Vehicle ECU Flag Authentication for Secure OTA Function Switching

Solution Overview

Problem

Existing Over-The-Air (OTA) technologies for updating vehicle control software lack robust security measures to prevent unauthorized switching of specific functions in vehicle ECUs, which can compromise vehicle security and functionality.

Innovation Solution

A server generates an electronic signature using a hash value calculated from flag data and dummy data, which are used to authenticate and switch between activated and deactivated states of specific vehicle ECU functions, ensuring the integrity of the software updates.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If an electronic signature scheme is applied to flag data for switching ECU functions, then security strength is improved, but device complexity increases due to hash calculation and signature generation requirements

Engineering Contradiction:

Improvesecurity strengthVSAvoiddevice complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

Dummy data is pre-stored in the ECU before runtime operations. This preliminary action eliminates the need for real-time generation or transmission of dummy data, reducing communication overhead and simplifying the runtime security verification process while maintaining the integrity of the electronic signature scheme

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The dummy data is extracted and stored separately in the ECU's storage unit, independent of the flag data transmission. This separation allows the flag data to be transmitted concisely while the dummy data remains available locally for hash calculation, reducing the complexity of data transmission and storage management

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If dummy data is transmitted along with flag data for hash calculation, then security is improved, but loss of information increases due to additional data transmission requirements

Engineering Contradiction:

ImprovesecurityVSAvoiddata transmission overhead

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

Dummy data is pre-stored in the ECU before runtime operations. This preliminary action eliminates the need for real-time generation or transmission of dummy data, reducing communication overhead and simplifying the runtime security verification process while maintaining the integrity of the electronic signature scheme

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The dummy data is extracted and stored separately in the ECU's storage unit, independent of the flag data transmission. This separation allows the flag data to be transmitted concisely while the dummy data remains available locally for hash calculation, reducing the complexity of data transmission and storage management

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS12541359B2Server, vehicle, and software management method

Publication Date: 2026.02.03 TOYOTA JIDOSHA KK

AI summary

A server is configured to manage software for an electronic control unit mounted on a vehicle. The server includes: one or more memories that store flag data for switching between an activated state and a deactivated state of a specific function that is executable by the software; and one or more processors configured to generate an electronic signature to be added to the flag data. The one or more processors are configured to calculate a hash value from the flag data and dummy data that are not used to switch between the activated state and the deactivated state of the specific function, and generate the electronic signature using the calculated hash value.