Ensuring the Safe and Secure Operation of Electronic Control Units in Road Vehicles

With the increasing connectivity and complexity of road vehicles, security heavily impacts the safety of vehicles. In fact, researchers demonstrated that the lack of security in vehicles can lead to dangerous and even life-threatening situations. A threat that has been insufficiently addressed in existing vehicular security solutions are software attacks, in which the adversary compromises the software of Electronic Control Units (ECUs). A promising technique to defend against software attacks is remote attestation, as it enables to detect compromised devices. This paper presents a novel attestation scheme that ensures the software integrity of ECUs to warrant the vehicle's safety. In our scheme, a trusted master ECU verifies the integrity of all safety-critical ECUs and refuses to start the engine in case an untrustworthy, and hence, unsafe state is detected. As modern vehicles are highly heterogeneous system of systems, we propose two different attestation techniques that enable the attestation of simple ECUs, such as basic sensors or actuators, as well as advanced, more complex ECUs like sensor fusion systems. We implement our attestation scheme on an exemplary automotive network that incorporates CAN and Ethernet, and show that our solution imposes an imperceptible overhead for passengers.