Sampled Secure Boot for Automotive Software Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Automotive systems face challenges in securely verifying the integrity of software in electronic control units (ECUs) during the boot process, particularly due to tight time constraints in real-time safety-critical systems, which can lead to delays and potential security vulnerabilities.
Innovation Solution
A sampled secure boot (SSB) system that uses an electronic controller with a memory and processor to generate secret keys, calculate fingerprints, and verify reference values using a one-way cryptographic function, allowing for rapid integrity checks during the boot phase while ensuring security by releasing a security halt or warning signal based on matching verification values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional secure boot verification is performed on the entire software image, then security is improved, but boot time increases beyond safety-critical constraints
Solution Approach 1:
The software image is divided into multiple blocks, and verification is performed on selected blocks rather than the entire image. This segmentation allows the system to verify software integrity while reducing the time required for boot-up, as only portions of the software need to be checked during each boot cycle.
Solution Approach 2:
Instead of performing complete verification of the entire software image during boot, the system performs partial verification on selected blocks. This partial action approach maintains security by verifying critical portions while accepting that not every single block is checked in every boot cycle, thus meeting time constraints.
2Reliability
If verification sampling rate is increased to improve security detection, then security is improved, but verification time increases
Solution Approach 1:
The verification process uses a dynamic sampling approach where different blocks are selected for verification at different times. The system randomly selects which blocks to verify during each boot cycle, creating a dynamic verification pattern that maintains security while adapting to time constraints. This dynamic selection allows the system to adjust verification intensity based on available time.
Solution Approach 2:
Verification is performed periodically at boot cycles rather than continuously. The system selects specific blocks for verification at periodic intervals (each boot), and within each verification event, specific blocks are sampled. This periodic action maintains security oversight while allowing normal operation without constant verification overhead.
Data Source
AI summary
Systems, methods, and vehicles for verifying integrity of automotive software. In one implementation, an electronic processor is configured to receive a power-up signal and randomly select one of a plurality of fingerprints. The electronic processor is also configured to retrieve a set of data stored in the memory cells of the selected fingerprint. The electronic processor is further configured to calculate a pre-boot verification value for the selected fingerprint using a one-way cryptographic function with a secret key and the retrieved set of data. The electronic processor is also configured to compare the pre-boot verification value to a reference verification value for the selected fingerprint. The electronic processor is further configured to release a security halt on the software image when the pre-boot verification value matches the reference verification value for the selected fingerprint.