Vehicle Connectivity Module Secure Session Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current communication technologies between mobile devices and vehicles, such as Bluetooth and WiFi, lack sufficient security for transmitting sensitive or safety-critical information, necessitating a more efficient and secure method for command and control communications.
Innovation Solution
The implementation of a method using a pre-shared cryptographic key (VAK) for authentication and an ephemeral session key (DSK) to secure communications between mobile devices and vehicles, with the VAK being shared out-of-band and the DSK being temporal and ephemeral to prevent replay attacks and ensure message secrecy, along with an optional counter for additional security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If standardized communication technologies such as Bluetooth and WiFi are used for communication between mobile device and vehicle, then ease of operation is improved, but security is worsened
Solution Approach 1:
The communication system is segmented into two distinct phases: authentication phase using VAK for identity verification, and data transmission phase using DSK for encrypted communication. This segmentation allows each phase to use optimized security mechanisms independent of the underlying wireless technology.
Solution Approach 2:
Authentication and key exchange are performed preliminarily before actual data transmission. The VAK authentication establishes trust beforehand, and the DSK is generated in advance for the upcoming session, ensuring security is established before sensitive communications occur.
2Reliability
If a pre-shared cryptographic key is used for authentication, then security is improved, but device complexity is worsened
Solution Approach 1:
A backend system acts as an intermediary to manage the distribution and provisioning of VAKs to vehicles and mobile devices. This externalizes the complexity of key management, so the vehicle and mobile device themselves don't need complex key management infrastructure.
Solution Approach 2:
Cryptographic keys (VAK and DSK) are preliminarily established and stored in secure elements during manufacturing or initial provisioning. This preliminary setup eliminates the need for complex runtime key management operations during normal vehicle operation.
3Reliability
If an ephemeral session key is used to protect messages, then security is improved, but use of energy is worsened
Solution Approach 1:
The system dynamically transitions between using VAK for authentication and DSK for data encryption. The ephemeral DSK is generated only for the duration of each communication session and then discarded, creating a dynamic security approach that balances security needs with energy efficiency.
Solution Approach 2:
Ephemeral session keys (DSK) are discarded after each communication session ends. The system recovers by generating a new DSK for the next session, ensuring forward security while limiting the energy and computational resources invested in each individual session key.
Data Source
AI summary
A vehicle includes: (i) a main telematics module, (ii) a connectivity module including antenna(s) and processor(s). The connectivity module is configured to: (a) authenticate a mobile device via a vehicle-access-key (VAK); (b), if (a), issue an ephemeral-session-key (DSK) to the mobile device; (c), if (b), establish an active session with the mobile device; (d) encrypt all messages to the mobile device with the VAK during (a) and with the DSK during (c). The connectivity module is configured to automatically revoke the DSK upon expiration of a predetermined time interval.