OUR story

01

Task

The SoC platform of our client mandated all TAs to be signed, which led our team to design and implement a secure image signing process. They required a scalable solution for production use that can integrate with the customer’s existing infrastructure without disrupting ongoing development.

In addition, the solution also had to comply with regulatory standards of ISO/SAE 21434 and UNECE WP.29 standard.

02

Challenge

The primary challenge was to establish a secure and automated signing process that would enable the seamless delivery of Trusted Applications (TAs) developed by our team. Since the customer’s existing setup lacked a standardized mechanism for signing.

Without proper signing, TAs become a weak point that threatens both compliance and the overall trustworthiness of the automotive software platform

1. Compromise sensitive assets,

2. Introduce malicious code, or

3. Weaken system safeguards.

This not only exposes the SoC platform to supply chain and runtime threats but also raises concerns around meeting compliance requirements.

Moreover, the solution demanded alignment with their established CI/CD workflows, enforce strict access controls, and provide audit-ready traceability across the entire signing and deployment chain.

03

Solution

Leveraging our deep expertise in Trusted Application development, PKI infrastructure, and CI/CD automation, Diconium’s cybersecurity team in Germany, developed a fully automated TA signing pipeline. The solution followed a three-step procedure:

• Step 1: The process began with the creation of a dedicated signing key pair in our PKI infrastructure. The public key was exported and provisioned into the target ECU, while the private key remained secured within our PKI infrastructure for signing operations.

• Step 2: Trusted Applications were version-controlled in a GitHub repository, with access limited to authorized developers under a four-eyes approval process. Each pull request triggered a CI/CD pipeline that automatically executed unit tests, static code analysis, and policy checks before proceeding to image signing.

• Step 3: Once validated, the pipeline securely signed the TA using the private key. The signed artifacts including the TA and its signature were then transferred to the client's platform through secure delivery channels.

04

Successes

With the new pipeline in place, our customer was able to achieve a production-ready solution that ensured cryptographic proof of authenticity for every Trusted Application.

The automated signing process eliminated manual handling risks, supported secure over-the-air deployment, and strengthened supply chain integrity.

Most importantly, the solution helped the client meet ISO/SAE 21434 and UNECE WP.29 cybersecurity requirements while aligning with OEM expectations for compliance and security assurance.