CYBERSECURITY REVIEW 9 SEPTEMBER 2022system design. The company also actively builds and improves the Simple Direct MediaLayer [SDL] platform to improve its code quality. In addition, NIO has built out an organizational structure to support these emerging threats. For example, they have emergency response systems and bug bounty programs that instantly use internal and external resources to respond to potential attacks and threats.The company's award-winning Firmware Over the Air (FOTA) downloads data packets over a wireless network to update the system. It is the only car company that has developed a full end-to-end FOTA rollout entirely in-house. As a result, NIO's FOTA can continuously upgrade the system, provide convenience and comfort to its users, fix security vulnerabilities, and improve smart EV security and practicality. Furthermore, to minimize the cyber-attack risks of FOTA, NIO built its CodeSec platform. This checks the code quality, scans for security vulnerabilities, and tests de-fuzzing and penetration. In addition, NIO continuously conducts formal verifications to ensure that the FOTA protocol has no bugs and has built a security platform with a private VPN to ensure safe communication. Improving the design and using hardware and system resources will be essential for security in smart vehicles. For example, NIO generally uses hardware as a Root of Trust (RoT) and accelerators to provide trusted environments. For system resources, NIO leverages these to build computing systems with data protection, access control, and threat detection & response, among others.To defend the various charging methods, NIO offers multiple layers of protection. For example, for public charging stations provided by NIO or NIO's partners, once the auto-authentication and payment feature for charging is enabled, a token is signed by the vehicle, and the vehicle identity sends it to the charging station. This data is then sent from the charging station to the charging station cloud to validate the sign and vehicle ID to confirm this automatic charging request's authentication. This authentication design is already considered one of the international standard requirements.Only authenticated cars know the hidden WiFi in a Power Home (the company's home charger), with its unique password. NIO supplies a certificate-based mutual authentication scheme to authenticate the car and the charging station. A cloud-based server will also issue a token signed by NIO public key infrastructure (PKI) and send to the charging station through the car for further authentication.Ensuring information and data are secure and well-protected should always be one of the top priorities for any manufacturer. NIO has implemented this from the product design level. Any user-related information has the highest level of confidentiality. Risk analysis and improvements continue through the entire lifecycle. This includes information collection, transmission, usage, and processing to storage and destruction so that data is appropriately protected in every online and offline scenario. Today's smart cars have powerful modern hardware devices and software systems, which gives EV manufacturers, including NIO, enough space to deploy more advanced security defense mechanisms. However, though the challenges and opportunities coexist, they need to constantly improve the design and make full use of hardware and system resources for vehicles'­ and owners'­ security and peace of mind. As a pioneer and leading manufacturer of premium smart electric vehicles, NIO has listened to their users' concerns and implemented an infrastructure to reduce security risks in their vehicles to protect their cars and users
< Page 8 | Page 10 >