Download - Information Access API WebSocket approach
![Page 1: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/1.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
Idea’s for securing the Vehicle Information Access API WebSocket approach
Magnus Gunnarsson
Peter Winzell
![Page 2: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/2.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
Agenda
• UseCases introduction
• WebSocket
• CIA security model
– Mapping of UC’s against CIA model
• Man In the Middle attacks
– Certificate Pinning
• ?
![Page 3: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/3.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
Identified API Use Cases
• Inter-process communication
• Inter-ECU communication
• Internet communication
![Page 4: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/4.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
WebSocket
• Not a HTTP protocol
• Uses HTTP handshake as a bridge.
![Page 5: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/5.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
CIA security model
• Interception Confidentiality
• Interruption
• Modification
• Fabrication Integrity
• Interruption
• Modification
• Fabrication Availability
![Page 6: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/6.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
IPC UC
Websocket Service broker
Vehicle Network publisher
Service 1
Service 2
Service 3
Service 4 Service 5
Service 6
Service n
![Page 7: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/7.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
Inter ECU UC
![Page 8: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/8.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
Internet UC
![Page 9: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/9.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
SSL hijacking one example of a Man-in-the-middle attack
Connect to HTTPS site on 443
Replace HTTPS Content with HTTP Content
Connect to HTTPS site on 443
Provide Server Certificate
Communication in clear text Encrypted Communication
![Page 10: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/10.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
Certificate and Public Key Pinning
• What's pinning: – Pinning is a way to re-use the existing protocols and infrastructure but
to use them in a harden way in order to reduce the incidence of man-in-the-middle attacks due to compromised Certification Authorities.
• When should you pin? – Pinning should be done anytime you want to be relatively certain of
the remote host's identity or when operating in a hostile environment.
![Page 11: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/11.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
Certificate and Public Key Pinning
• How does it work – By knowing something about the remote host you can you do not
need to rely on generalized mechanisms meant to solve the key distribution problem
• What to pin? – Certificate
– Public key
• subjectPublicKeyInfo
• RSAPublicKey or DSAPublicKey
[Certificate and Public Key Pinning, https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#What.27s_the_problem.3F]
[RFC7469, https://tools.ietf.org/html/rfc7469#page-24]
![Page 12: Information Access API WebSocket approach](https://reader030.vdocuments.us/reader030/viewer/2022012615/619dd8a281b2a146731135d5/html5/thumbnails/12.jpg)
© Mitsubishi Electric Corporation
Your company internal use only
Scope for the API Specification