GB 44495-2024Technical Requirements for Vehicle Cybersecurity (English PDF)

Foreword

This document was drafted in accordance with the rules given in GB/T 1.1-2020, Directives for standardization - Part 1: Rules for the structure and drafting of standardizing documents.

The technical content of this document refers to the United Nations Technical Regulation UN R155 Uniform rules for the approval of vehicle cybersecurity and cybersecurity management system.

Please note that some of the contents of this document may involve patents. The issuing organization of this document is not responsible for identifying patents.

This document is proposed and managed by the Ministry of Industry and Information Technology of the People's Republic of China.

1 Scope

This document specifies the requirements for vehicle cybersecurity management system, basic requirements for cybersecurity, technical requirements for cybersecurity and same type identification, and describes the corresponding inspection and test methods.

This document applies to category M and category N vehicles, as well as category O vehicles that are equipped with at least one electronic control unit.

2 Normative references

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the version corresponding to that date is applicable to this document; for undated references, the latest version (including all amendments) is applicable to this document.

3 Terms and definitions

Terms and definitions given in GB/T 40861, GB/T 44373 and GB 44496, as well as the following, are applicable to this document.

The state where the vehicle's electrical and electronic systems, components and functions are protected from asset threats.

risks associated with vehicle cyber threats and to protect vehicles from cyberattacks.

The process of discovering, identifying and describing risks, understanding the nature of risks and determining the level of risks, and comparing the results of risk analysis with risk criteria to determine whether the risks are acceptable.

Potential causes of unexpected events that may result in harm to systems, organizations, or individuals.

Weakness that can be utilized by one or more threats in an asset or mitigation.

Software and hardware installed on the vehicle side that are capable of directly receiving, distributing and verifying upgrade packages from outside the vehicle, etc., to achieve software upgrade functions.

Software upgrade that is transferred to the vehicle wirelessly rather than using cables or other local connections.

“Over-the-air upgrade” is also called “remote upgrade”.

“Local connection” generally refers to the physical connection made through the on-board diagnostics (OBD) interface, universal serial bus (USB) interface, etc.

Software upgrade other than over-the-air upgrade.

Personal information that, once leaked or used illegally, may lead to discrimination against vehicle owners, drivers, passengers, people outside the vehicle, etc., or serious harm to their personal or property security.

4 Abbreviated terms

5 Requirements for vehicle cybersecurity management system

5.1 Vehicle manufacturers shall have a cybersecurity management system for the entire vehicle life cycle.

The entire vehicle life cycle includes the vehicle development phase, production phase and post-production phase.

-- Establish a process for vehicle cybersecurity management inside the enterprise.

-- Establish a process for identifying, assessing, classifying, and handling vehicle cybersecurity risks and verifying that identified risks are handled, and ensure that vehicle risk assessments are kept up to date.

-- Establish a process for vehicle cybersecurity testing.

● Including vulnerability management mechanism, clearly defining the activities of vulnerability collection, analysis, informing, handling, release, and reporting;

● Establishing a process to provide relevant data and analyze cyber-attacks, such as analyzing and detecting cyber-attacks, threats and vulnerabilities through vehicle data and vehicle logs;

● Establishing a process to ensure continuous monitoring of cyber-attacks, cyber threats and vulnerabilities, and the vehicle shall be included in the monitoring scope no later than the time of vehicle registration;

● Establishing a process to ensure that identified cyber-attacks, cyber threats and vulnerabilities are responded to and addressed within a time frame;

● Establishing a process to evaluate whether implemented cybersecurity measures remain effective in the event of the discovery of new cyberattacks, cyber threats, and vulnerabilities.

-- Establish a process to manage cybersecurity dependencies between the enterprise and contract suppliers, service providers, and vehicle manufacturer sub-organizations.

6 Basic requirements for cybersecurity

The scope of risk assessment includes the various elements of the vehicle and their interactions, and further considers the interactions with external systems.

Key elements include, but are not limited to, elements that contribute to vehicle security, environmental protection or theft prevention, as well as system components that provide connectivity or parts of the vehicle architecture that are critical to cybersecurity.

6.4 The vehicle manufacturer shall take measures based on the requirements of Chapter 7 to protect the vehicle from the risks identified in the risk assessment. If the measures are not relevant to the identified risks, the vehicle manufacturer shall explain their irrelevance. If the measures are not sufficient to address the identified risks, the vehicle manufacturer shall implement other measures and explain the rationality of the measures used.

6.5 If there is a dedicated environment, the vehicle manufacturer shall take measures to protect the dedicated environment used by the vehicle to store and execute postinstalled software, services, applications or data.

Such as sandbox dedicated environment, etc.

-- Ability to identify vehicle cyber-attacks;

-- Monitoring and data forensics capabilities for vehicle-related cyber-attacks, cyber threats and vulnerabilities.

-- Adopt cryptographic modules that comply with international, national or industry standards;

-- For the cryptographic modules not adopting international, national or industry standards, explain the rationality.

6.10 Vehicles shall adopt default security settings. For example, the default connection password of WLAN shall meet the complexity requirements.

6.11 Requirements such as in-vehicle data processing, non-collection by default, application of accuracy range, desensitization processing, personal consent and prominent notification in motor vehicle data processing activities shall comply with the provisions of 4.2.2 in GB/T 44464-2024.

7 Technical requirements for cybersecurity

8 Inspection and test methods

9 Same type determination

10 Implementation of standards

For new vehicle models applying for type approval, implementation will begin from the date of implementation of this document.

For vehicle models that have obtained type approval, implementation will begin on the 25th month from the date of implementation of this document.

Bibliography