Functional Cybersecurity: Standards and Concepts

A modern vehicle is a networked computer that happens to have wheels. Driver assistance, infotainment and smartphone integration have turned the car into a dense mesh of hardware and software, and every convenience that mesh provides is also a surface through which a safety-critical component can be reached. The engineering question is no longer whether a vehicle can be attacked, but how the risk is contained across an entire product lifecycle.

This paper examines that question from three directions: the standards that govern functional cybersecurity in the automotive industry, the design concepts that limit the damage a fault or an intrusion can do, and the modules in modern software platforms that implement those concepts in production vehicles.

Standards

Three internationally recognised standards are examined, along with the relationship between them.

ISO 26262, “Road vehicles: Functional safety”. Ten years in development and published in 2015, with the current revision dating to 2018, it adapts the general electrical and electronic standard IEC 61508 to the automotive domain. Its most consequential contribution is the Automotive Safety Integrity Level scheme, which classifies functions and systems across four grades from ASIL A to ASIL D and drives the requirements and validation that follow. The paper argues that its real significance lies in a shift of perspective, away from a binary reading of risk and towards a detailed probabilistic assessment, which yields more precise requirements and a more efficient development process.

SAE J3061, “Cybersecurity Guidebook for Cyber-Physical Vehicle Systems”. Published in 2016, it borrows the framework of ISO 26262 but takes a more pragmatic and more readily adaptable approach. Its concept phase runs through seven steps, at the centre of which sits the threat analysis and risk assessment, the activity that identifies potential threats and evaluates the risks attached to them.

ISO/SAE 21434, “Road vehicles: Cybersecurity engineering”. The paper treats a common industry baseline as the mechanism by which any of this raises the security level in practice, rather than the standards operating in isolation.

Concepts for risk reduction

Six concepts drawn from ISO 26262 are set out with worked automotive examples: plausibility checks, fault detection, fault handling, graduated functional degradation, diverse programming and redundancy.

The example that carries the argument concerns graduated degradation. A component that is entirely uncritical while the vehicle is stationary may be highly critical in motion, which is why an over-the-air update may only proceed in a standstill or maintenance state, and why the vehicle returns to operation only once the update has been verified. The counter-example is a transmission sensor that fails and reports that a shift into reverse is available while the vehicle is travelling forwards at speed, an outcome that correct parameter logic is meant to make impossible.

Diverse programming is treated with similar candour. Developing the same function twice through different people, languages or toolchains removes a single point of failure, and no developer may test and release their own software, but the overhead is considerable enough that it should be applied selectively rather than everywhere.

Platform security modules

The final section turns to AUTOSAR and the mechanisms available to implementers.

Module	Role
Crypto Stack	Cryptographic primitives and keystores behind uniform interfaces, so access is controlled and portable across ECUs
SecOC	Authenticity and integrity for in-vehicle communication, detecting spoofing, manipulation and replay attacks
TLS	Authenticated, encrypted channels to external services
IPsec	Encryption and authentication of IP packets on the on-board network

The treatment of SecOC is the most pointed. In-vehicle communication has historically carried almost no security at all: classic CAN offers CRC functions and checksums, which provide no meaningful protection, and its eight-byte payload is too small to carry a message authentication code that can be verified in full. CAN FD, with sixty-four bytes available in a data frame, removes that constraint and makes complete MAC verification possible. The cost is network complexity, with consequences for topology, speed and efficiency that are far from trivial.

The limits of each mechanism are stated plainly. SecOC guarantees authenticity and integrity but not confidentiality. TLS supports unicast messages only and carries enough timing overhead that it suits time-uncritical applications, having been available in both AUTOSAR Classic and Adaptive since the end of 2018.

Abstract

Modern vehicles offer the driver and occupants a wide range of functions. From advanced driver assistance systems through to complex infotainment systems with smartphone integration, modern vehicles have long since become more than purely mechanical means of transport. The high-technology transformation of the automobile brings numerous advantages, along with new opportunities for attacks on the vehicle infrastructure. The integration of vehicle systems creates a complex network of hardware and software with access paths to components that are in some cases highly vulnerable and safety-critical. Through the use of fundamental concepts for risk minimisation, of system architectures conducive to security, and of the security modules and functions provided by modern software platforms, security can be assured throughout the development process and maximised for the end product. Current standards for functional cybersecurity, such as ISO/SAE 21434, can contribute considerably to improving the level of security by establishing a common basis within the automotive industry. Securing highly integrated embedded systems is essential if vehicle safety is to be assured in future.

@techreport{golombeck2019cybersicherheit,
  author      = {Golombeck, Marius},
  title       = {{Funktionale Cybersicherheit: Standards und Konzepte}},
  institution = {University of Applied Sciences and Arts Dortmund},
  address     = {Dortmund, Germany},
  year        = {2019},
  month       = oct,
  language    = {german},
  doi         = {10.13140/RG.2.2.13195.92961/1},
  url         = {https://www.researchgate.net/publication/345431821}
}