Query: cybersecurity for intelligent automated vehicle

title: The CARAMEL Project: a Secure Architecture for Connected and Autonomous Vehicles
abstract: The main goals of the CARAMEL project are to enhance the protection of modern vehicles against cybersecurity threats related to automated driving, smart charging of Electric Vehicles, and communication among vehicles or between vehicles and the roadside infrastructure. This work focuses on the latter and presents the CARAMEL architecture for improving the security and privacy of communication for connected and autonomous driving. The proposed architecture includes: (i) multi radio access technology capabilities, with simultaneous 802.11p and LTE Uu support; (ii) a MEC platform, where algorithms for detecting attacks are implemented; (iii) an intelligent On Board Unit with anti hacking features inside the vehicle; (iv) a Public Key Infrastructure that validates in real time the integrity of vehicle's data transmissions. As an indicative application scenario, the interaction between the entities of the CARAMEL architecture is showcased in the case that the GPS locations used by vehicles are spoofed.

title: Integrated Safety and Cybersecurity Risk Analysis of Cooperative Intelligent Transport Systems
abstract: Automated Vehicles (AVs) the self driving vehicles, are expected to outperform human drivers and improve road safety in the near future. However, to achieve these goals, they need to communicate with each other and the other road participants and coordinate their actions. The systems of connected cooperative AVs are called Cooperative Intelligent Transport Systems (C ITS) Similar to AVs, C ITS are vulnerable to failures and cyberattacks. In our previous work, we proposed a method US2 for AV risk analysis. This paper extends US2 and presents a method for integrated C ITS safety and cybersecurity risk analysis. It takes into consideration automotive safety and cybersecurity standards ISO 26262 and SAE J3061, and utilizes the elements of the previously proposed risk analysis methods US2, EVITA, TVRA, and RACE.

title: Modeling and analyzing cyberattack effects on connected automated vehicular platoons
abstract: Vehicular platooning requires an open access environment of vehicle communications to enable cooperating connected automated vehicles (CAVs) to share their travel information. However, the open access environment makes the cooperating platoon CAVs vulnerable to cyberattacks, causing concerns on traffic safety and mobility. So far, due to the lack of analytical models integrating malicious effects of manipulated information into CAV dynamics, we have limited knowledge on CAV platoon performance under cyberattack. It necessities a modeling framework to support a comprehensive analysis of the CAV platoon performance in a capricious travel environment. This study seeks to bridge this critical gap from the following three aspects. First, we review potential safety related cyberattacks faced by CAVs, related to manipulation of vehicle position, speed, and acceleration. Based on the review, these cyberattacks are categorized into three types: bogus messages, replay/delay, and collusion attack. Second, we develop a generalized vehicle dynamics model that accounts for the cyberattack effects on CAV dynamics. The proposed model, labeled cooperative intelligent driver model (CIDM) integrates the dynamic communication topological structure to enable the analysis of effects of manipulated information on CAV dynamics. The dynamic communication structure is a time varying function which is determined by the communication range and the distance between two vehicles. Upon the proposed CIDM, the third aspect focuses on simulation analysis of CAV platoon safety and efficiency under cyberattacks, which demonstrate the cyberattack effects at the platoon level. This study contributes to the fundamental understanding of CAV platoon dynamics under cyberattacks and lays a foundation to enhance the cybersecurity of CAV systems.

title: Potential Cyberattacks on Automated Vehicles
abstract: Vehicle automation has been one of the fundamental applications within the field of intelligent transportation systems (ITS) since the start of ITS research in the mid 1980s. For most of this time, it has been generally viewed as a futuristic concept that is not close to being ready for deployment. However, recent development of "self driving" cars and the announcement by car manufacturers of their deployment by 2020 show that this is becoming a reality. The ITS industry has already been focusing much of its attention on the concepts of "connected vehicles" (United States) or "cooperative ITS" (Europe) These concepts are based on communication of data among vehicles (V2V) and/or between vehicles and the infrastructure (V2I/I2V) to provide the information needed to implement ITS applications. The separate threads of automated vehicles and cooperative ITS have not yet been thoroughly woven together, but this will be a necessary step in the near future because the cooperative exchange of data will provide vital inputs to improve the performance and safety of the automation systems. Thus, it is important to start thinking about the cybersecurity implications of cooperative automated vehicle systems. In this paper, we investigate the potential cyberattacks specific to automated vehicles, with their special needs and vulnerabilities. We analyze the threats on autonomous automated vehicles and cooperative automated vehicles. This analysis shows the need for considerably more redundancy than many have been expecting. We also raise awareness to generate discussion about these threats at this early stage in the development of vehicle automation systems.

title: Modelling Safe and Secure Cooperative Intelligent Transport Systems
abstract: Automated Vehicles (AVs) are expected to help in significantly reducing traffic injuries and fatalities in the near future. However, to achieve this goal, they must be safe and secure. The recent news of the first fatal crash of AV including pedestrian confirm the urgent need of addressing AV safety and security issues to prevent such accidents from happening in the future. In order to outperform human drivers, AVs need to communicate with the other traffic participants, which makes them more vulnerable to cyberattacks. Cooperative Intelligent Transport Systems (C ITS) which include vehicle to vehicle and vehicle to infrastructure communications, are expected to be launched in Europe next year. Thus, assuring their safety and security is crucial. This paper presents an approach, CESAM&SSM, for modelling safe and secure C ITS using the CESAM method and the Six Step Model. A combination of these two methods enables comprehensive analysis of C ITS from operational, functional, constructional, safety, and security perspectives. The propose approach is compliant with three international standards: ISO 26262 vehicle safety standard, SAE J3061 vehicle cybersecurity standard, and ISO 21217 intelligent transport system architecture standard.

title: Merging safety and cybersecurity analysis in product design
abstract: When developing cyber physical systems such as automated vehicles, safety and cybersecurity analyses are often conducted separately. However, unlike in the IT world, safety hazards and cybersecurity threats converge in cyber physical systems; a malicious party can exploit cyber threats to create extremely hazardous situations, whether in autonomous vehicles or nuclear plants. The authors propose a framework for integrated system level analyses for functional safety and cyber security. They present a generic model named Threat Identification and Refinement for Cyber Physical Systems (TIRCPS) extending Microsoft's six classes of threat modelling including Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation Privilege. TIRCPS introduces three benefits of developing complex systems: first, it allows the refinement of abstract threats into specific ones as physical design information becomes available. Second, the approach provides support for constructing attack trees with traceability from high level goals and hazardous events (HEs) to threats. Third, TIRCPS formalises the definition of threats such that intelligent tools can be built to automatically detect most of a system's vulnerable components requiring protection. They present a case study on an automated driving system to illustrate the proposed approach. The analysis results of a hierarchical attack tree with cyber threats traceable to high level HEs are used to design mitigation solutions.

title: SCALED TESTBEDS FOR AUTOMATED ROBOTIC SYSTEMS
abstract: The automotive and defense industries are going through a period of disruption with the advent of Connected and Automated Vehicles (CAV) driven primarily by innovations in affordable sensor technologies, drive by wire systems, and Artificial Intelligence based decision support systems. One of the primary tools in the testing and validation of these systems is a comparison between virtual and physical based simulations, which provides a low cost, systems approach testing of frequently occurring driving scenarios such as vehicle platooning and edge cases and sensor spoofing in congested areas. Consequently, the project team developed a robotic vehicle platform Scaled Testbed for Automated and Robotic Systems (STARS) to be used for accelerated testing elements of Automated Driving Systems (ADS) including data acquisition through sensor fusion practices typically observed in the field of robotics. This paper will highlight the implementation of STARS as a scaled testbed for rapid prototyping, accelerated testing and verification and validation (V&V) and its applicability as a simulation tool for additional CAV concepts, such as modeling edge cases like swarm behaviors for route delivery and vehicle cyber security testing on sensors.  In this paper, we consider the validity of using a scalable vehicle platform for conducting hardwarein the loop (HIL) experimentation with respect to a virtual transportation model. The Scalable Testbed for Automated Robotic Systems (STARS) platform is designed to be a cost effective modeling and simulation tool combining physical and virtual testing to drive conclusions about Connected and Automated Vehicles' (CAV) functionality. The STARS system consists of five physically identical remote controlled cars, modified with commercial off the shelf (COTS) electronics, and an external ground control station (GCS) for developing path planning modules. Initially, STARS was designed to test cybersecurity mitigation strategies of vehicle swarming patterns and tracking functions, but since it uses modular components, it was adapted to match distinct use cases for connected vehicle  Scaled testbeds for automated robotic systems Page 2 of 8 technology (e.g. platooning, lane changing, and lane keeping assistance) The advantage of this system lies in the modularity and scalability of vehicle data being collected: The experiment discussed in this paper highlights a small scaled test orchestrated to observe and record CAV behaviors to understand real world challenges in full sized vehicles. This combined small scale physical and virtual platform allows the project team to perform cost effective rapid verification and validation (V&V) of CAV functionalities and vehicle design features. The platform leverages prototype and simulationbased testing to generate analysis of frequent driving scenarios and edge cases not typically replicated in the real world. The objective of this research is to provide insight to manufacturers and certifiers on how they can use small scaled test beds like STARS to validate CAV behaviors and consider edge cases like swarm behaviors and vehicle cyber security mitigation techniques concepts that are becoming prominent to both the automotive and defense industry.  The focus of this paper is the experimentation and analysis of field testing a platooning scenario of an "automated convoy," an application in which a group of automated vehicles follows a manually driven vehicle throughout a path, maintaining consistent speed and spacing.  Automated Vehicles Demonstrating a Platooning Proof of Concept at Aberdeen Proving Ground in 2017  The project team conducted a series of field tests in an isolated, controlled environment in which test vehicles demonstrated a platooning simulation built out in a transportation modeling tool for validation. By comparing simulated data with empirical field data, the project team analyzed performance metrics of both platooning scenarios to conclude V&V for small scale testing. Principles of modern control theory were used for developing simple control algorithms to compare the virtual and realworld model. As part of developing a methodology for STARS, the project team explored the use of HIL for scaled vehicle testing and V&V through a state of the art assessment of facilities and techniques used in the industry. Findings from this research of relevant HIL literature determined the following: HIL is already widely utilized in the automotive industry. HIL models consider many external factors to make each simulated model more accurate including gravity, resistance, and friction  A very low construction cost and short development cycle allow for testing variable conditions including road surface material, road geometry and slope, and static or dynamic obstacles  Embedding physical vehicle parts into a platform requires specialized space. The HIL method is highly reproducible and allows for flexibility in simulating realworld traffic operations. Small scale testing and HIL have been used by the automotive and defense industries, and both have been successfully implemented for V&V in the past. For example, the National Highway Traffic Safety Agency (NHTSA) Vehicle Research Test Center (VRTC) has conducted HIL simulation for validating braking components for heavy trucks [4] It is evident that the application of HIL in STARS will allow the project team to remain agile and innovative as it addresses the Federal Government's evolving needs for CAV regulation.  Scaled testbeds for automated robotic systems Page 3 of 8 METHODOLOGY The validation of the STARS platform is conducted by comparing the scaled physical vehicle's path trajectory with simulated trajectories from VISSIM, an industry standard transportation simulation tool. The following diagram presents the steps in validation.  Validation Process of STARS Project The experiment begins with user defined parameters: two vehicles (leader/follower) traveling in a straight path where the vehicle parameters are set to a default mid sized vehicle, measuring 4.92 feet wide by 15.62 feet long. Within the VISSIM simulation, an extended intelligent driver model (eIDM) was used to create an ideal scenario of cooperative adaptive cruise control (CACC) which is a fundamental concept behind vehicle platooning used in commercial vehicles. A CACC illustration can be seen in Figure 3, where the follower vehicles' speeds and distance can be observed.  Diagram of a Simple CACC Model The eIDM reflects an ideal scenario used in CACC modeled in VISSIM. The generalized equations can be seen here:

title: Trusting autonomous vehicles: An interdisciplinary approach
abstract: The theoretical concept of trust has been identified as highly important to the successful design of intelligent technologies such as autonomous vehicles (AVs) In human centred transport research this has resulted in a focus on trust in the technical design of future AVs and has raised the question of how the conditions that form trust change as technologies become more intelligent. In this article we discuss the first stage of an interdisciplinary project that brought together ethnographic and experimental user studies into trust in intelligent cars. This stage focused on the development of an interdisciplinary methodological framework for the user studies, through a review of 258 empirical HCI research articles on trust in automation and AVs. The review investigated the following research questions: a) what are the key themes in HCI methodologies used to research trust in automation and AVs; b) how do they account for trust in AVs as part of wider contexts; and c) how can these methodologies be developed to include more than momentary and individual human machine interactions. We found that while theoretical understandings of trust in automated technologies acknowledge the relevance of the wider context in which the interaction occurs, existing methodologies predominantly involve experimental studies in simulated environments with a focus on reliance related aspects of trust. We identified that ethnographic user studies can potentially contribute to new connections between theoretical understandings and conventional experimental methods. Therefore, we propose a framework for an interdisciplinary approach that combines experimental and ethnographic methodologies to investigate trust in AVs.

title: MICROTOKEN EXCHANGE (MTE) FOR SECURING DIGITAL DATA FROM CYBER WARFARE ATTACKS
abstract: New technological advancements call for innovative cybersecurity assurance measures in preventing increased vulnerabilities through cyber attacks and cyber warfare. Current encryption processes are no longer failsafe in secure data management architectures, especially with accessibility to Advanced Encryption Algorithms (AES) Through new technological advancements, including informational technology architectures and autonomous vehicle implementation, it is imperative to provide new paradigms of security against cybersecurity breaches. In all realms of data usage, including the development of the Next Generation of military vehicles, the demand for significant preventative measures in cybersecurity assurance has dramatically increased. The matter of advanced need in cybersecurity can be established through the use of MicroToken ExchangeTM (MTE) By way of MicroToken Exchange, it is possible to provide an additional robust layer of security that allows the right data, as well as ultrasecure command and control actions, to get to the right device, endpoint or End User Device (EUD) at the right time. Through MicroToken Exchange (MTE) operational changes are made to a sequence of digital data, which replaces the original data with new data or MicroTokens, prior to the streaming process; this process protects the data by replacing the real data with MicroTokens. By changing the data through the streaming process to MicroTokens rather than real data, the real data is then rendered inaccessible during the streaming process. When the MicroTokens reach their destination, they are then transformed for the device endpoint or EUD that the information was intended for to execute a command. This added transformation layer inhibits non authorized users to affect unauthorized actions to any paired End User Devices (EUDs) This process would provide the U.S. Army and U.S. Marine Corps with optimized effectiveness, efficiency and security in systems processing with MTE. MTE can be deployed on a one to one, one to many, and/or many to many ecosystem. Compatibility of this process is compliant with C, C+ and Java platforms, with possibilities of translation for multiple languages. MTE makes command data exploitation unassailable, as systems and connected devices remain unscathed, fully operational, stable, and secure by preventing these vulnerabilities. It is both unique and unparalleled in its design architecture. This paper provides more details on the process and the possibilities aligned with MTE's applications. In providing these details, this paper further converses how MTE can provide cybersecurity assurance to informational technology aspects of the military. Also, how to integrate into the Next Generation vehicles for protection against cyber attacks and cyber warfare in autonomous systems. By providing these additional layers of security, MicroToken Exchange would support the mission of the U.S. Army and the U.S. Marine Corps. This would prevent unauthorized user access to all information and all autonomous controls, by removing the real data that typically passes through the streaming process. Utilization of MTE would also coincide with the military goal of using more Unified Capabilities (UC) By preventing data collection from unauthorized users, vulnerabilities decrease dramatically, security increases exponentially, mission effectiveness increases dramatically, and safety of this nation's business and warfighter communities are preserved in the cyber realm.  In a world of interconnectivity comes the new responsibility of safeguarding our information. Technology, the need for speed, as well as, the vulnerabilities within networks, continue to grow exponentially. The development of a new platform for cyber attacks and cyber warfare has complicated the dynamic of using these data networks in business and in warfighter communities. The typical solution for this thus far has been use of encryption and redblack engineering, which is traditionally followed by government and military information architect intervention. Due to the increased rates of speed and the multiplications of vulnerabilities these typical solutions are becoming less effective and less practical. These situations coupled with the ability to employ super computers on Advanced Encryption Algorithms (AES) and the perfect storm for cyber warfare suddenly exists. Combat vehicle prototypes are focused on leap ahead technologies to support the mission. Ground Vehicle Robotic mid term capabilities are set to improve the cybersecurity of unmanned systems. TARDEC Value Stream 1 Autonomy is one program that warrants 100% security need in its technological architecture. In this growth of technology, also comes the growth of responsible protection against cyber warfare attacks. Current data environments require data yet using the "real" data is no longer a secure option. Through MicroToken Exchange (MTE) Secure Data Management Architecture is protected from cyber activity. This process makes it possible to secure datain transit, changing the technological aspect of where vulnerabilities exist in information technology and autonomous systems. MicroToken ExchangeTM (MTE) MicroToken Exchange, (MTE) is a process for information security that consists of replacing a sequence of digital data from a data stream with a different sequence of digital data that has no relationship to the data that is replaced. In the case of data that is already encrypted, the process of MTE can still be applied as an additional layer of protection.  The use of MicroToken Exchange communications between the Universal Controller and the paired EUD. Process is shown prior to the MicroToken Exchange from both end nodes. The following is an overview regarding its operation and how it works: Every send/receive command is authenticated and obfuscated, (No Encryption Req. MicroTokens execute preprogrammed commands, these commands are stored in paired libraries. MicroTokens can only be interpreted by paired devices. MicroTokens are instantly obsolete. Each time a command is execute the entire library of commands is re generated. Valid MicroTokens are hidden within complex digital chaff. The amount of chaff changes with each command so every packet has a different size. Pattern recognition is not possible due to its design. While there are additional layers within MTE, the solution makes sensitive command data invisible to hackers and cyberterrorists. MTE for data in motion began with the securing of commands to both connected and intelligent devices, including IoT devices. With the use of MTE, it is possible to secure data intransit, through enhanced capabilities that are agnostic to the type of Communication Protocol that is used to transmit information. By processing data through the MTE process, a new paradigm is created by removing the vulnerability that exists today with data in motion. These capabilities are eligible for use in transferring data commands and communications This process secures the commands, providing the user with an unequivocal layer of protection against cybersecurity breaches, including unauthorized actions. Operational Challenge Vehicle to Infrastructure (V2I) communication is a critical component of a connected vehicle environment a system of hardware, software, firmware and wireless communication that enables the dynamic transfer of data between vehicles as well as between vehicles and elements of the Joint Information Environment, (JIE) The greatest threat facing autonomy enable military vehicles is cybersecurity. TACOM TARDEC is developing Squad Maneuver Equipment Transport, (SMET) systems. Securing commands from the control device to the SMET over a wireless network is required for operational success. Current cybersecurity capabilities are at "fail safe" level. TARDEC is seeking enhanced security capabilities to achieve "full/fail mission capable" systems. By continuing to use typical cybersecurity options, there continues to be security risks and concerns for Automated Driving and Advanced Driver Assisted Systems, (ADAS) Through experimentation, it has been demonstrated that there are consequences of jamming and spoofing, exploiting underlying sensing principles. With very little effort, using simplistic tactics, bad actors can cause a great deal of harm and or destruction. Fig 2. Shows the Robotic and Autonomous system and their need for assured control. MTE and Army Digital Devices Military vehicles receive command inputs from many devices that need to control them, including satellites, handheld devices, other vehicles, thumb drives, and ground based installations. These command inputs need to be secured. The purpose of this Technical Paper is to present a Proof of Principle encompassing physical devices, software, protocol rules, and MTE proprietary software "methods" that provide significantly stronger cybersecurity to protect commands over existing communication networks. The systems viewpoint below presents the envisioned integration of MTE for test and evaluation at TRL 4 and rapidly maturing to TRL 6. Fig 3. High level pictorial of a system without MTE versus that of a system with MTE.  Recent trends in military communications are driving the Army toward more diverse end user devices (EUDs) to perform more activities via Unified Capabilities (UC) UC are a suite of integrated voice, video and/or data services delivered ubiquitously across a secure and highly available network infrastructure, independent of technology, to increase mission effectiveness for the warfighter and business  Concurrently, Army commanders are requesting EUDs based on their assessments of mission requirements, raising demand for the devices themselves as well as the connectivity necessary to enable their use. Meeting the demand comes at a cost. For the purposes of this Technical Paper TARDEC identifies all nodes within a network as a EU

title: Resilience modeling concepts in transportation systems: a comprehensive review based on mode, and modeling techniques
abstract: The objective of this comprehensive review study was to compile a state of the art understanding of the resilience of the transportation system due to natural and man made disasters. This study identified resilience measurement parameters that can be used to formulate resilience quantification and improvement strategies of a transportation system. Reviewed articles were classified and summarized from two perspectives: (i) modeling based on the mode of transportation; and (ii) modeling based on the mathematical technique used to quantify resilience. One of the unique contributions of this review article is that it compiled the key resilience indices that were analyzed to quantify resilience. This review revealed that the majority of the scholarly articles on the topic of transportation system resilience published since 2006, were focused on the resilience of the roadway based transportation system, and vulnerability was one of the most explored resilience indices in evaluating transportation system resilience. Several future research directions were identified considering the implications of emerging transportation technologies (e.g. connected and automated vehicle technology) The complex interdependency among critical infrastructure systems such as power, transportation, and communication system, as well as the cybersecurity issues in the advanced intelligent transportation system, will be vital in the resilience analysis of future transportation systems.