  The in-vehicle diagnostic and software update system, which supports remote
diagnostic and Over-The-Air (OTA) software updates, is a critical attack goal
in automobiles. Adversaries can inject malicious software into vehicles or
steal sensitive information through communication channels. Therefore, security
analysis, which identifies potential security issues, needs to be conducted in
system design. However, existing security analyses of in-vehicle systems are
threat-oriented, which start with threat identification and assess risks by
brainstorming. In this paper, a system-oriented approach is proposed on the
basis of the System-Theoretic Process Analysis (STPA). The proposed approach
extends the original STPA from the perspective of data flows and is applicable
for information-flow-based systems. Besides, we propose a general model for
in-vehicle diagnostic and software update systems and use it to establish a
security analysis guideline. In comparison with threat-oriented approaches, the
proposed approach shifts from focusing on threats to system vulnerabilities and
seems to be efficient to prevent the system from known or even unknown threats.
Furthermore, as an extension of the STPA, which has been proven to be
applicable to high level designs, the proposed approach can be well integrated
into high-level analyses and perform co-design in different disciplines within
a unified STPA framework.
