Secure software delivery and installation in embedded systems

Authors:
André Adelsbach;Ulrich Huber;Ahmad-Reza Sadeghi
Affiliations:
Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany;Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany;Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany
Venue:
ISPEC'05 Proceedings of the First international conference on Information Security Practice and Experience
Year:
2005

Citing 3
Cited 2

Broadcast encryption

CRYPTO '93 Proceedings of the 13th annual international cryptology conference on Advances in cryptology
Revocation and Tracing Schemes for Stateless Receivers

CRYPTO '01 Proceedings of the 21st Annual International Cryptology Conference on Advances in Cryptology
On the Security of Joint Signature and Encryption

EUROCRYPT '02 Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques: Advances in Cryptology

A system architecture for reconfigurable trusted platforms

Proceedings of the conference on Design, automation and test in Europe
A security scheme for dependable key insertion in mobile embedded devices

International Journal of Reconfigurable Computing - Special issue on selected papers from the international workshop on reconfigurable communication-centric systems on chips (ReCoSoC' 2010)

Quantified Score

Hi-index	0.00

Visualization

Abstract

Increasingly, software (SW) in embedded systems can be updated due to the rising share of flashable electronic control units (ECUs). However, current SW installation procedures are insecure: an adversary can install SW in a given ECU without any sender authentication or compatibility assessment. In addition, SW is installed on an all-or-nothing base: with the installation, the user acquires full access rights to any functionality. Concepts for solving individual deficiencies of current procedures have been proposed, but no unified solution has been published so far. In this paper we propose a method for secure SW delivery and installation in embedded systems. The automotive industry serves as a case example leading to complex trust relations and illustrates typically involved parties and their demands. Our solution combines several cryptographic techniques. For example, public key broadcast encryption enables secure SW distribution from any provider to all relevant embedded systems. Trusted computing allows to bind the distributed SW to a trustworthy configuration of the embedded system, which then fulfills a variety of security requirements. Finally, we outline the management of flexible access rights to individual functionalities of the installed SW, thus enabling new business models.