CYBERSECURITY IN AUTOMOTIVE
AUTOSAR as a systemic support for cybersecurity in Automotive
This article is part of a series dedicated to the topic of cybersecurity in the automotive industry, prepared by Krzysztof Labuda.
The goal of the series is to introduce readers to key issues related to automotive system security, industry standards, and practical solutions that directly impact the safety of modern vehicles. In this part, the author focuses on the role of the AUTOSAR standard in implementing cybersecurity mechanisms.
Key AUTOSAR elements in the field of cybersecurity
In this article, I will present AUTOSAR solutions that enable the implementation of cybersecurity in vehicles — in other words, the implementation of the widely used cybersecurity model known as the CIA Triad (Confidentiality, Integrity, Availability). I will also explain how AUTOSAR can help ensure: confidentiality, integrity, availability of the systems involved.
Throughout the series, we will explore:
- IPS/IDS solutions,
- cryptographic concepts (and their challenges, such as the AUTOSAR Crypto Stack) realized by this standard,
- support for IAM (Identity and Access Management) systems known from cloud solutions,
- DPI (Deep Packet Inspection) requirements,
- one of the most well-known AUTOSAR-dedicated solutions: Secure Onboard Communication.
AUTOSAR as the ECU architecture standard in vehicles
AUTOSAR is a consortium that delivers a standardized architecture for devices included in the electronic systems of vehicles — ECU (Electronic Control Units). It supports a modular, layered, and component-based approach. While the architecture itself is open, specific tools for configuration and software development are commercial and subject to separate licensing.
Support for popular network protocols
AUTOSAR also supports previously mentioned network protocols and standards (CAN / LIN / FlexRay / Ethernet). The architecture provides tools and methodologies for configuring and integrating software components within ECUs, allowing them to be integrated into increasingly complex and larger software subsystems.
These tools automate the generation of configuration files, software component mapping to hardware resources, and system consistency and compatibility verification.
To illustrate this, below you can find a diagram showing the layered approach proposed by AUTOSAR.
Source: https://www.autosar.org/fileadmin/standards/R22-11/CP/AUTOSAR_EXP_LayeredSoftwareArchitecture.pdf
Security and protection features in AUTOSAR
At its highest level of abstraction, the AUTOSAR architecture distinguishes three software layers:
- Application Layer — includes the vehicle’s functional logic.
- Run-Time Environment (RTE) — implements AUTOSAR interfaces for a specific ECU. This separation enables AUTOSAR software components to remain independent of specific ECU hardware.
- Basic Software (BSW) — runs directly on the microcontroller.
The architecture also addresses security and safety requirements in automotive systems, providing dedicated guidelines, standards, and design mechanisms. It implements critical functions and modules for both safety-critical and security-critical domains. These include error handling, fault tolerance, security protocols, and safety controls.
Remote updates and rollback protection
It is particularly worth noting that AUTOSAR enables remote firmware updates (FOTA — Firmware Over-The-Air). This includes the use of network protocols present in the network stack (such as TLS), which comprehensively secure transmissions through encryption. Furthermore, rollback protection can be implemented to prevent downgrading to unsecured or vulnerable software versions.
Compliance with safety and security regulations
These mechanisms allow compliance with, among others, ISO 24089:202 standards and Regulation R156 — crucial in light of the growing regulatory demands in the automotive industry. AUTOSAR plays a key role as a standard in the development of automotive software systems, providing standardized and interoperable frameworks for the design, integration, and deployment of software components in modern vehicles. By promoting collaboration and standardization across the automotive industry, AUTOSAR contributes to improved quality, reliability, and efficiency in automotive software development.
Challenges of AUTOSAR implementation in practice
In conclusion, I would like to draw the reader’s attention to the fact that one might mistakenly assume that this system standard is easy to implement. Nothing could be further from the truth — the integration of layers and components proposed by AUTOSAR remains a significant challenge for engineers in the automotive sector, not only at the development stage but especially during full system integration.
Author: Krzysztof Labuda,
Security Testing Consultant
A participant in the Certified Ethical Hacker CEH v11 program, which teaches the latest commercial-grade hacking tools, techniques, and methodologies used by hackers and information security professionals.
