From Seed–Key to Certificates: A Structured Black-Box Security Evaluation Framework for Modern ECU Diagnostic Architectures

This thesis presents a structured black-box security evaluation of a modern automotive ECU diagnostic architecture. The study focuses on UDS-based diagnostic communication, moving beyond the classical seed–key SecurityAccess model toward routine-based and certificate-oriented authentication. Through controlled experiments, the thesis analyses diagnostic surface exposure, session behaviour, authentication workflow, authorisation enforcement, replay resistance, robustness under misuse, and challenge variability. The results show that the analysed ECU does not rely on persistent session-based privilege elevation. Instead, authentication and authorisation appear decoupled, with privileges enforced at the service or operation level. Replayed authentication artefacts were rejected, and the ECU showed stable behaviour under most tested stress and misuse conditions. The thesis contributes both empirical findings from a production ECU and a reusable evaluation framework for analysing modern diagnostic security architectures under black-box conditions.