Connected and Autonomous Vehicles (CAVs) represent the future of the automotive industry. In-Vehicle Networks (IVNs) facilitate communication between various components within a vehicle, including Electronic Control Units (ECUs), gateways, and sensors. The Controller Area Network (CAN) is a widely used IVN protocol, but its lack of encryption and confidentiality features makes it vulnerable to cyberattacks. To enhance CAN security, we propose in this paper an efficient key management scheme called ECU-KM for IVNs in CAVs. Our scheme involves a lightweight session key agreement between each ECU and the manufacturer’s data center. We also define configuration and security parameters for CAN and introduce a symmetric cryptography-based key update mechanism to ensure secure and efficient key updates for each ECU. Through a comprehensive security and performance analysis, we demonstrate that ECU-KM is resilient against various attacks while minimizing communication costs. Our findings highlight the potential of ECU-KM to significantly improve the security of CAN-based IVNs in CAVs.