Procedure and vehicle-to-vehicle communication system for obtaining a certificate revocation list

Abstract

Method for obtaining a certificate revocation list (CRL) for a vehicle (10) in a vehicle-to-vehicle communication system, the method comprising the following steps: Providing a portable security unit (18) for access to secured premises for the vehicle (10), wherein the portable security unit (18) is part of a vehicle ignition key; Connecting the portable security unit (18) to a network device (22) that has access to a communication network (23), wherein the communication network (23) is in communication with a certificate authority to issue an updated CRL; Download the updated CRL from the certificate authority to the portable security device (18); Establishing a communication link between the portable security unit (18) and a vehicle processing unit (14); and Exchanging mutual authentication between the portable security unit (18) and the vehicle processing unit (14), wherein the updated CRL stored in the portable security unit (18) is downloaded to a memory (16) of the vehicle communication system in response to a successful mutual authentication, wherein the establishment of the connection between the portable security unit (18) and the vehicle processing unit (14) is initiated by inserting the vehicle ignition key into a vehicle ignition system.

Description

BACKGROUND OF THE INVENTION

[0001] One embodiment relates generally to a vehicle-to-vehicle communication system.

[0002] The use of certificate revocation lists (CRLs) for certificate validity checking on the Internet has motivated the use of CRLs in other contexts, such as vehicle-to-vehicle communications. Due to intermittent connectivity to a certificate authority resulting from vehicles not being within communication range of roadside equipment providing accessibility to the certificate authority, a revoked status of a certificate may be out of date at a verifier, resulting in the acceptance of messages signed using a revoked certificate. In vehicular communication systems, communication with the roadside equipment is used to obtain a CRL. However, if the vehicle is not in frequent communication with the roadside equipment, the vehicle may not obtain current CRL listings.

[0003] US 2007 / 0 223 702 A1 discloses a method for authentication in a vehicle-to-vehicle communication system. Upon request, each vehicle is assigned a multiple-validity certificate from a quasi-anonymous certificate pool by a certifying authority. Each vehicle can remain anonymous during communication within the system, and anonymity is only temporarily suspended during a new certificate revocation. Furthermore, each vehicle receives a certificate revocation list, which is periodically broadcast by the system to inform each vehicle of certificates revoked by the system. The periodic transmission of the certificate revocation list forces all vehicles with a certificate that is invalid according to the new certificate revocation list to reauthenticate with the certifying authority in order to receive a new certificate.Further prior art is known from US 2009 / 0 201 139 A1, DE 10 2005 038 471 A1, DE 199 17 817 A1, DE 103 17 499 A1, US 2010 / 0 031 025 A1 and US 2008 / 0 232 595 A1. SUMMARY OF THE INVENTION

[0004] The object of the invention is to provide an improved method and vehicle-to-vehicle communication system for obtaining a certificate revocation list.

[0005] To achieve this object, a method having the features of claim 1 and a vehicle-to-vehicle communication system having the features of claim 6 are provided. Advantageous embodiments of the invention can be found in the subclaims, the description, and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is an exemplary schematic diagram of the communication devices utilized in a CRL retrieval system in accordance with one embodiment. Fig. 2 is a block diagram of the CRL retrieval system in accordance with the embodiment. Fig. 3 is a flowchart of a method for updating the CRL in accordance with the embodiment. DETAILED DESCRIPTION

[0006] In Fig. 1 shows a vehicle-to-vehicle (V2V) communication system. The V2V communication system easily downloads updated certificate revocation lists (CRLs) from a source other than the roadside equipment, which is typically the primary communication interface device for updating CRLs. The V2V communication system includes a host vehicle in communication with one or more remote entities. The remote entities may be a remote vehicle or an RSE. It should be noted that each vehicle considers itself a host vehicle with respect to vehicles remote from the host vehicle. Thus, the term host vehicle is used in the context of a respective vehicle, which is the focus of the present description.

[0007] A CRL is a list of digital certificates that have been revoked or are no longer valid. A carrier receiving a message from a remote entity for which the digital certificate has been revoked or is no longer valid should not be referred to, and the message should be discarded. A digital certificate may be revoked for several reasons, including, but not limited to, a certificate authority (CA) issuing the certificate incorrectly, misconduct by the certificate holder, including violations of the policies specified by the CA, or if the private key is believed to have been compromised (i.e., known to some entity other than the entity to which the key was issued).

[0008] The CRL is regenerated and republished periodically, or this can occur after a digital certificate has been revoked. The digital certificate may also have expiration dates, which can be examined to determine the digital certificate's validity. The status of the digital certificate should be checked each time a requesting entity wishes to reference a digital certificate; otherwise, a message sent by an entity that signed a (revoked) digital certificate may be mistakenly perceived as referring to it. Thus, it is relevant to have a recent listing of the CRL. The problem with vehicular communications is that vehicles are not in constant communication with roadside entities or other communication devices (i.e., due to a transmission range).Thus, the CRL update can only take place if the vehicle is within the communication range of the RSE.

[0009] The embodiments described herein provide an effective threat mitigation technique in a vehicle-to-vehicle communication network through a mechanism for frequent communication between the CA and the vehicles. The need for frequent connectivity between the CA and the vehicle creates several advantages. First, when users (i.e., vehicles in the network) can frequently contact the CA, updated logs of vehicle-to-vehicle communications can be uploaded to assist the CA in detecting misbehaving vehicles that lead to the construction of blacklists. A log is a summary of messages received via a DSRC antenna over a specific period of time. The log can be exhaustive (e.g., containing all received messages), random (e.g., containing a random fraction of the received messages), or selective (e.g.,Second, the logs of suspicious messages may be limited to a single, unrelated entity (e.g., only containing messages from a vehicle perceived as suspicious or anomalous). Failure to upload suspicious message logs for long periods of time leads to delays in identifying and banning misbehaving identities. Second, users can download up-to-date revocation information through frequent interaction with the CA. Obtaining revocation information after long periods of time creates a "window of vulnerability" during which a user can accept packets from a banned entity. Furthermore, another benefit of the frequent interaction between the CA and vehicles creates increased levels of privacy. Furthermore, by assigning certificates specific to the geographical area, migration across geographical areas is facilitated. In particular, users can refresh their identities / credentials frequently enough to improve privacy.

[0010] Both based on Fig. 1 as well as Fig. 2, a vehicle 10 with V2V or vehicle-to-vehicle (V2X) communication capabilities is shown. The vehicle 10 includes a wireless radio 12 (e.g., a receiver end-port) that includes a transmitter and a receiver (or transceiver) for sending and receiving wireless messages. The vehicle 10 further includes a processing unit 14 (e.g., a protocol stack) for processing the data received in a wireless message or other wireless devices, such as a Global Positioning System (GPS) receiver. The processing unit 14 may include, but is not limited to, an electronic control unit (ECU) for controlling access to a vehicle and, further, engine start operation of the vehicle. The V2V communication system also includes a memory 16 for storing data, such as CRLs, used to determine whether a digital certificate is revoked.

[0011] The processing unit 14 of the V2V communication system communicates with a portable security unit 18. The portable security unit 18 is integrated as part of a vehicle ignition key for accessing the interior of a vehicle and actuating the starting of a vehicle's engine. The portable security unit 18 includes a dongle 20. The dongle 20 is a small piece of portable hardware that communicates with a network device 22, such as a computer, and is connected to a communications network 23 and additionally to the processing unit 14. The dongle 20 is preferably co-located with the vehicle's ignition key for communication with the vehicle's processing unit 14. The dongle 20 includes a memory 24, such as a smart card, flash memory, or the like, for storing codes for accessing the vehicle's functions and for storing updated CRLs and packet logs.

[0012] When connected to network device 22, dongle 20 accesses communications network 23 to upload packet logs and download an updated CRL from a certificate authority. Dongle 20 uses a docking device 26 to communicate with network device 22 (e.g., a computer). Docking device 26 may use a wired connection or a wireless connection to communicate with network device 22. Network device 22 further includes a processor 25 to control communication with the CA via communications network 23. Communication network 23 may include the Internet or any other communications medium. Network device 22 is used to communicate with the CA to upload packet logs and obtain an updated CRL upon user request. The updated CRL is downloaded from the CA to dongle 20 via device 22.The dongle 20 stores the downloaded CRL in the memory 24. After a successful download of the CRL from the CA, the dongle 20 is removed from the docking station 26. Additionally, cryptographic credentials or additional certificates in the form of a pseudonym can be downloaded to the vehicle from the CA. The pseudonym contains no personal or identifying information related to the vehicle, but enables the vehicle to execute security protocols necessary for sending and receiving V2V messages. This improves a user's privacy in the V2V communication system. Messages signed using cryptographic material corresponding to a respective pseudonym would generally have the respective pseudonym appended to the receiving party to verify the authenticity of the messages.An observer could connect messages sent by a particular vehicle as long as the vehicle uses the same pseudonym. By using each pseudonym for a short period of time and periodically requesting fresh sets of pseudonyms from the CA, a vehicle can maintain anonymity.

[0013] When the user enters the vehicle, the portable security unit 18 connects to the vehicle processing unit 14. In the preferred embodiment, the connection of the portable security unit 18 to the vehicle processing unit 14 can be initiated by inserting the ignition key into the vehicle ignition system 17 for mutual authentication between the dongle and the vehicle processing unit 14. Upon successful authentication, the updated CRL is downloaded from the dongle 20 to the vehicle's processing unit 14. The processing unit 14 uses the updated CRL to determine whether the digital certificate of the received message has been revoked.

[0014] Before sending the updated CRL, a central malicious node detection system running on a back-end server analyzes received packet logs. The central malicious node detection system detects anomalies in the vehicle-to-vehicle communication system.

[0015] Fig. Figure 3 illustrates a flowchart of a method for updating a vehicle's CRL in a V2V or V2X communication system. In step 30, a portable security unit is provided for accessing a vehicle's secured vehicle operation. The portable security unit is integrated with an ignition key. The portable security unit contains a dongle used to store one or more codes for accessing the secure vehicle operation.

[0016] In step 31, the portable security unit is connected to a network device that has a communication connection to a communications network. The network device may include, but is not limited to, a computer, a telephone, or a personal digital assistant. The portable security unit may establish communication with the network device using a docking station. The docking station may utilize a wireless or wired connection to the network device (e.g., a computer).

[0017] In step 32, the network device, such as the computer, accesses communication with a certificate authority (CA). The certificate authority is required to issue updated CRLs based on anomalies detected in received packet logs. Certificates listed in the CRL are digital certificates that have been revoked due to expiration, malicious behavior, or as a result of a private key being compromised. The computer downloads an updated CRL for a localized area upon user request.

[0018] In step 33, mutual authentication is initiated between the dongle and the vehicle processor to enable secure operation, such as an engine start operation. Establishing mutual authentication may include inserting the ignition key into the ignition system to initiate an engine start operation. The dongle integrated with the ignition key or with the portable security device communicates with the vehicle processor for mutual authentication.

[0019] In step 34, in response to initiation of vehicle operation or safe operation (ie, insertion of the ignition key into the ignition system), a connection is established between the portable communication device and the vehicle processor.

[0020] In step 35, mutual authentication is established. Successful authentication occurs when the portable security unit authenticates the vehicle communications processor and the vehicle communications processor authenticates the portable security device.

[0021] In step 36, after mutual authentication by both devices, an updated CRL is downloaded from the dongle to the vehicle processor. Additionally, cryptographic credentials or additional certificates in the form of a pseudonym can be downloaded from the CA to the vehicle. Furthermore, updated logs of vehicle-to-vehicle communications can be uploaded to assist the CA in detecting misbehaving vehicles, which are used to build revocation lists.

[0022] In step 37, the CRL is stored in the vehicle processor memory or the like and used to check whether digital certificates associated with messages received by the vehicle are revoked. If a digital certificate is revoked, the message is ignored. If the digital certificate for a received message is not revoked, the message is accepted or retained for additional processing.

[0023] Although certain embodiments of the present invention have been described in detail, those skilled in the art to which this invention relates will recognize various alternative designs and embodiments for practicing the invention as defined in the following claims.

Claims

[1] A method for obtaining a certificate revocation list (CRL) for a vehicle (10) in a vehicle-to-vehicle communication system, the method comprising the following steps: Providing a portable security unit (18) for accessing secured operations for the vehicle (10), the portable security unit (18) being part of a vehicle ignition key; Connecting the portable security unit (18) to a network device (22) having access to a communications network (23), the communications network (23) being in communication with a certificate authority to issue an updated CRL; Downloading the updated CRL from the certificate authority to the portable security unit (18); Establishing a communication link between the portable security unit (18) and a vehicle processing unit (14); and Exchanging mutual authentication between the portable security unit (18) and the vehicle processing unit (14), wherein the updated CRL stored in the portable security unit (18) is downloaded into a memory (16) of the vehicle communication system in response to successful mutual authentication, wherein the establishment of the connection between the portable security unit (18) and the vehicle processing unit (14) is initiated by inserting the vehicle ignition key into a vehicle ignition system. [2] The method of claim 1, wherein the updated CRL is calculated by a central malicious node detection system running on a back-end server. [3] The method of claim 2, wherein the central malicious node detection system detects anomalies in the vehicle-to-vehicle communication system. [4] The method of claim 1, wherein packet logs are uploaded from the portable security unit (18) to the certificate authority to assist in detecting anomalies in the vehicle-to-vehicle communication system. [5] The method of claim 1, wherein cryptographic credentials are downloaded from the certificate authority to vehicles (10) to provide enhanced privacy for users in the vehicle-to-vehicle communication system. [6] Vehicle-to-vehicle communication system comprising: a vehicle communication processing unit for controlling a broadcast of wireless messages within the vehicle-to-vehicle communication system, the vehicle communication processing unit having a memory (16) for storing certificate revocation lists (CRLs); and a portable security unit (18) for connecting to the vehicle processing unit (14), wherein the portable security unit (18) is part of a vehicle ignition key and communicates with the processing unit to perform mutual authentication between the portable security unit (18) and the vehicle communication processing unit in response to them being connected to each other, wherein the portable security unit (18) has a non-volatile memory (24) for storing an updated certificate revocation list; wherein the portable security unit (18) connects to a network device (22) having access to a communications network (23), wherein the communications network (23) is in communication with a certificate authority to issue an updated CRL, wherein the updated CRL is downloaded from the certificate authority to the portable security unit (18), wherein the portable security unit (18) establishes a communications link with the vehicle communications system in response to initiating a vehicle security operation, wherein initiating the vehicle security operation comprises inserting the vehicle ignition key into a vehicle ignition system,and wherein the updated CRL stored in the portable security unit (18) is downloaded into the memory (16) of the vehicle communication system in response to the mutual authentication between the portable security unit (18) and the vehicle processing unit (14). [7] A vehicle-to-vehicle communication system according to claim 6, wherein the portable security unit (18) includes a key dongle.

Images