Modern vehicles are no longer merely mechanical systems but are monitored and controlled by various electronic systems. Safety-critical systems of connected vehicles become vulnerable to cyberattacks because of increasing interconnection. At present, the security risk analysis of connected vehicles is mainly based on qualitative methods, while these methods are usually subjective and lack consideration for functional safety. In order to solve this problem, we propose in this paper a security risk analysis framework for connected vehicles based on formal methods. Firstly, we introduce the electronic and electrical architecture of the connected vehicle and analyze the attack surfaces of the in-vehicle safety-critical systems from three levels of sensors, in-vehicle networks, and controllers. Secondly, we propose a method to model the target of evaluation (i.e., in-vehicle safety-critical system) as a Markov decision process and use probabilistic computation tree logic to formally describe its security properties. Then, a probabilistic model checker PRISM is used to analyze the security risk of target systems quantitatively according to security properties. Finally, we apply the proposed approach to analyze and compare the security risks of the collision warning system under a distributed and centralized electrical and electronic architecture. In addition, from a practical point of view, we propose a Markov model generation method based on a SysML activity diagram, which can simplify our modeling process. The evaluation results show that we can have a quantitative understanding of the security risks at the system level in the early stage of system design.

中文翻译：

---

互联车辆安全关键系统的安全风险分析方法

现代车辆不再仅仅是机械系统，而是由各种电子系统进行监控。由于互连性的提高，联网车辆的安全关键系统容易受到网络攻击。目前，对联网车辆的安全风险分析主要基于定性方法，而这些方法通常是主观的，缺乏功能安全性的考虑。为了解决这个问题，本文提出了一种基于形式化方法的车联网安全风险分析框架。首先，我们介绍了互联车辆的电子和电气架构，并从三个级别的传感器，车载网络和控制器分析了车载安全关键系统的攻击面。其次，我们提出了一种将评估目标（即车载安全关键系统）建模为马尔可夫决策过程的方法，并使用概率计算树逻辑来正式描述其安全属性。然后，使用概率模型检查器PRISM根据安全属性对目标系统的安全风险进行定量分析。最后，我们采用提出的方法来分析和比较在分布式和集中式电气和电子架构下的碰撞预警系统的安全风险。另外，从实际角度出发，我们提出了一种基于SysML活动图的马尔可夫模型生成方法，可以简化建模过程。