Ford Global Technolgoies, LLC

Aldi Caushi

Jason Michael Miller

Lisa Therese Boran

Xin Ye

Kevin Thomas Hille

James Weinfurther

Daniel Aaron Zajac

Mike Raymond Westra

John Robert Van Wiemeersch

Vivekanandh Elangovan

Sangeetha Sangameswaran

John Naum Vangelov

Karl Nathan Clark

Michael Raymond Westra

Cameron Smyth

Jochen Schubert

Vijayababu Jayaraman

Daniel Joseph Madrid

Eric Ramsay Paton

John Russell Bielawski, Jr

John Cardillo

David Ray Erkkila

David Bardelski

Mohamad Yassine

Robert James Southern

John William Turner

Bobak Shahidehpour

Tracking component configuration is provided. A central gateway is in communication with ECUs over one or more vehicle buses. The central gateway generates a first digest of first software updates installed to the ECUs, the first digest including a manifest of changes performed to the ECUs and a first hash of a subset of the first software updates. A signature is embedded into the first digest, the signature including a first digest hash of the first digest. The first digest is maintained to a non-transitory storage of the central gateway as a non-reputable record of the installation of the software updates.

Non-reputable vehicle change history

A system includes a first computer including a processor programmed to receive, from a remote device, a first digital document including a digital signature from a server and specifying access to one or more vehicle systems for a user. The processor is further programmed to receive, from the server, a second digital document authorizing the specified access to the one or more vehicle systems; and provide, to the remote device, the specified access to the one or more vehicle systems based on the first digital document and second digital document.

Session unique access token for communications with a vehicle

A system for a vehicle includes a controller configured to receive encrypted software updates including a first signature, decrypt the received software updates using a decryption key received with update instructions indicative of available software updates, and install the decrypted updates in response to detecting that the first signature matches a second signature generated by the controller using a signature verification key.

Over-the-air updates security

A programming session may be initiated to a vehicle ECU by an update device. A software update for the ECU may be authenticated by the update device using an authentication key. When an authentication result indicates successful authentication, the ECU software update is sent by the update device over the in-vehicle network to the ECU. The ECU may then flash a memory with the ECU software update. The authentication key may be obtained from the ECU. The update device may be a vehicle telematics control unit or a service tool coupled to a connector of the vehicle.

Software authentication before software update

A Phone-as-a-Key (PaaK) system includes a pre-processor, a secure processor disposed in communication with the pre-processor, a cache memory associated with the pre-processor and the secure processor, and a memory for storing executable instructions. The pre-processor and the secured processor are configured to perform steps that can mitigate delay caused by mobile device authentication. For example, the pre-processor authenticates an authentication message associated with a mobile device used as a key for the vehicle, and stores the message in the cache memory. The pre-processor receives a door latch actuation signal, and initializes the secure processor in response. The pre-processor then provides access to the vehicle based on the secure processor initialization instruction, and the authentication message stored in the cache memory. After initialization, the secure processor sends a challenge value for second authorization of the mobile device, and triggers remedial actions if the device fails to respond correctly.

Phone as a key low latency vehicle access

Method and apparatus are disclosed for end-to-end vehicle secure ECU unlock in a semi-offline environment. An example vehicle electronic control unit includes a first processor and a second processor. The first processor, when unlocked, provides diagnostic information. The second processor sends a seed value to a diagnostic tool. Additionally, the second processor, in response to receiving a second key, unlocks the first processor. The second processor, after receiving a first verifier, decrypts the first verifier to generate a new key, replaces a current key with the new key, and sends a second verifier to the diagnostic tool.

End-to-end vehicle secure ECU unlock in a semi-offline environment

Various embodiment of the present disclosure provide a system and method for disabling a passive entry passive start system (PEPS) of a vehicle. In one embodiment, the system and method of the present disclosure enable a user of the vehicle to disable the standard PEPS operations so that the vehicle control module will not unlock the vehicle or automatically start the vehicle as it would under standard operation.

System and method for on-demand passive entry disable

A vehicle includes: (i) a main telematics module, (ii) a connectivity module including antenna(s) and processor(s). The connectivity module is configured to: (a) authenticate a mobile device via a vehicle-access-key (VAK); (b), if (a), issue an ephemeral-session-key (DSK) to the mobile device; (c), if (b), establish an active session with the mobile device; (d) encrypt all messages to the mobile device with the VAK during (a) and with the DSK during (c). The connectivity module is configured to automatically revoke the DSK upon expiration of a predetermined time interval.

Secure session communication between a mobile device and a base station

An access assessment tool is described for providing a technical solution for selectively controlling access to restricted information and/or implementation of restricted functionalities based on a current vehicle mode and/or validated credentials. The access assessment tool described herein controls the validation of a user or diagnostic tool requesting access to restricted information or implementation of a restricted function before allowing access to the restricted information or allowing implementation of the restricted function.

Customer driving mode for vehicles

A vehicle may receive a software update to be installed to a vehicle electronic control unit (ECU). The vehicle ECU may download a software update received from a server to a first storage; generate a nonce value associated with the software update; send to the server, a swap authorization request including the generated nonce value; receive a swap authorization including the nonce value and a command-and-control signature from the server; validate the signature and the nonce value from the swap authorization; and reboot using the first storage instead of a second storage when the recovered nonce value matches the generated nonce value.

Multiple-stage secure vehicle software updating

A vehicle includes a gateway controller configured to interface a diagnostic port to a vehicle communication network. In response to a perimeter alarm system being in an armed state, transfer of messages from the diagnostic port to the vehicle communication network is inhibited. A change session diagnostic request received from the diagnostic port is transferred to the vehicle communication network in response to vehicle speed being less than a threshold and an ignition switch begin in a run position. The transfer of the change session diagnostic request is otherwise inhibited unless intended for a module designated for reprogramming keys.

Growing community of inventors

Northville, MI, United States of America

Aldi Caushi