# A Hybrid-Cryptography Engine for Securing Intra-Vehicle Communications
## 3 The Crypto-Engine
### Principles and Logical Architecture of the Engine  
The Crypto-Engine represents the network of interest (e.g., the intra-vehicle network) as a clustered graph of transceiver nodes with almost converge-cast type communications for sensor data flows (e.g., sensor data collection) and multi-cast/broadcast operations for control flows. Clusters are composed by considering the physical location of the nodes or logical elements (e.g., nodes are grouped by their function). The core cryptographic solution adopted in the Crypto-Engine is the _Elliptic Curve Topology-Authenticated Key Scheme_, i.e., **ECTAKS**[53], which is used to secure the aforementioned clusters of nodes. ECTAKS is a topology-based upgraded version of the well-known ECDH (ECC-based Diffie-Helmann) scheme: specifically, the network topology is added to the identity of the nodes as discriminating factor for the purpose of generating the shared key between the parties (and therefore the encryption of communications and the authentication of messages and of the parties themselves) and the establishment of protected communication sessions. One of the relevant and characterizing properties of the ECTAKS scheme is the authentication between connected parties according to arbitrary session topologies. The ECTAKS module provides key generation, distribution, encryption, and signature management via NIST-compliant elliptic curves [41; 54; 55; 56; 57]. Furthermore, ECTAKS supports multi-cast cluster-wise communications: the cluster itself can be represented in the ANT as a virtual node, with its own set of key components. The private components are then distributed to those (real) nodes allowed to perform downstream communications (i.e., senders), while the public components are distributed to all the nodes in the defined cluster. In this way, the cluster itself has a single set of key components and it is possible to secure multi-cast communications in a scalable way with a negligible impact on node memory storage (i.e., for the additional key components) and no additional impact on performance (i.e., from the ECTAKS point-of-view, a multi-cast communication is a normal point-to-point communication). ECTAKS relies on the pre-distribution of partial key components denoted as Local Key Component (LKC), Transmitted Key Component (TKC) and a set of Topology Vectors (TV). For a given node, the Local Configuration Data (LCD) is the tuple \(\left(LKC,TKC,\left[TV_{1},\ldots,TV_{n}\right]\right)\) and represents the cryptographic material required for establishing a secure communication. The term \"topology authentication\" refers to the unfeasibility in setting up secure links between nodes whose topology is not compliant to an Authenticated Network Topology (ANT) which defines the available communication links. The ANT is implemented by generating and pre-distributing the sets of TVs among the nodes. This operation is called _ECTAKS Key Component Generation_ and takes place every time a new ANT is established. Whenever a node (_Alice_) in the ANT wants to start a communication with another node (_Bob_) with ECTAKS, they need to agree to a shared secret, i.e., the Elliptic Curve Topology Authenticated Key (ECTAK), to be used as symmetric key. ECTAKS makes this possible by using ECC in combination with the key components in the LCDs of the two nodes. The details and the mathematical formulations are available in [53]. Once the cryptographic key has been reconstructed from the key components, the symmetric Crypto-Engine encryption services adopt the AES algorithm in CCM mode [58] using ECTAK as a symmetric key. For public-key signature services [59], the Crypto-Engine uses the ECTAKS Key Components in an ECDSA-based solution featuring the Hash-based Message Authentication Code (HMAC), as the message authentication function (MAC) and SHA256 [60] for hashing the message to be signed (i.e., HMAC-SHA256). The adherence to the current NIST security standards [54; 55; 56] and the formal proof of security [47] make ECTAKS fully qualified for industrial use.