In-vehicle device management system

An in-vehicle device management system comprising:

• data processing hardware;
• and
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
• provisioning, via a provisioning application, in-vehicle secret keys to a plurality of in-vehicle devices;
• receiving, at a host electronic control unit (ECU), at least one responder identifier (ID);
• providing, via the host ECU, a host public key and the at least one responder ID to each of the plurality of in-vehicle devices;
• generating, at each of the plurality of in-vehicle devices, a device message authentication code (MAC) over the at least one responder ID using a responder key derivation function (KDF) key;
• sending, via the host ECU, a request including a responder production secret key to a responder;
• receiving, in response to the request, a responder service secret key at the host ECU, the responder service secret key being encrypted with the responder production secret key;
• verifying, at the host ECU, a legitimacy of the responder;
• generating, at the host ECU, a random number corresponding to a new responder production secret key encrypted with the responder service secret key;
• sending the generated random number to the responder;
• receiving, at the host ECU, a confirmation from the responder;
• removing, in response to the confirmation, the responder KDF keys at each of the plurality of in-vehicle devices;
• requesting, via the host ECU, a challenge from a secure environment of the host ECU;
• generating a MAC over the challenge using an attestation key, the attestation key generated via a cryptographic algorithm using the responder service secret key;
• receiving, at the host ECU, responder software selectively including calibration data from a programming tool;
• providing, from the host ECU, a signed header to the secure environment of the host ECU verified using the host public key;
• and
• writing, via the host ECU, the responder software at the memory hardware of the host ECU.