Comparative Analysis Programming Languages for Cybersecurity in the Automotive Context

Related Vendors

Perforce Software UK Ltd.

FAULHABER Drive Systems

Wuxi InfiMotion Technology Co., Ltd.

Modern vehicles are complex, software-controlled systems. However, with complexity, the attack surface for malicious actors also increases. The programming languages used therefore play a special role.

Cybersecurity has become a key factor in the automotive industry. According to this year's industry report by Perforce, 24 percent of automotive software professionals surveyed cited the lack of necessary skills to combat security threats as their biggest challenge. Meanwhile, 22 percent identified meeting security requirements as the biggest challenge.

Security Through Standards

Standards such as ISO/SAE 21434 are crucial to ensuring the highest possible level of cybersecurity in vehicles. However, general quality characteristics of software, as defined in the ISO 25010 quality model, are also relevant for the development of automotive software, even if they are not explicitly required.

Programming languages play a crucial role in meeting these standards. They influence everything: from the level of modularity and abstraction to resilience against security vulnerabilities.

ISO/SAE 21434: Cybersecurity Engineering

ISO/SAE 21434 is an automotive standard for cybersecurity-related risk management in electronic vehicle systems. Although the standard is still relatively new, a majority of respondents (65 percent) already need to comply with it today.

The standard includes detailed requirements for software development. These include, among other things, checking the software code for inherent security risks as well as consistency, correctness, and completeness. Additionally, certain criteria must be considered when selecting the programming language, such as secure design and secure coding techniques or clear syntax and semantics.

ISO 25010: Model for Software Quality

In addition, ISO 25010 defines a more general model for software quality based on eight main and 31 sub-characteristics. Here too, the programming languages used must therefore have properties that enable developers to write software that meets these criteria. Cybersecurity is one of them. However, companies need to determine how well the properties of the chosen programming language fulfill this and all other required quality characteristics. For real-time applications, functional suitability and performance efficiency are at least equally important.

AUTOSAR Platforms

AUTOSAR (short for "Automotive Open System Architecture") aims to standardize fundamental software elements, interfaces, and bus systems and make them future-proof. This is intended to help vehicle manufacturers manage the growing system complexity while keeping costs low.

The "Classic Platform API" is designed for vehicle functions with strict real-time requirements and high importance for functional safety. The interface was specified in the programming language C. The new "Adaptive Platform API," on the other hand, was specified using C++ but explicitly supports bindings to other languages.

It is therefore important to discuss the quality characteristics of popular programming languages such as Python, Java, C#, JavaScript, Go, and Rust.

An Overview of the Most Common Languages

In general, the programming languages used in vehicle manufacturing can be divided into three categories: native, platform, and interpreted languages. Each of these has specific strengths and weaknesses that make them suitable for different use cases.

Native Languages

Native languages are compiled into object code that can be executed directly on the target machine. These languages include — listed by their release dates — C, C++, Rust, and Go.

Executing native languages raises concerns about functional and digital security. Program errors can lead to crashes, and security vulnerabilities can be exploited for harmful purposes. For C and C++, ISO maintains language standards that specify problematic behavior. C and C++ can exhibit various forms of undefined behavior, such as using uninitialized data, attempting to access null memory addresses, and buffer overflows.

Fortunately, issues like these are largely known, and coding standards such as MISRA C and MISRA C++ aim to minimize the risk of such undefined behavior as much as possible. The use of static analysis tools can also help ensure reliable adherence to coding standards.

Native languages are inherently performance-efficient. C and C++ enable optimal runtime and memory performance and therefore offer the highest level of execution control. However, this comes with the risk of faulty memory accesses, such as using memory after it has been freed ("use after free"). Coding standards provide guidelines in this area. MISRA C includes a mandatory rule prohibiting the use of dynamic memory. In C++, "Scope Bound Resource Management" (SBRM) offers a way to automate memory management.

The language Go was introduced by Google in 2009. Its design focuses on parallel code execution. Like C, it allows manual memory management with all the associated risks. For automatic memory management, it uses a garbage collector, which introduces nondeterminism, making it unsuitable for real-time applications.

Rust is described in the book "Rust Reference," and the Ferrocene toolchain includes a specification of the language. Rust offers an innovative dynamic memory solution based on the ownership concept. It includes rules for memory ownership that the program must follow. These rules automate memory management, similar to SBRM in C++. While this makes writing correct program code more challenging, it eliminates the need for garbage collection and is therefore suitable for real-time applications.

The recently established "Safety-Critical Rust Consortium" is working on additional guidelines for functional safety. For MISRA C, Perforce has created a subsection called "Iron Carbide," which can be applied to Rust.

There are also differences regarding the features of the individual languages. C supports only procedural programming, whereas all other languages support modern programming paradigms.

C compilers are available for almost every hardware. The same applies to C++ compilers. Rust is compiled into native code and uses LLVM technology for this purpose, which supports a wide range of architectures. Finally, Go is only supported on desktop platforms.

Platform Languages

A platform provides an abstraction from the machine. It contains a compiler that generates bytecode for its virtual machines. Java and Kotlin run on the Java platform using the Java Virtual Machine (JVM). C#, on the other hand, is the primary language for the .NET platform with Microsoft's Common Language Runtime (CLR).

The execution of programs is fully defined by the specification of the virtual machine. However, they operate with a garbage collector, which can lead to non-determinism. Real-time Java platforms use a deterministic preemptive garbage collector. Nevertheless, programs can still contain errors and cause security issues. Accordingly, there is a CERT Coding Standard for Java, while CWE provides lists of known weaknesses and OWASP Cheat Sheets are available for both platforms.

Kotlin is Google's central programming language for the Android platform and has replaced Java in this role. Android offers a "Native Development Kit" with advanced support for C and C++. In 2021, Rust was also added as an additional option. Kotlin has a strong similarity to Java, but interface changes often require more frequent code adjustments — negatively affecting maintainability. Kotlin is interoperable with JavaScript for use in web applications.

Java is available for common desktop and server platforms, while .NET is only really well supported on Windows.

Interpreted Languages

The two remaining languages, Python and JavaScript, are interpreted languages. Interpreters read the program line by line and execute the commands. As a result, these are the least deterministic and least suitable languages for use in real-time systems.

Python is a popular scripting language that runs slowly but is easy to write. It is often used as a bridge between fast components written in native languages. No guidelines exist for Python regarding functional or digital safety.

JavaScript is used to program the behavior of websites. In the automotive industry, some in-vehicle infotainment systems are implemented as web applications. While ECMA maintains the ECMAScript standard, many variants and extensions of it exist. The multitude of language versions, frameworks, and environments poses a challenge, as a comprehensive understanding of the operating environment is essential for applying CWE and OWASP guidelines.

Comparative Analysis

From all these observations, the suitability matrices for ISO/SAE 21434 and ISO 25010 shown in Image 2 and Image 3 emerge.

The suitability of individual programming languages depends on the "Safety Integrity Level" of the respective project. Projects where functional safety is central may require a certified toolchain, which drastically reduces the options.

C remains a good choice for simple applications in environments with limited hardware and strict real-time requirements.

C++ is better suited for complex frameworks with multiple layers. This includes, for example, the "AUTOSAR Adaptive Platform," whose programming interface is specified in C++.

Java is suitable as a language within Java frameworks such as Android or in real-time environments where a real-time JVM is used.

Kotlin is also suitable for use in Android. However, the language is less stable than Java and its real-time support is more limited. On the other hand, it integrates better with JavaScript for in-vehicle infotainment applications.

C# is ideal for .NET, but this platform is not used in vehicles.

Python is suitable for only a few contexts; overall, there are more fitting alternatives. JavaScript, on the other hand, is indispensable for web user interfaces used in in-vehicle infotainment systems.

Finally, Rust offers the strongest characteristics for functional safety and is gaining increasing support, especially as more guidelines are being developed and toolchains are being certified.

Language Choice as a Strategic Decision

As the industry continues to evolve, the tools and practices used must also adapt. The choice of programming language is not just a technical matter. Rather, it is a strategic decision that has immediate impacts on the functional and digital security as well as the long-term maintainability of the program code. Such considerations must therefore be included in the language selection from the very beginning. (sg)

*Dr. Frank van den Beuken is a Principal Technical Support Engineer at Perforce Software.