In the era of vehicle networking safety and strong supervision, understand the key points of implementing mandatory national standards in advance →
Driven by artificial intelligence and the new generation of information and communication technology, the automobile industry is accelerating the transformation, and intelligent networked vehicles have become the key direction of the global automobile industry transformation. However, development and risk coexist. According to the monitoring data of China Information and Communication Research Institute, in 2023, there were 8.05 million attacks on domestic car networking service platforms, a year-on-year increase of 25.5%.
Intelligent driving, safety first. How to fasten the network "safety belt" for "smart car"? () Experts gave the answer when interviewed by CCTV →
In order to further improve the technical level of information security protection of China’s automobile products, strengthen the ability of industrial chain risk prevention and response to cyber attacks, and build a baseline of automobile information security protection, the Ministry of Industry and Information Technology has organized the formulation of the mandatory national standard GB 44495-2024 "Technical Requirements for Vehicle Information Security" (hereinafter referred to as the "Standard"), which will be officially implemented on January 1, 2026.
The Standard specifies the requirements of the automobile information security management system, as well as the technical requirements and test methods for external connection security, communication security, software upgrade security, data security, etc., and is applicable to M-class, N-class and O-class vehicles equipped with at least one electronic control unit.
Tianrongxin, based on the detailed requirements for automobile information security in the Standard, analyzes the specific implementation path of the Standard around two chapters: information security management system requirements and information security technical requirements, hoping to provide effective technical reference for automobile information security construction.
Information security management system requirements
Vehicle information security management system that vehicle manufacturers should establish
The Standard points out that vehicle manufacturers need to establish and strictly abide by the automobile information security management system covering the whole life cycle of vehicles.
Internal management process
Internal management processes involving information security should be formulated to ensure a clear division of responsibilities for information security and form a systematic management framework.
risk management
Establish a comprehensive risk management process, including identification, evaluation, classification and disposal of vehicle information security risks, and take corresponding measures according to different threat levels.
Information security test
Formulate and implement the vehicle information security testing process to ensure that the vehicle information system meets the safety requirements in all aspects of design, development, production and use.
Monitoring and response
In view of the network attacks, network threats and loopholes of vehicles, the process of real-time monitoring, rapid response and timely reporting is formulated to prevent the occurrence and spread of potential safety incidents.
Supply chain management
Formulate and implement the management process to ensure that the information security cooperation between suppliers and service providers meets the standard requirements.
Tianrongxin: It can assist vehicle manufacturers to complete the construction of automobile information security system, and provide business consulting support, certification process guidance, system documents and process documents development.
Business consulting and certification support: provide information security management system consulting and certification process guidance, and help enterprises build management processes that meet the requirements.
Document and document development: assist in the development of information security management system documents, including management process, test and verification, risk management, etc., to ensure that the system is documented.
Process construction: support the establishment of risk management, TARA analysis and safety testing processes, covering parts and vehicle safety testing.
Vulnerability management: provide a vulnerability management process of monitoring, responding and reporting to ensure that enterprises respond to security vulnerabilities in a timely manner.
Supplier management and platform construction: formulate supplier management system and build a safety management platform for vehicle networking to ensure effective reduction of information security risks.
Technical requirements for information security
Vehicle manufacturers should improve their information security capabilities.
External connection safety requirements
The Standard specifies the safety requirements for external connections to ensure that vehicles are free from the risks of attacks and data leakage when using wired and wireless connections. The specific contents include:
Remote vehicle control safety: ensure the communication safety through remote control and prevent illegal vehicle control caused by remote attack.
Third-party application security: protect the interaction security between third-party applications and vehicle systems, and prevent third-party applications from being maliciously exploited.
External interface security: prevent intrusion through physical interfaces (such as USB and OBD ports) and ensure interface security.
Tianrongxin: The safety of external connection of vehicles can be ensured through vehicle safety SDK, vehicle networking safety operation platform and vehicle safety detection platform.
Vehicle Security SDK: It has the functions of intrusion detection, authentication and encryption, and firewall, and can comprehensively detect and reinforce the external interface of vehicles, remote control applications and third-party applications.
Safety operation platform of vehicle networking: monitoring the safety status of vehicle network, realizing centralized management of safety events, risk awareness and safety disposal, providing various safety capabilities such as asset management, vulnerability management, alarm assessment, emergency response and situation awareness, and building a complete safety situation awareness and operation system of vehicle networking.
Vehicle networking security detection platform: Through vehicle system security detection tools, vehicle networking application security detection tools, vehicle networking vulnerability scanning tools, etc., it helps vehicle companies and detection institutions to conduct safety baseline detection and standard compliance verification for vehicle external connection network security.
Communication security requirements
Communication security is a key part of the automobile information security protection system. The Standard puts forward the following technical requirements for communication security:
Communication security is a key part of the automobile information security protection system. The Standard puts forward the following technical requirements for communication security:
Communication authentication: ensure the authenticity of all communication participants and prevent unauthorized access.
Integrity of communication channel: ensure that data has not been tampered with during transmission, and ensure the integrity of data.
Validity of communication instructions: ensure the legality of all communication instructions and prevent forged instructions or malicious operations.
Regional border protection: border protection ensures the safe isolation between the communication inside and outside the vehicle and prevents unauthorized access.
Threat data identification and attack detection: detect abnormal data flow and potential attack behavior in time to prevent data leakage or system intrusion.
Tianrongxin: The security of vehicle communication system can be guaranteed by means of communication identity authentication and encryption, communication channel integrity protection, and communication instruction validity and legality verification.
Authentication and encryption of communication identity: through authentication and encryption technology, the identity authenticity of all communication participants is ensured, unauthorized access is prevented, the legitimacy of communication channels and encrypted transmission of data are guaranteed, and the confidentiality and integrity of data during communication are ensured.
Integrity protection of communication channel: using encryption algorithm and data verification technology to ensure that data is not tampered with during transmission, prevent man-in-the-middle attacks and ensure the integrity of communication channel.
Validity and legality verification of communication instructions: Based on vehicle communication protocol and instruction verification mechanism, ensure the legality of all communication instructions and prevent forged instructions, malicious operations or unauthorized instruction injection.
Regional boundary protection and isolation: Through vehicle-mounted firewall technology and network security domain division, the security isolation between in-vehicle and out-of-vehicle communication is established to prevent cross-domain attacks or unauthorized access and ensure the communication security between different areas.
Threat data identification and attack detection: The vehicle-mounted intrusion detection and defense system (IDS/IPS) can monitor and record abnormal communication data flow in real time, detect and identify potential attacks in time, and prevent data leakage and system intrusion.
Network security testing and verification: provide integrated and standardized vehicle networking security testing capabilities through the vehicle networking security detection platform, identify potential threats in the vehicle communication process, analyze system vulnerabilities, verify the compliance capabilities of vehicles and parts, and ensure vehicle communication security.
Security requirements for software upgrade
The Standard clearly requires the safety of vehicle software upgrade, mainly focusing on the following aspects:
Vulnerability security: Prevent the vulnerabilities in the software upgrade package from being exploited by attackers and ensure the security of the upgrade package.
Online upgrade security: ensure the confidentiality and integrity of data transmission when upgrading software remotely, and prevent data leakage and tampering.
Offline upgrade security: ensure the security of upgrade package and upgrade equipment during offline upgrade, and avoid malicious modification or malicious code implantation of upgrade package.
Tianrongxin: provide all-round software upgrade security for vehicle manufacturers and third-party suppliers, and ensure the vulnerability protection of upgrade packages during the whole upgrade process and the security of online and offline upgrades.
Vulnerability scanning: comprehensively scan and detect the vulnerabilities of the on-board software upgrade system and upgrade package, identify potential security vulnerabilities that may be exploited by attackers, and ensure that there are no security risks in the software upgrade package, which meets the requirements of vulnerability protection.
Online upgrade security: through data encryption and authentication mechanism, the data transmission security during remote software upgrade is ensured, and the upgrade package is prevented from being intercepted, leaked or tampered during transmission. The system will verify the legality of the upgrade package to prevent unauthorized malware installation.
Offline upgrade security: strictly verify the offline upgrade package and upgrade equipment to ensure the security of offline upgrade package and storage media. By encrypting and authenticating the upgrade equipment and media, the upgrade package can be prevented from being maliciously tampered with or implanted with malicious code, and the integrity and security of data in the offline upgrade process can be ensured.
Security detection: security detection is carried out in all aspects of the upgrade to verify the authenticity and integrity of the upgrade package, to ensure that the system can operate stably and safely during the upgrade process, and to avoid the security threat caused by malicious tampering or counterfeiting of the upgrade package.
Data security requirements
With the continuous improvement of automobile informatization, the security of data in production, storage, transmission, access, use and destruction has become very important. The Standard puts forward multi-level protection requirements for data security, mainly including:
Data production safety: ensure the safety of the data generation process in the car and prevent the data from being tampered with in the generation process.
Data storage security: through encryption and access control mechanisms, ensure that key data stored in the car (such as vehicle identity information, sensitive personal information, security logs, etc.) will not be accessed or modified by unauthorized personnel.
Data transmission security: ensure that the confidentiality and integrity of data are not threatened during the transmission between the car and the car.
Data access control: set strict access control on key data in the car to ensure that only authorized personnel can access or operate.
Data destruction security: ensure that when data is no longer needed, it can be destroyed safely and thoroughly to prevent data leakage.
Tianrongxin: It can provide a vehicle data security mechanism to ensure the safety of vehicle data in all aspects of data production, storage, transmission, access and destruction.
Data production safety: strictly protect the generation process of in-vehicle data to ensure that the data will not be tampered with or maliciously operated in the generation process, and ensure the authenticity and integrity of the data source.
Data storage security: through encryption technology and access control mechanism, the key data stored in the car, such as vehicle identity information, sensitive personal information and security logs, are protected to ensure that these data will not be accessed, read or tampered by unauthorized personnel.
Data transmission security: Encrypted transmission protocol is adopted to ensure high confidentiality and integrity of data transmission inside and outside the vehicle, and to prevent data from being intercepted, leaked or tampered with during transmission.
Data access control: set strict access control for key data in the car to ensure that only authorized personnel can access or operate these data, effectively avoiding unauthorized access and potential security risks.
Data destruction security: when data is no longer needed, ensure that data can be destroyed safely and thoroughly, and prevent the risk of data leakage or malicious recovery in the destruction process.
In addition, based on Tianrongxin vehicle networking security detection platform, the vehicle data security capability is comprehensively tested and verified through automated and standardized processes to ensure that data security measures meet the requirements of the Standard, and at the same time effectively reduce the potential risks of vehicles in data security.
According to the forecast, in 2025 /2030, the incremental output value of China’s automobile and Lu Yun integration is expected to reach 729.5/258.25 billion yuan respectively. As a mainstay, the intelligent networked automobile industry accounts for more than 80%. Based on the continuous accumulation practice, Tianrongxin has now formed an Internet of Vehicles security system, which includes integrated deep Internet of Vehicles security protection, multi-dimensional Internet of Vehicles data security governance and full life-cycle Internet of Vehicles security operation. In a recent interview with Information Security and Communication Security Magazine, Tianrongxin Fan Xuejian emphasized that the integrated safety of vehicles and Lu Yun should focus on the whole chain protection!
The safety of intelligent networked automobile products is the focus of consumers’ attention, and it is also the fundamental guarantee for the sustained and healthy development of intelligent networked automobile industry. In the future, Tianrongxin will adhere to the development of the vehicle networking industry with safety "genes", continue to strengthen the deep integration of new technologies, new models and intelligent networking scenarios, and explore a new paradigm of intelligent networking vehicle safety. Based on cloud security protection, it will form a flexible and adaptive vehicle-road cloud protection system with deep defense, synergy and linkage.