## 2 Security Issues Facing AVs and Solutions
### Electronic Control Unit (ECU)  
The ECU is a kind of embedded system in a vehicle used to monitor the real-time state of the corresponding component and feedback the status parameters to the bus system. Meanwhile, the ECU processes the information exchanged from the bus system and takes control of operations to adapt the vehicle's behavior. The number of ECUs ranges from about 40 in compact cars to about 90 in luxury cars. According to their functions, ECUs are loosely categorized into four types: powertrain, chassis, infotainment, and body control [30]. There are some key ECUs, such as EBCM, playing a critical role in manipulating a vehicle's behavior; compromising them will directly kill the vehicle and endanger the driver's safety [31]. In practice, many ECUs are coupled with each other to achieve some complicated control functions [5]. Thus, attacking a single ECU has the potential to impact large control functionality of the vehicle.  
Attacks on ECUs might result from compromising a vehicle's sensor network or exploiting the control module directly through diverse types of connectivity. As Paper [32] provided, a comprehensive guide of ECU vulnerabilities regarding different attack surfaces exist in many popular vehicles in the U.S. Specific attacks on ECUs include fuzzing, phishing, DoS [5], etc. A fuzzing attack aims at finding vulnerabilities by sending random packets to the ECU. Phishing attacks involve masquerading a trusted entity to gain sensitive information and compromise the system. The driver might be tricked by the phisher into flashing the firmware, which will cause permanent damage. In most cases, a fuzzing attack is the first step in creating a phishing attack. Typically, ECUs are configured when a vehicle is manufactured, and have a long lifetime. Therefore, other exploits on ECUs involve overwriting firmware and flashing ECU [31]. The firmware can be modified or replaced by performing a physical and valid update via an OBD port. Recently, an ECU update over the air (OTA) has been proposed [33; 34], which would expose more security risks. Table 2 also lists the security mitigations: (a) The use of Message Authentication Codes (MACs) and other cryptography solutions are investigated in [6]. (b) In practice, a dedicated hardware for encryption purposes, known as a hardware secure module (HSM), can be used to perform sophisticated cryptography [30]. HSM usually cannot be tampered with or harmed by external attacks. Therefore, it can be adopted in each ECU to securely store confidential private keys, to trustworthily calculate the reputation of other ECUs, to perform digital signature generation and verification, or to manage the certificate. (c) In the future, if updating ECUs over the air is widely adopted in various models, the mitigation of vulnerabilities in the process should be implemented in each step from the update center, wireless transmission path, and target vehicle.  
Table 2 summarizes the security issues and solutions for the CAN bus and ECUs. As we mentioned, either the CAN bus or the ECU was well sealed from the outside in the past. Attackers must have physical access to the in-vehicle system to implement the attacks, which is not an easy task. However, increased connectivity exposes the vulnerabilities of these components to remote cyber-attacks and imposes severe security threats on the in-vehicle system.