Countering Security Threats | MACsec and Encryption | NEXTY Electronics, a trading company for electronic components and semiconductors

Security vulnerabilities in in-vehicle communications can lead to hacking of in-vehicle systems. Security threats, such as data eavesdropping and falsification, also exist on in-vehicle Ethernet LANs. MACsec, an encryption technology, is an effective countermeasure against these threats.
In "What is MACsec?" we explained the overview of MACsec, but in this column we will introduce how MACsec works and some specific examples of how to deal with it.

What is MACsec? | Learn about MACsec (Media Access Control Security).

Encryption Board

The basic encryption technologies are symmetric key cryptography and public key cryptography. OTHERS encryption methods and authentication are based on these two cryptography methods.

Common key cryptography

Symmetric key cryptography is a cryptography method that uses the same key to encrypt and decrypt plaintext. The symmetric key is shared between the sender and receiver, and the plaintext or ciphertext is encrypted or decrypted using the symmetric key. When sending or receiving data between multiple people, a symmetric key is required for each pair of sender and receiver, so the total number of keys increases quadratically.

public key cryptography

Common key cryptography is a cryptography method that uses different keys for encryption and decryption. Plain text encrypted with one key can only be decrypted with the other key, and it is impossible to guess one key from the other. One key is strictly managed as a private key, and the other is made public as a common key. When sending and receiving data between multiple parties, each sender and receiver must have a pair of keys, so the total number of keys increases linearly.

MACsec

The MACsec specification is based on IEEE 802.1AE and determines data encryption and decryption. Authentication, key management, and key exchange between link partners are outside the scope of 802.1AE and are included in 802.1X.

principle

The device encrypts the data in FRAMES received by the xMII using a pre-stored common key. The encrypted FRAMES is sent to the link partner by the MDI transmit block. The other device decrypts the encrypted packet received by the MDI using the common key.

Ethernet FRAMES | Learn about the standard Ethernet FRAMES for sending and receiving data.

What is MDI? | Learn about the signals sent and received between MDI and the Automotive Ethernet PHY.

What is xMII? | Learn about MII (Media Independent Interface).

MACsec Use Cases

Consider a use case where data acquired from a camera is sent to the PHY connected to CONNECTORS and processed by the subsystem.
Malicious hackers can attach hacking devices to CONNECTORS, allowing them to eavesdrop on or tamper with data. MACsec is used to prevent this.

Data eavesdropping

The data copied by the hacking device is sent to the hacker, who can then view the same image as the monitor on the subsystem. MACsec encrypts the data with a shared key, so a hacker who does not have the shared key cannot decrypt the copied data. Therefore, the hacker cannot view the same screen as the monitor.

Data tampering

If data sent from a hacker is sent to the monitor through the hacking device, the image will not be displayed correctly. MACsec uses data that is not properly encrypted, so the image will be displayed on the monitor as normal.

Summary

Using MACsec as a security measure on in-vehicle Ethernet LANs can prevent data eavesdropping and tampering, and can complement security vulnerabilities in in-vehicle communications.