Quantitative Security Assurance Case for In-vehicle Embedded Systems

Technological advances are transforming the automotive industry by increasing the number of computer-controlled auto components that provide information to remote systems through various means of communication. The changes have created new opportunities for cyber-attacks. To enable the engineering of in-vehicle embedded systems within road vehicles to keep up with changing technology and attack methods, in this year, ISO and SAE will jointly release the international standard ISO/SAE 21434. However, to date there are few studies about how to apply the standard to academia and industry. To fill this gap, the paper proposes an approach to develop assurance cases for cybersecurity argument of road vehicle in compliance with ISO/SAE 21434. We analyze the standard, and then propose a model-based approach to automotive cybersecurity assurance. After that, case studies are carried out to verify the effectiveness of the proposed method. Finally, the paper is concluded by discussing the limitations and future directions of the study.