US20220070159A1 - Secure vehicle control unit update - Google Patents
Secure vehicle control unit update Download PDFInfo
- Publication number
- US20220070159A1 US20220070159A1 US17/525,688 US202117525688A US2022070159A1 US 20220070159 A1 US20220070159 A1 US 20220070159A1 US 202117525688 A US202117525688 A US 202117525688A US 2022070159 A1 US2022070159 A1 US 2022070159A1
- Authority
- US
- United States
- Prior art keywords
- vehicle
- update
- control unit
- private key
- firewall
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000012545 processing Methods 0.000 claims abstract description 24
- 238000000034 method Methods 0.000 claims abstract description 15
- 230000004044 response Effects 0.000 claims abstract description 12
- 238000004891 communication Methods 0.000 claims description 29
- 230000005540 biological transmission Effects 0.000 abstract description 3
- 238000010586 diagram Methods 0.000 description 9
- 238000013459 approach Methods 0.000 description 5
- 230000007246 mechanism Effects 0.000 description 5
- 230000006378 damage Effects 0.000 description 3
- 239000004065 semiconductor Substances 0.000 description 3
- 238000012546 transfer Methods 0.000 description 3
- 208000027418 Wounds and injury Diseases 0.000 description 2
- 238000013473 artificial intelligence Methods 0.000 description 2
- 238000013528 artificial neural network Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 208000014674 injury Diseases 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 108700026140 MAC combination Proteins 0.000 description 1
- 230000006978 adaptation Effects 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 230000006735 deficit Effects 0.000 description 1
- 239000000446 fuel Substances 0.000 description 1
- 238000002347 injection Methods 0.000 description 1
- 239000007924 injection Substances 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000009467 reduction Effects 0.000 description 1
- 230000000153 supplemental effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/575—Secure boot
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
Definitions
- the present disclosure relates generally to semiconductor memory and methods, and more particularly, to apparatuses and methods related to a secure vehicle control unit update.
- the driver is critical to operating the vehicle's control system.
- the driver of a conventional motor vehicle makes decisions regarding the safe operation of the vehicle. Such decisions may include decisions related to the speed of the vehicle, steering of the vehicle, obstacle and/or hazard recognition, and obstacle and/or hazard avoidance.
- a driver's ability to make these decisions and operate the vehicle's control system may be limited in some situations. For example, driver impairment, fatigue, attentiveness, and/or other factors such as visibility (e.g., due to weather or changes in terrain) may limit a driver's ability to safely operate a conventional motor vehicle and/or its control system.
- the firmware and software that a vehicle's control system e.g. control unit
- the updates can be associated with improving the performance of the vehicle.
- autonomous vehicles In order to alleviate the deficiencies resulting from driver operation of a conventional motor vehicle, various manufacturers have experimented with autonomous vehicles. While autonomous vehicles may allow for a reduction in issues that may arise as a result of the driver's ability to operate the conventional motor vehicle becoming lessened, autonomous vehicles have their own shortcomings.
- vehicles including autonomous vehicles, may rely on various control components (e.g., control circuits), sensors, and/or cameras to determine a speed at which to operate the vehicle, steering of the vehicle, obstacle and/or hazard recognition, and obstacle and/or hazard avoidance.
- control components e.g., control circuits
- sensors e.g., sensors
- cameras e.g., cameras
- Such control components, sensors and/or cameras may fail and/or may require additional information (e.g., updates) to safely operate the vehicle from a host computing device responsible for providing updates to the autonomous vehicle.
- the vehicle may cease to operate or, in worse case scenarios, fail to provide adequate obstacle and/or hazard recognition, and obstacle and/or hazard avoidance, which may result in injury or death to passengers in the vehicle.
- FIG. 1 is a block diagram of an apparatus in the form of a firewall and an apparatus in the form of a control unit in accordance with a number of embodiments of the present disclosure.
- FIG. 2 is a block diagram of a system including a host computing device, a remote computing device, a firewall, and a control unit in accordance with a number of embodiments of the present disclosure.
- FIG. 3 is a block diagram of vehicle including a firewall and a control unit in accordance with a number of embodiments of the present disclosure.
- FIG. 4 is a flow diagram in accordance with a number of embodiments of the present disclosure.
- An example apparatus comprises a processing resource coupled to a memory resource.
- the memory resource can be configured to store a private key associated with a vehicle and store data corresponding to an update to a control unit of the vehicle.
- the processing resource can be configured to compare the private key associated with the vehicle and a private key included in the data corresponding to the update to the control unit that is stored in the memory resource and allow transmission of the update to the control unit of the vehicle in response to the private key associated with the vehicle matching the private key included in the data.
- the private key included in the data corresponding to the update to the control unit that is stored in the memory resource can be included in a secure message with a message signature that is generated using a message authentication communication (MAC).
- the private key associated with the vehicle can be stored in a memory resource of the apparatus and included in a signature generated by the processing resource for comparison to the private key included in the data corresponding to the update to the control unit that is stored in the memory resource.
- the secure message may include one or more authentication protocols, which may include one or more anti-replay mechanisms.
- An anti-replay mechanism may include information to indicate a “freshness” of the secure message (e.g., to indicate that the message was generated at or within a particular time period) and/or the additional fields may include one or more anti-replay protocols to alleviate the risk of a man-in-the-middle attack, for example.
- Non-limiting examples of anti-replay mechanisms may include a timestamp (e.g., a secure timestamp) that may be generated and included as part of the anti-replay mechanism, a cryptographic nonce, which may be a random or pseudo-random value that is generated for one time use and included as part of the anti-replay protocol, and/or a count value that may be included as part of the anti-replay mechanism.
- the count value may be a numerical value associated with a counter that is monotonically incremented based on various criteria such as the vehicle being powered on, a vehicle part being installed in the vehicle, etc.
- a vehicle may be under the control of the vehicle manufacturer during production.
- the vehicle manufacturer may provide an initial configuration of the vehicle and/or vehicle components during or directly after production, but prior to the vehicle reaching an end user. However, after the vehicle is no longer under the control of the manufacturer (e.g., once the vehicle has been shipped, purchased, etc.) the manufacturer may no longer have any control over the configuration of the vehicle.
- Updates to a control unit of the vehicle can be communicated from a host computing device (e.g., a computer at a service shop) to the vehicle via an on board diagnostics (ODB) II port.
- ODB on board diagnostics
- an “autonomous vehicle” is a vehicle such as a car, truck, bus, motorcycle, moped, all-terrain vehicle, military vehicle, tank, etc. in which at least a portion of the decision-making and/or control over vehicle operations is controlled by computer hardware and/or software, as opposed to a human operator.
- autonomous vehicles may include one or more artificial intelligence components. These components may be configured to perceive the surrounding environment and take actions to maximize a chance of success of completing a particular goal.
- the particular goal may be operating the autonomous vehicle safely. For example, the goal may be to operate the autonomous vehicle at a safe speed, safely control steering of the autonomous vehicle, and/or providing obstacle and/or hazard recognition, and/or obstacle and/or hazard avoidance.
- control circuitry of a control unit in vehicle may be utilized to update firmware and/or control unit parameters associated with one or more vehicle parts and/or control circuitries.
- the control circuitry of the vehicle may be configured to transfer information such as configuration and/or configuration profile information between the control circuitry and a control module associated with a particular function of a vehicle.
- the control unit of a vehicle can receive updates that can harm a vehicle by causing the vehicle to operate in an unsafe manner or operate such that components of the vehicle are harmed, even to the point of the vehicle becoming inoperable.
- a “configuration profile” is a set of instructions or semantics that manages the functionality of control circuitry, host computing devices, vehicle parts, etc.
- a configuration profile may be firmware, for example.
- vehicles may be susceptible to corrupt updates to a control unit from third parties.
- updates to a vehicle's control circuitry e.g., firmware updates, control unit parameter updates, vehicle object recognition updates, etc.
- updates to a vehicle's control circuitry may be susceptible to man-in-the-middle attacks in which a nefarious actor secretly replays, alters communications, and/or sends corrupt updates between the vehicle and a host computing device responsible for providing updates to the control unit of the vehicle. This may lead to unsafe situations in which a malicious entity may gain control over all or a portion of operation of the vehicle.
- embodiments disclosed herein may allow for secure delivery and implementation of control unit updates between the vehicle and host computing device.
- the data corresponding to the updates may provide updates to the firmware of the vehicle control unit and/or vehicle parts, vehicle part configuration data, trained data sets for operation of the autonomous vehicle's neural network, control unit parameter updates, data collected by the autonomous vehicle such as data corresponding to objects that are unrecognizable to the autonomous vehicle, and the like.
- FIG. 1 is a block diagram of an apparatus 100 in the form of a firewall 102 and control unit 101 in accordance with a number of embodiments of the present disclosure.
- firewall 102 a control unit 101 , processing resource 105 , memory resource 107 , controller 109 , and/or neural network 110 might also be separately considered an “apparatus.”
- apparatus 100 includes a firewall 102 , which includes processing resource 104 , memory resource 106 , and controller 108 .
- the processing resource 104 may be a central processing unit (CPU), semiconductor based microprocessor, integrated circuit based microprocessor, vector processor, and/or other hardware device(s) suitable for retrieval and execution of instructions stored in the memory resource 106 .
- Firewall 102 may be coupled to an on board diagnostics (OBD) II port of a vehicle and received commands, requests, and or data associated with control unit 101 .
- OBD on board diagnostics
- the memory resource 106 may include volatile and/or non-volatile memory configured to store instructions executable by the processing resource 104 .
- the memory resource 106 may include flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), dynamic random-access memory (DRAM), static random-access memory (SRAM), and/or other suitable storage media.
- Memory resource 106 can be configured to store data corresponding to an update for control unit 102 and/or a private key 111 associated with a vehicle.
- the private key 111 may be based, at least in part, on a vehicle identification number (VIN) associated with the vehicle.
- VIN vehicle identification number
- the private key may be based, at least in part, on a VIN, but may not have any information (e.g., numbers and/or digits) in common with the VIN.
- each vehicle manufactured has a unique VIN assigned thereto when the vehicle is being manufactured.
- the VIN may be used to identify a vehicle, among other things.
- the private key 111 can be based, at least in part, on the VIN.
- the private key 111 can be generated such that it is associated with the VIN to facilitate identification of a particular vehicle. Similar to the VIN, the private key may be unique to the vehicle to which it is assigned.
- the private key 111 can be stored in the memory resource 106 when the vehicle is manufactured. Embodiments are not so limited; however, and the private key may be stored in a memory device coupled to the firewall 102 .
- the private key 111 may be read; however, the private key 111 may not be modified. As a result, the integrity of the private key 111 can preserved. In some embodiments, the private key 111 may not be transferred from the vehicle (e.g., the private key 111 may not be transferred across a bus providing a signal path from the control unit to other circuitry in the vehicle and/or a host computing device).
- the private key 111 may be used to ensure that changes made to the control unit of the vehicle that are unauthorized are not allowed.
- the processing resource 105 can compare the private key 111 stored in memory resource 107 to a private key included in data associated with updates to the control unit of the vehicle in order to prevent the use of unauthorized vehicle modification, such as aftermarket tuning. If the private key 111 stored in memory resource 107 matches the private key included in data associated with updates to the control unit of the vehicle, the update is sent from the firewall 101 to the control unit 102 and is executed by the control unit 102 . If the private key 111 stored in memory resource 107 does not match the private key included in data associated with updates to the control unit of the vehicle, the update is not sent from the firewall 101 to the control unit 102 and the update is not executed by the control unit 102 .
- the controller 108 can be configured to control operation of the firewall 102 .
- the controller 108 can decode signals received to the firewall 102 that are used to control operation of the firewall 102 and control unit 101 .
- the controller 108 can be a state machine, sequencer, or some other type of controller, and can include hardware and/or firmware (e.g., microcode instructions) in the form of an application specific integrated circuit (ASIC), field programmable gate array, etc.
- the controller 108 can control generation and decoding of secure messages transmitted between the control unit 101 , firewall 102 , and a host computing device (e.g., host computing device 203 illustrated in FIG. 2 ).
- a host computing device e.g., host computing device 203 illustrated in FIG. 2 .
- apparatus 100 includes a control unit 101 (e.g., a vehicle electronic control unit), which includes processing resource 104 , memory resource 107 , and controller 109 .
- the processing resource may be a central processing unit (CPU), semiconductor based microprocessor, integrated circuit based microprocessor, vector processor, and/or other hardware device(s) suitable for retrieval and execution of instructions stored in the memory resource 107 .
- the memory resource 107 may include volatile and/or non-volatile memory configured to store instructions executable by the processing resource 104 .
- the memory resource 107 may include flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), dynamic random-access memory (DRAM), static random-access memory (SRAM), and/or other suitable storage media.
- Control unit 201 may correspond to various electronic control units utilized by the vehicle.
- control unit 201 may include an engine control component, a vehicle control component, a powertrain control component, an electronic brake control component, a body control components, and/or combinations thereof. These components may be responsible for performing and/or coordinating performance of various vehicle tasks such as operating the vehicle, steering the vehicle, controlling braking of the vehicle, etc.
- An engine control component may include hardware and/or instructions configure to control actuators of the engine of the vehicle.
- the engine control component may control ignition timing, air-to-fuel ratios, etc. of the vehicle.
- the vehicle control component may include hardware and/or software configured to control engine and/or vehicle performance.
- the powertrain control component may include hardware and/or software to control the powertrain of the vehicle.
- the electronic brake control component may include hardware and/or software to control and/or read data corresponding to the braking system of the vehicle, and the body control component may include hardware and/or software configured to control body features of the vehicle such as power windows, power seats, etc.
- the memory resource 107 may store a private key 111 associated with a vehicle.
- the private key 111 may be based, at least in part, on a vehicle identification number (VIN) associated with the vehicle.
- VIN vehicle identification number
- each vehicle manufactured has a unique VIN assigned thereto when the vehicle is being manufactured.
- the VIN may be used to identify a vehicle, among other things.
- the private key 111 can be based, at least in part, on the VIN.
- the private key 111 can be generated such that it is associated with the VIN to facilitate identification of a particular vehicle. Similar to the VIN, the private key may be unique to the vehicle to which it is assigned.
- the private key 111 can be stored in the memory resource 107 when the vehicle is manufactured. Embodiments are not so limited; however, and the private key may be stored in a memory device coupled to the control unit 101 .
- the private key 111 may be read; however, the private key 111 may not be modified. As a result, the integrity of the private key 111 can preserved. In some embodiments, the private key 111 may not be transferred from the vehicle (e.g., the private key 111 may not be transferred across a bus providing a signal path from the control unit to other circuitry in the vehicle and/or a host computing device).
- the controller 109 can be configured to control operation of the control unit 101 .
- the controller 109 can decode signals received to the control unit 101 that are used to control operation of the control unit 101 .
- the controller 109 can be a state machine, sequencer, or some other type of controller, and can include hardware and/or firmware (e.g., microcode instructions) in the form of an application specific integrated circuit (ASIC), field programmable gate array, etc.
- the controller 109 can control generation and decoding of secure messages transmitted between the control unit 101 and a host computing device (e.g., host computing device 203 illustrated in FIG. 2 ).
- FIG. 2 is a block diagram of a system including a host computing device 203 , remote computing device 213 , firewall 202 , and control unit 201 in accordance with a number of embodiments of the present disclosure.
- the control unit 201 , firewall 202 , and the host computing device 203 may be configured to exchange communications via communication paths 215 and 217 .
- communication path 215 may be utilized to transfer communications from the control unit 201 to the host computing device 203 via firewall 202
- communication path 217 may be utilized to transfer communications from the host computing device 203 to the control unit 201 via firewall 202 .
- Communication paths 215 and/or 217 may represent paths over which wired and/or wireless communications between the control unit 201 , firewall 202 , and the host computing device 203 may be transferred.
- various communication protocols may be used.
- various on board diagnostic protocols e.g., OBD-II protocols
- SAE J1850 PWM or SAE J1850 VPM may be used to facilitate communication between the control unit 201 and the host computing device 203 .
- Examples are not so limited; however, and the communication protocol between the control unit 201 and the host computing device 203 may include protocols such as ISO 9141-2, ISO 14230 KPW2000, ISO 15765 CAN, Ethernet, local area network, FlexRay, etc.
- Host computing device 203 can include a port 216 (e.g., an OBD II port) and firewall 202 can include port 218 (e.g., an OBD II port), wherein the host computing device 203 and firewall 202 can send communications between ports 216 and 218 on communication paths 215 and/or 217 .
- a port 216 e.g., an OBD II port
- firewall 202 can include port 218 (e.g., an OBD II port)
- the host computing device 203 and firewall 202 can send communications between ports 216 and 218 on communication paths 215 and/or 217 .
- the system may include a gateway 219 .
- the gateway 219 may be a network gateway configured to interface between devices that use different protocols.
- a protocol used by the control unit 201 and firewall 202 may be different than a protocol used by the host computing device 203
- the gateway 219 may be configured to facilitate communication between the control unit 201 , firewall 202 , and the host computing device 203 .
- the gateway 219 includes hardware configured to convert between the protocols used by the control unit 201 , firewall 202 , and the host computing device 203 .
- gateway 219 can calculate signatures for secure messages using a protocol (e.g., a MAC protocol) that are based on a private key.
- a protocol e.g., a MAC protocol
- the gateway 219 may be configured as an internet gateway, cloud gateway, internet of things gateway, server, or other suitable gateway for facilitating communication between the control unit 201 , firewall 202 , and the host computing device 203 .
- the gateway may be disposed in the vehicle or the gateway may be disposed in or near the host computing device 203 (e.g., the gateway may be remote to the vehicle).
- the host computing device 203 and the remote computing device 213 may include hardware configured to perform particular tasks (e.g., a physical computing device, server, etc.), and/or the host computing device 203 and the remote computing device 213 may be deployed as part of a software defined data center (e.g., as a virtualized computing device).
- the host computing device 203 and the remote computing device 213 may be located in a geophysically different locations from each other and the control unit 201 and firewall 202 , which may be disposed in an vehicle as described in more detail in connection with FIG. 3 , herein.
- the remote computing device 213 may be maintained by the manufacturer of the autonomous vehicle and host computing device 203 may be maintained by a vehicle service provider (e.g., a mechanics shop).
- the remote computing device 213 may be under the control of the manufacturer of the vehicle and/or the manufacturer of a vehicle part and the host computing device 203 may be under the control of a certified service provider associated with the manufacturer of the vehicle.
- the host computing device 203 can be coupled to the remote computing device 213 has part of a wired and/or wireless network, including a gateway, such as gateway 219 .
- the host computing device 203 can send a request to update the control unit 201 to the firewall 202 via port 216 , communication path 217 , and port 218 .
- the firewall 202 can recognize the request as a request to write data to the control unit 201 and, in response, send a vehicle identification number (VIN) for the vehicle to the host computing device 203 via port 218 , communication path 215 , and port 216 .
- VIN vehicle identification number
- the host computing device 203 can send the VIN along with a request for data associated with the update to control unit 201 to the remote computing device 213 .
- the remote computing device 213 can send data corresponding to the update, along with a private key associated with the VIN, back to the host computing device 203 .
- the host computing device 203 can send the data corresponding to the update to the firewall 202 .
- the firewall 202 can store the data corresponding to the update to a memory resource on the firewall 202 .
- the firewall can compare the private key included in the data corresponding to the update to the control unit to a private key stored in the firewall. If the private key included in the data corresponding to the update to the control unit matches the private key stored in the firewall, the update is authorized by the firewall and the data corresponding to the update is sent to the control unit.
- data corresponding to the update to the control unit including the private key can sent as a secure message.
- the secure message can be decrypted by the firewall 202 .
- the host computing device 203 can send a request to obtain data from the control unit 201 to the firewall 202 via port 216 , communication path 217 , and port 218 .
- the firewall 202 can recognize the request as a request to read data from the control unit 201 .
- the firewall 202 can, in response, send the request to control unit 201 and the control unit 201 can send requested data to the host computing device 203 .
- the requested data can be sent without the firewall authorizing the request based on matching private keys.
- the private key stored in the memory resource of firewall 202 can be included in a secure key generated by the processing resource of the firewall 202 .
- the secure key can include a signature that includes the private key stored in the memory resource of firewall 202 .
- the host processing device 203 , the remote processing device, firewall 202 , and control unit 201 can communicate via secure messages.
- the update for the control unit can be included in a secure message that is sent from the remote computing device 213 to the host computing device 203 and in a secure message that is sent from the host computing device 203 to the firewall 202 .
- the secure messages can include a header.
- the header may include supplemental data placed at the beginning of the secure message.
- the header may include control information to provide for delivering the secure message, for example.
- the secure messages may include a typology identification.
- the typology identification may include classification information associated with a particular control unit, an update to the control unit, a control component, a host computing device, etc.
- the typology identification may include information corresponding to a manufacturer, make, and/or model of the control unit, update to the control unit, control component, host computing device, etc.
- the secure messages may include a vehicle identification number (VIN) associated with the vehicle.
- VIN vehicle identification number
- the VIN may be used to identify the particular vehicle associated with the secure message.
- the VIN may be concatenated with (e.g., on top of) the typology identification.
- the secure messages may further include the serial number.
- the serial number may be a serial number of a particular control unit, update to the control unit, control component, host computing device, etc.
- the serial number may provide specific identification information regarding the particular control unit, update to the control unit, control component, host computing device, etc.
- the serial number may be concatenated with (e.g., on top of) the VIN and/or typology identification.
- the secure messages may further include a private key.
- the private key can be generated and included in a signature such that it is associated with the VIN to facilitate identification of a particular vehicle. Similar to the VIN, the private key may be unique to the vehicle to which it is assigned. The private key may be concatenated with (e.g., on top of) the serial number, VIN and/or typology identification.
- the secure messages may further include a counter value.
- the counter value may correspond to a value generated by a counter, as described above.
- the counter may be a monotonic counter.
- the counter may be incremented in response to a power cycle of the vehicle, update to the control unit, host computing device, control unit(s), control component(s), or combinations thereof.
- the counter value may be concatenated with (e.g., on top of) the private key, the serial number, VIN and/or typology identification.
- the secure messages may further include a payload.
- the payload 536 may include a message to be exchanged between the host computing device, vehicle part, control component, and/or control unit(s).
- the payload may include data for an update to the control unit of the vehicle.
- the secure communication may further include an authentication protocol.
- the authentication protocol may comprise an anti-replay authentication protocol.
- the authentication protocol may be provided to alleviate the risk of man-in-the-middle or other malicious packet injection attacks.
- the authentication protocol may be uniquely generated each time the host computing device generates the secure message.
- the authentication protocol may include additional fields.
- the authentication protocol may include a timestamp indicating when the secure message was generated or transmitted.
- the authentication protocol may include a random value (e.g., a cryptographic nonce).
- the authentication protocol may include a count value that is incremented (e.g., monotonically) as each secure message is generated.
- the secure messages may further include a message authentication code (MAC).
- the MAC may be generated by the host computing device, remote computing device, vehicle, vehicle part, control unit(s), control component(s), and/or host computing device, etc. from the vehicle may comprise information to authenticate the secure message and/or to alleviate the risk of a man-in-the-middle attack and to guarantee the system against the anti-replay attack.
- the MAC based on a secret key it may be a hash-based message authentication code (HMAC).
- the MAC may be based on the private key, and may comprise a HMAC.
- the MAC may be generated by the host computing device, remote computing device, and/or control unit. In some embodiments, the MAC may be generated based on the private key.
- the secure messages may further include footer.
- the footer may include information related to handling the secure message, and/or the footer may include information signifying the end of the secure message. In some embodiments, the footer may include information concerning the destination of the secure message.
- FIG. 3 is a diagram of a system in the form of a vehicle 360 in accordance with a number of embodiments of the present disclosure.
- the vehicle 360 may include control unit 301 and firewall 302 .
- the firewall 302 includes a processing resource 304 , memory resource 306 , and controller 308 .
- the firewall 302 is configured to communicate with the control unit 301 via communication path 322 .
- Communication path 322 may be used to transmit communications from the control unit 301 to the firewall 302 as well as from the firewall 302 to the control unit 301 .
- the firewall can include a processing resource 304 and memory resource 306 .
- Memory resource 306 can store a private key associated with vehicle 360 and also data corresponding to the update to the control unit that was sent to the firewall from a host computing device.
- the processing resource 304 can compare the private key included in the data corresponding to the update to the control unit to the private key stored in the memory resource 306 . If the private key included in the data corresponding to the update to the control unit matches the private key stored in the memory resource 306 , the controller 308 authorizes the update and sends the data corresponding to the update to the control unit 301 via communication pay 322 .
- FIG. 4 is a flow diagram 450 in accordance with a number of embodiments of the present disclosure.
- the flow diagram 450 may represent performance of a method.
- storing a private key associated with a vehicle In some embodiments, a firewall on a vehicle may store the private key and use the private key to authorize updates to a control unit of a vehicle.
- the method may include storing data corresponding to an update to a control unit of the vehicle.
- the firewall may receive a request to update the control unit of the vehicle.
- the firewall can store the data corresponding to the update in a memory resource on the firewall while the firewall is determining whether or not to authorize updates to the control unit of the vehicle.
- the method may include comparing the private key associated with the vehicle and a private key included in the data associated with the data stored in the memory resource.
- the data associated with the update may include a private key. This private key included in the data associated with the update can be compared to the private key stored in a memory resource on the firewall.
- the method may include allowing transmission of the update to the control unit of the vehicle in response to the private key associated with the vehicle matching the private key included in the data.
- the update can be authorized by the firewall and the data associated with the update can be sent to the control unit and executed by the control unit.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Radar, Positioning & Navigation (AREA)
- Remote Sensing (AREA)
- Small-Scale Networks (AREA)
- Automation & Control Theory (AREA)
- Aviation & Aerospace Engineering (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Multimedia (AREA)
- Electromagnetism (AREA)
Abstract
Description
- This application is a Continuation of U.S. application Ser. No. 15/847,373, filed on Dec. 19, 2017, which will issue as U.S. Pat. No. 11,178,133 on Nov. 16, 2021, the contents of which are incorporated herein by reference.
- The present disclosure relates generally to semiconductor memory and methods, and more particularly, to apparatuses and methods related to a secure vehicle control unit update.
- In conventional motor vehicles (e.g., automobiles, cars, trucks, buses, etc.), the driver is critical to operating the vehicle's control system. For example, the driver of a conventional motor vehicle makes decisions regarding the safe operation of the vehicle. Such decisions may include decisions related to the speed of the vehicle, steering of the vehicle, obstacle and/or hazard recognition, and obstacle and/or hazard avoidance. However, a driver's ability to make these decisions and operate the vehicle's control system may be limited in some situations. For example, driver impairment, fatigue, attentiveness, and/or other factors such as visibility (e.g., due to weather or changes in terrain) may limit a driver's ability to safely operate a conventional motor vehicle and/or its control system. Also, the firmware and software that a vehicle's control system (e.g. control unit) may be updated. The updates can be associated with improving the performance of the vehicle.
- In order to alleviate the deficiencies resulting from driver operation of a conventional motor vehicle, various manufacturers have experimented with autonomous vehicles. While autonomous vehicles may allow for a reduction in issues that may arise as a result of the driver's ability to operate the conventional motor vehicle becoming lessened, autonomous vehicles have their own shortcomings.
- For example, vehicles, including autonomous vehicles, may rely on various control components (e.g., control circuits), sensors, and/or cameras to determine a speed at which to operate the vehicle, steering of the vehicle, obstacle and/or hazard recognition, and obstacle and/or hazard avoidance. Such control components, sensors and/or cameras may fail and/or may require additional information (e.g., updates) to safely operate the vehicle from a host computing device responsible for providing updates to the autonomous vehicle. If the control components, sensors, and/or cameras fail or do not receive adequate or properly configured information to continue to operate the vehicle, the vehicle may cease to operate or, in worse case scenarios, fail to provide adequate obstacle and/or hazard recognition, and obstacle and/or hazard avoidance, which may result in injury or death to passengers in the vehicle.
-
FIG. 1 is a block diagram of an apparatus in the form of a firewall and an apparatus in the form of a control unit in accordance with a number of embodiments of the present disclosure. -
FIG. 2 is a block diagram of a system including a host computing device, a remote computing device, a firewall, and a control unit in accordance with a number of embodiments of the present disclosure. -
FIG. 3 is a block diagram of vehicle including a firewall and a control unit in accordance with a number of embodiments of the present disclosure. -
FIG. 4 is a flow diagram in accordance with a number of embodiments of the present disclosure. - The present disclosure includes apparatuses and methods related to a secure vehicle control unit update. An example apparatus comprises a processing resource coupled to a memory resource. The memory resource can be configured to store a private key associated with a vehicle and store data corresponding to an update to a control unit of the vehicle. The processing resource can be configured to compare the private key associated with the vehicle and a private key included in the data corresponding to the update to the control unit that is stored in the memory resource and allow transmission of the update to the control unit of the vehicle in response to the private key associated with the vehicle matching the private key included in the data. For example, the private key included in the data corresponding to the update to the control unit that is stored in the memory resource can be included in a secure message with a message signature that is generated using a message authentication communication (MAC). The private key associated with the vehicle can be stored in a memory resource of the apparatus and included in a signature generated by the processing resource for comparison to the private key included in the data corresponding to the update to the control unit that is stored in the memory resource.
- In some embodiments, the secure message may include one or more authentication protocols, which may include one or more anti-replay mechanisms. An anti-replay mechanism may include information to indicate a “freshness” of the secure message (e.g., to indicate that the message was generated at or within a particular time period) and/or the additional fields may include one or more anti-replay protocols to alleviate the risk of a man-in-the-middle attack, for example. Non-limiting examples of anti-replay mechanisms may include a timestamp (e.g., a secure timestamp) that may be generated and included as part of the anti-replay mechanism, a cryptographic nonce, which may be a random or pseudo-random value that is generated for one time use and included as part of the anti-replay protocol, and/or a count value that may be included as part of the anti-replay mechanism. In some embodiments, the count value may be a numerical value associated with a counter that is monotonically incremented based on various criteria such as the vehicle being powered on, a vehicle part being installed in the vehicle, etc.
- A vehicle may be under the control of the vehicle manufacturer during production. The vehicle manufacturer may provide an initial configuration of the vehicle and/or vehicle components during or directly after production, but prior to the vehicle reaching an end user. However, after the vehicle is no longer under the control of the manufacturer (e.g., once the vehicle has been shipped, purchased, etc.) the manufacturer may no longer have any control over the configuration of the vehicle.
- Updates to a control unit of the vehicle can be communicated from a host computing device (e.g., a computer at a service shop) to the vehicle via an on board diagnostics (ODB) II port. Due to the manufacturer's lack of control over the vehicle once it leaves their possession, an end user (e.g., a purchaser of a vehicle) and/or vehicle service center (e.g., mechanic) may potentially install updates to the control unit of the vehicle that are not properly configured and may result in harmful operation of the vehicle. This may be further exacerbated in autonomous vehicle deployments in which multiple functions of a vehicle may be controlled via control circuitry (e.g., hardware) and/or artificial intelligence components, because the update to the control unit of the vehicle may not be properly configured, which may result in failure of the vehicle and, in extreme case, injury or death to the vehicle operator. As used herein, an “autonomous vehicle” is a vehicle such as a car, truck, bus, motorcycle, moped, all-terrain vehicle, military vehicle, tank, etc. in which at least a portion of the decision-making and/or control over vehicle operations is controlled by computer hardware and/or software, as opposed to a human operator.
- In some approaches, autonomous vehicles may include one or more artificial intelligence components. These components may be configured to perceive the surrounding environment and take actions to maximize a chance of success of completing a particular goal. In autonomous vehicles, the particular goal may be operating the autonomous vehicle safely. For example, the goal may be to operate the autonomous vehicle at a safe speed, safely control steering of the autonomous vehicle, and/or providing obstacle and/or hazard recognition, and/or obstacle and/or hazard avoidance.
- In some approaches, the control circuitry of a control unit in vehicle may be utilized to update firmware and/or control unit parameters associated with one or more vehicle parts and/or control circuitries. For example, in some approaches, the control circuitry of the vehicle may be configured to transfer information such as configuration and/or configuration profile information between the control circuitry and a control module associated with a particular function of a vehicle. However, in some approaches, the control unit of a vehicle can receive updates that can harm a vehicle by causing the vehicle to operate in an unsafe manner or operate such that components of the vehicle are harmed, even to the point of the vehicle becoming inoperable. As used herein, a “configuration profile” is a set of instructions or semantics that manages the functionality of control circuitry, host computing devices, vehicle parts, etc. In some embodiments, a configuration profile may be firmware, for example.
- For example, because operation of the control system in a vehicle may be wholly or partly handled by control circuitry, vehicles may be susceptible to corrupt updates to a control unit from third parties. In some approaches, updates to a vehicle's control circuitry (e.g., firmware updates, control unit parameter updates, vehicle object recognition updates, etc.), for example, may be susceptible to man-in-the-middle attacks in which a nefarious actor secretly replays, alters communications, and/or sends corrupt updates between the vehicle and a host computing device responsible for providing updates to the control unit of the vehicle. This may lead to unsafe situations in which a malicious entity may gain control over all or a portion of operation of the vehicle.
- In contrast, embodiments disclosed herein may allow for secure delivery and implementation of control unit updates between the vehicle and host computing device. The data corresponding to the updates may provide updates to the firmware of the vehicle control unit and/or vehicle parts, vehicle part configuration data, trained data sets for operation of the autonomous vehicle's neural network, control unit parameter updates, data collected by the autonomous vehicle such as data corresponding to objects that are unrecognizable to the autonomous vehicle, and the like.
- The figures herein follow a numbering convention in which the first digit or digits correspond to the drawing figure number and the remaining digits identify an element or component in the drawing. Similar elements or components between different figures may be identified by the use of similar digits. For example, 101 may reference element “02” in
FIG. 1 , and a similar element may be referenced as 202 inFIG. 2 . As will be appreciated, elements shown in the various embodiments herein can be added, exchanged, and/or eliminated so as to provide a number of additional embodiments of the present disclosure. In addition, as will be appreciated, the proportion and the relative scale of the elements provided in the figures are intended to illustrate certain embodiments of the present invention, and should not be taken in a limiting sense. -
FIG. 1 is a block diagram of anapparatus 100 in the form of afirewall 102 andcontrol unit 101 in accordance with a number of embodiments of the present disclosure. As used herein,firewall 102, acontrol unit 101,processing resource 105,memory resource 107,controller 109, and/or neural network 110 might also be separately considered an “apparatus.” - As shown in
FIG. 1 ,apparatus 100 includes afirewall 102, which includesprocessing resource 104,memory resource 106, andcontroller 108. Theprocessing resource 104 may be a central processing unit (CPU), semiconductor based microprocessor, integrated circuit based microprocessor, vector processor, and/or other hardware device(s) suitable for retrieval and execution of instructions stored in thememory resource 106.Firewall 102 may be coupled to an on board diagnostics (OBD) II port of a vehicle and received commands, requests, and or data associated withcontrol unit 101. - The
memory resource 106 may include volatile and/or non-volatile memory configured to store instructions executable by theprocessing resource 104. For example, thememory resource 106 may include flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), dynamic random-access memory (DRAM), static random-access memory (SRAM), and/or other suitable storage media. -
Memory resource 106 can be configured to store data corresponding to an update forcontrol unit 102 and/or aprivate key 111 associated with a vehicle. Theprivate key 111 may be based, at least in part, on a vehicle identification number (VIN) associated with the vehicle. The private key may be based, at least in part, on a VIN, but may not have any information (e.g., numbers and/or digits) in common with the VIN. In general, each vehicle manufactured has a unique VIN assigned thereto when the vehicle is being manufactured. The VIN may be used to identify a vehicle, among other things. - As discussed above, the
private key 111 can be based, at least in part, on the VIN. For example, theprivate key 111 can be generated such that it is associated with the VIN to facilitate identification of a particular vehicle. Similar to the VIN, the private key may be unique to the vehicle to which it is assigned. In some embodiments, theprivate key 111 can be stored in thememory resource 106 when the vehicle is manufactured. Embodiments are not so limited; however, and the private key may be stored in a memory device coupled to thefirewall 102. - The
private key 111 may be read; however, theprivate key 111 may not be modified. As a result, the integrity of theprivate key 111 can preserved. In some embodiments, theprivate key 111 may not be transferred from the vehicle (e.g., theprivate key 111 may not be transferred across a bus providing a signal path from the control unit to other circuitry in the vehicle and/or a host computing device). - In some embodiments, the
private key 111 may be used to ensure that changes made to the control unit of the vehicle that are unauthorized are not allowed. For example, theprocessing resource 105 can compare theprivate key 111 stored inmemory resource 107 to a private key included in data associated with updates to the control unit of the vehicle in order to prevent the use of unauthorized vehicle modification, such as aftermarket tuning. If theprivate key 111 stored inmemory resource 107 matches the private key included in data associated with updates to the control unit of the vehicle, the update is sent from thefirewall 101 to thecontrol unit 102 and is executed by thecontrol unit 102. If theprivate key 111 stored inmemory resource 107 does not match the private key included in data associated with updates to the control unit of the vehicle, the update is not sent from thefirewall 101 to thecontrol unit 102 and the update is not executed by thecontrol unit 102. - The
controller 108 can be configured to control operation of thefirewall 102. In some embodiments, thecontroller 108 can decode signals received to thefirewall 102 that are used to control operation of thefirewall 102 andcontrol unit 101. Thecontroller 108 can be a state machine, sequencer, or some other type of controller, and can include hardware and/or firmware (e.g., microcode instructions) in the form of an application specific integrated circuit (ASIC), field programmable gate array, etc. In some embodiments, thecontroller 108 can control generation and decoding of secure messages transmitted between thecontrol unit 101,firewall 102, and a host computing device (e.g.,host computing device 203 illustrated inFIG. 2 ). - As shown in
FIG. 1 ,apparatus 100 includes a control unit 101 (e.g., a vehicle electronic control unit), which includesprocessing resource 104,memory resource 107, andcontroller 109. The processing resource may be a central processing unit (CPU), semiconductor based microprocessor, integrated circuit based microprocessor, vector processor, and/or other hardware device(s) suitable for retrieval and execution of instructions stored in thememory resource 107. - The
memory resource 107 may include volatile and/or non-volatile memory configured to store instructions executable by theprocessing resource 104. For example, thememory resource 107 may include flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), dynamic random-access memory (DRAM), static random-access memory (SRAM), and/or other suitable storage media. -
Control unit 201 may correspond to various electronic control units utilized by the vehicle. For example,control unit 201 may include an engine control component, a vehicle control component, a powertrain control component, an electronic brake control component, a body control components, and/or combinations thereof. These components may be responsible for performing and/or coordinating performance of various vehicle tasks such as operating the vehicle, steering the vehicle, controlling braking of the vehicle, etc. - An engine control component may include hardware and/or instructions configure to control actuators of the engine of the vehicle. For example, the engine control component may control ignition timing, air-to-fuel ratios, etc. of the vehicle. The vehicle control component may include hardware and/or software configured to control engine and/or vehicle performance.
- The powertrain control component may include hardware and/or software to control the powertrain of the vehicle. The electronic brake control component may include hardware and/or software to control and/or read data corresponding to the braking system of the vehicle, and the body control component may include hardware and/or software configured to control body features of the vehicle such as power windows, power seats, etc.
- The
memory resource 107 may store aprivate key 111 associated with a vehicle. Theprivate key 111 may be based, at least in part, on a vehicle identification number (VIN) associated with the vehicle. In general, each vehicle manufactured has a unique VIN assigned thereto when the vehicle is being manufactured. The VIN may be used to identify a vehicle, among other things. - As discussed above, the
private key 111 can be based, at least in part, on the VIN. For example, theprivate key 111 can be generated such that it is associated with the VIN to facilitate identification of a particular vehicle. Similar to the VIN, the private key may be unique to the vehicle to which it is assigned. In some embodiments, theprivate key 111 can be stored in thememory resource 107 when the vehicle is manufactured. Embodiments are not so limited; however, and the private key may be stored in a memory device coupled to thecontrol unit 101. - The
private key 111 may be read; however, theprivate key 111 may not be modified. As a result, the integrity of theprivate key 111 can preserved. In some embodiments, theprivate key 111 may not be transferred from the vehicle (e.g., theprivate key 111 may not be transferred across a bus providing a signal path from the control unit to other circuitry in the vehicle and/or a host computing device). - The
controller 109 can be configured to control operation of thecontrol unit 101. In some embodiments, thecontroller 109 can decode signals received to thecontrol unit 101 that are used to control operation of thecontrol unit 101. Thecontroller 109 can be a state machine, sequencer, or some other type of controller, and can include hardware and/or firmware (e.g., microcode instructions) in the form of an application specific integrated circuit (ASIC), field programmable gate array, etc. In some embodiments, thecontroller 109 can control generation and decoding of secure messages transmitted between thecontrol unit 101 and a host computing device (e.g.,host computing device 203 illustrated inFIG. 2 ). -
FIG. 2 is a block diagram of a system including ahost computing device 203,remote computing device 213,firewall 202, andcontrol unit 201 in accordance with a number of embodiments of the present disclosure. As shown inFIG. 2 , thecontrol unit 201,firewall 202, and thehost computing device 203 may be configured to exchange communications viacommunication paths communication path 215 may be utilized to transfer communications from thecontrol unit 201 to thehost computing device 203 viafirewall 202, andcommunication path 217 may be utilized to transfer communications from thehost computing device 203 to thecontrol unit 201 viafirewall 202.Communication paths 215 and/or 217 may represent paths over which wired and/or wireless communications between thecontrol unit 201,firewall 202, and thehost computing device 203 may be transferred. - In order to facilitate communication between the
control unit 201 and thehost computing device 203, various communication protocols may be used. For example, various on board diagnostic protocols (e.g., OBD-II protocols) such as SAE J1850 PWM or SAE J1850 VPM may be used to facilitate communication between thecontrol unit 201 and thehost computing device 203. Examples are not so limited; however, and the communication protocol between thecontrol unit 201 and thehost computing device 203 may include protocols such as ISO 9141-2, ISO 14230 KPW2000, ISO 15765 CAN, Ethernet, local area network, FlexRay, etc.Host computing device 203 can include a port 216 (e.g., an OBD II port) andfirewall 202 can include port 218 (e.g., an OBD II port), wherein thehost computing device 203 andfirewall 202 can send communications betweenports communication paths 215 and/or 217. - In some embodiments, the system may include a
gateway 219. As used herein, thegateway 219 may be a network gateway configured to interface between devices that use different protocols. For example, a protocol used by thecontrol unit 201 andfirewall 202 may be different than a protocol used by thehost computing device 203, and thegateway 219 may be configured to facilitate communication between thecontrol unit 201,firewall 202, and thehost computing device 203. In some embodiments, thegateway 219 includes hardware configured to convert between the protocols used by thecontrol unit 201,firewall 202, and thehost computing device 203. For example,gateway 219 can calculate signatures for secure messages using a protocol (e.g., a MAC protocol) that are based on a private key. - The
gateway 219 may be configured as an internet gateway, cloud gateway, internet of things gateway, server, or other suitable gateway for facilitating communication between thecontrol unit 201,firewall 202, and thehost computing device 203. In some embodiments, the gateway may be disposed in the vehicle or the gateway may be disposed in or near the host computing device 203 (e.g., the gateway may be remote to the vehicle). - The
host computing device 203 and theremote computing device 213 may include hardware configured to perform particular tasks (e.g., a physical computing device, server, etc.), and/or thehost computing device 203 and theremote computing device 213 may be deployed as part of a software defined data center (e.g., as a virtualized computing device). In some embodiments, thehost computing device 203 and theremote computing device 213 may be located in a geophysically different locations from each other and thecontrol unit 201 andfirewall 202, which may be disposed in an vehicle as described in more detail in connection withFIG. 3 , herein. Theremote computing device 213 may be maintained by the manufacturer of the autonomous vehicle andhost computing device 203 may be maintained by a vehicle service provider (e.g., a mechanics shop). For example, theremote computing device 213 may be under the control of the manufacturer of the vehicle and/or the manufacturer of a vehicle part and thehost computing device 203 may be under the control of a certified service provider associated with the manufacturer of the vehicle. Thehost computing device 203 can be coupled to theremote computing device 213 has part of a wired and/or wireless network, including a gateway, such asgateway 219. - In some embodiments, the
host computing device 203 can send a request to update thecontrol unit 201 to thefirewall 202 viaport 216,communication path 217, andport 218. Thefirewall 202 can recognize the request as a request to write data to thecontrol unit 201 and, in response, send a vehicle identification number (VIN) for the vehicle to thehost computing device 203 viaport 218,communication path 215, andport 216. Thehost computing device 203 can send the VIN along with a request for data associated with the update to controlunit 201 to theremote computing device 213. Theremote computing device 213 can send data corresponding to the update, along with a private key associated with the VIN, back to thehost computing device 203. Thehost computing device 203 can send the data corresponding to the update to thefirewall 202. Thefirewall 202 can store the data corresponding to the update to a memory resource on thefirewall 202. The firewall can compare the private key included in the data corresponding to the update to the control unit to a private key stored in the firewall. If the private key included in the data corresponding to the update to the control unit matches the private key stored in the firewall, the update is authorized by the firewall and the data corresponding to the update is sent to the control unit. - In some embodiments, data corresponding to the update to the control unit including the private key can sent as a secure message. The secure message can be decrypted by the
firewall 202. - In some embodiments, the
host computing device 203 can send a request to obtain data from thecontrol unit 201 to thefirewall 202 viaport 216,communication path 217, andport 218. Thefirewall 202 can recognize the request as a request to read data from thecontrol unit 201. Thefirewall 202 can, in response, send the request to controlunit 201 and thecontrol unit 201 can send requested data to thehost computing device 203. The requested data can be sent without the firewall authorizing the request based on matching private keys. - The private key stored in the memory resource of
firewall 202 can be included in a secure key generated by the processing resource of thefirewall 202. The secure key can include a signature that includes the private key stored in the memory resource offirewall 202. - The
host processing device 203, the remote processing device,firewall 202, andcontrol unit 201 can communicate via secure messages. For example, the update for the control unit can be included in a secure message that is sent from theremote computing device 213 to thehost computing device 203 and in a secure message that is sent from thehost computing device 203 to thefirewall 202. The secure messages can include a header. The header may include supplemental data placed at the beginning of the secure message. The header may include control information to provide for delivering the secure message, for example. - The secure messages may include a typology identification. The typology identification may include classification information associated with a particular control unit, an update to the control unit, a control component, a host computing device, etc. For example, the typology identification may include information corresponding to a manufacturer, make, and/or model of the control unit, update to the control unit, control component, host computing device, etc.
- The secure messages may include a vehicle identification number (VIN) associated with the vehicle. The VIN may be used to identify the particular vehicle associated with the secure message. In some embodiments, the VIN may be concatenated with (e.g., on top of) the typology identification.
- The secure messages may further include the serial number. The serial number may be a serial number of a particular control unit, update to the control unit, control component, host computing device, etc. In some embodiments, the serial number may provide specific identification information regarding the particular control unit, update to the control unit, control component, host computing device, etc. The serial number may be concatenated with (e.g., on top of) the VIN and/or typology identification.
- The secure messages may further include a private key. The private key can be generated and included in a signature such that it is associated with the VIN to facilitate identification of a particular vehicle. Similar to the VIN, the private key may be unique to the vehicle to which it is assigned. The private key may be concatenated with (e.g., on top of) the serial number, VIN and/or typology identification.
- The secure messages may further include a counter value. The counter value may correspond to a value generated by a counter, as described above. In some embodiments, the counter may be a monotonic counter. The counter may be incremented in response to a power cycle of the vehicle, update to the control unit, host computing device, control unit(s), control component(s), or combinations thereof. The counter value may be concatenated with (e.g., on top of) the private key, the serial number, VIN and/or typology identification.
- The secure messages may further include a payload. The payload 536 may include a message to be exchanged between the host computing device, vehicle part, control component, and/or control unit(s). For example, the payload may include data for an update to the control unit of the vehicle.
- In some embodiments, the secure communication may further include an authentication protocol. In some embodiments, the authentication protocol may comprise an anti-replay authentication protocol. The authentication protocol may be provided to alleviate the risk of man-in-the-middle or other malicious packet injection attacks. In some embodiments, the authentication protocol may be uniquely generated each time the host computing device generates the secure message.
- In some embodiments, the authentication protocol may include additional fields. For example, the authentication protocol may include a timestamp indicating when the secure message was generated or transmitted. In some embodiments, the authentication protocol may include a random value (e.g., a cryptographic nonce). In some embodiments, the authentication protocol may include a count value that is incremented (e.g., monotonically) as each secure message is generated.
- In some embodiments, the secure messages may further include a message authentication code (MAC). The MAC may be generated by the host computing device, remote computing device, vehicle, vehicle part, control unit(s), control component(s), and/or host computing device, etc. from the vehicle may comprise information to authenticate the secure message and/or to alleviate the risk of a man-in-the-middle attack and to guarantee the system against the anti-replay attack. In some embodiments, the MAC based on a secret key it may be a hash-based message authentication code (HMAC). In some embodiments, the MAC may be based on the private key, and may comprise a HMAC. The MAC may be generated by the host computing device, remote computing device, and/or control unit. In some embodiments, the MAC may be generated based on the private key.
- The secure messages may further include footer. In some embodiments, the footer may include information related to handling the secure message, and/or the footer may include information signifying the end of the secure message. In some embodiments, the footer may include information concerning the destination of the secure message.
-
FIG. 3 is a diagram of a system in the form of avehicle 360 in accordance with a number of embodiments of the present disclosure. As shown inFIG. 3 , thevehicle 360 may includecontrol unit 301 andfirewall 302. As shown inFIG. 3 , thefirewall 302 includes aprocessing resource 304,memory resource 306, andcontroller 308. - The
firewall 302 is configured to communicate with thecontrol unit 301 viacommunication path 322.Communication path 322 may be used to transmit communications from thecontrol unit 301 to thefirewall 302 as well as from thefirewall 302 to thecontrol unit 301. - The firewall can include a
processing resource 304 andmemory resource 306.Memory resource 306 can store a private key associated withvehicle 360 and also data corresponding to the update to the control unit that was sent to the firewall from a host computing device. Theprocessing resource 304 can compare the private key included in the data corresponding to the update to the control unit to the private key stored in thememory resource 306. If the private key included in the data corresponding to the update to the control unit matches the private key stored in thememory resource 306, thecontroller 308 authorizes the update and sends the data corresponding to the update to thecontrol unit 301 viacommunication pay 322. -
FIG. 4 is a flow diagram 450 in accordance with a number of embodiments of the present disclosure. In some embodiments, the flow diagram 450 may represent performance of a method. Atblock 451, storing a private key associated with a vehicle. In some embodiments, a firewall on a vehicle may store the private key and use the private key to authorize updates to a control unit of a vehicle. - At
block 452, the method may include storing data corresponding to an update to a control unit of the vehicle. In some embodiments, the firewall may receive a request to update the control unit of the vehicle. The firewall can store the data corresponding to the update in a memory resource on the firewall while the firewall is determining whether or not to authorize updates to the control unit of the vehicle. - At
block 453, the method may include comparing the private key associated with the vehicle and a private key included in the data associated with the data stored in the memory resource. The data associated with the update may include a private key. This private key included in the data associated with the update can be compared to the private key stored in a memory resource on the firewall. - At
block 454, the method may include allowing transmission of the update to the control unit of the vehicle in response to the private key associated with the vehicle matching the private key included in the data. In some embodiments, when the private key included in the data associated with the update matches to the private key stored in a memory resource on the firewall, the update can be authorized by the firewall and the data associated with the update can be sent to the control unit and executed by the control unit. - Although specific embodiments have been illustrated and described herein, those of ordinary skill in the art will appreciate that an arrangement calculated to achieve the same results can be substituted for the specific embodiments shown. This disclosure is intended to cover adaptations or variations of one or more embodiments of the present disclosure. It is to be understood that the above description has been made in an illustrative fashion, and not a restrictive one. Combination of the above embodiments, and other embodiments not specifically described herein will be apparent to those of skill in the art upon reviewing the above description. The scope of the one or more embodiments of the present disclosure includes other applications in which the above structures and methods are used. Therefore, the scope of one or more embodiments of the present disclosure should be determined with reference to the appended claims, along with the full range of equivalents to which such claims are entitled.
- In the foregoing Detailed Description, some features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the disclosed embodiments of the present disclosure have to use more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter lies in less than all features of a single disclosed embodiment. Thus, the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate embodiment.
Claims (20)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US17/525,688 US20220070159A1 (en) | 2017-12-19 | 2021-11-12 | Secure vehicle control unit update |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/847,373 US11178133B2 (en) | 2017-12-19 | 2017-12-19 | Secure vehicle control unit update |
US17/525,688 US20220070159A1 (en) | 2017-12-19 | 2021-11-12 | Secure vehicle control unit update |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/847,373 Continuation US11178133B2 (en) | 2017-12-19 | 2017-12-19 | Secure vehicle control unit update |
Publications (1)
Publication Number | Publication Date |
---|---|
US20220070159A1 true US20220070159A1 (en) | 2022-03-03 |
Family
ID=66814345
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/847,373 Active 2040-02-07 US11178133B2 (en) | 2017-12-19 | 2017-12-19 | Secure vehicle control unit update |
US17/525,688 Pending US20220070159A1 (en) | 2017-12-19 | 2021-11-12 | Secure vehicle control unit update |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/847,373 Active 2040-02-07 US11178133B2 (en) | 2017-12-19 | 2017-12-19 | Secure vehicle control unit update |
Country Status (3)
Country | Link |
---|---|
US (2) | US11178133B2 (en) |
CN (1) | CN111480314A (en) |
WO (1) | WO2019125850A1 (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20210132955A1 (en) * | 2016-03-18 | 2021-05-06 | Uatc, Llc | Secure Start System for an Autonomous Vehicle |
Families Citing this family (30)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10969777B2 (en) | 2017-06-23 | 2021-04-06 | Qualcomm Incorporated | Local drone identification verification |
US20190294135A1 (en) * | 2018-03-22 | 2019-09-26 | Ford Global Technologies, Llc | Content delivery to vehicle via charging station |
US11560240B2 (en) | 2018-03-29 | 2023-01-24 | Airbus Operations Gmbh | Aircraft area having a textile display, aircraft passenger seat having a textile display, and aircraft including an aircraft area |
EP3546355B1 (en) * | 2018-03-29 | 2021-07-07 | Airbus Operations GmbH | Aircraft area having a textile display, and an aircraft including such an aircraft area |
US11005662B2 (en) * | 2018-08-21 | 2021-05-11 | Ut-Battelle, Llc | Multimodal communication system |
US11635893B2 (en) | 2019-08-12 | 2023-04-25 | Micron Technology, Inc. | Communications between processors and storage devices in automotive predictive maintenance implemented via artificial neural networks |
US11586194B2 (en) | 2019-08-12 | 2023-02-21 | Micron Technology, Inc. | Storage and access of neural network models of automotive predictive maintenance |
US11853863B2 (en) | 2019-08-12 | 2023-12-26 | Micron Technology, Inc. | Predictive maintenance of automotive tires |
US12061971B2 (en) | 2019-08-12 | 2024-08-13 | Micron Technology, Inc. | Predictive maintenance of automotive engines |
US11775816B2 (en) | 2019-08-12 | 2023-10-03 | Micron Technology, Inc. | Storage and access of neural network outputs in automotive predictive maintenance |
DE102019212068A1 (en) * | 2019-08-12 | 2021-02-18 | Continental Teves Ag & Co. Ohg | Mobile communication device for updating security information or functions of a vehicle device and method |
US11748626B2 (en) | 2019-08-12 | 2023-09-05 | Micron Technology, Inc. | Storage devices with neural network accelerators for automotive predictive maintenance |
US11586943B2 (en) | 2019-08-12 | 2023-02-21 | Micron Technology, Inc. | Storage and access of neural network inputs in automotive predictive maintenance |
US10993647B2 (en) | 2019-08-21 | 2021-05-04 | Micron Technology, Inc. | Drowsiness detection for vehicle control |
US11498388B2 (en) | 2019-08-21 | 2022-11-15 | Micron Technology, Inc. | Intelligent climate control in vehicles |
US11361552B2 (en) | 2019-08-21 | 2022-06-14 | Micron Technology, Inc. | Security operations of parked vehicles |
US11702086B2 (en) | 2019-08-21 | 2023-07-18 | Micron Technology, Inc. | Intelligent recording of errant vehicle behaviors |
US11042350B2 (en) | 2019-08-21 | 2021-06-22 | Micron Technology, Inc. | Intelligent audio control in vehicles |
US11409654B2 (en) | 2019-09-05 | 2022-08-09 | Micron Technology, Inc. | Intelligent optimization of caching operations in a data storage device |
US11693562B2 (en) | 2019-09-05 | 2023-07-04 | Micron Technology, Inc. | Bandwidth optimization for different types of operations scheduled in a data storage device |
US11435946B2 (en) | 2019-09-05 | 2022-09-06 | Micron Technology, Inc. | Intelligent wear leveling with reduced write-amplification for data storage devices configured on autonomous vehicles |
US11650746B2 (en) | 2019-09-05 | 2023-05-16 | Micron Technology, Inc. | Intelligent write-amplification reduction for data storage devices configured on autonomous vehicles |
US11436076B2 (en) | 2019-09-05 | 2022-09-06 | Micron Technology, Inc. | Predictive management of failing portions in a data storage device |
US11250648B2 (en) | 2019-12-18 | 2022-02-15 | Micron Technology, Inc. | Predictive maintenance of automotive transmission |
CN113162959B (en) * | 2020-01-23 | 2023-06-30 | 华为技术有限公司 | Upgrading method and device of vehicle-mounted equipment |
US11709625B2 (en) | 2020-02-14 | 2023-07-25 | Micron Technology, Inc. | Optimization of power usage of data storage devices |
US11531339B2 (en) | 2020-02-14 | 2022-12-20 | Micron Technology, Inc. | Monitoring of drive by wire sensors in vehicles |
EP4329240A4 (en) * | 2021-04-30 | 2024-05-22 | Huawei Technologies Co., Ltd. | Key updating method and related device thereof |
CN114070866A (en) * | 2021-11-15 | 2022-02-18 | 阿波罗智联(北京)科技有限公司 | Vehicle resource pushing method and device, electronic equipment and storage medium |
US20240118880A1 (en) * | 2022-10-11 | 2024-04-11 | Ford Global Technologies, Llc | Transmission of authentication keys |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080221776A1 (en) * | 2006-10-02 | 2008-09-11 | Mcclellan Scott | System and Method for Reconfiguring an Electronic Control Unit of a Motor Vehicle to Optimize Fuel Economy |
US20130268759A1 (en) * | 2012-04-10 | 2013-10-10 | Western Digital Technologies, Inc. | Digital rights management system transfer of content and distribution |
US10007269B1 (en) * | 2017-06-23 | 2018-06-26 | Uber Technologies, Inc. | Collision-avoidance system for autonomous-capable vehicle |
US20180212967A1 (en) * | 2017-01-25 | 2018-07-26 | NextEv USA, Inc. | Portable device used to support secure lifecycle of connected devices |
US20180300472A1 (en) * | 2015-06-30 | 2018-10-18 | Hitachi Automotive Systems, Ltd. | Vehicle Data Rewrite Control Device and Vehicle Data Rewrite Authentication System |
Family Cites Families (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7000115B2 (en) | 2001-06-19 | 2006-02-14 | International Business Machines Corporation | Method and apparatus for uniquely and authoritatively identifying tangible objects |
US8126642B2 (en) | 2008-10-24 | 2012-02-28 | Gray & Company, Inc. | Control and systems for autonomously driven vehicles |
US11042816B2 (en) | 2009-10-30 | 2021-06-22 | Getaround, Inc. | Vehicle access control services and platform |
US9613214B2 (en) | 2013-07-09 | 2017-04-04 | Micron Technology, Inc. | Self-measuring nonvolatile memory devices with remediation capabilities and associated systems and methods |
US9253200B2 (en) | 2013-10-28 | 2016-02-02 | GM Global Technology Operations LLC | Programming vehicle modules from remote devices and related methods and systems |
US9374355B2 (en) | 2013-10-28 | 2016-06-21 | GM Global Technology Operations LLC | Programming vehicle modules from remote devices and related methods and systems |
US9331989B2 (en) | 2014-10-06 | 2016-05-03 | Micron Technology, Inc. | Secure shared key sharing systems and methods |
US9569622B2 (en) | 2014-11-20 | 2017-02-14 | Micron Technology, Inc. | Self-measuring nonvolatile memory device systems and methods |
KR102308763B1 (en) | 2015-01-20 | 2021-10-05 | 삼성전자주식회사 | Apparatus and method for tightening security of personal information data |
US9916151B2 (en) * | 2015-08-25 | 2018-03-13 | Ford Global Technologies, Llc | Multiple-stage secure vehicle software updating |
JP6217728B2 (en) * | 2015-10-19 | 2017-10-25 | トヨタ自動車株式会社 | Vehicle system and authentication method |
US20170214744A1 (en) | 2015-11-30 | 2017-07-27 | Veniam, Inc. | Systems and methods for adapting a network of moving things, for example including autonomous vehicles, based on user feedback |
US9787800B2 (en) | 2015-12-30 | 2017-10-10 | Veniam, Inc. | Systems and methods for remote software update and distribution in a network of moving things |
US10256890B2 (en) | 2016-05-24 | 2019-04-09 | Veniam, Inc. | Adaptive management of antennas in the network of moving things |
US11721205B2 (en) | 2016-06-13 | 2023-08-08 | Here Global B.V. | Method, apparatus, and computer program product for processing sensor data |
-
2017
- 2017-12-19 US US15/847,373 patent/US11178133B2/en active Active
-
2018
- 2018-12-12 WO PCT/US2018/065113 patent/WO2019125850A1/en active Application Filing
- 2018-12-12 CN CN201880081036.3A patent/CN111480314A/en active Pending
-
2021
- 2021-11-12 US US17/525,688 patent/US20220070159A1/en active Pending
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080221776A1 (en) * | 2006-10-02 | 2008-09-11 | Mcclellan Scott | System and Method for Reconfiguring an Electronic Control Unit of a Motor Vehicle to Optimize Fuel Economy |
US20130268759A1 (en) * | 2012-04-10 | 2013-10-10 | Western Digital Technologies, Inc. | Digital rights management system transfer of content and distribution |
US20180300472A1 (en) * | 2015-06-30 | 2018-10-18 | Hitachi Automotive Systems, Ltd. | Vehicle Data Rewrite Control Device and Vehicle Data Rewrite Authentication System |
US20180212967A1 (en) * | 2017-01-25 | 2018-07-26 | NextEv USA, Inc. | Portable device used to support secure lifecycle of connected devices |
US10007269B1 (en) * | 2017-06-23 | 2018-06-26 | Uber Technologies, Inc. | Collision-avoidance system for autonomous-capable vehicle |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20210132955A1 (en) * | 2016-03-18 | 2021-05-06 | Uatc, Llc | Secure Start System for an Autonomous Vehicle |
US11966747B2 (en) * | 2016-03-18 | 2024-04-23 | Uatc, Llc | Secure start system for an autonomous vehicle |
Also Published As
Publication number | Publication date |
---|---|
WO2019125850A1 (en) | 2019-06-27 |
CN111480314A (en) | 2020-07-31 |
US11178133B2 (en) | 2021-11-16 |
US20190187291A1 (en) | 2019-06-20 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20220070159A1 (en) | Secure vehicle control unit update | |
US11618394B2 (en) | Vehicle secure messages based on a vehicle private key | |
EP3348036B1 (en) | Unauthorized access event notificaiton for vehicle electronic control units | |
US9688244B2 (en) | Autonomous vehicle theft prevention | |
US9374355B2 (en) | Programming vehicle modules from remote devices and related methods and systems | |
US9923722B2 (en) | Message authentication library | |
US10545496B2 (en) | Systems and methods for securely controlling a vehicle using a mobile device | |
CN106464566B (en) | Network system, communication control method, and storage medium | |
US11757851B2 (en) | Secure message including a vehicle private key | |
US8035494B2 (en) | Motor vehicle control device data transfer system and process | |
US10834199B2 (en) | Cloud authorized vehicle control | |
CN113347133B (en) | Authentication method and device of vehicle-mounted equipment | |
US11259179B2 (en) | Systems and methods for enabling transmission of data and commands between a mobile device and a vehicle | |
US10997799B2 (en) | Method and apparatus for leveraging wireless connectivity for pre-service preparation in service lanes | |
RU2726884C1 (en) | System and method of controlling access to cyber physical system | |
Rumez et al. | Security hardening of automotive networks through the implementation of attribute-based plausibility checks | |
Vuillaume et al. | Cyber-security for Engine ECUs: Past, Present and Future |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: MICRON TECHNOLOGY, INC., IDAHO Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:TROIA, ALBERTO;REEL/FRAME:058103/0183 Effective date: 20171219 |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: ADVISORY ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: AWAITING RESPONSE FOR INFORMALITY, FEE DEFICIENCY OR CRF ACTION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |