← 研踪 PaperTrailarXiv:2506.13261 · v2
Building Automotive Security on Internet Standards: In-Car Service Authentication with DNSSEC, DANE, and DANCE
首次提交 2025-06-16 17:02
版本更新 2026-10-26 01:54
雷达观测 2026-10-29 00:36
摘要
The automotive industry trends to softwarizing cars according to flexible, service-oriented architectures. At the same time, connected cars become networked computer systems but lack proper security measures. In this paper, we propose to authenticate and authorize in-vehicle services by integrating DNSSEC, DANE, and DANCE with automotive middleware. Our approach decouples the cryptographic authentication of the service from that of the service deployment with the help of DNSSEC and thereby largely simplifies key management. We propose to authenticate in-vehicle services by certificates that are solely generated by the service suppliers but published on deployment via DNSSEC TLSA records solely signed by the OEM. We further show how these established Internet standards secure the service discovery and invocation, ensure interoperability with various protocols, and scale management of credentials for millions of connected vehicles at robust security levels. We back our design proposal by a security analysis using the STRIDE threat model and by evaluations in an emulation of a realistic in-vehicle setup that demonstrate its effectiveness.
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v2 · 2026-10-26 01:54 · 最新观测版本
Building Automotive Security on Internet Standards: In-Car Service Authentication with DNSSEC, DANE, and DANCE
The automotive industry trends to softwarizing cars according to flexible, service-oriented architectures. At the same time, connected cars become networked computer systems but lack proper security measures. In this paper, we propose to authenticate and authorize in-vehicle services by integrating DNSSEC, DANE, and DANCE with automotive middleware. Our approach decouples the cryptographic authentication of the service from that of the service deployment with the help of DNSSEC and thereby largely simplifies key management. We propose to authenticate in-vehicle services by certificates that are solely generated by the service suppliers but published on deployment via DNSSEC TLSA records solely signed by the OEM. We further show how these established Internet standards secure the service discovery and invocation, ensure interoperability with various protocols, and scale management of credentials for millions of connected vehicles at robust security levels. We back our design proposal by a security analysis using the STRIDE threat model and by evaluations in an emulation of a realistic in-vehicle setup that demonstrate its effectiveness.
查看此版本解读 →查看此版本原文 ↗