RAPIDSEA Secure Ethernet Library
Production-Ready MACsec Security Library for Automotive Ethernet ECUs - Encryption, Authentication, Key Management and Replay Protection, AUTOSAR Compatible
Production-Ready MACsec Security Library for Automotive Ethernet ECUs - Encryption, Authentication, Key Management and Replay Protection, AUTOSAR Compatible
Modern vehicles are evolving into high-bandwidth, software-defined platforms. Automotive Ethernet, running at 100 Mbps (100BASE-T1) and 1 Gbps (1000BASE-T1) over single-pair wire, now carries ADAS camera streams, LiDAR point clouds, SOME/IP service messages, OTA firmware updates, and DoIP diagnostic sessions across hundreds of ECUs.
IEEE 802.3 Ethernet was never designed for hostile in-vehicle environments. Without MACsec, every Ethernet frame travels in plaintext, unauthenticated, with no replay protection, exposing critical vehicle functions to eavesdropping, injection, and man-in-the-middle attacks that regulatory frameworks like ISO/SAE 21434 now mandate must be addressed.
An Ethernet MACsec encryption and authentication library closes this gap in software. RAPIDSEA Secure Ethernet Library delivers encryption, authentication, key management, and replay protection purpose-built for automotive Ethernet, fully compliant with the IEEE 802.1AE MACsec standard, without requiring an AUTOSAR BSW stack or RTOS.
RAPIDSEA Secure Ethernet Library is a portable C99 software library that protects automotive Ethernet traffic end to end, covering encryption, authentication, device admission, and key management. It supports both static pre-shared keys and full dynamic key agreement, with optional hardware offload where your Ethernet PHY supports it.
It converts a plaintext Ethernet frame into a fully IEEE 802.1AE-compliant MACsec frame, interoperable with any standards-compliant hardware or software MACsec implementation, including third-party switches and PHYs.
The library is delivered two ways: as a lean, zero-dependency standalone API for bare-metal, FreeRTOS, Zephyr, or Linux-based ECUs with no AUTOSAR BSW stack, and as an optional AUTOSAR Interface Layer for OEMs and Tier-1s standardized on AUTOSAR Classic. Both paths deliver the same level of protection.
Every Ethernet frame is encrypted and authenticated together, using AES-128, so its content stays confidential and any tampering or forgery is caught before it is trusted.
Devices are authenticated before joining the network, and encryption keys are established and rotated automatically, with no manual key handling required in the field.
Runs standalone on bare-metal or RTOS today, or add the optional AUTOSAR Interface Layer for Classic BSW integration.
Choose the right balance of security and performance for each ECU and link type, from fast-start integrity checking to full hardware-offloaded protection.
Captured frames cannot be recorded and retransmitted later; every frame is checked for freshness before it is ever accepted.
Add four C source files to your build system, include one header, and initialize a secure channel at startup. No BSW stack, no RTOS, no middleware dependencies required to get started.
AUTOSAR SecOC Profile 1 typically uses a short, truncated authentication check and no encryption. RAPIDSEA delivers full payload encryption plus a substantially stronger authentication check, and ships an optional AUTOSAR Interface Layer so OEMs standardized on AUTOSAR can adopt it as a compliant Mka BSW module instead of building one from scratch.
Validated on Renesas RH850, NXP i.MX RT1064, and STM32H7, and tested with Vector VN1610 and PEAK PCAN analysers against real SOME/IP ECU networks.
Not every ECU or link needs the same level of protection. RAPIDSEA Secure Ethernet Library ships with four purpose-built security profiles, so you can choose the right protection and performance trade-off for each Ethernet port rather than applying a single one-size-fits-all setting. Profiles can be mixed across ports on the same ECU.
| Profile | What It Provides | Best Suited For |
|---|---|---|
| Profile 1 - Fast-Start | Authentication only, no payload encryption, fastest startup and lowest overhead | Boot-time liveness signals, latency-critical diagnostics, service discovery |
| Profile 2 - Full Security | Full encryption plus authentication on every frame | General ECU-to-ECU communication, OTA updates, diagnostic sessions, command channels |
| Profile 3 - Heavy Payload | Full encryption and authentication engineered for sustained, high-volume traffic | Camera, LiDAR, and RADAR sensor streams, high-bandwidth backbone links |
| Profile 4 - Hardware Offload | Encryption and authentication performed by the Ethernet PHY hardware for zero CPU overhead | High-throughput gateway ports and switches with MACsec-capable hardware |
Full guidance on selecting and configuring each profile is provided in the Security Profile Guide, available under General Documents below.
RAPIDSEA Secure Ethernet Library provides systematic defence against the attack classes identified in ISO/SAE 21434 TARA threat catalogues for in-vehicle Ethernet networks.
| Attack Vector | RAPIDSEA MACsec Defence | Result |
|---|---|---|
| Eavesdropping / Passive Tap | Full payload encryption | Blocked |
| Frame Injection / Forgery | Cryptographic authentication check on every frame | Blocked |
| Replay Attack | Sequence-based freshness check on every frame | Blocked |
| Frame Tampering / Bit-Flip | Any modification is detected before the frame is accepted | Blocked |
| Man-in-the-Middle (MitM) | Only devices with valid credentials can send frames that get accepted | Blocked |
| Cross-Channel Injection | Frames are bound to their originating channel and rejected elsewhere | Blocked |
| Key Exhaustion / High-Volume Traffic | Automatic key rotation, with Profile 3 engineered for sustained high traffic | Blocked |
| Rogue Node / Unauthorized Device | Devices are authenticated before being admitted to the network | Blocked |
| Denial-of-Service (Frame Flood) | Invalid frames are rejected before reaching the application layer | Mitigated |
| OTA Firmware Spoofing | The OTA channel is encrypted and authenticated end to end | Blocked |
RAPIDSEA Secure Ethernet Library aligns with AUTOSAR FO R24-11 (Requirements on MACsec) and AUTOSAR CP R25-11 (SWS MACsecKeyAgreement). The optional AUTOSAR Interface Layer bridges the library into Classic AUTOSAR BSW, providing a compliant Mka BSW module with the required EthIf, Csm, CryIf, and RTE touchpoints, plus event counters feeding IDSM, so AUTOSAR-based ECUs can adopt it without a custom integration effort. Non-AUTOSAR ECUs use the lean standalone API directly, with the same underlying protection.
The full BSW module mapping, including function-level interfaces and requirement-by-requirement traceability, is provided in the AUTOSAR Adapter Integration Guide under Post-Purchase Documents and Gated Access Resources below.
Standards Compliance
| Standard / Regulation | RAPIDSEA Alignment |
|---|---|
| IEEE 802.1AE-2018 (MACsec) | Full alignment with the MACsec frame format and security requirements |
| IEEE 802.1X-2020 (MKA) | Integrated key agreement module following the automotive timing profile defined by OPEN Alliance TC17 |
| AUTOSAR R24-11 FO_RS_MACsec | Compatible with the full set of AUTOSAR Foundation requirements for MACsec-based Ethernet security |
| AUTOSAR R25-11 CP_SWS_MACsecKeyAgreement | Supported via the optional AUTOSAR Interface Layer |
| OPEN Alliance TC17 | Automotive timing and interoperability profile fully supported |
| NIST SP 800-38D / FIPS 197 | Underlying cryptographic algorithms verified against NIST reference test vectors |
| ISO/SAE 21434 | TARA-aligned threat coverage, documented in our threat mitigation reference |
No MCU-specific code in the library core. Compiles on GHS Multi, IAR, Keil MDK, GCC, and MSVC from one source base.
IEEE 802.1AE, IEEE 802.1X, AUTOSAR FO R24-11, AUTOSAR CP R25-11, OPEN Alliance TC17, NIST SP 800-38D, ISO/SAE 21434
One-time license fee per MCU part number. Deploy across unlimited products and units, with source code delivered.
Pair Secure Ethernet Library with our UDS, DoIP, SOME/IP, and Secure CAN stacks for a complete in-vehicle communication suite.
RAPIDSEA Secure Ethernet Library contains no OS-specific calls and no dynamic memory allocation. It is pre-validated across the most widely adopted RTOS and embedded environments, from bare-metal microcontrollers to full-scale Linux ECUs and AUTOSAR Classic BSW stacks.
| Environment | Status |
|---|---|
| Bare-metal (no OS) | Supported ✅ |
| FreeRTOS | Supported ✅ |
| Zephyr RTOS | Supported ✅ |
| Azure RTOS / ThreadX | Supported ✅ |
| Embedded Linux (netdev) | Supported ✅ |
| Windows (testing / simulation) | Supported ✅ |
| AUTOSAR Classic BSW (Mka module) | Supported ✅ (via AUTOSAR Interface Layer) |
Authenticates and encrypts camera, LiDAR, and RADAR data over high-speed links, preventing injection of false object-detection data; Profile 3 is recommended for multi-gigabit sensor feeds.
Secures the high-bandwidth Ethernet backbone between zonal gateways and the central compute unit, so only authorized devices can join the network.
Encrypts and authenticates SOME/IP service messages between ECUs, replacing insecure plain UDP/IP with Layer-2 MACsec protection without modifying the SOME/IP stack.
Secures the OTA delivery channel from telematics unit to target ECU, encrypting firmware payloads and preventing injection or replay of previous firmware versions.
Protects surround-view camera streams and in-vehicle audio over IEEE 1722 AVTP; Profile 3 and hardware offload (Profile 4) handle continuous high-frame-rate video without interruption.
Authenticates Ethernet-based UDS (ISO 14229) and DoIP (ISO 13400) diagnostic sessions, preventing unauthorized ECU access through diagnostic ports.
Secures the link between the infotainment SoC and cluster HMI display, preventing injection of fake speedometer or warning display data.
Authenticates Ethernet frames on in-vehicle aggregation links carrying V2X data from roadside units and C-V2X modems, so only authenticated external data enters the vehicle network.
RAPIDSEA Secure Ethernet Library has been validated on real automotive hardware across multiple ECU platforms and Ethernet PHYs, confirming correct cryptographic operation, key agreement, frame integrity, and timing compliance with OPEN Alliance TC17.
| Tool / Hardware | Purpose |
|---|---|
| PEAK PCAN-USB Adapter | Frame-level Ethernet capture and inspection |
| Vector VN1610 | Ethernet bus simulation, load testing, and protocol conformance verification |
| Wireshark + MACsec Plugin | Packet-level protocol analysis and verification |
| NIST Reference Test Vectors | Cryptographic conformance testing against published NIST vectors |
| OPEN Alliance TC17 Profile | Startup timing and interoperability validation |
| Built-in Self-Test Suite | Automated verification of cryptographic correctness, tamper detection, and replay rejection |
| Renesas RH850/D1M1A EVB | Primary bare-metal target validation |
| NXP i.MX RT1064 EVK | High-performance platform validation, including hardware-accelerated profiles |
RAPIDSEA Secure Ethernet Library is a portable C99 software library that adds encryption, authentication, key management, and anti-replay protection to automotive Ethernet frames, fully compliant with the IEEE 802.1AE MACsec standard.
