Harness: Transparent and Lightweight Protection of Vehicle Control on Untrusted Android Automotive Operating System

As modern in-vehicle infotainment (IVI) systems become more advanced and feature-rich, their complexity increases, expanding the attack surface. Since IVI systems often support vehicle controls, attackers can exploit their vulnerabilities to gain control of the car, posing a dangerous threat to property and personal safety. In this paper, we systematically analyze the attack surface of the Android Automotive Operating System (AAOS). We identify risks across the vehicle control chain, from the human-machine interface through relevant apps and services to the in-vehicle network communication. To prevent these risks, we propose Harness, a lightweight framework that transparently protects vehicle control from untrusted AAOS. Harness defines a minimal protection domain encompassing trusted software with permissions to perform security-critical vehicle control. Leveraging the hypervisor's capabilities, Harness isolates this domain from AAOS and protects its interactions with the external environment, ensuring vehicle control operations align with user intent. We implement Harness, and our evaluation shows it achieves security guarantees with only modest performance overhead.