ISO/SAE® 21434:2021 is an international standard for the automotive industry, addressing cybersecurity risks within modern road vehicles. The standard specifies requirements for building secure electrical and electronic (E/E) systems, including their components and interfaces, and keeping them secure over their lifetime. ISO 21434 provides a reference implementation for the Cyber Security Management System (CSMS) of UN-ECE R.155, and thereby prescribes the technical prerequisites for type approval of road vehicles.
This standard can be seen as a companion of ISO 26262 (the functional safety standard for road vehicles), but also addresses risks from malicious cyberattacks on E/E systems and their interactions. These risks must be continually identified and managed to ensure that the vehicle, driver, and other road users remain safe in today’s fast-changing threat landscape. ISO 21434 does not mandate the use of specific methods or countermeasures. Rather, it defines activities and work products that must be produced and updated continually as evidence for adequate risk management.
Building Secure Systems with Model-Based Design
Model-Based Design with MATLAB and Simulink addresses both ISO norms in one common toolchain. Model-Based Design enables developers and practitioners to build secure systems to generate the necessary work products and rapidly update designs in case of security incidents. The workflow provides full traceability between requirements and design, from initial concept to final implementation. Hierarchical refinements of specification and metadata enable developers to assess the completeness of the security architecture, determine the impact of design changes, and ensure overall consistency. Advanced verification methods identify vulnerabilities before they reach production and open an attack surface. With these capabilities, engineers can spot missing countermeasures and design secure solutions. Once engineers address security risks, they can implement the solution quickly and accurately with automatic code generation.
Detecting Vulnerabilities with Static Code Analysis
Another method that addresses risk is static code analysis, which the safety and cybersecurity standards recommend. Engineers can apply this method to generated and hand-written code to verify compliance with coding guidelines (including CERT C/C++, MISRA© security, and CWE) and identify other problems like integration defects, confidentiality threats, and performance issues. The deep formal-methods-based analysis of data and control flows can reveal defects that are hard to find with conventional methods like dynamic testing and can even prove the absence of critical vulnerabilities.
The full workflow documentation, reports, test suites, and additional certification artifacts are provided in the IEC Certification Kit (for ISO 21434, ISO 26262, ASPICE, and IEC 61508).
“Without Model-Based Design, we would have needed at least 30% more time to develop and certify the ESCL application software. We saved time and effort by generating efficient code that satisfied all our speed and memory requirements.”
Using MATLAB and Simulink Products for ISO 21434
Key products for developing ISO 21434 applications:
- IEC Certification Kit (for ISO 21434, ISO 26262, and ASPICE)
- Simulink
- System Composer
- Embedded Coder
- Simulink Check
- Simulink Coverage
- Requirements Toolbox
- Simulink Design Verifier
- Simulink Test
- Polyspace Bug Finder
- Polyspace Code Prover
Let us know how we can help you.
Contact us for a custom evaluation, and get pricing based on your needs.
