The future of innovation. Vehicle next generation.
The automotive industry has accelerated technological transformation within the last few years. The metamorphosis from ICE, automotive hardware environment, to EV and now to SDV (Software-Defined Vehicles), is a welcome evolution that brings innovation, speed, and novel creativity to a century-old industry.
In today’s average vehicle, one can find up to 150 million lines of code and as many as 100 distinct ECUs controlling and monitoring the vehicle’s operation and management. Integrating tech into vehicles opens the door to many innovations and agility, unbound by the confines of the traditional hardware-oriented mindset.
As the industry moves closer to becoming a computer on wheels, OEMs need to shift from existing manufacturing structures, and embrace a software-centric approach that achieves faster development, continuous updates, and overall value creation via innovation – without forgetting the foundations of safety and now cybersecurity, as with software-based vehicles come potential cybersecurity vulnerabilities.
SDV Zone-Oriented Architecture
Over the past few years, the automotive industry has been moving towards an SDV architecture. The current E/E architecture has reached its limits, and it will be surpassed by a fundamental technological shift. The automotive consumer expects a higher standard of connectivity, an improved and customizable driving experience, and OTA features, without increases in vehicle costs. Current E/E architecture cannot be expected to meet the complexity and computation demands of such emerging mobility experiences. A new architecture, with optimized vehicle servers and consolidation of ECUs, is now in demand.
The emergence of Domain-Centralized Architecture and Zonal Architecture creates a complete shift in how the automotive industry will provide this new experience, relying on software, changing the supply chain model, and accelerating development and update processes.
With centralized computing, there will be a reduction in wiring harnesses and components, a reduction in overall vehicle weight, a decrease in garage-based maintenance costs, and acceleration in vehicle type outputs providing a personalized experience.
OTA connectivity is another aspect that is reshaping the way car maintenance and software upgrading is done for infotainment, telematics, and vehicle diagnostic systems. Manufacturers can now connect with their customers effectively, building operational interactions, and not just rely on their brand and product for repeat sales. Cloud-based vehicle diagnostics can reduce costs, increase customer satisfaction, and help calibrate Advanced Driver Assistance technology (ADAS). Subscription-based OTA services will create new, recurring revenue streams that can persist long after a vehicle is purchased and on the road.
A Fundamental shift in the process
On the path to an SDV architecture, speed becomes paramount. Development in the automotive industry is already shifting from a waterfall (“V”) model to a CI/CD one. It starts with system architecture and the elements listed above, and it continues with in-vehicle application development, which can be up to 10 times faster, and a software-based supply-chain using a software-first agile and nimble distribution process.
Maintenance and operations need the same speed advantages, with data-driven operation and development, management of software at scale, monthly/daily version updates, and hotfix capabilities.
Together, these elements translate to a continuous cyber vulnerability assessment and monitoring, and continuous cybersecurity verification, validation, and certification. And while the standards and regulations already point to continual cybersecurity lifecycle management, in the CSMS, the foundation technologies that enable it – such as FOTA and cloud-based software development studios – need to fit into the realities of the automotive architecture.
Cloud or Mobile Technology?… Vehicle technology!
Cloud technology is already an integral part of the automotive industry. Automakers worldwide embrace cloud technology to accelerate innovation and improve their business model. Cloud tech is a connectivity enabler of an Automotive Cloud that can leverage large volumes of data from road infrastructure, surrounding vehicles and sensors, as well as from the internet and a partner ecosystem.
And while cloud tech seems to be a good first step, the “open ended” model of modern data centers, with new services added constantly (sometime directly by the users themselves, in SaaS mode) does not resemble the level of control expected in automotive, given the physical first value of the “automotive OS”: supporting safety-critical behavior at 150mph, a strong focus on initial hardware cost efficiency, and 10+ year hardware replacement/upgrade cycles.
One can claim that mobile technologies are a better analogy. It already has a cloud service supporting it, growing processing power, and specific functionality (like the camera) but strongly connected to specific hardware, with a shortening lifecycle. Today, the mobile device becomes the center of our lives and has made few companies dominate this experience. A strong shift from the pre-iPhone days. However, the modern auto industry is actually quite different. With multiple compute domains, some with very specific functionality like the Power Train and Automated Driving, and especially given its physical safety mechanisms, cost, and longevity, a connected SDV is at least 10 times more complex than a mobile phone. Multiple functions need to pass through regulated type approval, and while speed is critical in achieving SDV values, for the consumer and the manufacturer alike, the cybersecurity regulations, such as UN R155, are not going away and can become an obstacle.
SDV and Cybersecurity
As vehicles are hyper-connected, and more software is powering the SDV, relying even more on cloud-based, open-source technologies, we see a proportional growth in cyber threats and vulnerabilities.
The industry is already experiencing a growing challenge with the new cybersecurity standard ISO/SAE 21434, and the UN R155 regulation, applied to vehicles, components, and supply chains. Automation is required, to address these cybersecurity regulations while moving to SDVs, to avoid clogging the innovation pipeline.
Automakers are looking to reduce risks that are inherent to SDVs, but also to streamline and reduce costs of cybersecurity implementation in all vehicle lifecycle stages. From Design & Development, to Production, and on to Operations.
This in turn translates to a new cybersecurity program led by the Chief Product Security Officer (CPSO) that will integrate state-of-the-art cybersecurity technologies from the Mobile and Cloud domains (e.g., MacSec and Control Flow Integrity) into the newly created automotive SDV security domain, managing the transition and assuring type approval.
With highly agile SDVs and the increase in personal and experience, cybersecurity will have to adapt its processes, methods, and tools. While still focused on adhering to the standards and obtaining vehicle type approval, cybersecurity experts will start to be more concerned with actual attacks on the SDV. Cybersecurity innovation is in focus in the SDV era, to eliminate delays and to protect the brand.
At Karamba, we believe that the new SDV challenges will need to be met with two main strategies that complement each other:
- Defense in Depth, which utilizes the most modern cloud/mobile security concepts: Zero Trust, Minimized Attack Surface, Secure Communication, and Least Privilege Access
- Security by Design, which integrates security concepts and tools into the development process to accelerate the secured software development lifecycle (SSDLC)
Applying the latest security concepts includes proven technologies; Quantum-safe data and communication cryptography, runtime software integrity, and over-the-air updates that are secure even if delivered directly by software or application providers, are just a few of the requirements for secure SDVs.
For Security By Design – given the relatively short experience in the automotive security practice at OEMs and Tier1s (compared to IT security and of course to E/E architecture, Safety, and other automotive domains) – cybersecurity in 2023 will have to support both the current CSMS requirements (UNR155 regulation) as well as the speed requirements of the SDV architecture.
Focus on the speed of the process will require that current manual processes, like TARA and pen testing, be supported or replaced by automated ones; it is not unfeasible to expect AI-supported requirements review and verification, centralized assets database managing all software assets over 10 years after end of production, or simpler solutions like a central pentesting lab that accelerates manual processes and reduces their costs. The demand for cybersecurity compliance drives a platform-security approach, and is identified as a growing market.
In automotive, the global Testing, Inspection, Certification and Compliance (TICC) market is estimated to reach 24 billion dollars by 2028.
Karamba Security has anticipated these changes posed by the new SDV market, and is supporting the transition from today’s early days of regulatory-driven security to the dynamic and threat-driven cybersecurity of the SDV era. With End-to-End Product Security Portfolio capabilities and offerings, Karamba’s automated services and tools supply continual TICC in full compliance with ISO 21434 and UN R155. We harmonize safety- and security-related development practices across the supply-chain with a CI/CD structure.
To learn more about Karamba’s portfolio addressing the SDV, visit our website at www.karambasecurity.com, or contact us to request a comprehensive demo.
