Patent Application
20190278903
The present disclosure relates generally to vehicle systems and more particularly to replacing a security credential in a vehicle control module.
Vehicle control modules are electronic modules that control various aspects of vehicles. For example, a vehicle control module can control a vehicle's engine, communication, steering, navigation, infotainment, and other systems. In one example, a vehicle control module can control vehicle-to-vehicle (V2V) communications where a first vehicle transmits data to a second vehicle. The vehicle control module can also control other communication interfaces such as vehicle-to-infrastructure (V2I), vehicle-to-everything (V2X), vehicle-to-pedestrian (V2P), vehicle-to-device (V2D), and the like.
In one exemplary embodiment, a computer-implemented method for replacing a security credential in a vehicle control module includes authorizing, by a processing device of a management system, a service system to replace the security credential of the vehicle control module. The method further includes initiating, by a processing device of the service system, a replace security credential command to replace the security credential in the vehicle control module. The method further includes verifying, by a processing device of the vehicle control module, the replace security credential command. The method further includes initiating, by the processing device of the vehicle control module, a replace security credential request. The method further includes verifying, by the processing device of the management system, the replace security credential request. The method further includes creating, by the processing device of the management system, a new security credential for the vehicle control module. The method further includes installing, by the processing device of the vehicle control module, the new security credential.
In some examples, the authorizing includes creating, by the processing device of the service system, a request for service authorization; authenticating, by the processing device of the management system, the request for service authorization; and issuing, by the processing device of the management system, a service authorization token to the service system. In some examples, the request for service authorization includes: a service system identifier of the service system, a vehicle identifier of a vehicle associated with the vehicle control module, a vehicle control module identifier, a public key of the vehicle control module, and a timestamp signed by the corresponding private key of the vehicle control module. In some examples, the service authorization token includes an identifier of the service system that is authorized to perform the replacement, a public key of the vehicle control module whose security credential the service system is authorized to replace, a time window during which the service system is authorized to perform the replacement, and a digital signature over the authorization token created by a private key of the management system. In some examples, the time window includes a start time and an end time. In some examples, the service system sending to the vehicle control module a replace security credential command to replace the security credential in the vehicle control module includes the service system sending to the vehicle control module an authorization token, a service system identifier, and a replace security credential command. In some examples, an old security credential is revoked prior to the new security credential being created.
In another exemplary embodiment, a system includes a memory including computer readable instructions and a processing device for executing the computer readable instructions for performing a method for replacing a security credential in a vehicle control module. In examples, the method includes authorizing, by a management system, a service system to replace the security credential of the vehicle control module. The method further includes initiating, by the service system, a replace security credential command to replace the security credential in the vehicle control module. The method further includes verifying, by the vehicle control module, the replace security credential command. The method further includes initiating, by the vehicle control module, a replace security credential request. The method further includes verifying, by the management system, the replace security credential request. The method further includes creating, by the management system, a new security credential for the vehicle control module. The method further includes installing, by the vehicle control module, the new security credential.
In some examples, the authorizing includes creating, by the service system, a request for service authorization; authenticating, by the management system, the request for service authorization; and issuing, by the management system, a service authorization token to the service system. In some examples, the request for service authorization includes: a service system identifier of the service system, a vehicle identifier of a vehicle associated with the vehicle control module, a vehicle control module identifier, a public key of the vehicle control module, and a timestamp signed by the corresponding private key of the vehicle control module. In some examples, the service authorization token includes an identifier of the service system that is authorized to perform the replacement, a public key of the vehicle control module whose security credential the service system is authorized to replace, a time window during which the service system is authorized to perform the replacement, and a digital signature over the authorization token created by a private key of the management system. In some examples, the time window includes a start time and an end time. In some examples, the service system sending to the vehicle control module a replace security credential command to replace the security credential in the vehicle control module includes the service system sending to the vehicle control module an authorization token, a service system identifier, and a replace security credential command. In some examples, an old security credential is revoked prior to the new security credential being created. In some examples, the vehicle control module sending to the management system a security credential request includes the vehicle control module sending to the management system a security credential request command, a service authorization token from the service system, a public key of the vehicle control module, and a timestamp signed by a private key of the vehicle control module
In yet another exemplary embodiment a computer program product includes a computer readable storage medium having program instructions embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program instructions executable by a processing device to cause the processing device to perform a method for replacing a security credential in a vehicle control module. In examples, the method includes authorizing, by a management system, a service system to replace the security credential of the vehicle control module. The method further includes initiating, by the service system, a replace security credential command to replace the security credential in the vehicle control module. The method further includes verifying, by the vehicle control module, the replace security credential command. The method further includes initiating, by the vehicle control module, a replace security credential request. The method further includes verifying, by the management system, the replace security credential request. The method further includes creating, by the management system, a new security credential for the vehicle control module. The method further includes installing, by the vehicle control module, the new security credential.
The above features and advantages, and other features and advantages, of the disclosure are readily apparent from the following detailed description when taken in connection with the accompanying drawings.
Other features, advantages, and details appear, by way of example only, in the following detailed description, the detailed description referring to the drawings in which:
The above features and advantages, and other features and advantages of the disclosure are readily apparent from the following detailed description when taken in connection with the accompanying drawings.
The following description is merely exemplary in nature and is not intended to limit the present disclosure, its application or uses. It should be understood that throughout the drawings, corresponding reference numerals indicate like or corresponding parts and features. As used herein, the term module refers to processing circuitry that may include an application specific integrated circuit (ASIC), an electronic circuit, a processor (shared, dedicated, or group) and memory that executes one or more software or firmware programs, a combinational logic circuit, and/or other suitable components that provide the described functionality.
A vehicle control module (VCM) creates a unique module authorization key (MAK) private/public key pair, which acts as a security identifier for the VCM. In the secure context of the VCM manufacturing process, the VCM's MAK is used to authenticate a request for the VCM's first security credential from a management system. The management system registers the association of the VCM's MAK public key with the VCM's security credential. In the secure context of the vehicle assembly process, a VCM identifier (VCMID) is associated with the vehicle identifier. The management system registers authorized service tool identifiers and defines a minimum time between security credential replacements to restrict how frequently a VCM can receive a replacement security credential. This value is typically greater than the time it takes to communicate the revocation of a security credential to all vehicles in the security domain of trust maintained by the management system.
The technical solutions described herein provide for replacing a security credential in a vehicle control module. From time to time, such as prior to (or after) the expiration of a security credential in a VCM, it may be desirable to replace the security credential with a new security credential. The present techniques facilitate such replacement through the use of a combination of multiple, independent registrations/authentications for securing a service event. These can include a service system ID registration with a management system, a VCMID registration with a vehicle ID, and a VCM's MAK with a VCM security credential. The management system verifies the service system ID, VCMID, vehicle ID, the VCM's MAK public key, and the VCM's possession of the MAK private key in order to issue a token authorizing the service system to instruct the VCM to replace its security credential. In addition, the present techniques provide a process that can be securely executed through combining the use of time-bound service authorization tokens, the use of the MAK private key-signed replace security credential request, a minimum time between security credential replacement threshold, and the revocation of the replaced security credential. Accordingly, a security credential for a VCM can be replaced securely without the need for human involvement and/or physical proximity.
The various components, modules, engines, etc. described regarding
Each of the VCM 110, the service system 120, and the management system 130 are in communication with one another: the VCM 110 and the service system 120 are in communication via communication link 140, the VCM 110 and the management system 130 are in communication via communication link 141, and the service system 120 and the management system 130 are in communication via communication link 142. It should be appreciated that each of the VCM 110, the service system 120, and the management system 130 can include a network adapter (e.g., the network adapter 426 of
In one or more embodiments, one or more of the components of the system 100 can be implemented on the processing system 400 depicted in
It may be desirable to replace a security credential of the VCM 110, such as when the security credential is about to expire or has expired. To replace the security credential of the VCM 110, the following procedure occurs and includes an authorization method 200,
At 208, the management system 130 authenticates the received request for service authorization to authorize the service system 120 to be used to replace the security credential of the VCM 110. Such authentication occurs when one or more of the following are true: the service system ID is registered to the management system 130, the VCMID is registered to the vehicle ID for the vehicle 112 in the management system 130, the signature on the timestamp is validated by the MAK public key of the VCM 110, the current time is proximate to the timestamp (e.g., within a certain period of time, such as 45 seconds, 2 minutes, 15 minutes, etc.), the MAK public key is registered to a security credential in the management system 130, and/or the current time minus the time when the management system 130 last issued a security credential for the VCM 110 is greater than a minimum time between security credential replacement threshold. In some embodiments, each of these conditions must be met before the management system 130 authorizes the service system 120 to be used to replace the security credential of the VCM 110.
Once the management system 130 authenticates the received request for service authorization, at 210, the management system 130 issues a service authorization token to the service system 120 via the communication link 142. The service authorization token (“token”) can include the following information: the ID of the service system 120 that is authorized to perform the replacement, the MAK public key of the VCM 110 whose security credential the service system 120 is authorized to replace, a time window (e.g., start time and end time) during which the service system 120 is authorized to perform the replacement, and/or a digital signature over the token created by a private key of the management system 130. This completes the authorization method 200, at which point the security credential can be replaced in the VCM 110, as described with reference to
In particular,
At 216, the VCM 110 connects to the management system 130 via the communication link 141. At 218, the VCM 110 creates a security credential request and a new security credential private/public key pair. At 220, the VCM 110 sends to the management system 130 the following information: the security credential request, the MAK public key of the VCM 110, a timestamp signed by the MAK private key of the VCM 110, and the service authorization token.
At 222, the management system 130 authenticates the security credential request received from the VCM 110. In one or more embodiments, the security credential request is authenticated if one or more of the following authentication checks are true: the signature on the timestamp is validated by the MAK public key, the timestamp is proximate to the current time, the MAK public key is registered to a security credential in the management system 130, the token signature is valid per the public key of the management system 130, the current time is between the token start time and the token end time, and the current time minus the time when the management system 130 last issued a security credential for the VCM 110 is greater than the minimum time between security credential replacement threshold. It should be appreciated that in one or more embodiments, each of the authentication checks is true before the management system 130 authenticates the request.
At 224, the management system 130 revokes the current security credential for the VCM 110. Then at 226, the management system 130 issues a new security credential for the VCM 110. At 228, the management system 130 sends the new security credential to the VCM 110 (e.g., via the communication link 141). At 230, the VCM 110 deletes its old security credential private/public key pair and, at 232, installs its new security credential.
At block 302, the management system 130 authorizes, a service system to replace the security credential of the VCM 110. According to aspects of the present disclosure, the authorizing can include creating, by the service system 120, a request for service authorization; authenticating, by the management system 130, the request for service authorization; and issuing, by the management system 130, a service authorization token to the service system 120. The request for service authorization can include one or more of a service system identifier of the service system 120, a vehicle identifier of a vehicle 112 associated with the VCM 110, a vehicle control module identifier, a public key of the VCM 110, and a timestamp signed by the corresponding private key of the VCM 110. The service authorization token can include one or more of an identifier of the service system 120 that is authorized to perform the replacement, the public key of the VCM 110 whose security credential the service system 120 is authorized to replace, a time window (e.g., a start time and an end time) during which the service system 120 is authorized to perform the replacement, and a digital signature over the token created by a private key of the management system 130.
At block 303, the service system 120 initiates a replace security credential command to replace the security credential in the VCM 110. In examples, this includes the service system 120 sending to the VCM 110 the authorization token, a service system identifier, and a replace security credential command.
At block 304, the VCM 110 verifies the replace security credential command. According to aspects of the present disclosure, the VCM 110 verifies the request when the service system ID in the authorization token matches the service system ID sent by the service system 120, the MAK public key in the token matches the MAK public key in the VCM 110, the current time is within the time window listed in the token, and/or the digital signature on the token is valid according to the public key of the management system 130. It should be appreciated that in one or more embodiments, each of the authentication checks is true before the VCM 110 authenticates the command.
At block 305, the VCM 110 initiates a replace security credential request. In examples, this includes the VCM 110 sending to the management system 130 a replace security credential request, the VCM 110 MAK public key, a timestamp signed by the MAK private key, and the service authorization token.
At block 306, the management system 130 verifies the replace security credential request. According to aspects of the present disclosure, the management system 130 verifies the request when the timestamp signature is valid per the MAK public key, the MAK public key is registered to a security credential in the management system 130, the current time is proximate to the timestamp, the token signature is valid per the public key of the management system 130, the current time is between the token start time and the token end time, and the current time minus the time when the management system 130 last issued a security credential for the VCM 110 is greater than the minimum time between security credential replacement threshold. It should be appreciated that in one or more embodiments, each of the authentication checks is true before the management system 130 authenticates the request.
At block 308, the management system 130 creates a new security credential for the VCM 110. Before the new security credential is created, an old security credential can be revoked.
At block 310, the VCM 110 installs the new security credential. Installing the new security credential can include first deleting the old security credential.
Additional processes also may be included, and it should be understood that the processes depicted in
It is understood in advance that the present disclosure is capable of being implemented in conjunction with any other type of computing environment now known or later developed. For example,
Further illustrated are an input/output (I/O) adapter 427 and a network adapter 426 coupled to system bus 433. I/O adapter 427 can be a small computer system interface (SCSI) adapter that communicates with a hard disk 423 and/or other storage drive 425 or any other similar component. I/O adapter 427, hard disk 423, and storage device 425 are collectively referred to herein as mass storage 434. Operating system 440 for execution on processing system 400 can be stored in mass storage 434. A network adapter 426 interconnects system bus 433 with an outside network 436 enabling processing system 400 to communicate with other such systems.
A display (e.g., a display monitor) 435 is connected to system bus 433 by display adaptor 432, which can include a graphics adapter to improve the performance of graphics and general computation intensive applications and a video controller. In one aspect of the present disclosure, adapters 426, 427, and/or 432 can be connected to one or more I/O buses that are connected to system bus 433 via an intermediate bus bridge (not shown). Suitable I/O buses for connecting peripheral devices such as hard disk controllers, network adapters, and graphics adapters typically include common protocols, such as the Peripheral Component Interconnect (PCI). Additional input/output devices are shown as connected to system bus 433 via user interface adapter 428 and display adapter 432. A keyboard 429, mouse 430, and speaker 431 can be interconnected to system bus 433 via user interface adapter 428, which can include, for example, a Super I/O chip integrating multiple device adapters into a single integrated circuit.
In some aspects of the present disclosure, processing system 400 includes a graphics processing unit 437. Graphics processing unit 437 is a specialized electronic circuit designed to manipulate and alter memory to accelerate the creation of images in a frame buffer intended for output to a display. In general, graphics processing unit 437 is very efficient at manipulating computer graphics and image processing, and has a highly parallel structure that makes it more effective than general-purpose CPUs for algorithms where processing of large blocks of data is done in parallel.
Thus, as configured herein, processing system 400 includes processing capability in the form of processors 421, storage capability including system memory (e.g., RAM 424), and mass storage 434, input means such as keyboard 429 and mouse 430, and output capability including speaker 431 and display 435. In some aspects of the present disclosure, a portion of system memory (e.g., RAM 424) and mass storage 434 collectively store an operating system to coordinate the functions of the various components shown in processing system 400.
The descriptions of the various examples of the present disclosure have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described techniques. The terminology used herein was chosen to best explain the principles of the present techniques, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the techniques disclosed herein.
While the above disclosure has been described with reference to exemplary embodiments, it will be understood by those skilled in the art that various changes can be made and equivalents can be substituted for elements thereof without departing from its scope. In addition, many modifications can be made to adapt a particular situation or material to the teachings of the disclosure without departing from the essential scope thereof. Therefore, it is intended that the present techniques not be limited to the particular embodiments disclosed, but will include all embodiments falling within the scope of the application.
