# A Connected and Autonomous Vehicle Reference Architecture for Attack Surface Analysis
## 2 Related Work
### Requirements for Attack Surface Analysis  
The extant reference architectures for CAVs variously consider analysis (of attacks and of risk), viewpoints and features (autonomous vehicles, devices, edge and cloud). The reason that these architectures have different characteristics is that they serve different purposes. When analysing an attack surface, not all of the characteristics are required, indeed some are undesirable as they may be too detailed and complex and, as such, are not effective for the easy identification of the surface and associated threats. To be most effective, a reference architecture needs to have the essential characteristics and no more. For example, Reference [8] considers the widest range of viewpoints but this can hamper the security analysis. One example of this is that the information flow of the system is described in the Physical Viewpoint using entities from the Enterprise View. These information flows are also described in the Communications viewpoint. This repetition is helpful for system design within a single viewpoint but not security analysis across multiple viewpoints; a more focused reference architecture can simplify the process of performing a cyber security attack surface analysis.  
The minimal viewpoints required for a cyber security attack surface analysis are Functional and Communications, as is it necessary to know what the system does and how it interacts. This allows what actions an adversary can perform and how an adversary's interactions with the system can produce the attack. Other components are necessary for other systems, for example, the Physical viewpoint is required to investigate cyber-physical attacks. Other viewpoints, such as the Implementation viewpoint are important to analyse attacks against specific systems. But to perform a more general attack surface analysis, the Functional viewpoint is sufficient. Other viewpoints (e.g., Enterprise and Usage) are useful in considering different types of security such as security management. Therefore, the Functional and Communications viewpoint can be focused on when performing a cyber security attack surface analysis.  
A comparison of the existing and proposed reference architectures is provided in Table 2. Features that the reference architecture includes is indicated with a \(\blackcheck\) and features that are not included are indicated with a \(\blackcheck\), the following features are shown: (i) purpose of the reference architecture (Analysis), (ii) the viewpoints used (Viewpoints) and (iii) the areas the reference architectures consider (Considers). Our work partially considers the Implementation viewpoint as it can be implemented as a _virtual_ component and is thus marked with a \(\sim\). Some of the existing reference architectures fail to focus on the wide range of interactions that a CAV could be involved with. Most reference architectures include Edge devices such as RSUs but do not considering the wider range of interactions between CAVs, Devices & Peripherals, the Edge and the Cloud. Without considering all of these interactions, it will be impossible to analyse many current and emerging attacks, so a new reference architecture needs to specify these interactions.