Vehicle ECU Security Partitioning for Tamper-Proof Diagnosis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures for vehicles, such as the EVITA project, face challenges in distinguishing the cause of abnormalities in electronic control units (ECUs) after a security attack and ensuring functional safety operations, particularly in preventing tampering of software and malfunctions during diagnosis and communication monitoring.
Innovation Solution
A security processing device with a dual-area architecture, where a non-secure area allows program changes and a secure area prevents external modifications, includes a diagnosis program to determine abnormality types and execute appropriate processing measures, utilizing a hardware security module (HSM) for key management, decryption, and integrity verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single secure area is used for all security functions, then security management is simplified, but the ability to distinguish abnormality causes and execute specific safety measures is insufficient
Solution Approach 1:
The control part is divided into a non-secure area for operation programs and a secure area for diagnosis programs. This segmentation allows the diagnosis program to independently monitor and distinguish the causes of abnormalities (security attacks vs. malfunctions) without interference from operation programs, thereby improving abnormality cause distinction accuracy while maintaining manageable security complexity.
2Device complexity
If the diagnosis program is mounted in the non-secure area, then device complexity is reduced, but the program can be tampered with and reliability is compromised
Solution Approach 1:
The diagnosis program is extracted from the non-secure area and placed in a separate secure area that is protected from external tampering. This extraction ensures the diagnosis program's integrity and reliability, allowing it to accurately detect and distinguish abnormalities without being vulnerable to security attacks, while the overall device structure remains manageable through clear functional separation.
3Ease of operation
If communication monitoring is performed in the non-secure area, then ease of operation is improved, but security against attacks is insufficient
Solution Approach 1:
The secure area acts as an intermediary layer between the external communication interfaces and the non-secure operation area. The diagnosis program in the secure area monitors communication traffic and detects security attacks before they can affect the operation programs, providing protected communication monitoring that maintains ease of operation while enhancing security against attacks.
Data Source
AI summary
A security processing device which manages a device related to operation control of a vehicle includes a non-transitory computer-readable medium configured to store instructions executable by one or more processors. The non-transitory computer readable medium includes a non-secure area in which a mounted program is capable of being changed from an outside and a secure area in which a mounted program is incapable of being changed from the outside. The instructions cause a code of an operation program in the non-secure area to perform the operation control of the vehicle, and a diagnosis program in the secure area to diagnose an abnormality of the code of the operation program. When the abnormality of the operation program in the non-secure area is diagnosed, the instructions cause the diagnosis program in the secure area to determine a type of the abnormality and execute processing on a basis of the determined type.