Electronic control unit adapted for intelligent transport system communications and corresponding process

Abstract

The electronic control unit (ECU) includes a communication circuit (MDM) adapted to receive Intelligent Transportation System (ITS) type messages (INC_MSS), an authentication circuit (HSM) adapted to authenticate received messages, a non-volatile memory (NVM, sNVM) configured to store authenticated received messages (ATH_DAT), and a secure element (eSE). The secure element (eSE) has a blacklist of automatically excluded senders (BL) and is configured to directly reject a received message from a sender on the blacklist (BL), without authentication by the authentication circuit (HSM); or the secure element (eSE) has a whitelist of automatically allowed senders (WL) and is configured to directly store a received message from a sender on the whitelist (WL) in the non-volatile memory (NVM, sNVM), without authentication by the authentication circuit (HSM). Figure for the summary: Fig 2

Description

Title of the invention: Electronic control unit adapted for intelligent transport system communications and corresponding method

[0001] Embodiments and implementations relate to electronic control units "ECU" (acronyms for the common English terms "Electronic Control Unit"), typically intended for automotive electronic equipment, adapted to communicate in a system of the intelligent transport system type.

[0002] The intelligent transport system (usually designated by the acronym "ITS" from the English terms "Intelligent Transport System") is the name for electronic and computer technologies in the field of road transport and logistics, particularly for personal automobiles.

[0003] The ITS intelligent transport system is intended to digitally manage the regulation of automobile traffic, managing the exchange of messages communicated between “C2X” (for “Car to everything” in English) cars, also called “V2X” (for “Vehicle to everything”), and other cars or infrastructures (traffic lights, roundabouts, etc.) equipped with the ITS intelligent transport system. The C2X messages are in particular basic safety messages “BSM” (acronym for the English terms “Basic Safety Message”) communicating weather alerts, alerts of stopped cars or accidents, signaling malfunctions, etc.

[0004] C2X messages are received on the fly, analyzed and stored in a typically general-purpose non-volatile memory, usually a "Flash" memory, of the electronic control unit. Furthermore, to protect against the risk of corruption of the data stored in the memory, for example "hacking" the memory to access sensitive or secret information or keys, it is provided that the C2X messages have a very short lifetime, and that their sendings are renewed very frequently.

[0005] Thus, in the intelligent transport system ITS, there is a reception processing objective of a thousand (1000) messages received per second. Current electronic control units adapted to ITS communications are not capable of achieving this reception processing objective.

[0006] Indeed, to ensure the trust of ITS type communications, a digital signature of the sender is typically provided in C2X messages. The digital signature conventionally uses public key infrastructures "PKI" (acronym for the usual English terms "Public Key Infrastructure") and signature algorithms of the type "DSA_256" or "ECDSA_256" (acronym for the English terms “Digital Signature Algorithm” and respectively “Elliptic Curve DSA” designating techniques well known to those skilled in the art). Thus, for each incoming message, a cryptographic verification of the ECDSA_256 signature is executed in order to authenticate the received message before its storage in memory.

[0007] Authentication procedures, particularly of the ECDSA_256 type, typically require a large amount of computing resources and are relatively long to implement.

[0008] As a result, when the electronic control unit receives too many messages, a "bottleneck" phenomenon in the processing of the received messages may occur, and slow down the reception bandwidth well below the aforementioned objective.

[0009] The problem is expected to worsen as cars and infrastructure are equipped for the Intelligent Transport System ITS.

[0010] Conventional proposals for solutions to this problem are to increase the processing capacity of electronic control units. However, increasing the processing capacity also increases the power consumption, size and price of integrated circuits in electronic control units for automobiles.

[0011] Thus, there is a need to avoid having to use more per formants (and therefore larger, more expensive and more energy-intensive), to meet the high bandwidth demand, while benefiting from better security and trust.

[0012] According to one aspect, there is provided in this regard an electronic control unit comprising a communication circuit adapted to receive messages of the intelligent transport system type, an authentication circuit adapted to authenticate the received messages, a non-volatile memory configured to record the authenticated received messages, and a secure element.The secure element comprises a first list of automatically excluded transmitters and the electronic control unit is configured to directly reject a message received from a transmitter on the first list, without authenticating this message by the authentication circuit; and, alternatively or in combination, the secure element comprises a second list of automatically admitted transmitters and the electronic control unit is configured to directly record a message received from a transmitter on the second list in the non-volatile memory, without authenticating this message by the authentication circuit.

[0013] Thus, the direct rejection of a received message, that is to say that the message is neither processed nor recorded, is very fast and allows the system not to be clogged in the event of a large number of messages received. Similarly, the direct recording of a received message is very fast and avoids clogging the system in the event of a large number of messages received, including renewal messages at a high frequency.

[0014] Furthermore, the risk of extracting or modifying the data from the first list and the second list is extremely low, given that they benefit from the security of the secure element. Consequently, the direct processing (rejection or recording) of messages from senders present on said lists remains reliable despite the absence of authentication.

[0015] In particular, the secure element may advantageously include hardware protection means adapted for certification of at least “EAL4+” or higher (for example “EAL5+”, or even “EAL6+”).

[0016] According to one embodiment, the secure element is configured to modify the first list of automatically excluded transmitters or the second list of automatically admitted transmitters upon command transmitted over a secure channel by a server having authority.

[0017] This makes it possible to dynamically adapt the lists of excluded or automatically admitted transmitters, in a reliable and secure manner.

[0018] According to one embodiment, the communication circuit is adapted to wireless communications according to the protocol of the IEEE 802.11.p standard (also called “G5”) or according to the 5G protocol.

[0019] According to one embodiment, said non-volatile memory is not materially secure.

[0020] According to one embodiment, said non-volatile memory is hardware-secured, the secure element comprising said hardware-secured non-volatile memory and a clock counter that is always active (for example, active even in operating modes of the very low consumption type), the secure element being configured to assign to the received and authenticated messages a time-stamp data item from said clock counter, and to record said authenticated received messages and the respective time-stamp data in the hardware-secured non-volatile memory.

[0021] This embodiment has the advantage in particular of increasing the lifetime of the stored messages and of reducing the number of times the messages are systematically renewed, due to the fact that the authenticated messages benefit from the hardware protection of the hardware-secured non-volatile memory. The timestamp data allows for longer lifetime management of the messages in a secure and perfectly reliable manner.

[0022] Furthermore, with regard to this embodiment, those skilled in the art may, for all useful purposes, refer to the French patent application entitled “Method for managing communications of an intelligent transport system and corresponding electronic control unit” filed on the same day and by the same applicant that the present application.

[0023] According to another aspect, there is provided a method for managing communications of the intelligent transport system type comprising a reception of a message, an authentication of the received message, and a recording of the authenticated received message in a non-volatile memory of an electronic control unit, in which the received message is directly rejected, without having carried out said authentication of this message, if it comes from a sender from a first list of automatically excluded senders contained in a secure element of the electronic control unit; or the received message is directly recorded in the non-volatile memory, without having carried out said authentication of this message, if it comes from a sender from a second list of automatically admitted senders contained in the secure element.

[0024] According to one embodiment, a modification of the first list of automatically excluded transmitters or of the second list of automatically admitted transmitters is carried out on command transmitted over a secure channel by a server having authority.

[0025] According to one embodiment, the communications are wireless communications according to the protocol of the IEEE 802.1 lp (or “G5”) standard or according to the 5G protocol.

[0026] According to one embodiment, said non-volatile memory is not materially secure.

[0027] According to one embodiment, the method comprises an allocation to the received and authenticated messages of a time stamp data item from a still active clock counter belonging to the secure element, and a recording of said authenticated received messages and the respective time stamp data in the non-volatile memory, said non-volatile memory being materially secure and belonging to the secure element.

[0028] Other advantages and characteristics of the invention will appear on examining the detailed description of embodiments and implementations, which are in no way limiting, and the appended drawings, in which:

[0029] [Fig.l] ;

[0030] [Fig.2] ;

[0031] [Fig.3] ;

[0032] [Fig.4] illustrate embodiments and implementations of the invention.

[0033] [Fig.l] illustrates an example of an intelligent transport system ITS.

[0034] The intelligent transport system ITS comprises a network of vehicle stations ITS_VS, roadway infrastructure stations ITS_RS, and at least one central station ITS_CS. The VHC vehicles, such as automobiles, heavy goods vehicles, two-wheelers, etc., are ITS_VS stations of the ITS system and can communicate with neighboring vehicle stations ITS_VS by C2C (car to car) messages. The vehicle stations ITS_VS can also communicate with neighboring ITS-RS road infrastructure stations, such as road signage elements (traffic lights, kilometer markers, etc.) by C2I messages (from the English term "car to infrastructure"), and also with the central ITS_CS station by C2I messages via a telecommunications network or via the ITS_RS road infrastructure stations. The general C2I, C2C messages are also designated by the abbreviation C2X (from the English term "car to everything").

[0035] C2X messages are in particular basic safety messages “BSM” (acronym for the English terms “Basic Safety Message”) communicating weather alerts, alerts for stopped cars or accidents, alerts for signal malfunctions, etc. C2X messages are communicated by a wireless communication protocol, in particular the protocol of the IEEE 802.1 Ip standard dealing with wireless access in vehicle environments “WAVE” (for “Wireless Access to Vehicular Environment” in English) also designated “G5” or “ITS-G5”. C2X messages can also be communicated by the “5G” protocol for example as defined in the standard of the European Telecommunications Standards Institute “ETSI F5G” (for “European Telecommunications Standards Institute” in English).

[0036] The various stations of the intelligent transport system ITS, in particular the stations of the “connected object” type ITS_RS, ITS_VS (i.e. the stations other than the central station ITS_CS), comprise electronic control units ECU (usually in English “Electronic Control Unit”), typically intended for automotive electronic equipment, adapted to implement “C2X” (C2C, C2I) communications in the intelligent transport system ITS.

[0037] In this regard, reference is made to [Fig.2].

[0038] [Fig.2] illustrates an electronic control unit ECU as mentioned in connection with [Fig.l].

[0039] The electronic control unit ECU may belong to a land vehicle with a VHC motor such as an automobile, a heavy goods vehicle, a two-wheeler or to a road infrastructure device such as a traffic light, a kilometer marker, a road sign, an information or advertising panel, an emergency call terminal, or others.

[0040] The electronic control unit ECU comprises an MDM communication circuit, typically a "modem", adapted to wireless communications according to the protocol of the IEEE 802.1 Ip standard, or according to the 5G protocol, as mentioned above. In particular, the MDM communication circuit is capable of receiving INC_MSS (C2X) messages from the intelligent transport system ITS.

[0041] The electronic control unit ECU comprises an authentication circuit HSM adapted to authenticate received INC_MSS messages. For example, the HSM authentication circuit is capable of decrypting a digital signature of the sender of the INC_MSS message. The digital signature is typically encoded in the INC_MSS message by a 256-bit signature algorithm of the type "DSA_256" or "ECDSA_256" (acronyms for the English terms "Digital Signature Algorithm" and "Elliptic Curve DSA" respectively). Thus, for incoming INC_MSS messages, a cryptographic verification of the ECDSA_256 signature can be performed by the HSM authentication circuit.

[0042] The electronic control unit ECU typically comprises a general-purpose non-volatile memory NVM, such as a Flash memory. The general-purpose non-volatile memory NVM is not necessarily hardware-secured; in fact, so-called "general-purpose" devices are typically not secure, or at least have an "EAL" certification of a lower level than that of the secure element eSE (see below). Conventionally, all received messages INC_MSS are recorded in the general-purpose memory NVM, after having been authenticated ATH_MSS. However, in the conventional case, to limit the risk of extracting data from the NVM memory, the recorded messages have a very short lifetime, and must be renewed regularly, with cryptographic verification of the signature at each renewal.This classic implementation is not advantageous, particularly in terms of energy consumption and use of the computing resources of the HSM authentication circuit.

[0043] However, the electronic control unit ECU comprises a secure element eSE comprising a first list BL of automatically excluded transmitters, usually called a “black list”, and, in combination or alternatively, a second list of automatically admitted transmitters WL usually called a “white list”, for example recorded in a hardware-secured non-volatile memory sNVM. And, the electronic control unit ECU is configured to directly reject a message received from a transmitter on the black list BL, without authentication by the authentication circuit HSM, and, respectively, to directly record a message received MSS from a transmitter on the white list WL, in the non-volatile memory NVM, sNVM, without authentication by the authentication circuit HSM.

[0044] It is indeed possible to identify the sender of a message without implementing the authentication processing by the HSM authentication circuit. Thus, the procedure for directly rejecting a message received from a sender identified in the BL blacklist is very fast and makes it possible not to clog the system in the event of a large number of messages received. A direct rejection of a received message simply corresponds to not processing or recording the message.

[0045] Similarly, the procedure for direct MSS recording of a message received from from a sender identified in the WL white list is very fast and allows the system not to be clogged in the event of a large number of messages received, including renewal messages at a high frequency.

[0046] For example, the secure element eSE is "secure" in that it includes hardware protections such as active shield means, environmental parameter monitoring, protection against fault injections, protection against side-channel attacks, or other means. More generally, the secure element includes hardware protections capable of obtaining a common criteria certification "EAL4+" or "EAL5+" (acronym for the terms "Evaluation Assurance Level 4+ / 5+"), that is to say an evaluation assurance of level 4 or 5 according to common criteria, typically defined in the ISO-15408 standards. The certification can be obtained for example by satisfying an advanced methodical analysis of class 5 vulnerabilities "AVA_VAN5" (for "Vulnerability Assessment" and "Vulnerability Analysis") of said common criteria.

[0047] Thus, the secure element eSE is substantially “inviolable” (i.e. inviolable to the extent of its certification), and the risk of extraction or modification of the data from the BL black list and the WL white list is extremely low. Consequently, the immediate processing (direct rejection or direct recording) of messages from senders present on said BL, WL lists remains reliable despite the absence of authentication.

[0048] Furthermore, the secure element eSE is advantageously configured to modify the black list of automatically excluded transmitters BL and the white list of automatically admitted transmitters WL on command transmitted over a secure channel by a server having the authority to carry out this modification.

[0049] For example, the secure channel can be implemented by an end-to-end secure connection by a secure channel protocol “Secure Channel Protocol” of the “Global Platform” standard, for example according to the protocols “SCP 1 La”, “SCPll.b”, “SCPll.c” or even “SCP03”.

[0050] For example, the server having the authority to make a modification in the blacklist BL and in the whitelist WL may be a server of the central station ITS_CS of the intelligent transport system ITS, or a server belonging to the seller of the vehicle VHC, or a server belonging to the public authority. For example, in this regard, the secure element eSE integrates, at its manufacture, certificates of authorities designating the servers authorized to make a modification in the blacklist BL and in the whitelist WL.

[0051] Thus, the BL blacklist can be dynamically adapted to add new fraudulent actors, and the whitelist can be dynamically adapted to include new trusted actors, or for example in the event of an incident requiring a preferential treatment of messages from a particular sender.

[0052] Finally, if a received message INC_MSS comes from a sender that is present neither in the black list BL nor in the white list WL, then the authentication circuit HSM performs the authentication of the typical received message INC_MSS, i.e. the cryptographic verification of the message signature. The authenticated messages ATH_MSS are stored in the general purpose non-volatile memory NVM.

[0053] [Fig. 3] illustrates a method 300 corresponding to the management of communications of the intelligent transport system ITS, implemented by the electronic control unit ECU described in relation to [Fig. 2].

[0054] Thus, the method 300 begins with a reception 301 of an INC_MSS message.

[0055] A step 312 checks whether the received message INC_MSS comes from a sender belonging to the black list of senders automatically excluded BL.

[0056] If “ok”, the method moves to a step 313 of direct rejection RJCT of the received message INC_MSS.

[0057] In the negative “nok”, a step 330 of ATH authentication of the received message is implemented, as described previously in relation to the HSM authentication circuit.

[0058] If the message is authenticated, the method comprises a step 340 of recording the authenticated received message in the non-volatile memory NVM, or possibly in the hardware-secured non-volatile memory sNVM belonging to the secure element eSE.

[0059] A step 322 checks whether the received message INC_MSS comes from a sender belonging to the white list of automatically admitted senders BL.

[0060] If “ok”, the method goes directly to step 340 of recording the messages received in the non-volatile memory NVM / sNVM, without implementing the authentication 330.

[0061] If the answer is negative, the method moves to step 330 of ATH authentication, then to step 340 of recording the received message in the non-volatile memory NVM if the message is authenticated.

[0062] Either of the verification steps 312 and 322 is performed depending on the use of either, respectively, the blacklist BL and the whitelist WL. In case of use of both the blacklist BL and the whitelist WL, the respective verification steps 312 and 322 can be performed simultaneously, or subsequently, that is to say that any one of the verifications 312; 322 is done in case of a negative result “nok” of the other verifications 322; 312.

[0063] Furthermore, the invention is not limited to these embodiments and implementations but embraces all variants thereof, for example:

[0064] 1- With reference to [Fig.4], it is proposed according to one aspect to combine the technique described previously in relation to figures 1 to 3 (the common elements bear the same references and are not all detailed again here) with a technique of the type described in the French patent application entitled "Method for managing communications of an intelligent transport system and corresponding electronic control unit" filed on the same day and by the same applicant as the present application. In detail, this technique comprises on the one hand a use of the hardware-secure non-volatile memory (of level EAL4+ or higher) to store the INC_MSS messages; and on the other hand an allocation to the messages recorded in the secure non-volatile memory sNVM of a time stamp data from an always-active clock counter RTC belonging to the secure element eSE.Thus, the messages received from a sender in the WL white list, or the messages received and authenticated (i.e. the messages received from a sender absent from the BL black list and absent from the WL white list) are recorded in the hardware-secured non-volatile memory sNVM with the respective timestamp data. In particular, the always-on clock counter RTC is advantageously configured to generate a current value of a reference time base, in a standby operating mode and in an active operating mode of the secure element eSE.

[0065] Storing the messages in the hardware-secured non-volatile memory makes it possible to increase the AT lifetime of the stored messages (starting to run from the timestamp data), and thus to reduce accordingly the number of processing and recordings of the systematic renewal messages. The timestamp value allows management of the longer AT lifetime of the messages in a secure and perfectly reliable manner.

[0066] 2- According to another aspect, there is also provided a land motor vehicle in incorporating an electronic control unit ECU as previously described in connection with Figures 1 to 4.

[0067] 3- According to another aspect, there is also provided an infrastructure device of roadway incorporating an electronic control unit ECU as previously described in relation to Figures 1 to 4.

Claims

Claims

1. Electronic control unit (ECU) comprising a communication circuit (MDM) adapted to receive messages (INC_MSS) of the intelligent transport system (ITS) type, an authentication circuit (HSM) adapted to authenticate the received messages, a non-volatile memory (NVM, sNVM) configured to record the authenticated received messages (ATH_DAT), and a secure element (eSE), in which the secure element (eSE) comprises a first list of automatically excluded transmitters (BL) and the electronic control unit (ECU) is configured to directly reject a message received from a transmitter of the first list (BL), without carrying out the authentication of this message by the authentication circuit (HSM);or the secure element (eSE) comprises a second list of automatically admitted transmitters (WL) and the electronic control unit (ECU) is configured to directly record a message received from a transmitter of the second list (WL) in the non-volatile memory (NVM, sNVM), without carrying out the authentication of this message by the authentication circuit (HSM).;

2. Electronic control unit according to claim 1, in which the secure element (eSE) is configured to modify the first list of automatically excluded transmitters (BL) or the second list of automatically admitted transmitters (WL) on command transmitted over a secure channel by a server having authority.

3. Electronic control unit according to one of claims 1 or 2, in which the communication circuit (MDM) is adapted to wireless communications according to the protocol of the IEEE 802.11.p standard or according to the 5G protocol.

4. Electronic control unit according to one of claims 1 to 3, wherein said non-volatile memory (NVM) is not hardware secured.

5. Electronic control unit according to one of claims 1 to 3, wherein said non-volatile memory (sNVM) is hardware secured, the secure element (eSE) comprising said hardware secured non-volatile memory (sNVM) and an always-active clock counter, the secure element (eSE) being configured to assign to the received and authenticated messages a time stamp data from said clock counter, and to record said received authenticated messages and the respective time stamp data in the memory secure non-volatile hardware (sNVM).

6. Method for managing communications (300) of the intelligent transport system (ITS) type comprising a reception (301) of a message (INC_MSS), an authentication (330) of the received message, and a recording (340) of the authenticated received message in a non-volatile memory (NVM, sNVM) of an electronic control unit (ECU), in which the received message (INC_MSS) is directly rejected (313), without having carried out said authentication (330) of this message, if it comes from a transmitter from a first list of automatically excluded transmitters (BL) contained in a secure element (eSE) of the electronic control unit (ECU); or the received message (INC_MSS) is directly recorded (340) in the non-volatile memory (NVM, sNVM), without having carried out said authentication (330) of this message, if it comes from a sender from a second list of automatically admitted senders (WL) contained in the secure element (eSE).

7. Method according to claim 6, in which a modification of the first list of automatically excluded transmitters (BL) or of the second list of automatically admitted transmitters (WL) is carried out on command transmitted on a secure channel by a server having authority.

8. Method according to one of claims 6 or 7, in which the communications (301) are wireless communications according to the protocol of the IEEE 802.1 lp standard or according to the 5G protocol.

9. A method according to one of claims 6 to 8, wherein said non-volatile memory (NVM) is not hardware secured.

10. Method according to one of claims 6 to 8, comprising an allocation to the received and authenticated messages of a time stamp data from a still active clock counter belonging to the secure element (eSE), and a recording of said authenticated received messages and the respective time stamp data in the non-volatile memory (sNVM), said non-volatile memory (sNVM) being materially secure and belonging to the secure element (eSE).

Images