Enabling Secure ECU Reprogramming with Flash Data Security (FDS) and Integrity Validation Data

About the Customer

Our customer is a Tier-1 automotive supplier specializing in lighting systems for premium OEM platforms. They have strong expertise in projection optics, FPGA, and hardware design.

---

Business Challenge

While working on an FPGA based automotive lighting solution, the customer realized the need for enhanced cybersecurity for ECU flashing through the bootloader.

The original bootloader architecture relied on CRC-based verification, which could detect data corruption during flashing but could not verify firmware authenticity or prevent unauthorized software execution.

Flash Data Security (FDS) and Integrity Validation Data (IVD) were best suited to manage the authenticity and integrity problem.

The implementation needed to address multiple security objectives without disrupting the existing programming workflow, including:

The project also involved evolving customer expectations around cryptographic algorithms, key storage mechanisms, certificate handling, and compression requirements, necessitating a flexible and scalable security architecture.

---

Embitel's Solution

Development of Secure Bootloader Architecture with flash data security

We enhanced the existing bootloader with Flash Data Security (FDS), integrating digital signature verification into the standard UDS programming sequence while preserving the established pre-programming, programming, and post-programming workflow.

The secure flashing sequence consisted of:

1. Security Access authentication.
2. Firmware download using standard UDS services.
3. Application programming into flash memory.
4. Transfer of digital signature information.
5. ECU-side signature verification.
6. Controlled application execution only after successful authentication.

This approach ensured that only firmware signed by an authorized source could be executed, protecting the ECU against unauthorized software installation and malicious firmware modification.

Cryptographic Security Implementation

The security architecture combined integrity verification with asymmetric authentication.

1. Digital Signature Verification

The implementation utilized ECDSA with the NIST P-256 elliptic curve for firmware authentication.

• Private keys remained with the authorized flashing environment.
• Public keys were securely stored within the ECU.
• Firmware execution was permitted only after successful signature verification.
2. Integrity Validation

SHA-256 hashing was used to verify firmware integrity throughout the programming process and during post-deployment validation.

The architecture ensured that firmware could not be altered without detection while providing strong cryptographic assurance of software authenticity.

Integrity Validation Data (IVD)

In addition to secure programming, Embitel implemented Integrity Validation Data (IVD) to continuously verify software integrity after deployment.

Unlike Flash Data Security, which validates software during programming, IVD enables integrity checks throughout the ECU lifecycle.

After successful programming, Integrity Validation Data (IVD) records the validated software state. During every ECU power-on, the bootloader performs an integrity validation before transferring execution to the application. As part of this startup sequence, the bootloader also verifies that the programmed software is compatible with the target hardware configuration and that the software image is suitable for execution. Only after these validation and compatibility checks are successfully completed does the bootloader hand over control to the application.

The solution supports:

• Diagnostic-triggered integrity verification.
• ECU self-validation routines.
• SHA-256-based integrity comparison against stored validation data.

This layered approach improves long-term software reliability by detecting unexpected modifications in ECU flash memory after deployment.

Reusable Cryptographic and Data-Processing Framework

We used a reusable software framework capable of supporting multiple hashing, authentication, key-agreement, encryption, and decompression algorithms. This allowed the security architecture to be adapted to different OEM specifications and MCU platforms without redesigning the complete bootloader.

The framework included support for:

For this ECU implementation, the selected FDS path primarily used SHA-256 with an ECC-256 signature-verification mechanism. The remaining algorithms formed part of the reusable security and data-processing capability available for other customer or platform requirements.

Optimized Flash Programming Performance

To minimize programming time, Embitel optimized the hashing strategy by calculating SHA-256 hash values incrementally as firmware blocks were received.

Instead of performing complete hash computation after programming completion, the ECU processed data block-by-block during transfer.

This optimization:

Secure Key Management

The cryptographic trust model relied on secure public-key storage within protected MCU memory.

The implementation leveraged MCU security features including:

Storing public keys in protected memory prevented unauthorized modification of trust anchors and strengthened overall bootloader security.

Separate development and production key environments were maintained, allowing engineering teams to perform validation using development keys while preserving OEM ownership of production keys.

To further strengthen ECU security after production deployment, the solution supports the MCU’s JTAG Permanent Lock feature, which permanently disables debugger access once the ECU is provisioned. This prevents unauthorized firmware extraction, memory access, or modification through the debug interface, complementing the secure bootloader and protected key-storage architecture.

ODX-Based Programming Integration

The secure flashing solution remained fully compatible with the customer’s existing diagnostic infrastructure.

Programming was performed using:

The architecture also supports secure distribution of ODX files through digital signature mechanisms, helping maintain integrity throughout the programming ecosystem.

Hardware Security Module (HSM) Readiness

The solution was designed to leverage the MCU’s Hardware Security Module (HSM), which provides hardware-accelerated cryptographic operations such as SHA hashing, digital signature verification, and secure key management.

While the delivered project used Embitel’s reusable software-based security stack, the architecture remains HSM-compatible, enabling future migration to hardware-accelerated cryptographic services for significantly lower computation time, improved performance, and enhanced protection of security assets.

Validation Strategy

Extensive verification and validation activities were conducted to validate both functional behaviour and security robustness.

Testing scenarios included:

Testing was performed through both internal verification activities and customer validation using OEM-approved flashing tools.

Innovation Highlights

---

Embitel's Impact

The implemented solution enabled the customer to strengthen ECU software security while preserving compatibility with existing production programming processes.

Key outcomes included:

The project delivered a production-ready secure flashing solution that improved software trust, strengthened ECU cyber resilience, and provided a reusable foundation for future automotive programs.