%0 Conference Proceedings
%T Combining Third Party Components Securely in Automotive Systems
%+ Coventry University
%A Cheah, Madeline
%A Shaikh, Siraj, A.
%A Bryans, Jeremy
%A Nguyen, Hoang, Nga
%Z Part 5: Short Papers
%< avec comité de lecture
%( Lecture Notes in Computer Science
%B 10th IFIP International Conference on Information Security Theory and Practice (WISTP)
%C Heraklion, Greece
%Y Sara Foresti
%Y Javier Lopez
%I Springer International Publishing
%3 Information Security Theory and Practice
%V LNCS-9895
%P 262-269
%8 2016-09-26
%D 2016
%R 10.1007/978-3-319-45931-8_18
%K Automotive security
%K Attack trees
%K Secure design
%K Security testing
%K Bluetooth
%Z Computer Science [cs]Conference papers
%X Vehicle manufacturers routinely integrate third-party components and combining them securely into a larger system is a challenge, particularly when accurate specifications are not available. In this paper, we propose a methodology for users to introduce or strengthen security of these composed systems without requiring full knowledge of commercially sensitive sub-components. This methodology is supported by attack trees, which allow for systematic enumeration of black box components, the results of which are then incorporated into further design processes. We apply the methodology to a Bluetooth-enabled automotive infotainment unit, and find a legitimate Bluetooth feature that contributes to the insecurity of a system. Furthermore, we recommend a variety of follow-on processes to further strengthen the security of the system through the next iteration of design.
%G English
%Z TC 11
%Z WG 11.2
%2 https://inria.hal.science/hal-01639623/document
%2 https://inria.hal.science/hal-01639623/file/421627_1_En_18_Chapter.pdf
%L hal-01639623
%U https://inria.hal.science/hal-01639623
%~ IFIP-LNCS
%~ IFIP
%~ IFIP-TC
%~ IFIP-TC11
%~ IFIP-WISTP
%~ IFIP-WG11-2
%~ IFIP-LNCS-9895