Data encryption for a vehicle

Abstract

Aspects of the present invention relate to computer implemented methods of data encryption for a vehicle, the vehicle operating in a system comprising the vehicle and a user device, the vehicle having a sensor and a vehicle memory, the user device having a user device memory, the method comprising: obtaining sensor data from the sensor; determining encryption data in dependence on the sensor data; encrypting a data file using the encryption data to form an encrypted data file; transmitting the encryption data to the user device for 10 storage in the user device memory; and deleting the encryption data from the vehicle memory. Further aspects relate to a control system, and vehicle.

Description

TECHNICAL FIELD The present disclosure relates to a data encryption for a vehicle. Aspects of the invention relate to a computer implemented method of data encryption, to a control system, to a system, to a vehicle and to a computer readable instructions. BACKGROUND Data security is of increasing concern in today's digital age, and it extends to many aspects of data storage, including the data stored in vehicles. There are a number of potential threats to the security of this data, including theft of the vehicle itself, which can result in the loss and possible unauthorized access of data. To mitigate this latter risk, data usually is encrypted. Ultimately, data is at risk of being revealed, either sooner due to technological advancements or later due to brute force attacks. This risk is particularly concerning, as sensitive information can be used for nefarious purposes, such as blackmail or selling to secret services. It is an aim of the present invention to address one or more of the disadvantages associated with the prior art. SUMMARY OF THE INVENTION Aspects and embodiments of the invention provide computer implemented method of data encryption, a control system, a system, a vehicle and a computer readable instructions as claimed in the appended claims. According to an aspect of the present invention there is provided a method of data encryption, the method comprising determining encryption data in dependence on sensor data; encrypting a data file using the encryption data; transmitting the encryption data to a user device; and deleting the encryption data. The method may be of particular use in a vehicle, which has a large number of sensors which can provide sensor data, however, it will be understood that the invention may also be implemented with other entities having sufficient sensor data. According to another aspect of the present invention there is provided a computer implemented method of data encryption for a vehicle, the vehicle operating in a system comprising the vehicle and a user device, the vehicle having a sensor and a vehicle memory, the user device having a user device memory, the method comprising: obtaining sensor data from the sensor; determining encryption data in dependence on the sensor data; encrypting a data file using the encryption data to form an encrypted data file; transmitting the encryption data to the user device for storage in the user device memory; and deleting the encryption data from the vehicle memory. In this way, sensitive data on the vehicle may be protected on the vehicle, using an encryption key derived from highly random data that is available from the large number of sensors on the vehicle such that it has high entropy. The encryption data may comprise an encryption key or seed data that may be used to derive an encryption key. Optionally, the sensor may produce sensor data having a uniform distnbution, or a substantially uniform distribution. A substantially uniform distribution may be a probabilistic distribution that is statistically close to the uniform distribution. In an embodiment, the method comprises obtaining, in dependence on a first trigger event, the encryption data from the user device; and decrypting the encrypted data file using the encryption data. In this way, the data is protected in that it will only be accessible to the holder of the user device. The user device may be a remote access device for the vehicle, such as a key, key fob, or vehicle access application on a mobile device. The encrypted data may be accessed securely the next time the user accesses the vehicle. Optionally, the first trigger event may comprise the vehicle transitioning into a driving state, e.g., turning on the ignition in a vehicle with an internal combustion engine or initialising high voltage traction components of a battery electric vehicle. Alternatively, the first trigger event may comprise unlocking of the vehicle using the user device from outside the vehicle. Other examples of a first trigger event may include a direct or indirect user input, an elapsed time in an ignition cycle or journey, and the like. In an embodiment, determining the encryption data in dependence on the sensor data comprises determining a seed value in dependence on the sensor data. The encryption data may comprise the seed value. In this way, the encryption data may disguise the seed value. Optionally, encrypting the data file comprises deriving an encryption key from the seed value. In this way, the security of the method may be enhanced by including further steps between the sensor data and the encryption key for carrying out the encryption. In an embodiment, the method comprises obtaining sensor data from a plurality of sensors of the vehicle and combining data from the plurality of sensors to form the seed value. In this way, the quantity and variety of the sensor data may be increased. Combining the data from the plurality of sensors may include concatenation of the sensor output data of some or all of the sensors. Optionally, obtaining sensor data may comprise obtaining a quantity of sensor data equal to or larger than a size of the data file. In this way, the sensor data may be used as an encryption key for One Time Pad (OTP) encryption. In an embodiment, encrypting the data file with the encryption data may comprise encrypting the data file using One Time Pad (OTP) encryption. In this way, the encrypted data is secure against attacks due to technological advancements and brute force attacks. Optionally, the method may comprise encrypting the data file using the encryption data in dependence on a second trigger event. The second trigger event may comprise the vehicle transitioning out of a driving state, e.g., turning off the ignition in a vehicle with an internal combustion engine or powering down high voltage traction components of a battery electric vehicle. Alternatively, the second trigger event may comprise locking the vehicle using the user device from outside of the vehicle. In this way, sensitive data is protected when the vehicle is not in use. Other examples of a second trigger event may include a direct or indirect user input, an elapsed time in an ignition cycle or journey, and the like. In an embodiment, the method may comprise defining a secure area of the vehicle memory and storing the encrypted data file in the secure area. In this way, the encrypted data has additional protection when stored on the vehicle. The secure area may be part of a Trusted Execution Environment (TEE) of a vehicle processor or may be otherwise defined within the vehicle memory. The TEE is a robust way to provide a secure area for storage of the encrypted data file. In an embodiment, the method may comprise generating a Message Authentication Code (MAC) for the encrypted data. The MAC may be a one-time MAC. In this way, any tampering with the encrypted data file may be detected. Optionally, the data file may comprise a subset of user data of a user of the vehicle. In this way, the method may be used to protect sensitive user information, such as identifying data, locations logs, or the like while other non-sensitive data is not encrypted. The data to be protected may also include proprietary data of the vehicle manufacturer. According to an aspect of the present invention there is provided a control system for controlling an encryption system, the control system configured to: determine encryption data in dependence on sensor data; encrypt a data file using the encryption data; transmit the encrypted data file to a user device; and delete the encryption data. As with the method above, the control system and related encryption system may form part of a vehicle, but are not limited thereto. According to a further aspect of the present invention there is provided an encryption system, the encryption system comprising a control system as disclosed herein, an input, which is suitable for receiving sensor data from a sensor or sensors of the vehicle, and an output, which is suitable for transmitting encryption data to the user device. As above, the encryption system may form part of a vehicle, but are not limited thereto. According to another aspect of the present invention there is provided a control system for controlling an encryption system of a vehicle, the vehicle operating in a system comprising the vehicle and a user device, the vehicle having a sensor and a vehicle memory, the user device having a user device memory, the control system comprising one or more processors collectively configured to: obtain sensor data from the sensor; determine encryption data in dependence on the sensor data; encrypt a data file using the encryption data to form an encrypted data file; transmit the encryption data to the user device for storage in the user device memory; and deleting the encryption data from the vehicle memory. According to yet another aspect of the invention, there is provided a system comprising the control system and a secure area of the vehicle memory. Such a system can provide for secure handling of sensitive data of the vehicle. According to a further aspect of the invention, there is provided a system comprising the control system and a user device. According to a still further aspect of the invention, there is provided a vehicle comprising a system or a control system described herein. Such a vehicle can protect sensitive data thereof. The vehicle may operate in a system with a user device, such as a key fob or user communication device. According to an additional aspect of the invention, there is provided computer readable instructions which, when executed by a computer, are arranged to perform a method as described herein. In this way, sensitive data of the vehicle may be protected. Within the scope of this application it is expressly intended that the various aspects, embodiments, examples and alternatives set out in the preceding paragraphs, in the claims and / or in the following description and drawings, and in particular the individual features thereof, may be taken independently or in any combination. That is, all embodiments and / or features of any embodiment can be combined in anyway and / or combination, unless such features are incompatible. The applicant reserves the right to change any originally filed claim or file any new claim accordingly, including the right to amend any originally filed claim to depend from and / or incorporate any feature of any other claim although not originally claimed in that manner. BRIEF DESCRIPTION OF THE DRAWINGS One or more embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which: Figure 1 shows a flow chart illustrating a computer-implemented method according to an embodiment of the invention; Figure 2 shows a block diagram of a control system for controlling an encryption system of a vehicle according to an embodiment ofthe invention; Figure 3 shows a flow chart illustrating a computer-implemented method according to an embodiment ofthe invention; Figure 4 shows a block diagram of a system according to an embodiment ofthe invention; Figure 5 shows a block diagram of an encryption system according to an embodiment ofthe invention; Figure 6 is a process diagram of a method according to an embodiment ofthe invention; Figure 7 shows a flow chart illustrating a computer-implemented method according to an embodiment ofthe invention; Figure 8 is a process diagram of a method according to an embodiment ofthe invention; and Figure 9 shows a vehicle in accordance with an embodiment ofthe invention. DETAILED DESCRIPTION A computer-implemented method of data encryption for a vehicle in accordance with an embodiment of the present invention is described herein with reference to the accompanying Figure 1. As shown in Figures 4 and 9, the method is implemented in a vehicle 410, 900, As shown in Figure 4, the method operates in in a system 400 comprising the vehicle 410, 900 and a user device 450. Figure 1 is a flow chart illustrating the computer-implemented method, indicated generally by the reference numeral 100. At block 102, the method comprises determining encryption data in dependence on sensor data. The encryption data may include, for example, an encryption key, or a seed value for use in deriving an encryption key. At block 104, the method 100 comprises encrypting a data file using the encryption data. The method may include at this stage deriving an encryption key from the seed data. The data file may be encrypted using One-Time Pad (OTP) encryption. At block 106, the method comprises transmitting the encryption data to a user device. At block 108, the method comprises deleting the encryption data. The method may further comprise deleting some or all of the sensor data. The method may be implemented conveniently on a vehicle, as a typical vehicle comprises a number of sensors of varying types to provide sensor data useful in the determination of encryption data. With reference to Figure 2, there is illustrated a block diagram of a control system. The control system 200 may be suitable for controlling an encryption system, such as an encryption system of vehicle. The control system 200 may be configured to implement the methods described herein, for example the methods described herein in relation to Figures 1, 3 and 5. The control system 200 may form part of an encryption system within a vehicle. The control system 200 may comprise one or more processors collectively configured to carry out certain actions. The control system 200 is configured to determine encryption data in dependence on sensor data; encrypt a data file using the encryption data; transmit the encrypted data file to a user device; and delete the encryption data. The control system may comprise an encryption data determining unit, a data file encryption unit, an encrypted data file transmitting unit, and an encryption data deletion unit. With reference to Figure 3, there is shown a flow chart illustrating a further embodiment of a computer-implemented method, indicated generally by the reference numeral 300, according to the disclosure. The computer implemented method 300 is a method of data encryption for a vehicle, where the vehicle operates in a system comprising the vehicle and a user device. The vehicle has a sensor and a vehicle memory and the user device has a user device memory. The method 300 comprises, at block 301, obtaining sensor data from the sensor. At block 302, the method comprises determining encryption data in dependence on the sensor data. The encryption data may act as the encryption key, an encryption key may be derived by processing of the encryption data, or an encryption key may be otherwise derived in dependence on the encryption data in combination with other data. The method comprises, at block 304, encrypting a data file using the encryption data to form an encrypted data file. The data file may be considered as plaintext, while the encrypted data file may be considered the corresponding ciphertext. At block 306, the method comprises transmitting the encryption data to the user device for storage in the user device memory. The method comprises, block 308, the method comprises deleting the encryption data from the vehicle memory. With reference to Figure 4, there is shown a block diagram of a system according to an embodiment of the invention. The system, indicated generally by the reference numeral 400, may be used with the computer-implemented methods described herein. The system 400 comprises a vehicle 410 and a user device 450. The vehicle 410 comprises a sensor 412, vehicle memory 414, and a processor 416. The user device 450 comprises a user device memory 452. The processor 416 may correspond to the control system 200 described herein in relation to Figure 2. The vehicle memory 414 may comprise a secure area (not shown), the secure area may be referred to as a vault. The encrypted data file may be stored in the secure area. Data to be encrypted may be stored in the secure area, prior to be being encrypted. Previously encrypted data may be stored in the secure area after decryption. The secure area may be defined dynamically or may be statically assigned within the vehicle memory 414. The size of the secure area in the vehicle memory may be determined in dependence on the data to be encrypted. The secure area may be implemented as part of a Trusted Execution Environment (TEE), Secure Element (SE) or the like. In such a case, operations of the methods and systems described herein may be carried out within the TEE or SE as appropriate. For example, one or more of encryption, decryption, and determination of encryption data may carried out using a TEE or SE. It will be understood that the use of a secure area as described provides protection against tampering with the encrypted data file, however, the secure area is one option for tamper-detection. In another example, where no secure area is available, Message Authentication Codes (MAC), may be used to provide tamper-detection for encrypted files. In an example, a one-time MAC is used to allow detection of an encrypted data file that has been tampered with. Where a MAC is used, it may use an authentication key, separate from the encryption key used for carrying out the encryption. The secure area may also provide improved persistency for the encrypted data, as data stored therein is less likely to be erased accidentally. The sensor 412 may be any sensor associated with the vehicle, and may include a proximity sensor, ultrasonic sensor, camera system, radar sensor, LiDAR sensor, GPS, wheel speed sensor, accelerometer sensor, rain sensor, steering angle sensor, ambient light sensor, tyre pressure monitoring sensor and so on. The sensor 412 may correspond to a plurality of sensors, and / or a plurality of sets of sensors. For example, each wheel may have a wheel speed sensor, such that there is a set of wheel speed sensors. Choosing one or more vehicle sensors to act as the sensor 412 to provide sensor data may comprise considering the size of the data file to be encrypted, the characteristics of the output of the various vehicle sensors, the type of encryption to be used, the characteristics of the journey or journeys of the vehicle, and / or other considerations. For example, if a data file is to be encrypted using OTP, then an encryption key of the same size as the data file is required. As such, if a large quantity of data is to be encrypted, then a large quantity of sensor data should be obtained from the sensors. If the journey is short, then sensors that provide a high level of entropy in that short journey time may be chosen. The characteristics of the journey to be considered may include the duration, the surroundings, the terrain, the traffic, average speed, and the like. A journey in heavy traffic or with a long portion of motorway driving may limit the variation in the output of certain types of sensors e.g. steering angle sensor, and so reduce the entropy of the sensor data. The various vehicle sensors may have different characteristics in their data output, for example data collection time; sensor response time; precision; power consumption; variation in data, which may be understood to correspond to the entropy of the data output; and so on. A sensor that may provide output data that varies in real time or close to real time may be useful as many different measurement values could be obtained in a short period of time. A sensor which provides a high precision output is also useful, as it is likely to provide different measurements foreven small changes in the sensed variable. A sensor of the vehicle may be chosen to provide sensor data for use in the methods and systems described herein if it provides a high level of entropy in a reasonable period of time, however the methods and systems described herein are not limited to such a sensor. The output of a sensor that may be chosen to provide sensor data may follow the uniform distribution or a probabilistic distribution that is statistically close to the uniform distribution. In an example, a sensor may be chosen where the sensor data has a probabilistic distribution that is epsilon close to the uniform distribution, where epsilon a very small value in the order of 2 60 or less. Such statistical distributions are not essential forthe sensor data however, and other statistical distributions of sensor data may be used. When evaluating the potential entropy of a sensor output, the various sensors under consideration should be evaluated over a constant interval of time. In an example, the interval of time used may be the average ignition circle forthe vehicle, which may also be considered as the average journey time forthe vehicle. Other potential time intervals that may be relevant are times based on the difference between a first trigger event and a second trigger event. Where the method is using a Message Authentication Code, MAC, to provide tamper detection, additional sensor data may be obtained to allow for created of an authentication key or keys to be used in generation of the MAC. The authentication key will typically be separate from the encryption key, with no overlap between them. In an example, the sensor 412 may include one or more of a steering angle sensor, an accelerometer sensor, a camera system, a radar sensor, and LiDAR. These sensors can provide useful levels of entropy in a reasonable amount of time. When gathering data from the output of a radar sensor, data with a high level of entropy may be gathered from data relating to measured Doppler shifts. When gathering data from a camera system, data with a high level of entropy may be extracted from image level or pixel level data. When gathering data from the output of a steering angle sensor, data with a high level of entropy may be extracted from the rate of change of the direction of the wheel. When gathering data from a LiDAR system, the intensity / time of flight of laser pulses may be considered. A sensor 412 may provide its output as an analogue value or a digital value. When an analogue measurement is provided, it may be converted using an analogue to digital converter (ADC) to provide a digital output. The digital output comprises a series of bits, which may be random or substantially random depending on the entropy level of the analogue measurement. The digital output may be further processed to provide suitable sensor data. Where the sensor provides a digital output, this output may be processed by a digital-to-digital converter (DDC). The digital output of the ADC and DDC may be further processed to provide suitable sensor data. For example, the least significant bits of the digital values may be selected, for use in the sensor data, as these bits may exhibit more variation and hence have a higher entropy value. Where the sensor 412 comprises a plurality of sensors, the outputs of some or all of the plurality of sensors may be combined to provide a data stream of a larger size. In an example, a unit of data, such as a kilobyte, is gathered from each of the available sensors, and the units are then concatenated together. In this way, in an example using four sensors Si, S2, S3, and S4, the final sensor data for use in the methods and systems of the disclosure may be constructed as follows: SiB1 + S2BI + S3BI + S4BI + SiB2 + S2B2 + S3B2 + S4B2 + ... + SiBn + S2Bn + SsBn + S4Bn where Si, S2, S3, and S4 are the each of the four sensors respectively, and Bn is the nth data unit derived from that sensor. Data units may continue to be added until a desired size of the sensor data is reached. Once the desired size is achieved, earlier data may be over-written by newer data, or the collection of sensor data for use in examples of the invention may be stopped. With reference to Figure 5, there is shown a block diagram of an encryption system 500 which may comprise or be used in implementing examples of the invention. The encryption system 500 comprises the control system 200 described here in in relation to Figure 2. The encryption system 500 comprises an input 502, which is suitable for receiving sensor data from a sensor or sensors of the vehicle. The encryption system 500 comprises an output 504, which is suitable for transmitting encryption data to the user device 450. With reference to Figure 6, there is shown a process flow diagram illustrating a method according to an embodiment of the invention. The diagram illustrates timelines for actions taken by or between entities of the system 400 described above in relation to Figure 4 and Figure 5. Figure 6 illustrates the sensor 412, the encryption system 500, and the user device 450. At step 602, the sensor 412 gathers sensor data. At step 604, sensor data is transmitted to the encryption system 500. At step 606, the encryption system 500 determines encryption data in dependence on the sensor data. At step 608, the encryption system 500 encrypts a data file using the encryption data to form an encrypted data file. The data file may be referred to as the plaintext, while the encrypted data file may be referred to as the ciphertext. At step 610, the encryption system 500 transmits the encryption data to the user device 450. At step 612, the user device 450 stores the encryption data in user device memory 414. At step 614, the encryption system 500 deletes the encryption data from the vehicle memory. In use, the sensor 412 starts recording measurements to provide sensor output data. That sensor output data may be used directly as the sensor data, or may be processed to provide the sensor data. The processing of the sensor data may comprise combining sensor output data from a plurality of sensors. The sensor output data from the plurality of sensors may be combined through concatenation or other combination methods. The sensor data is then made available for use in determining the encryption data. Making the sensor data available may comprise transmitting it between systems within the vehicle, for example, from a sensor system, steering system, navigation system or the like to the encryption system. Additionally or alternatively, a control system, such as the control system 200, may access the sensor data. Obtaining sensor data may comprise obtaining a quantity of sensor data equal to or larger than a size of the data file to be encrypted. This is particularly useful if the data file is to be encrypted using One-Time-Pad (OTP) encryption. Encryption data is then determined in dependence on the sensor data. Determining the encryption data in dependence on the sensor data may comprise determining a seed value in dependence on the sensor data. In an example, the sensor data, encryption data and seed data are the same such that determining encryption data in dependence on the sensor data may comprise using the sensor data as the encryption data. Additionally or alternatively, the encryption data may comprise the seed value. In an example, determining the encryption data may comprise carrying out a permutation operation on the sensor data. An example permutation operation may comprise changing the order of bits or other data units in the sensor data. In an example, determining the encryption data comprises reversing the order of bytes in the sensor data. In an example, the encryption data is determined by carrying out a random permutation on the sensor data. In this way, the overall entropy of the encryption data may be higher than that of the sensor data. The type of encryption data to be determined may depend on the type of encryption to be used. The encryption data may act as the encryption key, an encryption key may be derived by processing of the encryption data, or an encryption key may be otherwise derived in dependence on the encryption data in combination with other data. Once encryption data has been determined, and if necessary, an encryption key derived from the encryption data, the data file is encrypted using the encryption data or the encryption key derived from the encryption data. A variety of encryption methods will be apparent to the skilled person, and the methods and systems described herein are not limited to any particular type of encryption. In an example, One-Time-Pad (OTP) encryption is used, with an encryption key the same length of the data file to be encrypted. In such an example, the encryption data may be the encryption key. Where OTP encryption is used, the sensor may have an output such that the sensor data follows the uniform distribution or a probabilistic distribution that is statistically close to the uniform distribution. In an example, a sensor may be chosen where the sensor data has a probabilistic distribution that is epsilon close to the uniform distribution, where epsilon a very small value in the order of 2 60 or less The data file to be encrypted may comprise user data of the vehicle, but is not limited thereto. The data file may be a subset of user data, for example, data that the user considers to be sensitive data. In an example, the data file comprises navigation data from one or more journeys undertaken by that user in the vehicle. The data file may comprise operational data of the vehicle. The data file may comprise data that is ranked according to priority, wherein the priority may be linked to the sensitivity of the data. In this way, data that is considered highly sensitive will have a high priority, and will be processed accordingly. For example, data may be encrypted according to its priority, such that high priority data is encrypted before lower priority data. If data is to be encrypted using OTP, then the quantify of data that can be encrypted may depend on the size of the encryption data, which may in turn be dependent on the size of the sensor data. Lower priority data may not be encrypted at all in certain circumstances, for example, if there are insufficient resources to carry out the encryption operation. Additionally, or alternatively, higher priority data may be encrypted using OTP, while lower priority data may be encrypted by another method which uses a shorter encryption key. Encrypting the data file may occur in dependence on a trigger event, which may be referred to as an encryption trigger event. The encryption trigger event may comprise the vehicle transitioning out of a driving state, e.g., turning off the ignition in a vehicle with an internal combustion engine or powering down high voltage traction components of a battery electric vehicle i.e. “power mode 0”. The encryption trigger event may comprise locking the vehicle using the user device from outside of the vehicle. The encryption trigger event may comprise a charging event, such as the beginning or end of a charging cycle. The encryption trigger event may be a user input, that directly or indirectly, requests encryption of the data file. A further example encryption trigger event includes encrypting the data file as soon as possible in dependence on having obtained sufficient sensor data to provide encryption data with a high enough entropy data to safely encrypt the data file. The encryption trigger event may be a combination of events, for example, a power mode 0 operation and a user input. The encrypted data file, that is the ciphertext, may be stored in vehicle memory after it is encrypted. The encrypted data file may be stored in a secure area of the vehicle memory. The data file may be stored in the secure area of the vehicle memory when unencrypted. In other examples, the data that will be encrypted may be derived from one or more systems of the vehicle, and will be moved to the secure area in response to the encryption trigger event. After the data file has been encrypted, the encryption data is transmitted to the user device. The user device receives the encryption data and stores it in user device memory. The user device memory may also comprise a secure area, and the encryption data may be stored therein, however, this is not a requirement. The secure area of the user device memory may be a TEE orSE, as discussed in relation to the secure area of the vehicle memory. The encryption data, and related seed data if present, is deleted from vehicle memory. Referring now to Figure 7, there is shown a flow chart illustrating a further method according to an embodiment of the disclosure. The method, indicated generally by the reference numeral 700, illustrated in Figure 7 is substantially similar to that described herein in relation to Figure 3, and the corresponding features have been assigned the same reference numerals. As described in relation to Figure 3, the method 700 comprises, at block 301, obtaining sensor data from the sensor. At block 302, the method comprises determining encryption data in dependence on the sensor data. The method comprises, at block 304, encrypting a data file using the encryption data to form an encrypted data file. At block 306, the method comprises transmitting the encryption data to the user device for storage in the user device memory. The method comprises, at block 3308, deleting the encryption data from the vehicle memory. At block 703, the method 700 comprises obtaining the encryption data from the user device. At block 705, the method 700 comprises decrypting the encrypted data file using the encryption data. Obtaining the encryption data from the user device may occur in dependence on a decryption trigger event. The decryption trigger event may comprise the vehicle transitioning into a driving state, e.g., turning on the ignition in a vehicle with an internal combustion engine or initialising high voltage traction components of a battery electric vehicle. The decryption trigger event may comprise unlocking of the vehicle using the user device from outside the vehicle. Other decryption trigger events will be apparent to the person skilled in art, including a user input, alone or in combination with another event. With reference to Figure 8, there is shown a process flow diagram illustrating a further method according to an embodiment of the disclosure. Figure 8 corresponds to previous Figure 6 modified to include the additional steps described above in relation to Figure 7. As in Figure 6, Figure 8 illustrates the sensor 412, the encryption system 500, and the user device 450. At step 602, the sensor 412 gathers sensor data. At step 604, sensor data is transmitted to the encryption system 500. At step 606, the encryption system 500 determines encryption data in dependence on the sensor data. At step 608, the encryption system 500 encrypts a plaintext data file using the encryption data to form an encrypted data file (ciphertext). At step 610, the encryption system 500 transmits the encryption data to the user device 450. At step 612, the user device 450 stores the encryption data in user device memory 452. At step 614, the encryption system 500 deletes the encryption data from the vehicle memory 414. At step 802, the decryption trigger event is identified at the user device 450. For example, the decryption trigger event may be engine ignition initiated in dependence on the user device. At step 804, the user device 450 transmits the encryption data to the encryption system 500. At block 806, the encryption system 500 decrypts the encrypted data file stored in vehicle memory using the encryption data. This may include deriving the encryption key from the encryption data. The process may then begin again with the collection of new sensor data, and the re-encryption of the data file at a later stage, where the re-encryption may occur in response to an encryption trigger event. The trigger events are not limited to being carried out by the user device 450, and may be implemented at the encryption system 500, or elsewhere in the vehicle. In such a case, the encryption system 500 may send a request for the encryption data to the user device 450, and the user device 450 then sends the encryption data to the encryption system. When the data file has been decrypted, it may be delivered to any relevant systems within the vehicle. Referring to Figure 9, there is shown a vehicle 900, in which the methods and systems described herein may be implemented. The vehicle comprises comprise a sensor such as sensor 412, a vehicle memory such as vehicle memory 414, an encryption system such as encryption system 500. The vehicle memory may comprise a secure area. The vehicle 900 may operate in a system, such as system 400, with a user device configured to interact with the vehicle 900, such as user device 450. It will be appreciated that various changes and modifications can be made to the present invention without departing from the scope of the present application.

Claims

1. A computer implemented method of data encryption for a vehicle, the vehicle, operating in a system comprising the vehicle and a user device, the vehicle having a sensor and a vehicle memory, the user device having a user device memory, the method comprising:obtaining sensor data from the sensor;determining encryption data in dependence on the sensor data;encrypting a data file using the encryption data to form an encrypted data file;transmitting the encryption data to the user device for storage in the user device memory; and deleting the encryption data from the vehicle memory.

2. A computer implemented method as claimed in claim 1, comprising obtaining, in dependence on a first trigger event, the encryption data from the user device; and decrypting the encrypted data file using the encryption data.

3. A computer implemented method as claimed in claim 1 or 2 wherein determining the encryption data in dependence on the sensor data comprises determining a seed value in dependence on the sensor data, such that the encryption data comprises the seed value.

4. A computer implemented method as claimed in claim 3 wherein encrypting the data file comprises deriving an encryption key from the seed value.

5. A computer implemented method as claimed in any preceding claim wherein the sensor produces sensor data having a uniform distribution, or a probabilistic distribution that is statistically close to the uniform distribution.

6. A computer implemented method as claimed in any preceding claim comprising obtaining sensor data from a plurality of sensors of the vehicle and combining data from the plurality of sensors to form the seed value.

7. A computer implemented method as claimed in any preceding wherein obtaining sensor data comprises obtaining a quantity of sensor data equal to or larger than a size of the data file.

8. A computer implemented method as claimed in claim 7 wherein encrypting the data file with the encryption data comprises encrypting the data file using One Time Pad encryption.

9. A computer implemented method as claimed in any preceding claim comprising encrypting the data file using the encryption data in dependence on a second trigger event.

10. A computer implemented method as claimed in any preceding claim comprising defining a secure area of the vehicle memory and storing the encrypted data file in the secure area.

11. A computer implemented method as claimed in any preceding claim wherein the data file comprises a subset of user data of a user of the vehicle.

12. A control system for controlling an encryption system of a vehicle, the control system comprising one 5 or more processors collectively configured to implement the method of any of claims 1 to 11.

13. A vehicle comprising a sensor, a vehicle memory, and an encryption system comprising the control system of claim 12.10 14. A vehicle as claimed in claim 13 wherein the vehicle memory comprises a secure area.

15. Computer readable instructions which, when executed by a computer, are arranged to perform amethod according to any of claims 1 to 11.14

Images