Der Weg zu einer verbesserten Cybersicherheit in der Automobilbranche

Das moderne Auto ist ein komplexes, vernetztes Gerät. Es bietet zwar mehr mögliche Dienste und Funktionen, ist aber auch zahlreichen Schwachstellen in der Cybersicherheit ausgesetzt. 

Rechtlicher Rahmen und Leitlinien

SAE J3061: Cybersecurity Guidebook for Cyber-Physical Vehicle Systems – a framework for designing and evaluating cybersecurity measures in the development process. It introduces concepts like the Cybersecurity Lifecycle (CSL) and recommends practices for risk assessment, threat analysis, and incident responses.

ISO/SAE 21434: Road vehicles – Cybersecurity engineering – specifies requirements for cybersecurity risk management. It includes design and development, production, operation, maintenance, and decommissioning of electrical and electronic systems in vehicles. This includes passing the cybersecurity requirements down the automotive supply chain to tier-1 and below suppliers.

NHTSA Cybersecurity Best Practices: The National Highway Traffic Safety Administration (NHTSA) issued best practices for improving motor vehicle cybersecurity. The recommendations address various aspects of cybersecurity, like security by design, threat detection and prevention, incident response, and industry collaboration.

UNECE WP.29: A primarily European standard, but compliance is required to sell vehicles into the European Union. The primary regulations of R155 and R156 deal with creating a Cybersecurity Management System (CSMS) and a Software Update Management System (SUMS) respectively.  

Entschlüsselung der PKI in der Automobilindustrie

The frameworks listed above do not specifically mention PKI. However, PKI is critical in documenting a company’s compliance with best practices.  

PKI beinhaltet die Verwendung von privaten und öffentlichen Schlüsseln zur Sicherung der Kommunikation. Im Kontext der Automobilindustrie erleichtert sie den sicheren Austausch von Informationen über verschiedene Bereiche hinweg:

Vehicle-to-Everything (V2X) Communication: This includes Vehicle-to-Vehicle (V2V), and Vehicle-to-Infrastructure (V2I), Vehicle-to-Pedestrian (V2P), Vehicle-to-Home (V2H), etc. V2X is essential for sharing vital information about vehicle operations and road conditions. By leveraging PKI, the devices can ensure the authenticity and trustworthiness of the data exchanged, enhancing safety.

Plug and Charge (PnC) Communication: PnC technology skips the credit card through seamless, automated payments. PKI plays a crucial role in this ecosystem, securing the communications and transactions between vehicles, charging stations, and backend systems (ISO 15118).

Vehicle-to-Cloud (V2C) Communication: V2C is used where data needs to be shared over time and space, such as in remote areas. PKI ensures that data exchanged between vehicles and backend systems is secure and maintains integrity and confidentiality.

Secure Over-the-Air (OTA) Updates: Critical for remote vehicle updates, OTA uses PKI to authenticate data sources and ensure the update is secure and tamper-proof.

Secure Boot: Critical to preventing power-on attacks, secure boot ensures that a vehicle’s software is the latest version and has not been compromised.

Post-Quantum Computing (PQC): Quantum-resistant algorithms are rapidly approaching. The automotive industry will have to update cryptography on existing vehicles, so crypto-agility is necessary for futureproofing. 

Herausforderungen und Lösungen bei der PKI-Implementierung

Die Integration von PKI in Kraftfahrzeugsysteme ist mit einigen Herausforderungen verbunden. Fragen wie Skalierbarkeit, Verwaltung des Lebenszyklus digitaler Identitäten und die Vielfalt des automobilen Ökosystems stellen erhebliche Hürden dar. Die Branche macht jedoch Fortschritte:

Collaborations and Partnerships: Automakers, technology providers, and cybersecurity experts are joining forces to create scalable, secure PKI solutions tailored for the automotive sector.

Open Standards and Protocols: These are crucial for consistent cybersecurity practices across different vehicle brands and models.

Lifecycle Management: Certificate lifecycle managers targeting IoT use cases facilitate remotely managing PKI certificates and trust chains. This ensures dynamic and robust vehicle security over the 10- to 20-year vehicle lifetime, which is critical for post-quantum agility. 

Der Weg nach vorn

In dem Maße, in dem die Grenzen zwischen der Technologie- und der Automobilbranche verschwimmen, wird die Rolle der Cybersicherheit immer wichtiger. PKI bietet einen robusten Rahmen für den Schutz dieser neuen Ära der digitalen Mobilität. Wenn die Automobilindustrie die Komplexität von PKI versteht und sich damit auseinandersetzt, kann sie die Herausforderungen dieser digitalen Transformation effektiv meistern.

The journey towards a secure automotive future is complex but achievable through continued innovation, standardization, and collaboration. For automakers and consumers alike, this paves the way for a future where connected driving is as secure as it is transformative. 

For more insights into issuing and managing secure digital identities for both IoT and Enterprise, contact us at [email protected].