Device update transmission using Bloom filters

Abstract

The system includes an activity management service that detects a plurality of computerized devices indicating that they are to be updated for an activity and stores data corresponding to the computerized devices to be updated. The activity management service may generate a bloom filter data structure including a hash value based on the data of each computerized device to be updated and provide the bloom filter data structure to a network edge. The system may include the network edge that may use the bloom filter data structure from the activity management service to determine whether a computerized device is to obtain a device update from the activity management service. The network edge may retrieve the device update and modify the computerized device by sending the device update to the computerized device, which then installs the device update.

Description

Technical Field

[0001] The present disclosure generally relates to systems, devices and methods for securely providing device updates. More specifically, the present disclosure relates to improved systems, devices and methods for providing device updates to computerized devices (e.g., computerized devices in V2X vehicles) included in an update activity. Background Art

[0002] As computers become miniaturized and commoditized, manufacturers are producing a wider variety of devices that include any number of embedded computers and processors. The computer in a computerized device can control the device's operation; collect, store, and share data; communicate with other computers and other computerized devices; and update its own software, among other things.

[0003] The Internet of Things (IoT) is a network of computerized physical devices with embedded processors, electronics, software, data, sensors, actuators, and / or network connections that enable these devices to connect and exchange data through digital networks, including the Internet, cellular networks, and other wireless networks. Typically, each "thing" is uniquely identifiable by its embedded computing system and is able to interoperate in the existing Internet infrastructure. "Things" in the sense of IoT can refer to a wide variety of computerized devices, such as consumer appliances, enterprise equipment used in commercial and corporate environments, manufacturing machines, agricultural equipment, energy-consuming devices in homes and buildings (switches, power sockets, appliances, lighting systems, light bulbs, televisions, garage door openers, fire sprinkler systems, security systems, etc.), healthcare equipment, infrastructure management equipment, robots, drones, and transportation equipment and vehicles, etc.

[0004] In many examples, modern vehicles and transportation machines (e.g., cars, trucks, airplanes, trains, boats, motorcycles, scooters, etc.) contain several embedded processors or embedded computers in their subsystems and are computer controlled in at least some aspects. Similarly, more and more modern transportation infrastructure equipment (e.g., traffic lights, traffic cameras, traffic sensors, bridge monitors, bridge control systems, etc.) contain at least one, often multiple, embedded processors or embedded computer systems and are computer controlled in at least some aspects. These computer-controlled elements of the transportation network typically communicate with each other, passing various types of information back and forth, and they can react, respond, change their operations, or rely on and use information received / sent / sent to other vehicles in vehicle-to-vehicle (V2V, also known as car-to-car (C2C)) communications and / or infrastructure elements in vehicle-to-infrastructure (V2I, also known as car-to-infrastructure (C2I) communications to operate safely, accurately, efficiently, and reliably. V2V and V2I systems are generally referred to as V2X systems or infrastructure.

[0005] Computers in computerized devices operate according to their software and / or firmware and data. To ensure secure and correct operation, computerized devices must be properly initialized and updated as intended by the manufacturer using appropriate software, firmware, executable instructions, digital certificates (e.g., public key certificates), keys, etc. (hereinafter collectively referred to as "digital assets" or "software") so that the IoT consists of devices that execute authorized, known good software and data. However, problems arise when unauthorized individuals or organizations (e.g., hackers) replace or change the software in computerized devices. Problems also arise when older software, untested software, unapproved software, and / or software with known bugs is installed in computerized devices.

[0006] Conventional systems require significant hardware and other resource allocations to process device update requests for "campaigns" that include a large number of devices, such as a campaign to update the software of all V2X-enabled cars of a specific brand, specific model, and specific year and / or having a specific digital asset (e.g., one of a specific set of certificates), which can reach tens of thousands or even hundreds of thousands of cars. For example, conventional systems that process device update requests for a large campaign require a large amount of memory, storage, network bandwidth, etc. in order to process all requests, which include requests from a set of devices that are part of the campaign (e.g., cars of a specific brand, model, year, and / or set of certificates) interspersed with requests from devices that are not part of the campaign (e.g., cars that are part of the V2X environment but do not have the specific brand, model, year, and / or set of certificates for the campaign). The campaigns referred to herein may include device updates for a specific set of computerized devices, wherein the device updates may include software updates, firmware updates, etc.

[0007] Some conventional systems may use a linear search or a binary search to determine whether a computerized device should receive a device update as part of a campaign, e.g., to determine whether the requesting car is in a particular set of makes, models, years, and / or licenses included in the campaign. However, both linear and binary searches typically require the storage of large amounts of data, and searching the data typically requires a large amount of processing time and power. Furthermore, the amount of time required to complete each such search increases with the number of devices (e.g., cars) in the campaign. As a result, conventional systems may incur significant delays or wait times in determining whether a computerized device is included in a device update campaign, e.g., five seconds or more per device / request.

[0008] In some embodiments, the technology includes improved systems, devices, and methods that can verify that a computerized device belongs to a campaign or a group or set of computerized devices that are scheduled to receive device updates. In some implementations, the technology includes a system that can reduce hardware resources and time used to determine whether a computerized device is included in a campaign and to retrieve device updates as part of a campaign. Summary of the invention

[0009] Thus, the present technology includes improved systems, devices, and methods that can provide updates to computerized devices. In some embodiments, a system for providing updates to a computerized device may include an activity management service that includes computer-executable instructions that cause a first processor to perform operations including detecting an activity initiation request indicating that a set of computerized devices is to be updated for an activity. The operations may also include generating a bloom filter data structure including a plurality of hash values, wherein the plurality of hash values ​​correspond to the set of computerized devices to be updated. In addition, the operations may include providing the bloom filter data structure to a network edge. And, the system may include the network edge that includes computer-executable instructions that cause a second processor to perform operations including determining that the computerized device is to receive a device update from the activity management service based on a hash value associated with the computerized device matching a hash value in a plurality of hash values ​​of the bloom filter data structure. The operations may also include obtaining a device update associated with the computerized device from the activity management service in response to the activity management service confirming that the computerized device is a member of the activity. Additionally, the operations may include providing a device update to the computerized device, whereby the device update modifies the computerized device.

[0010] In one embodiment, the network edge further comprises computer executable instructions causing a second processor to perform operations comprising: determining, using the Bloom filter data structure, that the computerized device does not belong to the activity; and providing an indication to the computerized device that there are no device updates for the computerized device without communicating with the activity management service.

[0011] In one embodiment, the computerized device is an Internet of Things (IoT) device, a consumer appliance, or a vehicle.

[0012] In one embodiment, the device update may include a registration certificate or a pseudonym certificate.

[0013] In an embodiment, the device update may include software or firmware to be installed on the computerized device.

[0014] In one embodiment, the device update may include installation information or an installation script.

[0015] In an embodiment, the activity management service further comprises computer executable instructions that cause the first processor to perform operations including storing data corresponding to the computerized device to be updated.

[0016] In one embodiment, the data may include one or more of the following: an activity start date, an activity end date, a plurality of vehicle identification numbers, a plurality of product serial numbers, and a product model number.

[0017] In one embodiment, the activity management service further comprises causing the first processor to execute computer executable instructions comprising determining whether the computerized device is in the activity by accessing the data.

[0018] In one embodiment, the Bloom filter data structure is a constant size regardless of the number of computerized devices in the set.

[0019] In an embodiment, generating the Bloom filter data structure may include adjusting a plurality of hash functions that generate the hash value of the Bloom filter data structure based on a false positive rate threshold.

[0020] In one embodiment, the system enables the computerized device to poll the network edge for the device update when the Bloom filter data structure is generated.

[0021] In one embodiment, the activity management service further comprises computer executable instructions for causing the first processor to perform operations including instructing the network edge to delete the Bloom filter data structure when the activity ends.

[0022] In an embodiment, each computerized device in the set of computerized devices includes a uniform resource locator for communicating with the network edge.

[0023] In one embodiment, a network edge device may include computer executable instructions that cause a processor to perform operations including obtaining a Bloom filter data structure including a plurality of hash values ​​from an activity management service. The operations may also include determining that the computerized device is to receive a device update from the activity management service based on a hash value associated with the computerized device matching a hash value of the Bloom filter data structure. In addition, the operations may include sending a device update request corresponding to the computerized device to the activity management service. Furthermore, the operations may include obtaining a device update associated with the device update request from the activity management service after the activity management service confirms that the computerized device is a member of an activity. In addition, the operations may include providing the device update to the computerized device, whereby the computerized device installs the device update.

[0024] In one embodiment, the activity management service may include computer executable instructions that cause a processor to perform operations including detecting an activity initiation request specifying a plurality of computerized devices to be updated with a device update for the activity. The operations may also include storing data corresponding to the plurality of computerized devices to be updated and generating a bloom filter data structure including a plurality of hash values, wherein each hash value is based on data of each of the plurality of computerized devices. Furthermore, the operations may include providing the bloom filter data structure to a network edge and receiving a request for the device update from a computerized device. Furthermore, the operations may include confirming that the computerized device is a member of the activity based on the data corresponding to the plurality of computerized devices to be updated. Furthermore, the operations may include providing a device update associated with the request to the network edge, the device update modifying electronic data accessed or stored by the computerized device. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings, which are included in and constitute a part of this specification, illustrate examples of numerous features of the disclosed subject matter. Together with the description, these drawings serve to explain the principles of the various techniques described herein.

[0026] Figure 1 is a block diagram of an example operating environment for a computerized device, a network edge, and an activity management service consistent with the exemplary embodiments described herein;

[0027] Figure 2 A block diagram of an example system capable of initializing a Bloom filter data structure using a computerized device, a network edge, and an activity management service consistent with example embodiments described herein is shown;

[0028] Figure 3A and Figure 3B is a block diagram of an example operating environment for a computerized device, a network edge, and an activity management service to process device update requests consistent with the exemplary embodiments described herein;

[0029] Figure 4 is a process flow diagram of an example method for managing activity-related requests with a network edge consistent with example embodiments described herein;

[0030] Figure 5 is a process flow diagram of an example method for enabling management of campaign-related requests using a campaign management service consistent with example embodiments described herein;

[0031] Figure 6 A data flow diagram illustrating an example data flow between a computerized device, an activity management service, and a credential management service consistent with exemplary embodiments described herein; and

[0032] Figure 7 is a block diagram of an example of a computing system that may host systems and methods consistent with the exemplary embodiments described herein. DETAILED DESCRIPTION

[0033] Reference will now be made in detail to various embodiments of the technology described herein, examples of which are shown in the accompanying drawings. Whenever convenient, the same reference numerals will be used in the drawings to represent the same or similar parts.

[0034] introduction

[0035] More and more devices, sensors, appliances, etc. include other hardware components, such as network components. These network components can enable various devices to communicate with any number of external devices, servers, etc. In some examples, the software and firmware used to run the device may be outdated or unsafe. Therefore, the device can request device updates via the network component to improve device performance and prevent security issues. In some embodiments, the device is updated in a group or activity. These activities can enable the manufacturer or any other suitable entity to provide device updates to the device set. In some examples, the device can periodically poll an external server or service to determine whether there are updates available for the device (e.g., whether there is an active campaign including the device) and / or determine whether the device can retrieve device updates.

[0036] In various embodiments, device updates may include updates to automotive components after they are manufactured and initialized. For example, embedded devices such as electronic control units (ECUs) used in vehicles may be initialized during manufacturing by providing digital assets (e.g., secure assets) to ensure safe and correct operation in the field. Digital assets may include various digital certificates, keys, unique identifiers, and software. In some examples, a CMS or certificate management service generates these digital assets, and a secure provisioning system distributes these digital assets to manufacturing plants.

[0037] Typically (but not always) after leaving the factory and being put into service, a computerized device may request a device update to retrieve new or replacement software, firmware, digital assets, etc. that may cause the computerized device to function properly or in a modified manner. In some of the described embodiments, a computerized device may request a device update, and these requests may be filtered using a bloom filter data structure. Various embodiments using a bloom filter data structure provide a determination as to whether a computerized device is to receive a device update in an approximately constant amount of time that is shorter than the time required by conventional systems, using less storage than conventional systems.

[0038] Figure 1 A block diagram of an example operating environment for a computerized device, a network edge, and an activity management service that can process device update requests. In some embodiments, the system 100 can be implemented using any suitable computing device, server, external remote service network, etc. As shown in this example, the system 100 can include a network edge 102, a device management server 104, a device 106, an activity management service 108, an internal service 110, a database 112, a Bloom filter device 114, and a message server 116, etc.

[0039] In some implementations, the network edge 102 may include a device management server 104 that may implement, among other things, initialization 118 of a device update activity. The activity may specify or include any set, group, or number of devices (also referred to herein as "computerized devices") 106 for which device updates (e.g., software updates, firmware updates, or new applications, etc.) are to be retrieved. In some embodiments, the device update may include installation information or an installation script associated with software, firmware, or any combination thereof to be stored in the device 106. The installation information may indicate a directory or location within a memory of the device 106 where the device update is stored. The installation script may include executable instructions for installing the device update.

[0040] In some embodiments, device 106 may be an Internet of Things (IoT) sensor, a consumer appliance, a vehicle, or a device that is part of a vehicle. For example, device 106 may include a vehicle, a watercraft (e.g., a ship), an airplane, a spacecraft, a medical device, a robot, a drone, a wireless or wired communication module, or an IoT device. In some examples, device 106 may correspond to an RSU of a traffic control device (e.g., a traffic signal, a traffic light, or an electronic traffic sign), a digital billboard, a pedestrian warning system, a motorcycle sensor, a bicycle sensor, an electronic sign, a street light sensor, or a construction warning sensor, etc.

[0041] In some examples, the device management server 104 may detect 120 an activity initiation request (not shown) from a network interface, an external server, or a device 106. In some implementations, the device management server 104 may detect an activity initiation request from a server or device that manages the activity. The device management server 104 may then forward the activity initiation request to the activity management service 108, which may belong to an internal service 110, which may include any number of computing devices, such as servers, databases, client devices, etc. In some embodiments, the internal service 110 may detect the activity initiation request through any suitable interface that sends activity-related data along a bypass via the device management server 104. The activity initiation request may indicate a list or set of devices 106 to be updated as part of the device update activity. In some examples, the activity initiation request may include a set of device identifiers or identification information for each device, such as a set of serial numbers, a set of product names, a set of Internet Protocol (IP) addresses, a set of media access control (MAC) addresses, etc., as well as a time to start the device update, a time to end the device update, and / or other information that optionally specifies activity parameters.

[0042] In some embodiments, the activity management service 108 may determine that an activity is to be initiated. In some examples, initiating the activity may include storing 122 activity data and status in a database 112 of the internal service 110. The activity data stored in the database 112 may include information from the activity initiation request, such as a set of serial numbers, a set of product names, a set of Internet Protocol (IP) addresses, a set of Media Access Control (MAC) addresses, a set of some other device identification information, a time to start device updates, a time to end device updates, etc. In some examples, the status of the activity stored in the database 112 may indicate whether the activity has been started or whether the activity is inactive until a later time. In some embodiments, the database 112 may store data locally within the activity management service 108, or the database 112 may be an externally located database 112 accessed via a network connection (not shown).

[0043] In some embodiments, the activity management service 108 initializes 124 the data structure of the activity before processing the device update request for the activity. The data structure may include a Bloom filter data structure, a linked list, a multi-dimensional array, or any other data structure that can be used to quickly identify the device 106 and / or request 134 included in or corresponding to the activity (e.g., a device in a list or set of device identifiers from the activity initiation request). In some examples, the Bloom filter data structure is allocated as a static or constant size structure that does not expand or shrink based on or according to the number of devices in the activity (e.g., when devices are added to the activity). In some embodiments, the Bloom filter data structure may include an array of hash values ​​corresponding to the computing devices included in the activity. In some embodiments, each hash value may be generated using a separate hash function. For example, each Bloom filter data structure may be associated with X different hash functions. Each of the X different hash functions may map or hash the identification information of the computing device to a position in the array of the Bloom filter data structure. For example, in order to add a computing device to the Bloom filter data structure, the identification information of the computing device is provided to each of the X different hash functions. Each of the X different hash functions generates an output value corresponding to an array position. The array of the Bloom filter data structure can be modified to store a value for each array position that is generated as an output by the X different hash functions. In one example, identification information of the computerized device can be provided to five hash functions, each of which generates a separate array position value. The Bloom filter data structure can be modified to store a binary value or any other suitable value at each array position that maps to the output of the five hash functions. Therefore, after the computerized device is mapped to the Bloom filter data structure, the five array positions of the Bloom filter data structure can store a 1 value.

[0044] The number of hash functions that map hash values ​​to an array of Bloom filter data structures can be based on a false positive rate threshold. For example, reducing the number of hash functions compared to the number of entries in the array of Bloom filter data structures can reduce the false positive rate. Conversely, increasing the number of hash functions used to map hash values ​​to an array of Bloom filter data structures can increase the false positive rate. In some examples, activity management service 108 can adjust the number of hash functions that generate hash values ​​for a Bloom filter data structure based on the false positive rate threshold.

[0045] In some embodiments, activity management service 108 may send 126 the Bloom filter data structure to Bloom filter device 114 via message server 116. For example, message server 116 may cause the Bloom filter data structure to be provided 128 to Bloom filter device 114 synchronously or asynchronously. In some examples, network edge 102 may begin running or executing activity 130 by storing a cached copy of the Bloom filter data structure in Bloom filter device 114 or device management server 104. Thus, network edge 102 may begin processing device update requests after initializing the Bloom filter data structure by storing the Bloom filter data structure in network edge 102. In some embodiments, if device 106 requests an update and is a member of an activity that has not yet completed initialization of the Bloom filter data structure, network edge 102 will respond that the requesting device 106 has no updates available or is not part of the activity, as described below with reference to Figure 2 Thus, in some examples, device 106 can poll network edge 102 and wait 132 for a response indicating whether device 106 is active, which includes polling network edge 102 for device updates when generating a Bloom filter data structure.

[0046] Figure 1Also shown is an example of how the system 100 processes a device update request from a device 106, wherein the device 106 is included in an activity represented by a bloom filter data structure, which may be referred to as a true positive. As shown in this example, the device 106 may send a device update request 134 to the network edge 102 after the bloom filter data structure is initialized and the filtering process is run. The network edge 102 may query 136 the bloom filter data structure (e.g., on the bloom filter device 114) to determine whether the requesting device 106 belongs to the activity. In some embodiments, querying 136 the bloom filter data structure may include generating a hash value using a hash function applied to a device identifier (i.e., identification information) from the device 106. The device identifier or identification information may be or include a MAC address, an IP address, a serial number, etc. In various embodiments, a hash value for the identification information of the device 106 that matches a hash value stored in the bloom filter data structure may indicate that the device 106 may belong to or is likely to belong to the activity, wherein the hash value stored in the bloom filter data structure is generated by a series of device identifiers included in the activity initiation request. A match in the Bloom filter data structure does not guarantee that the requesting device 106 is part of an activity because, in various embodiments, the Bloom filter may produce a false positive rate of about 10% or less (e.g., 8%, 6%, 5%, 4%, 3%, 2%, 1%) or less than 1% but greater than 0%. In some embodiments, the network edge 102 may determine 138 whether a matching hash value for the device 106 is stored in the Bloom filter data structure in an approximately constant amount of time, regardless of the number of hash values ​​(corresponding to devices) in the Bloom filter data structure (corresponding to activities). Thus, the Bloom filter data structure provides faster processing time and uses a smaller amount of memory than conventional systems when determining whether the device 106 is part of an activity; and these improvements increase as the number of devices in the activity increases.

[0047] exist Figure 1 In the various embodiments shown, after finding, comparing, or otherwise identifying a match, the Bloom filter device 114 can indicate 140 to the device management server 104 that the device 106 is a member of the activity. The device management server 104 can then send a device update request 134 to the activity management service 108, for example, via the messaging server 116. In some examples, the messaging server 116 can send 144 the device update request 134 to the activity management service 108 asynchronously or synchronously.

[0048] In various embodiments, the activity management service 108 may detect the device update request 144 / 134 and query 146 the database 112 to find or otherwise determine whether the device 106 actually belongs to the activity, which is not the case if the Bloom filter data structure produces a false positive. Figure 1 In the example shown, the database 112 can return 148 activity data, activity status, a list or range of devices (e.g., device identifiers), and / or other information to the activity management service 108. In the example shown in the figure, the activity management service 108 can determine 150 that the device 106 is a member of the activity being searched, and that the device 106 is to receive or be provided with a device update as part of the activity. In some embodiments, the activity management server 108 can return 152 to the device 106 via the message server 116, the bloom filter device 114, and / or the device management server 104, or any combination thereof, an indication that the device 106 is a member of the activity. In some embodiments, the activity management service 108 returns, sends, or otherwise provides 154 the device update data to the device 106 via the network edge 102. In various embodiments, the device update data can include digital assets, such as software, firmware, etc., that adjust or update the device 106 when executed or otherwise used, such as by modifying existing functions, adding new functions, removing unwanted functions, etc.

[0049] therefore, Figure 1 1 represents a true positive example, where device 106 matches the hash value stored in the Bloom filter data structure, and device 106 does belong to the activity. In some embodiments, system 100 can be implemented with any number of devices. For example, network edge 102 can be implemented with a single server, and internal service 110 can be implemented with a single server; and system 100 can include message server 116, so that network edge 102 and internal service 110 communicate directly with each other.

[0050] Figure 2 A block diagram of an example system for initializing a Bloom filter data structure is shown. In some embodiments, system 200 can be implemented with any suitable number of computing devices, such as network edge 102, device management server 104, device 106, activity management service 108, and the like.

[0051] In some embodiments, the system 200 may include a network edge 102, which may include a device management server 104, which may detect 202 an activity initiation request from a network interface, an external server, or a device 106 (not shown). In some embodiments, the device management server 104 may detect the activity initiation request from a server or device that manages the activity. The device management server 104 may then send the activity request to an activity management service 108, which may belong to an internal service 110. In some embodiments, the internal service 110 may detect the activity initiation request through any suitable interface that sends activity-related data along a bypass via the device management server 104. The activity initiation request may indicate a series of devices to be updated as part of a device update activity. In some examples, the activity request may include a set of serial numbers, a set of product names, a set of Internet Protocol (IP) addresses, a set of Media Access Control (MAC) addresses, a time to start device updates, a time to end device updates, and the like.

[0052] In some embodiments, the activity management service 108 may determine that an activity is about to be initiated. In some examples, initiating the activity may include storing 204 activity data and status in a database 112 of the internal service 110. The activity data stored in the database 112 may include information from the activity request, such as a set of serial numbers, a set of product names, a set of Internet Protocol (IP) addresses, a set of media access control (MAC) addresses, a time to start device updates, a time to end device updates, etc. In some examples, the status of the activity stored in the database 112 may indicate whether the activity has started or a subsequent time and date when the activity starts. In some embodiments, the activity management service 108 generates 206 a data structure of the activity before processing the device update request for the activity. The data structure may include a Bloom filter data structure, a linked list, a multidimensional array, or any other data structure. In some embodiments, the Bloom filter data structure may include an array of hash values ​​corresponding to the computing devices included in the activity. In some embodiments, each hash value may be generated by a separate hash function.

[0053] Figure 2Also shown is an example of how the system 200 processes a device update request received from a device 106 before the Bloom filter data structure representing the activity is ready for use by the network edge 102. In the illustrated example, while the Bloom filter data structure is being generated at activity initiation time, and / or before the Bloom filter data structure is retrieved and installed within the network edge 102, the device management server 104 may receive or detect 208 a device update request 134 from the device 106, which would trigger a determination as to whether the device 106 is active. In the illustrated example, since the activity management service 108 was in the process of generating 206 the Bloom filter data structure for the activity when the request 208 / 134 arrived, the device management server 104 would return a response 214 indicating that there are no updates for the device 106, or in other words, a response 214 indicating that the device 106 is not active.

[0054] In this particular example, the device management server 104 may send 210 a request 208 / 134 for a device update from the device 106 to the Bloom filter device 114. The Bloom filter device 114 may determine 212 whether the device 106 has active membership by generating a hash value based on identification information (e.g., serial number, IP address, MAC address, etc.) of the device 106 included in the request 208 / 134. In various examples, the Bloom filter device 114 may compare the hash value of the device 106 to a hash value of a Bloom filter data structure stored in the Bloom filter device 114 in an attempt to identify a matching hash value. Figure 2 In the example of , since the Bloom filter data structure has not yet been received from the activity management service 108, the Bloom filter device 114 does not yet have a Bloom filter data structure stored for the activity, and therefore, the Bloom filter device 114 cannot perform any comparison.

[0055] For this case of the illustrated embodiment, Bloom filter device 114 returns 214 an exclusion response via device management server 104 indicating that device 106 is not in an activity. This may occur even if device 106 belongs to an activity associated with a Bloom filter data structure that was concurrently generated, created, or generated 206 by activity management service 108.

[0056] In some embodiments, the device 106 may periodically poll the network edge 102 (e.g., send a request) for device updates. For example, the device 106 may send a request for device updates to the device management server 104 based on a predetermined time interval (e.g., a number of minutes, hours, days, weeks, months, years, etc.). In such an embodiment, one or more polling requests 208 may arrive at the network edge 102 at the same time as the Bloom filter data structure is generated. In some embodiments (as shown), the network edge 102 may determine that the device does not belong to the activity and return a no update or exclusion response 214 to the device 106 without communicating with the activity management service 108.

[0057] As mentioned above Figure 1 As discussed, the activity management service 108 may send 216 the Bloom filter data structure to the network edge 102, e.g., via the messaging server 116, after generating the Bloom filter data structure. In some examples, the network edge 102 may store a cached copy of the Bloom filter data structure in the device management server 104 or in a separate Bloom filter device 114. In some embodiments, the network edge 102 may begin processing the device update request 134 using the Bloom filter data structure after the Bloom filter data structure is initialized and stored within the network edge 102. In various implementations, the device management server 104 may return the device update 154 to any appropriate device 106 that belongs to the activity associated with the Bloom filter data structure stored after the Bloom filter data structure is initialized.

[0058] Figure 3A and Figure 3B A block diagram of an example operating environment for computerized devices, network edge, and activity management service to process device update requests. In some embodiments, system 300 may be implemented with any suitable number of computing devices, such as network edge 102, device management server 104, device 106, and activity management service 108.

[0059] exist Figure 3A In the example shown, the Bloom filter data structure may be as described above with respect to Figure 1 and Figure 2302 . For example, any suitable external server, web-based interface, computing device, etc. may initiate 302 a device update activity via an initialization request 304 sent to the internal service 110. In some embodiments, the activity management service 108 may initiate the activity by storing 306 the activity data and state in the database 112 of the internal service 110. In some implementations, the activity management service 108 initializes 308 a data structure for the activity, such as a Bloom filter data structure, before starting the activity. In some embodiments, the activity management service 108 may send 310 the Bloom filter data structure to the Bloom filter device 114 via the messaging server 116.

[0060] Figure 3A First, an example of how the system 100 processes a device update request from a device 106 is shown, where the device 106 is not included in the activity represented by the Bloom filter data structure. As shown in this example, the network edge 102 can begin implementing, running, or executing the activity 312 by storing a copy of the Bloom filter data structure in the Bloom filter device 114 or the device management server 104. Thereafter, since the Bloom filter data structure representing the activity is stored in the network edge 102, the network edge 102 can process the device update request for information about the activity. In some examples, the system 100 waits 314 until the Bloom filter data structure representing the activity is stored in the network edge 102 before processing the device request. In some embodiments, the network edge 102 can support multiple simultaneous activities related to various device updates for various devices. In some such embodiments, each activity can be represented by a separate Bloom filter data structure; while in other embodiments, a single Bloom filter data structure generated from data from multiple activities can be used to represent all activities in a single data structure.

[0061] exist Figure 3AIn the illustrated example, device management server 104 may receive or detect 316 an update request from device 106, as previously described. In some examples, device management server 104 may send 318 the device update request from device 106 to bloom filter device 114. Bloom filter device 114 may determine 320 membership of device 106 in the activity by generating a hash value based on or using identification information of device 106, wherein the identification information of device 106 is included in request 316. In some examples, bloom filter device 114 may compare the hash value of device 106 with hash values ​​stored in a bloom filter data structure in bloom filter device 114 in an attempt to find or identify a matching hash value in the bloom filter data structure. Bloom filters do not produce false negatives; therefore, the lack of a matching hash value indicates that device 106 is not part of the activity and / or no update data is available. In the illustrated example, the hashed identification information of the device 106 is not in the Bloom filter data structure, and therefore, the Bloom filter device 114 returns a response 322 via the device management server 104 indicating that the device 106 is not active or does not currently have an update available.

[0062] Figure 3B Also shown is an example of how the system 100 handles a device update request 324 from a device 106 that is not actually included in the activity but appears to be in the activity (which may be referred to as a false positive) according to the representation of the Bloom filter data structure. As previously described, in various embodiments, the Bloom filter data structure may produce a false positive rate of about 10% or less, for example, about 5%. As shown in this example, the device management server 104 receives or detects a request 324 from a device 106 to update, which may trigger a determination as to whether the device 106 is active. In such an example, the request 324 may be from or correspond to a different device 106 than the device that issued the request 316 from the previous example and is not included in the activity.

[0063] In some examples, device management server 104 may send 326 a device update request 324 from device 106 to Bloom filter device 114. Bloom filter device 114 may determine 328 membership of requesting device 106 in the active state by generating a hash value based on identification information of the request of device 106 and looking up a hash value in a Bloom filter data structure that is identical to the generated hash value. Upon finding the identical hash value in the Bloom filter data structure, Bloom filter device 114 returns 330 a response to device management server 104 indicating that device 106 is likely active (because the hash value identified in the Bloom filter data structure matches the hash value generated corresponding to device 106).

[0064] In some implementations, the device management server 104 may send 332 a device update request for the device 106 to the activity management service 108 via the messaging server 116. In some examples, the activity management service 108 may query 334 the database 112 to find or otherwise determine whether the device is a member of the activity, which may not be the case if the Bloom filter data structure produces a false positive. After the database 112 returns 336 the data and state information for the activity to the activity management service 108, in this particular example, the activity management service 108 determines 338 that the requesting device 106 does not belong to the activity. In some examples, the activity management service 108 may return 340 a response indicating that the device 106 does not belong to the activity via the messaging server 116, the Bloom filter device 114, and / or the device management server 104, or any combination thereof.

[0065] exist Figure 3B In the example of , although device 106 is not actually part of the activity, network edge 102 has generated a false positive indicating that device 106 is part of the activity and will receive a device update. This occurs when the hash value generated by the identification information of the requesting device 106 happens to match the hash value of a different device that is actually part of the activity represented by the Bloom filter data structure. As described above, this false positive error is ultimately detected when the activity management service 108 accesses the data and state information of the activity to verify that the requesting device 106 is actually a member of the activity. Nevertheless, because various embodiments of the Bloom filter device 114 never return a false negative membership response to a device 106 that is not part of the activity, the overall performance of the Bloom filter device 114 reduces the wait time experienced by the requesting device 106 and reduces end-to-end resource usage and processing time by greatly reducing the number of device update requests sent to and processed by the activity management service 108 (particularly the number of non-activity member requests).

[0066] Figure 4 is a process flow diagram of an example method that can be utilized to manage activity-related requests using a network edge. In some embodiments, method 400 can be implemented using any suitable number of computing devices, such as network edge 102, device management server 104, bloom filter device 114, network edge 602, activity service 608, or any combination thereof.

[0067] As shown in this example, at block 402, a network edge may detect a request to initiate a campaign for a device update. In some embodiments, any suitable server, web-based interface, device, or computerized device may initiate a campaign by providing a list or set of computerized devices that are in or belong to the campaign, and data such as a campaign start date and a campaign end date, wherein each of the computerized devices in the list or set is identified by a unique identifier, such as a vehicle identification number, a product serial number, a product model number, etc. In some embodiments, a uniform resource locator for the network edge is stored in a protected memory of each computerized device (e.g., computerized device 106) requesting a device update. The uniform resource locator enables the computerized device to securely contact a predetermined authorized network edge.

[0068] At block 404, the network edge may send the request to an activity management service (e.g., activity management service 108). In some embodiments, the network edge may send the request to the activity management service via a messenger device or service (e.g., messaging service 116). The messenger device may support asynchronous or synchronous communication. For example, the messenger device may store any number of requests and send the requests to the activity management service at a later time. In some embodiments, the messenger device may send requests for any number of activities from one or more network edges to one or more activity management services.

[0069] At block 406, the network edge may receive, retrieve, obtain, or otherwise access a Bloom filter data structure corresponding to the requested activity from the activity management service. For example, after a request to initiate an activity is processed by the activity management service, the network edge may receive or retrieve a Bloom filter data structure generated by the activity management service. In some embodiments, the Bloom filter data structure may be stored within the network edge in a device management server that communicates with the computerized device. In some examples, the Bloom filter data structure may be stored within the network edge in a separate device (e.g., Bloom filter device 114) accessible to the device management server.

[0070] During operation, the device management server may receive or detect a request from a computerized device to attempt to determine whether a device update for the campaign is available for the requesting device. The device management server may query a Bloom filter data structure stored locally or in a separate Bloom filter device to determine whether the computerized device is not a member of the campaign or whether the computerized device may be a member of the campaign, depending on a possible, low probability, false positive.

[0071] At block 408, the network edge may determine that the computerized device is likely to have a device update available from the activity management service based on a hash value associated with the computerized device matching a hash value stored in a Bloom filter data structure, wherein the stored hash value is identified by querying the Bloom filter data structure (as described above). On the other hand, when the requesting computerized device is not part of the activity / does not have any updates available, then the network edge may return a negative response to the computerized device. This occurs when the hash value associated with the computerized device does not match any hash value stored in the Bloom filter data structure.

[0072] In some embodiments, the network edge may generate any number of hash values ​​from the identification information for the computerized device and compare the hash values ​​to the values ​​stored in the Bloom filter data structure. For example, the Bloom filter data structure may store five or more hash values ​​based on the outputs from the identification information of the computerized device applied to five or more separate hash functions. In some embodiments, any number of hash functions may be used to generate the hash values ​​stored in the Bloom filter data structure.

[0073] At block 410, the network edge may send a device update request corresponding to the computerized device to the activity management service. In some embodiments, the network edge may send the device update request to the activity management service in response to detecting one or more hash values ​​corresponding to the identification information of the requesting device matching the hash values ​​in the Bloom filter data structure. In some examples, sending the device update request to the activity management service may enable verification that the computerized device belongs to the activity and is not a false positive.

[0074] In block 412, the network edge may receive, retrieve, or otherwise obtain device updates associated with the requesting computerized device from the activity management service, once the activity management service has verified, confirmed, or determined that the computerized device is indeed a member of the activity. In some embodiments, the activity management service may verify that the computerized device is a member of the activity based on stored data corresponding to the activity. For example, the data may include a list of identification information of computerized devices that may retrieve device updates as part of the activity (i.e., a list of identifiers corresponding to computerized devices included in the activity); and the activity management service may determine that the requesting device is on the list. In some embodiments, the network edge may receive or retrieve device updates from the activity management service directly or via a messenger device, or from any other suitable computing device.

[0075] At block 414, the network edge may update, revise, provide, or modify the computerized device by sending a device update from the activity management service to the computerized device. In some embodiments, the device update may modify software, firmware, and the like stored in the computerized device. The network edge may send or otherwise provision the device update to the computerized device, which may automatically install the device update upon receipt. In some examples, the device update may modify the computerized device by installing a new application, modifying an existing application, updating a firmware driver that controls a hardware component, and the like.

[0076] Figure 4 The process flow diagram of method 400 is not intended to indicate that the operations of method 400 are to be performed in any particular order, or that the operations cannot be performed simultaneously, or that all operations of method 400 are to be included in every situation. In addition, method 400 may include any suitable number of other operations. For example, method 400 may also include the computerized device and the activity management service exchanging each other's transport layer security certificates before retrieving device updates. In some embodiments, the network edge may not detect the request to initialize the activity and send the request to the activity management service. For example, an external server, a web-based interface, etc. may initialize the activity by sending the data of the activity directly to the activity management service without accessing the network edge.

[0077] Figure 5 is a process flow diagram of an example method that can utilize an activity management service to manage activity-related requests.In some embodiments, method 500 can be implemented using any suitable number of computing devices, such as activity management service 108, database 112, internal services 110, activity service 608, or any combination thereof.

[0078] At block 502, an activity management service may receive or detect an activity initiation request indicating a plurality of computerized devices to be updated for an activity. In some embodiments, the activity management service may detect the activity initiation request from a network edge or from a messenger device providing asynchronous or synchronous messages from a network edge. In some embodiments, the activity management service may detect the activity initiation request directly from a web-based interface, a device managing the activity, etc. As described above, the activity initiation request may include identification information of each device that should receive device updates as part of the activity, an activity start date or time, and an activity end date or time, etc.

[0079] At block 504, the activity management service may store data corresponding to the computerized device to be updated. In some embodiments, the activity management service may store data corresponding to the computerized device to be updated locally or in an external database. In some implementations, the activity management service may analyze, search, or query the data to determine whether the computerized device belongs to the activity. For example, if the activity management service later detects a device update request from a computerized device having a unique identifier, the activity management service may analyze, search, or query the data to determine whether the device (e.g., whether the unique identifier) ​​is included in the activity so that the device update can be provided to the computerized device.

[0080] At block 506, the activity management service may generate a Bloom filter data structure representing computerized devices included in the activity and therefore to be updated by the device providing the activity. In various implementations, the Bloom filter data structure includes a plurality of hash values, wherein the hash values ​​are generated from a unique identifier (or other identification information) for each of the computerized devices that are part of the activity. In some examples, the Bloom filter data structure may include a hash value based on data or identification information for each of the computerized devices to be updated.

[0081] In some embodiments, the Bloom filter data structure may include any number of hash values ​​based on the identification information of each computerized device to be updated. For example, the Bloom filter data structure may include an array, a linked list, a vector, etc. that can store any number of hash values. In some embodiments, the identification information of each computerized device is applied to any number of hash functions, and each hash function generates an output bit or series of bits stored in the Bloom filter data structure. In some embodiments, the activity management service may generate the Bloom filter data structure based on a union operation applied to multiple groups of computerized devices to be included in the activity.

[0082] At block 508, the activity management service may send or otherwise provide the Bloom filter data structure to a network edge, for example, after the Bloom filter data structure is initialized. In some embodiments, the activity management service may send the Bloom filter data structure to the network edge via an asynchronous messenger device (e.g., message server 116). For example, the asynchronous messenger device may receive the Bloom filter data structure and then delay sending the Bloom filter data structure to the network edge until a later time or date, which may improve communications via network interfaces with high latency and / or low bandwidth limitations.

[0083] At block 510, the activity management service may receive a device update request from a computerized device. In some embodiments, the activity management service may receive a device update request only after determining that the computerized device corresponding to the request is likely (except for false positives) to belong to an activity based on the Bloom filter data structure provided by the activity management service to the network edge at block 508. In some such embodiments, the network edge forwards the device update request to the activity management service only when a hash value generated or obtained by the identification information of the requesting computerized device matches a hash value stored in the Bloom filter data structure. As described above, when the hash value generated or obtained by the identification information of the requesting computerized device does not match any hash value stored in the Bloom filter data structure, the network edge does not contact the activity management service, but instead provides an accurate "no update" response to the computerized device requesting a device update but not included in the activity.

[0084] At block 512, the activity management service may confirm, verify, or otherwise determine that the computerized device is a member of the activity. In some embodiments, the activity management service may compare identification information of the computerized device for which the device update has been requested with data stored for the activity (e.g., stored locally or stored in a database) to determine whether the activity data indicates that the computerized device is part of the activity. In various embodiments, the identification information of the computerized device is included in the request. As a more specific example, the activity management service may search for the unique identifier of the computerized device in a list of unique identifiers (e.g., serial numbers) that are part of the activity data, wherein the list of unique identifiers in the activity data includes all devices that are part of the activity.

[0085] At block 514, the activity management service, after determining that the computerized device is indeed a member of the activity, can send a device update associated with the device update request (and the activity) to the network edge. In some examples, the device update can be code, instructions, binary, etc. that adds to, replaces, and / or modifies firmware, software, or any combination thereof stored on the computerized device.

[0086] If the activity management service does not confirm, verify, or otherwise determine that the computerized device is a member of the activity at block 512, the activity management service does not perform the operations of block 514. In various implementations, the activity management service may determine that the computerized device is not a member of the activity because the computerized device (e.g., identification information of the computerized device) is not listed, identified, or otherwise represented in the activity data.

[0087] In some embodiments, if the activity management service does not confirm, verify, or otherwise determine that the computerized device is a member of the activity at box 512, then at box 516 the activity management service sends, or otherwise provides or indicates to the network edge a message indicating that the requesting device is not part of the activity and / or that there are no updates for the requesting device.

[0088] Figure 5 The process flow diagram of method 500 is not intended to indicate that the operations of method 500 are to be performed in any particular order, or that the operations cannot be performed simultaneously, or that all operations of method 500 are to be included in every situation. In addition, method 500 may include any suitable number of other operations. For example, when an activity has ended (e.g., when an activity end date occurs), the activity management service can instruct the network edge to delete the Bloom filter data structure, such as by sending a message to the network edge to refresh a cache or storage device storing the Bloom filter data structure, wherein the message can be triggered in response to the end of the activity.

[0089] Figure 6 An example operating environment 600 is shown in which a network edge 602 interacts with a certificate management service 604, which is an example of a type of service for providing digital assets. In some embodiments, the certificate management service 604 may be a V2X certificate management service. In additional or alternative embodiments, the certificate management service 604 may be a C2X certificate management service and may be implemented as a server, one or more virtual machines located on one or more computing devices, etc. As shown, the network edge 602 may submit a device update request (e.g., a certificate, etc.) for one or more computerized devices 606 to the certificate management service 604 via an activity service 608 and a network 610 (e.g., the Internet). In some embodiments, a device update may enable an application to be executed on a computerized device 606 in a secure environment. For example, a device update may include a certificate that enables a computerized device 606 to securely transmit communications with other computerized devices in a runtime environment.

[0090] In some embodiments, the computerized device 606 corresponds to one or more of a vehicle, a watercraft (e.g., a ship), an airplane, a spacecraft, a medical device, a robot, a drone, a wireless or wired communication module, and an IoT device. For example, the computerized device 606 may correspond to an OBU or ECU of a vehicle, a watercraft, an airplane, a spacecraft, a robot, a drone, a medical device, or an IoT device. Moreover, for example, the computerized device 606 may correspond to an RSU of a traffic control facility (e.g., a traffic signal, a traffic light, or an electronic traffic sign), a digital billboard, a pedestrian warning system, a motorcycle sensor, a bicycle sensor, an electronic sign, a street light sensor, or a construction warning sensor.

[0091] In some embodiments, the network edge 602 may use a bloom filter data structure as described above to determine whether the computerized device 606 is to receive a device update from the certificate management service 604. In some examples, the device update may include an enrollment certificate, a pseudonym certificate, firmware, software, etc. The enrollment certificate may include any suitable digital certificate that enables device updates such as software updates, firmware updates, or any combination thereof to be provided to the computerized device 606. The pseudonym certificate may include a separate digital certificate that enables the computerized device 606 to securely exchange data or communicate during a runtime environment. In some embodiments, the network edge 602 may send a response to a computerized device 606 that is not included in the device update activity. For example, a hash value based on the identification information of the computerized device 606 may not match a hash value stored in a bloom filter data structure associated with the device update activity. In some examples, the network edge 602 may determine that one or more computerized devices 606 are included in the device update activity. The network edge 602 may send the device update request via the activity service 608 to a registration authority 612 , an enrollment certificate authority 614 , a pseudonym certificate authority 616 , or any combination thereof.

[0092] In operating environment 600, device updates or certificate requests are received by activity service 608 from network edge 602 via any suitable interface. For example, activity service 608 may implement an API based on a client representational state transfer (REST) ​​protocol or a simple object access protocol (SOAP), etc. Figure 6 As shown, the activity service 608 can implement a public or private API, and the certificate management service 604 can be a V2X or C2X certificate management service. The certificate management service 604 accepts the device update request, completes the task within the time frame, and then returns the result (e.g., the generated device update or certificate) to the network edge 602 via the activity service 608 and the network 610. In some embodiments, the time frame can be several minutes, hours, or days, etc., depending on the processing capacity of the certificate management service 604.

[0093] The certificate management service 604 includes components for generating requested device updates. Figure 6In the example shown, these components include registration authority 612 , registration certificate authority 614 , pseudonym certificate authority 616 , linkage authority 1 618 , and linkage authority 2 620 .

[0094] In additional or alternative embodiments, the components of the certificate management service 604 may vary depending on whether the certificate management service 604 is configured as a V2X or C2X certificate management service. For example, in the case where the certificate management service 604 is used as a C2X certificate management service, the certificate management service 604 may include a Long Term Certificate Authority (LTCA) configured to perform a role similar to the registration certificate authority 614. Similarly, when the certificate management service 604 is implemented as a C2X certificate management service, the certificate management service 604 may include an Authorization Authority (AA) that performs a role similar to the pseudonym certificate authority 616. The components of the certificate management service 604 will be described in the following paragraphs.

[0095] In one example, the certificate management service 604 can be implemented as a CMS. Various embodiments of the certificate management service 604 can be used for a very large number of device transactions and certificate generation processes. In various embodiments, the certificate management service 604 can be implemented using multiple servers, multiple hardware security modules (HSMs), multiple computing engines, and multiple application platforms. In an example embodiment, each application platform may include one or more virtual machines (VMs) for storing a registration center 612, a registration certificate center 614, a pseudonym certificate center 616, and link centers 618 and 620. In additional or alternative embodiments, each application platform may include one or more hardware platforms, such as an application server, a computer, or other computer hardware capable of storing and executing software applications. Figure 6 In the example shown, the application platform for the registration certificate center 614 may be one or more VMs running an application for the registration certificate center 614, and the application platform for the pseudonymous certificate center 616 may be one or more VMs operable to store and run an application for the pseudonymous certificate center 616. Similarly, the application platform for link center 1 618 may be one or more VMs configured to store and run link center 1 applications, and the application platform for link center 2 620 may be one or more VMs operable to store and run link center 2 applications. Non-limiting examples of the certificate management service 604 may be implemented in a private data center, a cloud data center (e.g., Amazon Web Services (AWS) from Amazon), or a hybrid of private and cloud data centers.

[0096] In some embodiments, the certificate management service 604 can provide device updates including security certificates, such as registration certificates and pseudonym certificates, to be used by the manufacturer's distributor appliance or network edge 602. In certain embodiments, the certificate management service 604 can interact with a digital asset management system (DAMS, not shown) to provide certificates to the distributor appliance (not shown).

[0097] like Figure 6 As shown, the architecture of the certificate management service 604 includes a registration center 612, a registration certificate center 614, a pseudonym certificate center 616, a link center 1 618, and a link center 2 620. Each of these components can utilize a respective dedicated computing engine (not shown) to perform tasks. For example, the registration center 612 can utilize a registration center computing engine, the registration certificate center 614 can utilize a registration certificate center computing engine, the pseudonym certificate center 616 can utilize a pseudonym certificate center computing engine, the link center 1 618 can utilize a link center 1 computing engine, and the link center 2 620 can utilize a link center 2 computing engine. The functions of each of these components will be described in the following paragraphs.

[0098] In some embodiments, the architecture of the certificate management service 604 advantageously separates non-security related applications from security functions. Figure 6 As shown in the example of , the registration center 612, the registration certificate center 614, the pseudonymous certificate center 616, and the link centers 618 and 620 are implemented as applications on their own VMs, which are executed on their own dedicated computing engines, all of which are separated from any non-security related applications and functions. This provides technical and security advantages over traditional systems, in which the performance of HSMs is slow, or the cloud service provider cannot supply HSMs, or their proper management of HSMs is uncertain. In the certificate management service 604, cryptographic operations using HSMs are performed in a computing engine (e.g., one or more computing engines).

[0099] By separating critical security functions from each other and onto separate compute engines, such as Figure 6As shown, computationally intensive cryptographic and security functions (e.g., elliptic curve butterfly expansion computation or elliptic curve digital signature) performed by, for example, a registration center 612, a registration certificate center 614, a pseudonymous certificate center 616, and link centers 618, 620 are performed much faster than existing conventional registration center systems. This design, combined with the activity service 608 described below, enables significant improvements in transaction processing in a multi-client environment by preventing any technical performance issues associated with the network 610 from interfering with or delaying the provisioning of digital assets to computerized devices 606 to retrieve from the certificate management system 604. For example, the activity service 608 can determine which computerized devices 606 belong to a device update activity and send a device update request. Therefore, the activity service 608 can determine whether the computerized device 606 belongs to a device update activity, and, if so, provide the retrieved device updates (e.g., registration certificates and pseudonymous certificates) to those computerized devices 606 during the provisioning process or at a later time. In some examples, the activity service 608 can avoid bandwidth issues, network connectivity issues, etc. while provisioning the computerized devices 606. For example, the activity service 608 can prevent a large number of computerized devices 606 from querying the registry 612 for device updates. The activity service 608 can also quickly process device update requests with less data storage by storing hash values ​​in a bloom filter data structure, wherein the hash values ​​can be based on identification information from the computerized devices 606 belonging to the activity. In addition, in some examples, the activity service 608 can synchronously or asynchronously retrieve the registration certificate and the pseudonym certificate from the CMS 604 and synchronously or asynchronously provide the registration certificate and the pseudonym certificate to the computerized devices 606. In some examples, the asynchronous retrieval and distribution of the registration certificate and the pseudonym certificate can also reduce the time of the provisioning process for each computerized device. Thus, embodiments consistent with the present disclosure provide a specific, technically advantageous system architecture to determine computerized devices 606, wherein the computerized devices 606 are to retrieve device updates as part of an activity and retrieve device updates such as digital assets from the certificate management system 604.

[0100] In some embodiments, if the scale of the registry application executed by the registry 612 is to be modified, then additional VMs can be added without changing the secure computing capabilities of the registry computing engine. Alternatively, if security computing limits performance, then additional secure registry computing engines can be added. For other components of the certificate management service 604, this same multidimensional scaling (multi-dimensional scaling) is also applicable. Compared with existing conventional certificate management services (CMS), these functions can provide significant performance improvements and scalability. In some embodiments, the respective application platforms of the registry 612, the registration certificate center 614, the pseudonym certificate center 616 and the link center 618, 620 are connected to the computing engine in communication via respective input message queue sets, so that all these components of the certificate management service 604 can be scaled independently of each other.

[0101] As mentioned above, Figure 6 As shown in the non-limiting example of, each of the registration center 612, the certificate center 614, 616, and the link center 618, 620 can be implemented as an application on its own virtual machine (VM). In additional or alternative embodiments, one or more of the registration center 612, the certificate center 614, 616, and the link center 618, 620 can be executed on a hardware platform (e.g., a server or a computing engine). The role and function of each of these applications executed on the application platform (e.g., VM or hardware platform) will be described in the following paragraphs.

[0102] In various embodiments, the registry 612 can be an institution in a provisioning network that verifies user requests for digital certificates or other types of digital security assets and enables certificate centers (e.g., the registry certificate center 614 and the pseudonymous certificate center 616) to issue digital certificates. In various embodiments, the registry 612 can implement any suitable public key infrastructure (PKI) technology. In various embodiments, the activity service 608 can pass the certificate request to the registry 612, which can be implemented as a representational state transfer (REST) ​​web service or a SOAP-based service, etc. In various embodiments, there can be multiple instances of the registry 612 executing simultaneously. This is for Figure 6The other components of the certificate management service 604 are similarly represented. The registry function of the certificate management service 604 is decentralized because its functions can be performed by multiple instances of the registry 612 implemented as a REST web service. One role of the registry 612 is to grant and satisfy certificate provisioning requests while preventing the signing pseudonym certificate center 616 from determining which certificates are to be stored in a particular computerized device. The registry 612 can interact directly with the pseudonym certificate center 616 and the link centers 618, 620 via a message queue to fulfill its role in the certificate management service 604.

[0103] In some embodiments, the registry 612 (and Figure 6 The certificate management service 604 may utilize a data store or a collection of databases for data storage and retrieval. For example, the database used may be composed of one or more database logical or physical units, where each unit has one or more tables that enable data separation when necessary. As used herein, the term "database" refers to one or more databases or data stores. In some embodiments, the use of multiple databases may allow the registry 612 to communicate with multiple databases. Figure 6 Data separation between other components shown. For example, such use of multiple databases allows data separation between the registration center 612, the certificate center 614, 616 and the link center 618, 620.

[0104] In some embodiments, the database used by the certificate management service 604 is a collection of one or more fast-access, low-latency databases. In some embodiments, the database may be a NoSQL database or database service, such as the DynamoDB data service provided by Amazon web services. In various embodiments, the data stored in the database depends on the application, but may include certificates issued in the past, various linkage authority values, data on devices to which certificates have been issued, operator actions, etc. In some examples, the data may be stored unencrypted, encrypted, or some combination thereof.

[0105] In various embodiments, since the digital certificates generated by the registration center 612 are divided into different parts, i.e., the registration digital certificates and the pseudonymous digital certificates, the certificate management service 604 includes the registration certificate center 614 and the pseudonymous certificate center 616. The registration certificate center 614 is a non-central component of the certificate management service 604, because there may be multiple instances of the registration certificate center 614 executing simultaneously. For example, in some embodiments, there may be multiple instances of the registration certificate center 614 executing simultaneously. The registration certificate center 614 may receive a request for a registration certificate from the registration center 612. One role of the registration certificate center 614 is to satisfy the request from the registration center 612 to issue a registration certificate to a terminal device (e.g., a distributor device). In some embodiments, the registration certificate center 614 interacts directly with the registration center 612 to fulfill its role in the CMS 604.

[0106] The pseudonym certificate center 616 is a non-central component of the CMS because there may be multiple instances of the pseudonym certificate center 616 executing simultaneously. For the pseudonym certificate center 616, in various embodiments, there may be multiple instances of the pseudonym certificate center 616 executing simultaneously in parallel. The pseudonym certificate center 616 may receive requests for pseudonym certificates from the registration center 612. One role of the pseudonym certificate center 616 is to satisfy requests from the registration center 612 to issue pseudonym certificates to terminal devices (e.g., computerized device 606). In certain embodiments, the pseudonym certificate center 616 satisfies requests for short-term pseudonym certificates for V2V functionality. In some embodiments, the pseudonym certificate center 616 interacts directly with the registration center 612 to implement its role in the CMS 604.

[0107] In various embodiments, Figure 6 The link centers 618, 620 shown link the identity of the certificate requester (i.e., the unique identifier of the device of the certificate requester) to the issued pseudonym certificate for revocation. That is, the link center 1618 and the link center 2620 provide the link value of the unique identifier of the device of the certificate requester to the issued pseudonym certificate. The link center 1618 and the link center 2620 can receive the request for the link value from the registration center 612, and then provide the requested link value to the registration center 612. The link centers 618, 620 interact directly with the registration center 612 to satisfy the request for the link value.

[0108] In various embodiments, the compute engines of CSM 604 may include an HSM, which allows these components to perform secure computations without undue threat from hackers. In some embodiments, the compute engines may be designed to perform secure computations themselves without an embedded HSM - in such embodiments, they embody an HSM.

[0109] In various embodiments, different HSM versions may be used in CMS 604. For example, the HSM may include an embedded HSM installed as a plug-in card in one or more computing engines. In such example embodiments, the embedded HSM may be installed in one or more computing engines as a Peripheral Component Interconnect (PCI) HSM or a PCI Express (PCIe) HSM. And, for example, the HSM in the certificate management service 604 may include external, network-attached, or network-connected HSMs that are separate from the computing engines in their own enclosures.

[0110] Those skilled in the art will recognize that Figure 6 The components and implementation details shown are examples given for simplicity and clarity of explanation. Other components, processes, implementation details and variations may be used without departing from the principles of the technology described herein, as this example is not intended to be limiting and many variations may be made.

[0111] Figure 7 700 includes a computing system 702 that can be used to implement systems and methods consistent with embodiments of the present technology. Other components and / or arrangements can also be used. In some embodiments, the computing system 702 can be used to at least partially implement Figure 1-Figure 6 Components of the network edge 102, the activity management service 108, the network edge 602, or the activity service 608. In some embodiments, a series of computing systems similar to the computing system 700 can each be customized and / or programmed as a dedicated server with specialized hardware to implement Figure 1-Figure 6 One of the components shown, which can communicate with each other via a network 704.

[0112] exist Figure 7In the example shown, the computing system 700 includes multiple components, such as a central processing unit (CPU) 706, a memory 708, an input / output (I / O) device 701, a hardware security module (HSM) 712, and a non-volatile storage device 714. The system 700 can be implemented in various ways. For example, an embodiment as an integrated platform (e.g., a server, a workstation, a personal computer, a laptop, etc.) may include a CPU 706, a memory 708, a non-volatile memory 714, and an I / O device 710. In such a configuration, components 706, 708, 714, and 710 can be connected and communicated via a local data bus, and can access a data repository 716 (implemented as, for example, a separate database system) via an external I / O connection. The I / O component 710 can be connected to an external device via a direct communication link (e.g., a hardwired or local Wi-Fi connection), via a network such as a local area network (LAN) or a wide area network (WAN, such as a cellular phone network or the Internet), and / or via other suitable connections. System 700 may be stand-alone or a subsystem of a larger system.

[0113] CPU 706 may be one or more known processors or processing devices, such as the Core family of microprocessors manufactured by Intel Corporation of Santa Clara, California, USA or the Athlon family of microprocessors manufactured by AMD Corporation of Sunnyvale, California, USA. Memory 708 may be one or more fast storage devices configured to store instructions and information executed or used by CPU 706 to perform certain functions, methods and processes related to embodiments of the present technology. Storage 714 may be a volatile or non-volatile, magnetic, semiconductor, tape, optical or other type of storage device or computer-readable medium, including devices such as CDs and DVDs and solid-state devices, for long-term storage.

[0114] In the illustrated embodiment, memory 708 contains one or more programs or applications 718 loaded from storage 714 or from a remote system (not shown) that, when executed by CPU 706, perform various operations, procedures, processes, or methods consistent with the present technology. Alternatively, CPU 706 may execute one or more programs remote from system 700. For example, system 700 may access one or more remote programs via network 704 that, when executed, perform functions and processes related to embodiments of the present technology.

[0115] In one embodiment, the memory 708 may include one or more programs 718 for performing the specialized functions and operations described herein for the network edge 102 and / or the activity management server 108. In some embodiments, the memory 708 may also include other programs or applications that implement other methods and processes that provide auxiliary functions of the present technology. In some examples, the memory 708 may include any suitable non-transitory computer-readable medium. For example, the non-transitory computer-readable medium may include computer-executable instructions that instruct the CPU 706 to execute instructions according to the techniques described herein.

[0116] The memory 708 may also be configured with other programs (not shown) not related to the present technology and / or an operating system (not shown) that, when executed by the CPU 706, performs several functions well known in the art. For example, the operating system may be Microsoft Windows, Unix, Linux, Apple Computers operating system, or other operating system. The choice of operating system, or even the use of an operating system, is not critical to the present technology.

[0117] The HSM 712 may be a device with its own processor that securely generates and stores digital security assets and / or securely performs various cryptographic and sensitive computations. The HSM 712 protects digital security assets (e.g., keys) and other sensitive data from being accessed by attackers. In some implementations, the HSM may be a plug-in card or board that is directly attached to the computing system 700.

[0118] The I / O devices 710 may include one or more input / output devices that allow data to be received and / or transmitted by the system 700. For example, the I / O devices 710 may include one or more input devices that allow data to be input by a user, such as a keyboard, a touch screen, a mouse, etc. In addition, the I / O devices 710 may include one or more output devices that allow data to be output or presented to a user, such as a display screen, a CRT display, an LCD display, a plasma display, a printer, a speaker device, etc. The I / O devices 710 may also include one or more digital and / or analog communication input / output devices that allow the computing system 700 to communicate digitally, for example, with other machines and devices. Other configurations and / or quantities of input and / or output devices may be included in the I / O devices 710.

[0119] In the illustrated embodiment, the system 700 is connected to a network 704 (e.g., the Internet, a private network, a virtual private network, a cellular network, or other network or a combination of these), which in turn is connected to various systems and computing machines, such as servers, personal computers, laptops, client devices, etc. In general, the system 700 can input data from external machines and devices and output data to external machines and devices through the network 704.

[0120] exist Figure 7 In the illustrated example implementation, the data repository or data source 716 is a separate database external to the system 700. In other implementations, the data source 716 may be hosted by the system 700. In various implementations, the data source 716 may manage and store data used to implement systems and methods consistent with the present technology. For example, the data source 716 may manage and store a data structure including identification information or data for each computerized device that is active, etc. The data source 716 may also manage and store a Bloom filter data structure including a hash value based on the identification information applied to any number of hash functions.

[0121] In some embodiments, data source 716 may include one or more databases that store information and are accessed and / or managed by system 700. For example, database 716 may be an Oracle database, a Sybase database, or other relational database. However, systems and methods consistent with the present technology are not limited to a single data structure or database, or even to the use of a database or data structure.

[0122] Those skilled in the art will recognize that Figure 7 The components and implementation details of the system are examples given for simplicity and clarity of explanation. Other components and implementation details may be used.

[0123] Although the above examples use specific examples of computerized devices such as OBU, ECU, and RSU for ease of explanation, the present technology is not limited to these specific examples. Various embodiments consistent with the present technology can be used with a variety of computerized devices and can be used for a variety of computerized devices, such as medical equipment (e.g., dialysis machines, infusion pumps, etc.), robots, drones, autonomous vehicles, and wireless communication modules (e.g., embedded universal integrated circuit cards (eUICCs)).

[0124] By considering the description and practice of the technology disclosed herein, other embodiments of the present technology will be obvious to those skilled in the art. Various modifications to the exemplary embodiments and other embodiments of the subject matter that are obvious to those skilled in the art to which the disclosed subject matter belongs are deemed to fall within the scope of the disclosed subject matter.

Claims

1. A system for providing updates to a computerized device, characterized in that The system includes: An activity management service comprising computer executable instructions causing a first processor to execute operations comprising: detecting an activity initiation request indicating a collection of computerized devices to be updated for the activity; generating a Bloom filter data structure comprising a plurality of hash values ​​corresponding to the set of computerized devices to be updated, wherein the plurality of hash values ​​for the Bloom filter data structure are generated using a plurality of hash functions; and providing the bloom filter data structure generated based on the hash function quantity to a network edge from an activity management service; The network edge includes computer executable instructions that cause a second processor to perform operations including: determining that the computerized device is to receive a device update from the activity management service based on a hash value associated with the computerized device matching a hash value in the plurality of hash values ​​of the Bloom filter data structure; Responsive to the activity management service confirming that the computerized device is a member of the activity, obtaining a device update associated with the computerized device from the activity management service, wherein the device update comprises a digital asset comprising one or more of software, firmware, or a digital certificate, wherein the digital asset modifies the operation of the computerized device; and The device update is provided to the computerized device, whereby the device update modifies the computerized device.

2. The system according to claim 1, characterized in that The network edge also includes computer executable instructions that cause the second processor to perform operations including: determining, using the Bloom filter data structure, that the computerized device does not belong to the activity; and An indication is provided to the computerized device that no device updates are available for the computerized device without communicating with the activity management service.

3. The system according to claim 1, characterized in that The computerized device is an Internet of Things (IoT) device, a home appliance, or a vehicle.

4. The system according to claim 1, characterized in that The device update includes a registration certificate or a pseudonym certificate.

5. The system according to claim 1, characterized in that The device update also includes installation information or an installation script.

6. The system according to claim 1, characterized in that The activity management service also includes computer executable instructions that cause the first processor to execute the following operations: Data corresponding to the computerized device to be updated is stored.

7. The system according to claim 6, characterized in that The data includes one or more of the following: an activity start date, an activity end date, a plurality of vehicle identification numbers, a plurality of product serial numbers, and a product model number.

8. The system according to claim 6, characterized in that The activity management service also includes computer executable instructions that cause the first processor to execute the following operations: Determining whether the computerized device is in the activity is performed by accessing the data.

9. The system according to claim 1, characterized in that The Bloom filter data structure is of constant size regardless of the number of computerized devices in the collection.

10. The system according to claim 1, characterized in that The system enables the computerized device to poll the network edge for the device update when the Bloom filter data structure is generated.

11. The system according to claim 1, characterized in that The activity management service also includes computer executable instructions that cause the first processor to execute the following operations: The network edge is instructed to delete the Bloom filter data structure at the end of the activity.

12. The system according to claim 1, characterized in that Each computerized device in the set of computerized devices includes a uniform resource locator for communicating with the network edge.

13. A network edge device, characterized in that It includes computer executable instructions that cause a processor to perform the following operations: obtaining, from an activity management service, a Bloom filter data structure comprising a plurality of hash values, wherein a plurality of hash functions generate the plurality of hash values ​​for the Bloom filter data structure; determining that the computerized device is to receive a device update from the activity management service based on a hash value associated with the computerized device matching a hash value of the Bloom filter data structure; sending a device update request corresponding to the computerized device to the activity management service; obtaining, after the activity management service confirms that the computerized device is a member of the activity, a device update associated with the device update request from the activity management service, wherein the device update comprises a digital asset comprising one or more of software, firmware, or a digital certificate, wherein the digital asset modifies the operation of the computerized device; and The device update is provided to the computerized device, whereby the computerized device installs the device update.

14. The network edge device according to claim 13, characterized in that: The operations also include: determining, using the Bloom filter data structure, that the computerized device does not belong to the activity; and An indication is provided to the computerized device that no device updates are available for the computerized device without communicating with the activity management service.

15. The network edge device according to claim 13, characterized in that: The device update includes a registration certificate or a pseudonym certificate.

16. An activity management service, characterized in that It includes computer executable instructions that cause a processor to perform the following operations: detecting an activity initiation request specifying a plurality of computerized devices to be updated with a device update for the activity; storing data corresponding to the plurality of computerized devices to be updated; generating a Bloom filter data structure comprising a plurality of hash values, wherein each hash value is based on data of each computerized device of the plurality of computerized devices, wherein a plurality of hash functions generate the plurality of hash values ​​for the Bloom filter data structure; Providing the bloom filter data structure generated based on the hash function quantity to the network edge from the activity management service; receiving a request from a computerized device for an update to said device; confirming that the computerized device is a member of the campaign based on data corresponding to the plurality of computerized devices to be updated; and A device update associated with the request is provided to the network edge, the device update modifying electronic data accessed or stored by the computerized device, wherein the device update comprises a digital asset comprising one or more of software, firmware, or a digital certificate, wherein the digital asset modifies the operation of the computerized device.

17. The activity management service according to claim 16, characterized in that: The device update includes a registration certificate or a pseudonym certificate.

Images