Vehicle Gateway Certificate Authentication for Diagnostic Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vehicle security systems fail to effectively authenticate external diagnostic devices and manage access security based on certificate validity and revocation lists, leading to potential security breaches when secret algorithms are compromised.
Innovation Solution
A method and apparatus that collect and analyze security-related information according to a certificate's rating, performing integrity checking and security key authorization processes to determine if a diagnostic device can access the vehicle, including validity term checking and certificate revocation list checking, using a vehicle gateway that communicates with a diagnosis device, vehicle head unit, and authorization server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secret algorithms are used for authentication, then security is maintained, but security is broken when the algorithm is open, leaked, or hacked
Solution Approach 1:
The patent replaces the mechanical secret algorithm-based authentication system with a public key infrastructure (PKI) system using digital certificates. Instead of relying on a secret shared algorithm between controller and diagnostic device, the system uses cryptographic key pairs where the controller verifies the device's certificate using a public key, eliminating the vulnerability of secret algorithm exposure.
Solution Approach 2:
The patent introduces an authorization server as an intermediary that issues and manages digital certificates. The authorization server acts as a trusted third party that authenticates the diagnostic device and provides cryptographic proof of authenticity through certificates, removing the need for direct secret sharing between controller and device.
2Reliability
If comprehensive security checking is performed, then access security is improved, but processing time and complexity increase
Solution Approach 1:
The patent implements staged authentication where the controller performs essential certificate verification (validity period, issuer, signature) without immediately performing all possible security checks. Optional checks like CRL verification are performed only when needed, balancing security with processing efficiency.
Solution Approach 2:
The authorization server performs preliminary authentication and certificate issuance before the diagnostic device connects to the controller. This pre-verification reduces the authentication burden during actual access, as the device already has a validated certificate that the controller can quickly verify.
3Reliability
If certificate validation processes are implemented, then unauthorized access is prevented, but device complexity increases
Solution Approach 1:
The patent extracts complex certificate management functions (issuance, revocation, renewal) from the controller and places them in a dedicated authorization server. The controller only needs to implement certificate verification, which is simpler than full certificate management, reducing its complexity while maintaining security.
Data Source
AI summary
A method for controlling access security at a vehicle gateway of a vehicle including at least one control unit in communication with the vehicle gateway includes: receiving a certificate from a diagnosis device; recognizing a rating of the certificate; and performing at least one of an integrity checking process and a security key authorization process according to the rating of the certificate to determine whether the diagnosis device is allowed to access to the vehicle.