Vehicle ECU classification based on safety-security characteristics

TLDR

Remote diagnostics and over‑the‑air firmware updates are becoming common in automotive manufacturing, but they require external communication that exposes the previously isolated in‑vehicle network to cyber‑attack risks. This study aims to identify cyber‑attack threats and classify electronic control units (ECUs) in the in‑vehicle network to determine which units should be protected or restricted. The authors categorize ECUs into powertrain, vehicle safety, comfort, infotainment, and telematics, then apply four safety integrity levels and defined safety‑effect levels of security threats to jointly classify each ECU category. The results show that powertrain and vehicle safety ECUs need stronger protection before remote connectivity is enabled, and manufacturers should prioritize security or limit OTA procedures to specific ECUs.

Abstract

An upcoming trend for automotive manufacturers is to perform remote diagnostics and firmware updates over the air, which allows identifying hardware problems and correction of software flaws with minimal customer inconvenience. These procedures require that the previously isolated in-vehicle network permits external communication, which introduces a number of security risks, e.g., cyber attack threats. In this paper, we identify cyber attack threats and classify the electronic control units (ECUs) in the in-vehicle network to assist in determining which ones to protect and restrict access to. We divide the ECUs into five categories: powertrain, vehicle safety, comfort, infotainment, and telematics. We then use four safety integrity levels to classify the ECU categories. Moreover, we define safety effect levels of security threats which are used to classify identified attacks in the remote diagnostics and firmware updates over the air procedures. The safety and security levels are combined to classify the ECU categories. From the results we conclude that ECU categories such as powertrain and vehicle safety require further protection prior to introducing remote connectivity. As a conclusion, we suggest that automotive manufacturers should emphasize security or restrict the remote diagnostics and firmware updates over the air procedures to certain ECUs.