In-Vehicle Systems

AutoCrypt IVS-TEE

Trusted execution environment for in-vehicle applications
autocrypt ivs tee main

Trusted security platform for software-defined vehicles.

AutoCrypt® IVS-TEE is an in-vehicle systems security platform dedicated to advanced vehicle applications like Advanced Driver-Assistance Systems (ADAS), in-vehicle infotainment (IVI), and the central communication unit (CCU).

By establishing a trusted execution environment (TEE) within each application processor, IVS-TEE provides an isolated and secure platform consisting of only trusted applications (TA).

Although hardware security modules (HSM) are highly effective at securing smaller units like MCUs and ECUs, TEE provides a more optimized and cost-effective approach to securing larger applications, ensuring compliance with UN R155 and ISO/SAE 21434.

How It Works

What Is a Trusted Execution Environment (TEE)?

A trusted execution environment (TEE) is an isolated environment for code execution, so that every application within the environment is safely protected from the rest of the device. All applications inside the TEE are called trusted applications (TA), each of them unable to access the data of other TAs.

The host environment on which a TEE is based on is called rich execution environment (REE). A TEE driver is built for applications in the REE, serving as a bridge to the TEE. TEE only allows the execution of code that has been validated and authorized. 

Even if the REE of an application is compromised in an attack, the attacker would not be able to access the data within the TEE. The attacker cannot even manually copy any data in the TEE to other devices, as all data within the TEE are bound to the host device and will not run on any other devices.

ivs tee 1

Highlights

AutoCrypt IVS-TEE Components

AutoCrypt® IVS-TEE provides a secure TEE within each component of the application processor, optimized for the vehicular software architecture. IVS-TEE contains the following key elements:

  • A crypto library in charge of encryption and key management
  • A crypto daemon in charge of access control and sending validated client requests to the trusted application (TA)
  • A TEE application in charge of encryption, key management, and other security functions in the TEE
  • All components needed for TEE implementation, including APIs, drivers, OS components, and a secure monitor, built in compliance with the GlobalPlatform standard
ivs tee 2

AutoCrypt® IVS-TEE complies with the following technical standards:

  • ASPICE-CL2
  • GlobalPlatform™ API
  • Adaptive AUTOSAR
  • TrustZone for ARM-A technical specs
  • MISRA-C/C++ validated

Use Cases

secure boot icon

Secure Boot

Guarantees software integrity by allowing the execution of only safe and verified software

secure flash icon

Secure Flash

Protects sensitive data from unauthorized access by granting access to validated users only

secure ota icon

Secure OTA

Ensures only validated packets are received and installed during OTA updates

CCU icon

CCU

Protects both the central communication unit and ECUs by two-way authentication

adas icon

ADAS

Protects ADAS from malicious code execution by implementing robust access control

ivi icon

IVI

Protects personal data by encrypting them and keeping them in an isolated environment

Related Resources

Play Video