Automotive Cyber Security – CAN Protocol Analysis

Question 1

CAN protocol is the backbone of automotive networks. Considering CAN as an asset, complete composite threat modelling following the bullet points below, noting the mark distribution provided.

• Creating interconnecting drawing (5 Marks);
• Flow diagram (5 Marks);
• Creating and populating threat matrix with following fields (20 Marks) i.e.:
  • 1) List of vulnerabilities that could be exploited,
• 2) difficulty level to protect against vulnerabilities,
• 3) resource required to do the attack,
• 4) consequences of attacks;
• Attack scenario (10 Marks).

Question 2

Controller Area Network or CAN protocol is a method of communication between various electronic devices like engine management systems, active suspension, ABS, gear control, lighting control, air conditioning, airbags, central locking etc. embedded in an automobile.

CAN messages are un-encrypted. What encryption technique is the best suitable for CAN messages (Give general description (5 Marks) give statistical evidences of comparisons (5 Marks) and give high-level implementation details e.g., sudo code, algorithm, state diagram (10 Marks).

Question 3:  

Attack trees are conceptual diagrams showing how an asset, or target, might be attacked. Use the J3061 attack tree notation to construct an attack tree to get remote access e.g., exploiting telematics unit vulnerabilities, where the attack goal is to access door lock ecu. Feel free to have assumptions e.g., open access of port, availability of scanning tools.

Create an attack tree using J3061 attack tree notation (5 Marks). Your attack tree should consider all possible ways (10 Marks). Once constructed, rate the different paths to achieving your attack goal with relative levels of difficulty, labelling 1 to 10 (where 10 being the most difficult and 1 is the least difficult) (5 Marks).

Question 4: 

What is the key legislation (current) that applies to automotive cyber security? (Feel free to quote EU,UK,USA,<Country of Relevance>) (10 Marks). Share your suggestions for new legislations (10 Marks).