# A Connected and Autonomous Vehicle Reference Architecture for Attack Surface Analysis
###### Abstract  
Connected autonomous vehicles (CAVs) will be deployed over the next decade with autonomous functionalities supported by new sensing and communication capabilities. Such functionality exposes CAVs to new attacks that current vehicles will not face. To ensure the safety and security of CAVs, it is important to be able to identify the ways in which the system could be attacked and to build defences against these attacks. One possible approach is to use reference architectures to perform an attack surface analysis. Existing research has developed a variety of reference architectures but none for the specific purpose of attack surface analysis. Existing approaches are either too simple for sufficiently detailed modelling or require too many details to be specified to easily analyse a CAV's attack surface. Therefore, we propose a reference architecture using a hybrid Functional-Communication viewpoint for attack surface analysis of CAVs, including the Devices, Edge and Cloud systems CAVs interact with. Using two case studies, we demonstrate how attack trees can be used to understand the attack surface of CAV systems. connected autonomous vehicles; reference architecture; attack surface analysis Article  
1  
[PERSON] 2  
1  
[PERSON] 2  
1  
[PERSON] 2  
1  
Footnote 10: email: chs  
can be used with a reference architecture to help understand _how_ an attack could be executed. However, a problem with using existing reference architectures for attack surface identification and analysis is that they are often either lack important details [7] in order to derive certain categories of attacks, or too complex [8] for vehicle manufacturers and CAV system designers to feasibly use (which will be elaborated on in Sections 2.1 and 2.2). This paper addresses these issues by proposing a hybrid Functional-Communication viewpoint reference architecture for attack surface analysis. This reference architecture aims to balance the complexity-completeness trade-off, such that the model is sufficient complex to model a wide range of interactions but remains easy enough to practically use. While many of the attacks against traditional vehicles could be modelled using this reference architecture, we target L3-L5 autonomous vehicles (which are described in Table 1). These are the new and emerging autonomous vehicles that are beginning to be deployed, and which will encounter new threats compared to L0-L2 vehicles [9]. These new threats may try to manipulate input sensor data [10] in order to affect how and where an autonomous vehicle drives, or may simply try to remotely take control of the vehicle's functions [11]. There is the potential for these attacks (and others [12]) to have a large impact due to the potential of leading to unsafe conditions for vehicle occupants and pedestrians [13]. As the way in which vehicles are designed and operated is changing at a rapid pace, this reference architecture aims to focus on the next 10 years [14] of autonomous vehicles and be flexible to facilitate future changes. To demonstrate the effectiveness of using this reference architecture to perform attack surface analysis, we instantiate it with two different case studies. Using the interactions of components in the reference architecture and goals identified from a threat modelling, attack surfaces are derived. Performing the threat modelling to identify attacker goals, motivations, capabilities and resources is out of the scope of this paper as the attack surface defines how these goals can be reached but does not aim to specify what these goals are. There exist many threat modelling approaches [6; 15; 16; 17; 18] that can be used as input to the reference architecture. In the first example of valet parking, the attacks against a vehicle parking itself in an autonomous car park are investigated. In the second example, a real world attack against Tesla vehicles is used to highlight the need to consider the Edge infrastructure in the security of CAVs. We make the following contributions in this paper:  
1.