Why Are an IDPS anda TEE Necessary for
Software-DeﬁnedVehicles?

The modern software-deﬁned vehicle (SDV)oﬀers a safer, connected, and autonomous
driving experience for the automotive industry.
But with millions of lines of code and various
connectivity interfaces, an SDV is exposed tomore risks.
A Trusted Execution Environment (TEE)provides a secure enclave to isolate andprotect customer code and data. Its ability to
run trusted applications (TAs) can enhance thesecurity and integrity of services such as anintrusion detection and prevention system(IDPS) by providing secure storage and

The Power of VicOne +Trustonic: Complete
Coverage Using Secure by
Design and Cybersecurity
A robust security foundation is a core partof any new vehicle, enabling OEMs todeliver their next-generation experienceswith the conﬁdence that their customers
will be fully protected. VicOne xCarbon,
with virtual patches and selected expert
rules, helps protect vehicles against
threats that use trusted credentials or

enabling secure communication.

exploits. For example, if an authorized

An IDPS helps vehicle manufacturers fulﬁll UNxCarbon detects and blocks it. Thanks to

R155 requirements by detecting and

VicOne’s threat intelligence, the virtual

monitoring suspicious activities in electronic

patches and expert rules are always

control units (ECUs). It also performs real-time

updated. Trustonic’s TEE provides

protection once a cyberattack is identiﬁed andtamper-protected storage for xCarbon

plays a sensor and data aggregator role torules, ensuring that only rules signed by acommunicate with the vehicle security

trusted VSOC are accepted by the vehicle.

operations center (VSOC) for further data

Similarly, traces generated by xCarbon areforensics and advanced analysis of threats.

stored and processed within the TEE,

component conducts suspicious activities,

ensuring any conﬁdential data is properly
managed and giving high assurance to theVSOC of data received.

Example Architecture•

The IDPS conﬁg ﬁle and virtual patch
IDPS TA(or rule set) database can be encrypted
and securely stored by Trustonic’s TEE.
•SFS(Secure FileSystem)IDPS

The IDPS sends a command to theConﬁg ﬁle

IDPS TA to get the conﬁg ﬁle and thenVirtual patch
databasefeed to the IDPS engine.
•When deploying a new virtual patch,

REE (e.g., Linux OS)

the IDPS sends a command to the IDPS
TA to securely store into database

Trustonic TEE OS

VSOC

within SFS.

Use Cases for IDPS and TEE
VicOne and Trustonic allow you to create an•

IDPS TA and add features over time:•Store the policy in SFS.
▪

The TA has a signature key to sign logs.

▪

The TA can link to device attestation toprove a device is legitimate.

▪

normal OS).
Updates are provided as signed ﬁles by◦The TA can sign individual messages orprovide a secure TLS tunnel to thethe IDPS.

back-end server.
•The TA validates the signature andMonitor the IDPS app.
▪

version before applying an update.
•▪

The IDPS fetches it periodically(avoiding ﬁle system attacks in a▪

Sign and/or upload logs.

heartbeat, with any miss being ﬂagged

Store the logs/database in Securein the TA.

Database (itself in SFS).
▪

The IDPS sends messages to add.

▪

The TA enforces an append-only policy.

▪

The TA provides local query/analysis

Require the IDPS app to send a periodic▪
•Avoid disablement attacks.

Utilize deep IDPS integration.
▪

The TA/driver monitors the IDPS appdirectly.

capability.

Learn more about VicOne
by visiting vicone.com.

Want to ﬁnd out more?
info@trustonic.com
trustonic.com