Security Architecture Map

Security Capability Matrix

This table is horizontally scrollable. Use the bottom scrollbar to view all columns.

Security Capability	Protects	Applied To	Mechanism	Evidence	Open Decision
Secure Diagnostics and RBAC	Diagnostic access state and privileged services	Diagnostic Tester Interface / Diagnostic Server	UDS Auth 0x29, authorization, lockout and audit	Strong	Confirm final role model and service list
Secure Software Update	ECU software and firmware authenticity	Bootloader / Update Logic	Signed packages, integrity validation, rollback control and update logging	Strong	Confirm signing chain, rollback and campaign ownership
Data Authenticity and Integrity Verification	Security-relevant vehicle data	Vehicle Network / Secure Data Transfer Interface	SecOC/SDT-style MAC, freshness and replay rejection	Moderate	Confirm protected signal allocation
Key and Certificate Handling	Keys, certificates and trust anchors	Security Services / Hardware Platform / PKI	Provisioning, validation, protected storage and renewal/revocation	Strong	Confirm HSM capability and PKI ownership
Communication Boundary Control	Vehicle and offboard interface boundaries	External Interfaces / Security Services	Input validation, boundary filtering and fail-safe discard behaviour	Moderate	Confirm exact boundaries and failure policy
Security Logging	Security event evidence	Logging / Event Reporting Interface	Event capture, retention, integrity and reporting	Moderate	Confirm event set and reporting channel
Vulnerability and Incident Handling	Field security posture	Security Operations / Compliance Process	Vulnerability intake, triage, mitigation and incident workflow	Strong	Confirm reporting channels and responsibilities
Cybersecurity Evidence and DIA	Approval and residual-risk case	Engineering Toolchain / OEM Approval Interface	Traceability, V&V evidence, decision logging and residual-risk approval	Strong	Confirm DIA split and authority

Security Capability Map

flowchart LR subgraph Protect["Protected areas"] Data["Vehicle data"] Software["ECU software"] Diag["Diagnostic access"] Trust["Keys and certificates"] Evidence["Security evidence"] end subgraph Capabilities["Security capabilities"] Comms["Secure communication"] UpdateSec["Secure update"] RBAC["Diagnostics RBAC"] KeyMgmt["Key / certificate management"] Audit["Logging and evidence"] end Comms --> Data UpdateSec --> Software RBAC --> Diag KeyMgmt --> Trust Audit --> Evidence

Mermaid source

flowchart LR
  subgraph Protect["Protected areas"]
    Data["Vehicle data"]
    Software["ECU software"]
    Diag["Diagnostic access"]
    Trust["Keys and certificates"]
    Evidence["Security evidence"]
  end
  subgraph Capabilities["Security capabilities"]
    Comms["Secure communication"]
    UpdateSec["Secure update"]
    RBAC["Diagnostics RBAC"]
    KeyMgmt["Key / certificate management"]
    Audit["Logging and evidence"]
  end
  Comms --> Data
  UpdateSec --> Software
  RBAC --> Diag
  KeyMgmt --> Trust
  Audit --> Evidence

Protected Asset Table

This table is horizontally scrollable. Use the bottom scrollbar to view all columns.

Asset	Threat Exposure	Protection Strategy	Evidence	Open Decision
Clutch control behaviour	Command spoofing, unsafe state or malformed data	Command validation, authenticated/fresh messages where allocated, diagnostic authorization	Confirmed function; security allocation inferred	Confirm protected signal set
ECU software and firmware	Tampered or wrong software installed	Signed update, IVD/integrity checks, secure boot/platform integrity	Strong update/flash evidence	Confirm signing chain and rollback
Keys, certificates and trust anchors	Credential theft or invalid trust decisions	Protected storage, certificate validation, lifecycle management	Strong key/certificate evidence	Confirm HSM and PKI owner
Diagnostic access state	Unauthorized privileged service access	UDS Auth 0x29, RBAC, lockout and audit	Strong diagnostic evidence	Confirm role model
Security evidence and decisions	Untrusted evidence or unapproved residual risk	Traceability, review workflow and decision logging	Strong process evidence	Confirm approval authority

Attack Surface Table

This table is horizontally scrollable. Use the bottom scrollbar to view all columns.

Attack Surface	Entry Point	Required Controls	Evidence	Status
Vehicle network	CAN / PWM command and status path	Message validation, authenticity/freshness where allocated, safe discard	CAN/PWM requirements and SecOC/SDT evidence	Requires confirmation
Diagnostic access	UDS tester and programming services	Authentication, authorization, lockout, rate limiting and audit	UDS/Auth 0x29 evidence	Requires confirmation
Software update / flash	Programming/update package path	Signature validation, IVD/integrity checks, rollback and logging	Flash/update evidence	Requires confirmation
PKI / provisioning	Key and certificate injection or renewal path	Protected storage, certificate validation, ownership and revocation controls	Key/certificate evidence	Requires confirmation
Supplier engineering evidence	ALM, CI/test and evidence repository	Access control, artifact integrity and audit trail	Cybersecurity concept/evidence requirements	Requires confirmation

Security Decision Table

This table is horizontally scrollable. Use the bottom scrollbar to view all columns.

Conclusion	Status	Evidence	Impact	Decision Needed
ECA ECU product identity and AMT platform context	Confirmed	3299216_1.md function statements; system_identity.md	Stabilizes review-board naming	Confirm final product designation/variant
Cybersecurity concept and evidence package are in scope	Confirmed	Cybersecurity and process requirements	Makes this an architecture/security baseline, not a brochure	Confirm approval workflow
Secure diagnostics, update and key/certificate handling apply to the ECU	Inferred	UDS, flash/IVD and certificate/key requirements	Drives security services and trust-boundary design	Confirm exact allocation
SecOC/SDT-style protection is needed for selected data flows	Requires Confirmation	Secure communication requirements	Blocks final interface-security allocation	Customer must identify protected signals

Asset Model