Granted Patent B2

US 12,470,406 · App. 17/899,722 · Granted Nov 11, 2025

Inventors: Stephen Paul McFarland, Jr. (Allen, TX); Mark R. Klausner (San Diego, CA)

Assignees: TOYOTA MOTOR NORTH AMERICA, INC.; Toyota Jidosha Kabushiki Kaisha

H04L9/3268H04L9/3073B60R16/0232

Abstract

Claims (98)

1 . A method, comprising:

providing a fixed private key from a first electronic control unit (ECU) of a vehicle to a server;

generating by the first ECU a certificate based on the fixed private key, wherein the first ECU acts as a certificate authority that signs the certificate; and

providing the certificate from the first ECU to a second ECU within the vehicle in response to the first ECU receiving from the second ECU a request comprising a health status of the second ECU, wherein

when the health status indicates that the second ECU is current, the certificate is fully functional, and

when health status indicates that the second ECU is not up to date, the certificate provides access to an updating service.

2 . The method of claim 1 , comprising:

configuring the first ECU with a first public/private key pair, including the fixed private key;

configuring the second ECU with a second public/private key pair;

establishing a secure communications link between the first ECU and the second ECU using the first public/private key pair and the second public/private key pair; and

by the second ECU over the secure communications link, requesting the certificate from the first ECU.

3 . The method of claim 1 , comprising:

requesting, by the second ECU, the certificate from the first ECU, the requesting including a first identifier for identifying the second ECU;

providing, by the first ECU, a second identifier for identifying the first ECU, with the certificate;

sending, by the second ECU, the certificate to the server; and

associating, by the server, the first identifier with the vehicle using the second identifier.

4 . The method of claim 1 , comprising:

associating the second ECU with at least one component of the vehicle;

determining, by the server, that a first identifier for identifying the second ECU is associated with the vehicle and another vehicle;

acquiring a first state of health from the second ECU at the vehicle;

acquiring a second state of health from the second ECU at the another vehicle; and

comparing, by the server, the first state of health to the second state of health to determine a life cycle stage for the at least one component.

5 . The method of claim 1 , comprising:

communicatively coupling a third ECU to the first ECU;

receiving, by the first ECU, a request from the third ECU for the certificate;

authorizing the first ECU to send the certificate to the third ECU; and

sending, by the first ECU, the certificate to the third ECU.

6 . The method of claim 1 , comprising:

indicating a third ECU has been installed in the vehicle;

determining, by the server, whether or not the third ECU is the first ECU;

when the third ECU is the first ECU, providing, by the server, a remediation certificate to the third ECU, the remediation certificate providing access to a service configured for updating the first ECU; and

when the third ECU is not the first ECU, sending a request for the certificate from the third ECU to the first ECU,

wherein the first ECU transmits a first message to the server indicating that a validation is required for the first ECU to send the certificate to the third ECU, and

wherein the first ECU receives a second message from the server validating the request.

7 . A system, comprising:

a memory storing instructions; and

a processor of a vehicle that executes the instructions to configure the processor to:

provide a fixed private key from of a first electronic control unit (ECU) of the vehicle to a server;

generate a certificate based on the fixed private key, wherein the first ECU acts as a certificate authority that signs the certificate; and

provide the certificate from the first ECU to a second ECU within the vehicle in response to the first ECU receiving from the second ECU a request comprising a health status of the second ECU, wherein

when the health status indicates that the second ECU is current, the certificate is fully functional, and

when health status indicates that the second ECU is not up to date, the certificate provides access to an updating service.

8 . The system of claim 7 , wherein the processor is configured to:

configure the first ECU with a first public/private key pair that includes the fixed private key;

configure the second ECU with a second public/private key pair;

establish a secure communications link between the first ECU and the second ECU using the first public/private key pair and the second public/private key pair; and

request, by the second ECU over the secure communications link, the certificate from the first ECU.

9 . The system of claim 7 , wherein the processor is configured to:

control the second ECU to request the certificate from the first ECU, wherein the request includes a first identifier that identifies the second ECU;

control the first ECU to provide a second identifier that identifies the first ECU, with the provided certificate; and

control the second ECU to send the provided certificate to the server to associate the first identifier with the vehicle.

10 . The system of claim 7 , wherein the processor is configured to:

associate the second ECU with at least one component of the vehicle;

determine that a first identifier which identifies the second ECU is associated with the vehicle and another vehicle;

acquire a first state of health from the second ECU at the vehicle;

acquire a second state of health from the second ECU at the another vehicle; and

compare the first state of health to the second state of health, to determine a life cycle stage for the at least one component.

11 . The system of claim 7 , wherein the processor is configured to:

communicatively couple a third ECU to the first ECU;

receive, by the first ECU, a request from the third ECU for the certificate;

authorize the first ECU to send the certificate to the third ECU; and

send, by the first ECU, the certificate to the third ECU.

12 . The system of claim 7 , wherein the processor is configured to:

indicate that a third ECU has been installed in the vehicle;

determine whether or not the third ECU is the first ECU;

when the third ECU is the first ECU, provide a remediation certificate to the third ECU, wherein the remediation certificate provides access to a service configured to update the first ECU; and

when the third ECU is not the first ECU, sends a request for the certificate from the third ECU to the first ECU,

wherein the first ECU transmits a first message to the server that indicates a validation is required in order for the first ECU to send the certificate to the third ECU, and

wherein the first ECU receives a second message from the server that validates the request.

13 . A non-transitory computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform:

providing a fixed private key from a first electronic control unit (ECU) of a vehicle to a server;

generating by the first ECU a certificate based on the fixed private key, wherein the first ECU acts as a certificate authority that signs the certificate; and

providing the certificate from the first ECU to a second ECU within the vehicle in response to the first ECU receiving from the second ECU a request comprising a health status of the second ECU, wherein

when the health status indicates that the second ECU is current, the certificate is fully functional, and

when health status indicates that the second ECU is not up to date, the certificate provides access to an updating service.

14 . The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further cause the processor to perform:

configuring the first ECU with a first public/private key pair, including the fixed private key;

configuring the second ECU with a second public/private key pair;

establishing a secure communications link between the first ECU and the second ECU using the first public/private key pair and the second public/private key pair; and

by the second ECU over the secure communications link, requesting the certificate from the first ECU.

15 . The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further cause the processor to perform:

requesting, by the second ECU, the certificate from the first ECU, the requesting including a first identifier for identifying the second ECU;

providing, by the first ECU, a second identifier for identifying the first ECU, with the certificate;

sending, by the second ECU, the certificate to the server; and

associating, by the server, the first identifier with the vehicle using the second identifier.

16 . The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further cause the processor to perform:

associating the second ECU with at least one component of the vehicle;

determining, by the server, that a first identifier for identifying the second ECU is associated with the vehicle and another vehicle;

acquiring a first state of health from the second ECU at the vehicle;

acquiring a second state of health from the second ECU at the another vehicle; and

comparing, by the server, the first state of health to the second state of health to determine a life cycle stage for the at least one component.

17 . The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further cause the processor to perform:

indicating a third ECU has been installed in the vehicle;

determining, by the server, whether or not the third ECU is the first ECU;

when the third ECU is the first ECU, providing, by the server, a remediation certificate to the third ECU, the remediation certificate providing access to a service configured for updating the first ECU; and

when the third ECU is not the first ECU, sending a request for the certificate from the third ECU to the first ECU,

wherein the first ECU transmits a first message to the server indicating that a validation is required for the first ECU to send the certificate to the third ECU, and

wherein the first ECU receives a second message from the server validating the request.

Assignments (2)

Continuity (1)

References Cited (39)