# A Connected and Autonomous Vehicle Reference Architecture for Attack Surface Analysis
## 5 Case Studies
### Driverless Valet Parking
#### 5.1.1 Threat Identification  
A number of threats were identified in the original example in Reference [7] that can also identified using the reference architecture proposed.  
* Spoof GNSS on Vehicle: GNSS signals could be spoofed to assist a thief stealing a vehicle.
* Modify Map via Update on **Cloud**: A map update is used to force the vehicle along a route to an arbitrary destination.
* Replay Retrieval on Device: A thief replays a recorded signal used to retrieve the vehicle.  
Figure 5: Valet Parking: Vehicle and Devices Instantiation.  
* Blind Range Sensor on Vehicle: An adversary seeking to cause a crash could blind the range sensor to prevent a vehicle from knowing its distance from obstacles.
* DoS Parking Allocator on Cloud: An adversary seeking to induce a traffic jam or freeze the parking garage could DoS the allocator, preventing vehicles from requesting new spaces.  
Using our reference architecture (see Figures 5 and 6), the following additional threats have been identified:  
* DoS Parking Sensor on Edge: Cover sensor that detects a vehicle in a parking space to reduce the availability of the parking garage.
* Information Disclosure via Vulnerable APIs on Cloud: Vulnerable APIs can potentially execute arbitrary code (such as via SQL injection attacks), allowing an adversary to remotely obtain sensitive data about the parking garage system.
* MiTM on Edge: A device could be placed in the parking garage that mimics roadside infrastructure. If it has a high signal strength vehicles would prefer connecting to that overt V2I rather than the Edge infrastructure of the parking garage, allowing a MiTM attack between the vehicle and the cloud services. This attack could reveal sensitive information about the user (such as financial details). It could also be used to over allocate vehicles causing a large traffic jam in the parking garage (denying vehicle availability).  
This work does not perform the threat modelling in step 3, as it is expected to input this information from one of the many different threat modelling techniques.  
Considering the additional components contained within the dashed lines, the following additional threats have been identified:  
* Cut Mains Power on Edge: A vehicle should be able to autonomously exit the parking garage even if power is lost, whether the power loss is malicious or not. If the vehicle is unable to exit the parking garage then availability of the vehicle is denied to its owner.  
Figure 6: Valet Parking: Edge and Cloud Instantiation. (**a**) **Edge**; (**b**) Cloud.  
* Incorrect Indoors Positioning on Edge: If the Edge assists the vehicle perform indoors positioning, then spoofed and jammed signals could be used to decrease the vehicle's certainty of its position.  
By including the additional interactions with the Edge and Cloud, as well as a better structuring of components and their interactions, our reference architecture has allowed more threats to be identified. The identification process does not require specifying a large amount of details compared to more comprehensive reference architectures such as in Reference [8].  
Attack trees were built from these specified potential threats by first selecting the most relevant threat agents; which are the thief, hacktivist and terrorist.For each threat agent the most important goals were identified. The attack trees were then analysed for each of these goals, which is summarised in Table 3. Finally, each tree was combined into a single tree (Figure 7) to illustrate the security analysis of the use case with respect to the threats, threat agents and their goals.