Cybersecurity Research Considerations for Heavy Vehicles

Abstract

The intent of this research is to investigate cybersecurity aspects of medium-duty/heavy-duty (MD/HD) trucks (classes 1 to 8) and compare those aspects to passenger vehicles. Information collected had a significant bias towards HD vehicles (class 7/8), as opposed to MD vehicles. This was due to the discovery process yielding very limited data on MD vehicles (class 3 to 6). This directly correlates to the types of responses provided by industry experts and their cybersecurity concerns (mainly by heavy truck OEMs and suppliers). Much focus was centered around their higher electronic content products that typically occur on class 7/8 vehicle platforms. Often, stakeholder feedback indicated that MD trucks have similar vulnerabilities to either light-duty or heavy-duty trucks but not necessarily anything particularly unique to that segment. This generality likely originates from the similarities between MD truck architectures/designs and HD truck architectures. The objective is to develop a framework to understand common features and differences between passenger vehicle and heavy-duty vehicle cybersecurity in terms of lifecycle, threats and risks, electrical/electronic architectures, control applications, security countermeasures, and industry aspects. Considering recent public awareness of passenger vehicle cybersecurity vulnerabilities, NHTSA undertook this research to understand potential impacts in the heavy-truck vehicle domain. This task started with the investigation of heavy-vehicle cybersecurity practices by contrasting the passenger vehicle cybersecurity knowledge-base to that of heavy vehicles. The project next considered risks in a more generic manner, and identified possible mitigation mechanisms. The comparison framework developed in this document was leveraged to help indemnify the possible mitigation mechanisms. The investigation and data gathering concentrated efforts on issues that affect vehicle safety, but not necessarily asset protection.