SECURITY FOR THE AUTOMOTIVE INDUSTRY: From End To End

Bill Boldt
Business Development Manager, Security
Blackberry 
wboldt@blackberry.com

Security is emerging as perhaps the most important factor in the evolution of the connected autonomous car. Due to high profile hacks on cars, it is hard to argue that without security you can have safety. Cars are the most software intensive systems in the universe with far more lines of code than even a state of the art jet fighter. 

With being such complex digital systems they have become prime targets for attack, and that is where cryptographic countermeasures come in. 

Connecting the dots:  in the emerging software-defined world,  safety increasingly comes from security, while security comes from cryptography. Robust cryptographic security implementation is how you increase trust, and in a car every system must be trusted, including inside the car, in the smart  infrastructure, in emerging applications-based ecosystems, and in the manufacturing supply
chain. 

When considering automotive security, many factors come into play. Some are noted here (and were noted in a prior blog, but are worth repeating):

•  Security assets (e.g.  crypto keys, serial numbers, etc.) must be installed into
  electronic devices such as Electronic Control Units (ECUs), domain/area controllers, and other processors at manufacturing time. This process is called "personalization"

• Those electronic devices must be distributed to and be installed into vehicles in globally located factories

• They must be warehoused worldwide for subsequent repairs, and be updateable at dealers and repair shops

• In addition, aftermarket suppliers must be able to sell and update secure devices, and
  OEMs must have the ability to authorize electronic devices or not (e.g. enforce warranty  policies) 

And, there are many more.
  
To maintain the maximum amount of flexibility, personalization (provisioning) and updating should be moved as close as possible to the very last minute. Each car maker will be faced with the same
situation and will have to design and manage secure device manufacturing systems, secure updating systems, and security certificate management systems that are global and long
term in nature.

The way in which these systems get deployed will have to be designed to the specific logistical and security needs of the manufacturer.

Fortunately, the tools to do that are available from Certicom; namely, the Managed PKI
System and Asset Management System. 


Asset Management System
Certicom’s Asset Management System (AMS) installs cryptographic keys into devices (such as ECUs, domain and area controllers, processors, memory,key storage ICs, etc.) to ensure they are secure from tampering, counterfeiting, cloning, and other bad things that happen to good systems.
 
Personalization using Certicom’s AMS solution automates the secure distribution and tracking of digital assets, especially when used in conjunction with the Managed PKI services. 

Certicom’s Managed PKI Certificate Services helps high volume manufacturers secure devices and securely enforce ecosystem requirements. Authentication is enforced via certificates, which is a method that provides the highest levels of security. 

Mangaged PKI System
 
Certicom’s managed PKI system was initially created for BlackBerry mobile devices, which speaks to high security and volume production scale capabilities. 

Managed PKI performs four essential functions:

1. ISSUE: Automatically issue certificates tvalidated devices 
2. MANAGE: Track all of the issued certificates 
3. RENEW: Automatically renew active devices 
4. REVOKE: Disable certificates of lost or decommissioned devices
   

Security Design Consulting
The overall automotive manufacturing blueprint must be designed with best practices in mind right from the start, and BlackBerry Professional Services can help with that.  BlackBerry’s cybersecurity consulting and tools help to:

• Identify the latest cybersecurity threats
• Develop risk appropriate mitigation strategies
• Implement and maintain IT security standards and techniques, and
• Defend against the risk of future attacks

BlackBerry is making the proprietary security skill sets that made BlackBerry mobile device the most secure in the world available to the open market. BlackBerry's Professional Security Services teams provide design, analysis, response, and testing ("DART") via a range of services, as noted in the table below, among others:

 
With security skills honed in the mobile industry, industry leading cryptographic  expertise, and decades of automotive software experience, you can see that Blackberry brings it all together.

Read More

Autonomous Cars – Part 2: The ABCs ADAS

Kaivan Karimi
SVP of Strategy and Business Development
BlackBerry Technology Solutions (BTS)

Advanced driver assistance systems (ADAS) is one of the most important of the many different technologies going into the connected autonomous car of the future. 

ADAS is evolving from discrete single function systems, such as blind spot monitoring and lane departure warning to integrated active safety systems and automated driving.  With ADAS high performance computing is intersecting with the need for functional safety, changing the very nature of the hardware and software in these next generation systems. So, a flexible, safe and stable software environment that leverages the performance advances in silicon while maintaining ISO 26262 functional safety certification is critical.  In an ADAS based car, software is the nervous system that works with the brains of the operations, which are  Microprocessors/Microcontrollers.  Together they work seamlessly with a range of other hardware components, some of which are noted below.

Radar Systems

Radar technology collects information around the vehicle and feeds it to the ADAS’s domain controller managing sensor fusion.  Several subsystems are part of the package such as a 77 GHz radar system that enables high precision and scalability from short to mid to long range detection; 24 GHz radar for high-demand features, such as rear cross traffic alert or blind spot detection; and Light Detection and Range (LIDAR) for adaptive cruise control, accident avoidance and mitigation and object detection. LIDAR is like a light-based radar that sends out short pulses of invisible scanning laser light, and based on how long it takes to see the reflection, calculates how far away it is.  It then creates a 3-D image of the surroundings of the car with high accuracy. 

Vision Processing

 A range of cameras and sensors combine to see the world.  External cameras assist with lane departure warnings, forward collision warnings, traffic sign recognition, and pedestrian recognition. Internal cameras provide information related to the driver’s focal point and behavior so that the ADAS system can react accordingly. These can be augmented with 3D capabilities that enable new HMI user experiences, such as gesture recognition and control of cabin button functions, or infotainment systems.  Ultrasound is also used for close-end object detection and will be used in park-assist applications, where a typical car would have between 10 to twelve sensors.

GPS

Global Positioning Systems are satellite-based navigation systems using a network of 24 satellites that were put in orbit by the U.S. Department of Defense (DoD) for military applications. In the 1980s the US government made the system available for civilian use. Galileo (EU), GLONAS (Russia), BeiDou (China), and IRNSS (India) are examples of other satellite-based navigation systems being developed around the world.  They have accuracy of within 10 to 50 feet for 95% of the time, with most providing a worst case pseudo-accuracy of 7.8 meters at a 95% confidence level. The actual accuracy depends on factors such as atmospheric effects, line of site clearance to the satellites, and receiver quality. To improve GPS location accuracy to centimeter-level accuracy, systems make use of ground-based reference points in combination to the satellite signal. These types of systems are called “differential GPS,” and a great example is that which comes from rental car companies.

For a self-driving car you need to know which lane a car is in and where within that lane is in reference to other cars and structures surrounding it, and all of this must be updated at high rates in real-time. This requires computational intensity as well as augmented GPS functionality with accelerometers, altimeters, gyroscopes, and a tachometer/odometer to achieve finer measurements of the position of the car under various conditions.

V2X

V2X communication refers to the exchange of information from a vehicle to anything that may affect the vehicle, and vice versa.  V2X stands for Vehicle-to-Vehicle (V2V), Vehicle-to-Infrastructure (V2I), Vehicle-to-Pedestrian (V2P), Vehicle-to-device (V2D), Vehicle-to-grid (V2G) and for all practical purposes, Vehicle-to-Everything.  (You can see that the “X” is the catch-all variable.) 

V2X is considered a cooperative approach between cars and their environment to make a more effective means to avoiding accidents and traffic congestion. For V2X to really work it needs to be rolled out with adoption rates of greater than 95%, and from that perspective it may be a few years before the infrastructure is put in place. The communication technology most often talked about for V2X is based on Dedicated Short Range Communication (DSRC) operating at the 5.9 GHz frequency based on 802.11p 

Wireless Access for Vehicular Environments (WAVE). The architecture, message protocols, and security standards are based on IEEE 1609.x in the US and various of ETSI layer standards.  Note that cryptographic security must be built in so that the signal sent and received can be trusted.  False or corrupted signals can produce dire results.

V2X will establish a hybrid access network and enable the flow of information regarding traffic delays and hazard warnings (e.g. road flooding, electrical poles down, or even cars driving in the wrong direction, and others) in a real time manner.

Telematics

A telematics system mixes the functionalities of telecommunications and informatics for a car, and a good way to explain the range of functionalities in a telematics system is to take a closer look those supported by OnStar from General Motors. OnStar includes a cellular modem, GPS, connections to a variety of sensors (some of which are dedicated to reporting significant crashes), a backup battery, and a roof mounted antenna with a range that is better than a typical cellphone. 

The box itself gets a “black-box” treatment, and is mounted in the back of the car to shield it from most crashes. The system is connected to a call center, which in turn can report accidents to a public safety answering point such as a 911 operator, and contact garages if only simple towing services or mechanical help is needed. After any incident, the call center operator contacts the passengers of the car, getting more information and assuring them that help is on the way. Emergency and roadside assistance along with basic vehicle diagnostics are the most popular services for most Telematic systems. 

Over time, a host of other services have been added from weather reports and sports scores, to traffic information, geo-fencing, and stolen vehicle tracking. The list of automakers who already offer telematics services include GM, Chrysler, Ford, Lincoln, Audi, BMW, Mercedes-Benz, Volkswagen, Porsche, Jaguar, Rolls-Royce, Volvo, Mini, Toyota, Infiniti, Lexus, Mazda, Nissan, and Subaru. 

Domain Controllers and Micro Processor/ Micro Controller Units (MPUs/MCUs)

MCUs and MPUs are the physical hardware brains of the whole vehicle operation, and combined with powerful sensor fusion algorithms are what turn a car into a robot. With the number of sensors feeding situational awareness data in real-time, one can see that high-speed and high-bandwidth data processing are at the heart of automated driving.  High performance Electronic Control Units (ECUs) accept the sensor inputs that monitor the automobile’s constantly changing environment, and fuse those data at speeds of greater that 1Gb/sec to make safe decisions.  As the table shows, this will ultimately shift the burden of “situational awareness and response” from the driver to the car. High-speed decision making at real-time speed, dealing with the amount of data discussed above, requires secure, reliable, and very fast processing computers. 

  

The growth of electronics in cars has resulted in double-digit growth of the number of ECUs being used in all car segments. Today’s embedded vehicle functions are shared between up to 100 ECUs and are connected over several buses, and typically uses 6-8 operating systems. This decentralized system has drawbacks in increased complexity, weight, and overall cost of the vehicle. The trend now is to move from 80-100 decentralized ECUs scattered across the vehicle, to 8 to 12 domains with their respective mega-ECUs, or Domain Controllers, which among many other things reduces the complexity of the system.

The next blog will address the software architectural issues to be considered when creating connected autonomous car of the future.   For more see the QNX web site.

 

_______________________________________________________________________________

Kaivan Karimi is the SVP of Strategy and Business Development at BlackBerry Technology Solutions (BTS). His responsibilities include operationalizing growth strategies, product marketing and business development, eco-system enablement, and execution of business priorities. He has been an IoT evangelist since 2010, bringing more than two decades of experience working in cellular, connectivity, networking, sensors, and microcontroller semiconductor markets. Kaivan holds graduate degrees in engineering (MSEE) and business (MBA). Prior to joining BlackBerry, he was the VP and General Manager of Atmel wireless MCUs and IOT business unit.

Read More

Anchoring Trust in the Increasingly Software-Based Car

Bill Boldt
Business Development Manager, Security, Blackberry
wboldt@blackberry.com

Electronic Control Units (ECUs) started out in the 1970s as discrete modules with each one doing one particular thing, at that time mainly for emissions controls and mileage.  Then they became connected via in-car networks with the invention of the CAN bus in 1985.  In-car networking represented a big improvement in capability.  However, being networked means that ECUs became vulnerable to mischief and thus they, and what the connect to (such as domain and area controllers) need to be secured cryptographically to ensure that the signals being sent have not been tampered with or corrupted, and perhaps most importantly, that they are authentic.   There is also the emerging need for confidentiality (i.e. encryption/decryption).

The picture below shows the top attack points.  This range or targets indicates just how vulnerable cars have become: 

With a car having so many places to attack, how can trusted security be implemented and why is it so important?  Well, the main thing is that trust leads to safety, especially as cars become more connected and autonomous.  Hacked or corrupted signals can have dire consequences in a car, which is obvious.  In a car, safety is related to security and security comes to a  large extent from cryptography.  (Note that safety and security are not exactly the same thing, but there is tremendous overlap and interplay, and safety is becoming much more dependent on cryptographic security as cars become more connected and autonomous.  For more on functional safety look here.)

Trust
Trust is paramount in digital systems, and increasingly so in automotive. Trust comes from cryptographic solutions that:

• Securely store secret keys
• Securely issue, manage, renew and revoke security certificates
• Include a mix of software and security hardened hardware devices, and
• Are manufactured in highly secure facilities

What Creates Trust?
A major tenet of security is that each system and sub-system will have different types of threats and a range of options to provide countermeasures to those. This means that the automotive security equation has many variables and thus is difficult to solve.

However, two things are always common to trustable cryptographic security, and they form the basic foundation of modern security:

1. A proven algorithm (e.g. Elliptic Curve Cryptography (ECC)), and  
2. A secret cryptographic key  (to provide the required level of security for the selected algorithm). 

The challenge for the automaker is to choose the right algorithm and key length for the available processing resources and to securely issue, manage/store, renew, and revoke the security certificates. Cryptographic strength comes from the combination and application of these principles, processes, and techniques. 
 
Trust Anchor
On a CAN bus, which was designed without security in mind, ECUs are exposed.   So, connected cars should employ best practices for security, but cost, complexity (especially of the supply chain) and time get in the way. Having said that, best practices will eventually prevail and that will likely include a hardware trust anchor system to establish, maintain, and update cryptographic processes.

 
From the diagram you can see the four basic things that create a PKI-based hardware trust anchor:

1. A trusted hardware anchor that stores the key
2. That key, which becomes the root of trust
3. The certificate chain anchored by the root of trust, and
4. A signing mechanism that creates the anchored certificate chain

Multi-level Security

Because there are so many systems in the increasingly software-defined car, security has to be multi-layered and fit the specific application. In other words — it must be tailored. You have to figure out what you are securing, what threats that system will face, and what countermeasures should be employed. You have to pick what pillars of security to apply; namely, confidentiality, data integrity, authentication, and non-revocation. Making sure you are doing the right security things on each system is what Blackberry is positioned to help you with, from consulting, to design, testing, certificate management, securing the supply chain, making updates, and applying cryptography to the in-car and around-the-car networks.

To learn more about cryptography for automotive please contact Blackberry's Certicom
subsidiary, and for more information and/or help regarding reliable, secure, and trusted software for safety- and mission-critical applications such as automotive please contact QNX. 

The bottom line is that BlackBerry, Certicom, and QNX can help your system become not just secure, but BlackBerry secure. 

Read More

The Secret to a Successful Autonomous Vehicle Development Program: A Data-Centric Approach to Autonomous Car Design

Bob Leigh, Director of Market Development at RTI
Romain Saha, Strategic Alliances Manager at BlackBerry

The automotive industry is facing unprecedented changes in the coming decade. With the rise of autonomous and connected cars, software is a significant differentiator in the automotive market. As software takes a central role in the functions and features of the car the investment in software development is accelerating dramatically. Automotive companies must adopt novel software design methodologies to be competitive, as well as ensure safety, security, and a quality user experience. Fortunately, embedded system architecture is also evolving. Fueling this change is the proliferation of “system-of-systems” architectures, where connectivity and accessibility are baseline requirements. This requires interoperability! 

  
IIoT and Data-Centric Design

The rise of the Industrial Internet of Things (IIoT) is driving this need for new architectures to unify the standalone devices of the past. These changes are already happening in other market segments and are fully applicable to automotive. In ever more connected and autonomous cars, many subsystems operate in tandem, but without the benefit of a greater awareness. For example, braking systems have very little interaction with power steering.  As we connect these systems and add layers of automation, the car itself becomes a system-of-systems – where braking and steering coordinate with vision and sensor functions – and every car is then connected to a much larger system. 

These larger connected systems could support fleet management, traffic management, sharing services and other as yet undefined applications.

 

Such a new design model must provide:

• Time-sensitive reliable transport, safety and mission-critical rigor in software design;
• Interoperability between applications, domains, operating systems, and entire heterogeneous systems;
• Support for high volume communication across multiple domains or compute platforms (sensors, actuators, etc.); and 
• Code reuse and the evolution of the system as it moves from research to development, on to production and into maintenance lifecycles that span multiple model releases.

Data-centric architectures address all these requirements. A data-centric architecture offers reduced development and maintenance costs when compared to device or application-centric or object-oriented approaches. 

Data centric-architectures support interoperability between teams, application and entire network domains and foster innovation through better access to data. To be data-centric means to put data at the center of any system, which is then self-describing and accurately reflects the real-time state of the system. It abstracts the complexity of operating systems, hardware, and network programming to allow applications to focus on the core value they add to the system. It decouples applications so that they become actors that use or change the state of data but do not explicitly interact with each other. This approach supports the sharing of code and IP (since it does not depend on a specific platform) and has many advantages in scalability, interoperability and maintaining data/state integrity.

Complete Lifecycle Support Platform

 

The preeminent data-centric middleware standard for real-time systems is DDS (Data Distribution Service). DDS is an open standard maintained by the Object Management Group (OMG). This standard has been developed over decades in highly demanding applications and is in use today in multi-billion dollar product lines worldwide.

DDS offers many features that are critical to any ADAS or Autonomous Drive application. Core to DDS, Quality of Service allows developers to guarantee latency, control data flow and manage network bandwidth. All of these things are achieved within the middleware, so the application only needs to focus on the processing of data, not the delivery.

Interoperability between applications and domains creates a layer of abstraction that allows OEMs to combine systems from different Tier 1s in a way that minimizes complexity and risk. It supports multiple operating systems seamlessly to enable architectural evolution from statically to dynamically configured higher-level operating systems – moving from the idea of domain controllers to compute platforms. It provides a unified infrastructure to connect and control different domains, paving the path to sensor fusion. It supports the high volume of traffic that these architectures will demand.

With DDS, applications, teams of developers, and systems share data using a common data model defined for the entire system. Once defined, all interaction between system actors is understood through this common data model. Code development and application interactions are decoupled, which allows more efficient development and collaboration of large, geographically distributed teams. DDS can support many thousands of applications with hundreds of development teams worldwide. This is the power of data-centric middleware.

Certified Software Stack

For many years DDS has been used in air, land, and sea autonomous system projects. It provides the features needed to support time-critical, dynamic, high volume applications that are key to the next generation ADAS architectures and ultimately to autonomous drive. Using a safety certifiable middleware, such as RTI Connext® DDS Cert, with QNX ISO26262 certified RTOS and ADAS framework, you can begin development with a fully-integrated, certified software stack. The combination allows engineering teams to focus on their core value-add in application development while ensuring system performance, interoperability, security and safety certifiability.

RTI(Real-Time Innovations, Inc.) is the largest DDS vendor and is the only one with a safety certifiable version of its product. RTI Connext® DDS is used in many mission-critical and safety-critical applications and is an essential component of the future Autonomous Car.

Please contact RTI at  bobl@rti.com or QNX at rsaha@blackberry.com today to learn more about these powerful tools.

QNX Software Systems Limited, subsidiary of BlackBerry is a leading vendor of operating systems, development tools, and professional services for connected embedded systems. Global leaders such as Audi, Cisco, General Electric, Lockheed Martin, and Siemens depend on QNX technology for vehicle infotainment units, network routers, medical devices, industrial automation systems, security and defense systems, and other mission- or life-critical
applications. Founded in 1980, QNX Software Systems Limited is headquartered in Ottawa, Canada.


For more information on Connext DDS in Autonomous Vehicles, please download our whitepaper or register for this upcoming joint webinarwith QNX and RTI.

---

Read More