d1-08 acharya esync arch and programming …...2017 ©excelfore esync architecture and programming...
TRANSCRIPT
2017©Excelfore
eSync Architecture and Programming Model for OTA and Diagnostics
Reaching Non-Ethernet Devices Over an Ethernet Backbone
Presentedby: ShrikantAcharyaChiefTechnologyOfficer,ExcelforeCorp.
ContributingAuthors: AnoopBalakrishnan,ExcelforeCorp.RemaBalaraman,ExcelforeCorp.
2017©Excelfore
Agenda
1. Considerations– ObjectivesandConstraints
2. ArchitectureReview
3. Protocols,SystemRequirements,Security
4. UseCaseExamples
2017©Excelfore
eSyncSystemDesignObjectives• Reach
• FromCloudtoEndDevice– AcrossVariousAutomotiveSub-Networks
• Bi-Directional• PipelineforDataPushandDataPull
• PushOver-the-Air(OTA)UpdatestotheVehicle
• PullDiagnosticandTelematicsDatafromtheVehicle
• HighlySecure• Vehiclescannotbe“Spoofed”orCompromisedwithSpuriousUpdates
• CloudServercannotbe“Spoofed”withSpuriousVehicleData
• Scalable• ScalestoManyDevicesinOneVehicle
• ScalestoManyDifferentVehicleConfigurations
• ScalestoMillionsofVehicles
2017©Excelfore
ImportantDesignConstraints
• Downtime• FullVehicleUpdateCycleMustMinimizeVehicleDowntime
• Resilience• MustbeResilientAgainstErrors/InterruptionsinOver-the-AirTransmissions
• Efficient• MustBeFlexibleforDifferentProcessingandMemoryResourcesinLegacyECUs
• Safe• FunctionalSafetyConsiderations,asDefinedinISO26262(ASILlevels)
2017©Excelfore
ImportantConsiderationsonSafetyandRobustness
• ISO26262Requirements:1. Non-Critical:TheOTAUpdateSystemDoesNotReachCriticalElementsatAll
- or-2. AllCritical:TheOTAUpdateSystem,andtheEntireIn-VehicleNetwork,
OperateEntirelyasaCriticalSystem- or-
3. IsolateCritical:TheIn-VehicleNetworkandtheOTAUpdateSystemIsolateCriticalandNon-CriticalElementsoftheSeparateASILdomains• RequiresParallel,SeparateOTAPaths
• Robustness• DesignforModularComponentIntegration• KeepUpwithCurrentTechniquesbyUsingLatestStandardsonSecurityandNetworkProtocols
2017©Excelfore
Agenda
1. Considerations– ObjectivesandConstraints
2. ArchitectureReview
3. Protocols,SystemRequirements,Security
4. UseCaseExamples
2017©ExcelforeADASInfotainment Body/ChassisPowertrain
VehicleGateway
PowertrainController/Gateway
ADASController/Gateway
BodyController/Gateway
eSync
CAN
LIN
CAN
Ethe
rnet
TSN
Ethe
rnet
TSN
CAN
Ethe
rnet
ASILD ASILBASILD ASILB
Ethe
rnet
AVB
LVD
S
………….………….
EthernetorOBDDiagnosticPort
High-Speed Ethernet
High-Speed Ethernet
High-Speed Ethernet
RepresentativeApproachtoNext-GenVehicleNetwork CloudServer
IVIHeadUnit/Gateway
2017©Excelfore
TheeSyncSystemArchitecture
Encryption&Authentication
SecurityCheckPoint
Encryption&Authentication
2017©Excelfore
UpdateAgent
2017©ExcelforeADASInfotainment Body/ChassisPowertrain
VehicleGateway
PowertrainController/Gateway
ADASController/Gateway
BodyController/Gateway
eSync
CAN
LIN
CAN
Ethe
rnet
TSN
Ethe
rnet
TSN
CAN
Ethe
rnet
ASILD ASILBASILD ASILB
Ethe
rnet
AVB
LVD
S
………….………….
EthernetorOBDDiagnosticPort
High-Speed Ethernet
High-Speed Ethernet
High-Speed Ethernet
RepresentativeApproachtoNext-GenVehicleNetwork(SingleClient,MultipleAgents)
CloudServer
IVIHeadUnit/Gateway
eSyncClient
Agent
AgentsAgents
Agents Agents
Agent Agent Agent
2017©Excelfore
OperationalModesofOTACloudtoDMClient
DMClienttoMessageServer
MessageServertoUpdateAgentStatusAgenttoUpdateAgent
UpdateAgentRe-flashofECU
RunDiagnosticScripts
ECUUpdateAgenttoMessageServer
StatusAgenttoDMClient
DMClienttoCloud
DataPush
DataPull
2017©Excelfore
Agenda
1. Considerations– ObjectivesandConstraints
2. ArchitectureReview
3. Protocols,SystemRequirements,Security
4. UseCaseExamples
2017©Excelfore
UDSServerCommandSequences
UDSSessionsLayer1. SettheUDSserverintoprogram
mode2. Resettonewmode3. RequestSeed*4. SendKey*5. TransferData†(multipledata
transfers)6. EraseMemory†7. VerifyMemory8. SettoNormalMode9. ResettoNormalMode10. EndofProcedure
UDSApplicationLayer1. TransferData2. ReadDataID(evenreadingDTC
codes)3. WriteDataID4. UploadData5. Erase6. Verify
*MaynotbeavailableonallECUs†SequencemaydifferbetweenUDSservers
2017©Excelfore
EthernetBasedECUs
• NewerECUsMayhaveEthernetInterface
• SecurityProtocolscanbeEmbeddedintoECUs
• EndtoEndAuthenticationcanGototheECUsDirectly• PayloadcanRemainEncrypted
• SimplifiestheSecurityArchitectureandLayoutofDevices• ClearSegmentationofFunctionalDomains(usingPortsandVLAN)
• NoChangetoUDSClient/UDSServerHandshake• SameasCAN-basedECUTransactions
2017©Excelfore
SecurityConsiderations
• DMClientActsasGateKeeperforAuthentication• PreferredLocation:InTCU• CanbeinGatewaySwitch– allExternalConnectionareAuthenticated
• DMClientinaHeadUnit (InfotainmentGateway)PresentsaSecurityRisk
• ForECUslocatedonFlexRay,CAN,LIN– UpdateAgentsCanResideinGateways• EachECUAuthenticateswithitsUpdateAgent
• NewerECUsonIPNetworkscanHostUpdateAgentwithintheirCodeSpace• IsolateLegacyECUsfromDirectConnectiontoOBDPort• UseECUArbitrationtoAuthenticateLegacyECUConnections
• DMClientandeachECUhavetheirownUniqueDigitalCertificates• EstablishBi-DirectionalAuthentication• DifficultforAttackersto‘Spoof'orImpersonateAnyElement,DifficulttoGainAccesstotheSystem
• Removes“maninthemiddle”Attacks
• ImpactonCostandPerformance
2017©Excelfore
SystemResourceRequirementsforeSyncClient
• OperatingSystemwithSecureNon-VolatileFileSystem
• EnoughFileSystemMemoryfortheLargestExpectedCombinationofSoftwareUpdateImages,PlusApproximately10%
• EnoughNon-VolatileFileSystemMemorytoBufferDiagnosticandTelematicsData
• ToPreventLossofDatawhenConnectionisInterrupted
• Lessthan500KBforeSyncClientCode
• Typical:about500KBforRAM
• AdditionalRAMMaybeNeededforManyUpdate/DiagnosticAgentsintheSystem
2017©Excelfore
Agenda
1. Considerations– ObjectivesandConstraints
2. ArchitectureReview
3. Protocols,SystemRequirements,Security
4. UseCaseExamples
2017©Excelfore
DemonstratedUseCaseEnvironments
eSyncClient:
• OperatingSystems:Linux,QNX,IntegrityandAndroid
• OtherOSandFileSystemsarePossible
• Processors:IntelApolloLake;NXPi.MX6;QualcommSnapdragon820;RenesasR-Car3
eSyncAgent:AllOSsandProcessorsUsedfortheeSyncClient,Plus:
• OperatingSystems:AUTOSAR,Erika,FreeRTOS
• ProcessorsandControllers:NXPMPC5777/5648;CortexR4/CortexM
• Bus/Networks:Ethernet(Broad-RReach,AVB/TSN),CAN,LIN,FlexRay,USB
2017©Excelfore
UseCase1:BasicVehicleSystem
eSyncClient
Agent
Agent
Agent
Agent
Agent
2017©Excelfore
UseCase2:VehicleInterconnectUsingEthernetforNewVehiclePlatforms
eSyncClient
Agent
Agent
AgentAgent
Agent
Agent Agent
2017©Excelfore
UseCase3:Multi-DomaineSyncOTASystemWithSecureGatewayforCriticalDomain
eSyncClient1
Agent
Agent
Agent
eSyncClient2
SecureDomain
2017©Excelfore
SummaryofeSyncSystem
• Bi-DirectionalandTransactionBasedInformationTransfer• ModularDesignwithUpdateAgentsforAllElectronicDevices(ECUs,Sensors,etc.)• IntheDeviceforIPAddressableEthernetDevices• IntheIPAddressablePortoftheGatewaySwitchforCAN,LINDevices• EnsuresSystemReachesAllElectronicDevices
• LayeredAuthenticationandEncryptionBetweenAllModules• RobustSecurityagainstHackers
• AnyNumberofUpdateAgents,UpdateAnyNumberofECUsinParallel• MinimizesVehicleDowntimeduringUpdates
• ModularDesignforOptimalUseofLimitedCPUandMemoryResources