In-Vehicle SOA MAC Allow Lists to Block ECU Spoofing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern vehicles face security vulnerabilities in their service-oriented architecture (SOA) due to ECUs being susceptible to spoofing by imposter or compromised ECUs, which can lead to dangerous consequences without proper message authentication.
Innovation Solution
Implementing a Message Authentication Code (MAC) Generate Allow List (MGAL) system that self-polices ECU transmissions based on granular permissions, ensuring only authorized ECUs generate MACs for messages within their permitted criticality levels, thereby preventing unauthorized access and spoofing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If ECUs are allowed to transmit messages freely in service-oriented architecture, then communication flexibility and system functionality are improved, but security vulnerabilities increase due to spoofing by imposter or compromised ECUs
Solution Approach 1:
The system performs preliminary authentication by generating a Message Authentication Code (MAC) for each message before transmission. The MAC is calculated using a secret key stored in the ECU's secure element, ensuring that the message's integrity and authenticity are verified in advance before it enters the network, preventing spoofing attacks.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism where a MAC calculation unit acts as a mediator between the message source and destination. This intermediary component verifies the message's authenticity by calculating and comparing MAC values, ensuring that only genuine messages from authorized ECUs are accepted, thus resolving the trust issue in flexible ECU communications.
2Reliability
If strict message authentication is implemented for all ECU communications, then security against spoofing is improved, but system complexity and computational overhead increase
Solution Approach 1:
The authentication system is implemented as a self-service mechanism within each ECU. Each ECU autonomously generates its own MAC using its unique secret key stored in its secure element, and other ECUs verify messages using the sender's public key. This distributed self-service approach eliminates the need for a centralized authentication server, reducing overall system complexity while maintaining strong security.
Solution Approach 2:
The patent transforms the authentication approach by changing the cryptographic parameters from symmetric key exchange to asymmetric key pairs with MACs. Each ECU holds a unique secret key and corresponding public key, allowing for efficient verification without requiring complex key management infrastructure. This parameter change simplifies the authentication system while providing robust security against spoofing.
3Speed
If MAC generation is permitted for all ECU requests, then communication speed is maintained, but unauthorized access and spoofing become possible
Solution Approach 1:
The system applies preliminary anti-action by preemptively preventing unauthorized MAC generation through hardware-based access control. The secret key is stored in a secure element that only allows MAC generation for messages originating from authorized ECUs. This preliminary security measure blocks spoofing attempts before they can occur, maintaining communication speed by not requiring post-transmission verification of unauthorized messages.
Solution Approach 2:
The patent introduces an intermediary secure element within each ECU that mediates MAC generation requests. This intermediary component verifies the authenticity of the requesting ECU hardware before allowing MAC generation, ensuring that only authorized ECUs can create valid authenticated messages. This mediation maintains communication speed by enabling fast local authentication while preventing unauthorized access through hardware-based security.
Data Source
AI summary
A method for a secure in-vehicle service oriented architecture with a MAC Generate Allow List includes receiving, at a secure environment, a request to transmit a message from a device. The request to transmit includes a request for a message authentication code. The method also includes determining, based on the request to transmit, an identity of the device, and determining, based on a message authentication generate allow list, that the request to transmit does not exceed a permission level of the device. Here, the permission level of the device is stored in the message authentication generate allow list. The method also includes obtaining a secure environment key assigned to the device, the secure environment key only accessible by the secure environment, and generating the message authentication code using the secure environment key assigned to the device.