One-Way AV Subsystem Segregation With Restricted User Backchannel
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Autonomous vehicles are vulnerable to cybersecurity threats through user devices, which can serve as entry points for malicious users to gain unauthorized access to critical AV subsystems due to the limitations of software-based firewalls and the potential for code injection.
Innovation Solution
Implementing a one-way communication link, such as a one-way data diode, to segregate AV subsystems from user devices, combined with a limited backchannel for transmitting predefined code words, ensuring that data flow is restricted from user devices to AV subsystems while allowing controlled communication in the opposite direction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a two-way communication link is used between user devices and AV subsystems, then ease of operation and user interaction are improved, but cybersecurity vulnerability increases due to potential unauthorized access and code injection
Solution Approach 1:
The communication link is segmented into two separate one-way channels: a forward channel allowing data transmission from AV subsystems to user devices, and a restricted backchannel allowing only predefined code word transmission from user devices to AV subsystems. This segmentation eliminates the security vulnerability of two-way communication while preserving essential interaction capabilities.
Solution Approach 2:
Predefined code words serve as intermediaries for communication from user devices to AV subsystems. Instead of allowing free-form data transmission, the system uses a limited set of approved code words that act as safe mediators, enabling user input while blocking malicious code injection attempts.
2Device complexity
If software-based firewalls are used to protect AV subsystems, then device complexity is reduced, but cybersecurity reliability deteriorates due to potential firewall bypass and code injection
Solution Approach 1:
The software-based firewall is replaced with a hardware-level one-way communication link. This physical constraint at the hardware level provides inherent security without relying on software filtering mechanisms, effectively substituting a mechanical/physical security layer for a software-based approach.
3Reliability
If a one-way communication link is implemented to block data transmission from user devices, then cybersecurity is improved, but ease of operation deteriorates due to limited user input capability
Solution Approach 1:
Instead of completely blocking all communication from user devices, the system implements partial action by allowing a limited set of predefined code words through the backchannel. This provides just enough user input capability for essential interactions while maintaining security, avoiding the excessive restriction of a complete block.
Data Source
AI summary
Malicious users (or hackers) can take advantage of user devices on or communicably connected to an autonomous vehicle (AV) to gain unauthorized access to AV subsystems (e.g., AV compute system, AV sensors, AV controls system, and AV cabin system). To address this concern, a one-way Ethernet communication link can be placed between the AV subsystems and the user devices. The one-way communication link can physically ensure that the user devices may only receive content from the AV systems, and that the user devices may not send data to the AV systems on the one-way communication link. A feature-limited backchannel that may be normally used for transporting audio data on a daisy-chained bus can be used by the user devices to transmit (8-bit) code words that correspond to specific messages to convey messages back to the AV systems.