Years ago, a cartoon in the New Yorker poked fun at auto mechanics who were now forced to fix newfangled devices like air conditioners and car radios. Today’s version of that old cartoon might show a mechanic scratching his (or her!) head at the dozens of connected digital devices that now operating inside modern cars. These devices control and monitor the engine, manage the power train, monitor energy use, operate body components like power windows, enable GPS navigation, communicate vehicle telemetry, provide entertainment and telephony and on and on.

There can be dozens of devices inside a car today, each made by a different vendor, with separate firmware and embedded system software. They often have to inter-operate with each other and communicate with the outside world. The net effect of all these IoT gadgets is a better car, but it comes at a price. The modern car is exposed to a wide range of cyber risks. Hackers can disrupt the car or steal data from it by taking over its internal digital devices.

Data encryption and the use of digital certificates offer a countermeasure to automotive cybersecurity risk. If each device inside the car has a unique, cryptographically verifiable ID and can encrypt the data it transmits, the car will become less vulnerable to hacking. The difficulty in implementing this solution, however, has to do with scale.

Creating certificates requires a certificate authority and Public Key Infrastructure (PKI). Until recently, it was a challenge to set up and manage certificate authorities for even relatively small numbers of certificates. The systems required for an enterprise with a few thousand certificates were cumbersome and costly to run. In the automotive scenario, the PKI has to handle billions of certificates, device IDs and public/private encryption key pairs.

Companies like Keyfactor are rising to the challenge of PKI for automotive and other large-scale IoT PKI use cases. The company has devised a system that can manage the kind of massive, billions-at-a-time certificate authority and key pairing required for modern cars. They work with one of the major global carmakers on a Vehicle Authorization System or VAS. With the VAS, Keyfactor can create a unique digital ID and certificate for each device in the car—cryptographically binding the ID to the silicon.

The solution enables encrypted communication between devices in the car, as well as between the car and any external data collection sites such as an edge network. Device firmware updates can only be made through a digitally signed certificate. This countermeasure reduces the chance that a hacker can take over a device through a firmware attack.

“We create a high assurance environment,” said Kevin von Keyserling, Co-Founder and Chief Strategy Officer at Keyfactor. “This has required overcoming a range of systemic challenges to operate at such a massive scale.” von Keyserling and his team came to their solution after working in the PKI management field for several years. Their experiences helping large enterprises implement and manage PKI gave them insights into what it would take to scale up beyond anything they’d ever imagined before.

Automotive is just one of many use cases for Keyfactor’s large-scale PKI toolset. Smart cities and the industrial IoT are prominent examples, as are medical applications. “Pacemakers are connected devices today,” von Keyserling explained. “They require over-the-air firmware updates just like your car’s infotainment center. And, unfortunately, they’re also vulnerable to malicious actors. We do PKI to secure the pacemaker. Think of it as the connected heart.”

von Keyserling and his peers feel that they are at the beginning of a much larger trend. IoT and smart edge networks will require even greater PKI scale, especially as system owners try to implement policies like zero trust. “We’re getting more devices, deployed further and further away from the core, but with greater expectations of security policy enforcement,” von Keyserling added. “This is the future for all of us.”