As vehicles become increasingly electric, connected and software-driven, cybersecurity is emerging as a fundamental pillar of automotive safety. From EVs and charging infrastructure to OTA updates, connected services and advanced electronics, every new digital connection expands the potential attack surface. In this insightful article, Girish P. Kamala, Sr. Director and Country Head Automotive Sales, Infineon Technologies India, explores why hardware-based security, trusted architectures and a security-by-design approach are essential for building a safer, more resilient and trustworthy mobility ecosystem.
The automotive industry is undergoing the most significant transformation in decades. Electrification, software-defined vehicles (SDV), over-the-air (OTA) updates, connected services, V2X communication and advanced driver assistance systems (ADAS) are rapidly becoming standard across passenger cars and commercial vehicles. In the India market, driven by the government’s ambitious EV adoption targets, expanding charging infrastructure and a growing digital ecosystem have resulted in the higher penetration and increased adoption of electric two-wheelers (E2Ws) and electric three-wheelers (E3Ws).
Every new connected feature creates a potential cybersecurity entry point. Vehicles of today are no longer only mechanical or electro-mechanical systems; they are networks of electronic control units (ECUs), sensors, wireless interfaces, cloud connections and mobile applications. As a result, cybersecurity has become a critical safety requirement, leading regulators and OEMs to adopt standards such as ISO/SAE 21434 and UNECE R155/R156.
Attack Surface Expansion in Cars and Electric Two/Three-Wheelers
Potential Entry Points in Passenger Cars
Every connection in today’s connected vehicle is a potential point for an attacker, as shown in Fig 1.
A compromise of any one interface can potentially provide a pathway into critical vehicle networks if adequate security architecture is not implemented.
Potential Entry Points in Electric Two/Three-Wheelers
The Indian market presents unique cybersecurity challenges because connected scooters and motorcycles increasingly offer smartphone integration, remote diagnostics and cloud-based services. Key attack surfaces are described in Fig 2.
As electric 2W/3Ws become highly connected, they face many of the same cybersecurity risks as passenger cars, despite having more cost-sensitive electronic architectures.
Key Attack Scenarios
As connected and electric vehicles become increasingly sophisticated, the number and complexity of potential cyberattacks are also growing. Attackers are developing more creative and targeted methods, making it essential for development teams to stay ahead of emerging threats. Security must therefore be built not only for today’s vehicles but also for the vehicles of the future.
OTA Update Manipulation: Attackers may attempt to inject malicious firmware during software updates. If successful, such attacks could disable safety functions, manipulate battery controls or install malware, potentially resulting in vehicle immobilisation, disruption of safety functions, unauthorised feature activation and even large-scale fleet compromise.
Remote Vehicle Access: Weak authentication mechanisms in mobile applications or telematics systems can allow attackers to remotely unlock doors, disable alarms, track vehicle locations and access personal data. Such vulnerabilities can lead to vehicle theft, privacy violations and disruption of connected fleets.
Battery Management System (BMS) Attacks: In electric vehicles, attackers may attempt to manipulate battery performance parameters or state-of-charge information. Such attacks could affect battery life and vehicle performance, create safety hazards, result in inaccurate battery-health reporting and in severe cases, prevent vehicle usage.
Charging Infrastructure Attacks: As public charging networks become critical elements of the EV ecosystem, compromised charging stations could potentially send malware or malicious commands to connected vehicles. The consequences may include data theft, charging disruptions, financial fraud and grid-related issues.
Diagnostic Tool Exploitation: Unauthorised access through service ports or dealer diagnostic systems can enable attackers to modify ECU configurations, bypass security mechanisms and compromise vehicle safety and security. This can potentially result in counterfeit software installation, odometer fraud and the disabling of security features.
Supply Chain and Counterfeit Components: The rapidly expanding EV ecosystem involves multiple component and subsystem suppliers as well as software vendors. Attackers may attempt to introduce compromised firmware or counterfeit components into the supply chain, creating hidden backdoors, exposing intellectual property and introducing long-term security vulnerabilities.
Why Software Alone Is Not Enough
The industry has traditionally relied heavily on software security to protect vehicles from cybersecurity threats. While software security remains essential, software-only approaches cannot fully protect cryptographic keys and sensitive credentials against increasingly sophisticated techniques such as side-channel analysis, fault injection, physical tampering, secure boot bypass attempts and credential extraction. Hardware-based security can provide an isolated environment for key storage, authentication, encryption and integrity verification, making such attacks significantly more difficult. Infineon Technologies highlights hardware-rooted trust as a critical element in protecting connected automotive systems from both logical and physical attacks.
Infineon Automotive Security Offering
Infineon offers a scalable portfolio of dedicated applications spanning telematics/connectivity (including V2X), central gateway, battery management (powertrain), radar (safety/ADAS) and body and chassis, including door control and head-up display (infotainment), to name a few. With a strong and diverse product portfolio, Infineon addresses the majority of customer needs. Below is an overview of Infineon’s offerings (Fig 3.)
Strategies for the Indian Automotive Market
The India market presents a unique cybersecurity landscape due to the rapid growth of electric two-wheelers, expansion of charging infrastructure, growing adoption of connected vehicle services, cost-sensitive vehicle architectures, large-scale urban mobility fleets and increasing localisation of vehicle electronics. To address these challenges, some Indian OEMs have already implemented these measures, while others are in an advanced stage of doing so.
Below are our recommendations for OEMs. Security-by-Design: Security must be incorporated from the earliest stages of product development rather than an afterthought. Hardware Root of Trust: Use hardware-based security technologies such as Infineon AURIX™ and OPTIGA™ solutions to establish trusted device identities and protect cryptographic assets. Secure OTA Frameworks: Implement authenticated firmware updates with digital signatures, secure key management and rollback protection. Strong Authentication: Deploy multi-factor authentication and certificate-based vehicle identities for cloud-connected services. Network Segmentation: Separate infotainment, telematics and safety-critical domains using secure gateways and zonal architectures. Supply Chain Security: Verify software authenticity, establish secure provisioning processes and prevent counterfeit component insertion. Continuous Threat Monitoring: Adopt cybersecurity management systems aligned with ISO/SAE 21434 and UNECE requirements.
In conclusion, in any interconnected system, reliable communication and robust security are inseparable. For vehicles of the future, there is no safety without security. As vehicles evolve into highly connected mobility platforms, cybersecurity becomes inseparable from functional safety. A secure EE architecture is always built around a certified root-of-trust. Security is a moving target and erodes over time. It is imperative that we need to always be ahead of the attacker’s capabilities and crypto-agility is a must, enabled by the right hardware. By combining secure hardware, robust software practices and industry-standard cybersecurity frameworks, automotive manufacturers can confidently accelerate the transition toward connected, electric and software-defined mobility while maintaining safety, reliability and consumer trust.
Note to Readers: The views expressed in this article are those of the author and are presented for informational purposes only. They do not necessarily represent the views of Mobility Electrified.
