Vehicle Gateway Web of Trust for ECU Command Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security approaches for remote operation of vehicle electronic control units (ECUs) lack validation of the correspondence between Vehicle Identification Number (VIN) and Electronic Serial Number (ESN), and do not validate the association of a gateway ESN and target ECU ESN, leading to potential unauthorized command execution.
Innovation Solution
Implementing a local web of trust within the vehicle's gateway, which verifies the association of VIN and ESN by querying the target ECU using a 'Who are you?' and 'Where are you?' trust test, ensuring that only trusted ECUs receive commands, and adding unverified ECUs to the trust web for future authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a local web of trust is implemented to validate VIN and ESN correspondence, then security against unauthorized command execution is improved, but device complexity and processing time increase
Solution Approach 1:
The gateway pre-establishes a local web of trust containing valid VIN-ESN associations before remote commands arrive. When a command is received, the gateway checks whether the target ECU's ESN and the vehicle's VIN form a valid association in the pre-built web of trust, enabling fast validation without complex real-time verification protocols.
Solution Approach 2:
The gateway maintains a local copy of the web of trust relationships within the vehicle, rather than querying external authorities for each command validation. This local replication allows rapid security verification while reducing dependency on external systems and minimizing processing delays.
2Measurement precision
If trust verification queries are sent to multiple subnets before command execution, then authorization accuracy is improved, but command execution time increases
Solution Approach 1:
The gateway performs trust verification by querying multiple subnets and collecting trust responses before the actual remote command is executed. This preliminary trust assessment ensures that only authorized ECUs receive commands, while the pre-computed trust relationships enable fast validation without delaying critical command execution.
Solution Approach 2:
The gateway acts as an intermediary that mediates between remote command sources and target ECUs. It collects trust responses from multiple subnets, validates the trust relationships, and then decides whether to forward commands, thereby centralizing authorization logic and enabling efficient trust verification without requiring direct peer-to-peer validation between all components.
Data Source
AI summary
A gateway of a vehicle is connected to a telematics control unit (TCU) and a plurality of electronic control units (ECUs). The gateway is programmed to receive a command from the TCU, the command specifying an electronic serial number (ESN) of a target ECU of the ECUs, and forward the command to the target ECU responsive to confirmation that the ESN of the target ECU is included in the web of trust.