Search papers, labs, and topics across Lattice.
This paper introduces DACER, a runtime decentralized attestation and coordinated repair framework designed to enhance the security of automotive electronic control units (ECUs) against malware threats. By integrating local self-attestation with global coordination for ECU repair, DACER addresses the critical challenge of maintaining vehicle safety during runtime operations. Experimental implementations on real-world hardware show that DACER effectively checks vehicle state and restores firmware with minimal overhead, significantly improving resilience against compromised ECUs.
DACER uniquely combines local self-attestation with global repair coordination, enabling real-time firmware restoration in automotive systems under threat.
The evolution of automotive technology increasingly integrates components, transforming vehicles into interconnected systems of systems. Modern vehicles are controlled by a distributed system of computing devices, known as electronic control units (ECUs). However, this interconnectedness means that any error poses significant risks to the vehicle operator. In particular, malware can be injected into ECUs, threatening vehicle safety. To address this, we need mechanisms to detect compromised ECUs then repair them to a benign state. Existing approaches mainly focus on detection and do not address the challenge of integrating detection with runtime ECU repair. This integration is nontrivial because runtime repair involves both local rollback and reboot with timing determined from global vehicle context to avoid unsafe behavior. In this work, we have designed DACER, a runtime decentralized attestation and coordinated repair framework for automotive ECUs. DACER is the first approach that co-designs attestation and repair to unify the ``local''nature of firmware rollback with the ``global''nature of ECU reboot. In DACER, each ECU performs efficient local self-attestation and self-repair functions, enabling low-overhead coordination for distributed operations. In addition, DACER takes advantage of the hierarchical vehicle computing architecture. Our resulting DACER design checks the entire state of the vehicle, resists single points of failure, conforms to real-time constraints, and enables firmware restoration during runtime. The key functions are enabled by the ARM TrustZone equipped within each ECU and the secure flash memory controller embedded in the storage device. We implemented DACER on real-world hardware and experimentally demonstrated its low overhead.
