DuoKey for Automotive
Automotive solution sheet. 4 pages, 2024.
The main attack paths on connected vehicles (V2V, V2I, ECUs, the CAN bus, OBD) and the key-management controls that address them. Those controls are PKI, code signing, UDS security access, over-the-air updates, secure boot, and remote attestation. It includes a published CAN-injection theft through a headlamp. Get it to map each attack path to a control ahead of your next R155 or R156 assessment.
Get the download
Tell us where to send the link. A business email is required.
Thieves have unlocked a Toyota RAV4 by reaching the CAN bus through its headlamp wiring and sending forged messages. No key, no broken glass.
Connected vehicles talk to other vehicles, roadside infrastructure, and the manufacturer's backend. Inside, ECUs exchange messages on the CAN bus, often with little authentication. Every one of those paths is a way in.
The sheet goes through each attack path and maps it to a cryptographic control, ready for your UNECE R155 and R156 work:
- PKI for device identities
- code signing for software
- UDS Security Access for diagnostics
- signed over-the-air updates
- secure boot
- remote attestation
Download it to see which controls close which gaps, in four pages.
FAQ
Who is this for?
Vehicle manufacturers, suppliers, and service providers responsible for vehicle cybersecurity or software updates.
Which standards does it reference?
UNECE R155 and R156, IEEE 1609.2, and C-ITS.
What is the headlamp example?
A theft where attackers reached the CAN bus through a Toyota RAV4's headlamp wiring and sent forged messages to unlock the car. The sheet uses it to show why ECU authentication matters.