Hardware Protected Security for Ground Vehicles
Authors:   Vehicle Electrical System Security Committee
Published: February 2020

<div class="section abstract">

<div class="htmlview paragraph">Access mechanisms to system data and/or control is a primary use case of the hardware protected security environment (hardware protected security environment) during different uses and stages of the system. The hardware protected security environment acts as a gatekeeper for these use cases and not necessarily as the executor of the function. This section is a generalization of such use cases in an attempt to extract common requirements for the hardware protected security environment that enable it to be a gatekeeper.</div>
<div class="htmlview paragraph">Examples are:</div>
<ul class="list disc">
<li class="list-item">
<div class="htmlview paragraph">Creating a new key fob</div></li>
<li class="list-item">
<div class="htmlview paragraph">Re-flashing ECU firmware</div></li>
<li class="list-item">
<div class="htmlview paragraph">Reading/exporting PII out of the ECU</div></li>
<li class="list-item">
<div class="htmlview paragraph">Using a subscription-based feature</div></li>
<li class="list-item">
<div class="htmlview paragraph">Performing some service on an ECU</div></li>
<li class="list-item">
<div class="htmlview paragraph">Transferring ownership of the vehicle</div></li></ul>
<div class="htmlview paragraph">Some of these examples are discussed later in this section and some have detailed sections of their own. This list is by no means comprehensive. Other use cases that require hardware protected security environment-based access control may be used by each manufacturer/service provider based on vehicle capabilities, architecture, and business model.</div>
<div class="htmlview paragraph">This section describes how the hardware protected security environment provides a platform to implement access control by enabling secure authentication, authorization and access enforcement. It does not define any specific access control system (DAC/MAC/capability-based/role-based/etc.), models, or polices.</div>
<div class="htmlview paragraph">A general access control system is based on the following stages:</div>
<ol class="list nostyle">
<li class="list-item">
<span class="li-label">1</span>
<div class="htmlview paragraph">Identifying and authenticating the user.</div></li>
<li class="list-item">
<span class="li-label">2</span>
<div class="htmlview paragraph">Authorizing access to the resource.
<ol class="list nostyle">
<li class="list-item">
<span class="li-label">a</span>
<div class="htmlview paragraph">Comparing authenticated user to policies (database/certificates/other).</div></li>
<li class="list-item">
<span class="li-label">b</span>
<div class="htmlview paragraph">Comparing other conditions (temporal/spatial/other) to policies database.</div></li>
<li class="list-item">
<span class="li-label">c</span>
<div class="htmlview paragraph">Unlocking access to the resource.</div></li></ol></div></li>
<li class="list-item">
<span class="li-label">3</span>
<div class="htmlview paragraph">Using the resource.</div></li>
<li class="list-item">
<span class="li-label">4</span>
<div class="htmlview paragraph">(Optional) Removing access to the resource based on temporal or other conditions.
<ol class="list nostyle">
<li class="list-item">
<span class="li-label">a</span>
<div class="htmlview paragraph">Locking access to the resource.</div></li></ol></div></li></ol>
<div class="htmlview paragraph">The hardware protected security environment can be involved to different extents in each of the stages listed above. The main two types of hardware protected security environment involvements are full control and partial control. In partial control, the hardware protected security environment is responsible to authenticate and authorize the access, while the normal environment is responsible to lock/unlock the resource. In full control, the hardware protected security environment is responsible for both.</div></div>