# US 12,114,155 B2 · Method and apparatus for non-linear authentication of vehicle communications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,114,155 B2 - Document ID: US12114155B2 - Status: Granted - Kind: B2 - Application number: 17/750,510 - Filed: 2022-05-23 - Published: 2023-12-21 - Granted: 2024-10-08 - Earliest claimed: 2022-05-23 - Assignees: GM Global Technology Operations LLC - Applicants: GM Global Technology Operations LLC - Inventors: Suresh Munagapati - Web page: https://patentgrep.com/patent/US12114155B2 ## CPC - H04W 12/06: Authentication - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} - H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04W 4/40: for vehicles, e.g. vehicle-to-pedestrians [V2P] - H04W 12/041: Key generation or derivation - H04L 2209/84: Vehicles - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system for authenticating communications from a vehicle to a remote assistance unit includes a connectivity module (CM) installed in the vehicle. A security device is adapted to transmit messages when the security device is within a predefined proximity of the CM. A security cloud unit is configured to validate the security device based in part on a first pair of complementary keys, including a first factory key stored by the security device and a second factory key stored by the security cloud unit. The first pair of complementary keys is configured for asymmetric encryption such that the first factory key is solely decryptable with the second factory key. The remote assistance unit is configured to authenticate an integrity of the CM based in part on a second pair of complementary keys which are dynamically generated by the security cloud unit. ## Claims ### Claim 1 A system for authenticating communications from a vehicle to a remote assistance unit, the system comprising: a connectivity module (CM) installed in the vehicle; a security device adapted to transmit messages when the security device is within a predefined proximity of the CM; a security cloud unit configured to validate the security device based in part on a first pair of complementary keys, including a first factory key stored by the security device and a second factory key stored by the security cloud unit; wherein the first pair of complementary keys is configured for asymmetric encryption such that the first factory key is solely decryptable with the second factory key; wherein the remote assistance unit is configured to authenticate an integrity of the CM based in part on a second pair of complementary keys dynamically generated by the security cloud unit, the second pair of complementary keys being dynamically generated by the security cloud unit with a predefined expiration time; and wherein the second pair of complementary keys is not stored, thereby eliminating a fixed repository of credentials. ### Claim 2 (depends on 1) The system of claim 1, wherein the security device is a handheld FOB and the remote assistance unit is a vehicle services cloud unit. ### Claim 3 (depends on 1) The system of claim 1, wherein: the second pair of complementary keys includes a first transaction key and a second transaction key; and the CM is adapted to submit a data request to the remote assistance unit for authentication using a plural origin of credential submission mechanism whereby the first transaction key is submitted by the CM to the remote assistance unit and the second transaction key is submitted by the security cloud unit to the remote assistance unit, both being correlated by the remote assistance unit to authenticate the data request by the CM. ### Claim 4 (depends on 1) The system of claim 1, wherein validating the security device includes configuring the security device to send an activation request for the CM, including submitting an encrypted message over a first network to the security cloud unit using the first factory key, the security cloud unit being adapted to decrypt the encrypted message from the security device using the second factory key. ### Claim 5 (depends on 4) The system of claim 4, wherein: the second pair of complementary keys includes a first transaction key and a second transaction key, the security cloud being adapted to transmit the first transaction key to the security device; the security device is configured to transmit the first transaction key to the CM by proximity detection, the CM being adapted to contact the remote assistance unit using the first transaction key; the security cloud unit is configured to transmit the second transaction key to the remote assistance unit through a second network; and the remote assistance unit is adapted to authenticate the integrity of the CM based on the second transaction key transmitted by the security cloud unit. ### Claim 6 (depends on 5) The system of claim 5, wherein the CM is adapted to submit a data request to the remote assistance unit over a third network, the data request being accepted when the integrity of the CM is successfully authenticated. ### Claim 7 (depends on 6) The system of claim 6, wherein the first network, the second network and the third network are out-of-band respectively with one another, the first network, the second network and the third network each including multiple respective modes. ### Claim 8 (depends on 6) The system of claim 6, wherein the data request to the remote assistance unit from the CM incorporates password salting recognizable by a user of the vehicle. ### Claim 9 (depends on 8) The system of claim 8, wherein the password salting is dynamically generated based in part on a mission of the vehicle and payload data. ### Claim 10 A method of authenticating communications from a vehicle to a remote assistance unit, the method comprising: installing a connectivity module (CM) in the vehicle; configuring a security device to transmit messages when the security device is within a predefined proximity of the CM; generating a first pair of complementary keys, including a first factory key stored by the security device and a second factory key stored by a security cloud unit, the first pair being configured for asymmetric encryption such that the first factory key is solely decryptable with the second factory key; validating the security device via the security cloud unit, based in part on the first pair of complementary keys; authenticating an integrity of the CM via the remote assistance unit based in part on a second pair of complementary keys dynamically generated by the security cloud unit; submitting a data request by the CM to the remote assistance unit, the second pair of complementary keys including a first transaction key and a second transaction key; and authenticating the data request using a plural origin of credential submission mechanism whereby the first transaction key is submitted by the CM to the remote assistance unit and the second transaction key is submitted by the security cloud unit to the remote assistance unit, both being correlated by the remote assistance unit to authenticate the data request by the CM. ### Claim 11 (depends on 10) The method of claim 10, further comprising: generating the second pair of complementary keys via the security cloud unit with a predefined expiration time, the second pair of complementary keys; and eliminating a fixed repository of credentials by not storing the second pair of complementary keys. ### Claim 12 (depends on 11) The method of claim 11, wherein validating the security device includes: adapting the security device to send an activation request for the CM, including submitting an encrypted message over a first network using the first factory key; and configuring the security cloud unit to receive the activation request and decrypt the encrypted message from the security device using the second factory key possessed by the security cloud unit. ### Claim 13 (depends on 12) The method of claim 12, wherein authenticating the integrity of the CM includes: configuring the security cloud unit to transmit a first transaction key to the security device, the second pair of complementary keys including the first transaction key and a second transaction key; transmitting the first transaction key from the security device to the CM by proximity detection, the CM being adapted to contact the remote assistance unit using the first transaction key; transmitting the second transaction key from the security cloud unit to the remote assistance unit through a second network; and authenticating the integrity of the CM, via the remote assistance unit, based on the second transaction key transmitted by the security cloud unit. ### Claim 14 (depends on 13) The method of claim 13, further comprising: submitting a data request from the CM to the remote assistance unit on a third network; and configuring the remote assistance unit to accept the data request when the integrity of the CM is successfully authenticated. ### Claim 15 (depends on 14) The method of claim 14, further comprising: selecting the first network, the second network and the third network to be out-of-band respectively with one another, the first network, the second network and the third network each including multiple respective modes. ### Claim 16 (depends on 14) The method of claim 14, further comprising: incorporating password salting in the data request from the CM to the remote assistance unit, the password salting being recognizable by a user of the vehicle. ### Claim 17 (depends on 16) The method of claim 16, further comprising: generating dynamically the password salting based in part on a mission of the vehicle and payload data. ### Claim 18 A system for authenticating communications from a vehicle to a remote assistance unit, the system comprising: a connectivity module (CM) installed in the vehicle; a security device adapted to transmit messages when the security device is within a predefined proximity of the CM; a security cloud unit configured to validate the security device based in part on a first pair of complementary keys, including a first factory key stored by the security device and a second factory key stored by the security cloud unit; wherein the first pair of complementary keys is configured for asymmetric encryption such that the first factory key is solely decryptable with the second factory key; wherein the remote assistance unit is configured to authenticate an integrity of the CM based in part on a second pair of complementary keys, the second pair being dynamically generated by the security cloud unit with a predefined expiration time; wherein the CM is adapted to submit a data request to the remote assistance unit, the data request being accepted when the integrity of the CM is successfully authenticated; and wherein the data request to the remote assistance unit from the CM incorporates password salting recognizable by a user of the vehicle.