T/JSIA 0002-2024 Passenger car CAN bus hardware fingerprint authentication device safety technical requirements and testing methods

Scope

Main Technical Content: 6.1 Hardware Information Security Requirements The certification device shall not have any backdoors or hidden interfaces. The debugging interface should be disabled or configured with secure access control. The specific implementation methods shall comply with the provisions of GB/T 40857–2021, Section 6.1. 6.2 Firmware Information Security Requirements 6.2.1 Security Boot The certification device shall have a security boot function. The trusted root used for security boot shall be protected by a trusted root entity. The specific implementation methods shall comply with the provisions of GB/T 40857–2021, Section 6.3.1. 6.2.2 Security Logs If the certification device has a security log function, it shall meet the following requirements: a) Conduct tests in accordance with the provisions of GB/T 40857–2021, Section 7.3(d), (e), and (f). When the certification device detects events such as CAN devices failing authentication, software configuration changes, or failures in software integrity verification, relevant information shall be recorded. b) Conduct tests in accordance with the provisions of GB/T 40857–2021, Section 7.3(g). The security logs of the certification device shall include at least the following information: the time (absolute or relative) of the triggering event, the event type, and the unique vehicle identification code. c) Conduct tests in accordance with the provisions of GB/T 40857–2021, Section 7.3(h). The certification device shall securely store the security logs to prevent their destruction in the event of physical tampering attacks and unauthorized additions, access, modifications, or deletions. The storage location of the security logs may be within the certification device, other ECUs, or cloud servers. d) Conduct tests in accordance with the provisions of GB/T 40857–2021, Section 7.3(i). The security logs of the certification device shall not contain any form of personal information. 6.2.3 S

Development Information

Related Standards