Automotive Control Unit Secure Update via Virtualization Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software update mechanisms in automotive systems are vulnerable to attacks and failures, particularly when receiving updates over networks, as they lack secure validation and can be compromised by untrusted signals and components, leading to potential hijacking and service disruptions.
Innovation Solution
A secure software update mechanism is implemented using a virtualization layer and a system supervisor server, where only trusted components can initiate updates, and untrusted components are isolated from critical memory areas, ensuring secure boot processes and encrypted communication to prevent unauthorized access and ensure reliable updates even in the presence of network failures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a basic software update mechanism is implemented allowing network downloads, then update capability is improved, but security vulnerability increases due to attack vectors from backend connections
Solution Approach 1:
The system is divided into multiple isolated virtual machines: an update client VM for downloading updates, a supervisor VM for validating updates, and a runtime VM for execution. This segmentation prevents any single component from being compromised and limits attack propagation across the system.
Solution Approach 2:
A trusted supervisor component acts as an intermediary between the untrusted update client and the critical runtime system. The supervisor validates update integrity and controls the update process, preventing direct access to critical system areas by untrusted components.
2Adaptability or versatility
If update mechanisms are allowed to create network connections, then update functionality is improved, but system security deteriorates due to potential hijacking of update privileges
Solution Approach 1:
Network communication functionality is isolated to a dedicated update client virtual machine that has no direct access to critical system resources. This segmentation confines potential attacks to a non-critical environment while preserving update functionality.
Solution Approach 2:
Update integrity validation is performed in advance by the trusted supervisor before any update installation occurs. This preliminary verification ensures that only authenticated updates can affect the runtime system, preventing hijacking attempts.
3Adaptability or versatility
If untrusted guest systems are allowed to communicate with the system supervisor, then system functionality is improved, but signal trustworthiness deteriorates due to potential signal manipulation
Solution Approach 1:
The trusted supervisor acts as an intermediary that receives and validates signals from untrusted guest systems before processing them. This intermediary layer filters out malicious signals while allowing legitimate communication, maintaining both functionality and trustworthiness.
Solution Approach 2:
The system implements signal validation and verification mechanisms where the supervisor checks signal authenticity and integrity before executing commands. This feedback loop ensures that only verified signals can modify system state, preventing manipulation attacks.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The present invention relates to a method for updating a control unit (1) for an automotive vehicle, the control unit comprising a runtime system (22, 122) with a virtualization layer (32, 132) adapted to run on the processor (3), the virtualization layer being adapted to assign processor time and memory space to a plurality of guest systems (24, 26, 28, 30, 124, 126, 128, 130, 158), the method comprising: downloading (1018), by a first update client (38, 40, 138, 140) of a first untrusted guest system (26, 28) running on the virtualization layer (32, 132), one or more first update files or data segments from a first remote server (44, 46, 48, 144, 146, 148); storing, by the first update client (38, 40, 138, 140), the one or more first update files or data segments in an untrusted memory (5) accessible to the first untrusted guest system; running an update operating system (58, 158) adapted to update one or more files or data segments of the control unit; retrieving, by the updating operating system (58, 158), the one or more first update files or data segments from the untrusted memory (5); and updating (1108, 1110, 1112, 1114) the one or more files or data segments of the control unit (1).