End-to-end communication security
AssigneeKaramba Security Ltd.
InventorsTal Efraim Ben David, Assaf Harel, Amiram Dotan, David Barzilai, Eli Mordechai
Life of this patent
Estimating the term…
Abstract
In one implementation, a method for providing end-to-end communication security for a controller area network (CANbus) in an automotive vehicle across which a plurality of electronic control units (ECU) communicate is described. Such an automotive vehicle can include, for example, a car or truck with multiple different ECUs that are each configured to control various aspects of the vehicle's operation, such as an infotainment system, a navigation system, various engine control systems, and/or others.
Claims20
A method for providing end-to-end communication security for a controller area network (CANbus) in an automotive vehicle across which a plurality of electronic control units (ECU) communicate, the method comprising:
- determining, by a first ECU in the automotive vehicle, a fingerprint for the first ECU;
- generating, by the first ECU, at least one unique identifier associated with the fingerprint;
- performing a remote attestation process with a remote computer system to validate the first ECU;
- in response to passing the remote attestation process, generating a first cryptographic key associated with the at least one unique identifier at the first ECU or a second ECU, wherein communications between the first and second ECUs are associated with a corresponding CANbus message identifier;
- creating, by the first ECU, a communication table that includes entries for a plurality of CANbus messages, at least one entry associating the first cryptographic key with the corresponding CANbus message identifier;
- encrypting, by the first ECU, the communication table using a communications table key;
- and
- storing, by the first ECU, the encrypted communication table locally on the first ECU.
A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations to provide end-to-end communication security for a controller area network (CANbus) in an automotive vehicle across which a plurality of electronic control units (ECU) communicate, the operations comprising:
- determining, by a first ECU in the automotive vehicle, a fingerprint for the first ECU;
- generating, by the first ECU, at least one unique identifier associated with the fingerprint;
- performing a remote attestation process with a remote computer system to validate the first ECU;
- in response to passing the remote attestation process, generating a first cryptographic key associated with the at least one unique identifier at the first ECU or a second ECU, wherein communications between the first and second ECUs are associated with a corresponding CANbus message identifier;
- creating, by the first ECU, a communication table that includes entries for a plurality of CANbus messages, at least one entry associating the first cryptographic key with the corresponding CANbus message identifier;
- encrypting, by the first ECU, the communication table using a communications table key;
- and
- storing, by the first ECU, the encrypted communication table locally on the first ECU.
Dependencies are inferred from the claim text.