Sicurezza Hardware per Bus CAN e Accelerazione AUTOSAR SecOC

Impiego di coprocessori hardware per l'autenticazione in tempo reale dei bus veicolari, gestione anti-replay e cifratura a bassissima latenza del carico utile.

CanHSM In-Vehicle Network Security Architecture

Cryptographic Enclave: CAN Cryptographic Engine — AUTOSAR SecOC ASIC Core

Hardware Security Nodes & Co-Processors

AUTOSAR SecOC CMAC Pipeline
Freshness Value Manager (FVM)
CAN-FD / CAN-XL Transceiver Hub
Hardware Frame Filter & IDPS
Silicon Key Derivation Core

Architectural Layers & Silicon Defenses

Layer 1: Deterministic Physical CAN Interface (ISO 11898-1/2 CAN-FD / CiA 610-1 CAN-XL): Interfacing directly with high-speed differential transceivers, sniffing frames, and injecting cryptographic tags.
Layer 2: Real-Time MAC Generation & Verification (Hardware AES-128/192/256-CMAC Core): Computing 28-bit to 64-bit truncated MACs for authenticating payload data before transceiving.
Layer 3: Freshness Value Manager (FVM) Core (Synchronized Trip Counter & Reset Logic): Generating synchronized freshness values combining trip counters, reset counters, and message counts.
Layer 4: In-Vehicle Gateway & Domain Routing (Ethernet SOME/IP to CAN Translation): Translating authenticated CAN messages into automotive Ethernet packets without losing cryptographic context.

Cryptographic Telemetry & Compliance: < 8 µs (SecOC CMAC Processing Time) | 100% (Anti-Replay Freshness Enforce) | 20 Mbps (CAN-XL Wire-Speed Throughput) | Zero-CPU (Host Microcontroller Offload)

Eliminare le vulnerabilità di broadcast nelle reti veicolari interne

The Controller Area Network (CAN) bus is the central nervous system of modern vehicles, but its inherent broadcast design lacks source authentication or confidentiality. CanHSM introduces dedicated silicon coprocessors adjacent to the CAN transceiver, generating and verifying cryptographic Message Authentication Codes (MACs) at wire speed without impacting vehicle control deadlines.

Core Engineering Areas

AUTOSAR SecOC Hardware Pipelining — Hardware architectures for offloading Secure Onboard Communication (SecOC) message authentication from automotive CPUs.
Freshness Value Management (FVM) — Preventing replay attacks on vehicular networks through synchronized cryptographic freshness values.
CAN-XL Next-Generation Security — Securing next-generation CAN-XL networks operating at up to 20 Mbps with native hardware encryption.

Technical Publications

Related Cluster Architecture Specifications

HSMCrypt — FIPS 140-3 Level 4 Cryptographic Engines, PKCS#11 Architecture & Hardware Root of Trust
AgenticHSM — Autonomous AI Agent Root of Trust, Secure Execution Enclaves & Model Tool Signing
ApiHSM — Cryptographic API Gateways, REST/gRPC PKCS#11 Microservices & Cloud-Native Key Enclaves
AssetHSM — Institutional Digital Asset Hardware Custody, Multi-Party MPC-HSM Hybrid & Cold Storage