The automotive industry is moving from a reactive, self-determined approach to cybersecurity to a standardized, regulated one. This document, an update on collaborative work from the SAE TEVEES18B Committee and GlobalPlatform Automotive Task Force, outlines this transition.
In the past, cybersecurity challenges in the automotive industry were seen as novel, and each company handled them individually. This era was characterized by self-determination of security mitigations and a unique justification for solutions. Companies often developed cybersecurity concepts based on past incidents and their own risk tolerance. A key tool during this time was the TARA (Threat Analysis and Risk Assessment), which organizations used to justify their security concepts or lack thereof. This led to company-specific policies and a lack of a global standard. The result was a fragmented market where every new project required a novel cybersecurity concept, hindering the development of a robust market for solutions. Cybersecurity was often viewed as a cost and a project impediment, and each new supplier had to be trained in the unique context of each project.
The era of self-determination has ended, replaced by regulation that identifies cybersecurity relevance based on the outcomes of vehicle components. Because modern vehicles increasingly rely on software and cyber interfaces to meet performance expectations set by regulations like FMVSS, cybersecurity has become a presumed requirement. This makes cybersecurity an "entry level requirement" and a basic cost of doing business, rather than a premium or optional feature.
Standardizing cybersecurity mechanisms is an opportunity to evolve the automotive electronics marketplace by building security mechanisms into the supply base from the start. This allows the industry to achieve economies of scale and shifts the focus of competition of cybersecurity strategies to the efficiency and effectiveness of their security implementations following the standardized strategy.
The SAE Hardware Security Task Force has identified an opportunity for the automotive industry to leverage GlobalPlatform to create a "trust ecosystem". GlobalPlatform is a standards organization that provides a security framework used across various industries, from payment systems to cell phones to IoT. By using GlobalPlatform's library of specifications, the industry can use "foundational bricks" like Secure Elements (SE) and Trusted Execution Environments (TEE) to build automotive applications with cybersecurity by design. This approach simplifies the challenge from inventing new security concepts to adapting existing, proven solutions, which can reduce the time to market. GlobalPlatform also facilitates certification through its Security Evaluation Standard for IoT Platforms (SESIP) methodology. Mapping SAE J3101 to GlobalPlatform standards creates a roadmap for applying SESIP certification to automotive components. This certification can offer several benefits, including the reuse of certification across different vehicles, guaranteed security assurance levels, and a reduction in the rejection of lab reports for type approval.
Ultimately, this standardization will facilitate the "identification" of every electronic device in a vehicle, giving each a unique identity. This will enable fine-grained Identity and Access Management (IAM) and create a secure, multistakeholder ecosystem. A key example is the "Smartphone as a Key" (SPaaK) use case, which can achieve end-to-end security for vehicle access by establishing intercompatible IAM standards between smartphones and vehicle components. Another example use case of GlobalPlatform Identity technologies explored in this document is based in supply chain security. Other examples of use cases of Global Platform Technologies are explored in this document.