Vehicle Computing Device Trust Zone Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern vehicles with highly networked computing devices face a significant increase in their attack surface due to varied external interfaces, leading to a heightened risk of remote attacks without physical access.
Innovation Solution
The implementation of a method that divides computing devices into trustworthy and non-trustworthy zones, with specific buffer storage areas having different authorizations for data exchange, and the use of a memory protection device to control access rights, thereby preventing unauthorized data manipulation and executive access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data exchange between zones is allowed to maintain operational flexibility, then system versatility is improved, but security against remote attacks deteriorates
Solution Approach 1:
The system divides the computing device into multiple trust zones (trusted zone and untrusted zone) with distinct memory spaces and access rights. This segmentation isolates potential attack vectors in the untrusted zone from critical resources in the trusted zone, reducing the overall attack surface while maintaining operational flexibility through controlled data exchange between zones.
Solution Approach 2:
Different memory regions are assigned different security properties and access permissions. The trusted zone has restricted access to prevent manipulation, while the untrusted zone allows broader data input. This local differentiation of security qualities enables flexible data exchange where needed while maintaining security boundaries where critical protection is required.
2Reliability
If buffer storage areas with different authorizations are implemented to enhance security, then reliability is improved, but device complexity increases
Solution Approach 1:
The memory space is segmented into multiple buffer storage areas with distinct authorization levels (read-only, read-write, execute permissions). This segmentation provides fine-grained security control without requiring complex external security mechanisms, as the authorization structure is built into the memory architecture itself.
Solution Approach 2:
A supervisor instance acts as an intermediary that manages data exchange between trusted and untrusted zones. The supervisor enforces access control policies and validates data transitions, providing centralized security management that simplifies the overall system architecture compared to distributed security checks throughout the codebase.
3Reliability
If zones are separated to prevent corrupted data from reaching trustworthy zones, then reliability is improved, but data exchange efficiency deteriorates
Solution Approach 1:
Data is validated and authorized for transfer before being moved between zones. The supervisor instance checks data integrity and permissions in advance, preventing corrupted or unauthorized data from entering the trusted zone. This preliminary validation ensures reliability while maintaining efficient data exchange by avoiding post-transfer security checks and corrections.
Solution Approach 2:
The supervisor instance serves as an efficient intermediary that manages data exchange between zones through predefined authorization rules. By caching and enforcing access control policies, the supervisor enables rapid data transfer decisions without requiring complex real-time security evaluations, thus maintaining high data exchange rates while ensuring security.
Data Source
AI summary
A method for operating a computing device for a control unit of a motor vehicle. The computing device including a processor core, and is configured to control an exchange of data between a connectivity zone and a security zone. The security zone includes at least one component which is necessary to drive the vehicle and has an elevated relevance with regard to safety. The connectivity zone including at least one component whose operation requires communication outside of the vehicle but is not required to drive the vehicle and does not have an elevated relevance with regard to safety. At least one first program executable by the computing device is assigned to a non-trustworthy zone, and at least one further program is assigned to a trustworthy zone. The component of the connectivity zone is assigned to the non-trustworthy zone, and the component of the security zone being assigned to the trustworthy zone.