Don't brick your car: Firmware confidentiality and rollback for vehicles

Mansor, Hafizah and Markantonakis, Konstantinos and Akram, Raja Naeem and Mayes, Keith (2015) Don't brick your car: Firmware confidentiality and rollback for vehicles. In: 10th International Conference on Availability, Reliability and Security (ARES 2015), 24th-27th August 2015, Toulouse, France.

	PDF - Published Version Restricted to Repository staff only Download (1MB) | Request a copy
	PDF (SCOPUS) - Supplemental Material Restricted to Repository staff only Download (84kB) | Request a copy

Abstract

In modern cars, there are a number of controllers that play a major role in the overall operations of the vehicles. The secure and updated firmware of these controllers is crucial to the overall security and reliability of the vehicle and its electronic system(s). Therefore, the life cycle of these controllers should be carefully managed. In this paper, we examine the vehicular firmware updates process and their associated security issues. We have analysed the security of the firmware update protocol proposed in the EVITA project, referred as EVITA protocol, which is considered as a main industrial effort in this field and found some potential shortcomings. Based on the analysis, in this paper we have suggested a number of improvements to the EVITA protocol, related with safety and security measures. The proposed improved protocol, also referred as EVITA+ protocol includes a rollback mechanism while preserving the confidentiality of the firmware. The integrity and authenticity of the flash driver are also considered in the EVITA+ protocol. The EVITA+ protocol is formally analysed using CasperFDR and Scyther to ensure the security of the firmware update process. Finally, we provide an insight analysis and our experience in relation to the efficiency, suitability and performance of the aforementioned tools in the field of automotive security.

Item Type:	Conference or Workshop Item (Plenary Papers)
Additional Information:	7910/58087
Uncontrolled Keywords:	ECU; firmware update; EVITA; Scyther; CasperFDR;
Subjects:	T Technology > T Technology (General) > T175 Industrial research. Research and development
Kulliyyahs/Centres/Divisions/Institutes (Can select more than one option. Press CONTROL button):	Kulliyyah of Information and Communication Technology Kulliyyah of Information and Communication Technology
Depositing User:	Hafizah Mansor
Date Deposited:	21 Aug 2017 14:47
Last Modified:	21 Aug 2017 14:47
URI:	http://irep.iium.edu.my/id/eprint/58087

Actions (login required)

View Item