On-board Device Memory Segmentation for Secure Telematics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing on-board devices for telematic traffic services face security concerns due to insecure near-range communication modules, which can be exploited for unauthorized access and resource inefficiencies due to direct memory access, potentially disrupting higher priority activities.
Innovation Solution
An on-board device with a radiofrequency communication stage, a short-range communication stage, two memories, and a data processing unit, where the first memory stores an encryption key accessible only by the data processing unit, and the second memory is directly accessible by the short-range communication stage, ensuring secure data transfer and efficient resource management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a near-range communication module with direct memory access is implemented, then ease of operation for configuration modification is improved, but security is worsened due to unauthorized access risks
Solution Approach 1:
The memory is divided into two separate memory units: a first memory unit that stores encryption keys and is accessible only by the data processing unit, and a second memory unit that stores configuration data and is directly accessible by the short-range communication module. This segmentation prevents unauthorized access to encryption keys while allowing easy configuration modification through the communication module.
Solution Approach 2:
The data processing unit acts as an intermediary between the short-range communication module and the first memory unit. When configuration data needs to be updated, the communication module sends encrypted data to the data processing unit, which then uses the encryption key from the first memory unit to decrypt and store the data. This intermediary role protects the encryption keys from direct exposure while enabling configuration changes.
2Productivity
If the short-range communication module can directly access the central operating memory, then productivity for data transfer is improved, but reliability is worsened due to potential disruption of higher priority activities
Solution Approach 1:
The memory system is segmented into a first memory unit for encryption keys (accessible only by data processing unit) and a second memory unit for configuration data (directly accessible by communication module). This allows high-speed data transfer to the second memory unit without blocking critical operations on the first memory unit, maintaining both productivity and reliability.
Solution Approach 2:
Different access permissions and characteristics are assigned to different memory units based on their specific requirements. The second memory unit allows direct access for efficient data transfer, while the first memory unit restricts access to maintain security and operational stability. This local differentiation resolves the contradiction between transfer efficiency and system reliability.
3Reliability
If encryption keys are stored in a memory accessible only by the data processing unit, then security is improved, but device complexity increases due to additional memory and access control mechanisms
Solution Approach 1:
The memory system is divided into two distinct memory units with different access characteristics. This segmentation provides security for encryption keys while maintaining relatively simple access control rules: the first memory unit is accessible only by the data processing unit, and the second memory unit is directly accessible by the short-range communication module. The segmented approach balances security requirements with architectural simplicity.
Data Source
Figure 1
Figure 2
AI summary
An on-board device for telematic traffic services is described. The on-board devices comprises a radiofrequency communication stage for communicating with a road-side device, a short-range communication stage for communicating with a user device (a mobile phone for example), a data processing unit cooperating with both the communication stages, a central operating memory - accessible only by the data processing unit - which stores an encryption key, and a second memory directly accessible by the short-distance communication stage. The short-range communication stage receives encrypted data from the user device and stores it temporarily in the second memory which can be directly accessed by it. Upon reception of a wake-up signal, the data processing unit decrypts this encrypted second data using the encryption key stored in the central operating memory and transfers said data into the central operating memory.