Non-reputable vehicle change history

Patent metadata

Field	Value
Publication number	US-12041182-B2
Application number	US-202217717434-A
Country	US
Kind code	B2
Filing date	Apr 11, 2022
Priority date	Apr 11, 2022
Publication date	Jul 16, 2024
Grant date	Jul 16, 2024

Abstract

Tracking component configuration is provided. A central gateway is in communication with ECUs over one or more vehicle buses. The central gateway generates a first digest of first software updates installed to the ECUs, the first digest including a manifest of changes performed to the ECUs and a first hash of a subset of the first software updates. A signature is embedded into the first digest, the signature including a first digest hash of the first digest. The first digest is maintained to a non-transitory storage of the central gateway as a non-reputable record of the installation of the software updates.

First claim

What is claimed is:

1. A system for tracking component configuration, comprising:
electronic control units (ECUs); and
a central gateway, including a hardware processor and a non-transitory storage, wherein the central gateway in communication with the ECUs over one or more vehicle buses and is programmed to utilize the hardware processor to:
generate a first digest of first software updates installed to the ECUs, the first digest including a manifest of changes performed to the ECUs and a first hash of a subset of the first software updates,
embed a signature of the central gateway into the first digest, the signature including a first digest hash of the first digest, and
maintain the first digest to the non-transitory storage as a non-reputable record of installation of the software updates to the ECUs.

2. The system of claim 1 , wherein the central gateway is further programmed to:
generate a second digest of second software updates installed to the ECUs, the second digest including a second manifest of changes performed to the ECUs, a second hash of a subset of the second software updates, and the first digest hash;
embed a second signature of the central gateway into the second digest, the second signature including a second digest hash of the second digest; and
maintain the second digest to the non-transitory storage as a non-reputable record of installation of the first software updates and the second software updates to the ECUs.

3. The system of claim 1 , wherein the first software updates are received to the central gateway from a diagnostic tool, and the manifest is signed by a private key of the diagnostic tool.

4. The system of claim 3 , wherein the central gateway is further programmed to verify an identity of the diagnostic tool using a public key of the diagnostic tool, the public key corresponding to the private key used to sign the manifest.

5. The system of claim 1 , wherein the subset of the first software updates includes first packets and/or frames of each of the first software updates.

6. The system of claim 5 , wherein the central gateway is further programmed to identify the first packets and/or frames by monitoring for predefined service identifiers indicative of modification-related communications.

7. The system of claim 1 , wherein the first software updates include updated settings to be applied to one or more of the ECUs and/or updated software to be installed to the one or more of the ECUs.

8. A method for tracking component configuration, comprising:
generating, by a central gateway in communication with ECUs over one or more vehicle buses, a first digest of first software updates installed to the ECUs, the first digest including a manifest of changes performed to the ECUs and a first hash of a subset of the first software updates;
embedding, by the central gateway, a signature of the central gateway into the first digest, the signature including a first digest hash of the first digest; and
maintaining the first digest to a non-transitory storage of the central gateway as a non-reputable record of installation of the software updates to the ECUs.

9. The method of claim 8 , wherein the central gateway is further programmed to:
generating, by the central gateway, a second digest of second software updates installed to the ECUs, the second digest including a second manifest of changes performed to the ECUs, a second hash of a subset of the second software updates, and the first digest hash;
embedding, by the central gateway, a second signature of the central gateway into the second digest, the second signature including a second digest hash of the second digest; and
maintaining the second digest to the non-transitory storage of the central gateway as a non-reputable record of installation of the first software updates and the second software updates to the ECUs.

10. The method of claim 8 , further comprising receiving the first software updates to the central gateway from a diagnostic tool, the manifest being signed by a private key of the diagnostic tool.

11. The method of claim 10 , further comprising verifying an identity of the diagnostic tool using a public key of the diagnostic tool, the public key corresponding to the private key used to sign the manifest.

12. The method of claim 8 , wherein the subset of the first software updates includes first packets and/or frames of each of the first software updates.

13. The method of claim 12 , further comprising identifying the first packets and/or frames by monitoring for predefined service identifiers indicative of modification-related communications.

14. The method of claim 8 , wherein the first software updates include updated settings to be applied to one or more of the ECUs and/or updated software to be installed to the one or more of the ECUs.

15. A non-transitory computer-readable medium comprising instructions tracking component configuration that, when executed by one or more processors of a central gateway in communication with ECUs over one or more vehicle buses, cause the central gateway to perform operations including to:
generate a first digest of first software updates installed to the ECUs, the first digest including a manifest of changes performed to the ECUs and a first hash of a subset of the first software updates,
embed a signature of the central gateway into the first digest, the signature including a first digest hash of the first digest, and
maintain the first digest to a non-transitory storage of the central gateway as a non-reputable record of installation of the software updates to the ECUs.

16. The medium of claim 15 , further comprising instructions that, when executed by the one or more processors of the central gateway, cause the central gateway to perform operations including to:
generate a second digest of second software updates installed to the ECUs, the second digest including a second manifest of changes performed to the ECUs, a second hash of a subset of the second software updates, and the first digest hash;
embed a second signature of the central gateway into the second digest, the second signature including a second digest hash of the second digest; and
maintain the second digest to the non-transitory storage as a non-reputable record of installation of the first software updates and the second software updates to the ECUs.

17. The medium of claim 15 , wherein the first software updates are received to the central gateway from a diagnostic tool, and the manifest is signed by a private key of the diagnostic tool.

18. The medium of claim 17 , further comprising instructions that, when executed by the one or more processors of the central gateway, cause the central gateway to perform operations including to verify an identity of the diagnostic tool using a public key of the diagnostic tool, the public key corresponding to the private key used to sign the manifest.

19. The medium of claim 15 , wherein the subset of the first software updates includes first packets and/or frames of each of the first software updates, and further comprising instructions that, when executed by the one or more processors of the central gateway, cause the central gateway to perform operations including to identify the first packets and/or frames by monitoring for predefined service identifiers indicative of modification-related communications.

20. The medium of claim 15 , wherein the first software updates include updated settings to be applied to one or more of the ECUs and/or updated software to be install

Assignees

• Ford Global Tech Llc

Inventors

• Jayaraman Vijayababu
• Miller Jason Michael
• Caushi Aldi
• Clark Karl Nathan
• Cardillo John

Classifications

• H04L12/66 Primary

  Arrangements for connecting between networks having differing types of switching systems, e.g. gateways · CPC title

• G06F8/65

  Updates (security arrangements therefor G06F21/57) · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title