## 2 Security Issues Facing AVs and Solutions
### In-Vehicle Network  
In-vehicle networks are composed of diverse types of bus systems, mainly including CAN, LIN, FlexRay, and MOST. Due to the specific characteristics of each type of bus system, each type possesses distinct vulnerabilities [24]. These bus systems connect diverse types of ECUs together, therefore, any type of bus controller can send messages to any other existing ECU. Among these bus systems, the CAN bus works as the backbone of the in-vehicle network to receive many control messages and deliver them to the corresponding ECU. Therefore, we analyzed the security issues of CAN. Typically, the CAN bus can be categorized into two types: CAN-C and CAN-HIS buses; each of them is designed with distinct functions. Due to the lack of encryption, authentication, and authorization on the CAN bus, all messages on the bus are transmitted in plaintext; neither source or destination address is included in the message format. Therefore, attacks on the CAN bus include eavesdropping and traffic analysis, jamming and DoS, and malicious modification or injection. For attacks aimed at manipulating certain functions of a vehicle, such as steering and braking, the attacker needs access to the CAN bus and to modify messages on the CAN bus or directly inject malicious messages into the bus. In the past, the in-vehicle system was sealed from the outside and the CAN bus can only be accessed on special occasions with the help of special tools; for example, the maintenance technician uses an OBD-II scanner to diagnose the system. Recently, the increased connectivity of vehicles increased the chances that the in-vehicle network is accessed, which exposed the CAN bus to more types of attacks. For example, the attack successfully accessed the CAN bus and sent messages on the bus remotely from the cellular connection [3]. Much work has been undertaken to boost CAN bus security. Generally, these measures can be categorized into two types: (1) cryptography [24; 25; 26; 27], which originated from (a) controller authentication and (b) message encryption; and (2) firewall and physical separation. (1a) Authentication requires that only authorized controllers can communicate over the bus systems. A general way to ensure authentication combining unsymmetrical and symmetric keys is presented in [24]. (1b) Encryption of the CAN message typically involves the data field [27]. The sender and receiver ECUs synchronously manage a sequence number. The sender can use the number and encryption algorithm, such as AES-128, to generate cipher text. After receiving the message, the receiver can decrypt the message and verify the source. In practice, implementing a real-time cryptographic solution can cause \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Type** & **Application** & **Security Issues** & **Solutions** & **References** \\ \hline GPS & Provides real-time position & & & (1) & Validation to \\  & data of the vehicle through the connection with & & & (2) & Other types of sensors are \\  & multiple satellites. & Spoefing, jamming. & & integrated to correct the data & [11; 21; 22] \\  & & & & or maintain reliable & \\  & & & & navigation services, such & \\  & & & & as IMU. & \\ \hline TPMS & Measures the pressure of each & & & (1) & Encrypting packets to defend \\  & tire and provides real-time & & & against eavesdropping & \\  & information to the & & spoofing, vehicle tracking, & (2) & Reliable software design and \\  & vehicle system. & & & detection mechanisms. & \\ \hline Inertial measurement units & & & & & \\  & & & & & \\  & & & & & \\  & & & & & \\  & & & & & \\  & & & & & \\ \hline Engine control sensor & & & & & \\  & & & & & \\  & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: \(Cont.\)an overhead of extra computation and data transfer time. Thus, a clear trade-off between security, functionality, and efficiency should be taken into consideration. (2) Firewall and physical separation.