Vehicle Password Entry Security via Cryptographic Nonce
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password entry systems in vehicles, such as phone-as-a-key (PaaK) and passive entry and start (PEPS) systems, are vulnerable to hacking and malicious misuse, necessitating secure password creation and validation methods.
Innovation Solution
A system that includes a computer-based verification procedure to ensure password security when starting a vehicle, involving detection of the absence of a PaaK device or PEPS key fob, prompting for a password entry, and employing cryptographic measures for validation, including a cryptographic nonce and salt for secure password processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a password entry system is implemented for vehicle starting, then convenience and accessibility are improved, but security vulnerability to hacking and malicious misuse increases
Solution Approach 1:
The system performs preliminary detection to verify the absence of authorized key fobs or PaaK devices before allowing password entry. This preliminary check ensures that password entry is only enabled when no legitimate key is present, preventing unauthorized access attempts while maintaining convenience for legitimate users
Solution Approach 2:
The system introduces cryptographic intermediaries including nonces and salts that mediate between the entered password and the stored hash. These cryptographic elements ensure secure validation by preventing direct password comparison and protecting against various attack vectors while maintaining authentication functionality
2Reliability
If cryptographic validation procedures are implemented, then password security is improved, but system complexity increases
Solution Approach 1:
The cryptographic validation procedure is segmented into distinct sequential steps: generating a nonce, combining nonce with password, hashing the combination, generating a salt, combining salt with hash, and final verification. This segmentation makes the complex cryptographic process more manageable and implementable while maintaining security
Solution Approach 2:
The system generates all necessary cryptographic elements (nonce and salt) automatically during the validation process without requiring manual intervention. The computer system self-manages the entire cryptographic workflow from nonce generation through final verification, reducing operational complexity while maintaining security
Data Source
AI summary
Exemplary embodiments described in this disclosure are generally directed to systems and methods for ensuring password security when starting a vehicle having a keyless engine starting system. In an exemplary method, a computer detects a depression of an engine start push button when no phone-as-a-key (PaaK) device or passive-entry-passive-start (PEPS) key fob is present in the vehicle. The computer responds by executing a verification procedure prior to password validation. The verification procedure can include operations such as determining that no PaaK device or PEPS key fob is present either inside the vehicle or within a defined geofence outside the vehicle. If the verification procedure is successful, the computer displays a prompt upon a display screen for entering of a password. The computer then uses various security measures when verifying the validity of an entered password, followed by displaying of a message indicating acceptance or rejection of the password.