Infineon Technologies Ag

Hensoldt Sensors Gmbh

Alexander Zeh

Viola Rieger

Laurent Heidt

Avni Bildhaiya

Marcus Janke

Harald Zweck

Stefan Koeck

Anjana Ramamoorthy

Donjete Elshani Rama

Frank Hellwig

Veit Kleeberger

Karel Heurtefeux

Patrick Kresmer

Berndt Gammel

Albrecht Mayer

Wieland Fischer

Eric Pihet

Klaus Scheibert

Bernhard Rohfleisch

Muhammad Hassan

Reinhard Deml

Rolf Baltes

Andreas Salomon

Martin Brunner

Vivin Richards Allimuthu Elavarasu

Andreas Graefe

Jörg Syassen

Kenneth William Tindell

A controller may receive a set of messages provided by one or more network nodes included in an in-vehicle communication network. The controller may determine a security pattern associated with generating a tunnel frame including the set of messages. The controller may identify one or more messages from the set of messages based on the security pattern. The controller may compute a tunnel frame message authentication code (TMAC) based on one or more characteristics of the one or more messages. The controller may generate the tunnel frame, the tunnel frame including the TMAC and the set of messages.

Secure tunnelling of a frame in an in-vehicle communication network

The described techniques address issues associated with current secure in-vehicle communication systems, which are required to generate subkeys per each encoded data transmission/reception. These encoded data transmissions/receptions may be in accordance with several different in-vehicle communication protocols, and the requirement of such protocols to generate the subkeys 'on-the-fly' may lead to significant processing overhead and latency. The embodiments provided herein address the issue of subkey generation by using a predetermined function to pre-calculate and store the subkeys that are to be used for future encoded data message transmissions/receptions. In this way, the time and overhead required to generate the subkeys may be better and more efficiently managed.

Secure communications using pre-generated subkeys

The described techniques address issues to achieve key agreement without the need to exchange separate key agreement messages and, consequently, meets the stringent starting time requirements for real-time control systems. This is achieved using a group-wide key counter, with each node storing the latest value of this counter that was observed via the last received secured message. This counter value increases monotonically, and nodes maintain synchronization by transmitting this counter value (or a representation of the counter value) in each secured message. The use of key counters may be extended to guard against weak replay attacks via the implementation of a live membership tracking solution, which defines one or more membership groups. Each node within a membership group may request, or 'challenge' other nodes with the same membership group at any time to verify their online status, and this online status may be maintained over time.

Secure communications using pre-shared keys and live membership

A device may compute redundancy information based on plaintext. The device may determine modified additional data based on the redundancy information and the additional data. The device may encrypt the plaintext to obtain ciphertext. The device may compute a message authentication code based on the ciphertext and the modified additional data. The device may transmit a message including the ciphertext, the additional data, and the message authentication code.

Safe and secure communication

A network node may receive a control plane message. The control plane message may include an indication that the control plane message is a control plane message, an indication that the control plane message is associated with security, an indication of a security key to be associated with a secure zone (SZ) of an in-vehicle communication network, and an indication of a freshness value. The network node may perform a cryptographic operation for a data plane message associated with the SZ using the security key.

Key indication protocol

A transmitter device of a bus-based communication system may add one or more padding bits, associated with providing traffic flow confidentiality for communication of a payload on a communication bus, either to the payload on a transport layer, or to one or more first frames on a data link layer. The one or more first frames may include a transport layer payload associated with the payload. The transmitter device may transmit one or more second frames, including a data link layer payload associated with the one or more first frames, on the communication bus. A receiver device of the bus-based communication system may receive the one or more second frames on the communication bus. The receiver device may process the one or more padding bits from either the one or more first frames on the data link layer, or from the payload on the transport layer.

Controller area network traffic flow confidentiality

A chip device with a logic circuitry () protected by a randomized logic encryption based on a key (K) for preventing a designated usage of the logic circuitry () by an unauthorized user comprises: a physically unclonable function, PUF, (), a storage (), and a chip enabler () with one or more registers (). The physically unclonable function, PUF, () is configured to generate a device-individual response (Re) based on a challenge (Ch). The storage () has stored the challenge (Ch) and a data element (C), the data element (C) being an encryption of the key (K) with the response (Re) of the PUF () as encryption key. The enabler () is configured to enable the logic circuitry () for the designated usage only, when the key (K) is transferred to the register(s) (), the key (K) being a decryption of the data element (C) with the response (Re) as the encryption key.

Chip device and method for a randomized logic encryption

A security hardware device is configured to secure a control apparatus. The security hardware device includes a data security domain; a functional safety domain; a data security processor provided in the data security domain and is configured to secure data from unauthorized access or manipulation; a functional safety processor provided in the functional safety domain and is configured to detect functional errors and generate respective safety alerts in response to detecting the functional errors; and a monitoring processor configured to analyze the respective safety alerts provided by the functional safety processor for at least one pattern of safety alerts indicative of a security attack and generate a response signal in response to the respective safety alerts having at least one of the at least one pattern of safety alerts.

Security device with extended reliability

The present disclosure relates to a server, a relay, and an in-vehicle end node that enable an efficient deployment of software updates for in-vehicle network end nodes.

Efficient and secured access to in-vehicle end nodes across a vehicle fleet

A controller may receive a message provided by a network node included in an in-vehicle communication network. The controller may identify one or more characteristics of the message, the one or more characteristics indicating at least one of a message type of the message, a security property of the message, or a secure zone (SZ) associated with the message. The controller may determine a priority of the message based at least in part on the one or more characteristics. The controller may provide the message to an output buffer based at least in part on the priority of the message, the output buffer being one of a plurality of output buffers.

Security aware routing in an in-vehicle communication network

An electronic anomaly detection unit for use in a vehicle includes an input component for capturing an input variable, wherein the input variable contains state information for at least one component of the vehicle, a memory component for storing state values based on the input variable, a selection component for selecting selected state values from the stored state values, an association component for associating the selected state values with predefined values, wherein the predefined values define a normal state of the component of the vehicle, and a decision component for deciding whether there is an anomalous behavior in the at least one component of the vehicle, based on the association, wherein one or more of the input component, the memory component, the selection component, the association component and the decision component are implemented in hardware.

Electronic anomaly detection unit for use in a vehicle, and method for detecting an anomaly in a component of a vehicle

A redundancy system includes a first computational device and a second computational device each configured to receive at least one input and to generate a first output and a second output, respectively, based on the at least one input; a random sequence generator configured to generate a random bit sequence; a random delay selector configured to determine a random delay based on the random bit sequence; a first random delay circuit configured to delay outputting the at least one input to the first computational device based on the random delay; a second random delay circuit configured to delay outputting the second output based on the random delay; and a fault detection circuit configured to receive the first output and the delayed second output, and to generate a comparison result based on comparing the first input to the delayed second output.

Secure X-modular redundancy

A device is suggested for processing input data including a hardware accelerator generating a first hash value based on a first portion of the input data and a second hash value based on a second portion of the input data, wherein the first hash value is generated based on a first configuration of the hardware accelerator and wherein the second hash value is generated based on a second configuration of the hardware accelerator. Also, a method for operating such device is provided.

Generating hash values

The present disclosure relates to authenticity and data security for bus-based communication networks in a vehicle. The present disclosure teaches a protocol frame, a sender on data link layer, and a receiver on data link layer providing such authenticity and data security as well as a communication network in a vehicle employing the protocol frame, the sender and the receiver according to the present disclosure.

Data link layer authenticity and security for automotive communication system

A sender device includes: a first sequence generator configured to generate a first sequence of bits having a bit pattern that incudes first bit values and second bit values; a first parsing processor configured to receive a first plurality of data blocks and the first sequence of bits, and select a first subset of data blocks and a second subset of data blocks from the first plurality of data blocks based on the bit pattern; an encryption processor configured to encrypt the selected first subset of data blocks received from the first parsing processor to generate encrypted data blocks and output the encrypted data blocks to an output terminal that is configured to output the encrypted data blocks and the selected second subset of data blocks as unencrypted data blocks from the sender device.

Growing community of inventors

Munich, Germany

Alexander Zeh