Don’t Brick Your Car: Firmware Confidentiality and Rollback for Vehicles. / Mansor, Hafizah; Markantonakis, Konstantinos; Akram, Raja; Mayes, Keith.

10th International Conference on Availability, Reliability and Security: ARES 2015. IEEE, 2015. p. 139-148.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Published

Abstract

In modern cars, there are a number of controllers that play a major role in the overall operations of the vehicles. The secure and updated firmware of these
controllers is crucial to the overall security and reliability of the vehicle and its electronic system(s). Therefore, the life cycle of these controllers should be carefully managed. In this paper, we examine the vehicular firmware updates
process and their associated security issues.We have analysed the security of the firmware update protocol proposed in the EVITA project, referred as EVITA protocol, which is considered as a main industrial effort in this field and found some potential shortcomings. Based on the analysis, in this paper we have suggested a number of improvements to the EVITA protocol, related with safety and security measures. The proposed improved protocol, also referred as EVITA+ protocol includes a rollback mechanism while preserving the confidentiality of the firmware. The integrity and authenticity of the flash driver are also considered in the EVITA+ protocol. The EVITA+ protocol is formally analysed using CasperFDR and Scyther to ensure the security of the firmware update process. Finally, we provide an insight analysis and our experience in relation to the efficiency, suitability and performance of the aforementioned tools in the field of automotive security.
Original languageEnglish
Title of host publication10th International Conference on Availability, Reliability and Security: ARES 2015
PublisherIEEE
Pages139-148
Number of pages10
DOIs
StatePublished - 2015
This open access research output is licenced under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License.

ID: 25385647