Software is expanding what vehicles can do, from advanced infotainment and connected services to increasingly sophisticated control of driving, braking, and steering. However, as these capabilities grow, so does the range of functions, data, and interactions that engineers must secure. Protecting personal information and digital services sits alongside preventing unauthorised access to safety-critical systems that can affect vehicle behaviour.
Greater connectivity adds further exposure. Wireless interfaces, diagnostic connections, and external services create potential entry points, while internal networks must prevent a compromise from spreading between functions. Within all systems, engineers must consider both how an attacker could gain access and what they could reach once inside.
That security challenge also extends beyond the vehicle. Electric vehicle (EV) charging infrastructure connects cars with chargers and supports digital services, while rapidly expanding vehicle-to-everything (V2X) communications introduce exchanges with other vehicles and roadside infrastructure, extending the range of interfaces that need protection.
Building security into this connected architecture requires both software and hardware that can support protection throughout the vehicle’s life. Avnet Silica brings together semiconductor technologies and technical expertise to help engineers select and integrate the security capabilities their automotive designs need.
Click to enlarge Figure 1 - The different areas of car security include access, processing, networks, gateways, and interfaces (Source: NXP)
More Software, Longer-Term Security Responsibilities
As vehicles become more software-defined, their functionality is increasingly shaped by updates and services introduced after production. Engineers must design for a connected system that will continue to change, protecting today’s functions while providing the capacity to address vulnerabilities and support future software throughout its intended life.
CONTACT OUR AUTOMOTIVE EXPERTS
Security Across Increasingly Integrated Systems
The shift towards zonal architectures and central computing is consolidating functions previously distributed across separate electronic control units (ECUs) onto shared computing platforms. Applications with different security and safety requirements may therefore share processing, memory, and communication resources, making isolation and access control particularly important. Engineers must establish which software can access those resources and how a compromised application can be contained.
Advanced driver assistance systems (ADAS) and automated driving illustrate the stakes. As software takes on more responsibility for steering, braking, and acceleration, unauthorised changes to its operation could have direct consequences for physical safety. An externally accessible infotainment application must therefore remain separated from safety-critical control functions, even where they share underlying infrastructure. The challenge spans the relationships between functions as well as the protection of each individual controller.
Responsibility Beyond Production
Connected services and over-the-air (OTA) updates create pathways through which vehicle software and configurations can be changed after production. These connections are a significant source of exposure: Upstream’s 2026 Global Automotive and Smart Mobility Cybersecurity Report found that 67% of the 494 publicly reported incidents it analysed from 2025 stemmed from telematics and cloud systems1.
BMW’s ConnectedDrive Upgrades, for example, allows owners of compatible vehicles to purchase features such as Driving Assistant Plus after delivery. These capabilities depend on communication between the owner’s account, the manufacturer’s services and the vehicle. If inadequately protected, that pathway could be exploited to activate functions without authorisation or deliver manipulated software. Engineers must therefore secure both access to the service and the vehicle’s verification of any software or configuration change it receives.
Vehicle access is evolving in a similar way. Smartphone-based digital keys can be issued, shared, and revoked, requiring protection of both the credential and the processes that grant access. Manufacturers and suppliers must manage these changing permissions alongside emerging vulnerabilities and software fixes to ensure that new functionality does not create new risks.
Hardware Foundations for Evolving Software
Software provides much of this adaptability, but its protections need a foundation that is resistant to compromise. Hardware-based security can isolate cryptographic keys and sensitive operations from application software, while a hardware root of trust can anchor verification of the code allowed to execute. This helps preserve essential security functions even when vulnerabilities emerge elsewhere in the system.
These requirements shape the choice of microcontrollers and processors with integrated security, dedicated secure elements, and technologies that protect vehicle communications. Engineers must assess how these capabilities work together to isolate applications, safeguard credentials, and verify updates, establishing a security architecture that can support the vehicle throughout its intended life.
Key Technologies for Automotive Cybersecurity
Avnet Silica’s portfolio spans secure processing, dedicated security devices, and protected communications. Technologies from NXP, STMicroelectronics, Renesas, and Microchip help engineers build these capabilities into vehicle controllers, connected services, and access systems.
Secure Processing and Software Execution
Integrating security into the main controller allows software verification, protected key handling, and cryptographic operations to sit alongside application processing. For consolidated architectures, hardware-enforced isolation also helps maintain boundaries between applications sharing the same device.
NXP supports body control, zone control, and vehicle infotainment with its S32K3 automotive microcontroller family. Built around scalable Arm® Cortex®-M7 cores, these MCUs integrate a hardware security engine (HSE) with NXP-provided firmware for secure boot, key storage, and cryptographic operations.
Firmware over-the-air (FOTA) support includes A/B firmware swapping and rollback, while real-time drivers support AUTOSAR and non-AUTOSAR applications. Compatibility with the wider S32 automotive platform enables software reuse as engineers scale between vehicle-control designs.
Hardware-Based Identity and Key Protection
Microchip provides external hardware security modules through its CryptoAutomotive portfolio, enabling engineers to add security alongside an existing host MCU. The TrustAnchor TA100 supports secure boot, message authentication, and trusted firmware updates.
Multiple automotive OEMs worldwide have already approved the device for EVITA Medium and EVITA Full HSM requirements. Furthermore, AUTOSAR drivers and Microchip’s CryptoAuthentication library support integration into AUTOSAR and custom software stacks, helping Tier 1 suppliers upgrade ECU security while retaining existing application code.
Protected In-Vehicle and External Communications
A compromised ECU must not become a route into other vehicle functions. Alongside its CAN, LIN and automotive Ethernet portfolio, Avnet Silica offers hardware security capabilities for protecting keys and supporting message authentication within the controllers exchanging data.
That containment is particularly important in connected cockpits, where smartphone interfaces and online services expand the attack surface. Renesas’ cockpit and infotainment solutions address this through R-Car processing platforms with hardware-assisted virtualisation, secure boot and trusted execution environments. These capabilities help engineers separate externally connected applications from sensitive functions and verify software before execution.
For digital vehicle access, engineers must establish both whether a key is authorised and whether it is nearby. Avnet Silica’s Bluetooth, UWB and secure-element portfolios provide routes to discovery, secure ranging, and credential protection, with automotive-qualified devices required for vehicle integration.
Click to enlarge Figure 3 - Architecture illustrating secure in-vehicle networking, software updates, external communications, secure boot, hardware security and gateway protection across key vehicle systems.
External Charging Infrastructure
EV charging stations operate as distributed fleets of connected edge devices. Network interfaces, remote-management services, and OTA update channels extend their attack surface, making device authentication and firmware integrity central to fleet operation. ISO 15118 Plug & Charge adds certificate-based authentication, requiring protection of the private keys used to establish trust.
Article
Protecting EV Chargers from Phishing
while EV charging stations become ubiquitous, the use of QR codes at these stations introduces a new cybersecurity threat with broad implications: QR code phishing, also known as ‘quishing’.
Cyber Resilience Act Compliance
Avnet Silica offers a range of supplier solutions, which provide developers with the tools and technologies needed to enhance cybersecurity and trust in their embedded systems and IoT devices.
Device Provisioning & Management
Avnet Silica pioneers secure device management with a commitment to simplicity, scalability, and heightened control.
Product
i.MX 952 - Applications Processor
Part of the EdgeVerse™ portfolio of intelligent edge solutions, the i.MX 952 offers advanced security with integrated EdgeLock® secure enclave to support energy-efficient edge computing.
STMicroelectronics' STM32H5 MCUs provide security capabilities for connected charger controllers, including ST’s Secure Manager trusted execution environment on supported devices. Isolation separates sensitive services from application code, while secure boot and authenticated firmware updates help prevent an OTA delivery channel from becoming a route for executing manipulated software. These mechanisms support continued patching without trusting every image received over the network.
Renesas' RA6M5 MCUs combine Ethernet and CAN FD interfaces with Arm TrustZone and a Secure Crypto Engine supporting key management and hardware cryptography. For charger communications and control, these capabilities support protected device identities and authenticated exchanges. Dual-bank flash with block swapping complements firmware verification by enabling in-field image replacement, addressing the practical installation stage of fleet-wide updates.
Going beyond hardware, Avnet Silica’s secure provisioning service supports credential installation through an encrypted, documented production process.
Frequently Asked Questions
| Questions | Answers |
|---|---|
| What are the main cybersecurity challenges facing connected and software-defined vehicles? | Connected and software-defined vehicles expose more potential attack surfaces through wireless interfaces, diagnostic connections, cloud services and other external connections. At the same time, centralised and zonal architectures increasingly consolidate functions with different safety and security requirements onto shared hardware, making isolation and access control critical. Engineers therefore need to protect data and services, prevent unauthorised access to safety-critical functions, contain compromised applications and maintain security as vehicle software evolves throughout its lifecycle. |
| What role does hardware-based security play in protecting connected vehicles? |
Hardware-based security provides a protected foundation for software security. It can isolate cryptographic keys and sensitive operations from application software, while hardware roots of trust establish trusted verification of the software permitted to execute. Automotive solutions can also incorporate hardware security engines (HSEs), secure boot, protected key storage and hardware-enforced isolation to help safeguard credentials, authenticate communications and maintain boundaries between applications. For example, the NXP S32N5 architecture available through Avnet Silica combines an advanced hardware security engine with on-chip hardware isolation for mixed-criticality applications. |
| How can manufacturers maintain vehicle cybersecurity throughout the vehicle’s lifetime? |
Cybersecurity needs to extend beyond production because software-defined vehicles continue to receive new features, configurations and security updates in the field. Vehicle architectures, therefore, need to support ongoing software updates, authentication, credential management and the remediation of newly discovered vulnerabilities. Credential management should cover the entire product lifecycle, from manufacturing and field installation to ownership changes, OTA firmware updates and decommissioning. Keys and certificates may also need to be securely updated while the vehicle is in the field. |
| How can engineers protect over-the-air vehicle updates from cyberattacks? |
OTA security should ensure that a vehicle verifies software or configuration changes before accepting them, with support from secure boot, protected credentials, and cryptographic authentication. The NXP S32K3 family, for example, combines a hardware security engine with secure OTA capabilities. OTA protection can include firmware verification keys, protected firmware decryption keys and firmware signing to verify integrity before an update is installed. |
| How can connected infotainment systems be isolated from safety-critical vehicle functions? |
Engineers can use hardware-assisted isolation and virtualisation to maintain boundaries between externally connected applications and sensitive vehicle functions, particularly when workloads share a computing platform. Renesas' R-Car processing platforms use hardware-assisted virtualisation, secure boot, and trusted execution environments for connected cockpit and infotainment applications. The principle becomes especially important as vehicle architectures consolidate. NXP's S32N5 architecture, for example, supports on-chip hardware isolation for mixed-criticality applications. |
| Which automotive cybersecurity standards and regulations should engineers consider? |
A key standard is ISO/SAE 21434, which addresses automotive cybersecurity engineering. An internal Avnet Silica resource describes it as a building block that helps OEMs achieve compliance with UNECE Regulation No. 155 (R155), whose requirements cover security processes over the development, production and post-production lifecycle. UNECE WP.29 R155 and R156 also relate to cybersecurity and software updates. For EV charging, ISO 15118 is also relevant, particularly its Plug & Charge security requirements and certificate-based authentication. |
| How are smartphone-based digital car keys protected against unauthorised access? |
Digital car keys require protection of both the credential and the processes used to issue, share and revoke access. Secure elements can protect digital key credentials, while technologies such as Bluetooth, UWB, and NFC can support vehicle access. Security measures can also include secure owner pairing, mutual authentication between the vehicle and smartphone, and secure OTA software updates. STSAFE-V500-based designs show secure digital key storage, mutual authentication between the car and the phone, secure owner pairing, and secure OTA updates. |
| What cybersecurity measures do connected EV charging stations need? |
Connected EV chargers need to protect communications, device identities and firmware against attack. TLS can secure communications between the EV and charger, while certificates and private keys enable authentication and must be securely stored and managed. Firmware integrity checks and protected OTA updates also help ensure that only trusted software is installed. ISO 15118 Plug & Charge uses certificate-based authentication to establish trust between the vehicle and the charging infrastructure |
| How can Avnet Silica support secure automotive and EV charging designs? |
Avnet Silica combines automotive and industrial semiconductor portfolios with security expertise and secure provisioning services. Support can begin at the architectural stage, covering security requirements and potential approaches before progressing into system-level design, software enablement and component selection. Avnet Silica also has expertise in device provisioning and management, software security and cybersecurity compliance. For implementation, Avnet Silica can support secure processing, dedicated security devices, protected communications and secure provisioning across vehicle controllers, access systems and connected charging stations. Avnet Silica's secure provisioning capability can provision components with keys, certificates and firmware before shipment, or provide an HSM-based approach for provisioning credentials on the customer's production line. |
Building Trust into the Connected Vehicle
The flexibility of connected vehicles depends on their ability to change without compromising the systems people rely on. As new services, digital keys, and software updates extend functionality beyond production, the hardware selected today must support continued authentication, isolation, and protection throughout the vehicle’s life. The same principle applies to the charging infrastructure connecting vehicles with the wider energy and service ecosystem.
Avnet Silica brings together automotive and industrial semiconductor portfolios, technical expertise, and secure provisioning services to help engineers translate these requirements into practical designs, from vehicle controllers and access systems to connected charging stations.
Sources
Working on an Automotive project?
Our experts bring insights that extend beyond the datasheet, availability and price. The combined experience contained within our network covers thousands of projects across different customers, markets, regions and technologies. We will pull together the right team from our collective expertise to focus on your application, providing valuable ideas and recommendations to improve your product and accelerate its journey from the initial concept out into the world.