## 3 T2G Communication Security, Vulnerabilities, and Threats
### Threats Overview  
As a core component for status monitoring and data transmission in high-speed rail systems, the T2G communication system is particularly vulnerable to cyber threats due to its open architecture, mobile nature, and reliance on real-time wireless links. Based on the attacker model defined above, the major categories of threats faced by the T2G system can be summarized as follows:  
1. Eavesdropping and Traffic Analysis: T2G communication often relies on public networks (e.g., 4G/5G), making it susceptible to passive attacks. Adversaries can deploy eavesdropping equipment along the railway to intercept and analyze transmitted packets. Even when encryption is applied, traffic analysis techniques (e.g., observing packet size, frequency, and timing) may reveal sensitive information such as train operating patterns, schedules, or equipment status.
2. Message Tampering and Forgery: Attackers may conduct man-in-the-middle (MitM) attacks by hijacking onboard communication channels or accessing network points at stations or along the track. This allows them to inject falsified operational parameters, fault reports, or location data, which could mislead the ground control system.
3. Replay Attack: Due to the periodic and predictable nature of T2G data transmissions, attackers can record legitimate packets and replay them at a later time to generate misleading operational states, potentially misleading decision-making on the ground side.
4. Denial-of-Service (DoS) Attacks: Attackers may disrupt T2G services by launching network-layer or physical-layer DoS attacks. These include flooding the channel with excessive traffic, exhausting system resources, or using high-power jamming signals. In busy station environments, such attacks could lead to widespread train delays and service disorganization.
5. Unauthorized Access and Device Compromise: Key T2G hardware components--such as Mobile Communication Gateways (MCGs), data acquisition units, and transmission controllers--may be compromised through supply chain vulnerabilities, misconfigurations, or leaked credentials. Without physically damaging the device, attackers could implant malicious code, enabling persistent access, data leakage, or remote shutdown of train communication functions.
6. Data Integrity Attacks: T2G data is often uploaded in batches for trajectory reconstruction, fault diagnostics, and performance analysis. Attackers could corrupt historical data or inject false supplementary records, undermining the consistency of datasets and impairing predictive maintenance or safety evaluations.
7. Routing and Protocol Exploits: In multi-train or edge-computing environments, T2G communication may leverage Software-Defined Networking (SDN), Mobile Edge Computing (MEC), or dynamic routing protocols. Adversaries may exploit protocol vulnerabilities to perform attacks such as route spoofing or cache poisoning, manipulating data paths or delaying service responses.
8. Mobile Network-Specific Threats: When relying on public 4G/5G infrastructures, T2G systems are also exposed to mobile-specific threats such as rogue base stations, DNS spoofing, and signaling storms. These techniques can intercept sessions, downgrade encryption, or force channel switching, potentially enabling more sophisticated or coordinated attacks.