Category: Blog

4 April, 2023 . 6 mins read

Improving Suburban Mobility with Multi-modal MaaS

In the past decade we have seen an emergence of mobility-as-a-service (MaaS) companies that create and manage their own platforms, aiming to make transportation efficient, easy-to-use, and available for everyone. Mobility-as-a-service provides an integrated transportation experience through a single platform allowing users to plan and pay for their journey seamlessly.

The most common example of MaaS are ride-hailing services like Uber and Lyft. These companies have democratized mobility-as-a-service, combining the entire experience from hailing a cab to paying for your ride into a mobile application. The emergence of ride-hailing also allowed for the spread of a C2C model in mobility, significantly increasing the supply of available transportation options. And due to the asset-light business model of ride-hailing companies it is easy to scale and launch in any country. Impact the likes of Uber and Lyft made on the mobility industry is undeniable, however, this impact is mostly concentrated in bigger cities.

An important characteristic of e-hailing services is its C2C operation model, where for the service to operate efficiently there needs to be an appropriate number of drivers willing to use their personal vehicles to provide rides to users. While this model works well in big cities it is less feasible in suburbs and rural areas that have smaller populations. If there are not enough people providing rides on Uber or Lyft people will not use the app.

It is also important to note that private and shared rides offered by ride-hailing companies are generally much more expensive than public transportation. An experiment conducted in Chicago revealed that the average public transit fare was $2.69, while Lyft and UberX rides averaged $18.13 and $17.90 respectively. This stands to prove that routine ride-hailing is not a very affordable transportation option for a lot of people. Even though ride-hailing comes with its own advantages, there are still limitations to how well it can operate in smaller cities and rural areas.

Increasing mobility coverage in smaller cities

It’s no secret that rural and suburban communities often lack access to reliable and efficient public transportation. Unreliable schedules, shortage of transit options, and lack of ride-hailing service presence significantly reduce the selection of available transportation means for suburban residents. Nonetheless, it is extremely important to connect rural populations with better transit options.

Developing a multi-modal MaaS platform can solve the inefficiency problems in the current suburban public transit system. A multi-modal mobility platform integrates different modes of transport into a single application that generates navigation directions across various transport modes and provides a centralized payment channel. The greatest advantage of multi-modal MaaS is that it provides users with a wide range of transportation options, making it easier for them to choose and combine the most efficient, convenient, and cost-effective one. By combining various modes of transportation such as public transit, ride-sharing, bike-sharing, car-sharing, and more, multi-modal MaaS offers users a seamless and integrated transportation experience that takes them from door-to-door.

For instance, if your commute from point A to point B consists of a bus ride and a 10-minute bike ride, the application will generate detailed directions to your destination, calculate your travel time according to real-time transit schedules and traffic congestion, and allow you to pay for both the bus and bike-sharing fee all on the same platform. Thus, a multi-modal MaaS offers the potential to integrate public transit with other mobility options, creating a higher range of transportation choices for users. By adding more variety into transport supply, a multi-modal mobility platform could transform a relatively inflexible transit system into one that is extremely efficient, cost-effective and easy-to-use.

Customized multi-modal MaaS case study

In 2022, AUTOCRYPT developed a multi-modal transport sharing platform for Jeju Island, a scenic tourist destination off the coast of Korea. The island is notorious for being hard to navigate without a private vehicle. So, the platform was designed to help tourists and locals get around the island without a car. By integrating alternative means of transport, such as electric bikes, electric motorcycles, and electric scooters, to complement public transport, the platform offers users an extended range of transit options, where all services can be accessed and paid for through a single application. The app also included benefits for users in the form of discounted transfer between public transport and micromobility.

Beta testing services began in April 2022, and the platform was officially launched in October of the same year. Operational data collected throughout this period revealed that the platform gained nearly 10,000 account registrations and had over 3,000 active users, serving a total of 10,312 trips. The number of account registrations almost tripled between beta testing and the official launch. The number of trips made via the platform also increased from 1,157 in April to 1,838 in October.

The operational data indicate that both locals and tourists used the platform to navigate the island with ease. Not only has the platform expanded transportation options for users, but it has also opened up new routes to more distant destinations. This is a significant accomplishment as it has allowed people to explore remote areas that would have otherwise remained unvisited, and at the same time helped local businesses in hard-to-access areas gain more customers.  

Moreover, the platform collects valuable data that can be used to improve the local mobility infrastructure. For instance, data of frequently used routes can be analyzed to help improve public transit and micromobility availability for these routes. Additionally, operational data can be used to indicate off-peak times, which can be leveraged to introduce dynamic pricing strategies.

A similar platform tailored to unique local needs can be created in any region. Such a platform would help improve suburban mobility and expand transportation options for local populations.

MaaS aims to provide users with a seamless transportation experience, making it easier and more convenient to get around cities. A multi-modal mobility service takes it a step further by offering a range of transport options through a single custom-made platform to provide users with a flexible, integrated, and sustainable transportation system that can improve mobility and enhance the quality of life in any region.

8 March, 2023 . 7 mins read

Software-Defined Vehicles: Tangent Industry Collaboration Opportunities

The lines between the automotive and tech sector are blurring as we approach the age of software-defined vehicles. Modern day vehicles are much more sophisticated than ever before, where hardware and software are intricately intertwined to achieve superior car performance and user experience. And while improving hardware is not new for OEMs, creating advanced software systems is a much tougher task. Automotive system innovations are causing disruptions in the entire industry, affecting manufacturing processes, product management, policies, and more. However, these disruptions are bringing in an array of new opportunities in the sector and its tangent industries.

B2B auto insurance

The way vehicles operate has changed in the past decade, but the insurance policies surrounding our cars have not evolved at the same rate as the technology. There is still no universal framework that decides who is liable for accidents involving software-defined vehicles (SDVs). Yet, current events in the industry are pointing to a shift of liability from individuals to OEMs, especially when autonomous driving is involved. Auto insurance policies have yet to reflect upon industry developments.

Traditional vehicle insurance policies typically cover physical damages resulting from driver-caused accidents. However, as ADAS and autonomous driving becomes more prevalent, the element of human error will gradually decrease, making traditional insurance policies less relevant. In addition, as software improves and cars become safer, revenue from individual insurance sales will also drop. Losses are expected to reach $25 billion, putting auto insurance providers at a risk of bankruptcy. Nevertheless, industry disruptions are creating new opportunities for auto insurance providers, with a significant portion of these opportunities located in the B2B sector. Between 2020 and 2025, new insurance policy revenues are predicted to reach $81 billion , according to a source.

As long as vehicle performance is directly tied to software performance, OEMs will be held accountable for cyberattacks, bugs, and software malfunctions in SDVs. Since the cost of software-caused accidents can have a colossally negative impact on manufacturers they will be looking for ways to offset the losses. Insurance providers will need to adjust to the changes in the industry and create policies that offer coverage for a new set of potential threats for a smaller pool of larger customers. Key opportunities for new policies include cybersecurity insurance, product liability insurance, and infrastructure insurance for OEMs and governments.

In recent years, cyberattacks have become more common and are projected to cost the automotive industry $505 billion. Due to the growing frequency of malicious cyberattacks, governments are enforcing cybersecurity regulations and pushing OEMs to adopt more stringent cybersecurity measures. Data breaches, hacking break-ins, ransomware attacks, and similar incidents are on the rise, and as the number of SDVs continues to increase, these attacks may soon spread into the automotive industry, leading to various negative consequences. One solution to mitigate these risks is for auto insurance policy providers to analyze the most common cyber threats and offer coverage for a new set of cyber risks. This approach can help companies protect themselves and their customers against the costly repercussions of cyberattacks.

In addition to cyberattack insurance, OEMs will also need to insure themselves against product malfunctions. Software is just as crucial to a car’s function as hardware, and failures in either can have devastating consequences. Fiat Chrysler experienced the effects of software issues firsthand when a pair of cybersecurity researchers uncovered a significant vulnerability in the manufacturer’s Jeep Cherokee. The researchers were able to hack into the car’s internal computer network through its Wi-Fi connection, gaining access not only to the car’s entertainment system but also to its engine, transmission, and brakes. The discovery revealed software shortcomings in multiple Chrysler models and eventually led to a recall of 1.4 million vehicles. As a result, the OEM’s stock value dropped by more than 2%. This case shows that software gaps can lead to catastrophic outcomes that could cost companies millions, if not billions. Therefore, manufacturers will need product liability coverage to offset the high stakes of potential software malfunctions.

Vehicles are not the only things getting smarter nowadays. The infrastructure is becoming increasingly reliant on software. Wireless technologies that allow communication between pedestrians (V2P), vehicles (V2V), and the infrastructure (V2X) are crucial for ensuring safety on the roads. But even the infrastructure is not entirely safe from cyber risk. Higher levels of connectivity can create more pathways for malicious hackers to exploit. Infrastructure software malfunctions can disrupt traffic conditions in entire cities, potentially putting people’s safety in jeopardy. Failures in the infrastructure can negatively impact governments, OEMs, drivers, and pedestrians. Hence, the risks should be insured against with appropriate coverage policies.

Vehicle software development and maintenance

The number of electric and software-defined vehicles is rapidly increasing, causing car manufacturers to shift their focus from hardware to software. Most new vehicles on the road are essentially computers on wheels, and like any computer, vehicle software needs to be properly maintained and periodically updated to improve performance. To keep up with this demand, manufacturers will need to expand their software development departments. However, since software-defined vehicles are a relatively new concept, most OEMs still lack the technological expertise to create and maintain advanced vehicle software technologies.

Creating and continuously managing vehicle software will become more challenging as the number of self-driving vehicles grows. Vehicle software management requires specialized technical expertise and large amounts of computing power, which in turn requires substantial financial resources. To keep up with industry trends manufacturers have developing in-house technological capabilities, hiring new personnel, establishing subsidiaries, and even acquiring other companies. While expanding in-house abilities can be a viable plan, OEMs can also embrace collaboration and seek partnerships with software solutions providers. By delegating software development, maintenance, bug fixes, and management to software suppliers, car manufacturers can focus on their core competencies. At the same time, software suppliers can unlock new revenue streams by entering the automotive sector.

An example of such cross-industry collaboration is the partnership between Mercedes-Benz and Nvidia. The two companies are working on a new software architecture for self-driving vehicles that is expected to add upgradable automated driving functions in the OEM’s vehicles. Unique expertise and know-how shared through cross-industry partnerships will positively affect the supply chain and help push the industry further forward.

Cybersecurity by design

As the SDV market expands, cybersecurity is becoming one of the biggest challenges facing the industry. Regulations hold manufacturers fully responsible for ensuring cybersecurity measures throughout the supply chain, which means that the risks associated with cybersecurity incidents are not just limited to a single player in the market.

To ensure vehicle cybersecurity measures are effective, manufacturers need to take a multi-faceted approach. One of the key areas that needs to be addressed is the protection of in-vehicle systems. These systems, which are responsible for controlling various vehicle functions, need to be secured to prevent unauthorized access and tampering. Additionally, manufacturers need to ensure secure charging for electric vehicles, as well as safe infrastructure communications. Each of these measures requires the development of different solutions and management systems, which can be a complex and time-consuming process.

In addition to implementing security software, companies also have to periodically test and update their security systems to keep up with the evolving threat landscape. OEMs will need the help of cybersecurity experts to put all of the cybersecurity measures in place. This creates new market opportunities for B2B partnerships between manufacturers and cybersecurity providers. Automotive cybersecurity solutions providers can advise manufacturers on the required security systems and deliver the necessary cybersecurity software. Various models of software-as-a-service can be offered to the manufacturers. Cybersecurity solutions providers can take on the task of not only developing the security software, but also managing it and performing periodic checks and improvements.

Disruptions caused by the new trends in the automotive sector are creating opportunities for collaboration with tangent industries. To take full advantage of current market opportunities, the automotive industry will need to embrace the culture of collaboration.

To stay informed and updated on the latest news about AUTOCRYPT and mobility tech, subscribe to AUTOCRYPT’s official newsletter.

23 February, 2023 . 5 mins read

What Is ASPICE? What does It mean to the Automotive Software Supply Chain?

Software Process Improvement Capability Determination, or SPICE (ISO/IEC 15504, ISO/IEC 33000), is a widely used industry standard for assessing the processes of software development and management, with an emphasis on the capability for continuous improvement. Developed jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), the primary goal of the standard is to help software development task forces and organizations improve the process of their projects. Although SPICE is used for evaluating software development processes in general, several adjusted and extended versions of SPICE have been established to fit the needs of different industries. One of them is ASPICE (Automotive SPICE). As automobiles become increasingly software-oriented, ASPICE is quickly gaining attention in the automotive industry. Many automotive software providers are adopting ASPICE as an assessment standard to improve the quality and efficiency of their software development processes.

The Assessment Framework

Unlike many technical protocols, ASPICE does not define the software development process step by step, but instead lists what practices should be done and what goals should be achieved. This makes the standard applicable to a wide range of software suppliers and development processes, allowing them to carve out a process that best fits their environment.

After undergoing ASPICE assessments, the tested projects are given a rating based on their capability level (CL). A total of six capability levels are included in the assessment framework:

Level 0: Incomplete Process – missing components in the software development process
Level 1: Performed Process – all components are performed, and results are achieved
Level 2: Managed Process – all components are planned, performed, and managed
Level 3: Established Process – process is implemented based on well-established standards across the organization
Level 4: Predictable Process – process is implemented consistently, and results are predictable
Level 5: Optimizing Process – process is consistent, predictable, and continuously improved

Throughout the six levels, organizations that achieve capability levels 2 and 3 are generally considered to have good software development practices, while those achieving levels 4 and 5 are seen as having exceptional capabilities. Not only does this rating system provide helpful insights during self-evaluation, but organizations can also acquire ASPICE certifications by having ASPICE-certified independent parties conduct audits of their software development processes.

For instance, AUTOCRYPT’s new in-vehicle systems security solution, AutoCrypt IVS-TEE, received ASPICE CL 2 certification prior to its initial launch in January 2023. IVS-TEE secures embedded automotive systems by constructing trusted execution environments (TEE), making it one of the first TEE-based security platforms in the automotive industry.

The Assessment Criteria

What are the evaluation criteria that determine the capability levels of an assessment target? To evaluate a process, ASPICE uses the following nine process attributes:

1.1 Process performance
2.1 Performance management
2.2 Work product management
3.1 Process definition
3.2 Process deployment
4.1 Process measurement
4.2 Process control
5.1 Process innovation
5.2 Process optimization

Each of the above attributes is evaluated using a four-point scale, commonly known as the N-P-L-F scale:

N (not achieved): 0-15%
P (partially achieved): 15-50%
L (largely achieved): 50-85%
F (fully achieved): 85-100%

More detailed guidelines are provided in ASPICE on how to evaluate each attribute, making the assessment results both objective and accurate.

The Importance of ASPICE for the Automotive Software Supply Chain

Unlike legally binding regulations such as WP.29 (UN R155/156), ASPICE serves less as a regulation and more as a toolkit that helps all parties in the automotive software supply chain. Suppliers can use ASPICE to gain a clear understanding of their software development processes and improve based on the results, whereas ASPICE certifications can help buyers make more informed purchase decisions for software products.

As the software-centric automotive supply chain starts to take shape, the quality and safety of a vehicle is now defined by its software features instead of hardware performance. As such, many industry players are now adopting ASPICE for an accurate self-assessment of their software development processes, ensuring that the best practices are used to control the quality of embedded automotive software, improve the efficiency of product development, and achieve continuous improvement and long-term success.

Automotive software providers that adopt ASPICE have a competitive advantage as they can maintain a well-defined, streamlined process for software development. This helps them achieve predictable and reliable results while minimizing human errors.

From ASPICE to Software Security

Although ASPICE isn’t a cybersecurity standard per se, it does provide a solid foundation for software security and can be used to complement both cybersecurity and functional safety processes, including ISO/SAE 21434: Road Vehicles – Cybersecurity Engineering and ISO 26262: Road Vehicles – Functional Safety. Since many cybersecurity failures and safety-related recalls can be traced back to improper practice at the development stage, having a well-established and predictable software development process minimizes software vulnerabilities and development flaws.

AUTOCRYPT’s in-vehicle systems security solution, AutoCrypt IVS, also emphasizes the importance of analyzing flaws and vulnerabilities at the software development stage. In 2022, two new tools were introduced to aid this process: AutoCrypt Security Analyzer and Security Fuzzer. One of which uses SBOM-based software composition analysis to eliminate software vulnerabilities at the development stage, while the other uses smart fuzzing to generate semi-random test cases to search for development flaws.

Of course, ASPICE and vulnerability testing do not guarantee security throughout all stages of the vehicle lifecycle. This is why AUTOCRYPT also provides intrusion detection and protection (IDP), as well as a vehicle security operation center (vSOC) for continuous fleet monitoring.

To stay informed and updated on the latest news about AUTOCRYPT and mobility tech, subscribe to AUTOCRYPT’s official newsletter.

19 January, 2023 . 7 mins read

All You Need to Know About V2X PKI Certificates: Butterfly Key Expansion and Implicit Certificates

AutoCrypt SCMS now supports Butterfly Key Expansion for both implicit and explicit certificates of the V2X PKI ecosystem. This article explains why Butterfly Key Expansion is necessary for the SCMS and why implicit certificates might be a useful alternative to conventional certificates.

Vehicle-to-everything (V2X) communication allows vehicles to communicate with other vehicles and road entities for safety warnings, traffic coordination, and eventually vehicle-infrastructure cooperated autonomous driving (VICAD). Given that these V2X messages are critical to road safety, a vehicular public key infrastructure (PKI) known as the Security Credential Management System (SCMS) has been adopted worldwide to protect the integrity of V2X messages and the privacy of road users. V2X PKI certificates, or SCMS certificates, are therefore a crucial enabler of secure V2X communications.

What Is Unique About V2X PKI Certificates?

What makes V2X PKI certificates unique? The most significant difference between IT and V2X authentication is that IT authentication is centralized and hierarchical. Users use their digital signature to reveal their identity to the server, after which the server verifies the identity and grants the user access. There is apparently no need for users to prove their identity to other users. On the other hand, V2X authentication is decentralized, where users (vehicles) need to verify each other’s identity without revealing it. Sounds contradictory? This is made possible by using pseudonym certificates.

In the SCMS, pseudonym certificates are issued by authorization certification authorities (CA) to every road user (vehicle). As suggested by its name, these certificates are pseudonymous and thus do not contain the vehicle’s identity, but instead contain proof that the vehicle’s identity had been verified by the CA and that it is a legitimate entity.

Furthermore, to prevent a stalker from spying on the same pseudonym certificate over an extended period to trace its travel routes and behaviours, pseudonym certificates have very short validity periods. For an average private vehicle, up to 20 pseudonym certificates are issued weekly, rotating every few hours to prevent tracing. These numbers can vary depending on local regulations and the importance of the passenger. For instance, the vehicle for a head of state might require non-rotating, one-time pseudonym certificates issued every five minutes.

What Is Butterfly Key Expansion?

Every time a vehicle requests a pseudonym certificate, the responsible CA needs to sign a new certificate and return it to the vehicle. Given that a typical vehicle needs up to 20 certificates per week, the CA needs to sign over a thousand certificates to a single vehicle over a year. This is a scale never seen before in the IT or financial industry. As more and more vehicles join the V2X environment, it can soon become difficult for CAs to cope with the growing number of requests.

With advancements in cryptographic construction technology, a novel approach known as Butterfly Key Expansion now overcomes this disadvantage. Butterfly Keys allow a vehicle to request an arbitrary number of certificates all at once; each certificate with a different signing key and each encrypted with a different encryption key. A request using Butterfly Key Expansion contains only one signing public key seed, one encryption public key seed, and two expansion functions that enable expansion. Therefore, Butterfly Keys are very useful for requesting pseudonym certificates as they can drastically decrease the number of requests needed.

Note that Butterfly Keys are not needed for issuing application certificates* to roadside units (RSU). Since privacy is not a concern to roadside infrastructures, application certificates are issued once at a time and have very long validity periods, meaning that application CAs are fully capable of dealing with the volume of requests.

(*Pseudonym certificates are used by vehicles for self-identification in V2V communications, whereas application certificates are used by roadside infrastructures for self-identification in V2I applications.)

Explicit vs. Implicit Certificates

Pseudonym certificates can be constructed in two different forms: conventional (explicit) certificates and implicit certificates. Conventional certificates consist of three distinct pieces of data: 1) a public key, 2) the digital signature of the CA, binding the public key to the vehicle’s identification data, and 3) the vehicle’s identification data. During V2V message transmission, the sender signs the certificate with the private key, after which the receiver uses the public key in the certificate to verify and view the message. In this process, the sender’s identity is “explicitly verified” because by opening the message, the receiver knows that the sender is the only entity holding the private key. As such, these certificates are also known as explicit certificates.

However, a disadvantage of explicit certificates is that, since they contain three distinct pieces of data, their size can range between 2,000 bits to 30,000 bits, depending on the level of security needed. Such a size isn’t a concern in and of itself. But in the V2X environment, where traffic volume is high and transmission speeds are pivotal, smaller sizes can be more advantageous.

To enable speedier message transmission and more efficient certificate issuance, a new form of V2X PKI certificate is gaining popularity. Known as implicit certificates, or Elliptic Curve Qu-Vanstone (ECQV), these certificates contain the same three pieces of data as explicit certificates do, but do not carry them as three distinct elements. Instead, the public key and the digital signature are superimposed, leaving a single reconstruction value that is similar in size as the public key. The receiver of the message uses this reconstruction value to reconstruct the public key and verify the message. The way in which the public key and the digital signature are superimposed means that by verifying the public key, the digital signature and the legitimacy of the sender get “implicitly verified”.

Since implicit certificates contain a single reconstruction value, they are much lighter and thus require much less bandwidth to transmit. The typical size of an implicit certificate is only 200 to 500 bits, which is ideal for the SCMS, where a large volume of certificates needs to be transmitted within a constrained timeframe.

The concept of implicit certificates is developed and patented by Blackberry Certicom. Nevertheless, CAs are free to issue implicit certificates for applications in the SCMS in accordance with IEEE 1609.2.

V2X PKI Regional Requirements and Preferences

As mentioned earlier, Butterfly Key Expansion is only beneficial for issuing pseudonym certificates and is not used for generating application certificates. The same is true for implicit certificates. The lightweight advantage of implicit certificates is best seen when applied to pseudonym certificates, but less significant when applied to application certificates. Given that the mechanism behind implicit certificates is more complex, some parts of the world prefer to stay with explicit certificates.

As a result, a mix of different mechanisms is used in the real world. In fact, different transport authorities have established different requirements for the certificates used in their SCMS. In North America, implicit certificates have become the standard for all V2X PKI certificates, whereas, in China, explicit certificates are required. Europe has been establishing two different standards, one for explicit certificates and one for implicit certificates.

In general, V2X PKI certificates can be constructed using four different combinations.

AutoCrypt SCMS Ready to Support All Certificate Types

In late 2022, AUTOCRYPT completed its development on the issuance of both explicit and implicit certificates with Butterfly Key Expansion, gaining the full capability to issue and provision all types of V2X PKI certificates in the SCMS.

To learn more about AUTOCRYPT’s V2X security solutions and AutoCrypt SCMS, contact global@autocrypt.io.

To stay informed and updated on the latest news about AUTOCRYPT and mobility tech, subscribe to AUTOCRYPT’s newsletter.

13 January, 2023 . 6 mins read

The State of Level 3 Autonomous Driving in 2023: Ready for the Mass Market?

Autonomous driving technology has come a long way. In recent years, the automotive tech industry has made significant enhancements to the capability and reliability of sensors, cameras, and vehicle-to-everything (V2X) communication, driving road transport toward higher levels on the autonomous driving spectrum, as defined by the SAE’s Levels of Driving Automation.

SAE J3016 levels of driving automation
Source: SAE International

This spectrum has become an internationally recognized classification for automated driving systems. Its six levels can be divided into two broad categories: driver support systems from L0 to L2 (shown in blue), and automated driving systems from L3 to L5 (shown in green). For the past several years, industry players have been working to make the jump from L2 to L3.

From Level 2 to Level 3 Autonomous Driving, a Legal Matter

Clearly, the leap from L2 to L3 is the most significant leap on the spectrum. Whereas L2 is considered as advanced driver support features, L3 marks the beginning of conditional autonomous driving, where drivers can legally take their eyes off the road when conditions are met. Strictly speaking, only vehicles classified as L3 and above are truly autonomous vehicles.

By today, most major automotive OEMs have mastered their technologies for L2 autonomy. As of the beginning of 2023, L2 driver support systems include Tesla’s Autopilot with “Full Self-Driving”, Audi’s Traffic Jam Assist, GM’s Super Cruise, BMW’s Extended Traffic Jam Assistant, Ford’s Blue Cruise, Hyundai’s autonomous driving package, and many more.

Now, a problem arises when OEMs seek to introduce vehicles with Level 3 autonomous driving. Looking at SAE’s autonomous driving spectrum again, the levels of autonomy are not defined by a vehicle’s self-driving capability, but instead by the expected roles of the vehicle and the human driver. For instance, under L2, the human driver must pay full attention to the road even when all driver support systems are on, whereas in L3, the human driver can officially take their eyes off the road when the automated driving systems are switched on.

Therefore, if an OEM wants to officially introduce an L3 vehicle, it must be liable for all potential accidents that occur while the vehicle’s L3 systems are switched on. That is, no matter how advanced and sophisticated the technology inside a vehicle might be, if the OEM is not ready to claim responsibility for accidents caused by its systems, the vehicle can only be classified as high as L2.

The truth is, although the technology for Level 3 autonomous driving might be ready, many OEMs are not yet prepared to officially claim L3 for legal reasons. This explains why Tesla uses the name “Full Self-Driving” to market its L2 driver support systems without mentioning L3 autonomy. Some OEMs use the term “L2+” to show that their technological capabilities have surpassed L2, yet do not claim L3. Hence, the gap between L2 and L3 is more of a legal gap than a technological gap.

Official Certifications Needed for L3 Autonomy

Since L3 is the first level on the SAE’s spectrum to allow drivers to take their eyes off the road, official certifications and approvals are needed before OEMs can claim a vehicle to be L3. These certifications are often issued by regional transport authorities and highway safety agencies.

In May 2022, Mercedes-Benz became the world’s first manufacturer to get approved by German transport authorities to legally operate its L3 Drive Pilot on the country’s public roads, sold as an option on Mercedes-Benz S Class and Mercedes EQS. This means that those with L3 Drive Pilot are legally allowed to eat, draft emails, or watch videos on the Autobahn. Still, given that L3 autonomy is conditional, if the vehicle loses the environmental or locational conditions to operate at L3, it will prompt the driver to take control within ten seconds. If the driver fails to respond in ten seconds, the car will automatically turn on emergency lights and decelerate to a full stop on the side of the road, then unlock the doors in case first responders might need access to the cabin.

At CES 2023, Mercedes-Benz further announced that it has become the first manufacturer to receive L3 certification in the United States, from the state of Nevada. However, since L3 approval is granted at a state level in the US, the system is only considered L3 in Nevada for now. Nonetheless, the OEM says its Drive Pilot is fully ready to deliver L3 autonomous driving in all 50 states.

Is Level 3 Autonomous Driving Coming to the Mass Market in 2023?

Mercedes is the first manufacturer to make the bold move to bring L3 autonomy to the consumer market. Although Honda Legend won the title for the world’s first approved L3 vehicle back in 2021, only 100 limited-edition vehicles were available for lease only in Japan. Honda’s L3 road map suggests it may take much longer to reach the mass market.

There is no doubt that more and more manufacturers will follow Mercedes’ move towards L3 autonomy. Major OEMs like Hyundai-Kia, Stellantis, BMW, GM, and Honda are continuously reporting progress and plans for L3 rollout. However, it is always easy for OEMs to announce plans and schedules but difficult to make the final decision to obtain L3 approval. Even Mercedes’ L3 Drive Pilot is available for the S Class only, and legally approved in very limited regions (Germany and Nevada). Apart from legal concerns, sensitive public reactions toward flaws in automated driving systems make OEMs more reluctant to introduce L3 vehicles on a large scale.

Hence, although the news is filled with press releases and announcements on launching L3 systems, it is unlikely to see L3 vehicles being available to the mass market within 2023. Nevertheless, following the path of Mercedes-Benz, more and more OEMs will likely launch L3 options for their high-end vehicles in limited regions within the year.

Addressing the Challenges Ahead

Achieving Level 3 autonomy is beyond a matter of technological capability, but a matter of confidence – the confidence that OEMs possess towards their automated driving systems. Before OEMs can gain full confidence in taking responsibility for their automated driving systems, several potential risks need to be addressed. One of them is cybersecurity risk.

Since automated driving features are run by software, these software-defined vehicles (SDV) must not be vulnerable to cyberattacks. If a threat actor were to gain access to a vehicle’s embedded systems and applications, they could gain the ability to tamper with driving data and potentially take control over crucial functions of the vehicle.

AUTOCRYPT has always envisioned a world of L3 and L4 autonomy. Since its inception, it has been working with OEMs and software providers to secure the in-vehicle systems and communication endpoints of SDVs through its industry-leading encryption and authentication technologies, offering solutions from vulnerability testing to intrusion detection and protection.

To learn more about how AUTOCRYPT secures the SDV, download the white paper below.

white paper sdv thumbnail

“The changing tides of the automotive industry into more software, and less hardware, indicate that vehicles will be a possible target for cyberattacks. This is why holistic, comprehensive cybersecurity is essential in securing the next generation of SDVs.”

Download White Paper

 

22 December, 2022 . 2 mins read

Infographic: 2022 Year in Review

Post-pandemic 2022 has been a busy and exciting year for AUTOCRYPT, filled with innovative new product launches and accomplishments. We wanted to thank all our investors, partners, clients, and visitors for all your support over the year. Have a wonderful holiday and see you in 2023!

See below for a summary of AUTOCRYPT’s accomplishments in 2022.

Download PDF

(Accessibility version below)

Red Herring – AUTOCRYPT was selected as “2022 Red Herring Top 100 Global” by Red Herring magazine

2022 Cybersecurity Breakthrough Awards – AutoCrypt IVS won “Automotive Cybersecurity Solution of the Year”

2022 AutoTech Breakthrough Awards – AutoCrypt EQ was awarded “Ride Hailing Innovation of the Year”

Events – We had some meaningful conversations and discussions with our partners and clients at international events this year, including ITF Summit, AutoTech: Detroit, EVS35 Oslo, and ITS World Congress

WebTrust Accreditation – AUTOCRYPT was officially accredited by the WebTrust program as a root CA for the V2X-PKI ecosystem

Series B – AUTOCRYPT closed its Series B financing round with $25.5 million, bringing its total valuation to $120 million

EVIQ – In the summer, we launched EVIQ, an all-in-one EV information and charging platform that comprises a charger locator map, a charging station management system (CSMS) for CPOs, a smart-billing Level 1 EV charger for residential use, and a Plug&Charge security module for secure and seamless charging

AutoCrypt V2X-Air – Launched in Spring, AutoCrypt V2X-Air is a portable OBU for vulnerable road users, enabling pedestrians and micromobility users to easily join the V2X ecosystem

Security Analyzer and Security Fuzzer – We launched a set of vulnerability testing tools utilizable during any stage of the software development lifecycle, dedicated to software-defined vehicles

Integrated Management System for SCMS – IMS for SCMS allows OEMs to view all their entire SCMS certificates on one centralized GUI.

Plug&Charge – AutoCrypt PnC was integrated into Hyundai Motor’s E-pit charging service platform, an ultra-rapid EV charging network across South Korea.