Access Control Module for Automotive Message Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In automotive networks, existing authentication methods require each application to manage cryptographic materials, leading to high computational costs and resource usage, as they need to authenticate and verify identities for message transmission, which is inefficient and resource-intensive.
Innovation Solution
A method where the source application associates security information with messages, which is then checked by access control modules within the network protocol stack, allowing for access control decisions to be made without the need for extensive cryptographic key management, reducing computational load and memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication is performed using cryptographic materials for each application, then message transmission security is improved, but memory consumption and CPU computation cost increase significantly
Solution Approach 1:
The patent extracts the cryptographic verification function from individual applications and centralizes it in a dedicated access control module. This module handles all authentication operations using shared cryptographic materials, eliminating the need for each application to maintain its own cryptographic key sets. The access control module receives messages, verifies source application identities using centralized cryptographic materials, and enforces access rules, thereby reducing memory consumption while maintaining security.
Solution Approach 2:
The access control module serves as a universal authentication service for all applications within the electronic control unit. Instead of each application having dedicated cryptographic materials, a single set of cryptographic materials in the access control module serves multiple applications. This multi-functional approach allows the same cryptographic infrastructure to authenticate messages from any source application to any target application, significantly reducing overall memory requirements.
2Reliability
If authentication is performed using cryptographic materials for each application, then message transmission security is improved, but CPU computation cost increases
Solution Approach 1:
The patent extracts the computationally intensive cryptographic verification operations from individual applications and concentrates them in a dedicated access control module. This centralized approach allows for optimized cryptographic processing and avoids redundant computations that would occur if each application performed its own cryptographic operations independently.
Solution Approach 2:
The access control module autonomously handles cryptographic verification and access control decisions without requiring individual applications to perform cryptographic operations. The module self-manages the verification process using centralized cryptographic materials, freeing application processors from heavy computational tasks and reducing overall CPU computation cost across the system.
3Adaptability or versatility
If each application manages its own cryptographic materials, then authentication capability is improved, but device complexity increases
Solution Approach 1:
The patent extracts cryptographic material management from individual applications and centralizes it in the access control module. This eliminates the complexity of distributed key management while preserving authentication capabilities. The access control module maintains a single set of cryptographic materials that can authenticate messages from any source application, simplifying the overall system architecture.
Solution Approach 2:
The access control module provides universal authentication services to all applications using a single cryptographic infrastructure. This multi-functional design allows the same module and cryptographic materials to serve multiple authentication purposes, reducing device complexity while maintaining versatile authentication capabilities across different application pairs.
Data Source
Figure 1
Figure 2
Figure 3~5
AI summary
The invention relates to a method (1) for controlling a transmission of a message (Msg) from a source application (A_S) within a primary electronic control unit (ECUA) of a network (N) to a target application (A_T) within a secondary electronic control unit (ECUB) of said network (N) according to a communication protocol (P), said method (1) comprising: - building (E1) by the source application (A_S) a message (Msg), - associating (E2) to said message (Msg) security information (si) characterizing said source application (A_S), - forwarding (E3) said security information (si) to at least one access control module (Acm) of one of the two primary and secondary electronic control units (ECUA, ECUB) via applicative layers (L5-L7) of at least one of network protocol stack (St) of one of the two primary and secondary electronic control units (ECUA, ECUB), - checking (E4) by said at least one access control module (Acm) access rules (r) mapped to said security information (si), - based on said checking, sending back (E5) by said access control module (Acm) a security decision (b) for the message (Msg) to said applicative layers (L5-L7) of said at least one network protocol stack (St).