ECU Software Update Authentication via TCU

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Vehicle ECUs face challenges in implementing resource-intensive security measures due to limited computing resources, and existing software update procedures fail to verify software authenticity before installation, potentially leading to unauthentic software being installed and inefficient update processes.

Innovation Solution

A method for updating ECU software that involves initiating a programming session via an in-vehicle network, authenticating software updates using an authentication key, and sending the update only if successful, with a Telematics Control Unit (TCU) or service tool connected to the network performing the authentication and flashing, ensuring authenticity and compatibility.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If digital signature authentication is implemented for software updates, then software authenticity is verified, but computing resources of ECU are consumed

Engineering Contradiction:

Improvesoftware authenticity verificationVSAvoidcomputing resources of ECU

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The authentication key is extracted from the ECU and stored in the TCU. This extraction moves the computational burden of authentication from the resource-constrained ECU to the more capable TCU, allowing the ECU to verify authenticity without consuming excessive computing resources during update operations.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The authentication key is obtained and stored in the TCU in advance, before the software update process begins. This preliminary action prepares the authentication mechanism so that during the actual update, the ECU can quickly verify the digital signature without the overhead of key management or complex cryptographic operations.

Inventive Principle:

Principle #10Preliminary action

2Productivity

If software update is performed without prior authentication, then update process is simple, but unauthentic software may be installed

Engineering Contradiction:

Improveupdate process efficiencyVSAvoidsoftware authenticity

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The digital signature authentication is performed as a preliminary step before the software update is applied. The TCU authenticates the update package by verifying its digital signature against the stored authentication key, ensuring authenticity is confirmed before any installation occurs, thus preventing unauthentic software from being installed.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The TCU acts as an intermediary between the update source and the ECU. It receives the software update, authenticates it using the stored key, and only then allows the authenticated update to be transferred to and installed on the ECU. This intermediary role ensures authenticity verification without complicating the update process for the end user.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Ease of operation

If authentication key is stored in TCU memory, then authentication can be performed externally, but security risk of key exposure increases

Engineering Contradiction:

Improveexternal authentication capabilityVSAvoidkey exposure risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

Instead of storing the complete private key in the TCU, only the public authentication key is copied and stored there. The private key remains securely stored in the ECU and never leaves it. This copying approach allows external authentication operations while maintaining the security of the private key, as the public key can be freely shared for verification purposes.

Inventive Principle:

Principle #26Copying

4Reliability

If version comparison is performed before authentication, then incompatible updates are prevented, but update process time increases

Engineering Contradiction:

Improveupdate compatibilityVSAvoidupdate process time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Version comparison is performed as a preliminary check before the authentication and update installation processes. By comparing the update version with the currently installed version beforehand, the system can quickly determine compatibility and prevent unnecessary authentication and installation of incompatible updates, thus saving time in the long run by avoiding failed update attempts.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11146401B2Software authentication before software update

Publication Date: 2021.10.12 FORD GLOBAL TECH LLC

AI summary

A programming session may be initiated to a vehicle ECU by an update device. A software update for the ECU may be authenticated by the update device using an authentication key. When an authentication result indicates successful authentication, the ECU software update is sent by the update device over the in-vehicle network to the ECU. The ECU may then flash a memory with the ECU software update. The authentication key may be obtained from the ECU. The update device may be a vehicle telematics control unit or a service tool coupled to a connector of the vehicle.