Securing Automotive Data Networks and Sensors

Introduction

As vehicles become more connected and automated, securing the data networks and sensors that enable these capabilities is critically important. In my experience researching and working in automotive cybersecurity, I have found that taking a layered, defense-in-depth approach is key to effectively protecting vehicles from cyber threats. In this article, I will provide an in-depth look at best practices for securing automotive data networks and sensors across the vehicle lifecycle.

Securing In-Vehicle Networks

Modern vehicles contain multiple in-vehicle networks that connect electronic control units (ECUs) and allow them to communicate. These networks include:

• Controller Area Network (CAN) – The most widely used network for communication between ECUs.

• Local Interconnect Network (LIN) – A lower-speed complement to CAN used for low-bandwidth devices.

• Media Oriented Systems Transport (MOST) – A high-speed multimedia network.

• FlexRay – A high-speed deterministic network for safety-critical systems.

• Ethernet – An increasingly used network for higher bandwidths needed by advanced driver assistance systems (ADAS) and infotainment systems.

To secure these networks, here are some key strategies I recommend:

Network Segmentation and Access Control

Segmenting networks into domains and restricting access between domains provides security by isolating critical systems. For example, the powertrain CAN bus can be separated from infotainment networks. Gateways with firewalls can filter traffic and enforce domain isolation.

Cryptographic Protection

Encrypting and digitally signing network traffic prevents eavesdropping, spoofing, and tampering attacks. CAN and FlexRay networks can use encryption while maintaining real-time performance.

Intrusion Detection Systems

In-vehicle network intrusion detection systems analyze traffic patterns and can identify anomalous behaviors indicating a potential attack. Detecting intrusions provides visibility and allows mitigating actions.

Secure Onboard Updates

The ability to securely update ECU software over-the-air is important to address vulnerabilities throughout a vehicle’s lifecycle. Cryptographic signing of updates is essential to prevent malicious code from being introduced.

Securing Vehicle Sensors

Vehicles are increasingly equipped with sensors like cameras, radars, ultrasonics, and LiDAR to enable ADAS and autonomous driving capabilities. Securing these sensors is important to maintain safety and availability. Here are some key sensor security strategies:

Input Validation

Carefully validating all sensor inputs helps prevent malformed or out-of-range data from affecting vehicle systems. This protects against potentially hazardous conditions.

Tamper Resistance

Mechanisms like tamper-evident seals can provide physical tamper detection and response for critical sensors. This protects against an attacker manipulating a sensor to inject false data.

Redundant Sensors

Using redundant sensor systems with different modalities makes it much more difficult for an attacker to manipulate the environmental model used by vehicle autonomy systems. The system can cross-validate sensor data.

Sensor Fusion

Sensor fusion combines data from multiple sensors to create a comprehensive environmental model of the vehicle’s surroundings. The redundancy makes it harder for an attacker to alter the vehicle’s perception without being detected.

Fail Safe Designs

Safety-critical systems need to fail safely even when sensor data is compromised. For example, ADAS features could be disabled and bring the vehicle to a minimal risk condition in response to a detected sensor issue.

Securing the Vehicle Lifecycle

Taking a holistic approach and implementing defense-in-depth at each stage of the vehicle lifecycle is key for effectively securing data networks and sensors against cyber threats. Here is an overview of how security extends across the vehicle lifecycle:

Design Phase

• Threat modeling and risk assessments during design identify required security controls.
• Security is architected into systems from the start through segmentation, encryption, access control, and other controls.

Manufacturing Phase

• Secure manufacturing processes, facilities, and supply chains prevent tampering of components.
• Hardware security technologies like TPMs and HSMs provide device identity and secure storage for keys.

Service Phase

• Fleet-wide remote updates keep vehicle software patched throughout service life.
• Monitoring, analytics, and response capabilities detect and respond to emerging threats.

End-of-Life Phase

• Retiring vehicles have sensitive data like keys securely wiped to prevent access by unauthorized parties.

By taking a comprehensive approach across the lifecycle, automakers can stay ahead of evolving cyber threats targeting connected vehicles.

Conclusion

Securing in-vehicle networks, sensors, and the automotive ecosystem is crucial as vehicles become more automated and reliant on technology. A layered, in-depth security strategy centered around network segmentation, encryption, access control, intrusion detection, secure updates, input validation, tamper resistance, redundancy, and fail-safe design is key to effectively protecting automotive systems. With cybersecurity built-in across the entire product lifecycle, automakers can confidently deliver innovative connected and autonomous vehicle capabilities while keeping drivers safe from cyber attacks.