Case study
Head-unit IOC security,
across two generations.
From 2016 to 2021 I led the security software work for the I/O controller (IOC) of two head-unit generations for a top German car manufacturer, as Technical Lead employed at Harman Becker, a Tier-1 supplier. The IOC is the head unit's automotive microcontroller. It is the vehicle's communication gateway, where buses such as CAN, Ethernet and MOST come together, and it controls the power of the main SoC. This page describes what the work involved. The car manufacturer is left out on purpose.
At a glance
- Role
- Lead software developer for security software, later functional owner and technical lead
- Setting
- Employed at Harman Becker, a Tier-1 supplier, delivering two head-unit generations to a top German car manufacturer
- Period
- 2016–2021
- Team
- Up to 7 engineers, multicultural offshore setup
- Technology
- Automotive microcontroller (IOC) with hardware security module (HSM), Secure Boot, Secure Software Update and Download, SecOC (Secure Onboard Communication), Secure Diagnostics, Python and Bash test and trace tooling
- Standards
- The security requirements of the car manufacturer as they applied at the time. Today these topics fall under ISO/SAE 21434 and UNECE R155/R156.
Situation
In 2016 the first of two head-unit generations needed hardware-backed security in its I/O controller (IOC): HSM firmware, fusing, Secure Boot and a Secure Software Update path. I led this workstream as lead software developer at the Tier-1 supplier and directed a multicultural offshore development team.
The role covered project planning, scheduling and supplier coordination for the security workstream, test scripts in Python and Bash, and the first operation and verification of the software in workshops with the customer and vendors. The practices established there carried over into the second generation from 2019.
Approach
In the second generation I became functional owner and technical lead. I owned the security architecture and its implementation on the IOC, an automotive microcontroller: HSM integration, Secure Boot, Secure Software Download, Secure Onboard Communication and Secure Diagnostics. The team grew to up to seven engineers.
Technical requirements were derived and extended from customer requirements, internal requirements, change requests and the system architecture, and fed directly into the architecture. In parallel the team built test scripts and scripts for automatic trace analysis in Python and Bash to verify the software in internal and external workshops.
Outcome
With this work, the head unit became the first ECU to fully implement the car manufacturer's security suite. It was a team achievement delivered under this technical leadership, across two head-unit generations, by a multicultural offshore team of up to seven engineers.
The same approach is what I bring to new projects: security requirements derived early, an architecture that holds up on constrained hardware, and test tooling that makes the result verifiable.
Working on something similar?
If your embedded or automotive product faces comparable security topics, send me a short message. The CV gives the full picture.
info@hornung-embedded.org