In-vehicle network (IVN) device and method for operating an IVN device

1. An in-vehicle network (IVN) transceiver, the IVN transceiver comprising:

a packaged integrated circuit (IC) device including;

an IVN bus interface for communicating with an IVN bus that is external to the packaged IC device;

a microcontroller communications interface for communicating with a microcontroller communications interface that is external to the packaged IC device; and

a security module connected between the IVN bus interface and the microcontroller communications interface and configured to perform a security function within the packaged IC device;

wherein the security module comprises a programmable cryptographic module configured to execute security software programs;

wherein the programmable cryptographic module is configured to:

extract a data payload from a plurality of data frames received through the microcontroller communications interface; and

process the data payload to generate a Cipher-based Message Authentication Code (CMAC) digest,

wherein the IVN transceiver further comprises a protocol controller configured to combine the payload with the CMAC digest.

2. The IVN transceiver of claim 1 , wherein the programmable cryptographic module comprises:

a security core configured to execute security software routines;

a random number generator configured to generate an encryption key;

an encryption engine configured to perform message encryption using the encryption key; and

a non-volatile memory (NVM) configured to store the encryption key.

3. The IVN transceiver of claim 2 , wherein the encryption engine is further configured to perform message decryption using a decryption key, and wherein the NVM is further configured to store the decryption key.

4. The IVN transceiver of claim 2 , wherein the NVM is further configured to store a set of policies for intrusion detection or intrusion prevention, and wherein the programmable cryptographic module comprises logic configured to implement detection or intrusion prevention.

5. The IVN transceiver of claim 1 , wherein the programmable cryptographic module is configured to:

extract a data payload from a plurality of data frames received through the microcontroller communications interface; and

encrypt the data payload with an encryption key to generate an encrypted data payload,

wherein the IVN transceiver further comprises a protocol controller configured to create a data frame to be transmitted through the IVN bus interface from the encrypted data payload.

6. The IVN transceiver of claim 1 , wherein the security module comprises a stream cipher circuit configured to perform stream cipher encryption and/or stream cipher decryption.

7. The IVN transceiver of claim 6 , wherein the stream cipher circuit comprises:

a random number generator configured to generate an encryption keystream;

a processing unit configured to encrypt a plaintext message with the encryption keystream to generate a ciphertext stream; and

a storage unit configured to store the encryption keystream and/or the ciphertext stream.

8. The IVN transceiver of claim 6 , wherein the stream cipher circuit is configured to process a Controller Area Network (CAN) payload without modifying the format of the CAN payload.

9. The IVN transceiver of claim 1 , wherein the security module is configured to perform at least one of:

intrusion detection or intrusion prevention;

message encryption or message decryption;

packet filtering; and

message authentication.

10. The IVN transceiver of claim 9 , wherein the security module is configured to perform stream cipher encryption and decryption or block cipher encryption and decryption.

11. The IVN transceiver of claim 9 , wherein the security module is configured to perform at least one of frame identification inspection and deep packet inspection.

12. The IVN transceiver of claim 1 , further comprising a decoder configured to decode messages received on the microcontroller communications interface.

13. The IVN transceiver of claim 1 , further comprising a transmitter and a receiver.

14. An electronic control unit comprising the IVN transceiver of claim 1 and a microcontroller, wherein the microcontroller communications interface of the IVN transceiver is used for communications with the microcontroller.

15. The IVN transceiver of claim 1 , wherein the IVN transceiver comprises a Controller Area Network (CAN) transceiver.

16. A Controller Area Network (CAN) transceiver comprising:

a packaged integrated circuit (IC) device including;

a CAN bus interface having a CAN high (CANH) bus interface and a CAN low (CANL) bus interface for communicating with a CAN bus that is external to the packaged IC device;

a microcontroller communications interface for communicating with a microcontroller that is external to the packaged IC device; and

a security module connected between the CAN bus interface and the microcontroller communications interface and configured to perform, within the packaged IC device, at least one of:

intrusion detection or intrusion prevention;

message encryption or message decryption;

packet filtering; and

message authentication;

wherein the security module comprises a programmable cryptographic module configured to execute security software programs;

wherein the programmable cryptographic module is configured to:

extract a data payload from a plurality of data frames received through the microcontroller communications interface; and

process the data payload to generate a Cipher-based Message Authentication Code (CMAC) digest,

wherein the CAN transceiver further comprises a protocol controller configured to combine the payload with the CMAC digest.

17. A method for operating an in-vehicle network (IVN) transceiver, the method comprising:

receiving data from a microcontroller using a microcontroller communications interface of the IVN transceiver, wherein the IVN transceiver is included in a packaged integrated circuit (IC) device, and wherein the microcontroller is external to the packaged IC device;

performing a security function within the packaged IC device on the data to generate processed data using a security module of the IVN transceiver connected between the microcontroller communications interface and an IVN bus interface of the IVN transceiver, wherein the IVN bus interface is included within the packaged IC device; and

transmitting the processed data onto an IVN bus that is external to the packaged IC device using the IVN bus interface;

wherein performing a security function comprises:

extracting a data payload from a plurality of data frames received through the microcontroller communications interface;

processing the data payload to generate a Cipher-based Message Authentication Code (CMAC) digest; and

combining the payload with the CMAC digest.