# Prevention of Controller Area Network (CAN) Attacks on Electric Autonomous Vehicles
## 7 Tests and Results  
A secure boot process of an electric autonomous vehicle's ECU was developed to test the performance of the six prementioned data integrity algorithms using the HSM module of the AURIX TC399. The integrity algorithms selected are the five most common validation algorithms used in secure booting in both the industry and academia, along with the newly introduced CMAC-based ECDSA algorithm. The CMAC-based ECDSA algorithm is a novel integrity algorithm, which was developed to combine the security advantages of the ECDSA and the performance advantages of the CMAC algorithms. The AURIX TC399 target was selected because it is one of the widely used microcontroller targets in the automotive industry. The used secure boot strategy was a sequential-mode strategy that has a single boot stage. This boot stage is executed by a one-time programmable HSM code that performs the secure boot process to the HSM firmware code and the host application code. The HSM firmware code is responsible for providing different cryptographic primitives to the host core upon the requests of the host application code. The host application code is an AUTOSAR-based code that is executed on the host core 0 and is responsible for executing the functionality needed from the ECU. The host application code defers cryptographic operations to the HSM firmware code, which performs the operations by interfacing with the hardware accelerators and then communicating the result to the host core. Upon startup, the OTP secure boot code executes and validates the HSM firmware code and the host application code. If both codes are valid, the OTP secure boot code releases the host core, allowing it to start executing, and gives control of the HSM core to the HSM firmware code. If one or both validations fail, the OTP secure boot code bricks the ECU and waits for the next reset to retry the validation process. This prevents the execution of any unauthorized code, which could gain access to the CAN bus and jeopardize the whole network. The full secure boot sequence is presented in Figure 8.  
Five test cases were performed to test the effectiveness of the proposed secure boot scheme in detecting malicious code injection. The first test case involved running the secure boot process using a valid HSM firmware code and a valid host application code. The second test case was performed after injecting a malicious code into the HSM firmware code, while the third test case was carried out by injecting a malicious code into the host application code. The fourth and fifth test cases were conducted by injecting a single-byte malicious code into the HSM firmware code and the host application code, respectively. The second and third test cases were meant to test major malicious code injection attacks, while the fourth and fifth test cases were meant to test minor malicious code injection attacks. In the first test case, the software validation process succeeded, and the ECU execution continued normally. In the second to fifth test cases, the secure boot process was able to detect the presence of the malicious code, which caused the validation process to fail. This prevented the malicious code from being executed. The results of the five test cases are summarized in Table 3.  
The OTP secure boot code interfaces with the HSM hardware accelerators to perform the integrity algorithms on the intended software. Six different variants of the secure boot code were implemented on the AURIX TC399 HSM using a productized ready-for-development code. Each variant implements the secure boot process using one of the algorithms discussed in Section 5. The performance of the six variants was tested using the HSM timer module to measure the time each variant took to finish the validation of 147,455 bytes of code. The reason for using a productized ready-for-development code was to ensure that the resulting timing characteristics are approximate to the performance of a deployed code in an industrial vehicle.