Skip to content

Automotive Security Cheat Sheet / 汽车安全速查表

Introduction / 介绍

This cheat sheet helps developers secure vehicle electronic control units (ECUs), connected services, and companion apps. Start with a threat model: map external connections, diagnostic access, sensitive data, and paths to safety-critical functions. Agree on safe behavior during security failures with the vehicle's safety engineers; automatically shutting down a moving vehicle can introduce danger. National Highway Traffic Safety Administration (NHTSA) guidance provides the broader development framework.

本速查表帮助开发者确保车辆电子控制单元（ECU）、连接服务和配套应用程序的安全。从威胁模型开始：映射外部连接、诊断访问、敏感数据和通往安全关键功能的路径。与车辆安全工程师就安全故障期间的安全行为达成一致；自动关闭正在行驶的车辆可能引入危险。国家公路交通安全管理局（NHTSA）指南提供了更广泛的发展框架。

Protect Communications and Inputs / 保护通信和输入

  • Separate trust zones. Isolate infotainment, wireless connectivity, and diagnostic interfaces from safety-critical controls. Allow only required message flows through gateways. Segmentation limits a compromise's reach; it does not authenticate messages within a segment.
    中文：分离信任区域。将信息娱乐、无线连接和诊断接口与安全关键控制隔离。仅允许通过网关传输必要的信息流。分段限制妥协的范围；它不验证分段内的消息。
  • Authenticate vehicle messages. Conventional Controller Area Network (CAN) does not authenticate senders. Use platform-supported protection such as AUTOSAR Secure Onboard Communication (SecOC), with freshness checks to reject replay. SecOC authenticates configured message data; it does not encrypt traffic or prevent bus flooding. A compromised sender can still produce authenticated messages.
    中文：验证车辆消息。 传统控制器区域网络 (CAN) 不验证发送者。使用平台支持的防护措施，如 AUTOSAR 安全车载通信 (SecOC)，进行新鲜度检查以拒绝重放。SecOC 验证配置的消息数据；它不加密流量或防止总线拥塞。即使发送者被破坏，仍然可以产生已验证的消息。
  • Protect external connections. Use Transport Layer Security (TLS) with certificate validation for vehicle-to-backend and app connections. Authenticate vehicles individually; an encrypted connection alone does not authorize commands.
    中文：保护外部连接。使用传输层安全性（TLS）和证书验证来保护车辆到后端和应用程序的连接。对车辆进行单独的身份验证；仅加密连接本身并不授权命令。
  • Validate before acting. Check message lengths, types, ranges, and whether an action is permitted in the current vehicle state, even for authenticated inputs. See Input Validation. Authentication does not establish that a sensor reading is physically correct.
    中文：在行动前验证。检查消息长度、类型、范围以及当前车辆状态下是否允许执行操作，即使对于已验证的输入。参见输入验证。身份验证并不能证明传感器读数在物理上是正确的。

Verify Software and Updates / 验证软件和更新

  • Verify before execution. Use secure boot with a protected trust root to authenticate the boot chain. Include recovery firmware. National Institute of Standards and Technology (NIST) guidance, sections 4.3–4.4 covers verification and recovery. Secure boot does not prevent runtime exploitation of trusted but vulnerable software.
    中文：执行前验证。 使用带有受保护信任根的安全引导来验证引导链。包括恢复固件。国家标准与技术研究院 (NIST) 指导，第 4.3-4.4 节涵盖了验证和恢复。安全引导不能防止对受信任但易受攻击的软件的运行时利用。
  • Authenticate updates on the ECU. For over-the-air (OTA) and workshop updates, verify signed metadata, image hashes, target hardware, freshness, and rollback policy. Follow Uptane's update verification requirements; transport encryption alone cannot establish update authenticity.
    中文：在 ECU 上验证更新。 对于空中 (OTA) 和车间更新，验证签名元数据、图像哈希、目标硬件、新鲜度和回滚策略。遵循 Uptane 的更新验证要求；仅传输加密不能建立更新的真实性。
  • Plan safe recovery. Activate updates only under agreed safe vehicle conditions. Recover from interrupted installation using authenticated software, without bypassing rollback protections. Signatures do not establish that software is free of vulnerabilities; protect the software supply chain too.
    中文：计划安全恢复。仅在同意的安全车辆条件下激活更新。使用已验证的软件从中断的安装中恢复，而无需绕过回滚保护。签名并不能证明软件没有漏洞；也要保护软件供应链。

Restrict Access and Protect Data / 限制访问并保护数据

  • Authorize each operation. Enforce authorization for the specific vehicle and action in backend services and vehicle command handlers. Separate owner, fleet, and service privileges. Revoke previous users' access when ownership or rental access ends.
    中文：授权每个操作。在后台服务和车辆命令处理器中强制执行授权，针对特定车辆和动作。区分所有者、车队和服务权限。当所有权或租赁访问结束时，撤销前用户的访问权限。
  • Protect service interfaces. Disable unnecessary production debug access; authenticate and restrict necessary diagnostic functions while preserving authorized repair. Physical access is not authorization. See NHTSA sections 7–8.4.
    中文：保护服务接口。 禁用不必要的生产调试访问；在保留授权维修的同时，对必要的诊断功能进行身份验证和限制。物理访问不代表授权。参见 NHTSA 第 7-8.4 节。
  • Protect keys and stored data. Avoid shared fleet-wide access secrets. Use hardware-backed key protection where available, with renewal and revocation procedures. Minimize retained location and personal data; encrypt sensitive storage with keys protected separately from the data. Encryption limits offline extraction, but software authorized to decrypt data can still expose it.
    中文：保护密钥和存储数据。避免共享车队级别的访问密钥。在可用的情况下，使用硬件支持的密钥保护，并实施更新和撤销程序。最小化保留的位置和个人数据；使用与数据分开保护的密钥加密敏感存储。加密限制了离线提取，但授权解密数据的软件仍然可以暴露数据。

Test and Maintain Security / 测试和维护安全

Follow NHTSA's lifecycle practices, section 4.2:

遵循NHTSA的生命周期实践，第4.2节：

  • Track component versions against deployed vehicles so vulnerabilities lead to targeted fixes. Agree with suppliers on patch ownership and support duration.
    中文：跟踪组件版本与部署车辆的对应关系，以便漏洞导致针对性的修复。与供应商就补丁所有权和支持持续时间达成一致。
  • Test rejected commands, malformed inputs, replay handling, and interrupted updates on isolated benches or simulators. Verify both security enforcement and safe failure behavior before vehicle deployment.
    中文：在隔离的台架或模拟器上测试被拒绝的命令、格式错误的输入、重放处理和中断更新。在车辆部署前验证安全执行和安全的故障行为。
  • Log authentication failures, privileged operations, and update results without secrets. Assign responsibility for reviewing events and responding to reports.
    中文：记录认证失败、特权操作和更新结果，不包含机密信息。分配责任以审查事件和响应报告。
  • For components that cannot be patched, restrict reachable interfaces and plan replacement. Gateway filtering reduces exposure but does not repair vulnerable firmware.
    中文：对于无法打补丁的组件，限制可访问接口并计划更换。网关过滤可以减少暴露，但不能修复易受攻击的固件。

References / 参考