Method and system for providing secure over-the-air vehicle updates

1. A method for providing a secure Over-The-Air (OTA) firmware update, the method comprising:

generating, by one or more servers, a firmware update package for a plurality of vehicles;

applying, by the one or more servers, a version-specific encryption to the generated firmware update package using a version key, the version key comprising a key specific to a version for the firmware update;

applying, by the one or more servers, a vehicle-specific encryption to the version key using a plurality of vehicle keys, each vehicle key comprising a private key maintained by the one or more servers and specific to each of the plurality of vehicles, wherein applying the vehicle-specific encryption to the version key using the plurality of vehicle keys generates a plurality of encrypted version keys; and

distributing, by the one or more servers, the encrypted generated firmware update package and the plurality of encrypted version keys to the plurality of vehicles, wherein distributing the encrypted generated firmware update package and the plurality of encrypted version keys to the plurality of vehicles comprises sending the encrypted generated firmware update package and the plurality of encrypted version keys over one or more communication networks to a service tool and transferring the encrypted generated firmware update package and one of the plurality of encrypted version keys from the service tool to each of the plurality of vehicles for installation through an On-Board Diagnostics (OBD) port of each of the plurality of vehicles, wherein the one of the plurality of encrypted version keys transferred to each of the plurality of vehicles is selected by the service tool based on a vehicle identification of the corresponding vehicle, and wherein each vehicle decrypts the one of the plurality of encrypted version keys transferred from the service tool using a private key maintained by the corresponding vehicle, decrypts the encrypted generated firmware update package using the decrypted one of the plurality of encrypted version keys, and applies the decrypted generated firmware update package.

2. The method of claim 1 , wherein the generated firmware update package comprises an image for firmware to update in the plurality of vehicles and a manifest for the image, the manifest for the image identifying contents of the image and defining dependencies for modules within the identified contents of the image.

3. The method of claim 2 , wherein the image for the firmware to update in the generated firmware update package comprises an image of all firmware for each of the plurality of vehicles.

4. The method of claim 1 , wherein applying the vehicle-specific encryption to the key specific to the version for the firmware update further comprises:

receiving, by the one or more servers, a trigger for the OTA firmware update;

identifying, by the one or more servers, each vehicle of the plurality of vehicles based on the received trigger; and

encrypting, by the one or more servers, the version key using the private key maintained by the one or more servers for each identified vehicle of the plurality of vehicles.

5. The method of claim 4 , wherein receiving the trigger for the OTA firmware update comprises receiving an indication of a period update check for the plurality of vehicles, receiving a request to push updates to the plurality of vehicles, or receiving a request from each of the plurality of vehicles to pull updates for the corresponding vehicle.

6. The method of claim 1 , further comprising signing, by the one or more servers, the generated firmware update package with a certificate authenticating a source of the generated firmware update package.

7. The method of claim 6 , further comprising, upon expiration of the generated firmware update package, adding, by the one or more servers, the certificate used to sign the generated firmware update package to a Certificate Revocation List (CRL).

8. The method of claim 1 , wherein distributing the encrypted generated firmware update package and the encrypted version keys to the plurality of vehicles comprises sending the encrypted generated firmware update package and the encrypted version keys to the plurality of vehicles over one or more communications networks.

9. A system comprising:

one or more communications networks;

a plurality of vehicles; and

one or more servers coupled with the one or more communications networks, each server comprising at least a processor and a memory coupled with and readable by the processor and storing therein a set of instructions which, when executed by the processor, causes the processor to provide a secure Over-The-Air (OTA) firmware update to one or more vehicles of the plurality of vehicles by:

generating a firmware update package for the plurality of vehicles,

applying a version-specific encryption to the generated firmware update package using a version key, the version key comprising a key specific to a version for the firmware update,

applying a vehicle-specific encryption to the version key using a plurality of vehicle keys, each vehicle key comprising a private key maintained by the one or more servers and specific to each of the plurality of vehicles, wherein applying the vehicle-specific encryption to the version key using the plurality of vehicle keys generates a plurality of encrypted version keys, and

distributing the encrypted generated firmware update package and the plurality of encrypted version keys to the plurality of vehicles over the one or more communications networks, wherein distributing the encrypted generated firmware update package and the plurality of encrypted version keys to the plurality of vehicles comprises sending the encrypted generated firmware update package and the plurality of encrypted version keys over the one or more communication networks to a service tool and transferring the encrypted generated firmware update package and one of the plurality of encrypted version keys from the service tool to each of the plurality of vehicles for installation through an On-Board Diagnostics (OBD) port of each of the plurality of vehicles, wherein the one of the plurality of encrypted version keys transferred to each of the plurality of vehicles is selected by the service tool based on a vehicle identification of the corresponding vehicle, and wherein each vehicle decrypts the one of the plurality of encrypted version keys transferred from the service tool using a private key maintained by the corresponding vehicle, decrypts the encrypted generated firmware update package using the decrypted one of the plurality of encrypted version keys, and applies the decrypted generated firmware update package.

10. The system of claim 9 , wherein the generated firmware update package comprises an image for firmware to update in the plurality of vehicles and a manifest for the image, wherein the image for the firmware to update in the generated firmware update package comprises an image of all firmware for each of the plurality of vehicles, and wherein the manifest for the image identifies contents of the image and defines dependencies for modules within the identified contents of the image.

11. The system of claim 9 , wherein applying the version-specific encryption to the generated firmware update package further comprises:

receiving a trigger for the OTA firmware update, wherein receiving the trigger for the OTA firmware update comprises receiving an indication of a period update check for one or more target vehicles, receiving a request to push updates to the one or more target vehicles, or receiving a request from each of the one or more target vehicles to pull updates for the corresponding vehicle;

identifying each vehicle of the plurality of vehicles based on the received trigger; and

encrypting the version key using the private key maintained by the one or more servers for each identified vehicle of the plurality of vehicles.

12. The system of claim 9 , wherein the instructions further cause the one or more servers to sign the generated firmware update package with a certificate authenticating a source of the generated firmware update package and, upon expiration of the generated firmware update package, add the certificate used to sign the generated firmware update package to a Certificate Revocation List (CRL).

13. The system of claim 9 , wherein distributing the encrypted generated firmware update package and the encrypted version keys to the plurality of vehicles comprises sending the encrypted generated firmware update package and the encrypted version keys to the plurality of vehicles over the one or more communications networks.

14. A non-transitory computer-readable medium comprising a set of instructions stored therein which, when executed by a processor, causes the processor to provide a secure Over-The-Air (OTA) firmware update to one or more vehicles of a plurality of vehicles by:

generating a firmware update package for the plurality of vehicles;

applying a version-specific encryption to the generated firmware update package using a version key, the version key comprising a key specific to a version for the firmware update;

applying a vehicle-specific encryption to the version key using a plurality of vehicle keys, each vehicle key comprising a private key maintained by one or more servers and specific to each of the plurality of vehicles, wherein applying the vehicle-specific encryption to the version key using the plurality of vehicle keys generates a plurality of encrypted version keys; and

distributing the encrypted generated firmware update package and the plurality of encrypted version keys to the plurality of vehicles over one or more communications networks, wherein distributing the encrypted generated firmware update package and the plurality of encrypted version keys to the plurality of vehicles comprises sending the encrypted generated firmware update package and the plurality of encrypted version keys over the one or more communication networks to a service tool and transferring the encrypted generated firmware update package and one of the plurality of encrypted version keys from the service tool to each of the plurality of vehicles for installation through an On-Board Diagnostics (OBD) port of each of the plurality of vehicles, wherein the one of the plurality of encrypted version keys transferred to each of the plurality of vehicles is selected by the service tool based on a vehicle identification of the corresponding vehicle, and wherein each vehicle decrypts the one of the plurality of encrypted version keys transferred from the service tool using a private key maintained by the corresponding vehicle, decrypts the encrypted generated firmware update package using the decrypted one of the plurality of encrypted version keys, and applies the decrypted generated firmware update package.

15. The non-transitory computer-readable medium of claim 14 , wherein the generated firmware update package comprises an image for firmware to update in the plurality of vehicles and a manifest for the image, wherein the image for the firmware to update in the generated firmware update package comprises an image of all firmware for each of the plurality of vehicles, and wherein the manifest for the image identifies contents of the image and defines dependencies for modules within the identified contents of the image.

16. The non-transitory computer-readable medium of claim 14 , wherein applying the vehicle-specific encryption to the key specific to the version for the firmware update and used to encrypt the generated firmware update package further comprises:

receiving a trigger for the OTA firmware update, wherein receiving the trigger for the OTA firmware update comprises receiving an indication of a period update check for one or more target vehicles, receiving a request to push updates to the one or more target vehicles, or receiving a request from each of the one or more target vehicles to pull updates for the corresponding vehicle;

identifying each vehicle of the plurality of vehicles based on the received trigger; and

encrypting the version key using the private key maintained by the one or more servers for each identified vehicle of the plurality of vehicles.

17. The non-transitory computer-readable medium of claim 14 , wherein the instructions further cause the one or more servers to sign the generated firmware update package with a certificate authenticating a source of the generated firmware update package and, upon expiration of the generated firmware update package, add the certificate used to sign the generated firmware update package to a Certificate Revocation List (CRL).