Security Challenges and Defense Opportunities of Connected and Autonomous Vehicle Systems in the Physical World

Recently, the technologies underneath the transportation system are under rapid revolution. At the individual vehicle level, Autonomous Driving (AD) technologies are now a reality, where a wide variety of commercial and private AD vehicles are already driving on the road. At the vehicle communication level, Connected Vehicle (CV) technologies enable Vehicle-to-Everything communications and can help the vehicles and infrastructure make more informed driving/control decisions. To facilitate driving automation and traffic control, these Connected and Autonomous Vehicle (CAV) technologies are highly security-critical as errors in them can cause various road hazards and even fatal consequences. Despite being security-critical, the security research in this domain is still largely insufficient in that (1) they mostly focus on individual AI component-level without considering the impact on the CAV systems, and (2) defensive studies, which are practically more important to advance the CAV technologies, are largely under-explored. My dissertation aims to address these two limitations in three general directions. First, I conduct security analyses with the consideration of security challenges at the CAV system level. My research focuses specifically on the security challenges imposed by CAV's reliance on physical world information, e.g., sensor attacks and physical world attacks, and systematically study their impact on the operation of the whole CAV system. Second, I design practical defenses against existing attacks leveraging the rich physical world information available in the CAV systems. Based on the offensive and defensive studies, my dissertation demonstrates that the reliance on the physical-layer information (e.g., sensor data, road information) inevitably introduce new security challenges (e.g., localization and perception errors) for CAVs, yet, it can also provide practical defense opportunities against existing attacks. Finally, I systematize the existing research efforts in AD security in the past 5 years and identify the important scientific gaps in prior works and propose potential solution directions