Data prioritization, storage and protection in a vehicular communication system

• US 9,124,421 B2
• Filed: 12/04/2013
• Issued: 09/01/2015
• Est. Priority Date: 12/04/2013
• Status: Active Grant

• Current Assignee: Tahoe Research Limited (f/k/a Learndale Limited) (Vector Capital Corporation)
• Original Assignee: Intel Corporation
• Inventors: Zhao, Meiyuan, Maciocco, Christian, Talwar, Shilpa, Walker, Jessie
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US14/096,386
• Publication Number:
  US 20150156013A1
• Time in Patent Office: 636 Days
• Field of Search: 380/270
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 4/48 for in-vehicle communication

Abstract

This disclosure is directed to data prioritization, storage and protection in a vehicular communication system. A black box (BB) in a vehicle may receive data from an on-board unit (OBU) and a vehicular control architecture (VCA). The OBU may interact with at least one RSU that is part of an intelligent transportation system (ITS) via at least two channels, at least one of the at least two channels being reserved for high priority messages. The OBU may transmit ITS data to the BB via a secure communication channel, which may be stored along with vehicular data received from the VCA in encrypted form. In response to a request for data, the BB may authenticate a requesting party, determine at least part of the stored data to which the authenticated party is allowed and sign the at least part of the stored data before providing it to the authenticated party.

Claims

1. A device for use in a vehicular communication system, comprising:

a communication module to at least receive vehicular data from a vehicular control architecture (VCA) in a vehicle in which the device is situated, and to receive intelligent transportation system (ITS) data from an on-board unit (OBU) also situated in the vehicle;

a key storage module to store at least one key for at least one of data encryption, data decryption or data signing;

a crypto module to utilize the at least one key for at least one of data encryption, data decryption or data signing; and

a secure storage module to store encrypted vehicular data received from the VCA and encrypted ITS data received from the OBU via the communication module, the vehicular and ITS data being encrypted by the crypto module utilizing the at least one key stored in the key storage module;

wherein the OBU;

is to interact with at least one of a road side unit (RSU) in the ITS or another vehicle, the interaction including at least one of receiving messages from, or transmitting messages to, the at least one of the RSU or other vehicle; and

is to interact with the at least one of the RSU or other vehicle on at least two channels, at least one of the at least two channels being reserved for high priority messages.

2. The device of claim 1, wherein the ITS data comprises at least any messages received from the at least one of the RSU or other vehicle and any transmitted messages transmitted to the at least one of the RSU or other vehicle.

3. The device of claim 1, wherein the OBU is to process messages received or transmitted via the high priority message channel before other messages pending for processing in the OBU.

4. The device of claim 1, wherein at least the key storage module, crypto module and secure storage module are protected within a trusted execution environment (TEE) in the device.

5. The device of claim 1, wherein at least the encrypted ITS data is received via a secure communication channel established between the communication module and the OBU.

6. The device of claim 1, wherein at least the secure storage module is to receive a request for the encrypted vehicular and ITS data from a requesting party via the communication module.

7. The device of claim 6, wherein at least the crypto module is to authenticate the requesting party based at least on one root of trust in the key storage module.

8. The device of claim 7, wherein at least the secure storage module is to determine at least part of the encrypted vehicular and ITS data that the requesting party is allowed to receive based at least on at least one policy associated with the authenticated requesting party.

9. The device of claim 8, wherein at least the crypto module is to decrypt the at least part of the encrypted vehicular and ITS data using the at least one key, to sign the at least part of the decrypted vehicular and ITS data using the at least one key and to provide the signed part of the vehicular and ITS data to the requesting party.

10. A method for protecting data in a vehicular communication system, comprising:

receiving vehicular data in a device from a vehicular control architecture (VCA) in a vehicle in which the device is situated;

receiving intelligent transportation system (ITS) data from an on-board unit (OBU) also situated in the vehicle;

storing at least one key for at least one of data encryption, data decryption or data signing;

encrypting the vehicular data received from the VCA and the ITS data received from the OBU utilizing the at least one key;

storing the encrypted vehicular and ITS data; and

interacting with at least one of a road side unit (RSU) in the ITS or another vehicle, the interaction including at least one of receiving messages from, or transmitting messages to, the at least one of the RSU or other vehicle;

wherein the OBU interacts with the at least one of the RSU or other vehicle on at least two channels, at least one of the at least two channels being reserved for high priority messages.

11. The method of claim 10, wherein the ITS data comprises at least any messages received from the at least one of the RSU or other vehicle and any transmitted messages transmitted to the at least one of the RSU or other vehicle.

12. The method of claim 10, further comprising:

processing messages received or transmitted via the high priority message channel before other messages pending for processing in the OBU.

13. The method of claim 10, wherein at least the encrypted ITS data is received via a secure communication channel established between the device and the OBU.

14. The method of claim 10, further comprising:

receiving a request for the encrypted vehicular and ITS data from a requesting party;

authenticating the requesting party based at least on one root of trust;

determining at least part of the encrypted vehicular and ITS data to which the requesting party is allowed based at least on at least one policy associated with the authenticated requesting party;

decrypting the at least part of the encrypted vehicular and ITS data using the at least one key;

signing the at least part of the decrypted vehicular data and decrypted ITS data using the at least one key; and

providing the signed part of the vehicular and ITS data to the requesting party.

15. At least one non-transitory machine readable storage medium having stored thereon, individually or in combination, instructions that when executed by one or more processors result in the following operations for protecting data in a vehicular communication system comprising:

receiving vehicular data in a device from a vehicular control architecture (VCA) in a vehicle in which the device is situated;

receiving intelligent transportation system (ITS) data from an on-board unit (OBU) also situated in the vehicle;

storing at least one key for at least one of data encryption, data decryption or data signing;

encrypting at least one of the vehicular data received from the VCA or the ITS data received from the OBU utilizing the at least one key;

storing the encrypted vehicular data and encrypted ITS data; and

interacting with at least one of a road side unit (RSU) in the ITS or another vehicle, the interaction including at least one of receiving messages from, or transmitting messages to, the at least one of the RSU or other vehicle;

wherein the OBU interacts with the at least one of the RSU or other vehicle on at least two channels, at least one of the at least two channels being reserved for priority messages.

16. The medium of claim 15, wherein the ITS data comprises at least any messages received from the at least one of the RSU or other vehicle and any transmitted messages transmitted to the at least one of the RSU or other vehicle.

17. The medium of claim 15, further comprising instructions that when executed by one or more processors result in the following operations comprising:

processing messages received or transmitted via the priority message channel before other messages awaiting processing in the OBU.

18. The medium of claim 15, wherein at least the encrypted ITS data is received via a secure communication channel established between the device and the OBU.

19. The medium of claim 15, further comprising instructions that when executed by one or more processors result in the following operations comprising:

receiving a request for the encrypted vehicular and ITS data from a requesting party;

authenticating the requesting party based at least on one root of trust;

determining at least part of the encrypted vehicular and ITS data to which the requesting party is allowed based at least on at least one policy associated with the authenticated requesting party;

decrypting the at least part of the encrypted vehicular and ITS data using the at least one key;

signing the at least part of the decrypted vehicular data and decrypted ITS data using the at least one key; and

providing the signed part of the vehicular and ITS data to the requesting party.