ON Semiconductor Corporation (ON) Earnings Call Transcript & Summary

[Presentation]

Hello, everyone, and welcome to today's technology webinar, don't let cybersecurity become the weakest link in automotive system brought to you by ON Semi. I'm Kyli Miller with ON Semi, and I'll be your moderator today. Let's meet our presenter, Ludovic Rota. Ludo is the product marketing manager with our automotive sensing division. In his current role is to define cybersecurity and functional safety requirements for our image sensor products. In this webinar, he will discuss how cybersecurity and functional safety go hand in hand to avoid unauthorized access, tampering and data breaches. During the webinar, you may type your questions into the chat box at the bottom of the screen, he will answer them at the end of the presentation. Please take a minute to complete a short survey on the right side of your screen. You can also check out some resources in the related content section. This webinar will be recorded and available on demand. You'll be notified via e-mail once recording is available. Now let's get started with webinar.

Thank you, Kyli. Hello, everyone. Good morning, good evening, depending where you are. Today, we discuss cybersecurity and functional safety in the context of image sensor. I don't know the audience I'm talking to, so we'll make the assumptions that some of you are not familiar with cybersecurity, functional safety or even image sensor to try to address and present the problem in a way which is understandable by everyone. First question is cybersecurity functional safety for image sensor. This, especially for cybersecurity might not be, I would say, an immediate natural association. When you think about cybersecurity for automotive, we think essentially about the big pieces that are in the system. Get away, ECU, DCU, processors, but not necessarily those what I call the small element and the leaves of the branches. And yet, it turns out it might be quite important and critical part in the vehicle architecture. So let me start immediately for that part. So as mentioned, I will cover image sensor expectation, assuming that someone might not be totally familiar with image sensor. Cover functional safety key metrics for our image sensor, make the parallel of the differentiation between functional safety and cybersecurity, talk about different typical case for cybersecurity and explain how it's pertinent for image sensor, and what are the consequences not addressed as properly. Extract the key cybersecurity requirement for image sensor. And finally, go a little bit but quickly on cybersecurity compliancy because it turns out that even people which are familiar kind of with cybersecurity, immediately related that to circuitry, electronics and so on. Compliancy it's more than that. It implies process, deliverable, paperwork, analysis and so on. So it's another aspect which is pretty important. So let's start. The first thing I would like people to do is to realize first for a moment, situation that we're facing every day that we, I would say, take for granted or we just have -- we're not pursuing them anymore. We know that now we're relating towards autonomous driving, we're going slowly to that path and there is some level of autonomicity, which is coming already. So in certain defined circumstances, we let cars drive themselves, mostly for example, on the highway. So it means that the car has no driver intervention. When you think about it, I mean, we have tendency not to even think about it anymore. The car, it's a massive object. I mean if I'm thinking just about like cars, specifically in the U.S., some of them can be quite massive. So several tons and they're in motion. And while we're driving themselves, they rely on one single element sometimes -- well, no, not single, but one element, which is barely bigger than you're nail. This is the image sensor. That small electronic parts is basically facing the [ scenery ] where the car is going. And taking that, converting to some information, so the car can take the right decision and driving safely. That's a small element controlling a massive object. So maybe it's not something that we think all the time. But when you think of a data in between both, it's quite significant to rely that we rely on that small element. So of course, this being said, it's obvious that we expect that image sensor to work absolutely perfectly, okay? And everything is fine. But because of the criticality of what you represent from what I just explained, we have to ask ourselves the question, what if something happen, if there is a failure and attack, what will happen? Before going into that part, just for what we expect for an image sensor, I think I don't have to spend much time. I guess we all have a smartphone in our jacket or in the pockets. And we know that if it's not that we have one image sensor, we probably have 3 or 5 on the back of a smartphone. And what do we expect is that whenever we take pictures, you have nice picture, nice color, nice edges, contrast, sharpness, you see what I mean, nice image. Now of course, in the context of automotive, what we ask on the top of that is -- it's going to be a video stream, which is sent. So we expect a certain number of frames per second. We expect to be able to discriminate objects which are in the low light part of the picture or in the high light part of the picture. So we expect some performance out of that sensor. Now we take for granted that is going to work perfectly. There might be a condition where it stopped breaking properly. And here, once again, it has nothing to do with the conception of the -- of an electronic element. It has to do with the externalities environment. If it's subject to stress, constraint, physical damage, even simply the universe [ alpha ] particle coming from the universe can be sufficient today to damage electronics. So if that occurs, the picture, the nice picture we're looking at just a second ago, will turn into something, I would say, less glamor. And so it means that from a system point of view, we can no longer rely on that piece of information. Now things that you have -- so if I distinguish the environment of the system in which the image sensor used in automotive, you have applications which are viewing application. So the intent is to display the picture to human eyes viewer or you have machine vision, sensing systems, which are basically taking the [ scenery ] in front of the car and making an analysis processing to extract information out of it. Some faults are easily distinguished by human eyes. You can realize there is a fault so here, typically, they would be a fault with the road [indiscernible] or the ones setting the roads for the pictures, then as a human, you will see it immediately, roles will be duplicated, wrong position, it's obvious that for your eyes, it would be immediate that there is an issue. It might not be that obvious for a sensing system. Of course, I present the one with a role. You have exactly the same thing it would be for [ columns with having ] strips, vertical strips. So all those ones are things where, as a human, we can immediately say something is wrong. But the opposite is also true. You could be in a case where we see a picture like that, imagine it would be in a display in a car. You know that in certain condition, for example, if you're driving and the sun is on your back and the sun is eating that display, we have tendency not to see the picture correctly. And so we say, yes, that's normal because there is a light on it. I cannot distinguish probably the most, but we will still say everything is okay. Well, it turns out that maybe it's not okay. And a sensor system will be able to detect that, is because the [ color ] are not okay, the sharpness, the contrast, things which are not easily perceptible by human eyes. The system will recognize them. Keep in mind that an image sensor, it's an entry point for a system. Out of those data that are going to be provided by the sensor, they're going to be used, mapped, decision will be taken by an engine, and then it will actuate some part of the vehicle. That's a pretty, I would say, critical mission for an image sensor. So it means that it's a mission-critical element of the vehicle. In fact, presented in the way it was on the first page, you can consider that, that image sensor, it's the eyes of the vehicle. So you have data system that require some computer vision, but even some that only rely on those image sensors. So functional safety is mandated. Functional safety, it's about to say are design something which is partly define, very well controlled, [ error ] free. Here, in the case something external, damage of that circuitry I will be able to detect and react to that failure. Now thing is based on the different failure and fold that you can see, it might not be always easy for a system to detect that something is wrong simply by image inspection. Just because as I mentioned, some defaults, some failure will be easily detectable by human eyes, but not by the system itself. So how do we address that at ON Semi? Well, a way to do things is to say we're going to cover all the data path of the image from the big cell where it's sensing the phone from the light up to the point where we deliver it to the system. And to do that, we put more than 50 safety mechanism inside our sensor just to make sure that we maximize full detection. Out of that detection, one thing which is extremely important from functional safety is that, of course, you have to detect if something goes wrong, but you also have to react quite fast. In functional safety, this is called the Fault Tolerant Time Interval. We have a budget, which is given first to the system, and that system later on is giving you a fraction of that budget for your component via the image sensor. So for dedicated faults that occurred from the image center, you have a defined time to detect the fault and then over defined time to react to that fault. And that's pretty small. So the way to address that is to put the safety mechanism as close as possible where the fault can occurring for the image sensor so that they can detect and provide information real time. How is this helping the system? Well, first of all, functional safety apply at different level. Functional safety, it's the way you cover the critical parts of the function you're supposed to deliver. In the case of the image sensor, functional safety, it's basically around the fact that it has to provide good, I would say, upstream of data. For the system level is going to be wider, it has other concern -- other things to cover, which are considered critical. If the system has to dedicate part of his resources just to identify what would go wrong with a picture sent from the image sensor, then it will take a significant amount of resources. It's going to take time. Remember, time is limited. So it's going to be also very complicated in terms of which algorithm it will have to use to detect the fault out of the picture. So the way to assist the system is to say we will work on that. Whatever faults it's in the image sensor and it occurs, we will detect it, provide it to the system that will require minimal computation from the system, we will simply report the fault live, okay? And then only at that time, the system has to do something and address it. One thing. We just discussed about the fact that for an image sensor, we will detect if there is a fault. If something is broken due to something in the environment. In that context, there is no bad intention that what will be the difference if someone has a bad intention and try basically to damage your sensor. How would you make a difference in between something due to a fault or from something due to an attack. Back to the [ vehicle ] we were considering, okay? And back to the first point I was mentioning, we think about like big elements, the getaway, the processing elements, VCU, but not to the leaf parts of metric. And yet, we're going to see that this can be quite critical. So back to the part where I was asking the difference in between functional safety -- sorry, about the fault and an attack. Why do we mix both? It's because when you think about safety and security. What is at stake? What do we try to achieve? Well, it's the same -- at the end, it's the same thing. We want to protect individuals around the car in and outside. So basically, you have to see that as the 2 faces of the same coin. In the case of safety, what we try to make sure is that the electronic does not become a risk for the individual. In the case of security, you do the opposite, you want the individual not to become a risk for the electronics. But the goal remains the same. And that's why, by the way, very often, you will hear safety interchangeable whenever you talk about safety or security. Back to the car, which I said it's a massive object in motion. That image sensor it's the entry to a system. And my apology, my system here a drone, it's pretty bad that I was not inspired. So for the system, all the green box, it's all the parts which are securing the system. If your system is as safe as its weakest point. And if you combine the fact that the weakest point is the entry point of your image sensor, you can end up with, I'd say, pretty serious consequences. Let's see some of the use cases to explain that. First, you have to understand that for an image sensor, the image sensor alone is not that is capable of much. It's the image sensor plus the image processing unit in the system which both combined deliver what is expected in terms of safety. Both are extremely intricate, and they are optimized to really work together properly to get the highest performance possible. Now I imagine that you're in a case that you need to replace your image sensor. And I guess, we all heard about the semiconductor component shortage on a market that have all been through 2022. There is also counterfeiting, which is occurring at that level. So it could be that you have someone in charge of replacing the image sensor, which in very good faith is going to say, I cannot get my hands on time with the original image sensor. I'm going to take a replacement sensor, something that looks quite similar, okay, and I'm going to plug it to the system. At best, what happened is that image sensor and the image processing are not planned to work together. The [ ADAS system ] won't work. It won't boot up and then it's safe because then will just simply say, don't rely on me, I cannot work, something is wrong with image sensor. But the worst-case scenario is that it's capable of accepting that non-genuine part and it will believe that we can get the same performance as is expecting from the sensory has been optimized for. If I give just a quick example. Imagine that the image sensor, for example, is expected to deliver 120 db, dynamic range, so that capability to detect low light from high lights in one exposure, okay? But the replacement one is only capable of achieving not even 110 decibels or it has to go with multiple exposure to reach 120. That's quite a difference. The system is not aware of that. The same thing if the image sensor is supposed to deliver frame at 30 frame per seconds, 220 dcb image capability, but the replacement sensor is only capable of delivering a 20 frames per second. Same thing. The system is absolutely not fixed for that -- it was not planned for that. And so consequence is that he can longer optimize and reach the performance it was designed for. Other case, you have the image sensor and the image processing. They are fully optimized together. And so the image sensor will give the best results from the [ scenery ] it is currently facing. Now someone can tamper the configuration of the image sensor. You start changing the register, putting funny values and so on. But it's going to completely ruin that optimization and some part of the center won't be -- it won't be able to distinguish details there. It means you're no longer capable of guaranteeing the safety of the vehicle once in motion because some part of the center is no longer visible. Worst of the worst case, the image sensor and the image processing are working together. Image sensor is streaming the video to the image processing unit. But at a certain point, that stream is cut bypassed altogether with some kind of malign system that it's basically making some kind of video loop. So video loop shows a road clear of any obstacles. While in reality, it might be a car, incoming car, pedestrian crossing or sinking obstacle on the road, while the system is completely unaware, it will continue and proceed like if everything was fine. Based on those parts, even though you might not be familiar with cybersecurity and everything it means, you can already sense what is important here. The image sensor and the image processing are working together. Functional safety is here to guarantee that everything works accordingly and things are not working appropriately will flag it. In the case of cybersecurity, we want that whenever operations are occurring, you can verify who is at stake, and what its exchanged. So in the case of the image sensor, you just want the image sensor to be able to say who it is. This is called authentication, device authentication. It's just a way for the sensor to say, "Hey, I'm from ON Semi. So I'm supposed to work with you. Same thing. If the image sensor can be updated as firmware capability, you know about that. We all have PCs and regularly we received updates. You will certainly not accept an update from the first view, which is totally unknown to you. That's the same thing here. You want that whoever has access to that [ firmware ] can prove who it is and he has the right to modify it. Controlled channel. Controlled channel servicing that sets the configuration of image sensor, same thing here, whoever it's touched, you want to make sure you can say who it is and he has the right to do so. And if not, you want to be able to detect. And finally, any data which is streamed off from image sensor, you want that stream of data to be signed to prove that it comes from image sensor. We have discussed about ADAS application. Basically, we have mentioned some fraud collision warning, automatic emergency braking. Also, we haven't mentioned that's okay. I'm not going through that list, but you're probably familiar with those ones, I mean, today's cars have many of those already embedded. But if this is already demanding for an image sensor in the future is going to be, I would say, more demanding, especially when we will have the advent of advanced in-cabin monitoring in place in the car, where basically the driver state is going to be monitored, you see the driver is in capacity of driving even to identify the driver as a replacement of a key, sitting in your car and the image sensor and the camera is looking at you and say, "Yes, okay, I recognize you can drive a car." Or while you are driving, you've suddenly become incapacitated, then the system can decide to take control and basically steer the car into a safe place and eventually even call emergency. So that's a lot of things where you would expect cybersecurity to be around sensor. Now if -- despite everything as presented to you, we're still not convinced, well, the regulation is there for you to remind you that you have to. So for a car manufacturer, the regulation, I think it's the UNECE R 155 that basically mandates car manufacturer from now on to put cybersecurity management system in place. To reach their compliancy at that level for that regulation, car manufacturers are asking their supplier to be compliant with the ISO-21434, which is the cybersecurity standard. The suppliers are going to be compliant with a different standard from the regulation for automakers. By being compliant with that one, basically, what will happen is that it will facilitate carmakers to be compliant with their own regulation. So it's a way to basically ease the work of integration for car manufacturer. In terms of cybersecurity, ON Semi have been placing cybersecurity features in a sensor -- in some of these centers since 2018. It's 3 years ahead of the ISO-21434 for cybersecurity. So basically, we were placing cybersecurity feature and capacity in some of our sensors before the standard was even out. What it means is that so far, we have been cybersecurity ready. By the end of this year, we're going to be cybersecurity compliant, meaning we're also going to fulfill the part of the process and the deliverable, which are expected. If I will go quickly over the feature which are currently available from a sensor, ON Semi sensor, we have discussed authentication and integrity. Authentication, it's a part where basically we want to make sure that at any time, the processor in the [ host ] which has integrated our sensor can verify who is the sensor, that it come from ON Semi. To do that, there are several ways which are possible. We can do that for a certificate chain of [ feature keys ] which are to -- it's a common way in cybersecurity to basically work on the authentication of an element, this will be possible from the sensor. From integrity, from the video data parts, the integrity of the data are going to be guaranteed through authentication of those data using a message authentication code. This is also something quite common in cybersecurity. And so it will facilitate the authentication of the [ data ]. For sensor control, configuration data from the sensor, then on the top of that, you will have tamper detection so that for a certain subset of register, if at any time, they're modified, you can flag it. I talked at the beginning about the fact that electronics in the sensor is not all when it comes to cybersecurity. There is also a part of the compliance. So putting the feature in the electronics of a component is fine, expected, but you also have a big part related to the process, what basically you need to do to prove that your product is cybersecurity compliant in terms of analysis, in terms of what requirements you have to go through, in terms of vulnerability identification and assessment about that compliance. And from the life cycle management, it also means that you have to make sure that everything remains secure from the moment you produce your part to the moment you deliver it to the point of usage. So all the parts, which is not directly linked to what is in the circuits are equally important because they will prove that you can guarantee the security and the [ endeavouring ] of your circuit from the moment it comes out of a fab to the moment it is delivered at the point where it will be integrated. For our image sensor ON Semi, in the different family of sensors, which are currently available in the portfolio. The one which will benefit the most immediately from everything that was presented. It's our Hyperlux 8 megapixel family. Today, they are developed according to ASIL C process. Very soon, they will be developed according to ASIL D process. It means that no matter what system in terms of ASIL level the sensor is integrated into, that will be fine. It will be ready for that. In terms of cybersecurity, the 8-megapixel sensor were the first one that were cybersecurity capable. At the time, as explained earlier, about simply cybersecurity ready. Very soon, they will become cybersecurity compliant. For all of sensor from 2-megapixel and above as from today now the minimum, not the only, but the minimum level, it's for functional safety ASIL B metrics, ASIL C process right now. For the [ 3-megapixel ] family, it will be a jumped directly from no cybersecurity capability to cybersecurity compliance. Back to the first slide, that I used to introduce that [ webinar ]. Now if you think about it, we're still in the same situation that big object in motion rely on that small piece of silicon, thanks to everything I've described about how we address functional safety, cybersecurity to make sure that if there is a failure or if there is an attack, the sensor is capable of mitigating the issue, alert the system and address everything on time so that decision can be taken to ask a driver to regain control, to pull the car side safely, to basically address the danger and the risk at stake. It means that now we can say, yes, it's a big object in motion but that can safely rely on that few gram of technology that is used to help steer the big objects safely around people. And that concluded by the webinar. Kyli?

All right. Thank you for the excellent presentation, Ludo.

If you would still like to submit any questions, just type them into the chat box. We have received several questions, so we'll just jump right in. First question, are there any security updates and patches applied to the image sensor firmware to address known vulnerabilities and security issues?

So firmware is when you have capability to change what is a sensor. Some of the sensor has firmware depending on which generation of the cybersecurity we're talking about. Some are not. Whenever you update the firmware of course, as explained during the webinar, you want to make sure that you can safely do that securely, I would say do that and make sure that the firmware is probably authenticated and then it will perfectly be taken by the sensor and then there is a verification process in place to make sure that the firmware is not going to arm the sensor by the time it returns to normal operations. New generation don't even have firmware. When you think about it, firmware is a vulnerability per se. From the moment you can change something, you introduce a vulnerability. So the new generation doesn't even have firmware. It's purely [indiscernible].

All right. And then this is our last question, I believe. Are there any hardware safeguards in place to detect and mitigate potential hardware faults in the image sensors that could compromise cybersecurity?

If I get the question right, it means one fault that will affect both functional safety and cybersecurity. Is that correct?

I'm sorry.

I didn't get the very well. So I'm sorry, could you repeat the question?

Yes, no worries. I'll just repeat it. Are there any hardware safeguards in place to detect and mitigate potential hardware faults in the image sensors that could compromise cybersecurity?

That's actually the key questions. It was addressed in the webinar. When you have the fault, being able to identify the fault is due to simply an externality, stress from the environment or an attack, it's extremely difficult. I would say -- this is probably the key today for not only also me -- it's everyone that basically combine functional safety and cybersecurity together and distinguish between something due to a fault or something due to an attack. So yes, what we do is that based on the analysis we do for functional safety for every type of faults, which are basically analyzed. And by the way, be aware that when we do the analysis for image sensor, we do not rely on expert judgment. We rely on fault injection. So what it means is that for each fault, which are basically simulated, we extract the information in terms of it have been detectable properly? What is the failure mode associated with it? What is a diagnostic cover. So basically, the capacity of the safety mechanism [indiscernible] detector to detect the faults in a range because the fault because the fault can have a range itself. In terms of cybersecurity, the approach is today, I would say not -- I would say, not advanced. But basically, the principle is exactly the same. For every attack that you foresee in the system, what are the consequences in terms of impact? How easy it is for that fault basically to be conducted? How can you mitigate what is the requirement out of it? What type of security mechanism you have to put in place? And here, you have a delicate equilibrium in between safety mechanism and security mechanism that, at some point, can have contradictory requirements. It's known basically that for functional safety, what you do is that whenever something happens, you still try to keep function on and operate properly. So you want to be fail safe or fail operation. While for cybersecurity, what you will try to do is to shut down everything and close to be safe and to protect the assets. So this is a delicate analysis that you have to do in between both domain in such a way that they do not overlap or they do not prevent each other to work properly.

All right. Thank you. We actually do have a few more questions after you answer that one. First being, could you tell us a bit more about how these sensors actually achieve this level of security without disclosing secrets, of course, but maybe some examples to illustrate how this works.