Recognizing the growing need to secure non-traditional computing systems, TCG formed an embedded systems work group and also has a subgroup looking at IoT, or Internet of Things, security and the role of trust in that security. The embedded work group has been working actively to create several specifications that enable the proven root of trust, the TPM, to be used in very demanding and very different environments, including automotive.

In just a few weeks, TCG members Fujitsu and Toyota InfoTechnology Center will demonstrate the outcome of this work with a prototype approach at the SAE 2015 World Congress & Exhibition, Detroit, in a session organized for the SAE Vehicle Electrical Hardware Security Task Force, a sub-committee of the SAE Vehicle Electrical System Security Committee.

The demonstration (details here), which also will be shown at the RSA Conference 2015 in San Francisco April 20, will leverage the TPM (Trusted Platform Module) and TNC (Trusted Network Connect) specifications already deployed in millions of PCs, servers, tablets, phones and networking gear. The TPM and TNC can:

• Measure and report on the integrity of firmware and software used in the ECU.

• Create, store, and manage cryptographic keys in the ECU

• Provide attestation and assurance of identity of the ECU

• Support secure firmware and software updates in the ECU

• Provide anti-rollback protection and secure configuration memory for the ECU

TCG also has made available the TCG TPM 2.0 Automotive Thin Profile, specifically provides key integrity, attestation, cryptographic key management and verification of digital signatures and safety remote installations.

What about the demanding environment part of the automotive market? TCG will be working to develop future specifications that take into account the heat, vibration, and other key issues that impact components and systems in vehicles.

Interested in the SAE demo? More info is here:https://trustedcomputinggroup.org/media_room/events/189.  If you are interested in joining the TCG efforts, which include liaison relationships with a number of industry groups and standards organizations, see https://trustedcomputinggroup.org/membership.