汽车硬件安全模块（HSM）——架构挑战与安全影响
Automotive HSMs - Architectural Challenges and Security Implications
浏览论文内容
中文总结 AI 辅助
本文分析汽车HSM的架构挑战与安全影响，调研量产ECU的HSM集成模型，探讨其在安全启动等中的作用及相关权衡，指出后量子就绪等新兴挑战，为汽车硬件安全提供方向。
中文摘要 AI 辅助
汽车电子控制单元（ECU）日益依赖硬件根安全，以在面临远程和物理威胁时保护软件完整性、真实性及生命周期管理。硬件安全模块（HSM）已成为汽车片上系统（SoC）的关键组成部分，在严格的实时性和成本约束下提供隔离的密码服务、安全密钥存储及受控执行。本文对汽车HSM进行架构分析，研究其在建立安全启动和硬件信任根中的作用。首先调研量产ECU中常用的HSM集成模型，讨论其灵活性及当前汽车应用场景；接着引入现实威胁模型以推动硬件支持的安全控制，分析HSM设计选择如何影响安全启动信任链、安全存储、安全执行及软件签名机制，探讨隔离性、性能、可更新性与攻击面之间的关键权衡，可选考虑侧信道影响；最后强调可扩展且弹性的汽车硬件安全的开放挑战与未来方向，还讨论了密码敏捷性和后量子就绪性等新兴挑战，这些将可能塑造下一代汽车HSM架构。
英文摘要
Automotive electronic control units (ECUs) increasingly depend on hardware-rooted security to protect software integrity, authenticity, and lifecycle management in the presence of remote and physical threats. Hardware Security Modules (HSMs) have become a key building block in automotive system-on-chips (SoCs), providing isolated cryptographic services, secure key storage, and controlled execution under stringent real-time and cost constraints. This paper presents an architectural analysis of automotive HSMs and examines their role in establishing secure boot and hardware roots of trust. We first survey common HSM integration models used in production ECUs and discuss their flexibility and current automotive use cases. We then introduce realistic threat models to motivate hardware-backed security controls and analyze how HSM design choices influence secure boot chains of trust, secure storage, secure execution, and software signing mechanisms. Key tradeoffs between isolation, performance, updateability, and attack surface are discussed, with optional consideration of side-channel implications. The paper concludes by highlighting open challenges and future directions for scalable and resilient automotive hardware security. Finally, we discuss emerging challenges such as cryptographic agility and post-quantum readiness that are likely to shape the next generation of automotive HSM architectures.
