Threat Analysis and Risk Assessment with Cybersecurity Countermeasures for Over-the-Air Enabled Lane Keeping Assist

With rapidly advancing technology, the automotive industry is undergoing a major development and transformation. Through the development of Advanced Driver Assistance Systems (ADAS), vehicles became smart devices within internet connection. As a consequence of this serious cybersecurity vulnerabilities and risks increased in connection with vehicle complexity. The ISO/SAE 21434:2021 standard covers cybersecurity threats, risks, and the implementation of security measures to be developed against these risks. The main aim of this study is to identify cybersecurity vulnerabilities that may exist during over-the-air (OTA) update process of the lane keeping assist (LKA) control module, to determine the risk levels security goals and security countermeasures. OTA update process is a system update that enables all ADAS functions, particularly LKA, to receive software improvements wirelessly and securely. The LKA control module is an ADAS function that keeps the vehicle in the lane by making corrections to the steering with the help of cameras and sensors. This paper represents potential cybersecurity threats that may arise during OTA updates on the LKA control module and focuses on measures to prevent these threats. Also, in this study contains item boundaries, preliminary architecture for an LKA functionality in the context of OTA-update consideration, threat analysis and risk assessment (TARA) and measures based on cybersecurity goals. This TARA study includes 17 asset identification, 35 damage scenarios, determination of impact ratings, 37 threat scenarios, attack path analysis, attack feasibility rating, risk value and cybersecurity assurance level (CAL) in the light of ISO/SAE 21434:2021. The results of this study, 8 cybersecurity goals and 20 countermeasures were determined against possible threats which are mentioned in a limited manner. This paper identifies security vulnerabilities and countermeasures, evaluates the cybersecurity risks, and provides precautions.