Vehicle ECU On-Board Diagnostic system Threat Analysis and Risk Assessment

This article presents a security assessment of the on-board diagnostic (OBD) system integrated into a vehicle's electronic control unit (ECU), specifically targeting the Unified Diagnostic Services (UDS) protocol. The research focuses on a representative Battery Management System (BMS) ECU for electric vehicles within its operational context. The study aims to evaluate security vulnerabilities across all OBD functionalities and propose risk mitigation strategies for software implementation. A Threat Analysis and Risk Assessment (TARA) was conducted following the ISO/SAE 21434 standard for road vehicle cybersecurity engineering. The authors identified seven primary assets requiring protection and defined 11 damage scenarios. Furthermore, feasibility ratings were calculated for 18 attack paths involving both physical and wireless OBD interfaces. Based on the assessment, the authors recommend specific software enhancements to mitigate the identified cybersecurity threats.