Hardware Security Module (HSM)

HSM stands for Hardware Security Module. In automotive electronics it means the protected crypto engine built into, or attached to, an ECU's microcontroller, which holds secret keys and performs encryption, signing, MAC and random-number operations on behalf of application software. In enterprise IT the same acronym describes rack-mounted or network-attached appliances that protect keys for servers and PKI.

An automotive HSM is a small, low-power security core embedded in an ECU's microcontroller, while a data-centre HSM is a separate network or PCIe appliance serving many applications. The automotive version is sized for real-time constraints and per-ECU keys and is commonly described against the EVITA full, medium and light profiles; data-centre HSMs are often validated against FIPS 140.

An HSM is used wherever an ECU must prove or check that code and messages are genuine. Typical uses are verifying firmware signatures during secure boot and secure flashing, computing SecOC MACs on CAN and Ethernet, storing keys for diagnostic authentication, and protecting credentials for OTA updates and backend connections. Gateways, telematics units and V2X modules typically need the more capable profiles.