Nexteer crafts new ways to steer clear of cyberattacks

In simpler times, vehicle steering was based on hydraulics, and Nexteer Automotive was known as Saginaw Steering, the in-house supplier to General Motors. Today, 70 percent of independent Nexteer's business is electric power steering, or EPS, and most of the rest comes from advanced products such as electric vehicle drivelines. But because of the shift to software-based components, Nexteer must now devote more time and resources to innovating new protective cybersecurity solutions. News Editor Lindsay Chappell spoke with the supplier's chief technology officer, Robin Milavec, and Kathy Pattok, Nexteer director of safety and security. Here are edited excerpts.

Q: Is cybersecurity a new field for Nexteer?

A: Milavec: Our earliest cybersecurity dates from 2016. But it didn't have as much dedicated hardware as it does now. Cyberattacks are getting more and more sophisticated over time.

Milavec: Even 10 years ago, the majority of vehicles were closed and there was no access point for anything external entering a vehicle. We would develop our software and electronics for a vehicle and it would get launched, and that was it. Now we have over-the-air flash and the software is no longer static.

How are your products vulnerable?

Milavec: Electronics is the entry point into the vehicle, and that gets into the subsystems, like the control of steering. But it even goes back into our own suppliers who provide our electronics. They are a significant part of our strategy to protect the entire value chain.

Pattok: With autonomous features, the steering system is expecting to receive external commands and respond to them.

So we need to make sure that those commands are coming from an authentic source, not a spoof message.

How do you keep up technologically with what the bad guys are doing?

Milavec: We work closely with the OEMs and they provide the requirements and specifications; they own the electrical architecture of the vehicle. It's up to us to take their requirements and offer them solutions on how to protect messages within the vehicle.

Pattok: There is also an industry consortium called Auto ISAC (Automotive Information Sharing and Analysis Center) that gives companies a means to anonymously report incidents.

We monitor that to make sure we're up to speed on what's happening in the industry.

As the methods and techniques become more sophisticated, the complexity of encryption also becomes more sophisticated.

We now have hardware-based solutions that can run these cryptographic algorithms faster. We also have hardware dedicated to security that's embedded into our product, serving as a trusted part of the system where the security assets and keys can be held completely separate from our regular EPS application program.

Help us understand what that component of dedicated hardware looks like.

Pattok: Within the microprocessor that runs the EPS application there is a hardware security module. It's contained within that chip. It's a processor within a processor.