Last week was an eventful one for the automotive industry and, as a result, the development of Intel and BlackBerry’s QNX collaboration on IoT for automobiles took something of a backseat.
Intel and QNX Software Systems have been partners for over 30 years, since QNX began life as a real-time OS (RTOS), but the new venture will see them explore uncharted territory – developing dashboard functionality, in-vehicle infotainment (IVI) systems, digital instrument clusters and advanced driver assistance systems (ADAS), with a focus on IoT.
QNX has been in the automotive game for some time and its open standard software running on Intel’s IoT platform will form the basis of these new products. This includes the QNX Neutrino RTOS; a powerful mobile connectivity framework; an HMI (human-machine-interaction) framework supporting Qt, HTML5 and other native UI toolsets. These will run on the newest generation of Intel Atom processors that are the power behind smartphones and tablets, intelligent cars, healthcare devices, micro servers for the cloud, and more.
This news comes as part of BlackBerry’s ongoing transformation from fallen smartphone producer to significant software-driven player, with CEO John Chen leading the turnaround since 2013. QNX was behind the unsuccessful operating system that saw the BlackBerry 10 OS crash and burn, but the reputation of QNX in the connected car sector remains certain – now with OS and middleware in over 50 million vehicles.
“With the evolution of the connected car, the capabilities that you’re seeing in vehicles are starting to expand dramatically,” said Ken Obuszewski, director of automotive marketing for Intel, in a recent video interview. That’s almost a given at this stage, following last week’s hacked-Jeep debacle, which forced Chrysler to recall some 1.4 million cars to patch the firmware vulnerabilities that allowed two white-hat hackers to wirelessly commandeer the car.
Without sounding too hung up on last week’s car hacking video, Intel’s blog post, rather worryingly, had zero mention of security – despite QNX’s reputation in the field, which would presumably be quite a strong selling point.
However, as it was absent in the press materials, it wasn’t until reading a separate QNX blog post on ‘The A to Z of QNX in cars’, that the mention of security finally jumped out from the letter ‘S’, believe it or not. The responsibility of security will be entrusted to a joint effort from QNX and Certicom, another subsidiary of BlackBerry, who claim they will bring strong cryptography and entity authentication to the automotive industry.
This is quite a step-up from smartphones for Certicom, however, as a commandeered smartphone doesn’t really have the potential to harm innocent bystanders, Jim Alfred, VP at Certicom, recently assured us all, “strong cryptography and entity authentication are the foundation of IoT security,” but it still reads as strange that Intel and QNX didn’t make more of the security potential of their partnership.
With the expansion of the IoT, comes the inevitable expansion of vulnerable points of target. The aim of cryptography is to protect the software as well as the electronics, by safeguarding components to ensure that only messages from trustworthy devices are acted upon.
The QNX blog continued, ‘O is for the over-the-air update solution of the BlackBerry IoT Platform’. Let’s hope BlackBerry do a better job of this than Uconnect, Chrysler’s IVI of choice. Just when we thought it couldn’t get any worse for Fiat-Chrysler, the over-the-air (OTA) security patch failed, leaving customers with just three options: download the update to manually install themselves, drive to the nearest dealership or, unbelievably, wait for a USB stick to arrive in the post – a social media hammering ensued, not helped by spokesperson Alyse Tadajewski, who said Chrysler posted the USB sticks to “optimize easy and convenience for our customers,” which was not well received.
Intel, QNX and Certicom will certainly be ensuring they don’t replicate the mistakes of Chrysler, but it still won’t be an easy ride. Having said this, BlackBerry has recently launched its Center for High Assurance Computing Excellence (CHACE), a promising IoT security drive. CHACE aims to reverse the ‘fail-then-patch’ approach to security, which is the current norm, with a proactive strategy that tries to tackle problems before they arise or are noticed by would-be attackers.
An obstacle for OTA software updates in most vehicles, is that due to the hard firewalls in the controller area network (CAN), wireless connection to the IVI is possible, but not to the Engine Control Unit (ECU) controlling the important components; airbags, brakes, steering, engine. In most modern cars, ECUs are centrally connected to receive OTA updates – leaving no protective hard firewalls and, consequently, gaping security vulnerabilities if your code is not up to scratch.
Nevertheless, the ability for a car to be wirelessly updated whilst customers go on with their daily routines, or detect when the oil needs changing and book a service appointment at the click of a button, is surely one of the more useful advancements for customers – as we edge ever closer to automated vehicles.
Recent events highlights how OTA software updates or bug patches to connected vehicles is a far cry from updating an easily replaceable piece of household tech – cars are more important than set top boxes for the vast majority of consumers. As a result of this, customers can delight in the extra time that this contemporary convenience has granted them and businesses will revel in the explosion of positive publicity – providing there isn’t also an explosion in hacking and connected brake-line cutting.