# US 11,897,500 B2 · Secure management of digital authentication information for autonomous vehicles

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,897,500 B2
- Document ID: US11897500B2
- Status: Granted
- Kind: B2
- Application number: 17/549,750
- Filed: 2021-12-13
- Published: 2023-06-15
- Granted: 2024-02-13
- Earliest claimed: 2021-12-13
- Assignees: GM Cruise Holdings LLC
- Applicants: GM Cruise Holdings LLC
- Inventors: Collin Richard Mulliner; Graziano Giuseppe Misuraca
- Web page: https://patentgrep.com/patent/US11897500B2

## CPC

- B60W 60/001: {Planning or execution of driving tasks}
- G06Q 10/08: Logistics, e.g. warehousing, loading or distribution; Inventory or stock management
- G06Q 30/018: Certifying business or products
- G06Q 50/40: Business processes related to the transportation industry (shipping G06Q10/083)
- G07C 5/008: {communicating information to a remotely located station (transmission systems for measured values G08C)}
- G07C 5/085: {using electronic data carriers}
- H04W 12/069: using certificates or pre-shared keys
- G06Q 2220/00: Business processing using cryptography
- B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems and methods are provided for managing private digital authentication information, known as secrets, for autonomous vehicles. In particular, systems and methods are provided for automating the acquisition of secrets by autonomous vehicles upon start-up, such that secrets are not stored on autonomous vehicles that are powered down. A secrets manager is installed on each autonomous vehicle that can request sets of secrets at start-up and provide the secrets to various modules in the vehicle. Secrets can be updated centrally and autonomous vehicles can easily access updated secrets.

## Claims

### Claim 1

A method for providing secrets to an autonomous vehicle, comprising:
determining a set of secrets to request at a secrets manager on the autonomous vehicle, wherein respective secrets of the set of secrets each include private digital authentication information for accessing a respective device in the autonomous vehicle, wherein each respective device has a data-configurable list of secrets to fetch;
transmitting a request from the secrets manager on the autonomous vehicle to a cloud-based central secrets authenticator for the set of secrets, wherein the cloud-based central secrets authenticator is configured to provide secrets to a fleet of vehicles including the autonomous vehicle;
identifying, at the cloud-based central secrets authenticator, the autonomous vehicle in a vehicle information database;
authenticating the autonomous vehicle at the cloud-based central secrets authenticator, based in part on the identification;
receiving, at the secrets manager on the autonomous vehicle, the set of secrets from the cloud-based central secrets authenticator;
saving, by the secrets manager, the set of secrets in an autonomous vehicle secrets memory;
providing access to respective secrets of the set of secrets to the respective devices in the autonomous vehicle, wherein the respective devices can access the respective secrets in the autonomous vehicle secrets memory; and
deleting the set of secrets from the autonomous vehicle secrets memory when the autonomous vehicle is powered down.

### Claim 2 (depends on 1)

The method of claim 1, further comprising transmitting an authentication credential from the secrets manager to the secrets authenticator, wherein the authentication credential includes a cryptographic certificate stored in persistent storage and a private key.

### Claim 3 (depends on 2)

The method of claim 2, wherein authenticating the autonomous vehicle further comprises authenticating based in part on the authentication credential.

### Claim 4 (depends on 1)

The method of claim 1, wherein determining the set of secrets to request further comprises accessing secrets configuration parameters on the autonomous vehicle.

### Claim 5 (depends on 1)

The method of claim 1, further comprising allowing autonomous vehicle clients to access selected secrets from the set of secrets.

### Claim 6 (depends on 5)

The method of claim 5, further comprising registering clients using the selected secrets.

### Claim 7 (depends on 1)

The method of claim 1, further comprising powering down the autonomous vehicle.

### Claim 8 (depends on 1)

The method of claim 1, wherein obtaining the set of secrets includes obtaining at least one of a certificate, a password, an encryption key, a decryption key, and an authentication key.

### Claim 9 (depends on 1)

The method of claim 1, further comprising injecting secrets in respective autonomous vehicle locations, including storing secrets in at least one volatile memory.

### Claim 10

A cloud-based computing system for injection of secrets to an autonomous vehicle, comprising:
a secrets vault configured to store a plurality of secrets for a fleet of vehicles including the autonomous vehicle, wherein respective secrets of the plurality of secrets each include private digital authentication information for accessing a respective client in the autonomous vehicle;
a vehicle information database configured to store information about vehicles in the fleet of vehicles including the autonomous vehicle; and
a cloud-based secrets authenticator configured to provide secrets to the fleet of vehicles including the autonomous vehicle, and further configured to:
receive a secrets request from the autonomous vehicle,
access a subset of the plurality of secrets from the secrets vault based on the secrets request and the information from the vehicle information database for the autonomous vehicle; and
a secrets manager in the autonomous vehicle configured to:
communicate with the cloud-based secrets authenticator to transmit the secrets request and obtain the subset of the plurality of secrets,
save the subset of the plurality of secrets in an onboard memory,
provide access to respective secrets of the subset of secrets to respective clients in the autonomous vehicle, wherein the respective clients can access the respective secrets in the onboard memory, and
delete the subset of the plurality secrets from the onboard memory when the autonomous vehicle is powered down.

### Claim 11 (depends on 10)

The system of claim 10, further comprising a secure memory on the autonomous vehicle configured to store an authentication credential, and wherein the secrets manager is further configured to transmit the authentication credential to the cloud-based secrets authenticator.

### Claim 12 (depends on 11)

The system of claim 11, wherein the cloud-based secrets authenticator is further configured to authenticate the secrets request.

### Claim 13 (depends on 10)

The system of claim 10, wherein the subset of the plurality of secrets includes at least one of a certificate, a password, an encryption key, a decryption key, and an authentication key.

### Claim 14 (depends on 10)

The system of claim 10, further comprising a secrets configuration file, wherein the secrets manager is configured to access the secrets configuration file and determine the subset of the plurality of secrets for the secrets request.

### Claim 15

A method for providing secrets to an autonomous vehicle, comprising:
at the autonomous vehicle:
determining a set of secrets to request at a secrets manager, wherein respective secrets of the set of secrets each include private digital authentication information for accessing a respective device in the autonomous vehicle, wherein each respective device has a data-configurable list of secrets to fetch;
transmitting a request for the set of secrets from the secrets manager to a central computing system secrets authenticator configured to provide secrets to a fleet of vehicles including the autonomous vehicle;
receiving, at the secrets manager on the autonomous vehicle, the set of secrets from the central computing system secrets authenticator;
saving, by the secrets manager, the set of secrets in an onboard memory;
providing access to respective secrets of the set of secrets to the respective devices in the autonomous vehicle, wherein the respective devices access the respective secrets in the onboard memory; and
at the central computing system secrets authenticator:
identifying the autonomous vehicle in a vehicle information database;
authenticating the autonomous vehicle, based in part on the identification;
identifying selected secrets from a secrets vault to fulfill the request; and
transmitting the selected secrets to the secrets manager.

### Claim 16 (depends on 15)

The method of claim 15, further comprising, at the autonomous vehicle, transmitting an authentication credential, and wherein, at the central computing system secrets authenticator, authenticating the autonomous vehicle is based in part on the authentication credential.

### Claim 17 (depends on 15)

The method of claim 15, further comprising, at the autonomous vehicle, receiving, at the secrets manager, the selected secrets from the central computing system secrets authenticator.

### Claim 18 (depends on 17)

The method of claim 17, further comprising, at the autonomous vehicle, saving the selected secrets to a memory.

### Claim 19 (depends on 18)

The method of claim 18, further comprising, at the autonomous vehicle, accessing at least one selected secret from the memory and registering a device.

### Claim 20 (depends on 15)

The method of claim 15, wherein transmitting the selected secrets includes transmitting at least one of a certificate, a password, an encryption key, a decryption key, and an authentication key.