STDA052 October   2026 DP83TC815-Q1 , DP83TC816-Q1

 

  1.   1
  2.   Abstract
  3.   Trademarks
  4. 1Introduction
  5. 2Time Synchronization for Radar With IEEE 802.1as
  6. 3Securing Radar Data With MACsec
  7. 4Using MACsec and PTP Together
  8. 5TI Ethernet PHYs With TSN and MACsec
  9. 6Conclusion
  10. 7References

3 Securing Radar Data With MACsec

Why Radar Links Need Security

Radar sensors in advanced driver assistance systems (ADAS) are safety-critical. These sensors provide the real-time data that a vehicle uses to detect obstacles, maintain safe following distances, and trigger emergency braking. As vehicles move toward zonal and central compute architectures, this data travels over Ethernet from the sensors to a central processor, which means the data passes through cables that run through the vehicle, and these cables are potentially physically accessible on the underside or front of the vehicle.

At the same time, modern vehicles have connections to the outside world through telematics, OTA update systems, and diagnostic interfaces. These connections increase the attack surface available to a malicious actor. An attacker who gains access to the in-vehicle network, whether physically or remotely, can target the radar data stream.

Threats to Radar Data

A radar link carrying safety-critical data is a potential target. The following table describes the main attack types, consequences of these attacks, and how MACsec addresses each potential attack.

Table 3-1 Threats and Mitigations for Radar Data
Threat Description Consequence MACsec Protection Mechanism
Spoofing Injecting a false object detected frame from a device that is not the radar Unwanted emergency breaking Authenticated key agreement. Every frame carries an ICV that only a key holder can generate.
Replay Recording a clear road stream and replaying the stream at a later time A real obstacle is masked Packet number in the SecTAG. Frames with old or repeated numbers are dropped.
Man in the Middle Intercepting frames and modifying bits to change obstacle to clear or vice-versa A real obstacle is masked ICV integrity check on each frame. Modified frames fail the check and are dropped.
Eavesdropping Capturing the stream to reverse-engineer sensor capability, resolution, or waveform Loss of intellectual property Payload encryption

MACsec in the PHY

MACsec, defined in IEEE 802.1AE, operates at layer 2, the data link layer. The sender adds a security tag (SecTAG) to every frame and appends an integrity check value (ICV), and encrypts the payload. The receiver verifies the SecTAG and the ICV, drops the frame if the check fails, and decrypts the frame if the frame passes. The two ends establish keys with the MACsec Key Agreement (MKA) protocol defined with IEEE 802.1X. For a full description of how MACsec works, the frame format, and the key terms, see Enhancing the Confidentiality and Integrity of Automotive Ethernet Data Using MACsec.

DP83TC815-Q1 DP83TC816-Q1 DP83TC817-Q1 DP83TC818-Q1 MACsec Ethernet Frame Figure 3-1 MACsec Ethernet Frame