Cybersecurity engineering: bridging the security gaps in advanced automotive systems and ISO/SAE 21434

Fahad Siddiqui; Rafiullah Khan; Sena Yengec Tasdemir; Henry Hui; Balmukund Sonigara; Sakir Sezer; Kieran McLaughlin

doi:10.1109/VTC2023-Spring57618.2023.10200490

Cybersecurity engineering: bridging the security gaps in advanced automotive systems and ISO/SAE 21434

Fahad Siddiqui, Rafiullah Khan, Sena Yengec Tasdemir, Henry Hui, Balmukund Sonigara, Sakir Sezer, Kieran McLaughlin

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

4 Citations (Scopus)

188 Downloads (Pure)

Abstract

Advanced Driver Assistance System} is one of the enabling technologies for autonomous driving. It senses and analyses the vehicle surroundings, detects the presence of potential risks as well as hazards and generates advisories. These advisories assist the autonomous driving system to take corrective measures to reduce safety risks and avoid fatal road accidents. For this purpose, ADAS uses various advanced sensing and data communication technologies to gather, process and share vehicle data. Nonetheless the use of these advanced connected technologies is expected to grow further in road infrastructure such as Vehicle-to-everything (V2X). In this regard, where this sharing of mix-critical data brings opportunities, if compromised, presents serious cybersecurity threats and safety risks due to the cyber-physical nature of these advanced automotive systems. Therefore, the automotive system design approach of adhering to functional safety standards (ISO 26262) alone is inadequate to protect the vehicle's critical functions from a range of cyber-attacks. To approach this challenge, the ISO/SAE 21434 standard provides a cybersecurity baseline for vehicle manufacturers to effectively manage cybersecurity risks and improve the cyber resilience of the automotive system. This paper adopts a holistic cybersecurity engineering process as a baseline and bridges the security gap by mapping the security engineering requirements of ISO/SAE 21434 to the traditional system design engineering processes including system generation and runtime phases. It also introduces an experimental automotive use case, defines the scope to establish the context, presents a comprehensive Threat Analysis and Risk Assessment and derives appropriate risk mitigation strategies. The proposed work facilitates automotive system designers to follow ISO/SAE 21434 standard guidelines by systematically identify, assess, protect and manage the cybersecurity risks across the automotive system life cycle.

Original language	English
Title of host publication	97th IEEE Vehicular Technology Conference (VTC2023-Spring)
Publisher	Institute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)	9798350311143
ISBN (Print)	9798350311150
DOIs	https://doi.org/10.1109/VTC2023-Spring57618.2023.10200490
Publication status	Published - 14 Aug 2023
Event	IEEE Vehicular Technology Conference - Firenzefiera Congress and Exhibition Center, Florence, Italy Duration: 20 Jun 2023 → 23 Jun 2023 Conference number: 97 https://events.vtsociety.org/vtc2023-spring/

Publication series

Name	IEEE Vehicular Technology Conference (VTC): Proceedings
ISSN (Print)	1090-3038
ISSN (Electronic)	2577-2465

Conference

Conference	IEEE Vehicular Technology Conference
Abbreviated title	VTC2023-Spring
Country/Territory	Italy
City	Florence
Period	20/06/2023 → 23/06/2023
Internet address	https://events.vtsociety.org/vtc2023-spring/

Keywords

Threat Analysis and Risk Assessment (TARA)
Secure-by-design
Cyber Resilience
Automotive
Threat Modeling
Safety-critical
Cybersecurity Engineering
ISO/SAE 21434

ASJC Scopus subject areas

Electrical and Electronic Engineering
Automotive Engineering
Safety, Risk, Reliability and Quality
General Computer Science
Control and Systems Engineering

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

Access to Document

10.1109/VTC2023-Spring57618.2023.10200490Licence: Unspecified

Cybersecurity engineering: bridging the security gaps in advanced automotive systems and ISO/SAE 21434
Copyright 2023 IEEE. This work is made available online in accordance with the publisher’s policies. Please refer to any applicable terms of use of the publisher.
Accepted author manuscript, 13.5 MBLicence: Unspecified

1 Active

R6656ECS: X-by-Construction Design framework for Engineering Autonomous & Distributed Real-time Embedded Software Systems’ — ‘XANDAR
Sezer, S. (PI), Garousi, V. (CoI) & McLaughlin, K. (CoI)
02/12/2020 → …
Project: Research

1 Membership of national or international committees and working groups
1 Invited or keynote talk at national or international conference
1 Oral presentation

Society of Automotive Engineers (SAE) (External organisation)
Siddiqui, F. (Advisor)
Oct 2023
Activity: Membership types › Membership of national or international committees and working groups
Cybersecurity Engineering of Safety-critical Embedded Systems
Siddiqui, F. (Advisor)
17 Jan 2023
Activity: Talk or presentation types › Invited or keynote talk at national or international conference
XANDAR: A holistic cybersecurity engineering process for safety-critical and cyber-physical systems
Siddiqui, F. (Advisor)
20 Jun 2022
Activity: Talk or presentation types › Oral presentation

4 Citations
9 Conference contribution

A comparative analysis of security patterns for enhanced security in safety-critical systems
Yengec-Tasdemir, S. B., Siddiqui, F., Sezer, S., Hui, H., McLaughlin, K. & Sonigara, B., 22 Sept 2023, Proceedings of the IEEE 36th International System-on-Chip Conference, SOCC 2023. Becker, J., Marshall, A., Harbaum, T., Ganguly, A., Siddiqui, F. & McLaughlin, K. (eds.). Institute of Electrical and Electronics Engineers Inc., 6 p. (IEEE International SOC Conference: Proceedings).
Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Open Access
File
82 Downloads (Pure)
A runtime security monitoring architecture for embedded hypervisors
Hui, H., McLaughlin, K., Siddiqui, F., Sezer, S., Yengec Tasdemir, S. & Sonigara, B., 22 Sept 2023, Proceedings of the IEEE 36th International System-on-Chip Conference, SOCC 2023. Becker, J., Marshall, A., Harbaum, T., Ganguly, A., Siddiqui, F. & McLaughlin, K. (eds.). Institute of Electrical and Electronics Engineers Inc., 6 p. (IEEE International SOC Conference: Proceedings).
Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Open Access
File
1 Citation (Scopus)

111 Downloads (Pure)
Cybersecurity engineering: bridging the security gaps in avionic architectures and DO-326A/ED-202A
Siddiqui, F., Ahlbrecht, A., Khan, R., Yengec Tasdemir, S., Hui, H., Sonigara, B., Sezer, S., McLaughlin, K., Zaeske, W. & Durak, U., 10 Nov 2023, 2023 AIAA/IEEE 42nd Digital Avionics Systems Conference (DASC): proceedings. Institute of Electrical and Electronics Engineers Inc., 9 p. (AIAA/IEEE Digital Avionics Systems Conference (DASC): Proceedings).
Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Open Access
File
1 Citation (Scopus)

107 Downloads (Pure)

Cite this

Siddiqui, F., Khan, R., Yengec Tasdemir, S., Hui, H., Sonigara, B., Sezer, S., & McLaughlin, K. (2023). Cybersecurity engineering: bridging the security gaps in advanced automotive systems and ISO/SAE 21434. In 97th IEEE Vehicular Technology Conference (VTC2023-Spring) ( IEEE Vehicular Technology Conference (VTC): Proceedings). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/VTC2023-Spring57618.2023.10200490

@inproceedings{562cbf5e0f944f9d9d872e71f773bba7,

title = "Cybersecurity engineering: bridging the security gaps in advanced automotive systems and ISO/SAE 21434",

abstract = "Advanced Driver Assistance System} is one of the enabling technologies for autonomous driving. It senses and analyses the vehicle surroundings, detects the presence of potential risks as well as hazards and generates advisories. These advisories assist the autonomous driving system to take corrective measures to reduce safety risks and avoid fatal road accidents. For this purpose, ADAS uses various advanced sensing and data communication technologies to gather, process and share vehicle data. Nonetheless the use of these advanced connected technologies is expected to grow further in road infrastructure such as Vehicle-to-everything (V2X). In this regard, where this sharing of mix-critical data brings opportunities, if compromised, presents serious cybersecurity threats and safety risks due to the cyber-physical nature of these advanced automotive systems. Therefore, the automotive system design approach of adhering to functional safety standards (ISO 26262) alone is inadequate to protect the vehicle's critical functions from a range of cyber-attacks. To approach this challenge, the ISO/SAE 21434 standard provides a cybersecurity baseline for vehicle manufacturers to effectively manage cybersecurity risks and improve the cyber resilience of the automotive system. This paper adopts a holistic cybersecurity engineering process as a baseline and bridges the security gap by mapping the security engineering requirements of ISO/SAE 21434 to the traditional system design engineering processes including system generation and runtime phases. It also introduces an experimental automotive use case, defines the scope to establish the context, presents a comprehensive Threat Analysis and Risk Assessment and derives appropriate risk mitigation strategies. The proposed work facilitates automotive system designers to follow ISO/SAE 21434 standard guidelines by systematically identify, assess, protect and manage the cybersecurity risks across the automotive system life cycle.",

keywords = "Threat Analysis and Risk Assessment (TARA), Secure-by-design, Cyber Resilience, Automotive, Threat Modeling, Safety-critical, Cybersecurity Engineering, ISO/SAE 21434",

author = "Fahad Siddiqui and Rafiullah Khan and {Yengec Tasdemir}, Sena and Henry Hui and Balmukund Sonigara and Sakir Sezer and Kieran McLaughlin",

year = "2023",

month = aug,

day = "14",

doi = "10.1109/VTC2023-Spring57618.2023.10200490",

language = "English",

isbn = "9798350311150",

series = " IEEE Vehicular Technology Conference (VTC): Proceedings",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

booktitle = "97th IEEE Vehicular Technology Conference (VTC2023-Spring)",

address = "United States",

note = "IEEE Vehicular Technology Conference, VTC2023-Spring ; Conference date: 20-06-2023 Through 23-06-2023",

url = "https://events.vtsociety.org/vtc2023-spring/",

}

Siddiqui, F, Khan, R, Yengec Tasdemir, S, Hui, H, Sonigara, B, Sezer, S & McLaughlin, K 2023, Cybersecurity engineering: bridging the security gaps in advanced automotive systems and ISO/SAE 21434. in 97th IEEE Vehicular Technology Conference (VTC2023-Spring). IEEE Vehicular Technology Conference (VTC): Proceedings, Institute of Electrical and Electronics Engineers Inc., IEEE Vehicular Technology Conference, Florence, Italy, 20/06/2023. https://doi.org/10.1109/VTC2023-Spring57618.2023.10200490

Cybersecurity engineering: bridging the security gaps in advanced automotive systems and ISO/SAE 21434. / Siddiqui, Fahad; Khan, Rafiullah; Yengec Tasdemir, Sena et al.
97th IEEE Vehicular Technology Conference (VTC2023-Spring). Institute of Electrical and Electronics Engineers Inc., 2023. ( IEEE Vehicular Technology Conference (VTC): Proceedings).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Cybersecurity engineering: bridging the security gaps in advanced automotive systems and ISO/SAE 21434

AU - Siddiqui, Fahad

AU - Khan, Rafiullah

AU - Yengec Tasdemir, Sena

AU - Hui, Henry

AU - Sonigara, Balmukund

AU - Sezer, Sakir

AU - McLaughlin, Kieran

N1 - Conference code: 97

PY - 2023/8/14

Y1 - 2023/8/14

N2 - Advanced Driver Assistance System} is one of the enabling technologies for autonomous driving. It senses and analyses the vehicle surroundings, detects the presence of potential risks as well as hazards and generates advisories. These advisories assist the autonomous driving system to take corrective measures to reduce safety risks and avoid fatal road accidents. For this purpose, ADAS uses various advanced sensing and data communication technologies to gather, process and share vehicle data. Nonetheless the use of these advanced connected technologies is expected to grow further in road infrastructure such as Vehicle-to-everything (V2X). In this regard, where this sharing of mix-critical data brings opportunities, if compromised, presents serious cybersecurity threats and safety risks due to the cyber-physical nature of these advanced automotive systems. Therefore, the automotive system design approach of adhering to functional safety standards (ISO 26262) alone is inadequate to protect the vehicle's critical functions from a range of cyber-attacks. To approach this challenge, the ISO/SAE 21434 standard provides a cybersecurity baseline for vehicle manufacturers to effectively manage cybersecurity risks and improve the cyber resilience of the automotive system. This paper adopts a holistic cybersecurity engineering process as a baseline and bridges the security gap by mapping the security engineering requirements of ISO/SAE 21434 to the traditional system design engineering processes including system generation and runtime phases. It also introduces an experimental automotive use case, defines the scope to establish the context, presents a comprehensive Threat Analysis and Risk Assessment and derives appropriate risk mitigation strategies. The proposed work facilitates automotive system designers to follow ISO/SAE 21434 standard guidelines by systematically identify, assess, protect and manage the cybersecurity risks across the automotive system life cycle.

AB - Advanced Driver Assistance System} is one of the enabling technologies for autonomous driving. It senses and analyses the vehicle surroundings, detects the presence of potential risks as well as hazards and generates advisories. These advisories assist the autonomous driving system to take corrective measures to reduce safety risks and avoid fatal road accidents. For this purpose, ADAS uses various advanced sensing and data communication technologies to gather, process and share vehicle data. Nonetheless the use of these advanced connected technologies is expected to grow further in road infrastructure such as Vehicle-to-everything (V2X). In this regard, where this sharing of mix-critical data brings opportunities, if compromised, presents serious cybersecurity threats and safety risks due to the cyber-physical nature of these advanced automotive systems. Therefore, the automotive system design approach of adhering to functional safety standards (ISO 26262) alone is inadequate to protect the vehicle's critical functions from a range of cyber-attacks. To approach this challenge, the ISO/SAE 21434 standard provides a cybersecurity baseline for vehicle manufacturers to effectively manage cybersecurity risks and improve the cyber resilience of the automotive system. This paper adopts a holistic cybersecurity engineering process as a baseline and bridges the security gap by mapping the security engineering requirements of ISO/SAE 21434 to the traditional system design engineering processes including system generation and runtime phases. It also introduces an experimental automotive use case, defines the scope to establish the context, presents a comprehensive Threat Analysis and Risk Assessment and derives appropriate risk mitigation strategies. The proposed work facilitates automotive system designers to follow ISO/SAE 21434 standard guidelines by systematically identify, assess, protect and manage the cybersecurity risks across the automotive system life cycle.

KW - Threat Analysis and Risk Assessment (TARA)

KW - Secure-by-design

KW - Cyber Resilience

KW - Automotive

KW - Threat Modeling

KW - Safety-critical

KW - Cybersecurity Engineering

KW - ISO/SAE 21434

U2 - 10.1109/VTC2023-Spring57618.2023.10200490

DO - 10.1109/VTC2023-Spring57618.2023.10200490

M3 - Conference contribution

SN - 9798350311150

T3 - IEEE Vehicular Technology Conference (VTC): Proceedings

BT - 97th IEEE Vehicular Technology Conference (VTC2023-Spring)

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - IEEE Vehicular Technology Conference

Y2 - 20 June 2023 through 23 June 2023

ER -

Siddiqui F, Khan R, Yengec Tasdemir S, Hui H, Sonigara B, Sezer S et al. Cybersecurity engineering: bridging the security gaps in advanced automotive systems and ISO/SAE 21434. In 97th IEEE Vehicular Technology Conference (VTC2023-Spring). Institute of Electrical and Electronics Engineers Inc. 2023. ( IEEE Vehicular Technology Conference (VTC): Proceedings). doi: 10.1109/VTC2023-Spring57618.2023.10200490

Cybersecurity engineering: bridging the security gaps in advanced automotive systems and ISO/SAE 21434

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

UN SDGs

Access to Document

Fingerprint

Projects

R6656ECS: X-by-Construction Design framework for Engineering Autonomous & Distributed Real-time Embedded Software Systems’ — ‘XANDAR

Activities

Society of Automotive Engineers (SAE) (External organisation)

Cybersecurity Engineering of Safety-critical Embedded Systems

XANDAR: A holistic cybersecurity engineering process for safety-critical and cyber-physical systems

Research output

A comparative analysis of security patterns for enhanced security in safety-critical systems

A runtime security monitoring architecture for embedded hypervisors

Cybersecurity engineering: bridging the security gaps in avionic architectures and DO-326A/ED-202A

Cite this