High-level intelligent driving system potential hazard identification method for fusion safety
By combining system-level hazard analysis and cybersecurity data flow graph mapping with the STRIDE method, we have achieved full-dimensional potential hazard identification for intelligent driving systems, solving the problem of incomplete identification in existing technologies and improving system security and development efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- XIAMEN UNIV
- Filing Date
- 2026-01-09
- Publication Date
- 2026-04-17
AI Technical Summary
Existing methods for identifying potential hazards in intelligent driving systems suffer from incomplete dimensional coverage, duplicate identification, and hazard omissions, making it impossible to effectively identify threats to functional safety, expected functional safety, and cybersecurity simultaneously.
By employing system-level hazard analysis and establishing a system security control structure, and by mapping a network security data flow graph structure and combining it with the STRIDE method, a unified hazard identification process for functional safety, expected functional safety, and network security is achieved.
It enables comprehensive identification of all potential hazards in intelligent driving systems, improves safety development efficiency, ensures high reliability and safety of the system, and avoids the duplication and omissions of traditional methods.
Smart Images
Figure CN121879424A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of intelligent connected vehicle technology, and in particular relates to a method for identifying potential hazards in high-level intelligent driving systems that integrates functional safety, expected functional safety and cybersecurity. Background Technology
[0002] With the deepening development of intelligent connected and autonomous driving technologies, the functional complexity and external interconnectivity of automotive electronic systems continue to increase. Their safety protection needs to address three core risk dimensions simultaneously: functional safety (ISO 26262) controls the hazards of electrical and electronic system failures; anticipated functional safety (ISO 21448) focuses on the risks of functional deficiencies, environmental interference, and human misuse in non-fault scenarios; and cybersecurity (ISO / SAE 21434) defends against malicious attacks and unauthorized access threats. Among these, potential hazard identification, as a core pre-development step in safety management, directly determines the completeness of subsequent safety measures. If there are blind spots in the identification process, potential vulnerabilities will exist in the security architecture, seriously threatening vehicle operational safety.
[0003] However, current methods for identifying potential hazards in the industry have significant technical limitations: due to the singularity of the analytical framework, existing methods can at most cover two of the three major security dimensions simultaneously. For example, some methods focus only on identifying hazards related to functional safety and expected functional safety, completely ignoring the security risks that cyberattacks may pose; other methods, while taking into account both functional safety and cybersecurity threat analysis, lack consideration for potential hazards caused by insufficient functional boundaries in non-fault scenarios. This limitation of missing dimensions directly leads to multiple problems: on the one hand, multiple rounds of targeted identification work need to be carried out repeatedly during the development cycle, such as first identifying hazards related to faults and functional deficiencies, and then separately conducting network threat identification, significantly increasing iteration costs and time consumption; on the other hand, due to the lack of a unified identification framework, some potential hazards will be missed, creating security risks for high-level intelligent driving systems.
[0004] Therefore, how to provide a method for identifying potential hazards that integrates functional safety, expected functional safety, and cybersecurity to achieve comprehensive identification of potential hazards across the three major security dimensions has become an urgent technical challenge. Summary of the Invention
[0005] The purpose of this invention is to provide a method for identifying potential hazards in a high-level intelligent driving system that integrates functional safety, expected functional safety, and network security. This method significantly improves the efficiency of safety development while ensuring high system reliability and security, and solves the technical problems of incomplete dimensional coverage, duplicate identification, and hazard omission in existing methods.
[0006] This invention is based on a systematic engineering approach encompassing functional safety (ISO 26262), intended functional safety (ISO 21448), and cybersecurity (ISO / SAE 21434), integrating the requirements of these three standards into a unified hazard identification process. Through system-level hazard analysis, establishing a system security control structure to analyze unsafe control behaviors, and mapping a system cybersecurity data flow graph structure for potential threat identification, it achieves comprehensive identification of potential system-level hazards caused by system failures, functional limitations, and cyberattacks within the same framework.
[0007] A method for identifying potential hazards in a high-level intelligent driving system with integrated safety includes the following steps:
[0008] 1) System-related item definition, functional design specifications and system asset definition: Clarify the core functions of the system, the usage scenarios and scope of the functions, the logic of function activation and intervention takeover, and define the system assets;
[0009] 2) Hazard and Operability Analysis (HAZOP): Traverse the system functions and assets defined in step 1), analyze the attributes of functions and assets, perform failure mode analysis on functions and loss analysis on system assets according to the attributes of functions and assets respectively to identify vehicle-level hazards, deduce possible hazard events based on vehicle-level hazards, and complete the identification of vehicle-level hazard events.
[0010] 3) Establish a system safety control structure, including elements such as sensors, controllers, control signals, feedback signals, actuators, drivers, and the external interactive environment;
[0011] 4) Mapping the network security data flow graph structure: Mapping the elements of the system security control structure to the four types of elements in the network security data flow graph: process, data flow, storage, and interaction.
[0012] 5) Identify unsafe control behaviors and analyze their causes; analyze unsafe control behaviors of control actions and deduce hazardous events; identify component failures that lead to unsafe control behaviors and potential deficiencies in expected functional safety and triggering conditions; use the STRIDE method to identify network threats and deduce potential hazards on the network security data flow graph structure.
[0013] In step 1), the core functions of the system include automatic steering, automatic braking, automatic acceleration, and handover of driving authority; the system assets include technical assets composed of software and hardware components, as well as privacy assets composed of user and traffic participant information.
[0014] In step 2), functional attributes correspond to failure modes, and asset attributes correspond to loss types. Functional failure modes include unexpected loss of function and unexpected provision of function. Unexpected provision of function specifically includes premature provision, late provision, excessive provision, insufficient provision, reverse provision, and unnecessary provision. Asset loss types include theft of technical assets and leakage of privacy assets. Harmful events include personal injury and system loss. System loss includes impact on vehicle control, economic property loss, and privacy leakage.
[0015] In step 3), the specific steps for establishing the system security control structure can be as follows:
[0016] 3.1) Deconstructing the key modules of the system: The core elements that make up the system are deconstructed into layers, mainly including the control body such as the autonomous driving domain controller, the perception layer multi-source sensor cluster, the actuator cluster, the driver interaction module and the external interaction environment;
[0017] 3.2) Clearly define the functions of each module and the relationships between modules;
[0018] 3.3) Control loop closed-loop construction: Based on the decomposition of elements, three types of core control closed loops are identified: the main control loop is a closed loop of sensor-controller-actuator-feedback; the human-machine interaction loop is a closed loop of driver input-system recognition-HMI (Human-Machine Interface) interaction-driver response; and the environmental interaction loop is a closed loop of external environment-perception sensor-vehicle body-actuator.
[0019] 3.4) Clarify the signal transmission (control signals, feedback signals) protocol and interaction logic of each loop.
[0020] In step 4), the mapping relationship is specifically as follows: sensors, controllers, and actuators are all mapped to processes and storage in the network security data flow graph; control signals and feedback signals are all mapped to data flows in the network security data flow graph; and the driver and external interactive environment are all mapped to interactive entities in the network security data flow graph.
[0021] In step 5), unsafe control behaviors are specifically provided but not required, failed to be provided, provided incorrectly, or provided too early or too late.
[0022] In step 5), the STRIDE method includes six threat types: forgery, tampering, denial, information disclosure, denial of service, and privilege escalation. Threat identification is carried out for the interaction, process, data storage, and data flow of the network security data flow graph.
[0023] In step 5), the cause analysis includes component failure analysis, expected functional safety deficiency analysis, and network attack analysis. The specific types of component failure analysis are interface failure, MCU failure, power failure, software failure, and communication failure. The specific types of expected functional safety deficiency analysis are hardware performance limitations, algorithm scenario limitations, and vehicle limitations. The specific types of network attack analysis are availability breach, integrity breach, and authenticity breach.
[0024] The steps 2) HAZOP analysis, 3) system security control structure establishment, 4) system network security data flow graph structure mapping, and 5) insecure control behavior and cause analysis are linked together to form a synchronous identification process for potential hazards in the three dimensions of functional safety, expected functional safety, and network security.
[0025] Compared with the prior art, the present invention has the following outstanding advantages and technical effects:
[0026] 1. Comprehensive Coverage with No Blind Spots: The core of this invention proposes a method for identifying potential hazards in intelligent driving systems that integrates functional safety, expected functional safety, and cybersecurity. This method breaks through the barriers of traditional fragmented identification of the three safety domains. Within a unified framework, it simultaneously completes the analysis of potential hazards in the three safety domains. It comprehensively covers fault-related potential hazards caused by electronic and electrical system failures, fully encompasses non-fault-related potential hazards caused by functional deficiencies, environmental interference, and human misuse, and more accurately captures network attack-related potential hazards caused by malicious attacks and illegal intrusions. This completely solves the limitation of existing methods that can only cover a maximum of two safety dimensions.
[0027] 2. Significantly improved development efficiency: By constructing an "integrated full-process" identification system, this invention avoids the drawbacks of traditional methods that require multiple rounds of repeated targeted identification work, greatly reducing development iteration costs and time losses, and providing an efficient solution for the safe development of high-level intelligent driving systems.
[0028] 3. Accurate and comprehensive identification: Through a progressive technical path of HAZOP analysis, control structure modeling, data flow graph mapping, and STRIDE threat identification, a complete identification chain is formed from initial hazard screening to cause tracing, ensuring that all kinds of potential hazards are fully captured without omission, effectively improving the safety and reliability of intelligent driving systems.
[0029] 4. Wide adaptability and strong practicality: This invention can be flexibly adapted to various high-level intelligent driving systems, including automatic emergency steering, adaptive cruise control, and autonomous driving domain control systems, without the need for significant adjustments to specific systems, and has broad engineering application value and promotion prospects. Attached Figure Description
[0030] Figure 1 This is a schematic diagram of the fusion analysis method described in this invention.
[0031] Figure 2 This is a schematic diagram of the AES system security control structure according to an embodiment of the present invention.
[0032] Figure 3 This is a network security data flow diagram of the AES system as described in an embodiment of the present invention. Detailed Implementation
[0033] To make the objectives, technical solutions, and advantages of this invention clearer, the following embodiments will be used in conjunction with the accompanying drawings to further illustrate the invention. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
[0034] Reference Figure 1 The following uses the Automatic Emergency Steering (AES) system as an example to explain in detail the implementation process of this invention:
[0035] Step 1: Define system-related items, define functional design specifications, and define system assets;
[0036] Within the Operational Design Condition (ODC) range, the Automatic Emergency Steering (AES) system is activated by the driver or the system itself. The AES controller collects real-time information on surrounding vehicles and roads via cameras, millimeter-wave radar, and V2X. Based on the speed and distance of surrounding vehicles and the feasible area of the road ahead, it makes decisions by sending a collision warning signal to the Human-Machine Interface (HMI) to alert the driver or sending a lane-changing steering angle command to the steer-by-wire system to initiate a lane change. When the system exceeds the ODC range, the AES controller deactivates the lane-changing function, sends a takeover request signal to the HMI to alert the driver to take over the vehicle, and sends a braking torque request signal to the braking control module to initiate deceleration and braking. The system's assets include the economic value of the system components' hardware and software, as well as information on users and other road users.
[0037] Step 2: Hazard and Operability Analysis (HAZOP);
[0038] Based on the system's relevant definitions, the system's functions and assets mainly include: system activation, automatic emergency lane change, driver authority transfer, and system property. Now, a HAZOP analysis is performed on the Automatic Emergency Lane Change (AES) system, including the failure modes of the functions and the loss of property.
[0039] Table 1 HAZOP Analysis Table
[0040]
[0041] Step 3: Establish the system security control structure;
[0042] Based on the system defined in step 1, a system security control structure is established, as follows: Figure 2 As shown, it mainly includes the main control loop, the human-machine interaction loop, and the environmental interaction loop.
[0043] The main control loop supports closed-loop control of the vehicle's automatic emergency lane change, completing the entire chain of scheduling from environmental perception to action execution. Cameras, radar, and V2X transmit external environmental information to the perception module, which then integrates and outputs the perceived information to the decision module. The decision module generates trajectory planning and control parameter commands, which are then transmitted to the control module. Finally, the control module issues execution commands to the steering and braking systems to complete the emergency lane change function.
[0044] The human-machine interface loop enables collaborative control between the driver and the system, achieving information exchange and permission coordination for human-machine co-driving. The driver inputs their operating intentions to the control system and HMI through the pedals and steering wheel. The HMI transmits driver commands to the decision-making module and simultaneously receives warning signals from the decision-making module and feeds them back to the driver. The execution status of the control system is also synchronized to the HMI.
[0045] The environmental interaction loop senses the external environment and adapts to the physical driving conditions, connecting the vehicle with the external environment for information and physical interaction. Cameras, radar, and V2X collect information on driving scenarios and traffic participants and transmit it to the perception module. GPS and IMU (Inertial Measurement Unit) transmit vehicle position and attitude information to the positioning module. At the same time, the steering and braking systems drive the vehicle body and tires, completing physical interaction with the road surface and aerodynamics and providing feedback on the status.
[0046] Step 4: Map the network security data flow graph structure of the system;
[0047] Map the components of the system security control structure established in step 3 to elements in the data flow graph structure. The specific component mappings are shown in Table 2. The data flow graph after component mapping is as follows: Figure 3 As shown in the figure, the circles, rectangles, and arrows represent processes, interactive entities, and data flows, respectively. The direction of the arrows indicates the transmission direction of the data flow. The dashed lines represent the boundary between the AES system and the outside world, describing the boundary between the AES system and the interactive entity.
[0048] Table 2 Mapping Control Structure Components to Data Flow Graph Elements
[0049]
[0050] Table 3 STRIDE Analysis Table of Data Flow Graph Elements
[0051]
[0052] Table 3 shows an example of STRIDE analysis for data flow diagram elements. STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
[0053] Step 5: Identify unsafe control behaviors and analyze their causes;
[0054] In this embodiment, the control action of the control unit sending steering commands to the steering system is demonstrated and analyzed. Unsafe control behaviors that could lead to vehicle-wide damage are identified through STRIDE potential threat identification, including analysis of the control unit's sending of steering commands to the steering system (providing but not needed, failing to provide, providing incorrect commands, providing commands too early / too late), and analysis of the cybersecurity attributes of the control unit's sending of steering commands to the steering system. The table of unsafe control behavior analysis and potential threat identification is shown in Table 4.
[0055] Table 4 Analysis of Unsafe Control Behaviors and Identification of Potential Threats
[0056]
[0057] Further causal analysis of unsafe control behaviors is conducted to identify component failures leading to these behaviors, as well as potential deficiencies in expected functional safety and triggering conditions. A causal analysis table for unsafe control behaviors can be found in Table 5.
[0058] Table 5. Analysis of the causes of unsafe control behaviors
[0059]
[0060] The above analysis comprehensively identifies eight types of hazard events (H1-H8) in the AES system caused by component failure (functional safety), functional limitations (expected functional safety), and network attacks (network security), providing complete input for the design of subsequent security measures.
[0061] The technical innovation of this invention lies in:
[0062] 1. Constructing a unified three-dimensional security framework: This invention breaks through the limitations of existing methods that can only cover at most two dimensions of functional safety, expected functional safety, and network security. It deeply integrates the requirements of three standards: ISO 26262 (functional safety), ISO 21448 (expected functional safety), and ISO / SAE 21434 (network security), and establishes a unified analysis framework for "synchronous identification of potential hazards across all dimensions," thus completely solving the problems of coverage blind spots and repetitive work caused by traditional decentralized identification.
[0063] 2. Innovative Multi-Step Linkage Technology Path: This invention designs a progressive process of "system definition → HAZOP analysis → safety control structure construction → data flow graph mapping → unsafe behavior and cause analysis". Through HAZOP analysis, the basic number of vehicle-level hazards is identified. Based on the system safety control structure, the module association and control loop are clarified. Then, a network security analysis carrier is built through data flow graph mapping. Finally, by combining unsafe control behavior classification and STRIDE threat identification, the invention achieves a progressive and accurate identification of three types of hazards: "fault-related, functional limitation-related, and network attack-related".
[0064] 3. Establishing mapping rules between control structure and data flow diagram: This invention proposes a clear element mapping logic, which standardizes the mapping of core components such as sensors, controllers, and actuators in the system security control structure into four types of elements in the network security data flow diagram: process, data flow, storage, and interaction. This provides a standardized bridge for the correlation analysis of network security threats with functional safety and expected functional safety hazards, and solves the technical pain point of the disconnect between the three security dimensions analysis.
[0065] 4. Integrating a multi-dimensional cause-based precise tracing mechanism: Based on the identification of unsafe control behaviors, this invention simultaneously realizes three-dimensional cause tracing of component failures (functional safety category), insufficient expected functional safety (non-failure scenario category), and network attacks (network security category), clarifying the root cause type and triggering conditions of various hazards, providing complete input for the targeted design of subsequent safety measures, and improving the accuracy of safety protection of intelligent driving systems.
[0066] The above embodiments are merely preferred embodiments of the present invention and should not be considered as limiting the scope of the present invention. All equivalent variations and improvements made within the scope of the present invention should still fall within the patent coverage of the present invention.
Claims
1. A method for identifying potential hazards of an advanced intelligent driving system oriented to converged security, characterized in that Includes the following steps: 1) System-related item definition, functional design specifications and system asset definition: Clarify the core functions of the system, the usage scenarios and scope of the functions, the logic of function activation and intervention takeover, and define the system assets; 2) Hazard and Operability Analysis (HAZOP): Traverse the system functions and assets defined in step 1), analyze the attributes of functions and assets, perform failure mode analysis on functions and loss analysis on system assets according to the attributes of functions and assets respectively to identify vehicle-level hazards, deduce possible hazard events based on vehicle-level hazards, and complete the identification of vehicle-level hazard events. 3) Establish a system safety control structure, including elements such as sensors, controllers, control signals, feedback signals, actuators, drivers, and the external interactive environment; 4) Mapping the network security data flow graph structure: Mapping the elements of the system security control structure to the four types of elements in the network security data flow graph: process, data flow, storage, and interaction. 5) Identify unsafe control behaviors and analyze their causes; analyze unsafe control behaviors of control actions and deduce hazardous events; identify component failures that lead to unsafe control behaviors and potential deficiencies in expected functional safety and triggering conditions; use the STRIDE method to identify network threats and deduce potential hazards on the network security data flow graph structure.
2. The potential hazard identification method for a high-level intelligent driving system oriented towards integrated safety as described in claim 1, characterized in that... In step 1), the core functions of the system include automatic steering, automatic braking, automatic acceleration, and handover of driving authority; the system assets include technical assets composed of software and hardware components, as well as privacy assets composed of user and traffic participant information.
3. The potential hazard identification method for a high-level intelligent driving system oriented towards integrated safety as described in claim 1, characterized in that... In step 2), the forms of functional failure include unexpected loss of function and unexpected provision of function. Unexpected provision of function specifically includes premature provision, late provision, excessive provision, insufficient provision, reverse provision, and unnecessary provision. The types of asset loss include theft of technical assets and leakage of privacy assets. The hazardous events include personal injury and system loss. System loss includes impact on vehicle control, economic property loss, and privacy leakage.
4. The potential hazard identification method for a high-level intelligent driving system oriented towards integrated safety as described in claim 1, characterized in that... In step 3), the specific steps for establishing the system security control structure are as follows: 3.1) Deconstructing the key modules of the system: The core elements that make up the system are deconstructed into layers, mainly including the control body such as the autonomous driving domain controller, the perception layer multi-source sensor cluster, the actuator cluster, the driver interaction module and the external interaction environment; 3.2) Clearly define the functions of each module and the relationships between modules; 3.3) Control loop closed-loop construction: Based on the decomposition of elements, three types of core control closed loops are identified: the main control loop is a closed loop of sensor-controller-actuator-feedback; the human-machine interaction loop is a closed loop of driver input-system recognition-HMI interaction-driver response; and the environmental interaction loop is a closed loop of external environment-sensing sensor-vehicle body-actuator. 3.4) Define the signal transmission protocol and interaction logic for each loop.
5. The potential hazard identification method for a high-level intelligent driving system oriented towards integrated safety as described in claim 1, characterized in that... In step 4), the mapping relationship is specifically as follows: sensors, controllers, and actuators are all mapped to processes and storage in the network security data flow graph; control signals and feedback signals are all mapped to data flows in the network security data flow graph; and the driver and external interactive environment are all mapped to interactive entities in the network security data flow graph.
6. The potential hazard identification method for a high-level intelligent driving system oriented towards integrated safety as described in claim 1, characterized in that... In step 5), unsafe control behaviors are specifically provided but not required, failed to be provided, provided incorrectly, or provided too early or too late.
7. The potential hazard identification method for a high-level intelligent driving system oriented towards integrated safety as described in claim 1, characterized in that... In step 5), the STRIDE method includes six threat types: forgery, tampering, denial, information disclosure, denial of service, and privilege escalation. Threat identification is carried out for the interaction, process, data storage, and data flow of the network security data flow graph.
8. The potential hazard identification method for a high-level intelligent driving system oriented towards integrated safety as described in claim 1, characterized in that... In step 5), the cause analysis includes component failure analysis, expected functional safety deficiency analysis, and network attack analysis. The specific types of component failure analysis are interface failure, MCU failure, power failure, software failure, and communication failure. The specific types of expected functional safety deficiency analysis are hardware performance limitations, algorithm scenario limitations, and vehicle limitations. The specific types of network attack analysis are availability breach, integrity breach, and authenticity breach.