess

controlsempowerorganizationstomanageaccessto

networkresourcesbasedonthegeographicallocation

ofIPaddresses.Byimplementingpreciseaccesspolicies,organizationscanlimitcertainactionstoapproved

locationsexclusively.Thisguaranteesthatactivities

originatefromsecureandtrustedenvironments,therebyreducingthelikelihoodoftamperingorunauthorized

access.Leveragingthisapproachforthevehiclesoftwareupdateprocessinvolvesutilizingthevehicle’slocationasavalidationcheckpoint.7

SincetheimplementationandregulationoftheeCall

emergencysystem,theinstallationofGPSandGalileo

interfaceshasbecomemandatoryinnewlymanufacturedvehicles.Theselocationdatacanserveasanadditionallayerofsecurityforthesoftwareupdateprocess.

Leveragingthevehicle’slocationasaprobabilityindicatorcanhelpdeterminewhethertheupdateprocessis

initiatedinasafeorvalidatedenvironment.However,itisessentialtoimplementmeasuresthatensurethe

Addressingnewautomotiveinnovations:SynergiesofCybersecurityandDiagnostics|WhitePaper

reliabilityoftheGPSlocationforthisstrategytobe

effective.Bydelayingorrejectingupdatesbasedon

thelocationdata,vehiclescanenhancetheirresilienceagainstsoftwaretamperinganddetectattempted

attacks.Thisapproachstrengthensthesecuritypostureofvehiclesandenhancestheiroverallprotectionagainstcyberthreats.

2.1.6AI-basedbehavioranalysis

AsanadvancedprotectionmeasureforITsystemsuserandentitybehavioranalyticssolutionsemploymachinelearningalgorithmstoanalyzepatternsofuserandentitybehavioracrossnetworkandserverenvironments.

Bycross-referencingdatafromdifferentsourcessuch

aslogins,fileaccess,networktraffic,andsystem

interactions,userandentitybehavioranalyticstoolscandetectanomaliesinbehaviorthatmaysignalpotential

securityrisks.Thisproactiveapproachaidsorganizationsinreal-timedetectionofinsiderthreats,credentialmisuse,andothersuspiciousactivities,therebybolsteringtheir

overallcybersecuritystance.Lookingahead,leveraginguserandentitybehavioranalyticstechniquescouldofferaneffectivestrategyforidentifyingandpreventing

cyber-attacksonvehicles.8

Withthecontinualadvancementofartificialintelligence(AI)capabilities,itsintegrationintoon-boarddiagnosticandcybersecurityholdssignificantpromise.

Byleveragingaitoanalyzedriverandvehiclebehaviorovertime,anomaliescanbeidentified,providedthereisasubstantialamountofdataavailable.Thiscapabilitycouldserveasadetectionsystemformisuseofvehiclefunctionsbydetectingsuddenorabnormalchanges.Suchalertscouldthenbeutilizedtowarnthedriver

andconnectedsystemsaccordingly.

2.2Analysis

Theanalysisfocusesonmeasurabledata,leveraging

insightsfromcomparablescenariosinnetworksecurityapplications.Itscrutinizedsixkeymetrics,which

willundergofurtherevaluationinthesubsequent

assessmentphase.Thesemetricsincludethelevelof

preparedness,thetimetodetectandverificationaswellasthesupportincontainingandresolvingtheincident.TheyarelistedandelaboratedfurtherinTable2for

comprehensiveunderstanding.

MetricDescription

LevelofpreparednessTheextenttowhichtheidentifiedapproachenhancesreadiness

againstcyberattacks.

Timetodetect

Thedurationrequiredfortheapproachtodetectapotentialsecurityincident.

Timetoverification

Thetimetakentoverifyadetectedpotentialsecurityincident.

Measuresupportscontainment

Thedurationneededtocounterorcontainanongoingattack.

Measuresupportsmitigation

Thetimerequiredtofullyresolveandmitigatethesecurityincident.

Table2:Analysis-Metricswithdescription

Copyright©2024DeloitteGlobal.Allrightsreserved.4

Addressingnewautomotiveinnovations:SynergiesofCybersecurityandDiagnostics|WhitePaper

Copyright©2024DeloitteGlobal.Allrightsreserved.5

2.2.1DTCanalysis

TheDTCanalysismethoddoesnotenhancepreparednessagainstcyberattacksasitsprimaryfunctionistoidentifysecurityincidents.ThetimetakentodetectsuchincidentsreliesonwhenDTCsarerequested,whetherduringa

workshopvisitorover-the-air,dependingonthediagnosticfunctionsimplemented.Confirmingasecurityincident

requiresfurtherinformationandtesting,leadingto

anincreaseinthetimetoverification.Givenitssole

functionofrecognition,DTCanalysisdoesnotcontributetocontainingorresolvingincidents.Theresultofthe

analysisissummarizedinTable3.

Metric

Description

Levelofpreparedness

Noimpact

Timetodetect

DependingonthetimetheDTCsarerequested

Timetoverification

Furtherinformationandtestsneeded

Measuresupportscontainment

Noimpact

Measuresupportsmitigation

Noimpact

Table3:Analysisresult–DTCanalysis

2.2.2Cross-domaincomparison

Byconsolidatingsensordatafromvariousdomains,cross-domaincomparisonenhancesthedetectionofcorrelationsandanomalies,therebybolsteringpreparednessagainst

cyberattacks.Operatingasafunctionorapplication

withintheHPC,thisapproachenablesinstantdetectionofanomaliesastheyarise.However,acknowledgingdetectedanomaliesasactualincidentsnecessitatesfurther

investigationandtesting.However,thepromptavailability

ofinformationenablesquickcontainmentmeasures,suchasdeactivatingspecificfunctionsoralertingthedriver,

dependingonthetargetedfunction.Basedontheattack’snature,mitigationmaybepossiblebutnecessitates

additionalinformationtopreventmeasuresthatcouldexacerbateratherthanalleviatethesituationforthevehicle.TheseresultsaresummarizedinTable4.

Metric

Description

Levelofpreparedness

Earlydetectionofcorrelationsandanomalies

Timetodetect

Instant

Timetoverification

Furtherinformationandtestsneeded

Measuresupportscontainment

Swiftcontainmentmeasuresforspecificfunctions

Measuresupportsmitigation

Furtherinformationneeded

Table4:Analysisresult-cross-domaincomparison

Addressingnewautomotiveinnovations:SynergiesofCybersecurityandDiagnostics|WhitePaper

2.2.3Applicationvulnerabilitymonitoring

Byintegratingmechanismscapableofidentifying

commonexploits,thelevelofpreparednessagainst

cyberattacksisheightened.Theefficacyofpromptly

detectingandaddressingattacksisheavilyinfluencedbytheavailabilityofinformationonknownattackpatterns.Thisavailabilitysignificantlyaffectsvariousmetrics,

particularlythetimetodetect,verify,contain,and

mitigateincidents.AsafunctionorapplicationwithintheHPC,thismethodfacilitatesimmediatedetectionand

acknowledgmentofattacks.Moreover,itempowersthesystemtoswiftlycontainandideallymitigatetheincidentuponitsoccurrence.Table5summarizestheseresults.

Metric

Description

Levelofpreparedness

Dependingontheavailableinformationonknownattackpatterns

Timetodetect

Instant(ifattackpatternisknown)

Timetoverification

Instant(ifattackpatternisknown)

Measuresupportscontainment

Swiftcontainment(ifattackpatternisknown)

Measuresupportsmitigation

Swiftmitigation(ifattackpatternisknown)

Table5:Analysisresult-applicationvulnerabilitymonitoring2.2.4Updatewhite-lists

Securingtheupdateprocessenhancesthelevelof

preparednessagainstcyberattacksaimingtoalterthesoftwareofECUsorHPCs.Asameasuretoensuretheintegrityandvalidityofthesoftware,thisapproach

enablesinstantdetectionandacknowledgmentofany

attemptedtampering.Ifthevalidityoftheupdateisnotconfirmed,thefunctiontoalterthesoftwareisblocked,therebycontaining,andresolvingpotentialattacks.ThisresultissummarizedinTable6.

Metric

Description

Levelofpreparedness

EnhancedagainstattackstargetingECUandHPCsoftware

Timetodetect

Instant

Timetoverification

Instant

Measuresupportscontainment

Instantcontain