Cybersecurity From a Tier 1 s Perspective. Christopher A Lupini Director, Cybersecurity Engineering Delphi Automotive Systems September 16 th 2015

Transcription

1 Cybersecurity From a Tier 1 s Perspective Christopher A Lupini Director, Cybersecurity Engineering Delphi Automotive Systems September 16 th 2015

2 Megatrends Drive Our Technology Portfolio Safe Green Connected Active Safety systems Vehicle-to-Vehicle communication Automated driving Driver state monitoring Occupant classification systems Gasoline and diesel fuel injection systems Engine management system controllers Hybrid & electric vehicle technologies Infotainment Rear seat entertainment Integrated center stack Driver interface systems Connected vehicle infrastructure Security is a priority for components with software communication 2 Cybersecurity Engineering

3 Essential Elements of Automated Driving Sensors and Perception 3 Functional Safety and Security

4 Future Automated Driving Infrastructure Cloud Cloud Vehicle Share Request Vehicle from parking request Cloud From - vehicle data To infotainment (map, traffic, entertainment), ADAS (roadway \topology, dynamic zones) Cloud Cloud Traffic Lights with vision V2V Low speed Autonomous vehicles Share request Dynamic Signs Speed changes, Lane changes Traffic Signs with vision 4

5 Connected Eco-System Infotainment Map Traffic Entertainment ADAS Topology Dynamic Zones Personal Device Back-end Server Vehicle Data Speed Position Location Diagnostics Etc. Vehicle-to-Infrastructure (V2I) Vehicle-to-Vehicle (V2V) Vehicle Data Parking info Signage Etc.. Vehicle Data Acceleration Status Warnings Position 5

6 Potential Automated Driving Players Data Centers: IBM, SAP, Microsoft, Oracle, Amazon, Google, Salesforce, Yahoo, Teradata, Cisco Network (Short Range): Cisco, Arada, Savari, NXP, Qualcomm, Coda Vehicle Sharing: Google/Uber, Zipcar, Lyft Security: McAfee, Symantec [+datacenters] Maps: Google, Navteq. Nokia, Apple, TomTom, Garmin Vehicle Systems: Delphi and others Cellular infrastructure: AT&T, Verizon, Sprint, T-mobile, etc 6

7 Exponentially increasing security sphere OEM Suppliers ITS Operator OBD DSRC 4G LTE Public Clouds Service Provider 7

8 What can go wrong? Why need Cybersecurity? There is no safety without security 8 Cybersecurity Engineering

9 9 Example Attack Vectors

10 What Needs To Be Addressed? Scope of Problem Prevent unauthorized personnel from taking control of in-vehicle electronic systems via wireless or wired means. Related Areas Security of mobile media information such as copyrighted video and audio being used in the car. Security of in-vehicle parameters such as engine calibrations, odometer, etc. Accuracy and validity of in-vehicle parameters such as vehicle speed. Will involve Functional Safety ISO Integrity of emission-control systems Detection of counterfeit ECUs Heightened Threats Personal Device Integration Telematics Cloud Access V2X Automated Driving IoT car may not be the primary target 10 10

11 Why Cybersecurity Matters Senator Edward Markey letter December 2013 Sent to twenty automakers demanding answers to a long list of questions about their automobiles potential vulnerability to hacking. Answers trickled in during the next year Breach of OPM (Office of Personnel Management) OPM is the HR system of the US Government with records of security clearances Hackers stole over 20M current and former federal employees data. Target Breach Hackers breached Target and stole over 40M customers data including credit cards, names, mailing addresses, phone numbers, etc. Target offers $10M to settle a class-action lawsuit And the list goes on for most recent breaches 11 11

12 Why Cybersecurity Matters (cont.) In his report, Senator Markey (D-MA) highlighted the following 8 key findings: Nearly 100% of cars on the market include wireless technologies that could pose vulnerabilities to hacking or privacy intrusions. Most OEMs were unaware of or unable to report on past hacking incidents. Security measures to prevent remote access to vehicle electronics are inconsistent and haphazard across all OEMs, and many manufacturers did not seem to understand the questions posed by Senator Markey. Only two OEMs were able to describe any capabilities to diagnose or meaningfully respond to an infiltration in real-time, and most say they rely on technologies that cannot be used for this purpose at all. OEMs collect large amounts of data on driving history and vehicle performance. A majority of automakers offer technologies that collect and wirelessly transmit driving history data to data centers, including third-party data centers, and most do not describe effective means to secure the data. Manufacturers use personal vehicle data in various ways, often vaguely to improve the customer experience and usually involving third parties, and retention policies how long they store information about drivers vary considerably among manufacturers. Customers are often not explicitly made aware of data collection and, when they are, they often cannot opt out without disabling valuable features, such as navigation. 12 (February 11, 2015) 12

13 Why Cybersecurity Matters (cont.) S SPY Car Act of Introduced 07/21/2015 National Highway Traffic Safety Administration (NHTSA) to issue motor vehicle cybersecurity regulations Require motor vehicles manufactured for sale in the United States to protect against unauthorized access to: (1) electronic controls or driving data, including information about the vehicle's location, speed, owner, driver, or passengers; or (2) driving data collected by electronic systems built into a vehicle 13 13

14 IT s Role in Vehicle cybersecurity Close partnership with Delphi Information Security Information Technology Key Management Infrastructure DTCP, HDCP, V2X, future encryption key/certificate support Cybersecurity Awareness Program Secure Coding Guidelines Vulnerability Definitions for Engineers Cybersecurity Incident Response Program Proper communication channels for Engineering or IT related vulnerability Public website for OEMs, Tier 1s, Hackers/Security Researchers to reach out through. 14

15 Cybersecurity Lessons Learned Align Engineering with IT Tier 1 Supplier has a different view than OEMs We can sell solutions on their own or as de-facto standards Tier 1 customers include agriculture, construction, etc. 15 Cybersecurity protection points available: Cloud/cell/Bluetooth CAN/LIN/FR/MOST bus (gateway or router; intrusion detection) Smart chip Secure hardware module onboard microcontroller Atomic level Collaboration with suppliers and customers: Training Consulting Standards 15

16 Delphi s Cybersecurity Approach Vision Enable a safe and secure vehicle experience through the identification and mitigation of cybersecurity risks for Delphi products Mission Key partnerships Enhance Delphi s reputation as a leader in the development of safe and secure vehicle systems Develop secured hardware and software products in collaboration with our customers and suppliers Establish cybersecurity requirements and incorporate into Product Development Process (PDP) Collaborate with OEMs, silicon providers and industry experts to develop relevant solutions Research new techniques through cross-industry information sharing Cooperate with national and international organizations on regulations and design standards Focused on a high-security driving experience 16 Cybersecurity Engineering

17 Delphi Cybersecurity Organization Glen De Vos VP, Engineering Michael Groene Director, Global Software Engineering John Bingham Chief Information Security Officer Mary Gustanski VP, Engineering & Program Management Harry Husted Chris Lupini Ron Szabo Rob Seidler Powertrain Director, Cybersecurity E&S E/EA Technical Lead, Engineering Technical Lead, Process & Tools Cybersecurity Lab, Manager IDI, Functional Security Manager EC, Functional Security Manager PT, Functional Security Manager 17 Cybersecurity Engineering

18 Academia & Industry Activities Software and Security Engineering Research Center Coordinates applied and basic research on software and system security 13 participating universities Academic involvement University of Michigan Transportation Research Institute Industry involvement SAE Cybersecurity Committee member Consult on all aspects of transportation cybersecurity and privacy Cybersecurity Test Lab evaluates cybersecurity solutions Future member of IT Information Sharing and Analysis Center (IT-ISAC) SAE Battelle Cyber Auto Challenge host Aligned with industry and academic initiatives 18 Cybersecurity Engineering

19 OEM Cybersecurity Strategy Partnering with key OEMs to identify best approach for cybersecurity protection for current product launches Protection methods Communication paths secured with controller-level protection Gateway provides vehicle and/or product-level protection Example OEM partnerships 19 Cybersecurity Engineering

20 Cybersecurity Guidelines and Actions Delphi s cybersecurity strategy centered on core principles Prepare React Design Align Deploy Develop cybersecurity awareness program Align with Delphi Information and Security organization Create cybersecurity incident response program Design to engineering guidelines with OEM collaboration Deploy according to global Delphi processes Structured approach to cybersecurity 20 Cybersecurity Engineering