GB/T 45496-2025Motor vehicle product recall — Guidelines for information defect assessment (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for standardization work Part 1: Structure and drafting rules for standardization documents" Drafting.

Please note that some of the contents of this document may involve patents. The issuing organization of this document does not assume the responsibility for identifying patents.

This document was proposed and coordinated by the National Technical Committee for Product Defects and Safety Management Standardization (SAC/TC463).

This document was drafted by: State Administration for Market Regulation Defective Product Recall Technology Center, Huawei Technologies Co., Ltd., China Automotive Industry Corporation China Automotive Engineering Research Institute Co., Ltd., China Society of Automotive Engineers, China Automotive (Beijing) Intelligent Connected Vehicle Research Institute Co., Ltd., Guangzhou Xiaopeng Motors Technology Co., Ltd., Tsinghua University, Zhejiang Tsinghua Yangtze River Delta Research Institute, Beijing China Automotive Research Institute Technology Co., Ltd., China Automotive Data Co., Ltd., Yutong Beijing Automobile Co., Ltd., Geely Automobile Group Co., Ltd., Beijing Mercedes-Benz Sales and Service Co., Ltd., Beijing Ideal Automobile Co., Ltd. company.

The main drafters of this document are: Li Yan, Dong Honglei, Xiao Lingyun, Tan Yuhan, Xia Guoqiang, Liang Xinmiao, Li Wenzhao, Xi Ming, He Xing, Zhang Yanan, Chen Guihua, Fang Rui, Ding Xu, Gao Yongqiang, Feng Yongqin, Zhang Heng, Qu Xianguo, Ren Yi, Sun Yingce, Peng Jianfen, Huang Rong, Liu Yahui, Wang Jian, Peng Yamin, Chen Jie, Shi Yan, Zhou Fanhua, Ma Chao, Guo Zhen, Yu Mingming, Ma Tao, Wang Peng, Chen Yupeng, and Wu Shengnan.

Introduction

With the cross-border integration of artificial intelligence, information communication and automotive technology, cars are no longer isolated electromechanical units, but have become an important part of the intelligent ecosystem.

As a carrier, cars have gradually evolved from information-isolated means of transportation to a digital space that integrates travel, entertainment, and services.

Security and information security risks are intertwined and superimposed, making the security situation more complex and severe.

The information security risks faced by automobiles come from "cloud-pipe-end-external links", namely cloud platforms, network transmission, vehicles and related external equipment.

Cloud platform information security risks include malicious theft and tampering of data by hackers, illegal access to sensitive data, etc. Network transmission security risks include But not limited to. 1) Transmission risk, sending wrong information; 2) Authentication risk, impersonating the identity of the verifier through identity forgery, dynamic hijacking, etc.

Information; 3) Protocol risk, attackers use false information to induce vehicle misjudgment. Vehicle-side information security risks include but are not limited to. 1) Software and hardware system

1) System security, such as exploiting vulnerabilities to attack vehicles; 2) Key security, such as attackers obtaining control information through plug-in debugging and reverse analysis, using scripts Control the vehicle through a digital key; 3) Architecture security, such as controlling the vehicle's electronic control unit (ECU) through a controller area network (CAN).

The security of externally linked devices includes, but is not limited to, risks caused by vulnerabilities in external ecological components such as manipulating apps and charging piles.

If there is a loophole in any link of the "link", it may affect driving safety, so automobile information defects need to be considered comprehensively from the perspective of system ecology.

Guidelines for evaluating automotive product recall information defects

1 Scope

This document provides recommendations for the evaluation of automotive product information defects, and outlines the evaluation process, evaluation and defect identification, and the handling of evaluation results.

This document is applicable to automobile manufacturers, parts manufacturers, system suppliers, data service providers, network operators, product recall The recall authorities, product recall technical institutions and other entities conduct defect analysis and defect judgment on the loopholes of the "cloud-pipe-end-external link" system of in-use vehicles.

Determination, risk warning and emergency response.

2 Normative references

GB/T 25069

GB/T 34402-2017

GB/T 40914

GB/T 43387

GB 44495

3 Terms and definitions

The terms and definitions defined in GB/T 25069, GB/T 43387, GB 44495 and the following apply to this document.