Truck & Off-Highway Engineering - April 2018 - 4

TECHNICAL
INNOVATIONS

SAE INTERNATIONAL
BOARD OF DIRECTORS

Hackers aim to exploit vulnerabilities in CVs, pushing
security to the forefront

Encryption and firewalls are some of the techniques
TTControl builds into its controllers.
Commercial vehicles are coming into the sights
of hackers who have succeeded in attacking
governments and corporations. Cyber-criminals
hope to exploit vulnerabilities in connected
trucks and off-highway vehicles with the aim of
wreaking havoc or extorting funds from vehicle
owners or equipment makers.
Now that most commercial vehicles are connected, protecting them from attackers with
multiple layers to provide defense in depth is
becoming a necessity. On the bright side, system developers and OEMs who haven't had to
worry about cyber attacks until recently can
leverage the efforts of industries that have
been battling hackers for years.
Those efforts are widespread. SAE
International focused on best practices in its
SAE J3061 standard. Groups like the National
Science Foundation have sponsored a number
of projects. Microsoft recently joined other
companies calling for the U.S. to establish a
single national cybersecurity agency.
These efforts are augmented by securityrelated developments from a diverse group of
companies including Harman, Blackberry and
Argus Cyber Security, which was purchased by
Continental last year.
Most experts note that security needs to be
designed in at every level, from semiconductors up to complete vehicles. That will provide
defense in depth, which helps prevent hackers
from penetrating deeply enough to take control of a system or vehicle.
"Security is a supply chain problem," said
Peter Brown, Chief Automotive Architect at
4 April 2018

Wind River Systems. "Companies have to have
a layered architecture. If somebody breaks
through one layer, they find that they have to
break through another, then another."
Those layers span a range of technologies.
Most experts feel that security needs to be designed in from the start of a project. It's more
difficult to add complex, multifaceted security
techniques to existing vehicle designs. That's
because many hardware and software layers
come from a range of suppliers, addressing
many levels of vehicle design.
"Attacks must be prevented by strong encryption technology in the communication
links," said Jose Ogara, Product Manager at
TTControl. "Additionally, connections should
not transverse public internet using private
access point names. At the vehicle level the
gateway should never open ports or services to
the internet, and a firewall should always be
present. Security is an architectural issue at the
vehicle level, and additional measures such as
signed codes should also be considered."
Many security specialists note that the need for
a broad-based security architecture requires support from the CEO level down through design and
manufacturing personnel. If not, security's likely to
be pushed aside when harried developers try to
avoid cost overruns or missed deadlines.
"Leadership must lead," said Bryson Bort,
CEO at Scythe, a data-security startup. "If
there's not a focus on security coming from the
top of the company, nothing's going to change."
Some connected vehicles have been protected because connections were largely proprietary, so hackers ignored them to attack
easier targets. But the shift to join the Internet
of Things and leverage existing communications tools and technologies has changed that.
Connected vehicles usually have hardware and
software produced by a range of Tier 1s and
other suppliers, so open architectures are becoming the norm.
"We see the need for open platforms,"
said Sanjay Ravi, Managing Director
Automotive at Microsoft Cloud Services. "Open
application programming interfaces make it
possible to include several players, from startups to very large automotive companies."
The move toward openness extends to development tools. Many design teams gravitate

Mircea Gradu, PhD
President
Douglas Patton
2017 President
Paul Mascarenas, OBE
2019 President Elect
Pascal Joly
Vice President - Aerospace
Carla Bailo
Vice President - Automotive
Landon Sproull
Vice President -
Commercial Vehicle
Pierre Alegre
Treasurer
David L. Schutt, PhD
Chief Executive Officer
Gregory L. Bradley, Esq.
Secretary
Haoran Hu, PhD
Donald Nilson
Eric Tech
Jeff Varick
Todd Zarfos
SAE International Sections

SAE International Sections are local
units comprised of 100 or more SAE
International Members in a defined
technical or geographic area. The purpose
of local Sections is to meet the technical,
developmental, and personal needs of the
SAE Members in a given area. For more
information, please visit sae.org/sections
or contact SAE Member Relations Specialist
Abby Hartman at abby.hartman@sae.org.

SAE International
Collegiate Chapters

Collegiate Chapters are a way for SAE
International Student Members to get
together on their campus and develop
skills in a student-run and -elected
environment. Student Members are vital
to the continued success and future of
SAE. While your course work teaches
you the engineering knowledge you
need, participation in your SAE Collegiate
Chapter can develop or enhance other
important skills, including leadership,
time management, project management,
communications, organization, planning,
delegation, budgeting, and finance. For
more information, please visit students.
sae.org/chapters/collegiate/ or contact
SAE Member Relations Specialist Abby
Hartman at abby.hartman@sae.org.

TRUCK & OFF-HIGHWAY ENGINEERING

TTCONTROL

CYBERSECURITY

http://www.sae.org/sections https://students.sae.org/chapters/collegiate/

Truck & Off-Highway Engineering - April 2018

Table of Contents for the Digital Edition of Truck & Off-Highway Engineering - April 2018