Multiple-stage secure vehicle software updating

Patent metadata

Field	Value
Publication number	US-9916151-B2
Application number	US-201514834868-A
Country	US
Kind code	B2
Filing date	Aug 25, 2015
Priority date	Aug 25, 2015
Publication date	Mar 13, 2018
Grant date	Mar 13, 2018

Abstract

A vehicle may receive a software update to be installed to a vehicle electronic control unit (ECU). The vehicle ECU may download a software update received from a server to a first storage; generate a nonce value associated with the software update; send to the server, a swap authorization request including the generated nonce value; receive a swap authorization including the nonce value and a command-and-control signature from the server; validate the signature and the nonce value from the swap authorization; and reboot using the first storage instead of a second storage when the recovered nonce value matches the generated nonce value.

First claim

What is claimed is:

1. A system comprising:
a first storage;
a second storage; and
a vehicle electronic control unit (ECU), including a hardware processor, programmed to download a software update received from a server to the first storage,
generate a nonce value associated with the software update, the nonce value including a unique-per-module serial number of the ECU and a time stamp concatenated to a hash value of the software update,
send, to the server, a swap authorization request to switch to the software update including the nonce value,
receive a swap authorization including the nonce value recovered from the server, and
reboot using the first storage instead of the second storage when the nonce value generated by the ECU matches the nonce value recovered from the server.

2. The system of claim 1 , wherein the vehicle ECU is further programmed to confirm the first storage as being active for booting instead of the second storage, responsive to the vehicle ECU successfully booting to the first storage.

3. The system of claim 1 , wherein the swap authorization includes a signature signed using a private key of the server, and the vehicle ECU is further programmed to verify the signature using a public key installed to the vehicle ECU.

4. The system of claim 1 , wherein the vehicle ECU is further programmed to:
receive a signature of the software update from the server; and
verify authenticity of the software update using the signature and a key installed to the vehicle ECU.

5. The system of claim 4 , wherein the key is one of a public key corresponding to a private key with which the software update is signed, or a symmetric key with which the software update is signed.

6. The system of claim 1 , wherein the vehicle ECU is further programmed to discard the software update when the nonce value recovered from the server fails to match the nonce value as generated.

7. The system of claim 1 , wherein the vehicle ECU is further programmed to apply the software update to the first storage while the vehicle ECU executes a software installation to the second storage of the vehicle ECU.

8. A system comprising:
a nonce value including a unique-per-module serial number of an electronic control unit (ECU) and a time stamp concatenated to a hash value of a software update; and
a server, including a hardware processor, programmed to
send the software update to a vehicle for installation to the ECU,
receive, from the vehicle, a swap request to switch to the software update including the nonce value, and
responsive to the swap request, send a swap authorization command to the vehicle, the swap authorization command including a second nonce value, thereby directing the vehicle to reboot using a first storage instead of a second storage when the nonce value generated by the ECU matches the second nonce value sent by the server.

9. The system of claim 8 , further comprising a data store programmed to maintain software updates, wherein the server is further programmed to retrieve the software update from the data store.

10. The system of claim 8 , wherein the server is further programmed to:
generate a signature using at least one of a private key matched to a public key stored by the vehicle or a symmetric key stored by the vehicle; and
include the signature with the swap authorization command.

11. The system of claim 8 , wherein the server is further programmed to:
retrieve a hash value corresponding to the software update from a database; and
determine whether the hash value of the software update is a match by comparing the hash value of the swap request to the hash value from the database.

12. A method comprising:
generating a nonce, for a software update downloaded to a storage of a controller, including a unique identifier of the controller and a time stamp concatenated to a hash value of the software update;
sending, to a server, a swap authorization request including the nonce;
receiving, from the server, a swap authorization including a second nonce; and
rebooting using the storage over a second storage when the nonce matches the second nonce.

13. The method of claim 12 , further comprising confirming the storage as being active for booting instead of a second storage, responsive to the controller successfully booting to the storage.

14. The method of claim 12 , wherein the software update includes a differential of updates to be applied to a software install of the controller, and further comprising applying the software update to the software install responsive to rebooting the controller when the nonce matches the second nonce.

15. The method of claim 12 , wherein the swap authorization includes a signature, and further comprising verifying the signature using a key installed to the controller.

16. The method of claim 12 , further comprising:
receiving a signature of the software update; and
verifying authenticity of the software update using the signature and a key installed to the controller.

17. The method of claim 12 , further comprising discarding the software update when the second nonce fails to match the nonce.

18. The method of claim 12 , further comprising applying the software update to a first storage operating as an inactive storage while the controller executes a software installation to a second storage acting as an active storage of the controller.

Assignees

• Ford Global Tech Llc

Inventors

• Ye Xin
• Caushi Aldi
• Bielawski Jr John R
• Westra Michael Raymond

Classifications

• H04L2463/121

  Timestamp · CPC title

• H04W12/08

  Access security · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04W12/10

  Integrity · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title