Method and system for providing secure over-the-air vehicle updates

A system comprising:

• one or more communications networks;
• a plurality of vehicles;
• and
• one or more servers coupled with the one or more communications networks, each server comprising at least a processor and a memory coupled with and readable by the processor and storing therein a set of instructions which, when executed by the processor, causes the processor to provide a secure Over-The-Air (OTA) firmware update to one or more vehicles of the plurality of vehicles by:
• generating a firmware update package for the plurality of vehicles,
• applying a version-specific encryption to the generated firmware update package using a version key, the version key comprising a key specific to a version for the firmware update,
• applying a vehicle-specific encryption to the version key using a plurality of vehicle keys, each vehicle key comprising a private key maintained by the one or more servers and specific to each of the plurality of vehicles, wherein applying the vehicle-specific encryption to the version key using the plurality of vehicle keys generates a plurality of encrypted version keys, and
• distributing the encrypted generated firmware update package and the plurality of encrypted version keys to the plurality of vehicles over the one or more communications networks, wherein distributing the encrypted generated firmware update package and the plurality of encrypted version keys to the plurality of vehicles comprises sending the encrypted generated firmware update package and the plurality of encrypted version keys over the one or more communication networks to a service tool and transferring the encrypted generated firmware update package and one of the plurality of encrypted version keys from the service tool to each of the plurality of vehicles for installation through an On-Board Diagnostics (OBD) port of each of the plurality of vehicles, wherein the one of the plurality of encrypted version keys transferred to each of the plurality of vehicles is selected by the service tool based on a vehicle identification of the corresponding vehicle, and wherein each vehicle decrypts the one of the plurality of encrypted version keys transferred from the service tool using a private key maintained by the corresponding vehicle, decrypts the encrypted generated firmware update package using the decrypted one of the plurality of encrypted version keys, and applies the decrypted generated firmware update package.

A non-transitory computer-readable medium comprising a set of instructions stored therein which, when executed by a processor, causes the processor to provide a secure Over-The-Air (OTA) firmware update to one or more vehicles of a plurality of vehicles by:

• generating a firmware update package for the plurality of vehicles;
• applying a version-specific encryption to the generated firmware update package using a version key, the version key comprising a key specific to a version for the firmware update;
• applying a vehicle-specific encryption to the version key using a plurality of vehicle keys, each vehicle key comprising a private key maintained by one or more servers and specific to each of the plurality of vehicles, wherein applying the vehicle-specific encryption to the version key using the plurality of vehicle keys generates a plurality of encrypted version keys;
• and
• distributing the encrypted generated firmware update package and the plurality of encrypted version keys to the plurality of vehicles over one or more communications networks, wherein distributing the encrypted generated firmware update package and the plurality of encrypted version keys to the plurality of vehicles comprises sending the encrypted generated firmware update package and the plurality of encrypted version keys over the one or more communication networks to a service tool and transferring the encrypted generated firmware update package and one of the plurality of encrypted version keys from the service tool to each of the plurality of vehicles for installation through an On-Board Diagnostics (OBD) port of each of the plurality of vehicles, wherein the one of the plurality of encrypted version keys transferred to each of the plurality of vehicles is selected by the service tool based on a vehicle identification of the corresponding vehicle, and wherein each vehicle decrypts the one of the plurality of encrypted version keys transferred from the service tool using a private key maintained by the corresponding vehicle, decrypts the encrypted generated firmware update package using the decrypted one of the plurality of encrypted version keys, and applies the decrypted generated firmware update package.