Vehicle Network Security Proxy for Low-Latency Message Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vehicle networks face computational intensity in authenticating messages from private communication systems due to the need for generating message authentication codes at the gateway node, which can overwhelm processors and security modules.
Innovation Solution
A message authentication system that utilizes a security proxy node to compute cryptographic hashes and authentication codes for messages from private nodes, reducing computational load by transmitting only cryptographic hashes and codes over the public communication system, allowing receiving nodes to verify authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the gateway node generates message authentication codes for all messages received from the private communication system, then message authenticity is ensured, but computational load on processors and security modules becomes excessive
Solution Approach 1:
The authentication process is segmented between the gateway node and receiving nodes. The gateway node only performs authentication for the first message from each private node, while subsequent messages from the same private node are authenticated by the receiving nodes using stored authentication data. This segmentation reduces the computational burden on the gateway node's processors and security modules.
Solution Approach 2:
The gateway node performs preliminary authentication by generating and storing authentication data (such as cryptographic keys or authentication tokens) for each private node before actual message authentication occurs. This preliminary action enables receiving nodes to independently verify subsequent messages without requiring the gateway node's computational resources.
2Reliability
If message authentication codes are generated for every message, then security is maintained, but processing time increases
Solution Approach 1:
The authentication responsibility is segmented temporally and spatially. The gateway node handles initial authentication setup, while receiving nodes handle ongoing message verification. This segmentation distributes processing time across different nodes and reduces the time any single node must spend on authentication operations.
Solution Approach 2:
Receiving nodes are empowered to perform self-service authentication for messages from private nodes whose authentication data they have previously received and stored. This eliminates the need for these nodes to contact the gateway node for each message verification, significantly reducing processing time and latency.
3Reliability
If the gateway node authenticates all messages, then message integrity is verified, but system complexity increases
Solution Approach 1:
The authentication system is segmented into two functional components: the gateway node that manages authentication setup and the receiving nodes that perform verification. This segmentation distributes system complexity across multiple nodes rather than concentrating it all in the gateway node, making the overall system more manageable and scalable.
Solution Approach 2:
Authentication data acts as an intermediary between the gateway node and receiving nodes. The gateway node generates and transmits this authentication data, which then mediates the verification process at receiving nodes. This intermediary mechanism simplifies the interaction between nodes while maintaining security.
Data Source
AI summary
A message authentication system for a vehicle network includes a private communication system including one or more private nodes in electronic communication with one another. The message authentication system also includes a public communication system including a plurality of public nodes in electronic communication with one another. The plurality of public nodes includes a security proxy node and one or more receiving nodes. The security proxy node authenticates one or more unique messages transmitted by a private node of the private communication system to the one or more receiving nodes of the public communication system.