Vehicle ECU RoT Verification Using a Monitoring ECU
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vehicle ECUs face challenges in securely verifying the integrity of their Root of Trust (RoT) due to the need for updating public keys, necessitating replacement of the ECU when the RoT is stored in a secure, non-writable storage, which limits long-term use.
Innovation Solution
The RoT is stored in a writable non-volatile memory and monitored by a duplicate monitoring ECU, which verifies the integrity of the RoT using hash values generated with a secure, read-only hash value generating program, allowing updates without replacing the ECU.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the Root of Trust is stored in a secure non-writable storage, then the integrity verification is secure, but the ECU must be replaced when public keys need updating
Solution Approach 1:
The verification system is segmented into two parts: the Root of Trust (stored securely in non-writable storage) and the verification program (stored in writable storage). This segmentation allows the verification program to be updated without replacing the entire ECU, while the Root of Trust remains secure and immutable.
Solution Approach 2:
A verification program acts as an intermediary between the Root of Trust and the startup program. This verification program can be updated in writable storage to support new public keys, while the Root of Trust in non-writable storage remains unchanged and secure.
2Reliability
If the ECU is replaced when RoT needs updating, then security is maintained, but long-term use and cost efficiency are reduced
Solution Approach 1:
The system transitions from a static configuration (fixed Root of Trust in non-writable storage) to a dynamic configuration where the verification program can be updated in writable storage. This allows the ECU to adapt to new security requirements without replacement, extending its service life.
Solution Approach 2:
The system changes the storage location parameter of the verification program from non-writable to writable storage, while keeping the Root of Trust in non-writable storage. This parameter change enables updates without replacement, extending ECU lifespan while maintaining security.
3Adaptability or versatility
If a writable storage is used for verification program, then updates are enabled, but the risk of tampering increases
Solution Approach 1:
The monitoring ECU provides feedback by monitoring the control ECU and verifying the integrity of the verification program and startup program. This feedback mechanism detects tampering attempts, allowing the system to maintain writable storage for updates while mitigating tampering risks through continuous verification.
Solution Approach 2:
The monitoring ECU acts as an intermediary that verifies the integrity of programs in writable storage. This intermediary layer enables updates in writable storage while protecting against tampering through cryptographic verification.
Data Source
AI summary
A vehicle includes a control electronic control unit and a monitoring electronic control unit. The control electronic control unit is configured to control an object device mounted on the vehicle, and the monitoring electronic control unit is configured to monitor the control electronic control unit. The control electronic control unit is configured to store a startup program and a first verification program for verifying whether the startup program has been tampered with in a writable first storage medium, calculate a hash value for the first verification program, and output the calculated hash value to the monitoring electronic control unit. The monitoring electronic control unit is configured to determine an abnormality in the control electronic control unit based on the hash value received from the control electronic control unit.