# Cybersecurity Comparison of Brain-Based Automotive Electrical and Electronic Architectures
## 5 Security Analysis Using STRIDE  
STRIDE is an acronym of six threat categories such as Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege (STRIDE) and has been developed by Microsoft. When applied using a tool like Microsoft Threat Modeling or Medini Analyze, the method generates a certain number of threats for each component. Within the scope of the example architecture, the following components and corresponding number of threats can be defined:  
1. Telematics Unit/ECU/HPC/Function = six threats, one threat for each threat category;  
Figure 18: Realization of Three-Brain Architecture in Ansys Medini Analyze.  
2. Sensor = two threats, one from spoofing and another from repudiation category;
3. Actuator = two threats, one from spoofing and another from repudiation category;
4. Connection port = three threats, one from tampering, another from information disclosure, and one from the denial of service category;
5. Data flow line = three threats, one from tampering, another from information disclosure, and one from the denial of service category;  
Based on this information, an equation is created to calculate the total number of threats for the traditional, centralized, and zone E/E architectures. The variables used in the equation are explained as below:  
\[T=T_{cp}(N_{t}+N_{e}+N_{b}+N_{f})+T_{csa}(N_{s}+N_{a})+T_{cpd}(N_{p}+N_{d}+N_{ db}) \tag{1}\]  
where  
* \(T_{cp}\) = number of threat category per process = 6;
* \(T_{csa}\) = number of threat category per sensor or actuator = 2;
* \(T_{cpd}\) = number of threat category per port or data flow direction = 3;
* \(N_{t}\) = number of telematics unit, which is normally 1 in a vehicle;
* \(N_{e}\) = number of traditional ECU in the architecture which is 0 for the brain-based architectures;
* \(N_{b}\) = number of brains/HPCs;
* \(N_{f}\) = number of features/functions;
* \(N_{s}\) = number of sensors;
* \(N_{a}\) = number of actuators;
* \(N_{p}\) = number of ports;
* \(N_{d}\) = number of data flow lines;
* \(N_{db}\) = number of databases = 0;
* \(T\) = total number of threats.  
In this equation, only one threat per threat category is considered. However, in practice, there are more than one threats per threat category.  
A comparison of the number of threats in different architectures is given in Table 1, where an assumption is made to use 800 functions/features/apps in a vehicle, which are equally distributed in HPCs (one-brain, two-brain, three-brain architectures) or ECUs (traditional architecture).  
In our studied traditional architecture, there is no telematics unit. The vehicle has 100 ECUs as each of the ECU hosts 8 functions. To realize 800 functions, 800 sensors and 800 actuators are required. Each sensor/actuator needs 4 ports to connect with a ECU (two ports on the sensor/actuator side and two ports on the ECU side) so the total number of ports are 800 times the sum of ports used for each sensor and actuator which comes out to be 6400. Similarly, 2 data flow lines are required for each sensor/actuator. The total number of data flows is 800 times the sum of data flow lines used in each sensor and actuator which comes out to be 3200. In comparison to this, all other architectures are equipped with 1 telematics unit and each architecture has specific number of HPC (brains). One-Brain has 4 and 2 extra ports and data flow lines respectively in order to make connections with the telematics unit, which is further generalised such that for each added brain 4 extra ports and 2 data flow lines are required. Thus, in total 6404, 6408 and 6412 data ports and 3200, 3202 and 3206 data flow lines are required for One-Brain, Two-Brain and Three-Brain architectures respectively. In this calculation, databases are not considered but can be used as components in any other architectures.