Table Of ContentEmbedded Security in Cars
Kerstin Lemke · Christof Paar · Marko Wolf (Eds.)
Embedded
Security in Cars
Securing Current and
Future Automotive IT Applications
With53Figuresand25Tables
123
Editors
KerstinLemke MarkoWolf
Ruhr-UniversitätBochum Ruhr-UniversitätBochum
44780Bochum,Germany 44780Bochum,Germany
[email protected] [email protected]
www.crypto.rub.de www.crypto.rub.de
ChristofPaar
Ruhr-UniversitätBochum
44780Bochum,Germany
[email protected]
www.crypto.rub.de
LibraryofCongressControlNumber:2005935329
ACMComputingClassification(1998):C.3,C.5,E.3,J.7
ISBN-10 3-540-28384-6 SpringerBerlinHeidelbergNewYork
ISBN-13 978-3-540-28384-3 SpringerBerlinHeidelbergNewYork
Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,reuseofillustrations,recitation,broadcasting,
reproductiononmicrofilmorinanyotherway,andstorageindatabanks.Duplicationofthispublication
orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,
1965,initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer.Violations
areliableforprosecutionundertheGermanCopyrightLaw.
SpringerisapartofSpringerScience+BusinessMedia
springeronline.com
©Springer-VerlagBerlinHeidelberg2006
PrintedinGermany
Theuseofgeneraldescriptivenames,registerednames,trademarks,etc.inthispublicationdoesnot
imply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevantpro-
tectivelawsandregulationsandthereforefreeforgeneraluse.
TypesetbytheauthorsusingaSpringerTEXmacropackage
Production:LE-TEXJelonek,Schmidt&VöcklerGbR,Leipzig
Coverdesign:KünkelLopkaWerbeagentur,Heidelberg
Printedonacid-freepaper 45/3142/YL-543210
Preface
Informationtechnologyisthedrivingforcebehindinnovationsintheautomo-
tiveindustry,withperhaps90%ofallinnovationsincarsbasedonelectronics
and software. Up to 80 embedded processors can be found in a high-end car,
and electronics and software are already a major cost factor in car manufac-
turing. The situation is similar for commercial vehicles such as trucks. One
crucialaspectoffutureITapplicationsinvehiclesisthesecurityofthesesys-
tems.Whereassoftwaresafetyisarelativelywell-established(ifnotnecessarily
well-understood) field, the protection of automotive IT systems against ma-
nipulationhasonlyveryrecentlystartedtoemerge.Whenwestartedworking
inthisexcitingareaaboutfouryearsago,werealizedthatthereishardlyany
literatureonthistopic,nottomentionanykindofcomprehensivedescription
of the field of IT security in cars.
Thisbookhasasimplemainobjective:We attempt to give an overview on
mostaspectswhicharerelevantforITsecurityinautomotiveapplications.We
hope that the book is, on the one hand, of interest to automotive engineers
and technical managers who want to learn about security technologies, and,
on the other hand, for people with a security background who want to learn
about security issues in modern automotive applications. In particular, we
hopethatthebookcanserveasanaidforpeoplewhoneedtomakeinformed
decisions about car security solutions, and for people who are interested in
research and development in this exciting field.
Ascanbeseenfromthetableofcontents,ITsecurityincarsincorporates
quite diverse disciplines. In addition to its spread across different technical
areas, it is a new and fast-moving field, so that the collection of topics in this
book should be viewed as a “best guess” rather than the final word on what
exactly constitutes automotive IT security. All of the contributing authors
(and ourselves) have been working for many years in embedded security, and
for a few years on various aspects of car security from a research as well as
from an industry viewpoint.
The book consists of an introduction and three other main parts. The
first article, Embedded IT Security in Automotive Application – an Emerging
VI Preface
Area, provides an overview of the field and at the same time serves as an
introduction and motivation for the remainder of this book.
Part II, Security in the Automotive Domain, is a collection of articles
whichdescribethemostrelevantcarapplicationsforwhichITsecurityis
crucial.Therangeoftopicsisquitebroad,includingsecurityforimmobilizers,
tachographs, software updates (“flashing”), communication buses and vehicle
communication. Some of the topics are very current, such as secure flashing,
whereasothertopicssuchasinter-vehiclecommunicationareforwardlooking.
Part III, Embedded Information Technology in Cars: State-of-the-art,
deals with the actual security technologies that are relevant for securing
car applications. In each article a comprehensive introduction to important
aspects of embedded security is given. The goal here was to inform in an un-
derstandablemannerabouttopicssuchascurrentsymmetricandasymmetric
cryptography,physicalsecurity,side-channelattacksandwirelesssecurity.The
articles attempt to provide the most important facts which can assist people
withanautomotivebackgroundwithoutoverloadingthereaderwithtoomuch
theoretical detail.
Part IV, Business Aspects of IT Systems in Cars, shows the interdiscipli-
nary dimension of IT security in the car context. The authors show in three
separate articles that security is a central tool for novel IT-based business
models.Thispartofthebookisperhapstheonethatdemonstratesbestthe
enormous impact that IT security has in cars, which goes well beyond a mere
technical one.
We hope that the book is of interest to people in industry and academia,
and also hope that it helps somewhat to enhance the field of embedded IT
security in cars.
Bochum, Kerstin Lemke
October 2005 Christof Paar
Marko Wolf
Contents
Part I Introduction
Embedded IT Security in Automotive Application – An
Emerging Area
Christof Paar.................................................... 3
Part II Security in the Automotive Domain
Aspects of Secure Vehicle Software Flashing
Winfried Stephan, Solveig Richter, Markus Müller.................... 17
Secure Software Delivery and Installation in Embedded
Systems
André Adelsbach, Ulrich Huber, Ahmad-Reza Sadeghi ................. 27
Anti-theft Protection: Electronic Immobilizers
Kerstin Lemke, Ahmad-Reza Sadeghi, Christian Stüble................ 51
A Review of the Digital Tachograph System
Igor Furgel, Kerstin Lemke........................................ 69
Secure In-Vehicle Communication
Marko Wolf, André Weimerskirch, Christof Paar..................... 95
A Survey of Research in Inter-Vehicle Communications
Jun Luo, Jean-Pierre Hubaux......................................111
Part III Embedded Security Technologies
Fundamentals of Symmetric Cryptography
Sandeep Kumar, Thomas Wollinger ................................125
VIII Contents
Fundamentals of Asymmetric Cryptography
Thomas Wollinger, Sandeep Kumar ................................145
Security Aspects of Mobile Communication Systems
Jan Pelzl, Thomas Wollinger ......................................167
Embedded Cryptography: Side Channel Attacks
Kai Schramm, Kerstin Lemke, Christof Paar ........................187
Embedded Security: Physical Protection against Tampering
Attacks
Kerstin Lemke...................................................207
Part IV Business Aspects of IT Systems in Cars
Automotive Digital Rights Management Systems
Marko Wolf, André Weimerskirch, Christof Paar.....................221
Security Risks and Business Opportunities in In-Car
Entertainment
Marcus Heitmann................................................233
In-Vehicle M-Commerce: Business Models for Navigation
Systems and Location-based Services
Klaus Rüdiger, Martin Gersch.....................................247
List of Contributors
André Adelsbach EPFL
Horst Görtz Institute for IT Security CH-1015 Lausanne, Switzerland
Ruhr University of Bochum [email protected]
44780 Bochum, Germany
[email protected]
Ulrich Huber
Horst Görtz Institute for IT Security
Dr. Igor Furgel
Ruhr University of Bochum
T-Systems GEI GmbH
Solution & Service Center 44780 Bochum, Germany
Test Factory & Security [email protected]
Rabin Str. 8
53111 Bonn, Germany
Sandeep Kumar
[email protected]
Horst Görtz Institute for IT Security
Ruhr University of Bochum
Dr. Martin Gersch
44780 Bochum, Germany
Competence Center E-Commerce
[email protected]
(CCEC)
Ruhr University of Bochum
44780 Bochum, Germany Kerstin Lemke
[email protected] Horst Görtz Institute for IT Security
Ruhr University of Bochum,
Marcus Heitmann 44780 Bochum, Germany
Institute for E-Business Security
[email protected]
(ISEB)
Ruhr University of Bochum
44780 Bochum, Germany Jun Luo
[email protected] School of Computer and Communi-
cation Sciences
Prof. Jean-Pierre Hubaux EPFL
School of Computer and Communi- CH-1015 Lausanne, Switzerland
cation Sciences [email protected]
X List of Contributors
Markus Müller Kai Schramm
T-Systems GEI GmbH Horst Görtz Institute for IT Security
Solution & Service Center Ruhr University of Bochum
Test Factory & Security 44780 Bochum, Germany
Rabin Str. 8 [email protected]
53111 Bonn, Germany
[email protected]
Winfried Stephan
T-Systems GEI GmbH
Prof. Christof Paar
Solution & Service Center
Horst Görtz Institute for IT Security
Test Factory & Security
Ruhr University of Bochum
Rabin Str. 8
44780 Bochum, Germany
53111 Bonn, Germany
[email protected]
[email protected]
Jan Pelzl
Horst Görtz Institute for IT Security Christian Stüble
Ruhr University of Bochum Horst Görtz Institute for IT Security
44780 Bochum, Germany Ruhr University of Bochum
[email protected] 44780 Bochum, Germany
[email protected]
Solveig Richter
T-Systems GEI GmbH
Solution & Service Center Dr. André Weimerskirch
Test Factory & Security escrypt GmbH – Embedded Security
Rabin Str. 8 Lise-Meitner-Allee 4
53111 Bonn, Germany 44801 Bochum, Germany
[email protected] [email protected]
Klaus Rüdiger
Marko Wolf
Institute for E-Business Security
Horst Görtz Institute for IT Security
(ISEB)
Ruhr University of Bochum
Ruhr University of Bochum
44780 Bochum, Germany
44780 Bochum, Germany
[email protected]
[email protected]
Prof. Ahmad-Reza Sadeghi Dr. Thomas Wollinger
Horst Görtz Institute for IT Security escrypt GmbH – Embedded Security
Ruhr University of Bochum Lise-Meitner-Allee 4
44780 Bochum, Germany 44801 Bochum, Germany
[email protected] [email protected]
