Automotive Cyber-physical Systems Research Articles

Energy-Efficient Functional Safety Design Methodology Using ASIL Decomposition for Automotive Cyber-Physical Systems

Automotive cyber-physical systems (ACPS) are typical cyber-physical systems because of the joint interaction between the cyber part and physical part. Functional safety requirement (including response time and reliability requirements) for an ACPS function must be assured for safe driving. Auto industry is cost-sensitive, power-sensitive, and environment-friendly. Energy consumption affects the development efficiency of the ACPS and the living environment of people. This paper solves the problem of optimizing the energy consumption for an ACPS function while assuring its functional safety requirement (i.e., energy-efficient functional safety for ACPS). However, implementing minimum response time, maximum reliability, and minimum energy consumption is a conflicting problem. Consequently, solving the problem is a challenge. In this paper, we propose a three-stage design process toward energy-efficient functional safety for ACPS. The topic problem is divided into three sub-problems, namely, response time requirement verification (first stage), functional safety requirement verification (second stage), and functional safety-critical energy consumption optimization (third stage). The proposed energy-efficient functional safety design methodology is implemented by using automotive safety integrity level decomposition, which is defined in the ACPS functional safety standard ISO 26262. Experiments with real-life and synthetic ACPS functions reveal the advantages of the proposed design methodology toward energy-efficient functional safety for ACPS compared with state-of-the-art algorithms.

The Support of MISRA C++ Analyzer for Reliability of Embedded Systems

Cyber-Physical Systems (CPS) are increasingly used in many complex applications, such as autonomous delivery drones, the automotive CPS design, power grid control systems, and medical robotics. However, existing programming languages lack certain design patterns for CPS designs, including temporal semantics and concurrency models. Future research directions may involve programming language extensions to support CPS designs. On the other hand, JSF++, MISRA, and MISRA C++ are providing specifications intended to increase the reliability of safety-critical systems. This article also describes the development of rule checkers based on the MISRA C++ specification using the Clang open-source tool, which allows for the annotation of code and the easy extension of the MISRA C++ specification to other programming languages and systems. This is potentially useful for future CPS language research extensions to work with reliability software specifications using the Clang tool. Experiments were performed using key C++ benchmarks to validate our method in comparison with the well-known Coverity commercial tool. We illustrate key rules related to class, inheritance, template, overloading, and exception handling. Open-source benchmarks that violate the rules detected by our checkers are also illustrated. A random graph generator is further used to generate diamond case with multiple inheritance testdata for our software validations. The experimental results demonstrate that our method can provide information that is more detailed than that obtained using Coverity for nine open-source C++ benchmarks. Since the Clang tool is widely used, it will further allow developers to annotate their own extensions.

Data-Driven Parameterized Corner Synthesis for Efficient Validation of Perception Systems for Autonomous Driving

Today's automotive cyber-physical systems for autonomous driving aim to enhance driving safety by replacing the uncertainties posed by human drivers with standard procedures of automated systems. However, the accuracy of in-vehicle perception systems may significantly vary under different operational conditions (e.g., fog density, light condition, etc.) and consequently degrade the reliability of autonomous driving. A perception system for autonomous driving must be carefully validated with an extremely large dataset collected under all possible operational conditions in order to ensure its robustness. The aforementioned dataset required for validation, however, is expensive or even impossible to acquire in practice, since most operational corners rarely occur in a real-world environment. In this paper, we propose to generate synthetic datasets at a variety of operational corners by using a parameterized cycle-consistent generative adversarial network (PCGAN) . The proposed PCGAN is able to learn from an image dataset recorded at real-world operational conditions with only a few samples at corners and synthesize a large dataset at a given operational corner. By taking STOP sign detection as an example, our numerical experiments demonstrate that the proposed approach is able to generate high-quality synthetic datasets to facilitate accurate validation.

Control Performance Analysis of Automotive Cyber-Physical Systems: A Study on Efficient Formal Verification

Automotive cyber-physical systems consist of multiple control subsystems working under resource limitations, and the trend is to run the corresponding control tasks on a shared platform. The resource requirements of the tasks are usually variable at runtime due to the uncertainties in the environment, necessitating some kinds of adaptation to deal with the resource limitations. Such adaptations may positively or negatively affect the control performance of several subsystems. Since there might be some thresholds on the control performances as quality constraints, this matter should be considered carefully to avoid any quality attribute constraint violation. This paper proposes a scalable control performance constraint verification method for such a system that works based on a feedback scheduler. The scalability is the result of a control-aware pruning method. In case of a constraint violation, the designer may change the system configuration and perform re-verification. Our evaluations show that the proposed method scales well while preserving the verification soundness.

Security-Aware CAN-FD Message Packing in Intelligent Automotive Cyber–Physical Systems

Controller area network with flexible data-rate (CAN-FD) has received great attention in automotive cyber–physical systems (ACPSs) due to its high bandwidth and long payload. However, CAN-FD adopts a broadcast message transmission mechanism and lacks security protection, making it extremely vulnerable to cyberattacks. CAN-FD message packing (packing signals into messages) with low bandwidth occupancy (utilization) under security constraints is the prerequisite for running intelligent applications in ACPS. In this work, we implement a two-stage CAN-FD message packing solution to reduce bandwidth utilization and improve signal acceptance rate under security constraints. The first stage solves the message packing problem of minimizing bus bandwidth utilization under security constraints. The second stage aims at improving the signal acceptance rate by repacking signals. Experimental results show that the first stage reduces average bus bandwidth utilization by 135% compared with the unpacking solution, and the second stage improves the average signal acceptance rate by 5% than existing advanced methods.

A CAN Bus Security Testbed Framework for Automotive Cyber-Physical Systems

The popularization of electronic devices and the enrichment of external interfaces have increased the attack surface of the automotive cyber-physical system (CPS). As a vital part of the CPS, the controller area network (CAN) is more vulnerable to security threats due to the lack of corresponding security protection mechanisms. This kind of security problem has also attracted extensive attention from academia and industry. Researchers have proposed numerous intrusion detection models for the in-vehicle CAN bus, solving some security problems to a certain extent. However, vehicle manufacturers seldom disclose the internal details of vehicle ECUs due to safety concerns. Thus, it is difficult for researchers to investigate the operation mechanism of the bus. Meanwhile, there is a risk of personal safety in completing attack experiments on real vehicles, which can also lead to the lack and diversification of in-vehicle network data, especially the data of attack behavior. Based on real vehicle data, an open, adaptable, and low-risk CAN bus security testbed framework in the automotive CPS is proposed in this study, aiming to enrich the operation data of the CAN bus and enhance the personal safety of researchers. Besides, the delay of the testbed sending and receiving periodic and aperiodic CAN messages is theoretically explored. The results demonstrate that the generated timestamp in the dataset is mainly associated with the timestamp of the real vehicle data and that the transmission and collection of time series data are completed by Algorithm 1 and Algorithm 2. In the evaluation of the security testbed, the stability of the security testbed is studied from the two indicators of delay and packet loss rate. The experiment reveals that the testbed has a small relative delay difference and a low packet loss rate. Moreover, the DTW algorithm is employed to calculate the distance between the real vehicle and the testbed, and the experimental results demonstrate that the testbed is featured with high similarity and simulation.

CANon: Lightweight and Practical Cyber-Attack Detection for Automotive Controller Area Networks.

Automotive cyber-physical systems are in transition from the closed-systems to open-networking systems. As a result, in-vehicle networks such as the controller area network (CAN) have become essential to connect to inter-vehicle networks through the various rich interfaces. Newly exposed security concerns derived from this requirement may cause in-vehicle networks to pose threats to automotive security and driver’s safety. In this paper, to ensure a high level of security of the in-vehicle network for automotive CPS, we propose a novel lightweight and practical cyber defense platform, referred to as CANon (CAN with origin authentication and non-repudiation), to be enabled to detect cyber-attacks in real-time. CANon is designed based on the hierarchical approach of centralized-session management and distributed-origin authentication. In the former, a gateway node manages each initialization vector and session of origin-centric groups consisting of two more sending and receiving nodes. In the latter, the receiving nodes belonging to the given origin-centric group individually perform the symmetric key-based detection against cyber-attacks by verifying each message received from the sending node, namely origin authentication, in real-time. To improve the control security, CANon employs a one-time local key selected from a sequential hash chain (SHC) for authentication of an origin node in a distributed mode and exploits the iterative hash operations with randomness. Since the SHC can constantly generate and consume hash values regardless of their memory capacities, it is very effective for resource-limited nodes for in-vehicle networks. In addition, through implicit key synchronization within a given group, CANon addresses the challenges of a key exposure problem and a complex key distribution mechanism when performing symmetric key-based authentication. To achieve lightweight cyber-attack detection without imposing an additive load on CAN, CANon uses a keyed-message authentication code (KMAC) activated within a given group. The detection performance of CANon is evaluated under an actual node of Freescale S12XF and virtual nodes operating on the well-known CANoe tool. It is seen that the detection rate of CANon against brute-force and replay attacks reaches 100% when the length of KMAC is over 16 bits. It demonstrates that CANon ensures high security and is sufficient to operate in real-time even on low-performance ECUs. Moreover, CANon based on several software modules operates without an additive hardware security module at an upper layer of the CAN protocol and can be directly ported to CAN-FD (CAN with Flexible Data rate) so that it achieves the practical cyber defense platform.

A Tutorial on Moving Target Defense Approaches Within Automotive Cyber-Physical Systems

Moving Target Defenses (MTD) have become a popular and emerging defense strategy for the protection of traditional information technology systems. By their very nature, MTD strategies are designed to protect against adversary reconnaissance efforts on static platforms, essentially sitting back and having unlimited time to identify, craft, execute, and scale an exploit. With the rapid adoption of distributed automotive Cyber-Physical Systems (CPS) ranging from self driving cars, to connected transportation infrastructure, it is becoming more apparent that third party supply chains, increased remote communication interfaces, and legacy software stacks are making the traditionally designed standalone systems become more susceptible to safety-critical cyber-attacks. MTD strategies within the automotive CPS domain have to delicately balance the tradeoff between security and real time predictability, maintaining the safety constraints of the systems. In this paper, we explore the various MTD strategies presented within the literature while discussing potential applicability and strategies sufficient for the automotive CPS domain.

Security-Related Hardware Cost Optimization for CAN FD-Based Automotive Cyber-Physical Systems.

The introduction of various networks into automotive cyber-physical systems (ACPS) brings great challenges on security protection of ACPS functions, the auto industry recommends to adopt the hardware security module (HSM)-based multicore ECU to secure in-vehicle networks while meeting the delay constraint. However, this approach incurs significant hardware cost. Consequently, this paper aims to reduce security enhancing-related hardware cost by proposing two efficient design space exploration (DSE) algorithms, namely, stepwise decreasing-based heuristic algorithm (SDH) and interference balancing-based heuristic algorithm (IBH), which explore the task assignment, task scheduling, and message scheduling to minimize the number of required HSMs. Experiments on both synthetical and real data sets show that the proposed SDH and IBH are superior than state-of-the-art algorithm, and the advantage of SDH and IBH becomes more obvious as the increase about the percentage of security-critical tasks. For synthetic data sets, the hardware cost can be reduced by 61.4% and 45.6% averagely for IBH and SDH, respectively; for real data sets, the hardware cost can be reduced by 64.3% and 54.4% on average for IBH and SDH, respectively. Furthermore, IBH is better than SDH in most cases, and the runtime of IBH is two or three orders of magnitude smaller than SDH and state-of-the-art algorithm.

Cluster-Based CAN-FD Frame Packing Framework Optimization Using Two Strategies

Minimizing frame bus utilization is a difficult issue for a controller area network with flexible data rate (CAN-FD) in automotive cyber-physical systems (ACPS) due to the heterogeneity between frames payload and periods. Recently, the cluster-based method was used to solve the problem of CAN-FD frame packing. However, this method does not consider both payload and period and ignores the impact of signal sequence. In this study, we propose a cluster-based CAN-FD frame packing framework by presenting two strategies, namely, a strategy that maximizes frame size (MAXFS) and a strategy that minimizes frame bus utilization (MINFBU). We first use MAXFS to pack the signal with the same period into a frame and maximize the frame size; then, MINFBU is used to pack the signal into any frame and minimize bus utilization. Experimental results show that the proposed framework can reduce bus utilization and deviation rate more effectively compared with the state-of-the-art counterparts.

Digital Twinning Based Adaptive Development Environment for Automotive Cyber-Physical Systems

Automotive cyber-physical systems need to be rigorously checked and tested under various physical conditions. Automakers aim to improve development efficiency of the automotive cyber-physical systems in the fierce market competition. However, the actual development process suffers from the challenges of long development cycle and poor scalability. To tackle these challenges, this article develops a digital twinning based adaptive development environment for automotive cyber-physical systems, which addresses two critical problems: each physical entity (i.e., electronic control unit, component, test source, etc.) needs to clone a corresponding digital twin; digital twins and the physical entities need to interact closely. The first problem is addressed through proposing an integrated digital twinning clone flow. The second problem is addressed through developing a smart digital twinning board. Our case study with the automotive body control system demonstrates that the adaptive development environment achieves a high adaptability with short development cycle, low complexity, low cost, high scalability, and high flexibility, which meet various automotive cyber-physical design requirements during the development process.

Covert Channel-Based Transmitter Authentication in Controller Area Networks

In recent years, the security of automotive Cyber-Physical Systems (CPSs) is facing urgent threats due to the widespread use of legacy in-vehicle communication systems. As a representative legacy bus system, the Controller Area Network (CAN) hosts Electronic Control Units (ECUs) that are crucial for the vehicles functioning. In this scenario, malicious actors can exploit the CAN vulnerabilities, such as the lack of built-in authentication and encryption schemes, to launch CAN bus attacks (e.g., suspension, injection, and masquerade attacks) with life-threatening consequences (e.g., disabling brakes). In this article, we present TACAN (Transmitter Authentication in CAN), which provides secure authentication of ECUs on the legacy CAN bus by exploiting the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">covert channels</i> , without introducing CAN protocol modifications or traffic overheads (no extra bits or CAN messages are used). TACAN turns upside-down the originally malicious concept of covert channels and exploits it to build an effective defensive technique that facilitates transmitter authentication via a centralized, trusted Monitor Node. TACAN consists of three different covert channels for ECU authentication: 1) the Inter-Arrival Time (IAT)-based, leveraging the IATs of CAN messages; 2) the Least Significant Bit (LSB)-based, concealing authentication messages into the LSBs of normal CAN data; and 3) a hybrid covert channel, exploiting the combination of the first two. In order to validate TACAN, we implement the covert channels on the University of Washington (UW) EcoCAR (Chevrolet Camaro 2016) testbed. We further evaluate the bit error, throughput, and detection performance of TACAN through extensive experiments using the EcoCAR testbed and a publicly available dataset collected from Toyota Camry 2010. We demonstrate the feasibility of TACAN and the effectiveness of detecting CAN bus attacks, highlighting no traffic overheads and attesting the regular functionality of ECUs.

Optimizing Extensibility of CAN FD for Automotive Cyber-Physical Systems

Extensibility is an important optimization objective for the E/E architecture of automotive cyber-physical systems (ACPS), while little attention has paid to the extensibility-aware design of in-vehicle network. To address this problem, this paper formulates a trade-off problem that balances the bandwidth utilization and the extensibility from the initial design of CAN FD. We firstly propose a new extensibility model and the related evaluation metric, and then two optimization algorithms, namely, the mixed integer linear programming (MILP) approach and the simulated annealing (SA) based heuristic approach, are proposed to resolve the trade-off problem for mid-sized and industry sized signal sets, respectively. The experiment results show the efficiency of the proposed extensibility metric and the optimization algorithms. By comparing with state-of-the-art algorithm, the MILP reduces the increase range of the bandwidth utilization of the extended signal set by 18.17% to 57.64% averagely, and 49.22% to 89.40% maximally, with only 0.06% to 0.79% bandwidth utilization overhead; the SA approach can reduces the increase range of the bandwidth utilization of the extended signal set by 12.71% to 58.33% averagely, and 40.08% to 89.40% maximally, with only 0.06% to 0.8% bandwidth utilization overhead.

Design and Evaluation of a Reconfigurable ECU Architecture for Secure and Dependable Automotive CPS

The next generation of automobiles integrate a multitude of electronic control units (ECUs) to implement various automotive control and infotainment applications. However, recent works have demonstrated that these pervasively computerized modern automobiles are susceptible to security attacks that could compromise the physical safety of the driver and/or passengers. In this paper, we propose a novel ECU architecture for automotive cyber-physical systems (CPS) that simultaneously integrates both security and dependability primitives in the design with negligible performance, energy, and resources overhead. We implement our proposed ECU architecture on Xilinx Automotive (XA) Spartan-6 FPGA. We demonstrate the effectiveness of our proposed architecture using a steer-by-wire (SBW) application over controller area network (CAN) with flexible data rate (CAN FD) as a case study. We also optimize and implement a prior secure and dependable automotive work on NXP quad-core iMX6Q SABRE automotive board. We quantify the performance, energy, and error resilience of our proposed architecture for the SBW case study. Results reveal that our proposed architecture can attain a speedup of 47.9× while consuming 2.4× lesser energy than the optimized SABRE board implementation of security and dependability primitives. We further perform a comparative analysis of prior designs and the proposed ECU architecture for different in-vehicle networks, viz., CAN, CAN FD, and FlexRay. Results verify the feasibility as well as the superiority of the proposed ECU over other prior designs in terms of response time, energy efficiency, and error resilience.

Multi-Level Message Sequence Charts to Validate the Collaborative Automotive Cyber-Physical Systems

Autonomous driving and e-mobility are swiftly becoming not only the work of science fiction or popular science, but a reality. A key focus of manufacturers and suppliers in the automotive domain is of course to specify systems that implement this reality. Often, scenarios at type-level are used throughout the development process to specify system behavior and interaction within the car, as scenario models are comparatively easy to understand and can easily be subjected to manual validation. However, autonomous driving and e-mobility require interaction not just of systems within the same car, but collaboration between multiple cars as well as between cars and miscellaneous road infrastructure (e.g., smart road signs). The car becomes a Cyber-Physical System that dynamically forms collaborating networks at runtime with other Cyber-Physical System to create functionality that goes beyond the scope of the individual vehicle (e.g., resolve a traffic jam). Consequently, a plethora of possible compositions of such a network exist and must be specified and validated completely to assure their adequate and safe execution at runtime. Doing this at type-level with scenario models becomes prohibitively tedious, error prone, and likely results in unrealistic development cost. To combat this issue, we investigate the use of multi-level Message Sequence Charts to allow for specifying interaction scenarios between collaborative Cyber-Physical System in a network of collaborating automotive Cyber-Physical System. To assist the developer in systematically defining multi-level Message Sequence Charts, we propose two processes. The resulting diagrams use a mixture of type and instance-level abstractions within one conceptual diagram. This allows reducing the required effort to manually validate the adequacy of scenarios to a manageable amount because information within the scenarios can be validated in batches. At the same time, instance-level defects become more obvious. Evaluation results from a controlled experiment show that multi-level Message Sequence Charts contribute to effectiveness and efficiency of manual validation for collaborative automotive Cyber-Physical System.

Physical layer authentication for automotive cyber physical systems based on modified HB protocol

Automotive cyber physical systems (CPSs) are ever more utilizing wireless technology for V2X communication as a potential way out for challenges regarding collision detection, wire strap up troubles and collision avoidance. However, security is constrained as a result of the energy and performance limitations of modern wireless systems. Accordingly, the need for efficient secret key generation and management mechanism for secured communication among computationally weak wireless devices has motivated the introduction of new authentication protocols. Recently, there has been a great interest in physical layer based secret key generation schemes by utilizing channel reciprocity. Consequently, it is observed that the sequence generated by two communicating parties contain mismatched bits which need to be reconciled by exchanging information over a public channel. This can be an immense security threat as it may let an adversary attain and recover segments of the key in known channel conditions. We proposed Hopper-Blum based physical layer (HB-PL) authentication scheme in which an enhanced physical layer key generation method integrates the Hopper-Blum (HB) authentication protocol. The information collected from the shared channel is used as secret keys for the HB protocol and the mismatched bits are used as the induced noise for learning parity with noise (LPN) problem. The proposed scheme aims to provide a way out for bit reconciliation process without leakage of information over a public channel. Moreover, HB protocol is computationally efficient and simple which helps to reduce the number of exchange messages during the authentication process. We have performed several experiments which show that our proposed design can generate secret keys with improved security strength and high performance in comparison to the current authentication techniques. Our scheme requires less than 55 exchange messages to achieve more than 95% of correct authentication.

Cost-aware reliability task scheduling of automotive cyber-physical systems

New generation of automotives has become a typical Cyber-Physical System, including various sensors, complex communication networks and distributed computing devices. Manufacturers pay great attention to functional safety and cost control of automotive. High-end computing devices such as electronic control units (ECU) that can perform multiple tasks bring higher reliability and also lead to soaring costs. In this paper, we propose an efficient scheduling algorithm that satisfies cost and functional reliability constraints under multifunctional mixed-criticality task replication execution scenarios. Using the proposed fault-tolerant hardware cost-aware multifunctional safety assurance (FT_HCMSA) algorithm can reduce the deadline miss ratio (DMR) of high-criticality function significantly while meeting the autumotive functional safety and hardware cost constraints. FT_HCMSA uses a fine-grained ECU replacement strategy to optimize task allocation. Our experiments validate that FT_HCMSA can reduce the DMR of high-criticality level functions while meet the requirements of safety and cost.

ASDYS: Dynamic Scheduling Using Active Strategies for Multifunctional Mixed-Criticality Cyber–Physical Systems

Emerging cyber-physical systems (CPSs), such as in the domains of automotive, robotics, and industrial automation, often run complex functions with different criticality levels on a heterogeneous and distributed architecture. The ever stronger interactions between the cyber components and the physical environment lead to dynamic and irregular release of these functions. This article investigates dynamic scheduling of such mixed-criticality functions, where each function is modeled by a directed acyclic graph with no assumption on its period or minimum interarrival time. Unlike the existing methods that passively address the mixed criticality with a remedy when deadline misses are observed-this results in a high deadline miss ratio (DMR), and it is particularly undesirable for the high-criticality functions-we propose a novel dynamic scheduling approach using active strategies (ASDYS in short), where the mixed criticality is actively treated throughout the scheduling process. Automotive CPSs are used as an example for illustration. Experimental results show that our approach is significantly better than the existing methods in both the DMR of high-criticality functions and the overall system DMR.

Examining the Thermal Stress Effect of Electromagnetic Susceptibility of Automotive CAN Controller

CAN controllers are responsible for the processing and transmission of CAN signals, which render them indispensable electronic devices in automotive cyber-physical systems. SJA1000T is one of the most common CAN communication chips which can be implemented through the use of bulk silicon CMOS technology. A susceptibility test platform is built based on the direct power injection method following IEC62132-4 to explore the electromagnetic susceptibility characteristics and the effects of thermal stress on CAN controller. Test results show that the susceptibility threshold curve is corresponded directly to frequency and temperature. The influence of thermal stress on the input and output characteristics of MOSFET is simulated and analyzed to verify the anti-interference ability and reduced reliability of the chip in a high temperature environment.

Design and Analysis of Secure and Dependable Automotive CPS: A Steer-by-Wire Case Study

The next generation of automobiles (also known as cybercars) will increasingly incorporate electronic control units (ECUs) in novel automotive control applications. Recent work has demonstrated the vulnerability of modern car control systems to security attacks that directly impacts the cybercar's physical safety and dependability. In this paper, we provide an integrated approach for the design of secure and dependable automotive cyber-physical systems (CPS) using a case study: a steer-by-wire (SBW) application over controller area network (CAN). The challenge is to embed both security and dependability over CAN while ensuring that the real-time constraints of the automotive CPS are not violated. Our approach enables early design feasibility analysis of automotive CPS by embedding essential security primitives (i.e., confidentiality, integrity, and authentication) over CAN subject to the real-time constraints imposed by the desired quality of service and behavioral reliability. Our method leverages multicore ECUs for providing fault tolerance by redundant multi-threading (RMT) and also further enhances RMT for quick error detection and correction. We quantify the error resilience of our approach and evaluate the interplay of performance, fault tolerance, security, and scalability for our SBW case study.