T/CSAE 101-2018Intelligent and Connected Vehicles On-Board Terminal Cyber Security Technical Requirements (English PDF)

3.1 Terms and definitions

3.3.1 Intelligent Network Connected Vehicles Intelligentand Connected Vehicles (ICV)

Intelligent networked vehicles are equipped with advanced in-vehicle sensors, controllers, actuators, etc., and incorporate modern communications and networks.

Technology, realize intelligent information exchange and sharing between vehicles and X (car, road, people, cloud, etc.), with complex environment awareness, intelligent decision-making, Collaborative control and other functions can achieve "safe, efficient, comfortable, energy-saving" driving, and finally can achieve a new one to replace people to operate Generation of cars.

3.3.2 Intelligent network car car terminal ICV On-Board Terminal

The intelligent networked car vehicle end is a subsystem of the intelligent networked car, with data input and output, calculation processing, storage, and communication.

Letter and other functions, can collect relevant ECU data in the car and send instructions to control the ECU, and can also integrate positioning, navigation, entertainment and other functions.

It is a functional unit for car networking, access to the mobile Internet and the inter-vehicle network.

3.3.3 User User

Use the body of the car-side resource.

2T/CSAE 101 -.2018

3.3.4 User Data User Data

Vehicle-side collection, processing, generation, and storage of user personal information and information about the user's use of the vehicle, including but not limited to vehicles Asset data (vehicle identification, etc.), user identification information, application data (locally generated data, externally after user permission) Enter data in the user data area, etc.).

3.3.5 Authorization Authorization

After the user identity is authenticated, the user is granted the corresponding permission according to the preset security policy.

3.3.6 Digital Signature Digital Signature

A numeric string appended to the data generated by the sender of the information or operated by a password conversion method. number the recipient of the data can verify the source and integrity of the data by verifying the digital signature, and the digital signature can also protect the data from tampering.

Forgery, to ensure the non-repudiation of data.

3.3.7 Code Signing Code Signature

A mechanism for signing all or part of a code by an entity with signature authority using a digital signature mechanism.

3.2 Abbreviations

ICV Intelligentand Connected Vehicle BGA Ball Grid Array Solder Ball Array Package LGA Land Grid Array Grid Array Package SPA Simple Power Analysis Simple Power Analysis DPA Differential Power Analysis Differential Power Analysis CPA Correlation Power Analysis related power analysis SE Secure Element security unit ECU Electronic Control Unit Electronic Control Unit CAN Controller Area Network TLS Transportation Layer Security Secure Transport Layer Protocol CD Compact Disc DVD Digital Video Disk Digital Video Disc SD Secure Digital Secure Digital USB Universal Serial Bus Universal Serial Bus

4.1 Vehicle-side security architecture

One of the new business requirements of intelligent networked vehicles is that the vehicle-mounted terminal with network connection function communicates externally through cellular network and short-distance communication.

Letters, as well as vehicle/vehicle communication, establish connections with the Internet and the inter-vehicle network for data exchange; internal and automotive bus and electronic and electrical 3T/CSAE 101 -.2018 the system collects information and issues instructions. As an important node of the intelligent network connection inside and outside the vehicle, the vehicle end should adopt technical measures.

Prevent, detect and block security attacks implemented through multiple network interfaces, ensuring that important subsystems in the vehicle do not have network connectivity and increase security risks.

The intelligent network connection vehicle information security system and the vehicle-side security architecture are shown in Figure 1. The overall security system is secure by the cloud.

The letter security and vehicle safety are composed of multiple parts. The vehicle end is an important part of the intelligent networked car, and its information security architecture is the vehicle.

An important part of information security, covering the hardware level of the vehicle end itself, the operating system level, the application level security, Security of external and inbound communications, as well as data security.

4.2 Overall safety objectives

The overall safety goal of the vehicle-mounted terminal is to avoid the security problems caused by information security problems through various measures at all levels of the vehicle-mounted end.

Damage to drivers and traffic participants, and the resulting public safety issues; while preventing personal information from leaking and due to information Property damage caused by security incidents.

4.3 Hardware Security Objectives

The vehicle-side hardware security goal is to ensure that the circuits and chips used by the vehicle-side system implement data calculation and data storage functions.

Security, the ability to use hardware-related technologies to combat multiple attacks at the physical level for encryption and decryption operations, such as cryptanalysis attacks, Side channel attacks, fault injection attacks, etc.

4.4 Operating System Security Objectives

The operating system security goal is that the operating system is correct by the identity rights management and access control mechanism that conforms to the vehicle-side application scenario.

Respond to authorized operations and handle abnormal behavior against overflow attacks, brute force attacks, man-in-the-middle attacks, replays, Tampering, forgery and other security threats, ensuring the availability, confidentiality, integrity and auditability of operating system files, ensuring Normal access to class resources, the system can function as expected or in a safe state under various conditions.

Figure 1 Schematic diagram of intelligent networked car information security system and vehicle-side security architecture

Intelligent networked car information security Cloud security Communication security Private cloud security Public cloud security Smart terminal APP security Car, vehicle and roadside facilities are safe and secure Vehicle safety High-level subsystem security Medium level subsystem security Bus/gateway security Low-level subsystem security Vehicle-mounted safety Data Security Application security Operating system security Hardware security foreign Communication Safety Internal Communication Safety 4T/CSAE 101 -.2018

4.5 Application Security Objectives

The application security goal is to ensure that the application software installed on the vehicle end has the corresponding source identification and confidentiality and integrity prevention.

Protection measures against a variety of application-specific security threats such as reverse analysis, decompilation, tampering, unauthorized access, and application the generated and used data is safely processed, the security of communication between the vehicle-side application and the related server is ensured, and the application is guaranteed to be a user.

Security when providing services and applications in startup, upgrade, login, and exit modes.

4.6 Intranet communication security objectives

Intracommunication refers to communication between the vehicle end and the in-vehicle bus and the electronic and electrical system. Its security goal is based on the application scenario.

The need for communication and data exchange ensures the security isolation between external threats and the internal network, ensuring that the vehicle end does not go to internal critical electronic the electrical system sends instructions and data of attack mode, such as forgery and replay, without illegally occupying internal bus resources;

The system receives the integrity and certifiability of the data and handles it accordingly, ensuring the authenticity of the subsystems in the vehicle communicating with the vehicle.

And the confidentiality and integrity of the data to ensure the normal function of the car.

4.7 External communication security objectives

External communication includes communication between the vehicle end and the cloud platform through the cellular network, short-distance communication with the mobile terminal, and Communication between other vehicles and roadside facilities. The security goal of external communication is to ensure the communication and data exchange requirements according to the application scenario.

The vehicle end establishes a secure connection with the external device, the communication parties take the necessary two-way identity authentication, and the key transmission data is made.

Use encryption and integrity verification to combat various security threats such as sniffing, man-in-the-middle attacks, and replay, and ensure data.

Confidentiality, integrity and certifiability.

4.8 User Data Security Objectives

User data security goal is to ensure the security of user data collected, stored, processed and transmitted by the vehicle end, ensuring users the confidentiality, integrity and availability of data are effectively protected, with a certain degree and granularity of user authorization and corresponding the configuration capabilities and disposal mechanisms protect the security of all aspects of the data lifecycle.

5.1 Overall security

5.1.1 Selection and implementation of safety technology

5.1.1.1 Through the risk assessment process, the network interface and threat attack path should be comprehensively analyzed to clarify the overall security requirements of the vehicle.

Vehicle-side security requirements, comprehensive selection of identity authentication, access control, detection response and other technical measures to secure the vehicle-mounted terminal itself Protection, and the vehicle-side safety protection as an integral part of the vehicle's overall safety protection system to achieve the overall safety objectives of the vehicle (eg. to ensure the personal safety of drivers and traffic participants).

5.1.1.2 The overall network security protection needs should be considered comprehensively, and the security technical measures on the vehicle end can effectively cooperate with the cloud security technology.

The technical measures are coordinated with the technical measures of communication network security.

5.1.1.3 The selection and implementation of vehicle-side safety technical measures should be closely integrated with the vehicle design and development verification test procedures.

5T/CSAE 101 -.2018

5.2 Hardware Security

5.2.1 Design safety

5.2.1.1 The chip used in the vehicle-mounted system cannot exist to illegally access the chip memory or change the function of the chip.

Concealed interface. The debug interface used by the chip during the design verification phase should be disabled in the marketed product.

5.2.1.2 The circuit board of the vehicle end system shall not have a readable silk screen for marking the functions of the chip, port and pin.

5.2.1.3 The communication lines of sensitive data between the vehicle end system chips should be as concealed as possible (for example. a vehicle using a multi-layer circuit board) the end system uses the inner layer wiring to hide the communication line) against the eavesdropping and forgery attacks on the internal data transmission of the vehicle end.

5.2.1.4 The key chips used in the vehicle end should minimize the exposure pins (for example, chips in BGA/LGA package).

5.2.2 Access Control

5.2.2.1 The vehicle-mounted terminal has a hardware-implemented security zone or security module to realize the important data security storage of the vehicle-mounted device.

isolation.

5.2.2.2 Sensitive information written once in a secure area or security module shall be guaranteed not to be obtained or altered without authorization.

5.2.2.3 The security zone or security module shall have the ability to detect and dispose of unauthorized access against brute force attacks.

5.2.3 Anti-attack protection

5.2.3.1 Use the necessary security mechanisms (eg, packaging) to protect against voltage, clock, electromagnetic, laser, etc.

Fault injection attack.

5.2.3.2 Use necessary safeguards against simple power analysis (SPA) attacks, first-order differential functions for cryptographic chips Consumption analysis (DPA) attacks, related power analysis (CPA) attacks, and side-by-side information such as runtime, temperature, etc.

Channel attack.

5.2.3.3 Use the necessary protection mechanisms to combat intrusion and tampering attacks on the in-vehicle device memory.

5.3 Operating System Security

5.3.1 Operating System Safe Boot

5.3.1.1 The operating system signature should be stored in a secure storage area. The operating system should use a trusted mechanism when it starts, in the verification operation After the system signs and determines the pass, the car-side operating system is loaded from the trusted storage area to avoid loading the tampered operating system.

5.3.2 Multiple Operating System Isolation

5.3.2.1 If there are multiple operating systems on the vehicle side, an isolation mechanism shall be adopted to ensure the security protection between different operating systems.

5.3.3 Operating System Load Application

5.3.3.1 Security mechanisms should be provided to ensure that the operating system can only load and launch a trusted car-side application and can verify the application.

Source and integrity to avoid running malicious programs.

6T/CSAE 101 -.2018

5.3.4 System Security Protection

5.3.4.1 integrity verification methods (eg, digital abstraction techniques based on hash algorithms or digital signature techniques) should be used, Critical code or file for integrity protection.

5.3.4.2 There is no back door in the vehicle end system, nor does it exist in the "China Automotive Industry Vulnerability Sharing Platform (CAVD)" and "Country the Home Information Security Vulnerability Sharing Platform (CNVD) has issued a high-risk security vulnerability of 6 months or more. The system should be able to be timely the way to fix the bug.

5.3.5 Resource Access Control

5.3.5.1 The notification and control methods applicable to each application scenario of the vehicle should be adopted to realize the application to the system sensitive resource call (example) for example, when using location information, the user knows. A setting switch is provided for the user to agree or reject the call.

5.3.5.2 Provide a secure execution space for critical applications based on sensitive data through a trusted execution environment, controlling critical resources Access (eg, key, CAN controller), protecting the confidentiality and integrity of resources and data against unauthorized access and tampering and so on.

5.3.6 Security Logging and Audit Control

5.3.6.1 Supports the logging function for critical events of the operating system, recording the time, object, description and result of the event.

5.3.6.2 Supporting the log upload function, the cloud is authenticated during uploading; according to the cloud management requirements, it is transmitted in a secure manner.

Logs are saved to ensure data integrity and certifiability.

5.3.6.3 An access control mechanism shall be adopted to manage the read and write permissions of the log; the log storage shall be protected against security.

5.3.7 System Software Updates and Firmware Updates

5.3.7.1 Accept only the agreed conditions (eg non-driving state) and vehicle system status (eg battery capacity meets requirements) the update request of the software such as the vehicle-side operating system and the application is initiated, and the update operation is performed after the user confirms.

5.3.7.2 When the software is updated, it should be able to identify the source of the update package and perform the update file received.

Integrity check. Software upgrades should not affect user settings and user data. The system should have backup and recovery capabilities and be able to Perform the necessary operations when a new exception occurs to prevent the system from failing due to an update failure. The system should record the continuous upgrade behavior.

The maximum number of upgrade attempts within a certain period of time, to avoid excessive consumption of vehicle resources through the vehicle-side upgrade attempt.

5.3.7.3 When the vehicle terminal transmits update files and update commands to other in-vehicle systems or equipment (eg ECU), be able to declare your identity and authority in time for the system or equipment in the car to be certified; only after the certification is passed, the operation can continue carried out.

5.3.8 Media Interface Security

5.3.8.1 There should be no undeclared peripheral media (eg CD/DVD, SD card, USB) interface on the vehicle side.

5.3.8.2 The vehicle side shall define the file type and authority on the storage medium accessed through the peripheral interface, and limit the connection through the medium.

The type of operation that the port performs on the vehicle side.

5.3.8.3 The necessary methods should be used to detect files that may modify the system configuration or operating status and Result alarm and disposal.

7T/CSAE 101 -.2018

5.4 Application Software Security

5.4.1 Basic requirements for application software security

5.4.1.1 Universal application software should not exist in the back door, nor in the "China Automotive Industry Vulnerability Sharing Platform (CAVD)" and the National Information Security Vulnerability Sharing Platform (CNVD) released high-risk security vulnerabilities for 6 months and above.

5.4.1.2 Application software should not contain malicious acts such as unauthorized collection or disclosure of user information and illegal data transmission.

5.4.1.3 The application does not store user sensitive information in clear text (eg user password, document number, transaction password, private key).

5.4.1.4 Application software should use security mechanisms (eg, confusion, packing) to combat reverse analysis for applications.

5.4.2 Application Software Signature Authentication Mechanism

5.4.2.1 The application software should adopt the code signature authentication mechanism, and the code signature mechanism complies with the relevant standards.

5.4.3 Application...