Electronic control unit adapted to intelligent transport system communications and corresponding method
The electronic control unit includes a communication circuit adapted to receive intelligent transport system messages, an authentication circuit designed to authenticate the received messages, a non-volatile memory configured to record the authenticated received messages, and a secure element. The secure element includes a blacklist of automatically excluded senders and is configured to directly reject a received message from a sender on the blacklist without authentication using the authentication circuit. Alternatively, the secure element includes a whitelist of automatically allowed senders and is configured to directly record a received message from a sender on the whitelist in the non-volatile memory without authentication using the authentication circuit.
1 . An electronic control unit, comprising:
a communication circuit configured to receive intelligent transport system (ITS) messages;
an authentication circuit configured to authenticate the received ITS messages and generate authenticated ITS messages;
a first non-volatile memory configured to record the authenticated ITS messages; and
a secure element;
wherein the secure element includes a second non-volatile memory being hardware secure and storing a blacklist list of automatically excluded senders where the electronic control unit is configured to directly reject a received ITS message from a sender on the blacklist, without performing authentication of this ITS message with the authentication circuit, wherein the first non-volatile memory and the second non-volatile memory are physically separate memory structures with different security characteristics.
2 . The electronic control unit according to claim 1 , wherein the secure element is configured to modify the blacklist of automatically excluded senders in response to receipt of a command sent on a secure channel by an authorized server.
3 . The electronic control unit according to claim 1 , wherein the communication circuit is configured for wireless communications according to an IEEE 802.11.p standard protocol or a 5G protocol.
4 . The electronic control unit according to claim 1 , wherein said first non-volatile memory is not hardware-secure.
5 . The electronic control unit according to claim 1 , wherein the secure element includes a continually active clock counter, the secure element being configured to assign each of the authenticated ITS messages a timestamp data item from said clock counter, and to record said authenticated ITS messages and their respective timestamp data in the hardware-secure non-volatile memory.
6 . The electronic control unit according to claim 1 , wherein the first non-volatile memory is not hardware-secure, wherein the different security characteristics include the second non-volatile memory requiring a higher authentication level to access than the first non-volatile memory.
7 . An electronic control unit, comprising:
a communication circuit configured to receive intelligent transport system (ITS) messages;
an authentication circuit configured to authenticate the received ITS messages, thereby generating authenticated ITS messages;
a first non-volatile memory configured to record the authenticated ITS messages; and
a secure element;
wherein the secure element includes a second non-volatile memory being hardware secure and storing a whitelist of automatically allowed senders where the electronic control unit is configured to directly record a received ITS message from a sender on the whitelist in the first non-volatile memory, without performing authentication of this ITS message with the authentication circuit, where the first non-volatile memory and the second non-volatile memory are physically separate memory structures with different security characteristics.
8 . The electronic control unit according to claim 7 , wherein the secure element is configured to modify the whitelist of automatically allowed senders in response to receipt of a command sent on a secure channel by an authorized server.
9 . The electronic control unit according to claim 7 , wherein the communication circuit is configured for wireless communications according to an IEEE 802.11.p standard protocol or a 5G protocol.
10 . The electronic control unit according to claim 7 , wherein said first non-volatile memory is not hardware-secure.
11 . The electronic control unit according to claim 7 , wherein the secure element includes a continually active clock counter, the secure element being configured to assign each of the authenticated ITS messages a timestamp data item from said clock counter, and to record said authenticated ITS messages and their respective timestamp data in the hardware-secure non-volatile memory.
12 . The electronic control unit according to claim 7 , wherein the first non-volatile memory is not hardware-secure, wherein the different security characteristics include the second non-volatile memory requiring a higher authentication level to access than the first non-volatile memory.
13 . A method for managing intelligent transport system (ITS) communications, comprising:
receiving an ITS message;
authenticating the received ITS message to generate authenticated ITS messages; and
recording the authenticated ITS message in a first non-volatile memory of an electronic control unit;
wherein the received ITS message is directly rejected, without performing said authentication, if the received ITS message is from a sender on a blacklist of automatically excluded senders contained in a second non-volatile memory of a secure element of the electronic control unit; and
wherein the received ITS message is directly recorded in the first non-volatile memory, without performing said authentication, if the received ITS message is from a sender on a whitelist of automatically allowed senders contained in the second non-volatile memory of the secure element, wherein the first non-volatile memory and the second non-volatile memory are physically separate memory structures with different security characteristics.
14 . The method according to claim 13 , wherein a modification of the blacklist of automatically excluded senders or of the whitelist of automatically allowed senders is performed upon a command sent on a secure channel by an authorized server.
15 . The method according to claim 13 , wherein the ITS communications are wireless communications according to an IEEE 802.11.p standard protocol or a 5G protocol.
16 . The method according to claim 13 , wherein said first non-volatile memory is not hardware-secure.
17 . The method according to claim 13 , further comprising assigning the authenticated ITS messages a timestamp data item from a continually active clock counter belonging to the secure element, and recording said authenticated ITS messages and respective timestamp data in the second non-volatile memory.
18 . The method according to claim 13 , wherein the first non-volatile memory is not hardware-secure and the second non-volatile memory is hardware-secure, wherein the different security characteristics include the second non-volatile memory requiring a higher authentication level to access than the first non-volatile memory.
19 . An intelligent transport system (ITS), comprising:
a network of vehicle stations;
roadway infrastructure stations;
at least one central station for managing communications between the network of vehicle stations and the roadway infrastructure stations;
wherein the network of vehicle stations, the roadway infrastructure stations, and the at least one central station are configured to use a wireless communication protocol for transmitting car-to-everything (C2X) messages between therebetween;
electronic control units (ECU) associated with said vehicle stations and roadway infrastructure stations, wherein each ECU includes:
a communication circuit configured for wireless communications;
an authentication circuit configured to authenticate received C2X messages by deciphering digital signatures of a sender, thereby generating authenticated C2X messages;
a first non-volatile memory configured to store the authenticated C2X messages;
a secure element comprising a second non-volatile memory being hardware-secure and storing a blacklist of automatically excluded senders and a whitelist of automatically allowed senders, wherein the ECU is configured to directly reject a received C2X message from a sender in the blacklist without authentication and directly record a received C2X message from a sender in the whitelist without authentication, wherein the first non-volatile memory and the second non-volatile memory are physically separate memory structures with different security characteristics;
wherein the at least one central station is configured to cause updating of the blacklists and the whitelists by transmitting update commands to the ECUs.
20 . The ITS of claim 19 , wherein the C2X messages include at least one of basic safety messages (BSMs), weather alerts, stopped car alerts, accident alerts, or signaling malfunction alerts.
21 . The ITS of claim 19 , wherein the secure element is configured to modify the blacklist and the whitelist in response to a command sent on a secure channel by the at least one central station.
22 . The ITS of claim 19 , wherein the communication circuit is configured for wireless communications according to an IEEE 802.11.p standard protocol or a 5G protocol.
23 . The ITS of claim 19 , wherein said first non-volatile memory is not hardware-secure.
24 . The ITS of claim 19 , wherein the secure element includes a continually active clock counter, the secure element being configured to assign each of the authenticated C2X messages a timestamp data item from said clock counter, and to record said authenticated C2X messages and their respective timestamp data in the second non-volatile memory.
25 . The ITS according to claim 19 , wherein the first non-volatile memory is not hardware-secure, wherein the different security characteristics include the second non-volatile memory requiring a higher authentication level to access than the first non-volatile memory.