Automotive industry addresses V2V security challenges

The automotive industry is joining the medical-device and aviation industries in making news regarding cybersecurity and related threats. The NHTSA is driving vehicle-to-vehicle communications efforts—potentially saving lives but opening the door to security and privacy threats.

Rachael King in the Wall Street Journal reports that NHTSA will propose a connected-car rule by yearend with the goal of getting V2V-capable cars on the road in the early 2020s. She notes that automakers are already at work on a public key infrastructure, which would let two vehicles with no pre-existing relationship securely exchange data. But King also notes that PKI isn’t infallible, with failures having led to the hacking of consumer credit-card and related information. And for V2V applications, such a system would need to scale to 200 million or more vehicles.

She quotes Steven Shladover, a program manager for California Partners for Advanced Transportation Technology, as citing one worst-case scenario: “A terrorist might want to shut down a major bridge or tunnel in a major urban area by causing a whole bunch of vehicles to misbehave.”

King reports that several automakers are planning to complete a proof-of-concept security credential management system by August 2016. Those automakers include Ford Motor, General Motors, Nissan Motor, Mazda Motor Corp., Honda Motor, Volkswagen and its luxury brand Audi, Daimler AG’s Mercedes-Benz, and Hyundai Motor and its affiliate Kia Motors.

King writes, “The automakers, part of a Crash Avoidance Metrics Partnership consortium, have a cooperative agreement with the Transportation Department to build the system. CAMP has already invested 11 years researching and testing various security approaches.”

One particular issue is privacy. King quotes Michael Shulman, a technical leader at Ford and program manager for CAMP’s Vehicle Safety Communications Consortium, as saying, “Other PKI systems, such as the system in operation by the Department of Defense, do not have the same privacy goals.”

Read King’s complete article here.