CROSS-TEE: A Distributed Trusted Execution Environment Architecture for Cross-Module Automotive Security

LCMA: lightweight cross-domain mutual authentication scheme for Internet of Vehicles

The Internet of Vehicles (IoV) facilitates real-time information exchange through vehicle-to-everything (V2X) communications, thereby enhancing traffic safety and operational efficiency. However, high mobility, frequent handovers, and cross-domain access impose rigorous demands on authentication latency, scalability, and credential management. Many existing authentication and key agreement (AKA) schemes necessitate the online involvement of a trusted authority (TA), which can lead to communication bottlenecks and create a single point of failure. Additionally, many physical unclonable function (PUF)-based schemes continue to depend on centralized challenge–response pairs (CRPs) or require online CRP queries, which obstruct their implementation in dynamic cross-domain environments. To tackle these challenges, this paper introduces a lightweight cross-domain mutual authentication scheme (LCMA) for IoV. LCMA integrates a PUF-based hardware-rooted authentication mechanism with a rolling verifier-state update mechanism. This design reduces the need to maintain a large-scale pre-stored CRP database while avoiding repeated reuse of static authentication materials. Furthermore, it employs a decoupled trust architecture in which the TA is engaged solely in secure offline registration, system initialization, and conditional traceability, while online authentication and session-key establishment are conducted by vehicles and authorized roadside units (RSUs). ROR-based analysis demonstrates session-key indistinguishability under the specified adversarial assumptions, while AVISPA verification within the Dolev–Yao model confirms the goals of authentication and secrecy. Performance evaluations indicate that LCMA achieves low computational and communication overhead in comparison with representative schemes. Under a load of 10,000 vehicles, it maintains an average authentication latency of 2.154 ms, thereby illustrating its appropriateness for highly dynamic cross-domain IoV environments.

Robust Multicast Origin Authentication in MACsec for Secure IIoT Networked Embedded Systems

Automotive HSMs - Architectural Challenges and Security Implications

Automotive electronic control units (ECUs) increasingly depend on hardware-rooted security to protect software integrity, authenticity, and lifecycle management in the presence of remote and physical threats. Hardware Security Modules (HSMs) have become a key building block in automotive system-on-chips (SoCs), providing isolated cryptographic services, secure key storage, and controlled execution under stringent real-time and cost constraints. This paper presents an architectural analysis of automotive HSMs and examines their role in establishing secure boot and hardware roots of trust. We first survey common HSM integration models used in production ECUs and discuss their flexibility and current automotive use cases. We then introduce realistic threat models to motivate hardware-backed security controls and analyze how HSM design choices influence secure boot chains of trust, secure storage, secure execution, and software signing mechanisms. Key tradeoffs between isolation, performance, updateability, and attack surface are discussed, with optional consideration of side-channel implications. The paper concludes by highlighting open challenges and future directions for scalable and resilient automotive hardware security. Finally, we discuss emerging challenges such as cryptographic agility and post-quantum readiness that are likely to shape the next generation of automotive HSM architectures.

On the Resilience of Secure Remote-Access VPN Solutions: A System-Level Evaluation of WireGuard, OpenVPN and IPsec (strongSwan)

Remote-access virtual private networks (VPNs) are a key component of enterprise security infrastructures. In practice, the effectiveness of a remote-access VPN is determined not only by cryptographic mechanisms but also by its ability to remain available and recover quickly under realistic operating conditions, which directly affects the operational security guarantees provided by the underlying cryptographic protocols. Enterprise deployments are characterized by heterogeneous client platforms, wireless access networks, and frequent endpoint and network disruptions. In this paper, we execute an exploratory case study of the operation of remote-access VPNs in enterprise environments through an empirical evaluation of WireGuard, OpenVPN, and IPsec. Using a controlled but realistic testbed with a cloud-hosted gateway and heterogeneous client platforms, we evaluate baseline performance as well as behavior under endpoint CPU stress, network impairments, MTU variation, and mobility-related disruptions, reflecting constrained and dynamically changing deployment conditions. The results suggest that VPN operational characteristics are influenced by both protocol design and execution environment. Within the evaluated deployment scenarios, kernel-based implementations generally exhibited higher resilience under endpoint resource contention and faster recovery after disruptions, while layered and virtualized environments exhibited increased variability and sensitivity to network imperfections. These findings underline that resilience in remote-access VPNs should be interpreted as a system-level property emerging from the interaction of implementation architecture, endpoint characteristics, and deployment conditions.

BLE Theft Auto: Evaluating the Security of Aftermarket BLE-based Automotive Remote Control Systems

ADASEC-TB: Cryptography Verification & Benchmarking for Next-Generation Networking Hardware

: Next-generation networks aim to provide a wide range of services which require high level of performance and security. In some services, security is particularly important and lack of it can lead to critical consequences due to sensitivity of the information being transmitted. Therefore, research in the field of security has significantly increased and a number of security solutions for next-generation networks are already developed. For every security solution, there is a need for a trusted test environment which can be used for its functional verification and performance evaluation. Existing security testbeds do not provide reproducible testing and evaluation of hardware-based cryptography solutions, which are especially important for high-speed next-generation networks. To overcome this limitation, we present a modular, flexible testbed which comprises several tasks: traffic generation, traffic processing (i.e. performing desired network or security functions) and analysis of traffic obtained after its processing. Suitability of our testbed for hardware-based cryptography solutions is demonstrated on an example of selective encryption through RTL simulation using ModelSim simulator.