In dem Paper beschreiben die Wissenschaftler eine formale und praktische Sicherheitsanalyse der Middleware Scalable service-Oriented MiddlewarE over IP (SOME/IP) - einer Software, die heute in vielen Autos eingesetzt wird, um die Kommunikation in unseren hochmodernen Fahrzeugen zu ergänzen. Neben der Sicherheitsanalyse identifizieren sie mögliche Angriffsszenarien und schlagen zwei Sicherheitserweiterungen vor.

Abstract:  
Automotive Ethernet is increasingly used in modern vehicles and complements or replaces legacy bus systems such as CAN. Ethernet also enables service-oriented communication with the Scalable service-Oriented MiddlewarE over IP (SOME/IP) middleware. In this paper, we present a formal and practical security analysis of Scalable service-Oriented MiddlewarE over IP (SOME/IP), the identified Man-in-the-Middle (MITM) attacks, and propose two security extensions. The attacks are possible even if SOME/IP is used in combination with link layer security mechanisms. The attacker can impersonate a service offering server and a service consuming client. The two most common communication methods, request/response and publish/subscribe, are both vulnerable. In most communication scenarios, we are able to route all messages over the attacker. Our security extensions for authentication and authorization of service provisioning and usage protect against these attacks. We formally analyze the security and evaluate the overhead with practical implementations.

PDF des Papers

Die ARES 2021 wurde vom 17. bis 20. August als virtuelle Konferenz durchgeführt.