In-vehicle cyber security: How should we respond?

The need for in-vehicle cybersecurity

Cyber security for cars? We understand this when it comes to computers and smartphones, but is it really necessary to think about cybersecurity when it comes to cars? I think there are many people who feel this way.However, for example, newly opened roads are reflected in the car navigation system, traffic information and the latest news are displayed because the data is updated regularly by accessing the Internet via wireless communication. This is because we do. In this way, if cars handle digital data and systems and communicate with the outside world in the same way as smartphones, you can feel that cyber security measures are necessary for cars as well.

In addition, each function of the car is electronically controlled by an ECU*, and each ECU is connected through a communication line. Therefore, if an ECU is infiltrated from the outside using one ECU as an entrance, other ECUs can be accessed through the communication line, and in the worst case scenario, it may lead to life-threatening situations such as steering wheel control being hijacked. . If you think about things like this, I think you will realize its importance even more.

*ECU＝Electric Control Unit

Regulations regarding in-vehicle cyber security

Recent years regarding in-vehicle cybersecurityUNECE* WP.29I think we are seeing the word more and more often.UNECE WP.29became the World Forum for Harmonization of Automobile Standards, which was established for the purpose of internationally harmonizing automobile safety standards and environmental standards. We will harmonize environmental standards internationally, improve the efficiency of standard creation and inspection work, and promote the spread of safe and environmentally friendly automobiles.It is a subordinate organization of the United Nations Economic Commission for Europe, which was established for the purpose of promoting the European Union.

*United Nations Economic Commissionfor Europe

InUNECE WP.29(5.1.2), two regulations related to in-vehicle cybersecurity,UN-R155andUN-R156, were agreed upon. If you want to know more about WP.29,UN-R155,UN-R156, please check out this article.

WP.29 Necessity of compliance with UN-R155/UN-R156 regulations

UNR155: Cyber Security Management System (CSMS)

UNR156: Software Update Management System (SUMS)

Requirements in the WP.29 regulation

Macnica is an official distributor of Infineon and Etas

There are twomain requirements that form the basis of the WP.29 regulation, and even though it simply states that cybersecurity measures must be taken, there are actually many things that need to be addressed.

Therefore, compared to the traditional development flow, we have briefly summarized what needs to be done and when to respond to cybersecurity. At Macnica Techster Company, we can introduce solutions from both hardware and software aspects.

Responding to in-vehicle cyber security

In addition to the traditional development flow, here is a diagram that briefly summarizes what needs to be considered and addressed when responding to cybersecurity.

Example of normal development flow

Example of development flow compatible with cybersecurity

①CSMS certification

CSMSstands for Cyber Security Management System, andits purpose is to manage company-level vehicle security, such as corporate ITsecurity and manufacturing departmentIT security. CSMS has three main requirements: ``management of company-wide security policy and supply chain,'' ``appropriate processes for taking cybersecurity measures during product development,'' and ``vulnerabilities during product development and operation.'' "Processes for monitoring and handling" are required. It is also necessary to develop human resources to deal with cybersecurity within the company.

At Aetas, wecan offer a variety of security-related consulting services, including security training to improve your cybersecurity level, operational support for building aPSIRT to respond to incidents, and regulatory compliance.

Aetas Cyber Security Management System (CSMS)

②Vehicle type certification

This will be a technical project-level product security response, with the objectives of developing secure vehicles, detecting and responding to security incidents in the vehicle fleet, and ensuring safe and secure software updates.

HSM(Hardware Security Module), which is often heard in relation to security atthe automotiveECU level, performs encryption and digital signature processing, but by using a microcomputer equipped withHSM, encryption processing can be performed much faster.ECUs requiring security measures are equipped withmicrocomputersequipped withHSMto prevent tampering with in-vehicle software and communication data, and to prevent updates of malware and unauthorized software, etc., and it is necessary to address this from both the hardware and software sides of security, and Macnica can propose solutions that address cybersecurity from both the hardware and software sides.

hardware:

Infineon develops, manufactures, and sells the industry's highest-spec microcontrollers that support in-vehicle security. In particular, the AURIX ™ 2G series, which supports ASIL-D and EVITA Full, is equipped with an HSM and is required for security. We have a track record of use in various ECUs.

software:

Etas has multiple security solutions for in-vehicle ECU level security. In particular, ESCRYPT security software products help customers reduce their development time and enable security measures to be taken from a variety of angles.

Products compatible with in-vehicle cyber security

hardware solutions

Microcontroller with built-in security function

Infineon mainlyhas a lineup of 3 series of automotive microcontrollers.

Please take a look at our lineup page, which provides a detailed introduction to the applications you can consider for each product.

Infineon's automotive microcontroller lineup

software solutions

Etas has a lineup of various security-related products, but here we will introduceCycurHSMandCycurLIB, which are directly related to semiconductors, among the onboard security installed in vehicles.