Method and decision gateway for authorizing a function of an embedded control unit

Patent metadata

Field	Value
Publication number	US-10091183-B2
Application number	US-201615146724-A
Country	US
Kind code	B2
Filing date	May 4, 2016
Priority date	May 19, 2015
Publication date	Oct 2, 2018
Grant date	Oct 2, 2018

Abstract

A method for authorizing a function of an embedded electronic control unit, including: a decision gateway requests from a hardware security module a function request destined for the electronic control unit, the decision gateway receives from the hardware security module the function request which is signed by the hardware security module, the decision gateway creates a communication channel, based on a cryptographic identity of the decision gateway, to a backend, the decision gateway sends the function request to the backend, the decision gateway receives from the backend via the communication channel a ticket which corresponds to the function request and is signed by the backend, and the decision gateway stores the ticket.

First claim

What is claimed is:

1. A method for authorizing a function of an embedded electronic control unit, comprising:
requesting, by a decision gateway from a hardware security module, a function request for the function of the embedded electronic control unit;
receiving, by the decision gateway from the hardware security module, the function request which is signed by the hardware security module using a secret key;
creating, by the decision gateway, a communication channel, based on a cryptographic identity of the decision gateway, to a backend;
sending, by the decision gateway, the signed function request to the backend;
receiving, by the decision gateway from the backend via the communication channel a ticket which corresponds to the signed function request and is signed by the backend using a signature key;
storing, by the decision gateway, the signed ticket; and
activating the function of the embedded electronic unit based on the signed ticket.

2. The method as recited in claim 1 , further comprising:
receiving, by the decision gateway, an authentication request from the embedded electronic control unit;
sending, by the decision gateway, the authentication request, in addition to the ticket and an identifier of the embedded electronic control unit, to the hardware security module;
receiving, by the decision gateway from the hardware security module, a response to the authentication request, based on a validation of the ticket; and
sending, by the decision gateway, the response to the embedded electronic control unit.

3. The method as recited in claim 2 , wherein after sending the response, the embedded electronic control unit checks the signature, and, based on the checking, the embedded electronic control unit utilizes the function.

4. The method as recited in claim 3 , wherein the decision gateway also sends to the embedded electronic control unit a cryptographic session key, and prior to utilizing the function, the embedded electronic control unit decrypts the function with the aid of the session key.

5. The method as recited in claim 1 , wherein the cryptographic identity includes a secret key which is known only to the hardware security module, a public key associated with the secret key, and a certificate of the public key which is issued by a trusted entity, and which is a function of a system environment of the decision gateway.

6. The method as recited in claim 1 , further comprising:
receiving, by the decision gateway, software in addition to the signed ticket, from the backend;
storing, by the decision gateway, the software;
initiating, by the decision gateway, a validation of the signed ticket and of the software;
checking, by the decision gateway, a result of the validation; and
installing, by the decision gateway, the software on the embedded electronic control unit based on the result.

7. The method as recited in claim 1 , further comprising:
storing, by the decision gateway, a public key of the ticket, which is signed by the backend, wherein the validation of the ticket is carried out by the decision gateway with the aid of the public key.

8. The method as recited in claim 1 , wherein the initiation of the validation includes an at least partial transfer of the ticket to the hardware security module, and the decision gateway receives the result of the validation from the hardware security module.

9. The method as recited in claim 1 , wherein the ticket is received via an over-the-air interface.

10. The method as recited in claim 1 , further comprising:
using the activated function.

11. A non-transitory machine-readable memory medium storing a computer program for authorizing a function of an embedded electronic control unit, the computer program, when executed by a processor, causing the processor to perform:
requesting from a hardware security module a function request for the function of the embedded electronic control unit;
receiving from the hardware security module, the function request which is signed by the hardware security module using a secret key;
creating a communication channel, based on a cryptographic identity of the decision gateway, to a backend;
sending the signed function request to the backend;
receiving from the backend via the communication channel a ticket which corresponds to the signed function request and is signed by the backend using a signature key;
storing the signed ticket; and
activating the function of the embedded electronic unit based on the signed ticket.

12. The non-transitory machine readable medium as recited in claim 11 , further comprising:
receiving, by the decision gateway, software in addition to the signed ticket, from the backend, the software being for implementing the function;
storing, by the decision gateway, the software;
initiating, by the decision gateway, a validation of the signed ticket and of the software;
checking, by the decision gateway, a result of the validation; and
installing, by the decision gateway, the software on the embedded electronic control unit based on the result.

13. The non-transitory machine readable memory medium as recited in claim 11 , wherein the computer program further causing the processor to perform:
using the activated function.

14. A system comprising a decision gateway, an embedded electronic control unit, and a hardware security module, the decision gateway for authorizing a function of the embedded electronic control unit, the decision gateway configured to, when executed by a processor:
request from the hardware security module a function request for the function of the embedded electronic control unit;
receive from the hardware security module, the function request which is signed by the hardware security module using a secret key;
create a communication channel, based on a cryptographic identity of the decision gateway, to a backend;
send the signed function request to the backend;
receive from the backend via the communication channel a ticket which corresponds to the signed function request and is signed by the backend using a signature key;
storing the signed ticket; and
activating the function of the embedded electronic unit based on the signed ticket.

Assignees

• Bosch Gmbh Robert

Inventors

• Stumpf Frederic
• Holle Jan

Classifications

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• G07C5/008

  communicating information to a remotely located station (transmission systems for measured values G08C) · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title