## 4 Security Issues and Solutions for CAVs
### Cyber-Attacks on Inter-Vehicle Systems
#### 4.2.1 Models of Attacks on Platoon  
Due to the dependence of platoon dynamics and control on inter-vehicle communications, the imperfections of communication, such as transmission delay, packet loss, channel interference, etc., will directly impact the performance of platoon mobility and vehicle dynamics. Firstly, we quantitatively analyze how the networking performances impact platoon dynamics and control. [PERSON] et al. used a three-car-platoon model to illustrate the platoon safety performance under different information content (e.g., distances, speeds, and driver actions) and different communication uncertainties (e.g., delay, Doppler effects) [99].They pointed out that the data rates and PDR, transmission distances with/without obstacles, and multi-hops all significantly impact the communication delay, and finally affect the safety distance between vehicles and platoon performance. Compared with the inter-vehicles distances of platoons only relying on ACC functions, the transmitted distance or speed information through vehicular communications can effectively shorten the inter-vehicle distance. Essentially, string stability stands for the platoon dynamics from the perspective of vehicle control, which is defined as the spacing error between the desired and actual inter-vehicle spacing not amplifying to the upstream of the platoon [100]. It is analyzed in the frequency domain, and the specific steady-state error transfer function is defined as  
\[H_{i}(s)=\left|\frac{E_{i}(s)}{E_{i-1}(s)}\right| \tag{1}\]  
\(E_{i}(s)=\mathcal{L}(e_{i})\), \(E_{i-1}(s)=\mathcal{L}(e_{i-1})\), is the Laplace transformation of the spacing error. Theoretically, platoon stability is guaranteed if the following condition is satisfied:  
\[||H_{i}(s)||_{\infty}\leq 1 \tag{2}\]  
[PERSON] et al. designed a CACC system from the perspective of a Networked Control System (NCS) and considered the effect of communication sampling, hold, and delays [101]. They analyzed the string stability of the platoon, which follows a constant time head-way spacing policy based on these imperfections in vehicular communication. A feedback/feedforward controller is included in the CACC model: the feedback controller C\({}_{i,ACC}\) (s) constitutes the ACC part and is a PD-type controller that acts on locally sensed data, while the vehicular communication is introduced as an addition to the ACC part to consti  
Figure 6: A cyber-attack on a cooperative platoon. tute the CACC operation. Given the spacing policy, a time-domain representation of the CACC feedback/feedforward control input is expressed as  
\[u_{i}=u_{fb,i}+u_{ff,i}=K_{i,i-1}x_{i-1}+K_{i,i}x_{i},\ \ 1\leq i\ \leq n \tag{3}\]  
They considered each vehicle in the platoon to be an individual closed-loop CACC model. For an individual closed-loop CACC model, the i-th CACC-equipped vehicle dynamics (\(2\leq i\ \leq n\)) in an n-vehicle string is described by,  
\[\dot{x}_{i}=A_{i,i}x_{i}+A_{i,i-1}x_{i-1}+B_{s,i}\dot{u}_{i}+B_{c,i}\dot{u}_{i -1}, \tag{4}\]  
\(x_{i}^{T}= \begin{bmatrix}e_{i}&v_{i}&a_{i}&u_{ff,i}\end{bmatrix} \) represents the state variables, \(\ddot{u}_{i}(t)=u_{i}(t-\tau_{a,i})\) accounts for the delays in throttite actuation; \(\dot{u}_{i-1}\) denotes that \(u_{i-1}\) is transmitted over the network, which includes network-induced effects (e.g., sampling, hold, and delays). Furthermore, they lumped the n models in the platoon to derive a complete discrete-time CACC NCS model for the string stability analysis,  
\[\bar{\xi}_{k+1}=\ \overline{A}_{\xi}(\tau,h)\bar{\xi}_{k}+\Gamma_{r}(h)u_{r,k} \tag{5}\]  
Their experiment results show how string stability is compromised by delays and other imperfections in wireless communications. Clearly, CACC-based platoon stability highly depends on communication performance. Therefore, cyber-attacks mainly utilize the dependence to impact platoon dynamics and safe operations by degrading the networking performances. [PERSON] et al.