Towards an automated security-by-design approach in automotive system-of-systems architectures

The development of future autonomous vehicles will become a challenging task, especially concerning the integration into a smart city context. Nowadays, vehicles must communicate with the surrounding environment to provide efficient driving features that prevent crashing and thus save passenger lives. However, the constant information exchange with the vicinity leads to growing attack surfaces of vehicles, which endangers the functional safety of vehicles in particular. Security-by-design seems to be a promising approach to overcoming security challenges and will become essential for the development of automotive architectures in the future. Therefore, the standard ISO-21434 was invented providing guidelines on how to tackle cybersecurity in the automotive context. One proposed method by this standard is the Threat Analysis and Risk Assessment (TARA) process used for analyzing cybersecurity threats. Nevertheless, no tools or approaches exist that provide full automation of the TARA process from an ISO-21434 perspective. Therefore, this paper proposes a concept to automate the TARA method by combining the security pattern engineering process with the Automotive Reference Architecture Model (ARAM) to enable a multi-layered security-by-design approach for the development of secure system-of-systems (SoS) architectures in conformity with ISO-21434.