Patent Publication Number: US-2021167956-A1

Title: Method for the vehicle-internal management of cryptographic keys

Description:
CROSS REFERENCE TO PRIOR APPLICATIONS 
     Cross-Reference to Related Applications 
     This application claims the benefit of PCT Application PCT/EP2019/070139, filed Jul. 25, 2019, which claims priority to German Application DE 10 2018 213 038.8, filed Aug. 3, 2018. The disclosures of the above applications are incorporated herein by reference. 
    
    
     TECHNICAL FIELD 
     The invention relates to a method for the vehicle-internal management of cryptographic keys, and also relates to a key-generating device for use in a vehicle-internal communication system. 
     BACKGROUND 
     Cryptographic keys are used in vehicles for cryptographically securing the vehicle-internal communication between different vehicle-internal control devices, and for cryptographically securing the integrity of the software of the vehicle-internal control devices. 
     In order that appropriate cryptographic security can be maintained over the service life of a vehicle, the generation and distribution of new cryptographic keys within a vehicle-internal communication system is needed regularly. The expression “rekeying” has become accepted in this context. 
     Various approaches are known for introducing new key material into a vehicle-internal communication system. Cryptographic keys are, for example, downloaded by a technician in a workshop by means of a test unit directly into the vehicle-internal communication system. The transmission of a command that initiates the key generation to a key-generating vehicle-internal control device is furthermore known. This can, for example, be performed by an authorized technician in a workshop, or by a backend through a secured end-to-end connection to the vehicle. Transmitting key material directly from a backend via a secured end-to-end connection to the vehicle is furthermore known. 
     The known solutions however partially entail significant problems. While downloading key material or commands that initiate the key generation by a technician, the vehicle must be made physically available. There is thus a negative impact on usage for the user of the vehicle. When the rekeying takes place in the context of servicing work that is to be carried out regularly at the vehicle, long periods of key usage can result, so that the internal communication security cannot be readily ensured. On top of this, it is not possible to rule out the possibility that third parties have an influence on the workshop personnel involved in the download of key material. 
     During the transmission of key material or of control commands that initiate the key generation using a secured Internet connection, there is always a risk of compromise, so that secure rekeying cannot be implemented either in this way. 
     Therefore, increasing the security during the generation and provision of cryptographic keys for vehicle-internal control units is desirable. 
     The background description provided herein is for the purpose of generally presenting the context of the disclosure. Work of the presently named inventors, to the extent it is described in this background section, as well as aspects of the description that may not otherwise qualify as prior art at the time of filing, are neither expressly nor impliedly admitted as prior art against the present disclosure. 
     SUMMARY 
     A vehicle-internal key generation device makes at least one secret available and at least one new cryptographic key is generated by the vehicle-internal key generation device on the basis of the at least one secret. 
     The device makes use of the recognition that as a result of the vehicle-internal key generation, the need for directly introducing the key, for example by means of a technician or via a backend, is not necessary, so that an associated risk of compromise is eliminated. The at least one secret that is to be introduced into the vehicle-internal communication system may not be used for key generation without the knowledge of supplementary generation parameters such as, for example, salt parameters or seed parameters. An attack aimed at the process of providing the at least one secret is thus unsuitable for impairing the communication security within the vehicle. The security of the rekeying process is increased in this way. 
     The key generation device for example uses a key derivation function such as, for example, PBKDF2 to generate the at least one key. The at least one secret can, for example, be a secret key, a password or a passphrase. The at least one secret can be downloaded, for example initially, to the key generation device and/or conveyed by means of a key exchange and/or a key agreement method such as, for example, the Diffie-Hellman or Elgamal. A plurality of secrets can also be provided to the vehicle-internal key generation device. The key generation device can also generate multiple new cryptographic keys on the basis of the one or of the plurality of secrets. 
     The at least one new cryptographic key may be provided to at least one vehicle-internal control device. Alternatively or in addition, the at least one new cryptographic key is used by the vehicle-internal control device in cryptographic and/or non-cryptographic security measures. The at least one new cryptographic key may also be made available to a plurality of vehicle-internal control devices, or agreed between them, by means of a key-sharing process, in particular using a key-exchange algorithm, wherein the plurality of vehicle-internal control devices can then use the at least one new cryptographic key in cryptographic and/or non-cryptographic security measures. The vehicle-internal control device may, for example, be an electronic control unit (ECU). A cryptographic security measure relates, for example, to the encryption of messages. A non-cryptographic security measure relates, for example, to the signing of messages. For example, one or a plurality of secrets are made available per vehicle-internal control device to the vehicle-internal key generation device, so that device-specific cryptographic keys can be generated on the basis of the respective secret or of the respective secrets, which are assigned to the respective vehicle-internal control devices. 
     In addition, the generation of the at least one new cryptographic key and/or the provision of the at least one new cryptographic key may be triggered by a key-exchange event or a combination of key-exchange events, and/or occurs autonomously. The key-exchange event can be a security event (security incident), such as for example a firewall alarm, an intrusion detection, a failed identity check or a certificate rule infringement (false identity proof via own signed backend certificate). The key-exchange event may be an environmental change, such as the change in the position, the change in the route and/or the exceeding of physical limit parameters. The key-exchange event may furthermore also be exceeding of a time limit. The key-exchange event may, moreover, be a vehicle-internal change, which can for example be ascertained by means of anomaly detection. 
     The key-exchange event may captured by a vehicle-internal control unit, wherein the control unit initiates the generation of the at least one new cryptographic key and/or the provision of the at least one new cryptographic key. The vehicle-internal control unit thus functions as a rekeying manager. The method may comprise the capture of a key-exchange event or a combination of key-exchange events by the vehicle-internal control unit. The key generation device and the control unit may be separate electronic modules, or can be integrated into a common electronic module. 
     In another embodiment, the control unit monitors the key generation carried out by the key generation device and/or adapts the key generation carried out by the key generation device. Alternatively or in addition, the control unit monitors the provision and/or the distribution of new cryptographic keys to one or a plurality of control devices and/or adapts the provision and/or the distribution of new cryptographic keys to one or a plurality of control devices. The rekeying process can be modified dynamically in that the control unit permits an adaptation of the key generation and/or an adaptation of the key distribution. The control unit may specify the secrets to be used for the key generation to the key generation device. Through a change to the specification it is possible to ensure that one or a plurality of secrets are no longer used for key generation, for example after it has been ascertained that they have been compromised. In addition to this, the control unit can specify the parameters to be used in the context of the key derivation function to the key generation device. New keys can thus be generated on the basis of an unchanged secret through a change to the parameters. 
     In one embodiment, key generation parameters are provided to a vehicle-external computer system which allow the vehicle-external computer system to generate at least one cryptographic key that is used by a vehicle-internal control device. Alternatively or in addition, the method comprises the generation, by the external computer system, of at least one cryptographic key that is used by a vehicle-internal control device. The external computer system can, for example, be a backend that is operated by the vehicle manufacturer or by a third-party supplier. The provision of the key generation parameters can, for example, comprise the transmission of the key generation parameters from the vehicle-internal communication system to the vehicle-external computer system, in particular using a secured Internet connection. For example, the at least one secret that was provided to the vehicle-internal key generation device for key generation is also known to the vehicle-external computer system. On the basis of the key generation parameters provided and of the at least one secret, the vehicle-external computer system is capable of generating corresponding cryptographic keys that may also be used in the context of the vehicle-internal communication system. 
     Authorization information may be made available for the vehicle-internal key generation device, and the generation of the at least one new cryptographic key by the vehicle-internal key generation device also takes place on the basis of the authorization information. The authorization information may also be known as credentials, and can, for example, comprise a counter, a token and/or authorization credentials. The authorization information may be made available by the control unit to the key generation device. 
     Further, a key generation device may comprise a computing unit that is configured to generate a new cryptographic key on the basis of the at least one secret. The key generation device may configured to be used in the method for vehicle-internal management of cryptographic keys according to one of the embodiments described above. 
     The object may be further achieved by a vehicle-internal communication system of the type mentioned at the beginning, wherein the communication system is configured to carry out the method for the vehicle-internal management of cryptographic keys according to one of the embodiments described above. 
     Other objects, features and characteristics of the present invention, as well as the methods of operation and the functions of the related elements of the structure, the combination of parts and economics of manufacture will become more apparent upon consideration of the following detailed description and appended claims with reference to the accompanying drawings, all of which form a part of this specification. It should be understood that the detailed description and specific examples, while indicating the preferred embodiment of the disclosure, are intended for purposes of illustration only and are not intended to limit the scope of the disclosure. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The present disclosure will become more fully understood from the detailed description and the accompanying drawings, wherein: 
         FIG. 1  shows an exemplary embodiment of the communication system in a schematic illustration; 
         FIG. 2  shows a further exemplary embodiment of the communication system in a schematic illustration; 
         FIG. 3  shows a further exemplary embodiment of the communication system in a schematic illustration; and 
         FIG. 4  shows a schematic flow diagram of the method. 
     
    
    
     DETAILED DESCRIPTION 
     According to  FIG. 1 , the vehicle-internal communication system  100  comprises a key generation device  10 , a control unit  12  and a plurality of, namely three, control devices  18   a - 18   c.    
     The key generation device  10  comprises a storage device for storing provided secrets  24   a ,  24   b , wherein the secrets  24   a ,  24   b  can, for example, be secret keys, passwords or passphrases. The provision of the secrets  24   a ,  24   b  for the key generation device  10  can, for example, take place through an initial download during the implementation of the communication system  100  and/or subsequently by means of a key exchange and/or a key agreement method, such as for example Diffie-Hellman or Elgamal. 
     Authorization information  22  is in addition provided to the key generation device  10  via the control unit  12 . The authorization information  22  can also be known as “credentials” and comprises for example a counter, a token and/or authorization credentials. 
     The key generation device  10  comprises a computing unit that generates cryptographic keys  26   a ,  26   b  on the basis of the secrets  24   a ,  24   b  and of the authorization information  22 . The cryptographic keys  26   a ,  26   b  that are generated are provided to a plurality of vehicle-internal control devices  18   a - 18   c  via a distribution device  14  using key exchange algorithms. In the exemplary embodiment illustrated, the key generation device  10  generates the cryptographic key  26   a  on the basis of the secret  24   a  and the cryptographic key  26   b  on the basis of the secret  24   b . The cryptographic key  26   a  is provided to the vehicle-internal control devices  18   a ,  18   b . The cryptographic key  26   b  is provided to the vehicle-internal control device  18   c.    
     The vehicle-internal control devices  18   a - 18   c  are designed as electronic control units (ECUs) and use the cryptographic key  26   a ,  26   b  provided in the context of cryptographic and non-cryptographic security measures  16   a - 16   c  such as the encryption or signing of messages. 
     The generation of the cryptographic keys  26   a ,  26   b  and the provision of the cryptographic keys  26   a ,  26   b  that have been generated is triggered by a key-exchange event  20   a - 20   c  or a combination of key-exchange events  20   a - 20   c , and takes place autonomously on the occurrence of the key-exchange event  20   a - 20   c  or on the occurrence of the combination of key-exchange events  20   a - 20   c.    
     The key-exchange event  20   a - 20   c  is captured by a vehicle-internal control unit  12 , so that the control unit  12  also initiates the generation of the new cryptographic keys  26   a ,  26   b  as well as the provision of the cryptographic keys  26   a ,  26   b  that have been generated. In addition to this, the control unit  12  serves for monitoring the key generation carried out by the key generation device  10  and for adapting the key generation carried out by the key generation device  10 . 
     The key-exchange event  20   a - 20   c  can be a vehicle-internal change  20   a , an environmental change  20   b  or a security event  20   c  (security incident). The vehicle-internal change  20   a  can be acquired through an anomaly detection. The environmental change  20   b  can, for example, relate to the change in the position of the vehicle, to the change in the planned driving route or to the exceeding of physical limit parameters. Environmental change  20   b  can furthermore also relate to time-based changes or limits. The security event  20   c  can, for example, be a firewall alarm, an intrusion detection, a failed identity check or a certificate rule infringement (false identity proof via own signed backend certificate). 
     The vehicle-internal communication system  100  is furthermore configured to provide key generation parameters to a vehicle-external computer system  102 , for example via an Internet connection. The key generation parameters allow the vehicle-external computer system  102  to generate the cryptographic keys  26   a ,  26   b  that are used by the vehicle-internal control devices  18   a - 18   c . This allows the keys  26   a ,  26   b  that are generated internally to the vehicle also to be generated outside the vehicle. 
     The communication system  100  illustrated in  FIG. 2  comprises two separate key generation devices  10   a ,  10   b , wherein the key generation device  10   a  is an element of the vehicle-internal control device  18   a , and the key generation device  10   b  is an element of the vehicle-internal control device  18   b . The secret  24  is provided to the key generation devices  10   a ,  10   b , wherein the key generation devices  10   a ,  10   b  are configured to derive a cryptographic key on the basis of the secret  24 , wherein this is directly usable by the respective control device  18   a ,  18   b  in the context of security measures  16   a ,  16   b.    
     The key generation devices  10   a ,  10   b  use, for example, a key derivation function to generate the respective keys. As a result of the integration of the key generation devices  10   a ,  10   b  into the vehicle-internal control devices  18   a ,  18   b , a distribution of the generated keys is not necessary. 
       FIG. 3  shows a vehicle-internal communication system  100  in which two vehicle-internal control devices  18   a ,  18   b , each of which is configured as an electronic control unit (ECU), exchange encrypted and signed messages  32   a ,  32   b  with one another. The messages  32   a ,  32   b  here comprise an identifier  34  such as, for example, a cipher or a MAC tag. An intrusion detector  30  serves to capture attacks by vehicle-external attackers  104 . 
     It is thus possible to ascertain by way of the intrusion detector  30  whether a security event  20  (security incident) that requires the regeneration of keys has occurred. On the basis of the ascertained security event  20 , the control unit  12  initiates the generation and distribution of a new cryptographic key  26  that the control devices  18   a ,  18   b  can use for further communication with one another. In this way, an exchange of the old key  28  for the new key  26  in the case of the control devices  18   a ,  18   b , caused by the detection of an external attack, takes place autonomously. 
     The flow diagram illustrated in  FIG. 4  shows by way of example the method flow  200  during the method for the vehicle-internal management of cryptographic keys. 
     In step  202 , a message is encrypted and signed by a vehicle-internal control device  18   a . The message contains an identifier. In step  204 , the message is transmitted to the vehicle-internal control device  18   b , wherein the message that is addressed to the control device  18   b  is caught and manipulated in step  206  by the attacker  104 . The manipulation is ascertained in step  208  by the vehicle-internal intrusion detector  30 , wherein the manipulated message is transmitted in step  210  from the attacker  104  to the vehicle-internal control device  18   b.    
     In step  212 , the vehicle-internal control unit  12  is informed by the intrusion detector of the attack on the communication between the control device  18   a  and the control device  18   b . Following this, in step  214  the control unit  12  identifies the cryptographic key used in the communication between the control device  18   a  and the control device  18   b , and initiates the generation of a new cryptographic key by means of a corresponding generation command that is transmitted to the key generation device  10  in step  216 . In step  218 , a vehicle-external computer system is additionally informed that the cryptographic key previously used for communication between the control device  18   a  and the control device  18   b  is invalid from this time on, and that a new key is being generated internally to the vehicle to replace the invalid key. 
     The key generation device  10  now uses a secret that was provided previously and has been stored in a memory of the key generation device  10  in order in step  220  to generate a new cryptographic key for securing the communication between the control device  18   a  and the control device  18   b . The generated cryptographic key is provided by way of a key distribution process to the control device  18   a  in step  222  and to the control device  18   b  in step  224 . 
     In step  228 , the control device  18   a  replaces the cryptographic key that was used previously and is from this time on invalid with the newly generated cryptographic key provided by the key generation device  10 . In step  226 , the control device  18   b  replaces the cryptographic key that was used previously and is from this time on invalid with the newly generated cryptographic key provided by the key generation device  10 . The communication between the control device  18   a  and the control device  18   b  is secured from this time on by means of the newly generated cryptographic key. 
     The invention thus allows an automatic vehicle-internal elimination of security flaws that is initiated by the identification of a key-exchange event, and does not require any further measures on the part of an external technician or the exchange of data with an external computer system. 
     The foregoing preferred embodiments have been shown and described for the purposes of illustrating the structural and functional principles of the present invention, as well as illustrating the methods of employing the preferred embodiments and are subject to change without departing from such principles. Therefore, this invention includes all modifications encompassed within the scope of the following claims.