By Bill Leifheit, Chief Architect and Chief Information Security Officer for Minnesota IT Services (MNIT) MnDOT

As technology evolves and our systems become increasingly connected, the transportation sector is looking to emerging technologies like connected and automated vehicles (CAV) to advance a safer, more equitable, and sustainable society. Minnesota IT Services (MNIT) is building secure CAV foundations to ensure the State of Minnesota can support this important technology, while also maintaining important public safety goals.

Our role is to protect many aspects of the system:

• Confidentiality of the information processed by the technology.
• Integrity of the data inside the system.
• Availability of the system for use by the travelling public.

Our approach – Security by Design – works to protect CAV systems by applying trusted information security principles from the Open Web Application Security Project (OWASP) to a proven and familiar transportation framework used by our transportation partners—the National Architecture Reference for Cooperative and Intelligent Transportation (ARC-IT) version 9.0. 

It is important that we protect CAV systems because they will touch many aspects of our daily lives as we make routine trips in tomorrow’s vehicles. Dropping kids off at school, bringing crops in at harvest time, riding on public transportation, or commuting in electric vehicles— people across Minnesota will all interact with the CAV infrastructure.

When

Minnesota’s CAV Office was founded in 2018, housed in the Minnesota Department of Transportation (MnDOT), to help the state plan and prepare for the future of emerging technologies like CAV. The state’s CAV goals are to harness innovation to advance safety, equity, access, health, mobility, and sustainability. The state’s CAV program is overseen by the Governor’s Advisory Council on CAV and its statewide Innovation Alliance

Jointly led by industry, government, researchers, subject matter experts, community members, and innovators, the Innovation Alliance includes the Connectivity and Data Committee, which focuses on privacy and cybersecurity aspects of connected and automated vehicles.

How Will CAV-X Impact Me?

Our transportation systems serve many, varied needs every day. We think about how each traveler will interact with current and future CAV technology, and what information or services we will need to provide to help communities be safer, advance equity, promote public health, and reduce environmental impacts.

For example, an emergency vehicle driver connects to signals at intersections to rush injured patients to care centers. Commercial vehicle operators need special mapping services to choose the safest route for their deliveries. Other technology alerts passing vehicles of people walking and biking nearby to prevent injuries. These are CAV systems that already exist.

Modern electric vehicles and older cars share our roads, but they send and receive very different CAV data.  Drivers may also have different needs according to their age, driving experience, or mobility capabilities. We must build a system that securely supports the transportation needs of all Minnesotans.

To prepare for this future, the CAV Office and Minnesota IT Services hosted a tabletop exercise to map the journey of various personas interacting with a CAV-ready world. We modeled these personas based on existing traveler research and people who rely on our system, like people who commute to work, parents who drop children off at daycare, or a truck driver making deliveries. We traveled with them virtually through their day and analyzed how they interact with CAV systems, asking:

• How will this persona access our services?
• What security measures will we need to protect those connections?
• What vulnerabilities could bad actors try to find in our systems?
• How might these connections be exploited to access our data or disrupt our systems?

We will leverage the extensive experience of the CAV Innovation Alliance Connectivity and Data Committee to identify potential points of weakness so that we can design a more secure system from the start.

What Are the Next Steps for Securing CAV-X in Minnesota?

Connected and automated vehicle technologies are our future, and that future is coming faster than we may even understand. While private industry is rapidly developing and deploying these technologies, it is important to test the security of CAV systems while we can still plan and design around them. MNIT will work with the transportation professionals in the CAV Innovation Alliance to build even more realistic testing scenarios. Our exercise with these personas will inform and focus these efforts, resulting in a more secure system. 

Minnesota has additional opportunities to test these ideas and technology, including:

• The MnROAD testing facility near Albertville, which hosted automated shuttle demonstrations and extreme cold-weather testing including snow, ice, salt use, and whiteout conditions.
• 3M’s Innovation Center which tests smart signs and pavement markings

The MnDOT Connected Corridor program, which tests CAV technologies like pavement markings and other connected vehicle technologies that help vehicles ‘talk’ to traffic signals, lights, roadside sensors, and other vehicles. Testing corridors include Interstate 94 near Monticello, Highway 55 in Minneapolis, and Highway 52 down to Rochester.

Testing these technologies and our cybersecurity framework will be accomplished using State of Minnesota fleet vehicles, and lessons learned will be incorporated into the 2022 CAV Strategic Plan.

MNIT’s mission is to deliver secure, reliable technology solutions to improve the lives of all Minnesotans. We make that real by partnering with MnDOT and the CAV Innovation Alliance to build a future transportation system that is safe, equitable, accessible, efficient, healthy, and sustainable. We are with them every step of the way.