Verification of Integrity in Vehicle Architectures

The draft version of ISO 21434 demands, among others, the verification of the car architecture with respect to the enforcement of the security goals. We present a distinct definition of integrity as a system property as well as a formal modeling and analysis approach to verify integrity in a given architecture. Thereby, we discuss the idea of integrity levels as well as security measure levels as metrics to represent a functions worthiness of protection and the reduction of risk, respectively. We present how the beneficence of security measures may be ranked for gaining the global security measure levels. We assign those levels to the system parts and interpret integrity as a global information flow problem. Formal properties enforce the relation between the integrity levels of a function and the assigned security measure level as well as between the communication links and the receiver functions. The relation between communication functions and functions in the same unit of isolation are enforced to follow the policy of no command-up.