# A Connected and Autonomous Vehicle Reference Architecture for Attack Surface Analysis
## 5 Case Studies
### Driverless Valet Parking
#### 5.1.2 Discussion  
One of the interactions specified in Reference [7] was a key/remote that is used to initiate the retrieval of a vehicle from the parking garage. This occurs by the key communicating directly with the vehicle and initiating its automated driving to exit the parking garage. An alternate architecture involves a user using an app on a smart phone to contact a cloud service to request the retrieval of a vehicle. This means the parking garage has greater control over vehicle parking allocating and scheduling vehicle retrieval. We use the alternate model as we believe it more accurately describes the way in which this system will be implemented. This means the steps of vehicle retrieval goes from (a.i) Key communicates with vehicle to request autonomous retrieval, (a.ii) vehicle autonomously drives to owner through parking garage, to (b.i) User requests vehicle retrieval using smart phone, (b.ii) cloud service schedules vehicle retrieval to prevent traffic jams in parking garage, (b.iii) vehicle autonomously drives to owner. \begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**TA** & **Goal(s)** & **Attacked Functions** & **Attack Surfaces** &
\begin{tabular}{c} **Detailed Attacks** \\ **on Assets** \\ \end{tabular} \\ \hline \hline \multirow{7}{*}{**TA**} & \multirow{7}{*}{Steal the CAV} & **F1** Stop the CAV at location that is convenient to steal & Sensors that are responsible to stop the CAV in incidents; OR edge (can ask CAV to stop) & A12 or A22 \\ \cline{3-6}  & & & Cloud (giving false map); OR Edge (giving false location); OR GNSS sensor (responsible for location sensing) & A21 or A11 or A23 or A24 \\ \cline{3-6}  & & & **F3** Control the CAV: compromise the command to make it go to false location & Edge (giving false command); OR Key (control the CAV directly & A31 or A32 \\ \hline \multirow{7}{*}{**TA**} & \multirow{7}{*}{Manipulate the CAV operation} & **F1** Stop the CAV & (See Thief analysis) & (See Thief analysis) \\ \cline{3-6}  & & **F2** Mislead the CAV & (See Thief analysis) & (See Thief analysis) \\ \cline{3-6}  & & **F3** Control the CAV & (See Thief analysis) & (See Thief analysis) \\ \cline{3-6}  & & & **F4** Track the CAV & Cloud (storing location information of the CAV) & A41 \\ \hline \multirow{7}{*}{**TA**} & **G1** Manipulate the CAV operation to create order & **G1-F1** Stop the CAV & (See Thief analysis) & (See Thief analysis) \\ \cline{3-6}  & & **G1-F2** Mislead the CAV & (See Thief analysis) & (See Thief analysis) \\ \cline{3-6}  & & **G1-F3** Control the CAV & (See Thief analysis) & (See Thief analysis) \\ \cline{3-6}  & & **G2** Disrupt the station operation management services & Cloud; Or Edge & F5: A21 or A25 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Attack Tree Analysis for Driverless Valet Parking Use Case with example threat actors and their goals. Our proposed reference architecture allows a more comprehensive attack surface to be identified than in previous work. For example, with the valet parking application, we can identify additional threats compared to Reference [7], because we define the previous unspecified Devices & Peripherals and Cloud sub-architectures and more thoroughly define the Edge sub-architecture. A comprehensive attack surface is always important because a missed threat can lead to risk being underestimated and may create severe consequences if attackers can use it to exploit the system.