IPsec & MACsec in Automotive - Automotive Cybersecurity

MACsec (IEEE 802.1AE) for In-Vehicle Ethernet

MACsec Frame Structure

  Original Ethernet Frame (unprotected):
  | Dst MAC | Src MAC | EtherType | Payload | FCS |

  MACsec Secured Frame (IEEE 802.1AE):
  | Dst MAC | Src MAC | 0x88E5 | SecTAG | Encrypted_Payload | ICV | FCS |

  SecTAG (8–16 bytes):
  ├── TCI/AN: Tag Control Information + Association Number (2 bytes)
  ├── SL: Short Length (1 byte, optional)
  ├── PN: Packet Number (4 bytes; replay protection: reject if PN ≤ window)
  └── SCI: Secure Channel Identifier (8 bytes, optional; identifies key/channel)

  ICV: Integrity Check Value (16 bytes, AES-128-GCM or AES-256-GCM)
  Encryption: AES-GCM authenticated encryption (encrypt+authenticate in one pass)
  Supported by: NXP SJA1110, Marvell 88Q5050 automotive Ethernet switches

MACsec in Automotive Zonal Architecture

Deployment Aspect	Configuration	Note
Key Agreement Protocol	MKA (MACsec Key Agreement, IEEE 802.1X-2020)	Zone controller acts as Key Server; distributes SAK to connected ECUs
Per-link isolation	Each zonal link = separate Connectivity Association	Compromise of one ECU does not expose keys for other ECU links
VLAN interaction	802.1Q VLAN tags remain authenticated but unencrypted	VLAN tag visible for switch forwarding; payload encrypted
Hardware acceleration	NXP SJA1110, Marvell 88Q5050	AES-256-GCM hardware acceleration; wire-speed at 1 Gbps
Protocol coverage	Protects all traffic: SOME/IP, DoIP, raw Ethernet	No per-protocol changes required — transparent to application layer

IPsec for V2X and Telematics Backend Tunnels

Pythonipsec_spd_config.py

#!/usr/bin/env python3
# AUTOSAR IPsec Security Policy Database (SPD) configuration
# IPsec Transport mode: encrypt IP payload only, preserve IP header

ipsec_policies = [
    {
        "name": "Policy_OTA_Backend",
        "description": "Encrypt all traffic to OEM OTA server",
        "traffic_selector": {
            "src_ip": "0.0.0.0/0",     # any vehicle IP (DHCP)
            "dst_ip": "203.0.113.10/32", # OEM OTA server
            "protocol": "TCP",
            "dst_port": 443,
        },
        "action": "ENCRYPT",
        "sa_params": {
            "mode": "Transport",
            "encryption": "AES-256-GCM",     # AEAD: encrypt + authenticate
            "ike_version": "IKEv2",
            "auth_method": "X.509_ECDSA",    # ECU cert provisioned at EOL
            "dh_group": "19",                 # ECDH P-256 (DH group 19)
        },
    },
    {
        "name": "Policy_V2X_Backend",
        "description": "Encrypt V2X certificate management traffic",
        "traffic_selector": {
            "src_ip": "0.0.0.0/0",
            "dst_ip": "203.0.113.50/32",  # V2X PKI backend
            "protocol": "TCP",
            "dst_port": 443,
        },
        "action": "ENCRYPT",
        "sa_params": {
            "mode": "Transport",
            "encryption": "AES-256-GCM",
            "ike_version": "IKEv2",
            "auth_method": "X.509_ECDSA",
            "dh_group": "20",   # ECDH P-384 for higher-security V2X
        },
    },
    {
        "name": "Policy_Internal_Bypass",
        "description": "Bypass IPsec for intra-vehicle (MACsec-protected) traffic",
        "traffic_selector": {
            "src_ip": "10.0.0.0/8", "dst_ip": "10.0.0.0/8",
            "protocol": "ANY", "dst_port": None,
        },
        "action": "BYPASS",
    },
]

for p in ipsec_policies:
    print(f"  {p['name']}: {p['action']}")
    if p["action"] == "ENCRYPT":
        print(f"    {p['sa_params']['encryption']} via IKEv2/{p['sa_params']['auth_method']}")

Protocol Selection Guidance

Scenario	Protocol	Rationale
In-vehicle Ethernet segment (ECU-to-ECU)	MACsec (L2)	Zero per-packet overhead beyond ICV; wire-speed hardware; transparent to L3+
Application-layer service security	TLS 1.3 (L7)	Flexible; works across routed networks; supports mTLS per service
Vehicle-to-backend tunnel	IPsec (L3)	Transparent to application; protects all IP traffic; IKEv2 with ECU cert
Defense in depth	MACsec + TLS combined	Attacker must break both L2 and L7 security independently
Intra-ECU (same silicon)	None needed	Physical isolation; no network transport

Summary

MACsec provides layer-2 segment security for in-vehicle Ethernet — protecting all traffic on a physical link without requiring per-protocol changes. IPsec provides layer-3 tunnel security for vehicle-to-backend communication. TLS/mTLS provides application-layer authentication for specific services. Combining MACsec and TLS in the zonal Ethernet backbone achieves defense-in-depth: an attacker who bypasses MACsec (e.g., by cloning a switch port) still faces TLS authentication at the service layer.

🔬 Deep Dive — Core Concepts Expanded

This section builds on the foundational concepts covered above with additional technical depth, edge cases, and configuration nuances that separate competent engineers from experts. When working on production ECU projects, the details covered here are the ones most commonly responsible for integration delays and late-phase defects.

Key principles to reinforce:

Configuration over coding: In AUTOSAR and automotive middleware environments, correctness is largely determined by ARXML configuration, not application code. A correctly implemented algorithm can produce wrong results due to a single misconfigured parameter.
Traceability as a first-class concern: Every configuration decision should be traceable to a requirement, safety goal, or architecture decision. Undocumented configuration choices are a common source of regression defects when ECUs are updated.
Cross-module dependencies: In tightly integrated automotive software stacks, changing one module's configuration often requires corresponding updates in dependent modules. Always perform a dependency impact analysis before submitting configuration changes.

🏭 How This Topic Appears in Production Projects

Project integration phase: The concepts covered in this lesson are most commonly encountered during ECU integration testing — when multiple software components from different teams are combined for the first time. Issues that were invisible in unit tests frequently surface at this stage.
Supplier/OEM interface: This is a topic that frequently appears in technical discussions between Tier-1 ECU suppliers and OEM system integrators. Engineers who can speak fluently about these details earn credibility and are often brought into critical design review meetings.
Automotive tool ecosystem: Vector CANoe/CANalyzer, dSPACE tools, and ETAS INCA are the standard tools used to validate and measure the correct behaviour of the systems described in this lesson. Familiarity with these tools alongside the conceptual knowledge dramatically accelerates debugging in real projects.

⚠️ Common Mistakes and How to Avoid Them

Assuming default configuration is correct: Automotive software tools ship with default configurations that are designed to compile and link, not to meet project-specific requirements. Every configuration parameter needs to be consciously set. 'It compiled' is not the same as 'it is correctly configured'.
Skipping documentation of configuration rationale: In a 3-year ECU project with team turnover, undocumented configuration choices become tribal knowledge that disappears when engineers leave. Document why a parameter is set to a specific value, not just what it is set to.
Testing only the happy path: Automotive ECUs must behave correctly under fault conditions, voltage variations, and communication errors. Always test the error handling paths as rigorously as the nominal operation. Many production escapes originate in untested error branches.
Version mismatches between teams: In a multi-team project, the BSW team, SWC team, and system integration team may use different versions of the same ARXML file. Version management of all ARXML files in a shared repository is mandatory, not optional.

📊 Industry Note

Engineers who master both the theoretical concepts and the practical toolchain skills covered in this course are among the most sought-after professionals in the automotive software industry. The combination of AUTOSAR standards knowledge, safety engineering understanding, and hands-on configuration experience commands premium salaries at OEMs and Tier-1 suppliers globally.