Knowledge Center
Navigation
Knowledge Center

ISO 21434 / SAE 21434 Standard – Automotive cybersecurity

popularity

Description

The ISO/SAE 21434 standard focuses on cybersecurity for road vehicles.

Cars are getting smarter, more complicated, and more vulnerable to cyberattacks. As the amount of semiconductor and software content continues to increase, so does the number of over-the-air updates and connections to edge-based servers and services, adding a variety of new vectors for attacks.

Properly securing vehicles requires engineers to first identify all the possible connection points. In the past, multiple ECUs were implemented as part of a vehicle’s security strategy, but carmakers increasingly are relying on a single, beefed-up ECU because it can improve performance and power efficiency. To make up for that loss of redundancy, carmakers are adding data encryption and strong security IP, and they are starting to require some level of security training for more types of engineers.

Safety islands are mandated in ISO/SAE 21434 and usually come in the form of an ECU, which routes data, then detects and rejects unsecured entries. While historically a number of ECUs were deployed in an automotive design, the recent trend is to have one ECU with more compute implemented to run a hypervisor, which in turn runs several operating systems.

The ECU can be thought of as a fortified gateway, where encryption takes place, and one that requires some beefing up to prevent any potential faults, be they from human attackers or from other sources.

The core of all security comes down to proper, strong cryptography. Cryptographic algorithms and software are subject to change, which only exacerbates the need for fool-proof hardware. While that’s particularly important in the ECU, data within the vehicle also can be encrypted as a fail-safe.

The migration toward holistic security now includes roots of trust installed in ICs located throughout the car’s systems. A focus on reinforced security is particularly important due to the lifespans of cars, which can stretch for well more than a decade.

Cybersecurity is mission-critical to SDVs, and it requires a view of the vehicle as a system rather than as a collection of isolated components. While in the past security was implemented through a number of ECUs through a car, the trend has veered toward a single, powerful ECU at the car’s largest weak point, supplemented with different redundancies and new updates throughout the lifetime of a vehicle.

The challenge for automakers is understanding how these systems of systems will behave both individually and together, and that may require security training as a pre-requisite for any facet of automotive design. Vehicles will only become more complicated in the future, and security increasingly is being looked at as everyone’s responsibility.

 

Multimedia

Adding Security Into Test