ECU Boot Method Reducing HSM Verification Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current boot strategies for electronic control units (ECUs) in the automotive industry face a trade-off between security and boot time, with Secure Boot offering superior security but unacceptably long boot times, while Authenticated and Autonomous Boots provide a compromise but still result in unacceptable boot times from the OEM perspective, making it difficult to achieve a sufficiently secure and timely boot process.
Innovation Solution
A method that extends the Authenticated Boot sequence by allowing the host to check for tampering and only involve the HSM for verification when necessary, using a flag to indicate tampering and requesting run-time manipulation detection verification results from the HSM, thereby reducing HSM involvement and boot time while maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Secure Boot is used to verify all software components through HSM, then security is improved, but boot time increases unacceptably
Solution Approach 1:
The boot process is segmented into two phases: a fast phase where the host boots without HSM verification, and a security phase where critical software components are verified by the HSM. This segmentation allows the system to achieve both fast boot times and adequate security by verifying only essential components rather than all software.
Solution Approach 2:
Instead of verifying all software components (excessive action), the system verifies only the critical minimum set of software components needed for secure operation (partial action). This partial verification approach provides sufficient security while avoiding the unacceptable boot time delay that would result from verifying every component.
2Loss of time
If Authenticated Boot or Autonomous Boot is used with parallel HSM and host booting, then boot time is reduced, but security verification completeness remains insufficient
Solution Approach 1:
The host performs preliminary booting and initialization before HSM verification occurs. Critical software components are prepared and staged in advance, allowing the HSM to verify only these essential components quickly, rather than verifying all software during the boot process. This preliminary preparation enables both fast boot times and adequate security verification.
3Reliability
If HSM verifies all software components sequentially, then security is ensured, but productivity and boot speed decrease
Solution Approach 1:
The software verification process is segmented to distinguish between critical components that require HSM authentication and non-critical components that can be loaded without verification. This segmentation enables the system to authenticate only the essential software components, maintaining security while dramatically improving boot speed and overall system productivity.
Solution Approach 2:
Different verification levels are applied to different software components based on their criticality. Critical components receive full HSM verification, while non-critical components use simpler verification or none at all. This local differentiation of verification quality ensures security for essential functions while maximizing boot speed for the overall system.
Data Source
Figure 1
Figure 2
AI summary
Method for booting an electronic control unit (ECU) (5), wherein the ECU (5) comprises a host (12) which interacts with a hardware security module (HSM) (10), wherein at least one software component is checked by the HSM (10), the host (12), if a manipulation is detected, sends a request to the HSM (10) to check whether the manipulation has occurred, and the host decides whether intervention is required.