Automotive security configuration management

A non-transitory computer-readable medium, storing computer-executable instructions, in an automotive server on a data communication network that, wherein executed by a processor, performs a method for securely updating configuration files of a specific automobile type and a specific automobile, the method comprising:

• storing configuration files and updates to configuration files from automobile manufacturers, the configuration files including security-configuration profiles;
• storing certificates for each individual automobile generated from a unique vehicle identification number (VIN) portion of a specific automobile along with an Internet Protocol associated with the specific automobile;
• storing, for the specific automobile, a device-level configuration and a device group configuration, the device group configuration identifying at least one vehicle network-interface parameter for a device group to which the specific automobile is assigned;
• receiving, in real-time over the data communication network, a request to check for updated configuration files for the specific automobile and the specific automobile type, the request including a checksum or signature associated with a current configuration file stored by the specific automobile;
• selecting, by the automotive server, a security configuration profile for the device group to which the specific automobile is assigned;
• rendering, by the automotive server, a complete configuration file for the specific automobile from the selected security configuration profile, the device group configuration, and the device-level configuration by replacing a network interface reference of the selected security configuration profile with a vehicle-specific network-interface identifier for the specific automobile;
• comparing the checksum or signature associated with the current configuration file stored by the specific automobile against a checksum or signature of the complete configuration file to check for an update;
• if the update is available, generating a signature using the certificate from the unique VIN portion and the complete configuration file for encrypting the complete configuration file;
• and
• transmitting signature and stored configuration file to the specific automobile for local configuration update.

An automotive server on a data communication network, for securely updating configuration files of a specific automobile type and a specific automobile, the automotive server comprising:

• a processor;
• a network interface communicatively coupled to the processor and to a data communication network;
• and
• a memory, communicatively coupled to the processor and storing:
• a first module to store configuration files and updates to configuration files from automobile manufacturers, the configuration files including security-configuration profiles;
• a second module to store certificates for each individual automobile generated from a unique vehicle identification number (VIN) portion of a specific automobile along with an Internet Protocol associated with the specific automobile and to store, for the specific automobile, a device-level configuration and a device group configuration, the device group configuration identifying at least one vehicle network interface parameter for a device group to which the specific automobile is assigned;
• and
• a third module to receive, in real-time over the data communication network, a request to check for updated configuration files for the specific automobile and the specific automobile type, the request including a checksum or signature associated with a current configuration file stored by the specific automobile,
• a fourth module to select a security-configuration profile for the device group to which the specific automobile is assigned, the fourth module to render a complete configuration file for the specific automobile from the selected security-configuration profile, the device-group configuration, and the device-level configuration by replacing a network-interface reference of the selected security-configuration profile with a vehicle-specific network-interface identifier for the specific automobile, the fourth module to compare the checksum or signature associated with the current configuration file stored by the specific automobile against a checksum or signature of the complete configuration file to check for an update,
• if the update is available, the fourth module to generate a signature using the certificate from the unique VIN portion and the complete configuration file for encrypting the complete configuration file,
• the network interface transmitting signature and stored configuration file to the specific automobile for local configuration update.