Abstract-Security attacks may have disruptive consequences on cyber-physical systems, and lead to significant social and economic losses. Building secure cyber-physical systems is particularly challenging due to the variety of attack surfaces from the cyber and physical components, and often to limited computation and communication resources. In this paper, we propose a crosslayer design framework for resource-constrained cyber-physical systems. The framework combines control-theoretic methods at the functional layer and cybersecurity techniques at the embedded platform layer, and addresses security together with other design metrics such as control performance under resource and real-time constraints. We use the concept of interface variables to capture the interactions between control and platform layers, and quantitatively model the relation among system security, performance, and schedulability via interface variables. The general codesign framework is customized and refined to the automotive domain, and its effectiveness is demonstrated through an industrial case study and a set of synthetic examples.