Automotive ECU Secure Data Export via Public Key Infrastructure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for securely exporting data from automotive engine control units (ECUs) face challenges such as limited processing power for cryptography, vulnerability to key exposure, and lack of forward secrecy, leading to potential tampering and administrative overhead.
Innovation Solution
A method using public key encryption schemes, where ephemeral keys are generated and used for secure data export, with authentication and encryption processes ensuring only authorized access and deletion of data post-export, reducing the need for long-term key storage and preventing replay attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetric secret key is stored on ECU for encryption and authentication, then data security is improved, but vulnerability to key exposure increases and encryption becomes useless if attacker obtains access to storage memory
Solution Approach 1:
The secret key is extracted from the ECU's storage memory and replaced by a public key that is stored on the ECU. The corresponding private key remains securely stored on the backend server. This extraction eliminates the vulnerability of storing symmetric secret keys on the ECU while maintaining encryption security, as the public key cannot be used to derive the private key.
Solution Approach 2:
A public key infrastructure acts as an intermediary between the ECU and the backend server. The public key on the ECU and the private key on the backend server mediate the authentication and encryption process, eliminating the need for direct symmetric key sharing and the associated security risks of key exposure on the ECU.
2Reliability
If unique key is provided to each ECU for encrypting and authenticating critical data, then security against key reuse from hacked ECUs is improved, but memory requirements and administrative overhead increase significantly
Solution Approach 1:
The unique secret key material is extracted from each ECU's non-volatile memory and relocated to the backend server. Each ECU only stores a public key, which is much smaller and does not require secure deletion. The backend server maintains the unique private keys for each ECU, providing security against key reuse without requiring large amounts of secure memory in each ECU.
Solution Approach 2:
The backend server provides a universal secure key management service for all ECUs. Instead of each ECU requiring its own secure key storage infrastructure, the backend server universally manages all unique keys, reducing the memory requirements and administrative overhead at the ECU level while maintaining unique key security.
3Productivity
If symmetric key is used for encryption of exported data, then encryption efficiency is improved, but forward secrecy is lost and keys must be manually updated in ECU and backend
Solution Approach 1:
Asymmetric cryptography (public key infrastructure) is applied to the key exchange and authentication process, providing forward secrecy without sacrificing encryption efficiency. The public key/private key pair enables secure key establishment where past compromise does not affect future security, while symmetric encryption can still be used for the actual data encryption using efficiently generated session keys.
Solution Approach 2:
The public key is preliminarily stored on the ECU during manufacturing, enabling forward secrecy to be established in advance. This preliminary setup allows the ECU to generate unique session keys for each communication with the backend server using the pre-stored public key, ensuring forward secrecy without requiring manual key updates.
4Reliability
If signature-based verification is used for access control, then authentication security is improved, but processing power requirements for cryptography increase beyond ECU capabilities
Solution Approach 1:
The cryptographic functionality is segmented between the ECU and the backend server. The ECU performs only lightweight operations such as verifying signatures using the backend's public key and generating encryption keys, while the computationally intensive signature generation and verification operations are performed on the backend server with sufficient processing power.
Solution Approach 2:
The public key acts as an intermediary that enables secure authentication without requiring the ECU to perform heavy cryptographic computations. The ECU can verify authentication using the backend's public key through simple verification algorithms, while the backend handles the computationally intensive signature generation and management.
Data Source
Figure 1~2
Figure 3
Figure 4~6
AI summary
A method of secure data export from an automotive ECU (100) to a requesting entity (102) comprises receiving a signed request, the request transmitting a first public encryption key. The signature is verified using a second public key stored in the automotive ECU (100). Further, the requesting entity is authenticated. Only upon successful verification and authentication the automotive ECU (100) generates a random symmetric key for encrypting the data to be exported. The symmetric key is encrypted using the first public key received in the request, and unencrypted data is deleted. The encrypted data is exported to the requesting entity, which decrypts the symmetric key using a first private key associated with the first public key, and decrypts the data encrypted with the symmetric key.