Security in Android Automotive OS: Secure by Design
Google's security measures for software-defined vehicles
1Domain Isolation with Virtual Machines
Google addresses security at the design stage for Android Automotive OS (AAOS) in software-defined vehicles. The current trend of consolidating Electronic Control Units (ECUs) into a single chip makes isolation between multiple domains running side by side more challenging. AAOS SDV uses virtual machines to run logical domains with different requirements, such as clusters and infotainment systems, independently. This ensures that sharing is explicitly defined while isolation becomes the default behavior.
2Android's Proven Security Heritage
AAOS SDV evolved from Microdroid, a minimal Android version optimized for privacy virtual machines (pVMs). This lineage provides Android platform engineers with security features they already know. The system follows Android's User ID (UID)-based isolation model to create a sandbox for each application. Each service runs in a dedicated process with a unique UID to manage access rights, data directories, and other restrictions.
3Deny by Default Policy
AAOS SDV uses Portable Operating System Interface (POSIX) capabilities to strictly limit operations and pairs this with Security-Enhanced Linux (SELinux) to enforce a 'deny by default' posture. This approach restricts each service to the absolute minimum required, meaning missing configurations block access rather than creating an over-permissive system. The same strategy is applied to the communication permission system.
4Proven Vulnerability Management
AAOS SDV integrates Android's mature security response and vulnerability management infrastructure. This lifecycle includes continuous automated scans, annual deep-dive penetration tests, and partner-driven intelligence through the Android security vulnerability reporting process. The security team assesses discovered vulnerabilities, assigns severity ratings based on risk, and tracks remediation to completion. Disclosure policies are coordinated through monthly Android Security Bulletins.
5Authenticated Software Delivery
A secure platform must ensure code integrity before execution, not just guarantee process isolation. AAOS SDV secures software delivery through two methods: First, software is installed directly to read-only system, product, or vendor partitions that validate signatures on every boot. Second, Android Pony EXpress (APEX) packages are used for services. Each APEX encapsulates software and its dependencies, treating the package as a partition with mandatory signature validation.
6Four Core Security Pillars of APEX
APEX mitigates malicious code execution through four core pillars: 1) Immutable Storage: The Android kernel loops the apex_payload.img file directly as a raw storage device using read-only loopback. 2) Cryptographic Integrity: The cryptographic signature validates a Merkle Tree of the entire filesystem image. 3) Strict Isolation: Each service receives its own user and data directory. 4) Atomic Recovery: APEX uses an 'Active/Backup' design to enable double-buffered rollbacks.
7Memory Safety and Rust Language
Memory safety was prioritized for new components developed for AAOS SDV. Due to fast availability requirements on small systems, the scope was limited to the native framework as building on the full Android stack wasn't feasible. The Rust programming language was used to create the required infrastructure for a distributed system. Rust's memory safety guarantees significantly reduce memory corruption bugs common in traditional C/C++ codebases.
8Security for Future Vehicles
Google's security approach for AAOS SDV is critical for the future of software-defined vehicles. Virtual machines, strict isolation policies, cryptographic integrity checks, and memory-safe development create a robust defense against increasing cyber threats in the automotive industry. These measures reflect Google's commitment to making not only its products but the entire ecosystem more secure.
Original article: Android Developers Blog — Android Automotive OS'de Güvenlik: Tasarımda Güvenlik