# Prevention of Controller Area Network (CAN) Attacks on Electric Autonomous Vehicles
## 4 Secure Boot Process  
A secure boot process is a process that starts each boot cycle of an ECU to verify the integrity of the software stored in the ECU's non-volatile memory before permitting the software to execute. The secure boot process uses cryptographic data integrity algorithms to ensure the integrity of the software by calculating an integrity value for the software and comparing the integrity value to a stored reference value. The number of electronic control units in modern vehicles exceeds 100 ECUs [22]. Therefore, performing a secure boot process in vehicles' ECUs is crucial to ensure that tampered software is not allowed to execute. Executing tampered software poses the risk of altering the performance of vehicles, breaching the privacy and confidentiality of vehicle owners, and imposing safety threats to passengers and pedestrians. A malicious code impacts not only the targeted ECU but also other ECUs connected through the vehicle networks like the CAN bus. Performing a secure boot process prevents a malicious code from performing CAN bus attacks by not allowing the malicious code to execute. Although the secure boot concept was recently introduced in modern vehicles, it has been long used in classic computer systems. Ref. [23], which is one of the first research studies in secure booting, suggested the usage of a physically secure coprocessor to perform a set of security protocols including secure booting. The implemented security protocols aim to protect against the security threats that were imposed at the time. The concept of using physically secure coprocessors to secure boot the application processor is currently realized through the usage of secure hardware modules such as trusted platform modules (TPMs) [24], secure hardware extensions (SHEs), and hardware security modules (HSMs) [25]. This study used the HSM of the TC399 32-bit AURIXTM TriCoreTM microcontroller to perform the secure boot process. Currently, many vehicle manufacturers are opting to include secure boot as a requirement for their ECUs to prevent illegal tuning and to protect against risks associated with executing tampered software even once. Executing unauthentic software may permanently change the ECU functionality [26], which may threaten both drivers' and pedestrians' lives [27]. A secure boot process could be implemented using various strategies, most of which are built on the concept of chain of trust. In strategies that use a chain of trust, the secure boot is composed of multiple boot stages, where each boot stage validates the succeeding boot stage and gives it trust if it is authentic [28], and if all boot stages are authentic, the whole software is considered authentic. A chain of trust could be viewed as if the initial  
Figure 3: CAN bus with deployed secure boot scheme. boot stage (BS\({}_{0}\)) secure boots the following boot stage (BS\({}_{1}\)), which in turn secure boots the following boot stage, and so on, until all boot stages are secure booted. Although it is more common that all boot stages use the same secure boot strategy, some chain-of-trust systems include boot stages that use different secure boot strategies such as different software integrity algorithms [29]. As shown in Figure 4, each boot stage is formed of three components. The measurement component is responsible for measuring the software integrity value and validating this integrity value against the reference value. The storage component is responsible for storing the values needed by the measurement component, such as the reference value and the cryptographic key. The storage component is also responsible for preserving the confidentiality of cryptographic private keys [29]. Finally, the reporting component is responsible for applying the necessary countermeasures if the secure boot of the succeeding boot stage fails. All three components of each boot stage should be validated by the preceding boot stage.