Cybersecurity, Encryption & the Internet of Vulnerable Things.

New regulations in the automotive industry recognize the truth about today’s connected vehicles: they run on electronics as much as on mechanics. The summer of 2024 will mark a significant rise in the cybersecurity expectations of automotive original equipment manufacturers (OEMs). The arrival of these EU regulations elevates the important role of encryption key management systems (KMS) in achieving compliance.

UN Regulation No. 155 (UNECE R155) on cybersecurity and cybersecurity management systems entered into force in the EU for all “new vehicle types” in 2022 but will apply to all “new vehicles” starting in July 2024, officially ushering in a new era of automotive cybersecurity.

Paired with UN Regulation No. 156, which focuses on software updates and their respective management systems, UNECE R155 takes into account the new reality of automobiles today—namely their reliance on software updates and interconnected systems.

Over-the-air updates and device-to-device communication multiply potential access points for cyberattacks. Because of the interplay between devices and between systems, one vulnerability can give cybercriminals sweeping control. And when hackers have control, vehicle users do not, a high-consequence scenario.

UNECE R155 lays out industry threats and related mitigations in great detail, sometimes referring to cryptography specifically. The vast majority of these mitigations, which vehicle manufacturers must demonstrate within their “Cyber Security Management System,” can be addressed through an effective key management system.

The below list quotes specific UNECE R155 mitigations (Annex 5, Tables B &C) that can be addressed by the right encryption key management system:

1. “Security controls shall be implemented for storing cryptographic keys” (Ref M11) to mitigate the following threats:

2. “Access control techniques and designs shall be applied to protect system data/code” (Ref M7) from the following threats:

3. “The vehicle shall verify the authenticity and integrity of messages it receives” (ref M10) to mitigate the following threats:

4. “Cybersecurity best practices for software and hardware development shall be followed” (ref M23) to mitigate related threats, such as:

5. “Confidential data transmitted to or from the vehicle shall be protected” (ref M12) in order to mitigate the following threats:

6. “Access control techniques and designs shall be applied to protect system data/code” (Ref M7) from the following threats:

In order to achieve regulatory compliance, designated by a physical marker, manufacturers must provide proof, and receive official approval that their cybersecurity management system addresses the development, production and post-production phases. They must demonstrate that their processes sufficiently address security, including the Annex 5 mitigations listed above.

Importantly, OEMs will report back annually to confirm that their “cyber security measures implemented are still effective in light of new cyber threats and vulnerabilities that have been identified” (7.2.2.2.).

OEMs, therefore, require a KMS solution that retains the flexibility necessary to evolve with new realities. They also need a centralized KMS that allows them to meet audit demands and demonstrate comprehensive cybersecurity processes on an annual basis.

Because no two OEMs’ legacy systems or security needs are identical, KMS providers must offer customized deployment options to organize, complement, unify and improve upon existing processes. Bringing existing systems under one organization-wide KMS solution will allow the internal team to effectively manage its encryption keys throughout their entire lifecycle.

A KMS tool like Keys&More, enables OEMs to better meet a variety of UNECE R155’s requirements, for example, the definition of user roles and access privileges; and the maintenance of security procedures, including the logging of actions and access. Or the need to secure messages received by the vehicle, such as diagnostic messages, vehicle-to-vehicle communications or proprietary messages sent from OEMs.

Moving forward, all cryptographic modules in use must meet consensus standards or be otherwise justified.

For most manufacturers in the automotive industry, these regulations will trigger an overhaul to their cybersecurity processes. Those without a robust encryption key management system will need to adopt a solution that fortifies their existing cryptography practices to achieve a compliant state. A customizable, flexible encryption key lifecycle management system is the answer.

Questions about UNECE R155 & how we can help? Unsure where to start? Speak with one of our KMS experts