Vehicle OTA Update Encryption With Dynamic Symmetric Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Over-the-air (OTA) software updates for vehicles face security vulnerabilities due to unauthorized access and installation of unapproved software, especially when using public networks and less-skilled users, and traditional encryption methods are insufficient to ensure integrity and reliability.
Innovation Solution
A system using dynamically generated symmetric keys, tied to specific vehicle and device combinations, ensures secure decryption by requiring access to vehicle-specific information, preventing unauthorized installation and tampering, even with intermediary servers that are not fully trusted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional encryption methods are used for OTA updates, then updates can be delivered wirelessly without physical connection, but security vulnerabilities exist allowing unauthorized access and installation of unapproved software
Solution Approach 1:
The encryption key is segmented into two parts: a vehicle-specific key component stored in the vehicle's secure element, and a update-specific key component transmitted during the update process. This segmentation ensures that neither component alone can decrypt updates, preventing unauthorized access while enabling wireless delivery
Solution Approach 2:
The vehicle-specific key component is pre-provisioned in the vehicle's secure element during manufacturing, before the vehicle ever receives an OTA update. This preliminary action establishes a security foundation that prevents unauthorized updates from the outset, while still allowing convenient wireless update delivery later
2Adaptability or versatility
If public networks are used for OTA updates, then updates can be delivered from any location with network access, but unauthorized actors can intercept and install malicious software
Solution Approach 1:
A secure element in the vehicle acts as an intermediary that independently verifies update authenticity using the vehicle-specific key component. This intermediary security mechanism protects against network-based attacks while allowing updates to be delivered from any location with network access
Solution Approach 2:
The vehicle's secure element autonomously performs cryptographic verification of update authenticity using its stored key component, without requiring external validation. This self-service security mechanism prevents unauthorized updates even when using public networks, while maintaining location flexibility
3Ease of operation
If untrained users initiate OTA updates, then updates can be applied outside dealerships, but users may inadvertently install incompatible or malicious software
Solution Approach 1:
The vehicle's secure element automatically performs cryptographic verification to ensure update compatibility and authenticity, without requiring user expertise. This self-service mechanism enables untrained users to safely receive updates outside dealerships while preventing installation of incompatible or malicious software
Solution Approach 2:
The cryptographic verification mechanism is pre-configured in the vehicle's secure element, automatically validating update authenticity before installation. This preliminary validation protects untrained users from installing incompatible software, while maintaining ease of operation for outside-dealership updates
4Productivity
If symmetric encryption keys are statically provisioned, then decryption is simple and fast, but security is compromised if keys are intercepted or leaked
Solution Approach 1:
The encryption key is segmented into vehicle-specific and update-specific components, with the vehicle-specific portion stored securely in the vehicle's secure element. This segmentation maintains fast decryption performance while significantly improving security by preventing key interception and leakage
Solution Approach 2:
The effective decryption key is dynamically formed by combining the stationary vehicle-specific key component with the update-specific key component transmitted during each update. This dynamic key formation maintains decryption speed while preventing security compromises from static key provisioning
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Embodiments of the present disclosure generally relate to systems, devices, and methods wherein dynamically generated symmetric keys are used for encryption and decryption of software updates for vehicles. The symmetric keys are dynamically generated using a combination of information that ties a given symmetric key to a specific combination of a vehicle and the devices installed therein. The dynamic generation of the symmetric keys also uses a piece of random data generated by an intermediary server, which allows the intermediary server to validate devices before providing the piece of random data and thereby control access to the software updates. Use of the techniques disclosed herein provide heightened security, control, safety, and reliability for over-the-air software updates for vehicles.