COnceptualising Secure CArs (COSCA)

COSCA is a European project selected in the H2020 competitive selection N° 825618 - NGI_TRUST 2nd Open Call - 2019002. The duration of the project is one year.


COSCA outputs a conceptual Framework for car security, drivers’ privacy and trust enhancement, thus orienting the Next Generation Internet at its core.

Innovatively taking a socio-technical approach, the COSCA Framework rests on crowdsourced drivers’ perceptions and hence is rooted in the human beings that are actual users of the car technologies. COSCA also adopts a GDPR-inspired classification of the data collected by cars and treated by manufacturers, paying particular attention to cases that treat special categories of data such as biometric data.

Upon such bases, COSCA conducts a risk assessment exercise inspired to an ISO/IEC methodology conveniently tailored for car security risks and drivers’ privacy risks. The outcome of this exercise offers a compact yet expressive view of the security measures that would be necessary to mitigate the found risks and improve the car technologies, ultimately producing a more trustworthy system that combines, at least, car and driver.

Such improvements will be discussed and systematically classified within the COSCA Framework, notably for what pertains to the necessary security protocols, techniques to manage cryptographic material and relevant threat models. Additionally, the Framework will extend on the human-computer interfaces to enable drivers to consciously express their informed consent to data treatment and then exercise their rights, such as access and erasure.

The COSCA Framework will be publicly accessible, flexible and extensible. It means that it will offer researchers and practitioners a benchmark for their work. For example, a protocol designer could check whether a protocol withstands one of the threat models provided by the Framework. An engineer could focus on technologies as indicated by the risk assessment exercise or straight by people’s perceptions classified in the Framework. Moreover, everyone may make pull requests to extend the Framework, which the proponents plan to maintain by seeking additional funding at national and EU level.


Modern cars host highly developed technologies, such as infotainment systems and e-call boxes, routinely connected to the Internet. This increases the possible attack surface, and a number of examples of remotely hijacked cars exist. Cars may also collect drivers’ (or passengers’) personal data, hence privacy becomes a concern.

The overall objective of COSCA is the conceptual development of a Framework that classifies all relevant elements in support of car security and drivers’ privacy. It will not be sheer technical exercise but, rather, be rooted in drivers’ perceptions, data classification and risk assessment. It will be publicly accessible, flexible and extensible.

The main aim of COSCA is to conceptualise car security. The aim is reached through 4 objectives:

1 - Summary of modern car drivers’ privacy perceptions and trust concerns

There would be limited use in addressing a problem that drivers did not feel. Despite a few recent headlines on attacks to real cars, there is limited literature demonstrating how drivers feel about their privacy in their cars and what level of trust they pose e.g. in the interconnected infotainment.

2 - Classification of types of data treated by modern car manufacturers

Android Auto is perhaps the best example demonstrating the integration of cars with the Internet. A scenario could leverage a hacked car. We must understand and gather what types of (personal) data categories cars are collecting - and their manufacturers are treating - notably if these include special categories according to Regulation (EU) 2016/679, known as GDPR.

3 - Assessment of car security risks and drivers’ privacy risks

Risks must not be presupposed, they must be assessed. This is especially true for risks affecting car security and drivers’ privacy. A structured, standard risk assessment methodology ought to be used to qualitatively assess such risks, then prioritise them and ultimately mitigate them.

4 - Conceptual framework for car security and drivers’ privacy

Notably, the relevant literature features a few prototypes of security protocols over CAN bus communication as well as a few realistic proofs of concept on possible attacks. However, a holistic view of the subject matter and its security and privacy problems is currently not available. The COSCA framework will provide that view.


The development of COSCA is described by the following deliverables:

1 - Drivers’ privacy concerns & trust perceptions

2 - Classifying data collected by cars

3 - Cybersecurity risk assessing per car brand

4 - COSCA framework for securing modern cars


Who is working on it?

Gianpaolo Bella

Giampaolo Bella

Project Coordinator and UNICT Site Leader

Professor Giampaolo Bella holds a Cambridge University Computer Laboratory Ph.D. and post-docs at Technische Universität München and Cambridge University. He has been with the University of Catania since 2001, seconded through the years with De Montfort University and SAP Research France. He is currently Visiting Professor at Royal Holloway University of London. His main research area is cybersecurity, data protection and their socio-technical aspects.

Pietro Biondi

Pietro Biondi

UNICT team member

Pietro Biondi is a PhD student in Computer Science at the University of Catania. He obtained his Master's Degree in Computer Science (summa cum laude) in July 2019 at the University of Catania. His degree thesis, supervised by Professor Giampaolo Bella, concerned the study, design and implementation of a security protocol on the CAN bus called TOUCAN. From 2018 he holds a position as a junior researcher with CNR, focusing on topics related to automotive security under the supervision of Dr. Gianpiero Costantino and Dr. Ilaria Matteucci. Pietro Biondi has produced a few scientific papers on this field.

Giuseppe Tudisco

Giuseppe Tudisco

UNICT Team Member

Giuseppe Tudisco is a student at the Department of Mathematics and Computer Science of the University of Catania. He graduated with a Bachelor's degree in Computer Science (summa cum laude) in March 2019 at the University of Catania. Currently, he is collaborating on COSCA Framework for his Master's degree in Computer Science (Network and Security Systems) under the supervision of Professor Giampaolo Bella and Dr. Pietro Biondi.

Gianpiero Costantino

Gianpiero Costantino

CNR Site Leader

Dr. Gianpiero Costantino is a researcher at the Italian National Research Council (CNR). Currently, he has been working for the Trustworthy and Secure Future Internet group within the Institute of Informatics and Telematics (IIT) located in Pisa. From November 2007 to March 2011 he was a Ph.D. student at the University of Catania. He is co-author of about fifty scientific papers. He has more than 10 years’ experience in cyber-security research and in particular, in the last five years has focused on Automotive Cyber-security.

Ilaria Matteucci

Ilaria Matteucci

CNR team member

Dr. Ilaria Matteucci (M.Sc. 2003, Ph.D. 2008) is a researcher of the Trustworthy and Secure Future Internet group within the Institute of Informatics and Telematics of CNR. Her main research interests include formal methods for the synthesis of secure systems, analysis of data sharing in service-oriented architectures and policies on personal data privacy. Currently, the research interest is focused on Automotive Cyber-Security, with particular reference to security properties of the CAN-bus protocol and possible vulnerabilities of Android Radio.

Mirco Marchetti

Mirco Marchetti

UNIMORE Site Leader

Professor Mirco Marchetti (M.Sc. 2005, Ph.D. 2009) is with the Department of Engineering “Enzo Ferrari” of the University of Modena and Reggio Emilia. Mirco Marchetti has been working in the area of automotive cybersecurity for the last four years. Research results in this field include several scientific papers on intrusion detection, attack prevention and reverse engineering applied to automotive in-vehicle networks, as well as industrial research projects carried out with automotive industries.