Secure ECU Unlock in Semi-Offline Vehicle Diagnostics
Solution Overview
Problem
Existing end-to-end secure electronic control units (ECUs) in vehicles require continuous online connectivity for diagnostic access, which is not feasible in semi-offline environments, such as during vehicle diagnostics away from network coverage.
Innovation Solution
A secure ECU system that shares a security key, offline key, and counter value between the ECU and a remote security manager, allowing a diagnostic tool to generate a candidate unlock key offline, ensuring secure access to diagnostic functions without continuous network connectivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If continuous online connectivity is required for secure ECU access, then security is improved, but usability in semi-offline environments deteriorates
Solution Approach 1:
The system performs preliminary actions by generating and storing cryptographic keys (offline keys, seed values) and authentication data before the diagnostic session begins. The ECU and diagnostic tool pre-share security credentials that enable subsequent offline authentication, eliminating the need for continuous online connectivity while maintaining security.
Solution Approach 2:
The patent introduces cryptographic intermediaries (offline keys, verifiers, challenge-response mechanisms) that mediate between the ECU and diagnostic tool in offline mode. These intermediaries enable secure authentication without direct online connection to the security manager, acting as trusted intermediates that preserve security while enabling offline operation.
2Ease of operation
If offline diagnostic access is enabled, then ease of operation in semi-offline environments is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The system performs preliminary authentication setup by pre-sharing security credentials (offline keys, seed values) between the ECU and diagnostic tool before offline operation. This preliminary action ensures that even though offline access is enabled, only authorized tools with the correct credentials can access the ECU, maintaining security while enabling ease of operation.
Solution Approach 2:
The patent implements feedback mechanisms through challenge-response authentication and verifier verification. The ECU issues challenges that require specific cryptographic responses based on shared secrets, and the system verifies authentication results to confirm authorized access. This feedback loop ensures security is maintained even in offline mode where continuous verification is not possible.
3Ease of operation
If the offline key is stored in the ECU, then ease of operation is improved, but vulnerability to key interception increases
Solution Approach 1:
The patent segments the security architecture by separating the offline key storage from the ECU. The offline key is stored in the security manager's server, not in the ECU itself. The ECU only holds derived credentials (seed values, authentication data) that are computationally useful only when combined with the master offline key stored remotely. This segmentation reduces the attack surface in the ECU while maintaining ease of operation.
Solution Approach 2:
The patent introduces cryptographic intermediaries (verifiers, challenge-response tokens, derived credentials) that mediate between the stored offline key and the ECU authentication process. Instead of directly using the offline key in the ECU, the system uses intermediate cryptographic materials that are computationally derived and time-limited, reducing the value of any single intercepted credential while maintaining operational ease.
Data Source
AI summary
Method and apparatus are disclosed for end-to-end vehicle secure ECU unlock in a semi-offline environment. An example vehicle electronic control unit includes a first processor and a second processor. The first processor, when unlocked, provides diagnostic information. The second processor sends a seed value to a diagnostic tool. Additionally, the second processor, in response to receiving a second key, unlocks the first processor. The second processor, after receiving a first verifier, decrypts the first verifier to generate a new key, replaces a current key with the new key, and sends a second verifier to the diagnostic tool.