Why it’s better to be overprotected
Many of us have so much on our plates, it becomes difficult to balance everyday work tasks, which means people focus on what is happening right now, and not what could happen in the future. This “I’ll deal with it when it happens” mentality may be okay for some situations, but when it comes to vehicle security, you’d be taking a huge risk. Many companies are unwittingly waiting to be hacked rather than designing-in optimal security now.
Let’s take a step back and look at why vehicle security is needed now:
- Vehicles equipped with Internet connectivity have become ubiquitous and need protection against unauthorized access. This connectivity is a portal for hackers to access vehicle systems and manipulate the vehicle’s behavior.
- Electronic control units (ECUs) are the backbone of in-vehicle communication and vehicle control systems and therefor need robust protection from the outside world.
- As cars become increasingly more automated, end-to-end protection is needed to secure all points of the connected environment (e.g., intrusion detection systems, automotive firewalls, secure OTA software updates, secure V2X).
Not just talk – hacking happens!
Many have heard of the famous hack on a Jeep through the cellular system. But while that may be one of the most well-known incidents, it’s by no way the only one.
Hackers aren’t the only consideration. New vehicle security regulations such as ISO/SAE 21434 and UNECE WP.29 are planned and will be in place soon – another reason to be prepared now rather than sitting back and waiting. This is especially true if the U.S. or other countries follow the lead of upcoming European standards that begin places requirements on OEMs in 2022. The time to be prepared is now.
A step in preventing hackers
Hardware security modules (HSMs) are physical computing devices in a vehicle controller which safeguard and manage digital keys, perform encryption and decryption functions for digital signatures and more. They create a strong root of trust based on certificates – they are the key pillar to an effective vehicle security system.
Again, while you may not think you need a robust HSM now, think about the functionality ECUs already have, or will have in the near future. For example, look at over the air (OTA), also referred to as firmware over the air (FOTA), a process of updating software without requiring the vehicle to be physically connected to a system at the dealership. With OTA, a vehicle can receive software updates while it’s sitting in the consumer’s garage. Check out this article and video showing thousands of parked Teslas confirming receipt of an OTA update.
OTA is a great convenience, but it comes with risks because it’s opening a pathway to the vehicle. If hackers can access this pathway, dangerous results could ensue: the vehicle could be programmed for any nefarious maneuver, like sharp turns at high speeds or turning off the brake system entirely. And while critical vehicle systems (e.g., powertrain, brake) may have security measures, software-based protection could be overwritten. A robust HSM acts as the gatekeeper and protector of OTA updates by securing the information coming into the vehicle wirelessly.
A robust HSM available today
ESCRYPT’s CycurHSM links existing hardware security peripherals to the relevant HSM and host controller applications, while implementing a comprehensive cryptographic library on the HSM. And while each OEM is addressing software updates differently, CycurHSM has an existing track record of authenticating software coming into the vehicle. Benefits include:
- Modular: a toolbox approach for a high degree of customization
- User-friendly: seamlessly integrates into automotive ECUs
- Fast: based on a real-time operations system to ensure real-time HSM features
- Comprehensive: encapsulates all required security functions to satisfy OEM security requirements
- High-quality standards: ASPICE, ISO 26262, ASIL D
- Secure: powerful hardware/software co-design platform for customer-specific applications with high-performance cryptographic demands
The last listed benefit, secure, is key when considering OTA. But remember, OTA isn’t the only way a hacker can get access to the vehicle. Bluetooth, cellular, wifi – these are all available portals for hackers. A CycurHSM root of trust can protect all access to the vehicle.
So, if you are thinking “I don’t do OTA/FOTA, so I don’t need anything that comprehensive”, remember we really don’t know the full capabilities of hackers…if your ECU is on a communication bus, then it is vulnerable. Hackers are actively trying to gain access to vehicles. What blocks them today, may not work tomorrow. With all this in mind, do you still think doing only what’s needed today is worth damaging your reputation or brand or worse, putting the safety of drivers at risk?
We don’t think so. That’s why ESCRYPT experts have been developing security solutions such as CycurHSM for over ten years. Our solutions are found in millions of vehicles around the world. To learn more about how we can add your vehicles to that list, please contact us.