Security of updates over an air interface

Abstract

System for a vehicle (104), comprising: a vehicle control unit (118) with a hardware processor; and a telematics control unit configured to: in response to receiving an update instruction indicating an available software update (102; 102'; 102'') for the vehicle controller (118) and including a decryption key (136) and a signature verification key (138), sending the signature verification key (138) to the vehicle controller (118), wherein the update instruction is secured using a vehicle-specific coding chain indexed using a first vehicle identifier, and the decryption key (136) is indexed using a second vehicle identifier, in response to receiving the software update (102; 102'; 102''), which is encrypted and signed, decrypting the software update (102; 102'; 102'') using the decryption key (136) and sending the decrypted software update (102; 102'; 102'') to the vehicle control unit (118), and the vehicle control unit (118) is programmed to do the following: in response to receiving the signature verification key (138) and the decrypted software update (102; 102'; 102''), verifying a signature of the software update (102; 102'; 102''), and In response to successful verification, install the software update (102; 102'; 102'') on the vehicle control unit (118).

Description

TECHNICAL AREA

[0001] The present disclosure relates to systems and methods for securing software updates via an air interface (over the air - OTA) that are provided to a variety of vehicle control units. GENERAL STATE OF THE ART

[0002] One or more software and / or hardware components of a vehicle may require periodic or occasional electronic updates. For example, these updates might involve changes to the vehicle's software or settings to address a problem or to provide enhanced functionality to the current software or settings. In another example, the updates might involve updated configuration settings for one or more vehicle control units and / or updated software or firmware versions to be installed on those control units.

[0003] The vehicle can be configured to receive electronic updates via a wired or wireless connection. For example, a technician at a car dealership or repair shop might download the updates to the vehicle using a wired land-access network (LAN) connection. Alternatively, the vehicle might be configured to receive over-the-air (OTA) software updates, such as updates received wirelessly from a server.

[0004] German patent DE 10 2015 211 904 A1 discloses a system for software updates in vehicles, in which an update server sends a software update, encrypted with an encryption key, to a vehicle. If the vehicle requests the encryption key, the update server sends it to a mobile device, which requests user verification and, upon receiving the verification, delivers the encryption key to the vehicle. To enable multi-factor verification, the update server can communicate with a data storage device that uses first-factor and second-factor information for encrypting the software updates.

[0005] The further document US 2009 / 0119657A1 describes a method for software updates in a vehicle in which hardware information is transmitted via the vehicle's telematics system to a communication network and compared with the information in a table. If the transmitted hardware information is listed in the table, the software update is authorized. If the transmitted hardware information is missing from the table, a warning message is sent to a registered user. Document US 2013 / 0318357A1 discloses a software update system in which a private encryption key and a public encryption key are transmitted to a target device.The software update package is encrypted with a symmetric key, which is encrypted on one side with a public encryption key and on the other with a digital signature prepared with a private encryption key. Authentication of the software update is performed by decrypting the symmetric key using the private decryption key. Further encryption and verification methods for installing and activating software updates are described in US 2014 / 0032916A1, US 2016 / 0170733A1, and US 2015 / 0121070A1. SUMMARY

[0006] Starting from the aforementioned prior art, the present invention is based on the objective of creating an improved system and an improved method for a vehicle which, when installing software updates, reliably ensure that only software updates actually intended for the respective vehicle are accepted and executed by the vehicle control system.

[0007] According to the invention, the aforementioned problem is solved by a system according to claim 1 and claim 13 and a method according to claim 7. Preferred embodiments of the invention are the subject of the dependent claims.

[0008] A system for a vehicle includes a controller configured to receive encrypted software updates containing an initial signature, to decrypt the received software updates using a decryption key received with update instructions specifying available software updates, and to install the decrypted updates in response to the detection that the initial signature matches a second signature generated by the controller using a signature verification key.

[0009] A procedure for a vehicle involves decrypting software updates downloaded from an update server using a decryption key received from the update server as part of update instructions specifying the software updates and including an initial signature, and installing the decrypted updates in response to the detection that the initial signature matches a second signature generated by the controller using a signature verification key received from the update server.

[0010] A system for a vehicle includes a telematics controller configured to download software updates from an update server to be applied to a vehicle controller, determined by instructions received by the telematics controller in response to the detection that a vehicle identifier included in the instructions matches a vehicle identifier assigned to the vehicle. BRIEF DESCRIPTION OF THE DRAWINGS Fig. Figure 1 is a block diagram illustrating a system for backing up software updates that are provided to vehicle control units; Fig. Figure 2 is a block diagram illustrating a system for encrypting software updates sent over an air interface; Fig. Figure 3 is a block diagram illustrating a system for verifying a control signature included in the software updates; Fig. Figure 4 is a flowchart illustrating an algorithm for receiving and distributing decryption keys and signature verification keys; and Fig. Figure 5 is a flowchart illustrating an algorithm for decrypting encrypted software updates and performing signature verification. DETAILED DESCRIPTION

[0011] A multitude of control units, which perform a variety of functions on a vehicle, can be configured to receive periodic or occasional software and firmware updates (generally referred to here as software). To name just a few non-limiting examples, software updates can help address efficiency issues, functional changes, and security vulnerabilities in vehicles in service or in customer hands.

[0012] Software update files for installation in multiple vehicle control units (DCUs) can be protected from unauthorized access using a variety of security procedures. For example, a cloud server manager can encrypt the software update files using a public or private encryption key. Each software update file can also be digitally signed, allowing decoding to be performed at the appropriate DCU rather than, for example, a telematics control unit (TCU). The cloud server manager can send an instruction file to the vehicle, containing a list and location of the software updates available for download. The instructions can also include data for the receiving DCU to decrypt the software updates.In some cases, the cloud server manager can encode the instruction file to be vehicle-specific, so that only the vehicle whose controllers are receiving the updates is able to interpret the instructions.

[0013] Fig. Figure 1 illustrates an exemplary system 100 for providing software updates 102 to a vehicle 104. The vehicle 104 may include a telematics control unit (TCU) 106, which has a modem 108 that communicates with an update server 112 via a network 110 (e.g., directly or via a mobile device of a vehicle occupant). The update server 112 may communicate with a data store 114, which is configured to store software updates 102 for download. The system 100 may further include a software update manager 116, which is installed on the vehicle 104 and configured to install software updates 102 on the TCU 106 itself or on other controllers 118 of the vehicle 104. Although in Fig. Figure 1 shows an exemplary system 100; the exemplary components illustrated in the figure are not intended to be limiting. In fact, system 100 may have more or fewer components, and additional or alternative components and / or implementations may be used.

[0014] Vehicle 104 can refer to various types of automobiles, including soft-roaders (crossover utility vehicles - CUVs), off-road vehicles (sport utility vehicles - SUVs), trucks, recreational vehicles (RVs), boats, aircraft, or other mobile machinery used for transporting people or goods. In many cases, Vehicle 104 can be powered by an internal combustion engine. Alternatively, Vehicle 104 can be a hybrid electric vehicle (HEV), powered by both an internal combustion engine and one or more electric motors, such as a series hybrid electric vehicle (SHEV), a parallel hybrid electric vehicle (PHEV), or a parallel / series hybrid electric vehicle (PSHEV).Since the type and configuration of vehicle 104 can vary, its operating characteristics can also vary accordingly. Among other possibilities, vehicle 104 may have different characteristics regarding passenger capacity, towing capacity, and storage volume.

[0015] When the vehicle 104 is assembled, it may include various hardware and software components, such as one or more vehicle controllers 118 (shown as individual controllers 118-A to 118-G). The controllers 118 may be configured to monitor and manage various functions of the vehicle 104 using the power from the vehicle battery and / or power transmission. Accordingly, the controllers 118 may include one or more processors (e.g., microprocessors) (not shown) configured to execute firmware or software programs stored in one or more memory devices (not shown) of the controller 118.Although the controllers 118 are illustrated as separate components, the vehicle controllers 118 share common physical hardware, firmware and / or software, so that the functionality of several controllers 118 can be integrated into a single controller 118 and so that the functionality of various such controllers 118 can be distributed across a multitude of controllers 118.

[0016] The vehicle controls 118 may include, for example, the following: a powertrain control 118-A configured to manage engine operating components; a body control 118-B configured to manage various performance control functions such as exterior lighting, interior lighting, keyless entry, remote start, and verification of the status of access points; a radio transceiver control 118-C configured to communicate with key fobs, mobile devices, or other local devices of the vehicle 104; an entertainment control 118-D configured to support voice commands and BLUETOOTH interfaces with the driver and driver mobile devices; and a climate control management control 118-E configured to manage heating and cooling system components (e.g., compressor clutch, blower fan, temperature sensors, etc.).) to monitor and manage, a controller for a global positioning system (GPS) 118-F configured to provide vehicle location information, and a controller for a human-machine interface (HMI) 118-G configured to receive user input via various buttons or other control devices and to provide vehicle status information to a driver.

[0017] A vehicle bus 120 can include various communication methods available between the vehicle controllers 118 and between the TCU 106 and the vehicle controllers 118. A vehicle bus 120 can also include one or more of the vehicle's Controller Area Network (CAN), an Ethernet network, or a Media-Oriented System Transport (MOST) network.

[0018] The TCU 106 may include one or more processors 122 (e.g., microprocessors) configured to execute firmware or software programs stored on one or more storage devices 124 of the TCU 106. The TCU 106 may also include network hardware, such as the modem 108, configured to facilitate communication between the vehicle controllers 118 and between the vehicle 104 and other devices of the system 100 via the network 110. The network 110 may include one or more interconnected communication networks, such as the Internet, a cable television distribution network, a satellite link network, a local area network, a wide area network, and a telephone network, to name a few non-limiting examples.As another example, the TCU 106 can be configured to communicate via one or more of Bluetooth, Wi-Fi and wired USB network connections, facilitating data transfer between the Network 110 and a mobile device (not shown).

[0019] The data storage device 114 can be configured to store software updates 102. Software updates 102 can include changes to the software or settings of the vehicle 104 to address a problem with the current software or settings, or to provide improved functionality to the current software. For example, software updates 102 can include updated configuration settings for one or more vehicle controllers 118 and / or updated software or firmware versions to be installed on one or more vehicle controllers 118.In some cases, the software updates 102 may contain a single data segment, whereas in other cases, the software updates 102 may be organized into multiple segments, elements, or blocks, all of which may need to be downloaded to complete the software update 102 to be installed.

[0020] The data storage 114 can be configured to store information indicating the compatibility of the software updates 102 with the specifications of the vehicle 104. For example, a memory entry for the software update 102 can indicate that the software update 102 is compatible with a specific make and model of the vehicle 104, or that it is associated with a specific version(s) of the vehicle control unit 118.

[0021] The data storage device 114 can also be configured to store additional information regarding the software updates 102. For example, the data storage device 114 can be configured to determine which software updates 102 correspond to which vehicle control units 118. The update server 112 can be configured to append additional information to each of the software updates 102 or to one or more subsections of the software updates 102, so that each of the software updates 102 can be verified as authentic by the respective control unit 118.

[0022] Vehicle information 126 may include information configured to record the vehicle 104 or the vehicle 104's configuration. For example, vehicle information 126 may include a vehicle identification number (VIN) published to the vehicle bus 120, or information about the subscriber identity module (SIM) of the modem 108, such as a unique international mobile station equipment identity (IMEI). Additionally or alternatively, vehicle information 126 may include version information for at least some of the hardware and software components of the vehicle control units 118 of the vehicle 104.

[0023] The update server 112 can be configured to apply one or more security techniques to protect the software updates 102 from unauthorized access or manipulation, to ensure that the available software updates 102 are directed to and authenticated by the vehicle control unit 118 for which they are intended, to restrict the receipt of the software updates 102 to receipt by the vehicle 104 for which they are intended, and so on.

[0024] For example, update server 112 can be configured to receive requests for available software updates 102 from vehicle 104. These requests can include vehicle information 126, which allows update server 112 to query data store 114 for the software updates 102 associated with vehicle 104 as it is currently configured. In response to these requests, update server 112 can provide information about the available software updates 102 (or the software updates 102 themselves) to update the requesting vehicle 104.

[0025] The data storage device 114 can also be configured to store encryption keys 128 generated by the update server 112. The update server 112 can generate the encryption keys 128 and the corresponding decryption keys 136 in response to the detection that software updates 102 are available. The update server 112 can use the encryption keys 128 to encrypt the available software updates 102 and can send the decryption keys 136 to the vehicle 104 so that the vehicle 104 can decrypt the downloaded software updates 102.

[0026] The encryption key 128 can be a random or pseudorandom byte string generated according to one or more encryption schemes. For example, the encryption schemes can be symmetric, asymmetric, and cryptographic hash algorithms, including, but not limited to, Data Encryption Standard (DES), Triple DES (3DES), Advanced Encryption Standard (AES), the International Data Encryption Algorithm (IDEA), the Secure Hash Algorithm, and Pretty Good Privacy (PGP). Additionally or alternatively, the encryption keys 128 and the corresponding decryption keys 136 can be indexed according to the vehicle information 126, such as the VIN provided to the data storage 114 as part of the vehicle information 126, or in other cases, indexed according to the vehicle control unit 118 for which the software update 102 is intended.

[0027] One or more of the data segments of the software updates 102 can furthermore be signed by the update server 112 with a code such that the software updates 102 can be recognized by the controller 118 being updated. The data store 114 can be configured to store signature keys 130 and signature verification keys 138 generated by the update server 112. The update server 112 can use the signature keys 130 to sign the software updates 102 before the updates 102 are downloaded by the vehicle 104, and can distribute the corresponding signature verification keys 138 to the controllers 118 for use during a signature verification process.

[0028] The data storage unit 114 can also be configured to store vehicle-specific coding chains 132 or data chains that identify the specific vehicle 104 for which the available software updates 102 are intended. The vehicle-specific coding chains 132 can be indexed, for example, according to the vehicle information 126, such as the VIN provided to the data storage unit 114 as part of the vehicle information 126. As described in more detail below, the update server 112 can use the coding chains 132 to encode one or more transmissions to the vehicle 104 in such a way that only the vehicle 104 for which the transmissions are intended is able to interpret them.

[0029] The update manager 116 of the vehicle 104 can be configured to manage the installation of software updates 102 on the vehicle 104. The update manager 116 can be configured to use the TCU 106's access to the vehicle bus 120 to communicate with the vehicle controllers 118. During or after the assembly of the vehicle 104, the update manager 116 can be configured to query the presence and version information for at least some of the hardware and software components that define the vehicle controllers 118. In one example, the update manager 116 can trigger a periodic check for new software updates 102. In another example, the update manager 116 can receive a command from a user requesting to check for software updates 102.

[0030] The update manager 116 can be configured, when triggered, to send an update request to the update server 112 to inquire whether software updates 102 are available for the vehicle 104. For example, the update manager 116 can query the update server 112 using the vehicle information 126 (or, if the data store 114 maintains current vehicle information 126, an identifier of the vehicle 104), and it can receive a response from the update server 112 indicating whether new software updates 102 are available for the vehicle 104 (e.g., an instruction file 134 containing links or other identifiers of the software updates 102 for download by the vehicle 104).The instruction file 134 can be secured using the vehicle-specific coding chain 132, so that the instruction file 134 can be read and interpreted by the specific vehicle 104 for which the software updates 102 are intended.

[0031] If the response to Update Manager 116 indicates that software updates 102 are available for vehicle 104, Update Manager 116 may also be configured to download and install the specified updates 102, or, in other cases, to add the software updates 102 to a queue for download and installation. For example, Update Manager 116 may be configured to receive instructions 134 containing a list of the software updates 102 that Update Server 112 has identified as available. Update Manager 116 may also be configured to detect when vehicle 104 is connected to network 110, for example, via modem 108, and to download the software updates 102 while connected. Update Manager 116 may also be configured to...B. to send via the vehicle bus 120 for installation by the corresponding vehicle control units 118.

[0032] In one example, instructions 134 can be encoded using coding strings 132 in such a way that only the update manager 116 of the vehicle 104, for which the transmissions are intended, is able to interpret them. Update manager 116 can ignore instructions 134 in response to determining that it does not recognize the coding string 132 used to encode instructions 134.

[0033] In another example, instructions 134 from the update server 112 may contain links to the encrypted software updates 102. Accordingly, instructions 134 may include decryption keys 136 for decrypting the downloaded software updates 102. The update manager 116 may also be configured to send the decryption keys 136 received with instructions 134 to the relevant vehicle control units 118 for later use with the encrypted software updates 102.

[0034] Fig. Figure 2 illustrates an example diagram 200 of the signing of the software update 102 before it is downloaded by the vehicle 102 and the verification of the signature after the software update 102 has been downloaded. As shown, a signer 202 can be configured to generate a software update 102' from the software update 102 using the signature key 130. Furthermore, a verifier 204 can be configured to verify that the signature generated using the signature verification key 138 of the vehicle control unit 118 matches the signature included in the software update 102.In one example, the update server 112 can execute the signer 202's operations on the software update 102 before providing the signed software update 102' to the vehicle 104, and the vehicle controller 118 can execute the verifier 204's operations on the signed software updates 102' before installation on the vehicle controller 118.

[0035] The update server 112 can generate the signature key 130 and the corresponding signature verification key 138 for distribution to the one or more vehicle controllers 118 of the vehicle 104 for which the software updates 102 are available. The update server 112 can also include the corresponding signature verification keys 138 in the instructions 134 that are sent to the update manager 116 for distribution to the vehicle controller 118. Before transmitting the requested software update 102 to the vehicle 104, the update server 112 can sign one or more parts of the software update file 102, such as the file or segment header, using the generated signature key 130. The update manager 116 can then download the signed software updates 102 and send them to the corresponding controllers 118 of the vehicle 104.

[0036] The vehicle controller 118 can accordingly use the signature verification process to verify, prior to installation, that the received software updates 102 are intended for the vehicle controller 118. The vehicle controller 118 can use the signature verification key 138 to generate a controller signature and can further verify that the signature included in the downloaded signed software updates 102 matches the signature generated by the vehicle controller 118. If the received and generated signatures do not match, the vehicle controller 118 can be configured to send an error message. The vehicle controller 118 can also be configured to install the received software updates 102 in response to the detection that the received and generated signatures match.In one example, the update server 112 can be configured to encrypt the signed software updates 102' using the encryption key 128, and can send the encrypted signed software updates 102'' to the vehicle 104.

[0037] Fig. Figure 3 illustrates an example diagram 300 of the encryption and decryption of the software update 102. The update server 112 can generate the encryption key 128 and the corresponding decryption key 136 in response to the detection that the software updates 102 are available for one or more controllers 118 of the vehicle 104. The update server 112 can then send the generated decryption key 136 as part of the instruction file 134 to the update manager 116 of the vehicle 104.

[0038] The update server 112, which executes the processes of an encryption agent 302, can be configured to generate an encrypted signed software update 102'' using the signed software update 102' and the encryption key 128. Before the vehicle 104 downloads the requested software update 102, the update server 112 can encrypt the software update 102 using the generated encryption key 128. For example, the update server 112 can combine a single segment of the generated encryption key 128, such as the first segment or a segment following a key that is embedded in the encryption key 128, with a single segment, e.g., the first segment, of the software update 102.

[0039] The update server 112 can send the decryption key 136, which corresponds to the generated encryption key 128, to the vehicle 104 as part of the instructions 134. The update manager 116, which receives the instructions 134, can send the included decryption keys 136 to the corresponding controller 118 before downloading the encrypted signed software updates 102. Additionally or alternatively, the update manager 116 can, for example, store the decryption keys 136 included as part of the instructions 134 in memory 124 and decrypt the downloaded encrypted signed software updates 102 before sending the files to the corresponding controllers 118.

[0040] The vehicle control unit 118 can execute processes of a decryptor 304 and can regenerate the signed software update 102' using the encrypted signed software update 102'' and the decryption key 136 received from the update manager 116. Additionally or alternatively, the vehicle control unit 118 can receive the signed software update 102' that has previously been decrypted by the update manager 116 using the decryption key 136. As previously described with reference to Fig. As described in section 2, the vehicle control unit 118 can use the signature verification key 138 to verify that the signed software update 102' is intended for the control unit 118.

[0041] With reference to Fig. Figure 4 illustrates an exemplary process 400 for decrypting the encrypted software updates 102 using the decryption keys 136. Process 400 can begin at block 402, where the update manager 116 of the vehicle 104 receives instructions 134 from the update server 112, specifying the location of the software updates 102 available for the one or more controllers 118. At block 404, the update manager 116 determines whether the coding string 132 used to encode the instructions 134 is recognized. If the update manager 116 determines that the coding string 132 is not recognized, it can ignore the instructions 134 and exit process 400. Before exiting process 400, the update manager 116 may send an error message at block 406 indicating that the received instructions 134 could not be interpreted.

[0042] In response to the detection of the encoding string 132, the update manager 116 determines at block 408 whether the instructions 134 include the decryption keys 136 for decrypting the downloaded software updates 102. In response to the determination that the decryption keys 136 are not included as part of the instructions 134 from the update server 112, the update manager 116 sends an error message at block 406 and exits operation 400.

[0043] In response to the determination that the received instructions 134 contain the decryption keys 136, the update manager 116 stores the received decryption keys 136 at block 410 in memory 124 for future use with the encrypted signed software updates 102. Alternatively, the update manager 116 can send the received decryption keys 136 to the appropriate vehicle controllers 118.

[0044] At block 412, the update manager 116 determines whether the received instructions 134 contain one or more signature verification keys 138 for the corresponding controller 118 that receives the software updates 102. In response to the determination that the signature verification keys 138 were not received as part of the instructions 134, the update manager 116 may send an error message at block 406 and then exit operation 400. At block 414, the update manager 116 sends the received signature verification keys 138 to the corresponding controllers 118 for use during the verification process.

[0045] At block 416, the update manager 116 downloads the encrypted signed software updates 102'' according to the received instructions 134. At block 418, the update manager 116 decrypts the encrypted signed software updates 102'' using the stored decryption keys 136. At block 420, the update manager 116 sends the downloaded encrypted signed software updates 102'' to the corresponding vehicle control unit 118. At this point, the process 400 can terminate. Additionally or alternatively, the update manager 116 can send the encrypted signed software updates 102'' to the vehicle control units 118 for decryption, provided the update manager 116 has previously sent the decryption keys 136 to the corresponding vehicle control unit 118.In some examples, the 400 operation may be repeated in response to the update manager receiving instructions 134 for available software updates 102, or in response to the receipt of another signal or request.

[0046] Fig. Figure 5 illustrates an exemplary process 500 for decrypting the encrypted software updates 102 and verifying that the received software updates 102 are intended for the vehicle controller 118. The process 500 can begin at block 502, where the controller 118 receives the encrypted signed software updates 102'' from the update manager 116. In one example, the controller 118 can receive the encrypted signed software updates 102'' in response to a determination that the software updates 102 are available for one or more controllers 118 of the vehicle 104.

[0047] At block 504, the control unit 118 determines whether the decryption key 136 has been previously received by the update manager 116. If it is determined that the decryption key 136 has not been previously received, the vehicle control unit 118 sends an error message at block 506 indicating that the received encrypted signed software updates 102'' could not be decrypted. If the decryption key 136 is detected, the vehicle control unit 118 can use it at block 508 to decrypt the encrypted signed software updates 102'' and generate the signed software update 102'.In a scenario where the update manager 116 decrypts the encrypted signed software updates 102 before sending the files for update 102 to the appropriate control 118, operation 500 can move to block 510 in response to receiving the decrypted software updates 102.

[0048] At block 510, control 118 determines whether the decryption key 138 has been previously received by the update manager 116. Control 118 can send an error message at block 506 in response to a determination that the signature verification key 138 has not been previously received.

[0049] In response to the detection of the received signature verification key 138, controller 118 performs signature verification. At block 512, controller 118 uses the signature verification key 138 to generate a unique signature. At block 514, controller 118 verifies that the generated unique signature matches the signature included as part of the received signed software updates 102. If, at block 506, controller 118 determines that the signature included as part of the received update 102 does not match the generated signature, it may send an error message indicating that the controller signature could not be verified.

[0050] At block 516, the controller 118 installs the software updates 102 in response to a determination that the signature included as part of the received signed software updates 102' matches the signature generated using the signature verification key 138. At this point, operation 500 may terminate. In some examples, operation 500 may be repeated in response to the vehicle controller 118 receiving the encrypted signed software update 102'', or in response to receiving another signal or request.

[0051] The processes, methods, or algorithms disclosed herein can be fed to or implemented by a processing device, a controller, or a computer, which may include an existing programmable electronic control unit or a dedicated electronic control unit. Likewise, the processes, methods, or algorithms can be stored as data and instructions that can be executed by a controller or computer in many forms, including, but not limited to, information permanently stored on non-writable storage media such as ROM devices, and information modifiably stored on writable storage media such as floppy disks, magnetic tapes, CDs, RAM devices, and other magnetic and optical media. The processes, methods, or algorithms can also be implemented in a software-executable object.Alternatively, the processes, procedures or algorithms may be implemented wholly or partially using suitable hardware components, such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), state machines, controllers or other hardware components or devices, or a combination of hardware, software and firmware components.

Claims

[1] System for a vehicle (104), comprising: a vehicle control unit (118) with a hardware processor; and a telematics control unit configured to: in response to receiving an update instruction indicating an available software update (102; 102'; 102'') for the vehicle controller (118) and including a decryption key (136) and a signature verification key (138), sending the signature verification key (138) to the vehicle controller (118), wherein the update instruction is secured using a vehicle-specific coding chain indexed using a first vehicle identifier, and the decryption key (136) is indexed using a second vehicle identifier, in response to receiving the software update (102; 102'; 102''), which is encrypted and signed, decrypting the software update (102; 102'; 102'') using the decryption key (136) and sending the decrypted software update (102; 102'; 102'') to the vehicle control unit (118), and the vehicle control unit (118) is programmed to do the following: in response to receiving the signature verification key (138) and the decrypted software update (102; 102'; 102''), verifying a signature of the software update (102; 102'; 102''), and In response to successful verification, install the software update (102; 102'; 102'') on the vehicle control unit (118). [2] System according to claim 1, wherein the update instructions further include a vehicle identifier and the controller (118) receives the encrypted signed software updates (102; 102'; 102'') in response to the detection that the vehicle identifier matches a stored identifier of the vehicle (104). [3] System according to claim 2, wherein the controller (118) is further configured to ignore the update instructions and refrain from receiving the encrypted signed software updates (102; 102'; 102'') in response to the detection that the vehicle identifier differs from the stored identifier of the vehicle (104). [4] System according to claim 1, wherein the controller (118) is further configured to receive the signature verification key (138) with the update instructions. [5] System according to claim 1, wherein the controller (118) is further configured to receive the software updates (102; 102'; 102'') from an update server (112) which is configured to sign the software updates (102; 102'; 102'') before sending the updates to the controller (118) using a signature key (130) corresponding to the signature verification key (138). [6] System according to claim 5, wherein the update server (112) is further configured to encrypt the software updates (102; 102'; 102'') before sending the updates to the controller (118) using an encryption key (128). [7] Method for a vehicle (104), comprising: Received from a server via a telematics controller, an update instruction specifying available software updates (102; 102'; 102'') for a vehicle controller (118) and including a decryption key (136) and a signature verification key (138), wherein the update instruction is secured using a vehicle-specific coding chain indexed using a first vehicle identifier, and the decryption key (136) is indexed using a second vehicle identifier; Sending the signature verification key (138) to the vehicle control unit (118); in response to receiving the software updates (102; 102'; 102'') which contain an initial signature, decrypt, via the telematics control, the software updates (102; 102'; 102'') using the decryption key (136); and Installing the decrypted updates in response to the detection that the first signature matches a second signature generated by the controller using a signature verification key (138) received from the update server (112). [8] Method according to claim 7, wherein the update instructions further include a vehicle identifier and further comprising that the software updates (102; 102'; 102'') are received in response to the detection that the vehicle identifier matches a vehicle identifier assigned to the vehicle (104). [9] Method according to claim 8, further comprising ignoring the update instruction and refraining from receiving the encrypted signed software updates (102; 102'; 102'') in response to the detection that the vehicle identifier differs from the identifier assigned to the vehicle (104). [10] Method according to claim 7, wherein the signature verification key (138) is generated by the update server (112). [11] Method according to claim 7, wherein the encrypted signed software updates (102; 102'; 102'') are received via a network connection, wherein an update server (112) is configured to sign the software updates (102; 102'; 102'') before sending the updates using a signature key (130). [12] Method according to claim 11, wherein the update server (112) is further configured to encrypt the software updates (102; 102'; 102'') before sending the updates using an encryption key (128). [13] System for a vehicle (104), comprising: a telematics controller configured to download software updates (102; 102'; 102'') from an update server (112) to be applied to a vehicle controller (118) by instructions received by the telematics controller in response to the detection that a vehicle identifier included in the instructions matches a vehicle identifier assigned to the vehicle (104). [14] System according to claim 13, wherein the telematics control is further configured to ignore the instructions and refrain from downloading the software updates (102; 102'; 102'') in response to the detection that the received identifier differs from the assigned identifier. [15] System according to claim 13, wherein the instructions further include a decryption key (136) for decrypting the downloaded software updates (102; 102'; 102''). [16] System according to claim 15, wherein the telematics control is further configured to decrypt the downloaded software updates (102; 102'; 102'') using the decryption key (136) and to send the decrypted software updates (102; 102'; 102'') to a corresponding vehicle control (118). [17] System according to claim 15, wherein the telematics control is further configured to send the decryption key (136) to a corresponding vehicle control (118) before downloading the software updates (102; 102'; 102'') and to send the software updates (102; 102'; 102'') to the corresponding vehicle control (118) after completion of the download. [18] System according to claim 17, wherein the vehicle control unit (118) is configured to decrypt the received software updates (102; 102'; 102'') using the decryption key (136) and install the decrypted software updates (102; 102'; 102'') in response to the detection that a control signature included in the received software updates (102; 102'; 102'') matches a generated signature of the vehicle control unit (118).

Images