By Alois Kliner, VP automotive & IoT manufacturing, Utimaco

Alois Kliner, VP automotive & IoT manufacturing, Utimaco

The connected car has been around for some time. But now a new paradigm is emerging in which the many disconnected systems of modern day vehicles, often made by different manufacturers, is replacing the numerous Electronic Control Units (ECUs) with a small number of HPC High Performance Computers that function more like a phone.

These ‘software-defined vehicles’, or SDVs can carry out anything an existing connected vehicle can but being a single system onto which software ‘apps’ can be installed in a similar way to a smartphone. This is an exciting arena but it does throw up the possibility of cybersecurity threats to vehicles, with potentially fatal attacks on vehicles. While a hack of a person’s phone or computer could compromise their payment or persona information, a hack of a vehicle could disable its brakes or take over the steering.

With this in mind, let’s look at the benefits of software-defined vehicles and how they are being made secure against the current generation of automotive cybersecurity threats.

SDV – the future of motor vehicles

88% of the UK population uses a mobile phone, with that number estimated to rise to 95% by 2025. We have become used to the layouts of Android and iOS devices and in a relatively short time they have gone from a novelty to a necessity. We rarely think about the security on these devices, even though they are usually no more or less secure than desktop computers, which tend to have digital security such as firewalls and virus protection built in. Many of the security threats affecting mobile devices are essentially platform-agnostic: phishing emails, hijacked sites and so on.

With such high penetration the app-based, frictionless aesthetic of mobile devices has made its way into many other parts of life, most notably Smart TVs and connected vehicles. For many years this interface was essentially emulated – vehicles would have touch screens with different functions arranged into apps, and although these apps would be updated wirelessly, they couldn’t be updated unless it was through a car manufacturer’s own ‘walled garden’ app store.

The move to software-defined vehicles changes this and has profound implications for how drivers interact with their vehicles and for the security of those vehicles. Early motor vehicles were entirely mechanical, barely different from steam trains, and as they developed over the course of the twentieth century even though they incorporated more electrical components they were chiefly defined by their hardware – bigger engines, lighter alloys, two seats instead of four. A software-defined vehicle has features that are defined by more than just its physical hardware – it can have features ‘unlocked’ by subscribing to new services. Having a vehicle’s systems built around a single interoperable stack also means that individual components can ‘talk’ to each other: the car’s navigation system can check the battery to see whether there is enough charge to make a journey, and if not what the options are for charging, for instance.

Security is essential

There are many examples of when all the connected systems are in a single stack and use a single language to allow interoperability, a security vulnerability in one area could potentially affect all others. In 2022, an attacker manipulated a power steering ECU by modifying its firmware, and was able to brute-force the ECU authentication. In the same year a cybersecurity researcher exploited a vulnerability in a popular third-party app and gained access to all of the functions of 25 vehicles around the world.

This is why vehicle manufacturers and the OEMs they work with are working with organisations to incorporate next-generation key management and other enterprise-grade cybersecurity systems into vehicles and the software ecosystem that supports them. It’s also why there are standards like ISO 21434 and UNECE WP.29 R155 that ‘establish a common language for communicating and managing cybersecurity risk’.

Key management is particularly important: components are kept up to date through Firmware Over The Air (FOTA) updates. Using asymmetric encryption for in-car communication significantly strengthens the vehicle’s defenses against counterfeit updates. Similarly, device attestation is a vital part of keeping a vehicle secure: it allows individual devices to show that they are authentic, something which is vital in a vehicle.

These are just a few examples of the digital security systems that will be keeping vehicles secure as they increasingly become SDVs – and we have yet to mention the issues around quantum cybersecurity. It is time for OEMs, vehicle manufacturers, fleets and even drivers to start taking vehicle cybersecurity seriously.

• Utimaco is a global platform provider of cybersecurity and compliance solutions and services, with headquarters in Aachen (Germany) and Campbell, CA (USA).