Computer-implemented cryptographic method for improving a computer network, and terminal, system and computer-readable medium for the same

• US 9,756,024 B2
• Filed: 09/16/2016
• Issued: 09/05/2017
• Est. Priority Date: 09/18/2015
• Status: Expired due to Fees

• Current Assignee: Trillium Limited (London Wall Outsourcing Holdings Ltd.)
• Original Assignee: Trillium Limited (London Wall Outsourcing Holdings Ltd.)
• Inventors: Benedek, Aaron Sanjaya
• Primary Examiner(s): KIM, TAE K
• Application Number:
  US15/268,532
• Publication Number:
  US 20170085537A1
• Time in Patent Office: 354 Days
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A method at a terminal in a multiple-node digital communications network, comprising any one or more of: generating at least one symmetric first key(s), across all participating nodes in the multiple-node digital communications network and securely distributing the at least one first key(s) in encrypted form to multiple participating nodes of the multiple-node digital communications network, using at least one asymmetrically established second key(s), the participating nodes including at least one message-transmitting node(s) and at least one message-receiving node(s); generating at least one symmetric third key(s) for one or more communication session that includes one or more communications from the at least one message-transmitting node(s) to the message-receiving node(s); encrypting at least one payload message using the at least one third key(s) at the at least one message-transmitting node(s), sending the encrypted at least one payload message, and receiving the encrypted at least one payload message at the at least one message-receiving node(s); encrypting the at least one third key(s) using the at least one first key(s), sending the encrypted at least one third key(s), and receiving the encrypted at least one third key(s) at the at least one message-receiving node(s); decrypting the at least one third key(s) using the securely distributed at least one first key(s), at the at least one message-receiving node(s); and decrypting the at least one encrypted payload message using the decrypted at least one third key(s), at the at least one message-receiving node(s). A terminal, system, and computer readable medium are also disclosed.

Claims

1. A method of increasing operational efficiency of one or more computers or controllers at a terminal in a multiple-node digital communications network, comprising:

generating at least one symmetric first key(s), across all participating nodes in the multiple-node digital communications network;

securely distributing the at least one first key(s) in encrypted form to multiple participating nodes of the multiple-node digital communications network, using at least one asymmetrically established second key(s), the participating nodes including at least one message-transmitting node(s) and at least one message-receiving node(s);

generating at least one symmetric third key(s) for one or more communication session that includes one or more communications from the at least one message-transmitting node(s) to the message-receiving node(s);

encrypting at least one payload message using the at least one third key(s) at the at least one message-transmitting node(s), sending the encrypted at least one payload message, and receiving the encrypted at least one payload message at the at least one message-receiving node(s);

encrypting the at least one third key(s) using the at least one first key(s), sending the encrypted at least one third key(s), and receiving the encrypted at least one third key(s) at the at least one message-receiving node(s);

decrypting the at least one third key(s) using the securely distributed at least one first key(s), at the at least one message-receiving node(s);

decrypting the at least one encrypted payload message using the decrypted at least one third key(s), at the at least one message-receiving node(s);

wherein the network is a motor vehicle network entirely internal to one or more motor vehicles and comprises one or more of a secure application layer and a secure link layer, which secures the motor vehicle network.

2. A method according to claim 1, wherein the multiple node(s) have unique IDs securely pre-stored internally in the network before one or more of:

first activation;

re-activation; and

reboot,

of the network.

3. A method according to claim 1,

wherein the network stores a pre-determined list of unique IDs securely held in at least one memory internal to the network, and

wherein the list is established and stored securely by relying only on data that is pre-stored in the network before network activation.

4. A method according to claim 1, wherein the message of one or more of the at least one message-transmitting node(s) and the at least one message-receiving node(s), when executed, operably causes altering of a primary function of one or more mechanical or electronic vehicle component(s) that is operated based on instructions sent to one or more of the at least one message-transmitting node(s) and the at least one message-receiving node(s).

5. A method according to claim 1, wherein a protocol used to establish the at least one asymmetrically established second key(s) over the network uses properties inherent to the network:

to obtain one or more bits of shared secret information and use the one or more bits of shared secret information as at least a portion of the at least one asymmetrically established second key(s), and

to securely distribute the at least one symmetric first key(s).

6. A method according to claim 5, wherein the properties inherent to the network include one or more arbitration phase(s), during which one or more communicated logical value is preferred over some other communicated logical value(s), causing one or more of:

(1) the arbitration phase occurring irrespective of what node(s) either of the logical values has been communicated from;

(2) the arbitration phase creating an externally visible side channel of information comprising preferred logical value transmissions from one or more single nodes;

(3) the side channel results from and represents a collection of all transmitted logical values;

(4) the side channel provides an additional channel that is in addition to one or more node-to-node transmission channels; and

(5) the side channel is based on multiple logical value transmissions.

7. A method according to claim 6, wherein the arbitration phase is configured to be activated at one or more random point in time, regularly scheduled time or another time.

8. A method according to claim 6, wherein the arbitration phase is configured to be extended for any length of time during which secret information in one or more side channel may be recorded in one or more locations in the network and securely stored, thereby reducing the necessary computational load on the network during one or more times when a new version of the at least one second key(s) is required.

9. A method according to claim 1, further comprising at least one store having a maximum memory capacity, the store being associated with one or more of the node(s), the maximum capacity being smaller than what is required to hold the at least one second key(s).

10. A method according to claim 1, wherein at least one of the participating nodes is at least one domain controller(s), and each of the at least one domain controller(s) is configured to perform at least as many computations as any other node(s) connectively linked to the at least one domain controller, and is

configured to store the at least first key(s) securely so that the at least first key(s) may be securely distributed.

11. A method according to claim 1, wherein the multiple nodes are one or more of:

uniquely associated with one or more mechanical or electronic vehicle component(s) that is operated based on instructions sent to one or more of the at least one message-transmitting node(s) and the at least one message-receiving node(s);

located adjacent to one or more mechanical or electronic vehicle component(s) that is operated based on instructions sent to one or more of the at least one message-transmitting node(s) and the at least one message-receiving node(s);

comprising only specifically-and-uniquely-defined-by-vehicle-function nodes at spoke ends of a hub-and-spoke controller area network (CAN) or hub-and-spoke local interconnect network (LIN) architecture;

not comprising any one or more of a domain controller node, base station node, and master node; and

comprising any one or more of at least one domain controller node, base station node, and master node.

12. A method according to claim 1, wherein the at least one first symmetric key(s) is generated based on multiple group elements, at least one of the group elements from one or more of:

each of the message-transmitting nodes in the network;

each of the message-receiving nodes in the network; and

at least one domain controller node in the network.

13. A method according to claim 1, wherein the at least one second key(s) is a key derived from a shared secret used to securely relay information to a node that shares the secret.

14. A method according to claim 1, wherein the at least one second key(s) is discarded after sharing information to a node.

15. A method according to claim 1, wherein the multiple group elements are generated and sent to one or more node(s) when operation of the network starts, to enable data to be transmitted securely, thereby minimizing time-delay before network functionality can be accessed.

16. A method according to claim 1, wherein the at least one first key(s) are generated and sent in encrypted form after the network operation starts yet before validation of one or more node(s) has occurred, to enable data to be transmitted securely, thereby minimizing time-delay before network functionality can be accessed.

17. A method according to claim 1, wherein the at least one first key(s) are generated based on one or more of bit(s) of random or non-random data, obtained by one or more of:

sampling data stored in the network;

measuring sensor data from one or more sensor(s) associated with one or more nodes in the network;

combining two or more pieces of sensor data from one or more sensor(s), by using a mathematical function.

18. A method according to claim 1, wherein the at least one second key(s) are generated based on one or more of bit(s) of random or non-random data, obtained by one or more of:

sampling data stored in the network;

measuring sensor data from one or more sensor(s) associated with one of more nodes in the network; and

combining two or more pieces of sensor data from one or more sensor(s), by using a mathematical function.

19. A method according to claim 1, wherein instructional messages sent in high noise environments such as is found in motor vehicles can be received at the at least one message-receiving node(s) without certification due to non-destructive arbitration of message data.

20. A method according to claim 1, wherein the at least one second key(s) are each independently generated at two locations, both at a domain controller node, and at one or more of

one of the message-transmitting node(s), and

one of the message-receiving node(s).

21. A method according to claim 1, wherein the at least one second key(s) are generated based on information obtained from two-way, shared group element information:

(1) from each of all of the multiple nodes, to a domain controller node, and

(2) from the domain controller node to each of all of the multiple nodes.

22. A method according to claim 1, wherein the at least one second key(s) are generated based on information obtained from two-way, shared group element information.

23. A method according to claim 1, wherein the at least one first key is generated based on all of the at least one second key(s) from all of the participating nodes.

24. A method according to claim 1, wherein distribution of the at least one first key(s) is achieved by the at least first key(s) being one or more of:

encrypted at a domain controller, using at least one of the at least one second key(s), which is generated at a domain controller node from information from a first node and information from the domain controller node, and

unencrypted at the first node, using at least one separately-and-remotely-at-the-first-node-generated duplicate copy of the at least one of the at least one second key(s), the at least one of the at least one second key(s) being uniquely associated with only the first node and the domain controller node.

25. A method according to claim 1, further comprising;

generating the at least one symmetric third key(s) at the at least one message-transmitting node(s), the at least one symmetric session key(s) generation being one or more of;

repetitive at a cycle speed, and

simultaneous at the multiple or participating nodes, including at the at least one message-transmitting node(s) and at the one or more message-receiving node(s).

26. A method according to claim 1, wherein the at least one symmetric third key(s) are generated based on one or more of bit(s) of random or non-random data, obtained by one or more method comprising:

sampling data stored in the network;

measuring sensor data from one or more sensor(s) associated with one of more nodes in the network;

combining two or more pieces of the sensor data from one or more sensor(s), by using a mathematical function.

27. A method according to claim 1, wherein the at least one first key(s) is a master key, the at least one second key(s) are multiple transient keys, one for each non-domain-controller node that is either, one of the message-receiving node(s) or one of the message transmitting node(s), and

the at least one third key(s) comprises one or more session key(s).

28. A method according to claim 1, further comprising decrypting the at least one session keys at one or more message-receiving node(s) based on the master key at the message receiving node(s) and decrypting the ciphertext at one or more message-receiving node(s) based on one of the session key(s).

29. A method according to claim 1, wherein at least one of the message-transmitting node(s) and the message-receiving node(s) is authenticated by one or more of:

validating encrypted node IDs received at the domain controller by way of a comparison at the domain controller of ID messages to a known list of pairs of nodes and unique IDs associated to those nodes; and

performing a runtime authentication, by requiring the message-transmitting node(s) to provide data over a channel modulated by a message ID value that is calculated by combining the session key(s), the validated group ID(s) and another number, and requiring the message-receiving node(s) selectively to limit information which is processed to what is received over the channel modulated by the message ID.

30. A method according to claim 1, wherein each of the at least one message-transmitting node(s) and the one or more message-receiving node(s), comprise one or more of:

at least one constrained vehicle controller area network bus node allowing a data field length of up to 8 bytes;

at least one constrained vehicle local interconnect network bus node allowing a data field length of up to 8 bytes;

at least one controller area network bus domain controller; and

at least one local interconnect network bus domain controller.