ECU Tamper Detection via Hardware Security Module
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern vehicles' electronic control units (ECUs) face challenges in ensuring data integrity and security, particularly when software is tampered with, as existing methods either halt the processor or continue executing potentially compromised data, which is not palatable for safe operation, and limiting access to encryption keys does not protect local functions from rogue software.
Innovation Solution
An ECU design featuring a tamper-resistant hardware security module that determines data tampering by checking cryptographic signatures and, upon detection, loads new data from external storage, ensuring only verified data is executed, with the option to halt the processor if data is compromised, and incorporating cryptographic error correction to correct errors before execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the processor halts when data tampering is detected, then data integrity is protected, but vehicle operation is compromised
Solution Approach 1:
The system performs preliminary authentication of data using cryptographic signatures before execution. The HSM verifies signatures of code in storage and data from peripherals in advance, allowing the system to prepare safe execution states or fallback modes before actual execution, thus preventing complete operational halt while maintaining integrity
Solution Approach 2:
The system implements cryptographic error correction codes and authentication mechanisms as preventive measures before data execution. These cushioning mechanisms detect and correct tampering attempts beforehand, allowing the processor to continue operating with corrected data rather than halting completely
2Productivity
If the processor continues executing potentially compromised data, then vehicle operation is maintained, but data integrity is compromised
Solution Approach 1:
The HSM continuously monitors and verifies data integrity through cryptographic signatures during runtime. When data from peripherals or storage is executed, the HSM provides real-time feedback by authenticating the data, allowing the system to maintain operation while dynamically ensuring integrity through continuous verification
3Reliability
If access to encryption keys is limited, then protection against rogue software is improved, but local function protection is weakened
Solution Approach 1:
The HSM acts as a secure intermediary that holds encryption keys and performs cryptographic operations. Application software cannot directly access keys but can request cryptographic services from the HSM. This mediator architecture protects against rogue software while maintaining local function security, as the HSM verifies all cryptographic operations regardless of software origin
4Reliability
If cryptographic verification is performed on all data, then data integrity is ensured, but processing time increases
Solution Approach 1:
The system performs cryptographic verification selectively rather than on all data. Critical data such as code in storage and data from untrusted peripherals undergo full signature verification, while internally generated trusted data may use lighter validation. This partial action approach ensures integrity for critical paths while minimizing overall processing time impact
Data Source
AI summary
An electronic control unit for a vehicle, the electronic control unit comprising a processor comprising: a processor core; storage, the storage storing data comprising instructions for the processor core; a tamper-resistant hardware security module which is coupled to the storage for reading and writing; and an external interface; the electronic control unit further comprising further storage connected to the processor through the external interface and containing further data; in which the hardware security module is arranged to cause a determination whether the data in the storage has been tampered with and, on a determination that the data has been tampered with, to cause the further data to be loaded into the storage from the further storage over the external interface. Other apparatus and methods for improving the security of electronic control circuits are disclosed.