A method for authorizing a function of an embedded electronic control unit, including: a decision gateway requests from a hardware security module a function request destined for the electronic control unit, the decision gateway receives from the hardware security module the function request which is signed by the hardware security module, the decision gateway creates a communication channel, based on a cryptographic identity of the decision gateway, to a backend, the decision gateway sends the function request to the backend, the decision gateway receives from the backend via the communication channel a ticket which corresponds to the function request and is signed by the backend, and the decision gateway stores the ticket.