AI 中文总结
该研究设计了DACER框架，首个协同设计汽车ECU的证明与修复，可检查车辆整体状态、抵御单点故障且开销低，能在运行时恢复固件。
AI 中文摘要
汽车技术的发展不断整合各类组件，使车辆转变为互联的系统之系统。现代车辆由称为电子控制单元（ECU）的分布式计算设备系统控制，然而这种互联性意味着任何故障都会对车辆操作人员构成重大风险，尤其是恶意软件可能被注入ECU，威胁车辆安全。为解决该问题，我们需要能够检测受感染ECU并将其修复至良性状态的机制。现有方法主要聚焦于检测，未解决将检测与运行时ECU修复相整合的挑战，这种整合并非易事，因为运行时修复涉及本地回滚和重启，且重启时机需由全局车辆上下文确定以避免不安全行为。本研究中，我们设计了DACER——一种用于汽车ECU的运行时去中心化证明与协同修复框架，它是首个将证明与修复协同设计，以统一固件回滚的“本地”特性与ECU重启的“全局”特性的方案。在DACER中，每个ECU执行高效的本地自证明与自修复功能，支持分布式操作的低开销协调，此外，DACER利用了分层的车辆计算架构。我们设计的DAC方案可检查车辆的整体状态、抵御单点故障、符合实时约束并支持运行时固件恢复，其关键功能由每个ECU配备的ARM TrustZone以及存储设备中嵌入的安全闪存控制器实现。我们在实际硬件上实现了DACER，并通过实验证明其具有低开销。
英文摘要
The evolution of automotive technology increasingly integrates components, transforming vehicles into interconnected systems of systems. Modern vehicles are controlled by a distributed system of computing devices, known as electronic control units (ECUs). However, this interconnectedness means that any error poses significant risks to the vehicle operator. In particular, malware can be injected into ECUs, threatening vehicle safety. To address this, we need mechanisms to detect compromised ECUs then repair them to a benign state. Existing approaches mainly focus on detection and do not address the challenge of integrating detection with runtime ECU repair. This integration is nontrivial because runtime repair involves both local rollback and reboot with timing determined from global vehicle context to avoid unsafe behavior. In this work, we have designed DACER, a runtime decentralized attestation and coordinated repair framework for automotive ECUs. DACER is the first approach that co-designs attestation and repair to unify the ``local'' nature of firmware rollback with the ``global'' nature of ECU reboot. In DACER, each ECU performs efficient local self-attestation and self-repair functions, enabling low-overhead coordination for distributed operations. In addition, DACER takes advantage of the hierarchical vehicle computing architecture. Our resulting DACER design checks the entire state of the vehicle, resists single points of failure, conforms to real-time constraints, and enables firmware restoration during runtime. The key functions are enabled by the ARM TrustZone equipped within each ECU and the secure flash memory controller embedded in the storage device. We implemented DACER on real-world hardware and experimentally demonstrated its low overhead.
