Ford Global Technolgoies, LLC

Xin Ye

Venkata Kishore Kajuluri

Bradley Warren Smith

Lisa Therese Boran

Jason Michael Miller

Aldi Caushi

Kevin Thomas Hille

James Martin Lawlis

Jacob David Nelson

Daniel Aaron Zajac

Sangeetha Sangameswaran

Kevin Smith

James Weinfurther

Karl Nathan Clark

Michael Raymond Westra

Vijayababu Jayaraman

Daniel Joseph Madrid

Mark Andre Zielinski

Majed Samhan Mohammed

Douglas A Oliver

John Russell Bielawski, Jr

Jiguo Song

Stephen Robert Traicoff

David Bardelski

Mohamad Yassine

Humberto Eduardo Franyie Quintana

A method is disclosed; the method may comprise: receiving, at each of a plurality of network computers, a security message from a gateway computer, wherein the security message identifies a current mode of the vehicle, wherein the current mode is indicative of a vehicle state; storing the current mode; receiving a data message; and based on the current mode, determining whether to accept the data message.

Accepting or rejecting a data message in a vehicle network

An onboard communication network of a vehicle is monitored to detect a plurality of available messages that include respective cipher-based message authentication codes (CMAC) and that were identified as eligible messages based on having an information entropy greater than a specified threshold. A first message is selected from the plurality of available messages. The CMAC of the selected message is input into a random number generator that outputs a random number seeded by the CMAC of the selected message. Then the random number is provided.

System and method for a vehicle network

A vehicle communication network is monitored to detect a plurality of electronic control units (ECUs). Upon identifying a new ECU in the plurality of ECUs, a highest ECU trip counter is determined from the plurality of ECUs. A global trip counter stored in the memory is updated based on the highest ECU trip counter. The updated trip global trip counter is greater than the highest ECU trip counter. Then a replacement synchronization message is provided to the plurality of ECUs on the vehicle communication network. The replacement synchronization message includes the updated global trip counter.

Vehicle electronic control unit authentication

A system for a vehicle includes a computer, a first electronic control module, and a wired vehicle communications network coupling the computer and the first electronic control module. The computer is programmed to transmit authentication keys to the first electronic control module and a plurality of second electronic control modules via the wired vehicle communications network, encrypt a table of the authentication keys using a first key, store the encrypted table, transmit the encrypted table to the first electronic control module via the wired vehicle communications network, and transmit the encrypted table and the first key to a remote server spaced from the wired vehicle communications network.

Transmission of authentication keys

A system includes a control module and a local server. The server is programmed to transmit a command to perform an operation to a plurality of vehicles including a vehicle including the control module. The command including a digital signature that is common across the vehicles. The control module is programmed to receive a temporary value; receive the command; decrypt the digital signature in the command with the temporary value; upon verifying the decrypted digital signature, perform the operation; and upon a metric incrementing to a threshold value, prevent decryption of the digital signature with the temporary value.

Securely transmitting commands to vehicle during assembly

Systems and methods described herein provide for assigning classifications to signals and corresponding messages for prioritization and transmission across a vehicle CAN bus. The assigned classifications are used to select authentication keys specific to each classification of message. Nodes of the CAN bus can include different sets of keys based on the classifications of messages handled at the nodes. Keys are distributed and localized to reduce any potential impact on critical functions of the vehicle system that may result from compromise of an authentication key.

Assigning categories for messages and symmetric key per category to localize the impact in case of key compromise

Techniques for using a trip flag to detect desynchronization of trip counter values in a vehicle system. Techniques include a first electronic control unit (ECU) receiving a synchronization message including a trip counter and receiving a message from a second ECU including a trip flag. The trip flag includes a single bit of data generated by the second ECU. The first ECU compares the trip flag to a last bit of the trip counter stored at the first electronic control unit and processes the message in response to the trip flag matching the trip counter. The first ECU compares the trip counter to a previous trip counter based on the trip flag differing from the trip counter. The first ECU processes the message using the previous trip counter or increments the trip counter to process the message based on the comparison with the previous trip counter.

Detecting and resolving desynchronization of trip counter values in authenticated messages

A computer includes a processor and a memory storing instructions executable by the processor to, upon receiving an authorization message, transmit a plurality of new authentication keys to a respective plurality of control modules, the memory including an expiration time for the authorization message; update a listing of the control modules with respective statuses of the transmissions of the respective new authentication keys to the respective control modules, wherein each status is one of successful or unsuccessful; upon at least one status being unsuccessful, prevent the authorization message from expiring at the expiration time; after preventing the authorization message from expiring, retransmit the respective new authentication keys to each control module for which the respective status is unsuccessful; and then expire the authorization message.

Authorization of a user device is suspended based on determining, for a first predetermined time, a distance between the user device and a vehicle is greater than a threshold distance. Then a user input specifying a vehicle parameter is requested. Upon receiving the user input, the user input is validated based on the user input matching a stored vehicle parameter. The user device is deauthorized based on a) failing to receive a valid user input within a second predetermined time, or b) receiving a number of invalid user inputs equal to a threshold number.

Vehicle deauthortization of user device

Systems and methods described herein provide for assigning classifications to signals and corresponding messages for prioritization and transmission across a vehicle CAN bus. The assigned classifications are used to prioritize messages, signals, and nodes of the vehicle CAN bus. The classifications are used to prioritize critical messages and high priority messages that control operations of the vehicle system.

Using signal rating to identify security critical CAN messages and nodes for efficient implementation of distributed network security features

The present disclosure relates to a system that allows engagement of an electronic plug-in device (EPID) with an on-board diagnostic II (OBD-II) port of a vehicle. The EPID includes an accelerometer and a processor. The accelerometer detects vibrations associated with engine operation. The processor, in communication with the accelerometer, executes instructions to receive an input waveform from the accelerometer. The processor may determine whether the input waveform from the accelerometer is associated with the engine operation. The processor may transition the EPID from a sleep state to a wake state if the input waveform is detected to be associated with the engine operation. In contrast, the processor may transition the EPID from the wake state to the sleep state when the input waveform is not associated with the engine operation.

System to wake electronic plug-in devices (EPIDs) and related method(s) thereof

A programming session may be initiated to a vehicle ECU by an update device. A software update for the ECU may be authenticated by the update device using an authentication key. When an authentication result indicates successful authentication, the ECU software update is sent by the update device over the in-vehicle network to the ECU. The ECU may then flash a memory with the ECU software update. The authentication key may be obtained from the ECU. The update device may be a vehicle telematics control unit or a service tool coupled to a connector of the vehicle.

Software authentication before software update

A vehicle includes a controller, programmed to responsive to receiving a command from a non-customer party, send an authorization request based on the command and a predefined vehicle parameter to a server; and responsive to receiving a signed command from the server, execute the signed command.

Cloud authorized vehicle control

A first electronic control unit (ECU) is in communication with a second ECU over a vehicle bus. The first ECU is configured to generate functional safety values and security protection values for a message, validate the security protection values for the message, and send the message to the second ECU including the security protection values but not the functional safety values.

End-to-end controller protection and message authentication

A system includes a processor controlling a vehicle module (VM) in communication with a telematics control unit (TCU) over a bus. In this embodiment, the processor is configured to receive an authentication request, including a counter value, from the TCU. The processor is also configured to respond to the authentication request based on comparison of the counter value to a stored counter value stored by the VM. The processor is further configured to receive a command corresponding to the authentication request and including the counter value, responsive to the approved authentication request and process the command based on comparison of the counter value to the stored counter value.

Growing community of inventors

Farmington Hills, MI, United States of America

Xin Ye