Approach for securing a vehicle access port

• US 10,728,249 B2
• Filed: 03/24/2017
• Issued: 07/28/2020
• Est. Priority Date: 04/26/2016
• Status: Active Grant

• Current Assignee: Garrett Transportation I Inc. (Garrett Motion, Inc.)
• Original Assignee: Garrett Transportation I Inc. (Garrett Motion, Inc.)
• Inventors: Markham, Thomas R.
• Primary Examiner(s): Doan, Trang T
• Application Number:
  US15/469,156
• Publication Number:
  US 20170310674A1
• Time in Patent Office: 1,222 Days
• Field of Search: 726 27
• CPC Class Codes: B60R 16/0231 Circuits relating to the driving or the functioning of the vehicle monitoring tyres B60C23/00; indicating overspeed B60K31/00; for dash boards B60K37/00, B60Q3/10; for indicating emergencies B60Q1/52; brake control systems B60T; registering or indicating the working of vehicles G07C5/00; measuring distance G01C, e.g. combinations of speed and distance G01C23/00; engine indicators G01L; measuring speed or acceleration G01P
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication

Abstract

The disclosure reveals a system having secured electronic access. The system may have one or more vehicle buses, one or more electronic control units on a vehicle connected to the one or more vehicle buses, a security module connected to the one or more vehicle buses, and a vehicle access port connected to the security module. An accessing entity may attempt connection to the vehicle access port. Messages injected or extracted by the accessing entity may be authorized or unauthorized at the security module based on a security policy.

Claims

1. A mechanism for controlling signals between a vehicle and an entity outside of the vehicle, comprising:

a vehicle having one or more electronic control units (ECUs);

a vehicle bus connected to the one or more ECUs;

a security module connected to the vehicle bus; and

a vehicle access port connected to the security module; and

wherein;

the security module passes, controls, restricts or blocks signals between the vehicle access port and the vehicle bus according to a vehicle manufacturer security policy;

the vehicle is a product of a vehicle manufacturer;

the vehicle manufacturer security policy applies to an accessing entity having a wireless or non-wireless connection with the vehicle access port;

the vehicle manufacturer creates a vehicle manufacturer public key and a vehicle manufacturer private key;

the vehicle manufacturer private key is protected in the security module;

an accessing entity provider creates an accessing entity provider public key and an accessing entity provider private key;

the accessing entity provider sends the accessing entity provider public key and an accessing entity provider identification data to the vehicle manufacturer using a certificate request protocol;

the vehicle manufacturer uses the vehicle manufacturer private key to sign an accessing entity provider certificate, wherein the accessing entity provider certificate includes the accessing entity provider identification data and the accessing entity provider public key;

the vehicle manufacturer creates a policy change authorization token having changes to the vehicle manufacturer security policy;

the vehicle manufacturer signs the policy change authorization token with the vehicle manufacturer private key;

the vehicle manufacturer sends the policy change authorization token to the accessing entity provider;

an accessing entity public key and an accessing entity private key are created by the accessing entity provider for the accessing entity;

the accessing entity provider uses the accessing entity provider private key to sign an accessing entity certificate containing the accessing entity identification data and the accessing entity public key; and

the accessing entity provider loads a copy of the accessing entity provider certificate, the accessing entity certificate, and the policy change authorization token into the accessing entity.

2. The mechanism of claim 1, wherein the accessing entity contains the accessing entity provider certificate signed by the vehicle manufacturer, the accessing entity certificate signed by the accessing entity provider, and the policy change authorization token specific to the accessing entity.

3. The mechanism of claim 1, wherein the vehicle manufacturer loads the vehicle manufacturer public key into the security module, during a manufacturing process of the vehicle.

4. The mechanism of claim 1, wherein the security module is made with a default security policy which is changeable by the policy change authorization token.