Update Gateway with Hardware Security Module for Autonomous Control Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for updating embedded electronic control units in vehicles lack secure and autonomous functionality, especially when no network connection is available, and may be vulnerable to attacks if the update gateway is compromised.
Innovation Solution
A method utilizing a hardware security module to securely update control units by downloading data during an internet connection and using a ticket-based mechanism that is cryptographically signed, allowing updates without an active OEM backend dialogue, and establishing a secure channel between the hardware security module and the control unit to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If updates are performed without network connection, then update autonomy is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The system downloads update data and authentication tickets to the update gateway while network connection is available. These credentials are stored securely in the HSM for later use when no network connection is available, enabling autonomous updates with pre-obtained security credentials
Solution Approach 2:
A hardware security module (HSM) is introduced as an intermediary component that securely stores authentication credentials and tickets. The HSM acts as a trust anchor that enables secure autonomous updates by validating update requests locally without requiring continuous network connection to the OEM backend
2Ease of operation
If cryptographic credentials are stored on update gateway, then update functionality is improved, but protection against data extraction deteriorates
Solution Approach 1:
The HSM serves as a secure intermediary that stores cryptographic credentials and authentication tickets. It provides secure access control and cryptographic operations while protecting the stored credentials from extraction attacks. The update gateway communicates with the HSM through a secure interface, enabling update functionality while maintaining strong protection against data extraction
Solution Approach 2:
The system combines software-based update gateway functionality with hardware-based security module. This composite architecture integrates the ease of operation of software updates with the physical security and extraction resistance of hardware security modules, creating a system that benefits from both approaches
3Reliability
If ticket-based mechanism is implemented, then update security is improved, but system complexity increases
Solution Approach 1:
The system uses ticket-based authentication where the ticket contains encoded authentication parameters and validity information. The HSM validates tickets by checking their cryptographic signatures and validity periods. This approach provides strong security through cryptographic parameters while keeping the validation logic relatively simple and standardized
Data Source
AI summary
A method for updating an embedded electronic control unit, including an update gateway requests from a hardware security module an update request destined for the electronic control unit, the update gateway receives from the hardware security module the update request, which is signed by the hardware security module, the update gateway creates a communication channel, based on a cryptographic identity of the update gateway, to a backend, the update gateway sends the update request to the backend, the update gateway receives from the backend via the communication channel an update ticket which corresponds to the update request and is signed by the backend, in addition to associated update data, validates the update data, initiates a validation of the update ticket, checks the result of the validation, and depending on the result, the update gateway updates the electronic control unit with the update data.