Automotive ECU Interprocess Communication Security via Kernel Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current automotive control systems face security vulnerabilities due to multiple decision-making points for access control, making it difficult to predict system behavior under hacking attempts, and allowing potential compromise of control units, especially in unattended vehicles.
Innovation Solution
Implementing a secure operating system with a single decision-making point, where the kernel intercepts interprocess communication requests and grants access based on a predefined security policy, using a secure access control component to ensure only authorized interactions occur, thereby simplifying security policy management and enhancing trust in the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple decision-making points are used for access control in AUTOSAR systems, then flexibility in access control is improved, but system reliability and predictability deteriorate due to difficulty in prognosticating behavior under hacking attempts
Solution Approach 1:
The patent merges multiple access control decision-making points into a single centralized security management system. This unified approach consolidates security policies and decision-making logic in one location, eliminating the distributed decision points that caused unpredictable system behavior. The single centralized system maintains access control flexibility while ensuring reliable and predictable security decision-making throughout the AUTOSAR architecture.
2Adaptability or versatility
If access control decisions are made at multiple points, then system adaptability is improved, but device complexity increases making it difficult to ensure complete security policy description and compatibility
Solution Approach 1:
The invention combines multiple scattered access control decision points into one unified security management system. This consolidation reduces the overall complexity of the security subsystem by eliminating redundant decision-making components and their associated configuration management overhead. The single centralized system provides complete security policy description and ensures compatibility across all AUTOSAR components without the complexity of coordinating multiple independent decision points.
3Ease of manufacture
If conventional AUTOSAR security subsystem is implemented, then standard compliance is improved, but security vulnerability increases due to potential compromise of control units and decision making points
Solution Approach 1:
The patent extracts the security-critical decision-making functionality from the conventional AUTOSAR security subsystem and implements it as a single centralized security management system. This extraction isolates the most vulnerable decision points into one controlled location that can be thoroughly secured and monitored. By taking out the critical security logic from distributed components, the system maintains AUTOSAR standard compliance while reducing the attack surface and preventing compromise of individual decision-making points.
Data Source
Figure 1a
Figure 1b
Figure 1c
AI summary
A method for providing an interprocess interaction in an electronic control unit having an operating system defining a kernel space, wherein the method involves steps in which: the kernel of the operating system intercepts a request for an interprocess communication between a first application and a second application of the electronic control unit. A verdict is requested, from an access control component of the operating system, with respect to granting access for the requested interprocess communication between the first application and the second application of the electronic control unit. The access control component generates the verdict for the requested interprocess communication based on a security policy. The kernel of the operating system selectively allows the requested interprocess communication between the first application and the second application based on the generated verdict.