Gateway-Accessible Memory Partitioning for Secure ECU Firmware Restore
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory systems in control systems, such as those used in cars, face safety concerns due to the potential alteration of electronic control apparatuses, which can lead to abnormal operation and unauthorized access, and the storage of restoration firmware in accessible regions that may be abused.
Innovation Solution
A memory system with separate storage regions for normal and restricted access firmware, allowing secure storage and distribution of special and diagnosis firmware only after authentication, and a watchdog mechanism to ensure regular alteration detection and restoration operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of repair
If restoration firmware is stored in accessible storage regions, then the gateway can easily access and restore altered electronic control apparatuses, but the accessible storage region may be abused by unauthorized access
Solution Approach 1:
The storage system is divided into two distinct storage regions: a first storage region that is accessible during normal operation and a second storage region that is inaccessible during normal operation. Restoration firmware is specifically stored in the second storage region, which is only accessible when the electronic control apparatus is started using second software (restoration mode). This segmentation ensures that restoration firmware is protected from unauthorized access while remaining accessible when needed for legitimate restoration operations.
2Ease of operation
If the gateway is started using first software for normal operation, then regular access to firmware is enabled, but the gateway cannot access restoration firmware stored in restricted regions
Solution Approach 1:
The system implements dynamic access control based on the software mode being executed. When the gateway is started using first software, the first storage region is accessible for normal firmware operations, while the second storage region remains inaccessible. When the gateway is started using second software (restoration mode), the access rights are dynamically changed to allow access to the second storage region containing restoration firmware. This dynamic switching of access permissions enables the system to satisfy both normal operation requirements and restoration requirements without compromising security.
3Reliability
If separate storage regions are implemented for normal and restoration firmware, then security is improved, but device complexity increases
Solution Approach 1:
The controller is designed to perform multiple functions: it manages both the first storage region for normal firmware and the second storage region for restoration firmware, and it can execute both first software for normal operation and second software for restoration mode. The controller universally handles firmware distribution, authentication, and mode switching, thereby managing the complexity of the segmented storage structure through a single multi-functional component rather than requiring separate dedicated systems for each function.
Data Source
AI summary
A memory system comprising a first storage region which stores first firmware corresponding to an external first electronic control apparatus; a second storage region which stores second firmware corresponding to an external gateway and third firmware corresponding to the first electronic control apparatus; and a controller configured to transmit the second firmware and the third firmware to the gateway on the basis of a first command received from the gateway, and transmit the first firmware to the gateway on the basis of a second command received from the gateway.