KEYS&MORE is a Key Management System developed by INCERT Luxembourg Public Agency. Providing tailored encryption tools for manufacturing excellence.

How encryption key management systems meet regulatory demands in the automotive industry

New regulations in the automotive industry recognize the truth about today’s connected vehicles: they run on electronics as much as on mechanics. The summer of 2024 will mark a significant rise in the cybersecurity expectations of automotive original equipment manufacturers (OEMs). The arrival of these EU regulations elevates the important role of encryption key management systems (KMS) in achieving compliance.

UN Regulation No. 155 (UNECE R155) on cybersecurity and cybersecurity management systemsentered into force in the EU for all “new vehicle types” in 2022 but will to all “new vehicles” starting in July 2024, officially ushering in a new era of automotive cybersecurity.

Paired with UN Regulation No. 156, which focuses on software updates and their respective management systems, UNECE R155 takes into account the new reality of automobiles today—namely their reliance on software updates and interconnected systems.

Over-the-air updates and device-to-device communication multiply potential access points for cyberattacks. Because of the interplay between devices and between systems, one vulnerability can give cybercriminals sweeping control. And when hackers have control, vehicle users do not, a high-consequence scenario.

How KMS facilitates compliance

UNECE R155 lays out industry threats and related mitigations in great detail, sometimes referring to cryptography specifically. The vast majority of these mitigations, which vehicle manufacturers must demonstrate within their “Cyber Security Management System,” can be addressed through an effective key management system.

The below list quotes specific UNECE R155 mitigations (Annex 5, Tables B &C) that can be addressed by the right encryption key management system:

.1 “Security controls shall be implemented for storing cryptographic keys” (Ref M11) to mitigate the following threats:

Sybil attacks
Invalid update due to software provider’s compromised encryption keys
Extraction of cryptographic keys

.2 “Access control techniques and designs shall be applied to protect system data/code” (Ref M7) from the following threats:

Data manipulation
Circumventing of monitoring systems
Unauthorized changes to vehicle’s electronic ID
Extraction of software
Manipulation, erasure & overwriting of vehicle held data/code via communication channels
Introduction of data/code to vehicle’s systems
Introduction of malicious software
Unauthorized access to falsify configuration parameters of key functions & charging parameters

.3 “The vehicle shall verify the authenticity and integrity of messages it receives” (ref M10) to mitigate the following threats:

Spoofing of messages
Code injection
Accepting information from unreliable source
Man-in-the-middle attack or replay attack
Malicious V2X, software & proprietary messages

.4 “Cybersecurity best practices for software and hardware development shall be followed” (ref M23) to mitigate related threats, such as:

Breaking of encryption by cyberhackers (due to short encryption keys & long validity periods)
Inadequate use of encryption to protect systems
Design of hardware or software that allows attacks or fails to stop them
Breaches via unprotected gateways & data points

.5 “Confidential data transmitted to or from the vehicle shall be protected” (ref M12) in order to mitigate the following threats:

Interception of information
Interfering radiations
Communications monitoring

6 “Measures to prevent and detect unauthorized access shall be employed” (ref M9) to mitigate the following threats:

Granting of privileged access (e.g. root access) to unprivileged user
OEM hardware manipulation

Throughout the document, the authors also reiterate the necessity of implementing backend security controls to prevent unauthorized access, data breaches, access to system critical data and risks related to cloud computing.

What this means for automotive OEMs

In order to achieve regulatory compliance, designated by a physical marker, manufacturers must provide proof, and receive official approval that their cybersecurity management system addresses the development, production and post-production phases. They must demonstrate that their processes sufficiently address security, including the Annex 5 mitigations listed above.

Importantly, OEMs will report back annually to confirm that their “cyber security measures implemented are still effective in light of new cyber threats and vulnerabilities that have been identified” (7.2.2.2.).

Identifying the right KMS solution

OEMs, therefore, require a KMS solution that retains the flexibility necessary to evolve with new realities. They also need a centralized KMS that allows them to meet audit demands and demonstrate comprehensive cybersecurity processes on an annual basis.

Because no two OEMs’ legacy systems or security needs are identical, KMS providers must offer customized deployment options to organize, complement, unify and improve upon existing processes. Bringing existing systems under one organization-wide KMS solution will allow the internal team to effectively manage its encryption keys throughout their entire lifecycle.

A KMS tool like Keys&More, enables OEMs to better meet a variety of UNECE R155’s requirements, for example, the definition of user roles and access privileges; and the maintenance of security procedures, including the logging of actions and access. Or the need to secure messages received by the vehicle, such as diagnostic messages, vehicle-to-vehicle communications or proprietary messages sent from OEMs.

Moving forward, all cryptographic modules in use must meet consensus standards or be otherwise justified.

For most manufacturers in the automotive industry, these regulations will trigger an overhaul to their cybersecurity processes. Those without a robust encryption key management system will need to adopt a solution that fortifies their existing cryptography practices to achieve a compliant state. A customizable, flexible encryption key lifecycle management system is the answer.

Questions about UNECE R155 & how we can help? Unsure where to start? Speak with one of our KMS experts

Contact

UN Regulation No. 155: KMS as a Path to Compliance for OEMs

How encryption key management systems meet regulatory demands in the automotive industry

How KMS facilitates compliance

What this means for automotive OEMs

Identifying the right KMS solution