Preventing cyber-attacks across Connected and Autonomous Vehicles

Government, industry and academia have committed, through leading organisation Zenzic, to accelerating the self-driving revolution by developing a national platform for testing the cyber resilience of Connected and Autonomous Vehicles (CAV).

CAVs rely on using global navigation satellite systems (GNSS) such as GPS and Galileo as vital sources of positioning, navigation and timing (PNT) information. CAVs depend on this information to enable efficient route planning and ensure awareness of environments.

Relying on satellite systems becomes problematic when considering the weak signal strength from navigation satellites in space, and no authentication is currently included in the systems adopted in the automotive industry. This means that cyber-attacks against signals via jamming (denying access to satellite information) or spoofing (presenting incorrect and altered information) are attractive to cyber-criminals due to the potentially high impact such attacks can achieve.

Jamming is often easier to perform and detect compared to spoofing, but can be harder to mitigate. Attacks can be performed using readily available devices, so it is important that manufacturers, as well as Connected and Automated Mobility (CAM) service providers implement techniques to detect and mitigate these threats.

To explore these challenges, WMG and the recognised global leader in the provision of positioning, navigation and timing solutions, Spirent Communications established the ‘PNT Cyber Resilience: A Lab2Live Observer Based Approach’ project. The project invited a wide range of experts to virtual roundtable interviews from the automotive, cyber-security and positioning, navigation and timing industries. Experts shared their opinions on CAV resilience and vulnerabilities to satellite cyber-attacks and assisted in defining the ideal characteristics of a cyber-security testbed.

From its PNT development centres in the UK, Spirent had been researching a new solution – a PNT attack emulator (PNTAE) - aimed at providing positioning, navigation and timing cyber-security assurance for both the UK and international CAV markets.

Spirent’s attack emulator solution comprises a suite of receivers, simulators and emulators, and is a globally unique offering that can be placed into CAVs from prototype stage through to production and aftermarket models. The basis of the solution’s functionality is to replicate possible cyber-attack situations from the mundane (e.g. accidental interference) to the most sophisticated (e.g. spoofing, offset timing etc.), with the potential to commercially exploit the technology and support manufacturers and testing facilities.

However, a route to commercialising such a solution, and therefore developing new cyber-security related services in UK and global CAV marketplaces, is currently inhibited by the absence of a high calibre testbed.

Realising the commercial potential of a unique product

To explore the potential for the solution, Spirent joined forces with WMG to perform a feasibility study and independently confirm that the attack emulator for CAV positioning, navigation and timing was technically ready. Spirent therefore provided their attack emulator solution for WMG researchers to form the basis of testing.

Although both theory and practice-focused literature exist on mitigating attacks, there is no individual solution. The three-month feasibility study was launched on January 1st 2020 and conducted specific research and testing around the positioning, navigation and timing of CAVs to identify vulnerabilities by exploring and replicating cyber-attacks, generating a deeper understanding and providing recommendations around the preventative national facilities needed.

As well as reviewing vulnerabilities, the Innovate UK-funded study explored detection and mitigating techniques and presented the opinions on cyber testing from a group of experts. The study identified the methods and software needed to create and test positioning, navigation and timing in an ideal testbed based on a ‘Lab2Live approach’, which spans from simulation tests on intelligent vehicles inside WMG’s National Automotive Innovation Centre (NAIC) lab, to real-world environment testing on autonomously-driving vehicles at the University of Warwick’s Wellesbourne Campus.

Combining its existing and fully operational equipment with WMG’s hi-tech facilities, Spirent launched both controlled and real-world scenarios to emulate a direct attack on vehicle systems by using the attack emulator, with results reported to government agencies and the public. The trials then allowed Spirent to understand the exploitability potential of the solution.

Adding real value and triggering new product ranges

The lab and real-world testing highlighted that spoofing and jamming attacks on satellite signals are capable of leading to severe loss of functionality and safety in CAVs by denying them access to or providing them with incorrect positioning, navigation, and timing information.

Results also emphasised that specific positioning, navigation and timing testing facilities are urgently needed, from simulation in artificial environments to over-the-air (OTA) testing in labs and real-world environments. Dr Elijah Adegoke, WMG Research Fellow on the project said:

“From our findings from the academic literature surveyed, as well as the practical Lab2Live work carried out in the course of the project, it is evident that robust countermeasures for cyber vulnerabilities are required to ensure that the CAM sector is safe and robust.

“A wide range of attacks can be carried out. Software attacks can lead to violations of availability or integrity. Jamming attacks are prevalent in today’s transport networks, however, not all occurrences are intentional. Spoofing attacks are also likely to occur, but require advanced knowledge and detailed information about the target, and are thus not yet an immediate threat.”

Steve Hickling, Director of Professional Services at Spirent said:

“Through this project WMG and Spirent have demonstrated that bringing a quantitative assessment of cyber resilience and robustness into CAV testing adds real value and provides opportunities for UK industry and academia.

“This has validated our approach at Spirent for a new range of test solutions focused on the generation of realistic threats. The solutions could be specified such that they could be used as part of a comprehensive CAV Cyber-Security testbed and would meet UK requirements.”

Dr Adegoke added:

“Government and all associated stakeholders need to continue to work together to foster collaborative research and development that is capable of testing and certifying position, navigation and timing for CAM in the UK.

“Through conducting simulated testing in lab environments, and real-world testing using Spirent’s attack emulator solution, WMG demonstrated how the product can efficiently replicate signals, simulate realistic cyber-attacks and reveal where vehicle security systems are compromised.

“Most importantly, this project has shown that the chosen Lab2Live methodological approach, starting with lab-based testing and finishing with real-world tests, provides the complimentary and comprehensive results that are required to evaluate a system’s cyber resilience.”

From the project, two industry guidance reports for best practice were also produced, exploring the team’s innovative methods for measuring and monitoring positioning, navigation and timing-related aspects of CAV cyber-security, defining a set of requirements for a future cyber-security capability and understanding the commercial landscape for such a facility.

Dr Matthew Bradbury, WMG Research Fellow, highlighted:

“GNSS products and systems that depend on them need evaluation under cyber-attacks to provide confidence that safety and security is maintained in adverse conditions. Using input from PNT and cyber-security experts on the focus areas, the first report presents our Lab2Live testing methodology based on evaluating the resilience of GNSS receivers in a controlled lab environment to live testing.

“Using this experience, we present 15 specifications and 5 recommendations for a PNT cyber-security testing facility in the second report, with key highlights being the need for new standards, equipment and site requirements, and, above all, the need for a UK sovereign cyber-security testing capability.”

WMG is now also leading a collaborative post project IEEE technical paper, “CAV PNT Attacks in the Lab and Field: An Empirical Study”, which is to be submitted to IEEE Transactions on Intelligent Vehicles in August/September 2020.

---------------------------------------------------

Find out more about WMG's Intelligent Vehicles research here.

For further information please see the two technical reports produced on GNSS Resilience and Identified Vulnerabilities (Report 1) and Specifications for Cyber Testing Facilities (Report 2).