Vehicle Data Service Embedded Public Key Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Commercial vehicles face challenges in maintaining secure communication systems due to malicious interference in broadband IP-based datalinks, particularly with certificate-based authentication methods that require frequent updates and increased complexity and cost in protecting symmetric or asymmetric keys.
Innovation Solution
A hybrid symmetric and public-private key system using an embedded public key for secure communication, eliminating the need to store device private keys on the vehicle, and enabling bidirectional authenticated data service communications through a vehicle communication manager device with a processor and wireless datalink transceiver.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate-based authentication is used to ensure secure communication, then message authenticity is improved, but device complexity and maintenance burden increase due to frequent certificate updates and key protection requirements
Solution Approach 1:
The patent extracts the private key from the on-vehicle device and stores it only in the ground-based certificate authority. The on-vehicle device retains only the public key, eliminating the need for private key storage and protection on the device. This resolves the contradiction by maintaining authentication reliability through public key verification while removing the complexity of private key management.
Solution Approach 2:
The patent introduces a ground-based certificate authority as an intermediary that signs messages using its private key. The on-vehicle device verifies these signed messages using the stored public key, eliminating the need for the on-vehicle device to possess or protect any private keys. This mediator approach maintains security while simplifying device complexity.
2Ease of operation
If symmetric key schemes are used for secure communication, then authentication is simplified, but key protection complexity and cost increase to maintain communications integrity
Solution Approach 1:
The patent extracts the symmetric key from the on-vehicle device and stores it exclusively in the ground-based system. The on-vehicle device uses only public key cryptography for authentication, while the ground-based system manages the symmetric key for message signing. This resolves the contradiction by simplifying on-vehicle authentication while removing key protection requirements from the device.
3Reliability
If certificates are stored on-board the vehicle for authentication, then message verification is enabled, but equipment replacement time increases due to certificate reloading requirements
Solution Approach 1:
The patent extracts the private key and certificate storage requirement from the on-vehicle device. Only the public key is stored on the device, which is sufficient for verifying messages signed by the ground-based system. When equipment is replaced, the new device already contains the public key and can immediately verify messages without requiring certificate reloading or reconfiguration.
4Productivity
If broadband IP-based datalinks are used for communication, then bandwidth and cost-effectiveness are improved, but susceptibility to malicious interference increases
Solution Approach 1:
The patent applies preliminary anti-action by implementing digital signatures on all ground-based messages before transmission. The on-vehicle device verifies these signatures using the stored public key, creating a preemptive defense against spoofing and malicious interference. This allows the system to use broadband IP-based datalinks for efficient communication while protecting against network-based attacks.
Data Source
AI summary
Secure subscription based vehicle data services are provided. In one embodiment, a device comprises: a non-volatile memory comprising an embedded public key (EPK) that comprises a public key of a public-private key pair associated with a data service system not onboard the vehicle; a protocol that initiates a communication session that includes a session validation sequence that causes a processor to transmit a session request message and validate an authenticity of a session reply request using the EPK; the protocol includes a session initiation sequence that causes the processor to: transmit an initiation request message to the data service system that includes a key derivation key, and apply the key derivation key to a key derivation function to generate a message authentication key. The processor authenticates uplink messages exchanged with a host data service using the message authentication key.