How to Build a Secure Automotive System Using Secure Flash Storage

Highly secure data storage is essential in modern automotive embedded systems, especially in the face of increasingly sophisticated cyberattacks. This article will describe the steps for designers to use flash memory correctly.

How to Build a Secure Automotive System Using Secure Flash Storage

Highly secure data storage is essential in modern automotive embedded systems, especially in the face of increasingly sophisticated cyberattacks. This article will describe the steps for designers to use flash memory correctly.

The need for safety and security in Electronic embedded systems has never been stronger than it is today. As cars become more automated, we need to increase their level of security to prevent them from being hacked. The same is true for factories with large numbers of robots and Internet of Things (IoT) devices that handle sensitive data.

Non-volatile flash memory is essential for all such embedded systems. Flash memory can be used as code storage, file system storage, or microcontroller unit (MCU) memory that runs code directly. If you want to achieve system security, you must first ensure that the flash memory used by the system is safe. This article explores the security requirements of flash memory to help developers build secure and secure embedded systems for automotive, industrial, and communications applications.

How flash memory is used

If we look closely at the electronic systems of modern cars, we will see that flash memory is widely used throughout the vehicle. As the complexity of the system increases, we need larger capacity code storage and data storage. All subsystems in the car, including advanced driver assistance systems (ADAS), instrumentation systems (soon to be merged with infotainment), transmission and body systems, require embedded systems to operate in real time.

All of these embedded systems require some type of flash memory for code storage and data storage. For example, Figure 1 shows an ADAS subsystem using multiple NOR flash devices.

figure 1.The ADAS subsystem uses multiple NOR flash

In today’s ADAS applications, complex algorithms and AI processes rely on code and data stored in flash memory to run. Storage must be failsafe and secure, as system failure or malicious attack can result in serious personal injury or even death.

Similar safety and security needs for storage solutions exist in industrial and networking applications. Against the backdrop of ever-increasing interconnectivity, hackers can breach any weak entity connected to the Internet, steal sensitive information, or use the compromised device as a springboard to launch attacks elsewhere across the network. Therefore, it becomes critical to build systems that are secure against this type of attack.

Secure Flash Storage

For years, flash memory vendors have offered pure data storage. For these applications, endurance and retention are two measures of flash memory quality. Security is not a requirement for this type of flash device, which means that data stored on flash is either completely unprotected or protected using unauthenticated commands.

For example, some flash memory devices provide basic protection functions through a normal command set, such as non-volatile or volatile protection of sectors for program or erase operations, password protection for program or read operations, and so on. These features are good features, but they are not enough to defend against sophisticated attacks. If hackers gain access to the flash device’s bus interface, they can easily extract or modify data on the device.

In order to be secure, flash memory devices must protect stored code and data from multiple means of attack. The following summarizes several attacks that flash storage devices need to guard against.

Man-in-the-middle (MIM) attack

Hackers in MIM attacks often imitate the sender of a communication channel, sending commands or messages to the other side to steal or modify data (Figure 2). Therefore, it is necessary to authenticate every message between the host and the flash device. Authentication can be accomplished by using a public key on the host and flash memory to generate a Message Authentication Code (MAC) that accompanies the actual message. The receiver can verify the MAC before taking action on the message.

figure 2.Man-in-the-middle attacks often imitate the channel sender of the communication to send commands or messages with the ultimate goal of stealing or modifying data

To prevent the system from being permanently compromised if the key is compromised, the use of ephemeral keys is usually required. Temporary keys expire after a certain amount of time or after a certain number of times. The purpose of this is to prevent the key from being decrypted by methods such as Destructive Physical Analysis (DPA) or other iterative attacks as much as possible.

Another man-in-the-middle attack is to replay the intercepted legitimate message after a certain time. To protect against replay attacks, the host and flash device must generate the MAC using an accumulation counter (value incremented with each message). Because the current accumulated counter value is different from the value of the previous message. Replaying the same message will fail the MAC verification,


Some hackers can use advanced technology to read the entire contents of flash memory chips, making profit by illegal cloning. To protect against such attacks, each flash chip must have a Unique Device Secret (UDS) that cannot be read by anyone. UDS values ​​are unique and are truly random values ​​within each chip. There is no correlation between the UDS in one chip and the other.

UDS can be used to derive the Composite Device Identifier (CDI), which is the basis for generating Device ID certificates as defined by the Trusted Computing Working Group (TCG) Device Identifier Composition Engine (DICE) specification. Generally speaking, the device also generates an alias private key public key pair for all keys exported by the host on the basis of CDI. This eliminates the need to expose the private key for the device ID.

With UDS and the DICE process in place, hackers cannot clone the device since UDS is physically unclonable.


Passive listening is another known attack method. By eavesdropping on the bus, an attacker can gather sensitive or confidential information from the data transmitted over the bus. To protect important data, users can choose to encrypt the data before sending it over the bus to the flash device and storing it. When the host retrieves data from the device, the data should also be encrypted so that potential hackers never have access.

One might argue that the encryption method does not require a secure flash storage solution because the host can encrypt the data directly and store it in flash. Only the host can decrypt the data.

However, there are certain downsides to doing so. One of them is that the host cannot easily deprecate encryption keys. For example, suppose KeyA is used to encrypt data and store it in flash memory, and later the user finds out that KeyA has been compromised and needs to use a different key on the system, namely KeyB.

At this point, the host is in a dilemma: it cannot simply discard KeyA, because it needs to keep that key in order to decrypt data read from the device. However, if KeyA is compromised, the user may not want to keep it permanently. If the new data encryption key is to be used, the user has to take more complicated measures. The original encrypted data on the flash memory is erased, and then the flash memory is programmed with the newly encrypted data. This operation is not easy in the field, and there are certain risks.

On the other hand, if secured flash memory can provide encryption and decryption, it can safely store plaintext data in its secured storage and encrypt the data before sending it back to the host. If the current encryption key is compromised, the host can simply exchange a new key with the device. Data in storage remains intact and secure, which is a much simpler method than storing encrypted data.


The individual steps for developing secure flash storage are described below:

Provides flexible memory architecture

In modern multicore embedded systems, multiple MCUs or hardware security modules (HSMs) may have access to the same flash storage. It is necessary for flash devices to provide a flexible memory architecture that can be partitioned and configured so that different regions can be managed by different cores. These different areas can provide different levels of security, or when not needed at all, security can be removed.

By looking at the eMMC standard and the UFS standard, we can clearly see a trend towards supporting multiple security zones. The current eMMC standard specifies Replay Protected Memory Blocks (RPMBs). The latest UFS (v3.0) standard provides intelligent support for four RPMB partitions managed by four different keys. Such memory architecture flexibility is more appropriate in a multicore SoC environment.

Provides fast secure boot function

Many embedded systems store boot code in flash memory. Partly because of the need for fast startup, for example automotive subsystems need to process CAN messages within 100ms of power-on-reset (POR). Not only does the system need to boot securely (that is, verify the boot code), it also needs to boot quickly. This presents a higher challenge to embedded designers.

Typically, when running in Store and Download (SnD) mode, the host reads the bootloader from flash memory and maps it to RAM for execution. However, to boot securely, the entire bootloader code needs to be checked and certified to ensure its trustworthiness. This process takes time on the MCU. Secured flash storage provides bootload authentication, drastically reducing boot time.

A secure flash device can check the bootloader using an internal secure hash function and provide the host with a hash value for authentication. If the hash value has not changed, the bootloader has not been tampered with and can be safely used for booting.

Provides secure firmware over-the-air updates (FOTA)

Field upgrades are a must for modern embedded applications. By remotely upgrading a system’s firmware or software, manufacturers can quickly resolve issues, provide new features, and enhance the user experience. However, remote upgrades can also pose a security threat to the system. No one wants a hacker to take advantage of an existing update pipeline and let a system run malicious firmware or software.

In addition to relying on the security provided by the CPU, the security engine inside the flash device can greatly improve the security level of the FOTA process (Figure 3). With such a security engine, a flash device that provides boot code storage can authenticate not only the firmware provider with the host next to the flash device, but also on a remote cloud. In this way, end-to-end channel security can be established for firmware updates or software updates in flash memory.

image 3.Security Engine in Flash Devices Helps Enable More Secure Over-the-Air Firmware Update Process

Embedded systems used in modern automobiles, industries, and communications require highly secure data storage. The challenge for embedded system designers is how to build secure systems that can withstand cyber-attacks. Flash memory with integrated security features, such as Cypress’s Semper Flash, improves overall system security by preventing various attacks against embedded systems.

The Links:   NL6448BC26-08D NL10276BC20-18A