El automóvil moderno es un dispositivo complejo y conectado. Aunque ofrece más servicios y funciones posibles, también está expuesto a numerosas vulnerabilidades de ciberseguridad.
Marco normativo y directrices
SAE J3061: Cybersecurity Guidebook for Cyber-Physical Vehicle Systems – a framework for designing and evaluating cybersecurity measures in the development process. It introduces concepts like the Cybersecurity Lifecycle (CSL) and recommends practices for risk assessment, threat analysis, and incident responses.
ISO/SAE 21434: Road vehicles – Cybersecurity engineering – specifies requirements for cybersecurity risk management. It includes design and development, production, operation, maintenance, and decommissioning of electrical and electronic systems in vehicles. This includes passing the cybersecurity requirements down the automotive supply chain to tier-1 and below suppliers.
NHTSA Cybersecurity Best Practices: The National Highway Traffic Safety Administration (NHTSA) issued best practices for improving motor vehicle cybersecurity. The recommendations address various aspects of cybersecurity, like security by design, threat detection and prevention, incident response, and industry collaboration.
UNECE WP.29: A primarily European standard, but compliance is required to sell vehicles into the European Union. The primary regulations of R155 and R156 deal with creating a Cybersecurity Management System (CSMS) and a Software Update Management System (SUMS) respectively.
Descifrar la PKI en la industria del automóvil
The frameworks listed above do not specifically mention PKI. However, PKI is critical in documenting a company’s compliance with best practices.
La PKI consiste en el uso de claves privadas y públicas para proteger las comunicaciones. En el contexto de la automoción, facilita el intercambio seguro de información entre distintos ámbitos:
Vehicle-to-Everything (V2X) Communication: This includes Vehicle-to-Vehicle (V2V), and Vehicle-to-Infrastructure (V2I), Vehicle-to-Pedestrian (V2P), Vehicle-to-Home (V2H), etc. V2X is essential for sharing vital information about vehicle operations and road conditions. By leveraging PKI, the devices can ensure the authenticity and trustworthiness of the data exchanged, enhancing safety.
Plug and Charge (PnC) Communication: PnC technology skips the credit card through seamless, automated payments. PKI plays a crucial role in this ecosystem, securing the communications and transactions between vehicles, charging stations, and backend systems (ISO 15118).
Vehicle-to-Cloud (V2C) Communication: V2C is used where data needs to be shared over time and space, such as in remote areas. PKI ensures that data exchanged between vehicles and backend systems is secure and maintains integrity and confidentiality.
Secure Over-the-Air (OTA) Updates: Critical for remote vehicle updates, OTA uses PKI to authenticate data sources and ensure the update is secure and tamper-proof.
Secure Boot: Critical to preventing power-on attacks, secure boot ensures that a vehicle’s software is the latest version and has not been compromised.
Post-Quantum Computing (PQC): Quantum-resistant algorithms are rapidly approaching. The automotive industry will have to update cryptography on existing vehicles, so crypto-agility is necessary for futureproofing.
Retos y soluciones en la implantación de PKI
La integración de PKI en los sistemas de automoción tiene sus retos. Cuestiones como la escalabilidad, la gestión del ciclo de vida de la identidad digital y la diversidad del ecosistema automovilístico plantean importantes obstáculos. Sin embargo, el sector está avanzando:
Collaborations and Partnerships: Automakers, technology providers, and cybersecurity experts are joining forces to create scalable, secure PKI solutions tailored for the automotive sector.
Open Standards and Protocols: These are crucial for consistent cybersecurity practices across different vehicle brands and models.
Lifecycle Management: Certificate lifecycle managers targeting IoT use cases facilitate remotely managing PKI certificates and trust chains. This ensures dynamic and robust vehicle security over the 10- to 20-year vehicle lifetime, which is critical for post-quantum agility.
El camino a seguir
A medida que se desdibujan las líneas que separan las industrias tecnológica y automovilística, el papel de la ciberseguridad se hace más crítico. La PKI ofrece un marco sólido para proteger esta nueva era de movilidad digital. Al comprender y abordar las complejidades de la PKI, la industria de la automoción puede afrontar los retos de esta transformación digital con eficacia.
The journey towards a secure automotive future is complex but achievable through continued innovation, standardization, and collaboration. For automakers and consumers alike, this paves the way for a future where connected driving is as secure as it is transformative.
For more insights into issuing and managing secure digital identities for both IoT and Enterprise, contact us at [email protected].
Suscríbase a The Source
Stay secure with Keyfactor's monthly newsletter, packed with expert insights and practical steps for quantum-readiness.
