In-Vehicle Systems
AutoCrypt IVS-TEE
Trusted execution environment for in-vehicle applications
Trusted security platform for software-defined vehicles.
AutoCrypt® IVS-TEE is an in-vehicle systems security platform dedicated to advanced vehicle applications like Advanced Driver-Assistance Systems (ADAS), in-vehicle infotainment (IVI), and the central communication unit (CCU).
By establishing a trusted execution environment (TEE) within each application processor, IVS-TEE provides an isolated and secure platform consisting of only trusted applications (TA).
Although hardware security modules (HSM) are highly effective at securing smaller units like MCUs and ECUs, TEE provides a more optimized and cost-effective approach to securing larger applications, ensuring compliance with UN R155 and ISO/SAE 21434.
How It Works
What Is a Trusted Execution Environment (TEE)?
A trusted execution environment (TEE) is an isolated environment for code execution, so that every application within the environment is safely protected from the rest of the device. All applications inside the TEE are called trusted applications (TA), each of them unable to access the data of other TAs.
The host environment on which a TEE is based on is called rich execution environment (REE). A TEE driver is built for applications in the REE, serving as a bridge to the TEE. TEE only allows the execution of code that has been validated and authorized.
Even if the REE of an application is compromised in an attack, the attacker would not be able to access the data within the TEE. The attacker cannot even manually copy any data in the TEE to other devices, as all data within the TEE are bound to the host device and will not run on any other devices.
Highlights
AutoCrypt IVS-TEE Components
AutoCrypt® IVS-TEE provides a secure TEE within each component of the application processor, optimized for the vehicular software architecture. IVS-TEE contains the following key elements:
- A crypto library in charge of encryption and key management
- A crypto daemon in charge of access control and sending validated client requests to the trusted application (TA)
- A TEE application in charge of encryption, key management, and other security functions in the TEE
- All components needed for TEE implementation, including APIs, drivers, OS components, and a secure monitor, built in compliance with the GlobalPlatform™ standard
AutoCrypt® IVS-TEE complies with the following technical standards:
- ASPICE-CL2
- GlobalPlatform™ API
- Adaptive AUTOSAR
- TrustZone for ARM-A technical specs
- MISRA-C/C++ validated
Use Cases
Secure Boot
Guarantees software integrity by allowing the execution of only safe and verified software
Secure Flash
Protects sensitive data from unauthorized access by granting access to validated users only
Secure OTA
Ensures only validated packets are received and installed during OTA updates
CCU
Protects both the central communication unit and ECUs by two-way authentication
ADAS
Protects ADAS from malicious code execution by implementing robust access control
IVI
Protects personal data by encrypting them and keeping them in an isolated environment
