Security risk analysis approach for on-board vehicle networks

Transcription

1 1 Security risk analysis approach for on-board vehicle networks Alastair Ruddle Consultant, MIRA Limited

2 Motivation 2 o o Future vehicles will become mobile nodes in a dynamic transport network vehicle systems will be under threat from malicious individuals and groups seeking to gain personal or organizational advantage ensuring security will be critical for the successful deployment of V2X technology EU project EVITA aims to prototype a toolkit of techniques and components to ensure the security of in-vehicle systems hardware, software, analysis methods

3 EVITA scope and assets 3 EVITA only aims to investigate network security solutions at vehicle level Different levels of security protection are envisaged, depending on need Some assets may not require security measures (low risk) Risk analysis aims to prioritize security requirements

4 EVITA project security risk analysis rationale 4 o Too costly to protect against every threat, so need to rank risks in order to prioritize countermeasures o Risk associated with a security attack depends on: severity of impact (ie. harm to stakeholders) drivers, other road users, civil authorities, ITS operators, vehicle manufacturers and system suppliers probability of successful attack depends on attacker resources, nature of attack o Physical safety is a key aspect of security physical harm may be an objective of an attack harm may also be an unintended consequence

5 Safety and security 5 o Physical safety is a key aspect of security physical harm may be an objective of an attack harm may also be an unintended consequence o Automotive ot functional safety standards ds are based on qualitative measures of relative risk, severity and probability natural basis for automotive security risk analysis o For safety-related security risks, probability needs to include controllability of hazardous situations opportunity for drivers to influence outcome for safety- related security hazards

6 Starting point EVITA Use Cases 6 A suite of 18 potential use cases was defined, based on EASIS project network architecture In vehicle network structure Powertrain PTC Engine Control Hybrid Drive Transmission PT Sensors Chassis & Safety CSC Diagnosis Interface Body Electronic BEM Communication Unit CU Brake Control Instrument Audio Chassis / Steering Environmental Sensors Passive Safety Airbag Chassis Sensors e.g. Steer Angle Door Modules Light Control Climate Seat ECU Head Unit HU Display / Video Navigation Telephone GPS/Galileo UMTS DSRC USB Bluetooth Mobile Device Scenario classes: car-car car-infrastructure mobile devices aftermarket maintenance Assumed reference architecture

7 Security threat agents and their motivations 7 o Dishonest drivers avoid financial obligations, gain traffic advantages; o Hackers gain/enhance reputation as a hacker; o Criminals and terrorists financial gain, harm or injury to individuals or groups; o Dishonest organisations driver profiling, industrial espionage, sabotage of competitor products; o Rogue states achieve economic harm to other societies

8 Generic security threats and objectives 8 Generic security threats Aims Target Approach Motivation Security objectives Harming individuals Driver or passenger Interference with safety functions of a specific vehicle Criminal or terrorist activity Safety Privacy City or state economy, Interfere with safety functions of Harming Criminal or Safety through vehicles many vehicles or traffic groups terrorist activity and/or transport management functions Operational Gaining personal advantage Gaining organizational advantage system Driver or passenger Vehicle Transport system, vehicle networks, tolling systems Driver or passenger Vehicle Theft of vehicle information or driver identity, vehicle theft, fraudulent commercial transactions Interference with operation of vehicle functions Criminal or terrorist activity Privacy Financial Interference with operation of Build hacker Operational reputation Privacy Interference with operation of traffic management functions or tolling systems Avoiding liability for accidents, vehicle or driver tracking Interference with operation of vehicle functions, acquiring vehicle design information Enhanced traffic privileges, toll avoidance Fraud, criminal or terrorist activity, state surveillance Industrial espionage or sabotage Operational Privacy Financial Privacy Financial Privacy Operational Safety

9 Security hazard classification 9 o Different security aspects are not independent safety is definitely a sub-set of operational financial is perhaps a subset of privacy o Why separate the proposed security aspects? certain aspects relate to particular attacker types privacy industrial espionage, surveillance operational industrial i sabotage, nuisance hacker safety opportunistic harm (terrorism) privacy and safety targeted harm (crime) privacy and financial crime (opportunistic, organized) safety has special features potential for driver to intervene to mitigate some hazards

10 Threat analysis Attack Trees 10 Common model to map attack trees to risk analysis

11 Sample attack tree 11 Developed by brainstorming (based on EVITA uses cases considering identified threat agents and their motivations)

12 Severity classification in vehicle safety engineering 12

13 Extending from safety to security 13

14 Severity classification of privacy infringements 14

15 Financial severity classification 15

16 Security severity classification a 4-component vector 16

17 Attack potential and probability 17 o o Attack potential evaluation using established, structured approach from Common Criteria applied in EVITA at asset attack level l of attack trees Indicative of attack probability (inverse relationship) numerical scale used to represent relative ranking of attack probability

18 Evaluation of attack potential 18 o Factors considered (ISO/IEC 18045) elapsed time attacker expertise system knowledge required window of opportunity equipment required o Each factor has a number of classes each assigned with a numerical value e.g. attacker expertise layman (0), proficient (3), expert (6), multiple experts (8) o Attack potential classes based on ranges of total numerical value

19 Controllability safety hazards 19 Possibility for the driver (and/or other traffic participants) p to mitigate possible safety hazards

20 Risk graph (fragment only) 20 Non-safety aspects addressed with table for controllability C=1 (C>1 only for safety issues)

21 Attack tree tables for risk analysis 21 A compressed tabular attack tree representation provides a convenient framework for documenting the risk analysis Attack Objective Severity (S) Attack Method Risk level (R) Combined attack method probability (A) Asset (attack) a & B1 R B1(S B, A B1) A B1=min{Pa,Pb} b B S B d B2 R B2 (S B, A B2 ) A B2 =max{pd,pe,pf} P Pf} e Pe f Attack Probability (P) Pa Pb Pd P Pf OR: as easy as the easiest option AND: as hard as the hardest component

22 Overview of EVITA attack trees 22 o The 18 EVITA use cases suggested 10 attack trees: attack E-call, attack E-toll tamper with warnings, attack active break manipulate speed limits, force green light manipulate traffic flow, simulate traffic jam unauthorized braking, engine denial-of-service o These are representative, but not exhaustive o Rationalization of the attack trees revealed: 44 different asset attacks, involving 16 different assets o Risk analysis provides the means to assess the relative importance of protecting ti these assets

23 Risk-based prioritisation of counter-measures 23 Identified threats Risk analysis results Security requirements Asset Attack Risk level Instances 1 3 Authenticity_6, Availability_102, Denial of service Chassis 2 1 Availability_106 Low priority Safety Exploit Controller 4 1 Authenticity_1, Authenticity_2, implementation i flaws 5 1 Authenticity_3 2 5 Confidentiality_1, Confidentiality_2, Authenticity_ Corrupt or fake 4 4 Wireless messages 5 1 Important to protect Comms 6 4 againstthis this asset attack Availability_107, Availability_108, Jamming 5 2 Integrity_102

24 Conclusions 24 o o A security risk analysis approach has been developed from automotive safety and IT security practices attack trees to identify asset attacks from use cases, attacker type and motivations 4-component security risk vector, potentially including security-related related safety issues attack potential and controllability to assess probability of successful attack Level and frequency of risks associated with asset attacks identified in attack trees indicate priorities iti for counter-measures

25 Acknowledgements 25 For further information see: