Secure boot for vehicular systems

A tangible, non-transitory, computer-readable media having instructions thereupon which, when executed by a processor, cause the processor to perform a method comprising:

• a primary electronic control unit (ECU) of a vehicular system performing, in response to a boot of the vehicular system, a security self-check on the primary ECU to verify the primary ECU by a security module of the primary ECU locally executing a verification script permanently stored locally in read-only memory (ROM) of the primary ECU such that the verification script cannot be remotely updated;
• the primary ECU generating a security challenge;
• the primary ECU transmitting, after the performing of the security self-check, the security challenge to a secondary ECU of the vehicular system through a network or bus of the vehicular system;
• the primary ECU receiving a security response from the secondary ECU in reply to the security challenge, the security response relating to contents of memory of the secondary ECU;
• and
• the primary ECU verifying the security response to validate at least a portion of the content of the memory of the secondary ECU and to establish a chain of trust between the primary ECU and the secondary ECU.

A vehicular system with secure boot, comprising:

• a vehicular network or bus;
• a secondary electronic control unit (ECU) coupled to the vehicular network or bus;
• a primary ECU, coupled to the vehicular network or bus, and comprising a processor, memory, read-only memory (ROM), a security module, a challenge generator and a response checker;
• the security module configured to perform, in response to a boot of the vehicular system, a self-check of the primary ECU by the security module locally executing a verification script permanently stored locally in the ROM of the primary ECU such that the verification script cannot be remotely updated;
• the challenge generator configured to generate a security challenge and to send, after the performing of the self-check, the security challenge to the secondary ECU via the vehicular network or bus;
• and
• the response checker configured to receive a security response from the secondary ECU in reply to the security challenge and configured to check the security response to validate at least a portion of contents of memory of the secondary ECU and to establish a chain of trust between the primary ECU and the secondary ECU.