2016年秋天，美國眾議院能源和商業(yè)委員會（U.S. House Committee on Energy and Commerce）已經(jīng)就OBD-II安全的相關(guān)問題，聯(lián)系了國家公路交通安全管理局(NHTSA)，要求NHTSA“集結(jié)行業(yè)力量，共同出臺行動意見，解決現(xiàn)代汽車生態(tài)系統(tǒng)中OBD-II端口存在的安全隱患。”
SAE加入
“在NHTSA的敦促下，SAE International - 國際自動機工程師學(xué)會（以下簡稱SAE）已經(jīng)成立了一個工作小組，用NHTSA的話來說，其任務(wù)就是‘探索強化OBD-II端口的方法’。”SAE車輛標準技術(shù)項目經(jīng)理TimWeisenberger表示，SAE將廣泛吸取整個汽車行業(yè)的意見，組織成立專項工作組，全面分析問題，所在并最終形成一套推薦做法。
Weisenberger解釋道，“在設(shè)計之初，OBD-II只是美國環(huán)保署（EPA）和加州空氣資源管理局（CARB）等機構(gòu)監(jiān)控車輛排放的一個端口。”現(xiàn)在，我們要做的就是在汽車數(shù)據(jù)訪問的便利性與安全性之間做出平衡。目前，無論是出于“合法”還是“非法”目的，各方都希望能夠訪問OBD-II端口。具體來說，“合法”利用該端口的場景包括檢查/維護、車廠/服務(wù)、保險及其他插入式遠程信息處理與預(yù)測應(yīng)用，及車輛性能優(yōu)化等；“非法”訪問則來自惡意滿滿的黑客。
行業(yè)開始行動
2016年12月1日和2017年1月30日，大約40家公司已經(jīng)齊聚一堂，探討面前存在的共同問題、潛在需求及相關(guān)措施，保護OBD-II端口的安全。
Weisenberger解釋道，“參加研討會的成員包括我們的幾個不同協(xié)會的專家負責人，比如大眾汽車公司（VW）的Bob Gruszczynski與DGTech公司的Mark Zachos等真正領(lǐng)域領(lǐng)袖。”
另外，SAE員工也在場協(xié)助組織工作的快速推進。參會專家正在考慮以一種 “合作研究項目”的方式推進，也就是說由2個或2個以上的組織集合資源共同開展聯(lián)合項目，針對競爭前技術(shù)領(lǐng)域進行研究并共享研究結(jié)果，從而加快相關(guān)標準的開發(fā)。
“對于整個行業(yè)來說，這就像是一個觸發(fā)器，未來各個方面還將集結(jié)更多資源，一起促使整個行業(yè)變得更加開放，”Weisenberger說，“而不僅僅是影響到個別的企業(yè)”。
SAE新成立的OBD工作組，成員背景非常豐富多樣，既包括來自BMW、福特（Ford）、通用（GM）、本田（Honda）、現(xiàn)代（Hyundai）、五十鈴（Isuzu）、豐田（Toyota）、大眾汽車（VW）等8家汽車廠商；沃爾沃（Volvo）、康明斯（Cummins）等幾家重型卡車制造商和供應(yīng)商的人員，也包括來自加州空氣資源委員會、國家公路交通安全管理局及美國國家標準與技術(shù)研究所等多家政府與監(jiān)管機構(gòu)的人員。
TEVDS20委員會成立
通過一系列努力，SAE TEVDS20數(shù)據(jù)鏈路層連接器車輛安全委員會（Data Link Connector Vehicle Security Committee-TEVDS20）成立。Weisenberger告訴《國際汽車工程》雜志，需要指出的是，“數(shù)據(jù)鏈路層連接器”是OBD-II端口的官方技術(shù)術(shù)語，而OBD-II端口的說法更像是行話的表達。此后，委員會成員將開始采用官方術(shù)語進行表述。
在《國際汽車工程》雜志本期報道出版之后，該工作組成員將再次會面，共同確定相關(guān)工作的范圍，并成立一個新的工作小組開展相關(guān)工作，進行技術(shù)方面的探討（J3138）。Weisenberger解釋道，未來，該委員會還將繼續(xù)定期會面，探討OBD-II問題的發(fā)展情況，并開展相關(guān)工作。
Weisenberger表示，“J3138只是我們的具體工作任務(wù)之一。”未來，大家要做的工作還有很多，但目前的確定目標是按照眾議院的要求，對OBD-II端口的安全性能進行強化。
SAE Standards News aims to update readers on the extensive activity in the SAE Global Ground Vehicle Standards development arena, by more than 800 ground vehicle committees comprised of volunteers from global industry stakeholders and SAE GVS staff who support the committee work.
In Fall 2016, the U.S. House Committee on Energy and Commerce reached out to the National Highway Traffic Safety Administration (NHTSA) in regards to addressing OBD-II security. The letter requested NHSTA to “convene an industry-wide effort to develop a plan of action for addressing the risk posed by the existence of the OBD-II port in the modern vehicle ecosystem.”
Enter SAE.
“SAE International, at NHTSA’s urging, has started a working group that is ‘looking to explore ways to harden the OBD-II port’—that was their [NHTSA’s] language,” said Tim Weisenberger, SAE’s Project Manager, Technical Programs, Ground Vehicle Standards. SAE set to work by reaching out to a wide range of the industry. A working group was assembled to examine the issue with the goal of developing a set of recommendations.
“The OBD-II port has moved beyond its originally designed intent as a port to check emissions by regulators like the EPA and CARB,” Weisenberger explained. There are vehicle data access vs. vehicle security issues at hand. Many entities are requesting both legitimate and non-legitimate access to the port. The “legit” side include inspection and maintenance, workshop/service, insurance/other plug-in telematics and prognostics apps and performance tuners. On the malicious side are the hackers.
Triggering the industry
The group of approximately 40 gathered for the first workshops on December 1 and January 30 to identify common issues, needs and an approach to secure the OBD.
“The group included a couple of our experts that run various committees—Bob Gruszczynski from VW and Mark Zachos from DGTech were really the lead experts,” Weisenberger explained.
SAE staff were also present to facilitate and help to examine how the organization could move forward rapidly. They considered either standards development or expedited standards development that uses what SAE calls a Cooperative Research Project approach. This is a pathway for joint-venture research projects where two or more organizations pool their resources to study a pre-competitive technical area and share in the results.
“It was interesting that this was kind of a trigger for the industry to get together to create something that’s a little more open for the entire industry,’’ he said, “not just specific to company.”
The new OBD working group SAE has assembled is broad. It is comprised of eight automotive OEMs (BMW, Ford, GM, Honda, Hyundai, Isuzu, Toyota, VW), a few heavy truck OEMs and suppliers (Volvo, Cummins), various associations (MEMA, ETI), as well as representation from government and regulators (California Air Resources Board, NHTSA and the National Institute of Standards and Technology).
Get to know the TEVDS20
Through this effort, a new SAE committee was born: the Data Link Connector Vehicle Security Committee (TEVDS20). It is important to note that “data link connector” is the technical term for the OBD-II port (which is really more of an industry slang term, Weisenberger told AE). With the committee’s naming as a trigger, members will begin to use the technical term moving forward.
As this issue of Automotive Engineering went to press, the group was set to meet again to define the scope of work and engage a new Task Force under the committee to develop the technical work item (J3138). From there, the committee will continue to meet periodically to examine the issue and begin new work items as needed, Weisenberger explained.
“This new work item is a very specific use case,” he said. “It is a deep dive.” The potential is there for other work down the road, but for now the group has its very specific goal to meet the House Committee’s need of hardening the OBD-II port in sight.
Author: Jennifer Shuttleworth
Source: SAE Automotive Engineering Magazine
如今，OBD-II已經(jīng)不再僅僅是一個檢查車輛排放的端口，而是保衛(wèi)車輛安全的網(wǎng)關(guān)之一，未來將開始發(fā)揮更大的作用