Access Control Module for Automotive Message Security

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

In automotive networks, existing authentication methods require each application to manage cryptographic materials, leading to high computational costs and resource usage, as they need to authenticate and verify identities for message transmission, which is inefficient and resource-intensive.

Innovation Solution

A method where the source application associates security information with messages, which is then checked by access control modules within the network protocol stack, allowing for access control decisions to be made without the need for extensive cryptographic key management, reducing computational load and memory usage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If authentication is performed using cryptographic materials for each application, then message transmission security is improved, but memory consumption and CPU computation cost increase significantly

Engineering Contradiction:
Improvemessage transmission securityVSAvoidmemory consumption
Core Design Contradiction:
ReliabilityVSQuantity of substance

Solution Approach 1:

The patent extracts the cryptographic verification function from individual applications and centralizes it in a dedicated access control module. This module handles all authentication operations using shared cryptographic materials, eliminating the need for each application to maintain its own cryptographic key sets. The access control module receives messages, verifies source application identities using centralized cryptographic materials, and enforces access rules, thereby reducing memory consumption while maintaining security.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The access control module serves as a universal authentication service for all applications within the electronic control unit. Instead of each application having dedicated cryptographic materials, a single set of cryptographic materials in the access control module serves multiple applications. This multi-functional approach allows the same cryptographic infrastructure to authenticate messages from any source application to any target application, significantly reducing overall memory requirements.

Inventive Principle:
Principle #6Universality (Multi-functionality)

2Reliability

If authentication is performed using cryptographic materials for each application, then message transmission security is improved, but CPU computation cost increases

Engineering Contradiction:
Improvemessage transmission securityVSAvoidCPU computation cost
Core Design Contradiction:
ReliabilityVSPower

Solution Approach 1:

The patent extracts the computationally intensive cryptographic verification operations from individual applications and concentrates them in a dedicated access control module. This centralized approach allows for optimized cryptographic processing and avoids redundant computations that would occur if each application performed its own cryptographic operations independently.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The access control module autonomously handles cryptographic verification and access control decisions without requiring individual applications to perform cryptographic operations. The module self-manages the verification process using centralized cryptographic materials, freeing application processors from heavy computational tasks and reducing overall CPU computation cost across the system.

Inventive Principle:
Principle #25Self-service

3Adaptability or versatility

If each application manages its own cryptographic materials, then authentication capability is improved, but device complexity increases

Engineering Contradiction:
Improveauthentication capabilityVSAvoidkey management complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent extracts cryptographic material management from individual applications and centralizes it in the access control module. This eliminates the complexity of distributed key management while preserving authentication capabilities. The access control module maintains a single set of cryptographic materials that can authenticate messages from any source application, simplifying the overall system architecture.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The access control module provides universal authentication services to all applications using a single cryptographic infrastructure. This multi-functional design allows the same module and cryptographic materials to serve multiple authentication purposes, reducing device complexity while maintaining versatile authentication capabilities across different application pairs.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP4167118A1Method for controlling a transmission of a message from a source application to a target application
Publication Date: 2023.04.19 VALEO COMFORT & DRIVING ASSISTANCE
  • EP4167118A1 patent drawingFigure 1
  • EP4167118A1 patent drawingFigure 2
  • EP4167118A1 patent drawingFigure 3~5

AI summary

The invention relates to a method (1) for controlling a transmission of a message (Msg) from a source application (A_S) within a primary electronic control unit (ECUA) of a network (N) to a target application (A_T) within a secondary electronic control unit (ECUB) of said network (N) according to a communication protocol (P), said method (1) comprising: - building (E1) by the source application (A_S) a message (Msg), - associating (E2) to said message (Msg) security information (si) characterizing said source application (A_S), - forwarding (E3) said security information (si) to at least one access control module (Acm) of one of the two primary and secondary electronic control units (ECUA, ECUB) via applicative layers (L5-L7) of at least one of network protocol stack (St) of one of the two primary and secondary electronic control units (ECUA, ECUB), - checking (E4) by said at least one access control module (Acm) access rules (r) mapped to said security information (si), - based on said checking, sending back (E5) by said access control module (Acm) a security decision (b) for the message (Msg) to said applicative layers (L5-L7) of said at least one network protocol stack (St).