Formalising UPTANE in CSP for Security Testing

Kirk, Rhys; Nguyen, Hoang Nga; Bryans, Jeremy; Shaikh, Siraj Ahmed; Evans, David; Price, David

doi:10.1109/qrs-c55045.2021.00124

Cited by 5 publications

(5 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Blockchain technology: Blockchain was first used in Bitcoin [8] . Due to its decentralized and non-tamperable characteristics, the application of blockchain technology has now extended to many fields such as digital finance, Internet of Things, intelligent manufacturing, supply chain management, and digital asset transactions.…”

Section: Relavent Knowledgementioning

confidence: 99%

“…Uptane framework: The Uptane framework is a flexible, multi-layered in-vehicle software online update security system framework that supports user OTA customization and can prevent attackers from causing many types of damage to the vehicle [6] [7] [8] . The Uptane framework maintains a mirror library and a command library, which can issue different update data to different cars at the same time, meeting the needs of the automotive industry for customizable updates.…”

Section: Relavent Knowledgementioning

confidence: 99%

See 1 more Smart Citation

Blockchain-based Uptane optimization framework

2024

International Conference on Signal Processing and Communication Security (ICSPCS 2024)

View full text Add to dashboard Cite

In recent years, the application of wireless communication technology has been developing from mobile smartphones to the automotive industry. The number of software configured on intelligent connected cars and the number of open network ports are increasing day by day, so they face more network security threats than traditional cars. The automotive software update framework not only needs to have high security and high performance, but also requires the framework to have customizable functions to meet the OTA (Over The Air, over the air upgrade) customization needs of car users. In order to improve the security of the framework while reducing the operating overhead of the framework on the vehicle side, and the framework has customizable functions, After analyzing and studying the Uptane framework, an optimization plan based on blockchain technology is proposed. Design a blockchain verification algorithm with low overhead for hierarchical verification and sub-regional verification, Improve the framework's protection capabilities after key leaks.

show abstract

Section: Relavent Knowledgementioning

confidence: 99%

Section: Relavent Knowledgementioning

confidence: 99%

Blockchain-based Uptane optimization framework

2024

International Conference on Signal Processing and Communication Security (ICSPCS 2024)

View full text Add to dashboard Cite

show abstract

“…-Req. 6: "If any step fails, the ECU shall return an error code 2 -deny installation of updates that is doing a denial of service (DoS), which we hereby denote G std.…”

Section: Uptane's System and Security Assumptionsmentioning

confidence: 99%

“…Possibly the "reference paper" on Uptane is [10] which describes it even before the standard documents were as they are today. A simplistic security analysis using the oldfashioned CSP formalism can be found at [2]; no vulnerabilities of interest are reported. Non-academic security reviews have been carried out by the Uptane Alliance [11], and there is one line [12] on supply-chain attacks.…”

Section: Related Workmentioning

confidence: 99%

“…2. Uptane Components (figure adapted from [2]) components shown in Figure 2, and it describes each of them and the protocols they need to follow such that a software update gets from an OEM to an ECU. c) Overview of Uptane's Design Flow: Without yet detailing the Uptane's mechanisms, we preempt that the Uptane end-to-end updates are based on cryptographic primitives and protocols.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Formally Verifying the Security and Privacy of an Adopted Standard for Software-Update in Cars: Verifying Uptane 2.0

Boureanu

2023

2023 IEEE International Conference on Systems, Man, and Cybernetics (SMC)

View full text Add to dashboard Cite

In this paper, we formally analyse the security of Uptane 2.0 -the latest version 1 of a framework for overthe-air (online) delivery of software to cars. We are doing so by using the threat model and security requirements found in standard document that accompanies Uptane 2.0, as well as a modulation of this threat model and requirements added by ourselves, for a deeper analysis. To undertake this verification, we use the well-known formal protocol-verifier and theorem prover called Tamarin. We discuss our responsible disclosure to and work with the Uptane Alliance.

show abstract