Secure communication between in-vehicle electronic control units

A system comprising:

• one or more first processors of a first electronic control unit (ECU) of a plurality of ECUs in a vehicle;
• a first memory of the first ECU, the first memory storing:
• authentication data usable to authenticate messages exchanged between a second ECU of the plurality of ECUs and a third ECU of the plurality of ECUs, the authentication data usable to authenticate the messages exchanged between the second ECU and the third ECU;
• and
• first instructions that, when executed by the one or more first processors, cause the first ECU to perform first operations comprising:
• provisioning the third ECU with a set of security keys that enable the third ECU to securely exchange messages with the second ECU;
• and
• provisioning the second ECU with the authentication data, the authentication data including a message count attribute that defines a maximum message count for a security key among the set of security keys;
• one or more second processors of the second ECU;
• and
• a second memory of the second ECU, the second memory storing second instructions that, when executed by the one or more second processors, cause the second ECU to perform second operations comprising:
• receiving, from the third ECU, a secure message that is signed using the security key among the set of security keys provisioned to the third ECU;
• and
• authenticating the secure message by comparing the authentication data with an authentication signal maintained by the second ECU, the authentication signal including a message count that quantifies messages signed using the security key, the comparing of the authentication data with the authentication signal including:
• updating the message count that quantifies the messages signed using the security key in response to reception of the secure message from the third ECU;
• and
• comparing the message count to the maximum message count.

A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform operations comprising:

• configuring a first electronic control unit (ECU) of a plurality of ECUs that include a second ECU and a third ECU, in a vehicle, to perform first operations comprising:
• provisioning the third ECU with a set of security keys that enable the third ECU to securely exchange messages with the second ECU;
• and
• provisioning the second ECU with authentication data usable to authenticate the messages exchanged between the second ECU and the third ECU, the authentication data including a message count attribute that defines a maximum message count for a security key among the set of security keys provisioned to the third ECU;
• and
• configuring the second ECU to perform second operations comprising:
• receiving, from the third ECU, a secure message that is signed using the security key among the set of security keys provisioned to the third ECU;
• and
• authenticating the secure message by comparing the authentication data with an authentication signal maintained by the second ECU, the authentication signal including a message count that quantifies messages signed using the security key, the comparing of the authentication data with the authentication signal including:
• updating the message count that quantifies the messages signed using the security key in response to reception of the secure message from the third ECU;
• and
• comparing the message count to the maximum message count.