Over-the-air updates security

Patent metadata

Field	Value
Publication number	US-11295017-B2
Application number	US-201715420373-A
Country	US
Kind code	B2
Filing date	Jan 31, 2017
Priority date	Jan 31, 2017
Publication date	Apr 5, 2022
Grant date	Apr 5, 2022

Abstract

A system for a vehicle includes a controller configured to receive encrypted software updates including a first signature, decrypt the received software updates using a decryption key received with update instructions indicative of available software updates, and install the decrypted updates in response to detecting that the first signature matches a second signature generated by the controller using a signature verification key.

First claim

What is claimed is:

1. A system for a vehicle comprising:
a vehicle controller having a hardware processor; and
a telematics controller programmed to:
responsive to receiving an update instruction indicative of an available software update for the vehicle controller and including a decryption key and a signature verification key, send the signature verification key to the vehicle controller, wherein the update instruction is secured using a vehicle-specific encoding string indexed using a first vehicle identifier, and the decryption key is indexed using a second vehicle identifier,
responsive to receiving the software update that is encrypted and signed, decrypt the software update using the decryption key and send the software update as decrypted to the vehicle controller, and

the vehicle controller is programmed to:
responsive to receiving the signature verification key and the software update as decrypted, verify a signature of the software update, and
responsive to a successful verification, install the software update to the vehicle controller.

2. The system of claim 1 , wherein the update instruction further include a vehicle identifier and the controller receives the encrypted signed software updates in response to detecting that the vehicle identifier matches stored identifier of the vehicle.

3. The system of claim 2 , wherein the controller is further configured to disregard the update instruction and forego receiving the encrypted signed software updates in response to detecting that the vehicle identifier differs from the stored identifier of the vehicle.

4. The system of claim 1 , wherein the controller is further configured to receive the signature verification key with the update instruction.

5. The system of claim 1 , wherein the controller is further configured to receive the software updates from an update server configured to sign the software updates prior to sending the updates to the controller using a signature key corresponding to the signature verification key.

6. The system of claim 5 , wherein the update server is further configured to encrypt the software updates using an encryption key prior to sending the updates to the controller.

7. The system of claim 1 , wherein the first vehicle identifier includes a vehicle identification number (VIN), and the second vehicle identifier includes at least one of a subscriber identity module (SIM) information or an international mobile station equipment identity (IMEI).

8. A method for a vehicle comprising:
receiving, via a telematics controller, from a server, an update instruction indicative of available software updates for a vehicle controller and including a decryption key and a signature verification key, wherein the update instruction is secured using a vehicle-specific encoding string indexed using a first vehicle identifier, and the decryption key is indexed using a second vehicle identifier;
sending the signature verification key to the vehicle controller;
responsive to receiving the software updates including a first signature, decrypting, via the telematics controller, the software updates using the decryption key; and
installing the decrypted updates in response to detecting that the first signature matches a second signature generated by the controller using a signature verification key received from the update server.

9. The method of claim 8 , wherein the update instruction further include a vehicle identifier and further comprising receiving the software updates in response to detecting that the vehicle identifier matches a vehicle identifier assigned to the vehicle.

10. The method of claim 9 further comprising disregarding the update instruction and foregoing the receiving of the encrypted signed software updates in response to detecting that the vehicle identifier differs from the identifier assigned to the vehicle.

11. The method of claim 8 , wherein the signature verification key is generated by the update server.

12. The method of claim 8 , wherein the encrypted signed software updates as received via a network connection with an update server configured to sign the software updates using a signature key prior to sending the updates.

13. The method of claim 12 , wherein the update server is further configured to encrypt the software updates using an encryption key prior to sending the updates.

14. The method of claim 8 , wherein the first vehicle identifier includes at least one of a subscriber identity module (SIM) information or an international mobile station equipment identity (IMEI); and the second vehicle identifier inclues a vehicle identification number (VIN).

Assignees

• Ford Global Tech Llc

Inventors

• Madrid Daniel Joseph
• Sangameswaran Sangeetha
• Miller Jason Michael
• Vangelov John Naum
• Caushi Aldi

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04W12/03

  Protecting confidentiality, e.g. by encryption · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• H04W12/06

  Authentication · CPC title

• H04W12/106

  Packet or message integrity · CPC title