# Prevention of Controller Area Network (CAN) Attacks on Electric Autonomous Vehicles
## 6 TC399 32-Bit AURIXTM TriCoreTM Microcontroller  
The AURIX TC399 is a member of the TC3 xx family, which is designed by AURIX specifically for automotive ECUs. The TC3 xx family is designed for safety-critical applications with the addition of a separate HSM core for security-critical applications. In addition to the HSM core, the AURIX TC399 contains six TriCore processors called host cores, which are used to execute the ECU application code. Each of the six cores can operate with frequencies up to 300 MHz, has its separate SRAM, and has its separate flash memory that can be used for storing both code and data. Although the six cores can access each other's memory, this access can be restricted by memory protection units (MPUs) because each core has its designated MPU. The MPUs can be configured to protect their cores' memory and registers from being manipulated by other cores.  
The AURIX TC399 HSM processor is based on the ARMTMT CortexTM M3 architecture and can operate with frequencies up to 100 MHz. The HSM core was built while applying the EVITA classification [53] to provide the ECU with security schemes and fast cryptographic primitive calculation. The HSM core was designed to be isolated from the application and the host cores to protect the HSM from being compromised due to a compromise in the application code. This is achieved by restricting all communication from the host cores to the HSM core through a special bridge module. This bridge module consists of multiple special function registers that are used to synchronize between the host cores and the HSM core and to transfer data between the two sides. The bridge module also enables each side to send interrupt signals to the other side, which can be enabled to invoke an interrupt service routine. The AURIX TC399 memory is implemented such that the HSM core can have access over the whole memory which cannot be restricted by the MPUs, while  
Figure 6: ECDSA-CMAC algorithm flowchart.  
the host cores cannot modify the HSM memory if the HSM memory is configured as being HSM exclusive. This isolation of the HSM enables it to be used for the secure storage of cryptographic secrets and keys, which prevents these secrets and keys from being modified by unauthenticated sources. To further protect the memory from being modified, code memory sections can be configured to be one-time programmable, which ensures that the configured code memory sections are hardware protected against modifications.  
The HSM core performs fast cryptographic primitives through its designated hardware accelerators. The AURIX TC399 HSM contains hardware accelerators such as a true random number generator (TRNG); an AES 128 encryption/decryption device; a hash module that performs the message-digest algorithm (MD-5); SHA-1, SHA-224, and SHA-256 hash functions; and a public key cryptography (PKC) module that support asymmetric cryptographic operations that use key sizes up to 256 bits.  
As indicated in Figure 7, the AURIX TC399 starts the host core 0 upon booting, and if the HSM core is configured to be enabled, the host core 0 starts the HSM core and waits for the HSM to release it. When the HSM is configured to be enabled, the AURIX TC399 microcontroller detects any attempts to bypass the execution of the HSM core code and locks the microcontroller if an attempt is detected.  
Figure 7: AURIX TC399 boot sequence.  
All the prementioned characteristics make the HSM of the AURIX TC399 a suitable root of trust for the secure boot process. Because it is the first software section to be executed by an ECU, and it possesses the hardware accelerators that speed up the measurement of the validation value. Also, the HSM has a hardware-secured storage area to store the reference validation value and the cryptographic keys. The HSM also has the ability to brick the ECU if needed by preventing the release of the host cores and trapping the code executed by the HSM core. Finally, as an extra layer of security, the software responsible for secure booting could be set to be one-time programmable.