ECU Shared-Key Inspection for Secure In-Vehicle Message Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The onboard network in vehicles lacks effective security measures to prevent unauthorized access and control, as existing technologies do not adequately detect and manage the sharing of session keys among electronic control units (ECUs), leading to potential security breaches.
Innovation Solution
A key management method is introduced where a shared key is stored in multiple ECUs, with a master ECU generating and distributing session keys based on the shared key, and periodically inspecting the security state of the shared key, including expiration dates and serial IDs, to ensure only authorized ECUs access the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If session keys are encrypted using a shared key for distribution among ECUs, then key distribution security is improved, but vulnerability to brute-force attacks increases if the shared key is compromised
Solution Approach 1:
The patent implements periodic generation and distribution of session keys using the shared key. By continuously rotating session keys at predetermined intervals, the system limits the window of opportunity for brute-force attacks and reduces the impact of a compromised shared key, as unauthorized nodes would only have access to a limited number of session keys rather than all future keys
Solution Approach 2:
The patent changes the session key parameter periodically by generating new session keys at predetermined intervals. This dynamic parameter change ensures that even if an attacker compromises the shared key, they can only decrypt a limited number of frames before the session key changes, thereby mitigating brute-force attack effectiveness
2Reliability
If a message authentication code is added to frames to prevent unauthorized control, then network security is improved, but communication overhead increases
Solution Approach 1:
The patent extracts the authentication function into a separate component (message authentication code) that is appended to the frame data. This allows the core communication protocol to remain unchanged while adding security functionality, and the MAC can be efficiently calculated using the session key without requiring changes to the fundamental frame structure or transmission mechanism
3Measurement precision
If shared key security state is inspected periodically, then detection of unauthorized ECUs is improved, but system complexity increases
Solution Approach 1:
The patent implements a feedback mechanism where the first-type ECU periodically inspects the security state of shared keys stored in second-type ECUs and verifies authentication information. This continuous monitoring provides real-time feedback on the security status of the network, enabling detection of unauthorized ECUs or key compromises while maintaining a manageable inspection frequency to avoid excessive system complexity
Solution Approach 2:
The patent performs preliminary security inspections of shared key storage in ECUs before potential security breaches can occur. By proactively verifying the security state and authentication information at predetermined intervals, the system prevents unauthorized access rather than reacting to breaches after they occur, reducing the need for complex emergency response mechanisms
Data Source
AI summary
A key management method serves as an electronic control unit (ECU) in an onboard network system having a plurality of ECUs that perform communication by frames via a network. The method includes storing, in a first-type ECU, a shared key to be mutually shared with second-type ECUs, and executing encryption processing regarding a framed transmitted or received via the network, based on the shared key. The method further includes executing, by the first-type ECU, inspection of a security state of the shared key stored by the second type ECUs in a case where a vehicle is in at least one of the following particular states, including immediately after the vehicle is not driving and is entering the accessory-on state, immediately after the vehicle is not driving and the vehicle is entering the accessory-off state, and immediately after the vehicle engine is started.