Modern vehicles are increasingly being interconnected with computer systems, which collect information both from vehicular sources and Internet services. Unfortunately, this creates a non negligible attack surface, which extends when vehicles are partly operated via smartphones. In this letter, a hierarchically distributed control system architecture which integrates a smartphone with classical embedded systems is presented, and an ad-hoc, end-to-end security layer is designed to demonstrate how a smartphone can interact securely with a modern vehicle without requiring modifications to the existing in-vehicle network. Experimental results demonstrate the effectiveness of the approach.