PCB Inter-Processor Authentication for Secure Reliable Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a lack of standard solutions for authenticated encrypted reliable point-to-point communication between processors on a single PCB, leading to vulnerabilities in automotive electronic systems, particularly due to ad-hoc custom solutions using block ciphers in unauthenticated modes, which are susceptible to attacks and lack connection reliability.
Innovation Solution
A method for secure inter-processor communication using a Shared Secure Key (SSK) to establish session keys through authentication challenges and responses, employing an Authenticated Encryption with Associated Data (AEAD) scheme to ensure confidentiality, integrity, and authenticity, with mutual authentication and retransmission mechanisms for reliability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If ad-hoc custom solutions with block ciphers in unauthenticated mode are used, then implementation simplicity is improved, but security is worsened due to vulnerability to attacks and lack of authentication
Solution Approach 1:
The patent applies preliminary action by pre-provisioning each processing unit with a unique cryptographic identity and shared secret keys during manufacturing. This preliminary setup enables secure authenticated communication without complex runtime key management, resolving the contradiction between implementation simplicity and security by preparing security credentials in advance.
Solution Approach 2:
The patent introduces cryptographic primitives (authenticated encryption with associated data, message authentication codes) as intermediaries between the processing units and the communication channel. These intermediaries provide security guarantees while maintaining implementation simplicity through standardized algorithms, addressing the contradiction between ease of implementation and security.
2Speed
If fast session key establishment is implemented, then communication speed is improved, but complexity increases due to authentication protocols
Solution Approach 1:
By pre-provisioning cryptographic identities and shared secrets during manufacturing, the patent eliminates complex runtime key exchange protocols. The authentication process becomes straightforward verification using pre-shared keys, achieving fast session establishment without protocol complexity.
Solution Approach 2:
Each processing unit independently generates its own authentication credentials and verifies incoming authentication messages using its pre-provisioned identity. This self-service approach eliminates the need for centralized key management or complex mutual authentication protocols, reducing system complexity while maintaining fast authentication.
3Productivity
If pre-shared keys are provisioned during manufacturing, then authentication speed is improved, but manufacturing complexity increases
Solution Approach 1:
The patent segments the security credential provisioning into individual processing units, with each unit receiving its own unique identity and shared secrets. This segmentation allows parallel provisioning during manufacturing, limiting the increase in manufacturing complexity while enabling fast authentication through pre-provisioned keys.
Data Source
AI summary
A method for securely transmitting data between first and second processing units, each storing a shared secure key and respective first and second identifiers, includes transmitting an authentication challenge from the first processing unit to the second processing unit. The authentication challenge includes a first random number. The method includes generating a session key and an authentication key at each of the corresponding first and second processing units, based on the transmitted authentication challenge and the stored shared secure key. The method includes transmitting an authentication response including an authentication code generated from the authentication challenge based on the authentication key. The method includes verifying each processing unit by comparing a received authentication code with a locally generated authentication code. The method includes, in response to being verified, transmitting data between the first and second processing units using the corresponding session keys.