A system, comprising: a host processor associated with a vehicle, said host processor being configured to receive an encrypted new or updated message filtering rule produced by a rule authoring entity and a trusted digital manifest associated with said encrypted new or updated message filtering rule to indicate that the new or updated message filtering rule is trusted; a bus configured to convey messages between said host processor and one or more electronic control units, ECUs, communicatively coupled to said bus; a bus controller configured to: filter messages from said host processor using one or more filtering rules in a message filtering rule data repository, wherein filtering said messages includes receiving unfiltered messages from said host processor for transmission on said bus, generating filtered messages by removing unfiltered messages that potentially include malicious code for altering operation of said vehicle using said one or more message filtering rules, and sending said filtered messages to said bus; perform authentication operations to verify the authenticity of said encrypted new or updated message filtering rule with said trusted digital manifest and a trusted rule-signing key; and when the encrypted new or updated message filtering rule is determined to be authentic, decrypt the encrypted new or updated message filtering rule using a combination of the trusted digital manifest and the trusted rule-signing key to produce a decrypted new or updated message filtering rule, and updating the message filtering rule data repository with said decrypted new message filtering rule; and wherein said bus controller is programmable through an interface that is inaccessible to said host processor. a host processor associated with a vehicle, said host processor being configured to receive an encrypted new or updated message filtering rule produced by a rule authoring entity and a trusted digital manifest associated with said encrypted new or updated message filtering rule to indicate that the new or updated message filtering rule is trusted; a bus configured to convey messages between said host processor and one or more electronic control units, ECUs, communicatively coupled to said bus; a bus controller configured to: filter messages from said host processor using one or more filtering rules in a message filtering rule data repository, wherein filtering said messages includes receiving unfiltered messages from said host processor for transmission on said bus, generating filtered messages by removing unfiltered messages that potentially include malicious code for altering operation of said vehicle using said one or more message filtering rules, and sending said filtered messages to said bus; perform authentication operations to verify the authenticity of said encrypted new or updated message filtering rule with said trusted digital manifest and a trusted rule-signing key; and when the encrypted new or updated message filtering rule is determined to be authentic, decrypt the encrypted new or updated message filtering rule using a combination of the trusted digital manifest and the trusted rule-signing key to produce a decrypted new or updated message filtering rule, and updating the message filtering rule data repository with said decrypted new message filtering rule; and wherein said bus controller is programmable through an interface that is inaccessible to said host processor. filter messages from said host processor using one or more filtering rules in a message filtering rule data repository, wherein filtering said messages includes receiving unfiltered messages from said host processor for transmission on said bus, generating filtered messages by removing unfiltered messages that potentially include malicious code for altering operation of said vehicle using said one or more message filtering rules, and sending said filtered messages to said bus; perform authentication operations to verify the authenticity of said encrypted new or updated message filtering rule with said trusted digital manifest and a trusted rule-signing key; and when the encrypted new or updated message filtering rule is determined to be authentic, decrypt the encrypted new or updated message filtering rule using a combination of the trusted digital manifest and the trusted rule-signing key to produce a decrypted new or updated message filtering rule, and updating the message filtering rule data repository with said decrypted new message filtering rule; and wherein said bus controller is programmable through an interface that is inaccessible to said host processor.