Rules and Guidelines
Want to participate in the discussions? Please read our Community Rules and Guidelines. Need some help? Visit Support and Answers.

  • State Not Answered
  • Locked Locked
  • Replies 13 replies
  • Subscribers 17 subscribers
  • Views 2222 views
  • Users 0 members are here
Options
You may also be interested in
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Automotive Cyber Security

Deborah-Claire McKenzie
Connected vehicles have numerous potential benefits for convenience, safety, travel time and access to mobility, and the features that deliver these have become essential selling points. Advances in autonomy will increase the number and types of connections and travellers’ reliance upon them. In 2020, most new vehicles are connected vehicles and many have online connections to safety-critical systems, putting them at risk of deadly hacks. It’s not clear that the automotive industry is fully equipped to deal with this and they may even be deceiving the public about their lack of preparedness.


In response to these challenges, the new UNECE WP.29 type approval regulations for cybersecurity and over-the-air (OTA) updates enter into force in January 2021. The cybersecurity management standard ISO/SAE 21434 “Road Vehicles – Cybersecurity Engineering” is also hotly anticipated next year. But is the industry ready?

Stepping up in this connected world is a major challenge for the established automotive industry and Intelligent Transport Systems (ITS) providers. A number of these challenges can’t be solved without addressing deep-rooted issues such as reluctance to collaborate, a lack of specialised security talent, and engineering processes that don’t consider security throughout the lifecycle.


The ARTS TN have organised a webinar on Automotive Cyber Security on 21 October 2020 at 11.00hrs BST. Ahead of the webinar we’d like to hear your views on the following questions:


•    How well are automotive and ITS businesses positioned to deal with security in their products and services? 

•    What do the various industries need to do to create conditions where security can be assured by design throughout the lifecycle of their products and services? 

•    What are the gaps, how big are they, and what capabilities are needed to address them?


If you have other questions that you’d like to post here, we will also consider these for discussion by our experts in the Q&A panel during the webinar.

Parents
  • 0
    We've now had responses from David Evans, IDIADA.to the remaining questions that we didn't get around to covering on the webinar. 

    Q: Why does the communication technology have to be vehicle specific? Why not utilise the user's mobile phone for the connection method?
    David: The mobile phone does not have the same level of access to the vehicle's internal network, you could argue that a phone could be connected (e.g. Bluetooth) and act as a 'gateway' but that doesn't really help with the benefits that peer to peer (ad hoc) communication with nearby vehicles can do... Possibly 5G will make this possible, but I think introducing a mobile phone into a potentially safety critical part of the vehicle could cause more problems.


    Q: Do you consider the current Internet architecture to be reliable for V2X? Or do we have to create an "Internet of the Future" for that?
    David: It's a complex challenge and an increasingly growing market, I would argue there' probably more IoT devices deployed than vehicles on the road. It's certainly a challenge for the supporting infrastructure, and there's a lot of work being done on projects like H2020 C-Mobile + C-ROADS on this type of activity.

    Q: Are the CAM and DENM protocols free software? Where can I find to do some tests?
    David: The latest specifications for CAM and DENM are available here and in this location as well..

    Q: Will the V2X technology require bespoke legislation and how does / will that affect the design and development of the system? Has current legislation hampered what you would like to include within the system?
    David:  Possibly, with the introduction of new regulations for automotive cybersecurity / Over the air updates it has to be considered. You get into an interesting point about sharing GPS data with nearby infrastructure (as needed by ETSI ITS G5 CAM message), you cross a line whether you share this information with the overarching road authority to help improve the traffic and (potentially) safety benefits.

    Q: Why are you sending a false vehicle position?
    David: The whole basis of CAM (and other V2X messages) was to share 'where you are' and 'where you are going' with other nearby vehicles + infrastructure to enable safety applications. GNSS has been demonstrated countless times to be susceptible to attacks and vulnerabilities and I wanted to show a simple example where this could be manipulated somewhere in between the vehicle's GNSS module and the V2X module within the vehicle. In the case of the SecureIoT project, a vehicle insurer may be interested in knowing what you were 'telling' other vehicles at the point of a crash, or otherwise, to better understand an accident.

    Q: Given the existing vulnerabilities around GPS, 4G, WiFi etc. Has the automotive industry already seen cyber-attacks? When do we anticipate the tipping point? when will automotive cyber-attacks will become more prevalent.
    David: I believe there has been several attacks publicised, the attack on the Jeep Cherokee by Miller and Valasek  is possibly the most well-known (www.wired.com/.../), We're seeing a lot more Linux based OS' in vehicles now, I've seen several lower end vehicles using open source  libraries (e.g. to display a picture from a memory card) of which vulnerabilities have been discovered several years into the vehicle's production run. It's a constant challenge for the automotive industry, and hopefully with the introduction of ISO/SAE 21434 + regulations from UN ECE, this will be a positive step towards accountability and clear responsibility to address these issues when discovered.

    Q: I thought SATNAV uses GPS tracking which is classed in this case as personal data.
    David: Yes, but you're using that service (and presumably provided consent for this). In the case of V2X, will this be mandated that a vehicle 'must' use this (and as a consequence) share information (anonymised or not) with nearby infrastructure and other vehicles?


    It would be good to see your further comments on these posts. 


    If you didn't manage to register for the webinar, you can still watch it OnDemand.
Reply
  • 0
    We've now had responses from David Evans, IDIADA.to the remaining questions that we didn't get around to covering on the webinar. 

    Q: Why does the communication technology have to be vehicle specific? Why not utilise the user's mobile phone for the connection method?
    David: The mobile phone does not have the same level of access to the vehicle's internal network, you could argue that a phone could be connected (e.g. Bluetooth) and act as a 'gateway' but that doesn't really help with the benefits that peer to peer (ad hoc) communication with nearby vehicles can do... Possibly 5G will make this possible, but I think introducing a mobile phone into a potentially safety critical part of the vehicle could cause more problems.


    Q: Do you consider the current Internet architecture to be reliable for V2X? Or do we have to create an "Internet of the Future" for that?
    David: It's a complex challenge and an increasingly growing market, I would argue there' probably more IoT devices deployed than vehicles on the road. It's certainly a challenge for the supporting infrastructure, and there's a lot of work being done on projects like H2020 C-Mobile + C-ROADS on this type of activity.

    Q: Are the CAM and DENM protocols free software? Where can I find to do some tests?
    David: The latest specifications for CAM and DENM are available here and in this location as well..

    Q: Will the V2X technology require bespoke legislation and how does / will that affect the design and development of the system? Has current legislation hampered what you would like to include within the system?
    David:  Possibly, with the introduction of new regulations for automotive cybersecurity / Over the air updates it has to be considered. You get into an interesting point about sharing GPS data with nearby infrastructure (as needed by ETSI ITS G5 CAM message), you cross a line whether you share this information with the overarching road authority to help improve the traffic and (potentially) safety benefits.

    Q: Why are you sending a false vehicle position?
    David: The whole basis of CAM (and other V2X messages) was to share 'where you are' and 'where you are going' with other nearby vehicles + infrastructure to enable safety applications. GNSS has been demonstrated countless times to be susceptible to attacks and vulnerabilities and I wanted to show a simple example where this could be manipulated somewhere in between the vehicle's GNSS module and the V2X module within the vehicle. In the case of the SecureIoT project, a vehicle insurer may be interested in knowing what you were 'telling' other vehicles at the point of a crash, or otherwise, to better understand an accident.

    Q: Given the existing vulnerabilities around GPS, 4G, WiFi etc. Has the automotive industry already seen cyber-attacks? When do we anticipate the tipping point? when will automotive cyber-attacks will become more prevalent.
    David: I believe there has been several attacks publicised, the attack on the Jeep Cherokee by Miller and Valasek  is possibly the most well-known (www.wired.com/.../), We're seeing a lot more Linux based OS' in vehicles now, I've seen several lower end vehicles using open source  libraries (e.g. to display a picture from a memory card) of which vulnerabilities have been discovered several years into the vehicle's production run. It's a constant challenge for the automotive industry, and hopefully with the introduction of ISO/SAE 21434 + regulations from UN ECE, this will be a positive step towards accountability and clear responsibility to address these issues when discovered.

    Q: I thought SATNAV uses GPS tracking which is classed in this case as personal data.
    David: Yes, but you're using that service (and presumably provided consent for this). In the case of V2X, will this be mandated that a vehicle 'must' use this (and as a consequence) share information (anonymised or not) with nearby infrastructure and other vehicles?


    It would be good to see your further comments on these posts. 


    If you didn't manage to register for the webinar, you can still watch it OnDemand.
Children
No Data

Community Rules & Guidelines