M2SIM Phase II

As the complexity and interconnectivity of modern automotive systems continues to grow, ensuring the security of electronic control units (ECUs) has become a crucial concern for manufacturers and end users. This proposal presents a comprehensive FPGA-based emulation platform for automotive ECU security analysis, which allows researchers to conduct a wide range of security analyses based on various attacks against various targets present in automotive ECUs. The M2SIM system offers several unique features, including the ability to ensure that vulnerabilities present in the digital twin are found in real systems. This is achieved by comprehensive test suites that accurately simulate the behavior of real-world ECUs and networks, and a mechanism to validate their presence in real systems, ensuring that security analyses conducted on the platform are as accurate and reliable as possible with quantifiable measures and outputs including confidence scores. In addition, the M2SIM system is designed to be accessible to a wide range of users, regardless of their technical expertise. For example, the technical barrier of designing and creating emulators in FPGA/SoC is lowered with templated FPGA components that can be easily configured and assembled in a low/no-code environment. The system is designed to feature a software-only experience for end-users, providing dedicated low/no-code interfaces for various roles and functions. The separation of roles is intended to securely silo operations by user roles, access control, and permissions, resulting in a maintainable solution that can be used by a diverse range of users, as a modern, reliable, scalable, flexible, and maintainable modular microservices architecture. M2SIM will result in an instrument available for use by Army Ground Vehicles, hosting a library of ECU systems for analysis, along with the ability to generate and customize attack workflows and pipelines. This ensures that researchers have access to a broad range of automotive ECUs and networks, enabling them to conduct in-depth security analyses on a variety of systems. Finally, the system offers maximal deployment flexibility, with plans to make it available as a (self-contained) handheld unit for fielding opportunities in future phases. This will enable researchers to conduct on-site security analyses and assessments, further enhancing the effectiveness and usefulness of the system.