Vehicle ECU Secure Software Update via Nonce and Signature
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern vehicles face efficiency issues and security flaws due to the increasing role of software in their systems, with improper firmware updates potentially leading to malfunctioning or unauthorized vehicle operation.
Innovation Solution
A two-stage software update procedure involving a first stage where updates are downloaded and verified, and a second stage where the update server authorizes the swap to the new software version, ensuring authenticity and integrity through cryptographic signatures and nonce values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software updates are applied manually at the dealership while the vehicle is inoperable, then software version control is maintained, but vehicle availability and update efficiency are reduced
Solution Approach 1:
The system enables self-service through automated update processes. The ECU autonomously receives software updates from the server, performs integrity verification using cryptographic signatures, and applies updates without requiring manual technician intervention. The system automatically manages the update lifecycle including download, verification, and installation phases.
Solution Approach 2:
The system performs preliminary actions by pre-verifying software updates before application. Cryptographic signatures are validated in advance, and integrity checks are conducted before the update is committed to the ECU, ensuring reliability is established prior to the actual update process.
2Ease of operation
If software updates are applied manually by technicians, then update application is controlled, but security against unauthorized updates is compromised
Solution Approach 1:
Cryptographic signatures serve as an intermediary mechanism between the server and ECU. The server signs software updates with a private key, and the ECU verifies these signatures using a public key. This intermediary cryptographic layer ensures that only authorized updates from the server can be applied, preventing unauthorized modifications while maintaining automated control.
Solution Approach 2:
The patent replaces manual mechanical control by technicians with an automated cryptographic verification system. Instead of relying on human operators to control update application, the system uses cryptographic signatures and automated verification processes to enforce security, eliminating the security gaps associated with manual operations.
3Reliability
If cryptographic verification is performed on all updates, then security is improved, but processing time and computational overhead increase
Solution Approach 1:
The system performs cryptographic verification selectively and efficiently. Rather than excessive verification of all data, the system focuses verification on critical elements such as software signatures and integrity checksums. This partial verification approach maintains security while reducing unnecessary computational overhead and time consumption.
Data Source
AI summary
A vehicle may receive a software update to be installed to a vehicle electronic control unit (ECU). The vehicle ECU may download a software update received from a server to a first storage; generate a nonce value associated with the software update; send to the server, a swap authorization request including the generated nonce value; receive a swap authorization including the nonce value and a command-and-control signature from the server; validate the signature and the nonce value from the swap authorization; and reboot using the first storage instead of a second storage when the recovered nonce value matches the generated nonce value.