#404

Securing the Software-DefinedVehicle

SEC

TABLE OF CONTENTS
Introduction
Executive Summary

Security

Introducing the SDV

In recent years, software has become a mutual focus for many automakers across the industry and around theglobe. Legacy OEMs, automotive brands, and newer start-ups alike are increasingly integrating technologies thatput software first in many areas of the vehicle lifecycle – from its design and core user experience, through to theways it can help maintain and extend the lifecycle.

What’s New?
Secure Chipsets
Secure E/EWhile this focus continues to shift from hardware to software, and from discrete ECUs to advanced computing
systems, new cyber security threats and attack points that exploit their vulnerabilities will be introduced. As such,OEMs and suppliers working with, or producing, a software-defined vehicle must be well equipped to manage newrisks while adopting new mitigation technologies.

Secure Software
Secure Cloud

SBD Automotive’s Securing the Software-Defined Vehicle report takes a detailed, chip-to-cloud look at SDVs. In
doing so, it provides a high-level threat model of a typical SDV architecture and identifies the best practices forpreventing, detecting, and containing malicious cyber security attacks at each layer of the technology stack. For ITand security teams newly supporting the development of a SDV, the report maps out the key differences between
traditional and SDV architectures from a cyber security perspective.

Secure Organizations & Strategy
Go Deeper

RELATED SBD REPORTS
402 – Software Defined Vehicle Forecast
The Software-Defined Vehicle Forecast provides agrounded assessment of the growth enabling SDVtechnologies in different regions and vehicle
segments. Its ten-year forecast understands howmajor OEM groups will deploy future E/E
architecture elements, while assessing how theseelements are expected to evolve. An adjacent Excelversion offers detailed, data-driven, analysis sorted
by brand and country in addition to revenues.

COVERAGE

FREQUENCY

PUBLICATION FORMAT

PAGES

1
NA

CHINA

EUROPEANNUALLYQUARTERLY

ONE-OFFPD F

POWERPOINT

EXCEL

ONLINE

150+

#404/Securing the Software-Defined Vehicle

Key questions answered> What are the fundamental
differences from a cybersecurity point of view
between a traditionalvehicle architecture and anSDV?

> What are the emerging
solutions for securing SDVs
and where are the gaps that
may require further researchand development?

> What new attack points
does an SDV introduce
and how will OEMs needto change their approachto protecting theirvehicles?

> What impact will the shift toSDV have in terms of initialand on-going compliance toUNECE R155?

This research supports

Product Planners

Do I have access?

Cyber

Portal access
IT

Engineering

Request a quote for
Securing the Software-Defined Vehicle
One-Off Report for 2023

2023

404

Securing the Software-Defined Vehicle

Introduction

Introduction

Introduction
The transition towards software defined vehicles is already enabling OEMs to realize
opportunities which could not be achieved with traditional automotive architectures. New
technologies are bringing more features to the vehicle, and also to the OEM businessmodel. Thanks to more advanced software and hardware, the automotive industry canprovide safer features, more convenient operations and a better user experience.
However, at the same time, the automotive security mindset needs to be updated, as therisk of vulnerabilities also increases because of the increasing number of attack surfaces.
Automotive security is already being taken seriously. In recent years, cybersecurity attacks
on vehicles have resulted in serious impact to financial, safety, operational and privacy
aspects. Making the industry aware that building a holistic standard that considers security
in the early project development, and that working across the industry, is vital to protect
vehicles from potential attacks.
Technologies keep evolving, which presents more challenges that stakeholders need toreact to. For example, quantum computing and digital twins' applications are bringing new
security vulnerabilities. Stakeholders need to adopt an agile and comprehensive approachto address incoming threats. In the early phase of product development, the stakeholders
need to adopt a security mindset to conduct the potential threat analysis and deploy
forward-looking security mechanisms.

Content

Bird’s Eye View

A brief overview of the journey to the Software Defined Vehicle,
considering the different layers of the SDV, and SBD’s SDV Report
Series.

ExecutiveSummary

From the security point of view, the chapter evaluates what arethe key approaches considered to follow, the impact, threat,limitation, goals and solutions in each SDV layer.

The Basics

What do you need to know about Software Defined Vehicles?
What does SDV mean to security strategy?

The motivation of attackers comes from various perspectives. New targets now include
private user data and bypassing the FaaS to gain financial benefits. In the foreseeable
future, more forms of attacks will emerge.
This reports discusses the security-related topics for each of the five layers of the SDV.
These are Cloud, Chipset, Software, E/E and Organization & Strategy. The vulnerabilitiesof each layer, potential impacts, source of threats, security goals and what solutions canbe considered for deployment.

AnalysisFive SDV layers (Chipset, Cloud, E/E, Software and Organization &Strategy) analysis, including the cybersecurity assets analysis,impact analysis, threat analysis, limitation analysis, Goals analysis
and Solution analysis.
A simplified TARA modelling is also conducted for reader example

A simplified version of TARA modelling is provided to help cybersecurity engineersconsider various aspects before deciding the best security mechanism.

Next Step

How SBD can help?

Example slides
from the reportBird’s Eye View

High(700K)

Vehicle 4.0 will evolve across the volume and premium segments
Which generation of architectures are used in which market
segment?
Key to Architectures⚫ Vehicle 1.0 ⚫ Vehicle 2.0 ⚫ Vehicle 3.0

VolumeSegment

Vehicle 1.0
CAN based topology
built around agateway module.
May feature MOST or
Flexray for specificfunctions

Vehicle 2.0

Introduction ofsecondary point-topoint high bandwidth
Ethernet channels for
specific functions - forexample connecting amodem toinfotainment

Vehicle 3.0

Sales Volume

Centralized Computeor Functional Domain
High Performance
Compute withdecoupled software, andEthernet being used asa primary network

Vehicle 4.0

Scalable network from distributed
Zonal ‘Switches’ to Zonal
Computes; perhaps with anethernet ring and a smart roof zone
antenna module

BudgetSegment
Premium Segment

E/E Architecture Guide
Right decisions on E/E architecture leads
to increased vehicle safety, security, andsystem usability

Sales PriceHigh($140K)

77Executive Summary

SDV calls for defence-in-depth with a secure by design approach
OEMs need to prioritize security decisions based on the impact of the functions they protect and move away from prioritizing
primarily on attack feasibility. This multi-layered methodology should be the basis for any new vehicle development.
ChipsetMessage-levelprotection

ECU Auth (PUFs)

IAM

Secure Diagnostics

API management

Secure Debug

E/E

SoftwareOrganizationand Strategy

Secure Gateway

App Vetting

Training

Message-level protection

Code Signing

Regulatory
Compliance

Cloud

Secure gateways

mTLS

IP-SEC

Firewall

MAC-SEC

Segregationof networksPenetration testing

Network IPS

Sandbox

Secureboot

DevSecOps

Secure Storage
Crypto agility

AttackPrevent

IAM
Simplify organizational
complexity
Supply chain andopen-source oversight

VSOC

Network IDs

Host IDS

VSOC

Monitoring Resources

Monitoring team

IAM

Cyber team building

VSOC

Network IPS

Host IPS

Cloudcontainerization

V2X isolation

Sandbox

VSOC

Cyber teambuilding

Simplify organizational
complexity
Strong
SIEM
team

IAM
Secure Execution

IAM

DetectContainRegulatorycompliance

Cloud backups

Strong backup/
recovery teamOTA Updates

Simplify organizational
complexity

RecoverCyber team building

OTA Updates

OTA UpdatesCloud backups

VSOC

Penetration testing
Tamper-proof datastorage

8

Penetration testing

OTA team startingwith R156

Fix

Cyber team building

Forensic Storage

Data Forensics team
Cyber team building

Forensics
8

The Basics

New features, software, technologies keep evolving, which requires continuous monitoring

Middleware
Signal-based communication(Classic AUTOSAR) has been
replaced with service-oriented
communication (AdaptiveAUTOSAR), in which new
applications can be easily
integrated into the entiresystem.
For OTA software updates,
Adaptive AUTOSAR provides key
functions for purposefully
updating features andcomponents. Classic AUTOSAR
requires a full update of theapplication software. Adaptive
AUTOSAR supports differentialupdates.

InnovativeTechnologies

Virtualizing
A high-performance computing(HPC) system in E/E
architecture is a centralized
computing platform used toprocess large amounts of dataand perform complex
calculations. Both OEMs andsuppliers are rolling out vehicle
HPCs. The presence of such
HPCs makes this newarchitecture vulnerable forcyber attacks, especially ifstrong security measures are
not thoroughly considered.
Centralized architecture may
unify attackers to focus on thecore

Centralising

Centralized architecture drives
the need for hypervisors.
Hypervisors support multiple
functionalities on the samedevice. Hypervisors allocate
resources to the SDV virtualmachine, providing a
configurable, controllable
interface between applications
and the vehicle.
Known hypervisor vulnerabilities
like device escape and memory
corruption can have catastrophic
effects on the vehicle when the
combination of mixed criticality
functions are running on thesame core.

The technologies enable moreadvanced personalization
features are being implemented
in the vehicles. Biometrics isexpected to be increasingly
implemented in various areas,including vehicle access, user
authentication, shared services,etc, which will expand beyond
the basic safety authentication
functions.
Managing the biometric data is a
new task for security engineers
as the increased privacy
requirement.

Looking forward, stakeholders
need to consider to react tothose emerging technologies,
including quantum computing,
Neuromorphic computing,Affective computing, meshnetworking and 6G, Digital
Twin, satellite networking, etc.
A process to evaluate thepotential impact from thesetechnologies need to beestablished and implement
corresponding technologies tomitigate the risks.

Morepersonalization99

Chipset

Implementing security mechanism on Chipset is not straight-forward
Cyberassets

ImpactThreat1
2
3Complexity of the hardware architecture

No easy fix for Semiconductor Chips

Long lifecycle

Limitation

4

Hard to define the robustness

Automotive SoC with multiple computing islands and heterogenousarchitecture is complex. Complex automotive SoC host powerful software
functionality, which increases system vulnerabilities and threats. The security
spans multiple computing nodes of different design and capabilities on thesame chip. Meanwhile there are significant differences in SoC architecture
at the different level of usage.
Software vulnerabilities cannot be fixed by patching and rebooting once they
have been identified. Cybersecurity implementation in chipset requires aproactive product planning in the early phase of development. This putsa heightened emphasis on the identification and proactive design of strategies
to mitigate potential vulnerabilities. Any chip vulnerability detected by an OEMlate in the design cycle will delay the delivery of vehicles to customers.
Semiconductor chips are designed to maintain functionality for over a decade.
The long lifecycle means a higher cost because security measures must bewell-built to protect against threats that may emerge throughout thechip's operational lifespan.

There is an increasing risk of cyberattacks and unauthorized access. The
performance requirements are being enhanced so the security solution should
be robust. It is difficult for manufacturers to validate the robustness ofthe chipset's cybersecurity countermeasures as the attack method isevolving daily.

Goals

Solutions
105Improved need for cryptographicprocessing

Due to the increasingly large amount of streaming data from sensors andcameras to serve new emerging SDV functionalities, it is hard for only one HSM
in one ECU to handle the whole cryptographic processing. This is due to thehigh security demand on performance. Cryptographic platforms need to process
large amounts of data in a time sensitive-manner.
One option to meet the increasing need is to set several security processing
modules outside HSM and to consider an embed security accelerator on the chip.
10Chipset

The shift to the cloud-trust
Secure Diagnostics
Cyberassets

Cost

If the service tools provided to dealers and 3rd parties have no security mechanism applied, it canbecome a vulnerable point to be attacked. Hackers can utilize the chance to crack the security featuresand reverse-engineer the shared security keys on the tool itself.
One solution is to adopt a cloud-based crypto solution to prevent key sharing and support role-based
authentication. By implementing the end-to-end authentication between the ECU and Cloud, thereliance on diagnostics tools can be further reduced to avoid associated risks.

ImpactSome OEMs are adopting the new ISO standard known as UDS service 0x29, which includes the key
standards of making the diagnostics more secure, for example, the back-end authentication for
diagnostic security access, compared to the older service 0x27 solution that relies on device security.

LowMediumHigh

In development

Ready to use

Maturity
Theoretical

When it fits
Planning

DesignDevelopment

ContainRecoverOperations

Where it fits
Prevent

ThreatAdvantages/strengths

Limitation

Goals

Solutions

DetectFixForensics

Disadvantages/challenges

Reduce the risks associated with thecryptographic keys stored in service tools.

The implementation should consider some otherlegislation, for example, right to repair.

Supports differentiated role-based authentication

Requires a new diagnostics infrastructure to be
deployed globally

Attack resistance

Spoofing:

High

Tampering:

MediumRepudiation:

Low

Information Disclosure:

Low

Denial of Service:High

Elevation of Privilege:

Medium1111

E/E

Threat modelling example – Threat analysis
Damage scenario

Vehicle module storage

C I A

Safety impact resulting from the loss of confidentiality of the vehicle
V2X module storage

MVehicle module storage

C I AOperational and safety impact resulting from the loss of integrity of thevehicle module storage

MVehicle module runtime

C I A

Safety impact resulting from the loss of availability of the vehicle
module runtime

MInterface to HPC

C I A

Operational and Privacy losses resulting from loss of Confidentiality ofdiagnostics interface

V2X wireless interface

C I A

Operational and safety loss resulting from loss of Availability of thevehicle V2X wireless interface

MVehicle Module

C I A

Safety, Financial, Operational and Privacy loss resulting from loss ofIntegrity of the V2X vehicle module

H M H M

HPC communication interfaces

C I A

Safety and Operational loss resulting due to loss of Availability of theHPC comms interfaces

HH

ADAS sensor safety critical data

C I A

Safety and Operational loss resulting due to loss of integrity of theADAS sensor safety critical data

HH

HPC storage

C I A

Privacy losses due to extraction of raw in-vehicle operational data fromthe HPC storage, resulting in loss of confidentiality

HPC runtime

C I A

Safety impact resulting from the loss of availability of the vehicle's HPCruntime

HFaaS

Vehicle configuration

C I A

Safety and Operational impact due to loss of the integrity of thevehicle configuration

HEdge
computingIn-vehicle module

C I A

Safety and Operational impact due to loss of integrity of the Edge
computing in-vehicle module

H M H

AssetsCyberassets

ImpactV2X

ThreatLimitation

HPC
Goals

Solutions12

ImpactAnalysis

Cyberproperties

Impact Analysis – H – High M – Medium L - Low

SCyber Properties – C - Confidentiality, I - Integrity, A - Availability

FOPHH M
HHH12

Request the priceContact Us

Contact SBD Automotive

Do you have any questions?
If you have any questions or feedback about thisresearch report or SBD Automotive’s consulting services,
you can email us at info@sbdautomotive.com or discusswith your local account manager below.

info@sbdautomotive.com

Book a meeting

USAGarren Carr
North America
garrencarr@sbdautomotive.com+1 734 619 7969

14UK

Germany

Luigi Bisbiglia
UK, South & West Europe
luigibisbiglia@sbdautomotive.com+44 1908 305102

Andrea Sroczynski
Germany, North & East Europe
andreasroczynski@sbdautomotive.com+49 211 9753153-1

India

China

Japan

SBD China Sales TeamChina
salesChina@sbdautomotive.com+86 18516653761

SBD Japan Sales TeamJapan, South Korea & Australia
postbox@sbdautomotive.com+81 52 253 6201
14