UniSUF: Unified Secure Software Update Framework

• UniSUF is a secure software update framework that defines clear roles and cryptographic protocols for automotive and IoT environments.
• It decomposes the update process into modular components such as software suppliers, producer/consumer subsystems, and ECUs to ensure robust, authenticated delivery.
• The framework employs formal verification with ProVerif to validate confidentiality, integrity, freshness, and liveness of update protocols.

The Unified Software Update Framework (UniSUF) is a reference architecture for secure software update delivery, originally specified for software-defined vehicles but extensible to IoT and embedded systems. UniSUF targets the robustness, scalability, and end-to-end security required in automotive and distributed embedded contexts, supporting integration with existing OEM, supplier, cloud, and edge infrastructures. It explicitly codifies secure key management, authenticated update distribution, and formal threat modeling, setting a rigorous baseline for update system correctness and auditability (Hagen et al., 19 Nov 2025).

1. Architectural Components and Ecosystem Modeling

UniSUF decomposes the automotive update workflow into explicit software, infrastructure, and orchestration roles. The principal entities are:

• Software Suppliers: Source signed software binaries.
• Producer Subsystem: Aggregates artifacts, encapsulates per-vehicle orders, and issues Vehicle Unique Update Packages (VUUPs). This component comprises VCM, PSA, PDA, PIA, PSS, CMS, Order Agent, Order Cloud Service, VIN DB, and Vehicle Cloud Service sub-entities.
• Consumer Subsystem: Performs update retrieval, decryption, staging, and installation on the vehicle. It integrates modules such as CDA (download manager), CSA (secure enclave for cryptographic verification), CIA (installer), and local storage.
• ECU (Electronic Control Unit): Target computational node(s); typically resource-constrained and potentially network-exposed.
• Root Infrastructure: All cryptographic credentials (e.g., VCM_Cert, PSA_Cert, Vehicle_Cert) are rooted under a vehicle-internal CA.

All inter-producer and producer–consumer links are required to be both secure and reliable, e.g., via mutually authenticated TLS or private SSH channels. Only the final Consumer-to-ECU link is modeled as reliable but adversary-controlled under the Dolev–Yao model.

This modular partitioning mirrors advanced IoT frameworks such as ASSURED, which similarly leverages per-domain controllers, secure-boot-backed device agents, and standardized repository protocols (e.g., TUF, SUIT, Uptane) (Asokan et al., 2018). Both approaches stress policy enforcement locality, update-specific constraints, and cryptographic separation of duties.

2. Threat Model and Security Goals

UniSUF constructs its security model under robust adversarial assumptions:

• Dolev–Yao Adversary: All public network channels (except those explicitly secured) are under complete adversarial control; messages can be intercepted, replayed, delayed, or modified. Cryptographic primitives are assumed perfect.
• Certificate Trust Anchors: Every vehicle’s root CA is pre-installed and trusted; subordinate certificates are validated by the established chain.
• Infrastructure Guarantees: Synchronized global time, update-round identifiers (of the form VIN ‖ expirationTime), and session sequence numbers enable persistent log-based replay protection and ordering.

The security properties formalized (as “MetaRequirements”) are:

1. Confidentiality: No session or update secret (e.g., DKM_Key, SKA_Key) is leaked to the adversary.
2. Integrity and Authenticity: All instructions, manifests, and binaries must be provably intact and traceable to their origin.
3. Freshness: All update material is bound to unique round identifiers, prohibiting replay.
4. Order: All protocol steps must follow the prescribed partial order.
5. Liveness/Termination: Update processes halt or expire safely under all executions.

These properties are captured via correspondence and secrecy assertions in a formal model (Hagen et al., 19 Nov 2025).

3. Workflow and Protocol Formalization

The update protocol proceeds in tightly controlled stages:

1. Preparation: Suppliers sign software; materials are staged in the Producer’s local secure storage.
2. Order Processing: The Producer subsystem synthesizes the VUUP using the Vehicle Signed Order (VSO), emitting cryptographically bound update packages per vehicle.
3. Consumer Handling: The Consumer subsystem retrieves the VUUP, decrypts and stages software in the secure enclave (CSA), and finally streams the update to the ECU over a network channel subject to adversarial interference.
4. Intra-Vehicle Delivery: The final leg is designed to tolerate Dolev–Yao-level attacks by securing messages, enforcing per-session keys and strict round identifiers.

All critical artifact flows and protocol events are modeled as ProVerif processes, channels, and events. For example, authenticated encryption, public-key cryptography, digital signature construction, and certificate validation are encoded as:

type key. fun senc(bitstring, key): bitstring. fun sdec(bitstring, key): bitstring. equation forall m:k, k1:key; sdec(senc(m,k1),k1)=m. fun aenc(bitstring, pkey): bitstring. reduc forall m:bitstring, sk:skey; adec(aenc(m,pk(sk)),sk)=m.

Event sequencing captures workflow step ordering:

event verifySL(r, d_SL); event mkDLInstr(r, d_DL); event mkDKM(r, d_DKM); query event(mkDLInstr) ==> event(verifySL). query event(mkDKM) ==> event(mkDLInstr).

Each process instance is assigned only the cryptographic keys and credentials authorized for its role.

4. Formal Verification and Security Guarantees

ProVerif is employed to model and verify UniSUF’s protocol stack. Security requirements are encoded as:

• Secrecy queries: e.g., query attacker(new DKM_Key)., ensuring session keys remain confidential.
• Correspondence queries: e.g., query event(mkDKM) ==> event(mkDLInstr)., ensuring correct origin of critical artifacts.
• Freshness and uniqueness queries: e.g., query r1,r2,d; event(mkDKM(r1,d)) && event(mkDKM(r2,d)) ==> r1 = r2.

No counterexamples are generated; all secrecy, integrity, freshness, order, and liveness properties are proven true under the specified model. Verification completes in approximately 2 seconds on commodity hardware. Liveness and intra-round uniqueness are separately proven via combinatorial arguments over model structure (Lemmas 7.1, 7.2) (Hagen et al., 19 Nov 2025).

5. Integration with IoT and Lessons from ASSURED

ASSURED provides a comparable, rigorous update framework for IoT and embedded devices featuring the following:

• Four-Party Model: Manufacturer/OEM (signing updates), TUF repository (metadata/authentication), Domain Controller (policy enforcement, update staging), Device Agent (embedded device/TEE).
• End-to-End Authenticity: OEM signature verification at device.
• Controller Offload: Device cryptographic load is limited to one signature verification and one HMAC, while heavy-weight metadata and policy evaluation is performed by the Domain Controller.
• Installation Attestation: Devices send state proofs (e.g., $$\mathrm{MAC}_{K_{DC}}(\mathrm{state} \| \mathrm{nonce})$$) back to Controller.
• Performance Gains: On low-end MCUs, ASSURED achieves a 4.5× speed-up over direct TUF client operation, decreasing update+attestation time from ≈10.7s to ≈2.3s. Metadata size is reduced from ≈940B (TUF JSON) to ≈188B (fixed format).

These lessons inform the UniSUF design by endorsing partitioned responsibility, scalable end-to-end authenticators, and attestation protocols—an architecture suitable for millions of resource-constrained endpoints (Asokan et al., 2018).

6. Discussion, Limitations, and Implications

Formal verification of UniSUF provides strong symbolic assurance of design-level security properties:

• Confidentiality: Update payloads and session keys remain secret against malware and network-level adversaries.
• Authenticity and Integrity: Cryptographic nesting and event-correspondence prevent unauthorized step-skipping or key misuse.
• Freshness and Replay Resistance: Binding update artifacts to unique (VIN, expirationTime) tags ensures replay and rollback protection.
• Liveness: Updates terminate safely; incomplete or malicious sessions timeout.

Limitations include:

• Computational Model Restrictions: Dolev–Yao idealizes cryptographic primitives; side-channel leakage and TEE vulnerabilities are not modeled.
• Abstraction Level: Single-ECU focus and abstracted process modeling (multi-ECU and tiered adversary scenarios are earmarked for future work).
• Implementation Gaps: Real-world deployment demands conformance checking, hardened cryptographic backends, and practical mitigations for physical and side-channel attacks.

A plausible implication is that the modular process/event structure, standard key infrastructure, and policy provisioning pioneered in UniSUF and ASSURED form a scalable blueprint for broad classes of automotive and IoT update ecosystems, pending code-level and hardware-complete validation (Hagen et al., 19 Nov 2025, Asokan et al., 2018).