Securing a Software-Defined Future in the Automotive Sector

For decades, cars have been equipped with multiple connected electronic control units (ECUs) that manage various functions like entertainment, route finding, and engine controls. To prevent unauthorized access, each of these components with external connections requires security measures, resulting in a complicated network of overlapping security systems that may contain weaknesses.

In 2022, an ethical hacker successfully manipulated the firmware of a power steering ECU by employing brute force techniques to bypass its authentication. This concerning breach posed a significant threat by granting potential control over the steering of multiple vehicles that rely on the same system. To mitigate such risks, it is crucial for vehicle manufacturers and OEMs to prioritize the incorporation of next-generation key management and enterprise-grade cybersecurity systems into vehicles and their supporting software ecosystem. This imperative is further reinforced by recognized standards such as ISO 21434 and UNECE WP.29 R155, which establish a common language for effective communication and management of cybersecurity risks.

The automotive industry is shifting towards a new paradigm where multiple disconnected systems made by different automotive manufacturers are being replaced by a smaller number of high-performance computers. These software-defined vehicles (SDVs) function similarly to a smartphone and can run any software app while presenting as a single system.

As a result, the increase in cybersecurity threats to vehicles has been a concern to manufacturers of connected vehicles, as it has been possible for some time to launch attacks that could result in fatal consequences such as disabled brakes or loss of control. Manufacturers of modern vehicles must consider automotive cybersecurity a critical concern, as a serious breach that could severely impact their reputation.

Securing SDVs

When a vehicle's connected system is distributed across multiple ECUs (Electronic Control Units), there is an increased risk of vulnerabilities in individual ECUs. However, it becomes challenging for intruders to transition from one vulnerable system to another, especially if they store sensitive information or control critical functions. Conversely, if all connected systems operate on a unified language and exist within a single stack, a security vulnerability in one area has the potential to impact all others.

Effective cryptographic key management (not just your physical car keys) is crucial in maintaining the security of connected vehicles. Regular firmware over-the-air (FOTA) updates present a potential vulnerability for malicious actors to distribute harmful software to numerous vehicles. The utilization of asymmetric encryption for in-car communication substantially boosts the vehicle's security, particularly in safeguarding against fraudulent updates. By employing this encryption technique, which involves the use of public and private key pairs, the vehicle's communication channels can be fortified, ensuring that only authorized and trusted sources can initiate updates.

Device attestation is an important aspect of ensuring vehicle security. It enables devices to prove their authenticity, which is crucial in a vehicle. The threat posed by a malicious actor creating a virtual device connected to an SDV is a critical concern. With this capability, the attacker could manipulate the vehicle's system and provide false information, such as indicating that the brakes are engaged or that the engine temperature is within a safe range, even when it is actually overheating. This malicious deception could lead to dangerous situations, compromising the safety and reliability of the vehicle's operation. It emphasizes the urgency for robust security measures and stringent authentication protocols to prevent unauthorized access and mitigate the risks associated with such activities.

In summary

Recent high-profile incidents have underscored the utmost importance for vehicle manufacturers and OEMs to fortify their security measures, including the implementation of robust authentication protocols and advanced defenses against unauthorized access. This necessitates a proactive approach, characterized by constant vigilance and the adoption of comprehensive cybersecurity strategies. Crucially, incorporating robust key management practices becomes instrumental in safeguarding vehicles, guaranteeing driver safety, and preserving the integrity of the entire vehicle ecosystem.

Cryptomathic is a leader in key management and cryptography, providing strong cryptography-based solutions that can help the automotive industry secure its data and operations. Read more about our key management and crypto agility solutions or contact us to discuss your requirements.