Autonomous Vehicle Server Failover Using Signed Backup Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Autonomous vehicles are vulnerable to attacks if their cloud server is compromised, as malicious entities can send harmful commands, and restoring control can take an unknown amount of time, potentially causing significant damage.
Innovation Solution
Provisioning autonomous vehicles with a public key and a public key certificate before operation, allowing them to authenticate commands from a secondary server, which holds a private key split among administrators, stored in Hardware Security Modules, enabling override of malicious commands and switching to a backup server if compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single cloud server controls autonomous vehicles, then operational efficiency is improved, but system vulnerability to compromise increases
Solution Approach 1:
The system divides the single-point control architecture into multiple segmented server components (primary server, backup server, and emergency override server), each with specific authentication credentials. This segmentation allows the system to maintain operational efficiency through distributed control while reducing vulnerability since compromise of one server does not grant complete system control.
Solution Approach 2:
The system performs preliminary actions by pre-provisioning autonomous vehicles with multiple sets of server credentials (primary server public key, backup server public key, and emergency override public key) before deployment. This advance preparation ensures that when a server compromise is detected, vehicles can immediately switch to alternative credentials without interruption, maintaining productivity while countering the vulnerability.
2Object-generated harmful factors
If the cloud server is compromised, then malicious control capability is improved, but time to restore control increases
Solution Approach 1:
The system performs preliminary actions by pre-configuring multiple authentication credentials and override mechanisms before any compromise occurs. When malicious control is detected, the system can immediately activate pre-prepared backup credentials and emergency override keys, reducing the time to restore legitimate control without requiring lengthy restoration procedures.
Solution Approach 2:
The system implements preliminary anti-action through the emergency override server, which holds cryptographic keys that can immediately counteract malicious commands. This pre-positioned countermeasure allows the system to neutralize compromised control capabilities instantly, preventing extended periods of malicious operation and reducing the time needed to restore safe control.
3Reliability
If multiple server credentials are provisioned to vehicles, then system resilience is improved, but authentication complexity increases
Solution Approach 1:
The system performs preliminary action by pre-provisioning vehicles with multiple server credentials during manufacturing or initial setup. This advance configuration eliminates the need for complex real-time credential management decisions, as vehicles already have the necessary authentication materials ready to use when switching between primary, backup, or emergency servers.
Solution Approach 2:
The system implements self-service through automated credential verification and server selection mechanisms. Vehicles autonomously determine which server credential to use based on pre-configured conditions and current system state, without requiring complex manual authentication procedures. This automation maintains high resilience while keeping authentication complexity manageable through rule-based decision-making.
Data Source
AI summary
Systems and methods for managing a compromised autonomous vehicle server are described herein. A processor may obtain an indication of a first server configured to control an autonomous vehicle being compromised. The autonomous vehicle may have previously been provisioned with a first public key. The first public key may be paired with a first private key. A processor may compile command information. The command information may include a command for the autonomous vehicle and a digital certificate of a second server configured to control the autonomous vehicle in the event of the first server being compromised. The digital certificate may include a second public key and may be signed with the first private key. The command may be signed with a second private key associated with the second server. The second private key may be paired with the second public key.