Sending and receiving messages
The present disclosure relates to the exchange of information between a message sending device and a message receiving device with message authentication and proposes to reduce the time required for message authentication by pre-computing a message tag, such as a MAC, and subsequently replacing the computation of the MAC when the tag is to be validated (or indeed also on sending) by a table look-up. The approach requires a set of messages and works particularly well for small sets of messages, for example as small as two or three messages, or less than five or ten messages. The approach finds particular application in control networks where control decisions have to be taken quickly and securely, for example in the control of a vehicle, for example an autonomous vehicle, or the control of a smart electricity grid.
1. A message-receiving device, the message-receiving device comprising:
a memory configured to store a plurality of messages and corresponding message tags;
a communications interface configured to receive a message-tag pair, the message-tag pair comprising a message tag and a corresponding message, from a message-sending device; and
a processor configured to:
combine each message of the plurality of messages with an authentication key to compute, for each message of the plurality of messages, a respective message tag of a plurality of message tags for validating one or more messages tags associated with one or more messages;
store the plurality of message tags in the memory;
validate the received message tag based on comparing the received message tag with the stored plurality of message tags to identify a matching message tag;
in response to a trigger event, update the authentication key for computing one or more updated message tags;
combine each message of the plurality of messages with the updated authentication key to compute a plurality of updated message tags; and
store the plurality of updated message tags in the memory.
2. The message-receiving device of claim 1 , wherein the processor is configured to store each computed message tag in the memory in association with the corresponding message as a pair, and validate the authenticity of the received message based on comparing the received message-tag pair with the stored pairs to identify a matching stored pair.
3. The message-receiving device of claim 1 , wherein the trigger event comprises the validation of the message tag.
4. The message-receiving device of claim 1 , wherein the communications interface is configured to transmit a message to the message-sending device and the processor is configured to cause the communications interface to send a return message to the message-sending device in response to validating the message tag.
5. The message-receiving device of claim 4 , wherein the return message comprises information enabling authentication of the return message by the message-sending device.
6. The message-receiving device of claim 1 , wherein each message comprises a corresponding control instruction for an actuator device associated with the message-receiving device and the processor is configured to cause the control instruction to be actioned by the actuator device or wherein each message comprises a sensor signal of a sensor associated with the message-sending device and the processor is configured to process the sensor signal to determine a control instruction for an actuator and to cause the control instruction to be actioned by the actuator.
7. The message-receiving device of claim 6 , wherein the processor is configured to execute the combining and updating subsequent to causing the actuator to action the control instruction.
8. The message-receiving device of claim 1 , wherein, to combine one message of the plurality of messages with the authentication key, the processor is configured to, at least one of:
encrypt the one message using the authentication key;
hash the one message with the authentication key; or
use the authentication key as a seed or parameter to encode the one message using a Message Authentication Code (MAC) algorithm.
9. A message-sending device comprising:
a memory configured to store a plurality of pairs of respective messages and corresponding message tags;
a communications interface configured to transmit message tags; and
a processor configured to:
combine each message of the plurality of messages with an authentication key to generate, for each message of the plurality of messages, a respective message tag of a plurality of message tags for validating one or more message tags associated with one or more messages;
store the plurality of message tags in the memory in association with a respective message of the plurality of messages as a respective message-tag pair,
select a message to communicate to a message-receiving device;
retrieve a message tag from a stored message-tag pair corresponding to the selected message from the memory;
cause the communications interface to transmit the retrieved message tag corresponding to the selected message together with the selected message;
in response to a trigger event, update the authentication key for computing one or more updated message tags;
combine each message of the plurality of messages with the updated authentication key to compute a plurality of updated message tags; and
store each updated message tag of the plurality of updated message tags in the memory in association with a respective message of the plurality of messages.
10. The message-sending device of claim 9 , the communications interface is configured to receive a return message from the message-receiving device, wherein the trigger event comprises receiving, by the communications interface, a message confirming receipt of the message tag by the message-receiving device.
11. The message-sending device of claim 9 , wherein, to combine one message of the plurality of messages with the authentication key, the processor is configured to, at least one of:
encrypt the one message using the authentication key;
hash the one message with the authentication key; or
use the authentication key as a seed or parameter to encode the one message using a Message Authentication Code (MAC) algorithm.
12. A method of receiving a message, the method comprising:
combining each message of a plurality of messages with an authentication key to compute, for each message of the plurality of messages, a respective message tag of a plurality of message tags for validating one or more message tags associated with one or more messages;
storing the plurality of messages and the plurality of message tags in a memory;
receiving a message-tag pair, the message-tag pair comprising a message tag and a corresponding message, from a message-sending device;
validating the received message tag based on comparing the received message tag with the stored plurality of message tags to identify a matching message tag;
in response to a trigger event, updating the authentication key for computing one or more updated message tags;
combining each of the plurality of messages with the updated authentication key to compute a plurality of updates message tags; and
storing the plurality of updated message tags in the memory.
13. The method of claim 12 , wherein the trigger event comprises the validation of the message tag.
14. The method of claim 12 , further comprising:
storing each computed message tag in the memory in association with a corresponding message as a respective message-tag pair; and
validating the authenticity of the received message based on comparing the received message-tag pair with the stored pairs to identify a matching stored pair.
15. The method of claim 12 , further comprising:
transmitting a return message to the message-sending device in response to validating the received message tag.
16. The method of claim 15 , wherein the return message comprises information enabling authentication of the return message by the message-sending device.
17. The method of claim 12 , wherein, combining one message of the plurality of messages with the authentication key comprises at least one of:
encrypting the one message using the authentication key;
hashing the one message with the authentication key; or
using the authentication key as a seed or parameter to encode the one message using a Message Authentication Code (MAC) algorithm.