Secure Vehicle Interface: Auto aftermarket's answer to telematics

LAS VEGAS — It may not be surprising that most U.S. vehicle owners want full access to and control of their vehicles' telematics data, including maintenance and repair information, according to the results of a survey sponsored by the Auto Care Association (ACA).

The survey results, along with independent repair shops' determination to not lose market share, served as an impetus for the ACA's launch of the Secure Vehicle Interface (SVI) during the recent Automotive Aftermarket Products Expo (AAPEX) in Las Vegas.

SVI is an internationally standardized technical design that provides for secure and standardized access to the In-Vehicle Networks (IVN) for access to operational, maintenance and driver behavioral data by the automotive aftermarket and vehicle owners.

With nearly 90 percent of all new cars equipped with wireless technologies that can transmit vehicle information, the ACA said it is concerned that vehicle manufacturers are gaining exclusive access to vehicle data at the expense of consumers and independent repair shops.

Traditionally, automotive repairers have had direct access to vehicle diagnostics for maintenance and repairs. However, as vehicle technologies continue to evolve and data are transmitted wirelessly, OEMs are working to ensure they gain exclusive access and ownership of this information, the ACA claims.

"SVI is a collection of technical design standards that ensure vehicle data interfaces always enable safe, secure and standardized consumer access and control of the data their car generates," ACA President and CEO Bill Hanvey said.

"If a car owner is unable to directly access and control the data their car produces, then they can't determine where or how they have their vehicle serviced," he said. "This would mean greater inconvenience, greater cost and fewer options for taking care of their vehicle."

"SVI's internationally standardized design enables a smarter, more efficient global infrastructure where vehicles can 'talk' to infrastructure components, like roadside controllers, traffic lights, emergency vehicles and more," Joe Register, ACA vice president of emerging technologies, added.

SVI's standardized authentication and security specifications can be adapted to both new and late model vehicles.

"So you can implement the secured vehicle interface on vehicles that currently don't have it so that they can utilize the intelligence transportation system," Mr. Hanvey said.

Maintaining access

"We're an association based on data, we're an association based on technology… ," Mr. Hanvey said. "We're investing in where we need to invest to ensure the future of the aftermarket. We're investing in data to make sure that our members can make better business decisions. And we're investing globally to make sure that people understand that we're a global industry."

He described SVI as an agnostic technology with a set of standards addressing access to vehicle data so that independent repair shops can access the vehicle's codes without having to go through the OEMs.

"So nobody owns it. We thought, as an association, that that is the way to do it. To ensure that there's a free marketplace," he said.

Repair shops would need credentials or certificates to get access to vehicle data, Mr. Hanvey said, similar to access protocols used by the SDRM (Society for the Administration of Mechanical Reproduction Rights), which handles reproduction licensing for authors, composers and publishers.

Mr. Hanvey said the association is still determining if there is a need for a separate credentialing organization.

Working with OEMs

"The car company can build their vehicle system any way they want," noted Aaron Lowe, ACA senior vice president, regulatory and government affairs.

"They just have to make sure it communicates meeting the standards, the ISO (International Organization of Standardization) standards, that have been developed so that it can communicate with other vehicles and other groups that want that information."

He predicted that OEMs will some day eliminate the on-board diagnostics (OBD) data port in favor of wireless data access.

"Back in the 1980s we fought really hard to make sure the OBD system was generic and everyone would have one plug and everybody would use the same system. That was really critical. If that hadn't happened in the '80s, we'd all have proprietary systems for each car. It would have been a mess," Mr. Lowe said.

"So we're looking now at wireless communication. We're looking at a new cybersecurity protections. We're trying to do the same thing to make sure there is a generic way that this information can be shared, but it's cyber secure.

"There's a new world going on out there. We're going to have to take different precautions, but we're trying to make sure there's going to be competition for the consumer in the long run and that's what SVI seeks to do.

"It's not a product. Nobody owns it. It's actually a standard that's been developed by ISO. ... This is going to be something that is going to benefit the industry in the long term. We're going to have to work out issues. … What data is going to be available and how that's going to be determined? Once we get agreement from the manufacturers and we get to that point, those issues can be worked out."

However, the OEMs have been reluctant to agree, Mr. Lowe said.

To force the OEMs' hand, the ACA is considering introducing legislation in Massachusetts in January to implement SVI standards. Massachusetts previously enacted the Right to Repair law that went into effect with the 2018 vehicle model year and required OEMs to provide the automotive aftermarket with access to the repair and diagnostic information they provide their franchised dealerships.

The law prompted auto makers that had fought Right to Repair to enter into a memorandum of understanding with the auto aftermarket nationwide to provide access to their service websites for a fee.

The ACA said the best solution to the telematics access issue is a negotiated settlement with the auto makers.

"Absent an agreement, the only apparent solution for ensuring consumer control and access to data is legislation, which we are actively working on via our government affairs department, our coalition partners and more," the ACA said on its website, which is promoting the consumer campaign slogan: "Your car. Your data. Your choice."

"The goal of the Auto Care Association and its members is to empower consumers, legislators and other relevant stakeholders with knowledge about the data collected from their vehicle by auto manufacturers, the restrictions owners currently face when accessing that data, and the opportunities presented by recognizing the right of a vehicle owner to access and control that data," the ACA said.

SVI and technology

Technology based on SVI standards enables access to the data via secure interfaces and provides a standardized format for the transmission of the data, according to the ACA.

SVI provides a standardized, secure design for vehicle data to be shared with third parties at the owner's discretion, the ACA said, enabling vehicles to "talk" to the surrounding infrastructure, such as traffic lights, emergency vehicles, other vehicles, etc.

Technology based on SVI uses hardware and software connected to a vehicle's internal network that translates its data into common language. It creates two secured interfaces for the data to be transmitted — at the vehicle network, either through a wired or wireless method, and at the external receiving point collecting data, according to the ACA.

SVI incorporates a multi-layer approach to ensuring security for consumer vehicle data, the ACA said, including: source authenticity, data integrity, data availability and data confidentiality.

The ACA said SVI is a better solution than the "Extended Vehicle" (ExVe) concept — which provides access to vehicle data in accordance with defined technical, data protection and competition rules through various interfaces — since the auto maker remains in control over its collection and distribution.

SVI, it claims, puts consumers at the center when it comes to data access and control through the use of standardized communication profiles authorized by the vehicle owner. ExVe leaves it up to each manufacturer to decide what data are shared and how to share them.

If the auto makers continue to control the data, consumers will have few choices for vehicle repairers, be subject to the commercial business preferences of the OEM regarding the use of their vehicles' data and face restrictions on access to the critical data needed to repair sophisticated late-model vehicles, according to the ACA.

As part of the SVI debut at AAPEX, the ACA partnered with Q-Free A.S.A., Concepts & Services Consulting (CSC), OnBoard Security Inc., Green Hills Software/Integrity Security Services (GHS/ISS) and CarMD.com Corp. to demonstrate technology that is under development and using vehicle data with SVI, including:

The Open Driving Platform (ODP) connected to the in-vehicle network of a 2018 Dodge Charger to monitor and diagnose the vehicle as it drove around Las Vegas. Using the SVI-enabled interface, the system measured and reported vehicle roadworthiness, diagnostics and emergency notifications — such as an Automated Crash Notification, punctured tire or engine alert — all while the car was in motion.

Intelligent Transport Systems (ITS) connectivity for estimated arrival time and traffic conditions. The system connected with infrastructure using shuttle buses transporting passengers between the AAPEX and SEMA shows. Passengers were able to access real-time arrival times, traffic and vehicle data using their smartphones. The system also monitored vehicle health data for the Dodge Charger, using secure ITS stations to display traffic, speed and geolocation.

"Providing standardized access to the In-Vehicle Networks is an important step toward enabling the deployment of Connected Vehicle (CV) technology to the aftermarket," said Knut Evensen, chief technologist at Q-Free.

"Leveraging security technology from CV pilots will keep the costs down and open up a global market for vehicle owners everywhere, enabling new and innovative products and services related to CV."

"This interface provides a consistent communication interface for collecting and reporting vehicle data to ensure interoperable, safe and secure operation," CSC founder Gangolf Feiter said.

"SVI also provides a secure direct connection to vehicle network systems for certificate-based, authorized third parties, ensuring the integrity of the data being transmitted to properly complete vehicle maintenance and repair."