Secure message system and method of the same
A computer-implemented method that causes data processing hardware to perform operations including generating, at a first device, a message having a header including a message type and a service ID, receiving, at a second device, the message including the header and a key serial number (KSN) of the first device, determining, based on the header, the message type of the message, verifying, at a high performance crypto accelerator (HPCA) of the second device, a message authentication code (MAC) of the message based on the determined message type being the service event, obtaining, based on the KSN from the message, a key slot from a message authentication code table (MACT), identifying, based on the key slot, a key associated with the key slot obtained from the MACT, the key including at least one of a primary key and a secondary key, and verifying, using the key and the key slot obtained from the MACT, the MAC.
1 . A computer-implemented method when executed by data processing hardware causes the data processing hardware to perform operations comprising:
generating, at a first device, a message having a header including a message type and a service identifier (ID), the message type being one of a service discovery and a service event;
receiving, at a secure environment of a second device, the message including the header and a key serial number (KSN) of the first device;
generating, outside of a secure environment of the first device, a KSN/service ID table including storing the KSN and the service ID from the message;
determining, based on the header, the message type of the message;
verifying, at a high performance crypto accelerator (HPCA) of the second device, a message authentication code (MAC) of the message based on the determined message type being the service event;
obtaining, based on the KSN from the message, a key slot from a message authentication code table (MACT);
identifying, based on the key slot, a key associated with the key slot obtained from the MACT, the key including at least one of a primary key and a secondary key; and
verifying, using the key and the key slot obtained from the MACT, the MAC.
2 . The method of claim 1 , wherein determining the message type includes determining that the message type is a service discovery.
3 . The method of claim 1 , wherein generating the KSN/service ID table includes associating an offered service of the message with the KSN of the second device.
4 . The method of claim 3 , wherein verifying the MAC includes determining an error based on the KSN from the message and the stored service ID at the KSN/service ID table.
5 . The method of claim 4 , wherein determining the error includes issuing an error message and terminating the service event.
6 . The method of claim 1 , wherein identifying the key includes executing a key derivation function and generating the secondary key.
7 . A computer-implemented method when executed by data processing hardware causes the data processing hardware to perform operations comprising:
generating, at a first device, a message having a header including a message type and a service identifier (ID), the message type being one of a service discovery and a service event;
receiving, at a secure environment of a second device, the message including the header and a key serial number (KSN) of the first device;
generating, outside of a secure environment of the first device, a KSN/service ID table including storing the KSN and the service ID from the message;
determining, based on the header, the message type of the message;
bypassing, based on the determined message type being the service event, a message authentication code (MAC) generate allow list (MGAL);
comparing, based on the KSN from the message, the service ID from the message with a stored service ID from a message authentication code table (MACT);
validating, based on the service ID matching the stored service ID, the KSN at the MACT;
obtaining, based on the validated KSN, a key slot from the MACT;
identifying, based on the key slot, a key associated with the key slot obtained from the MACT, the key including at least one of a primary key and a secondary key; and
verifying, using the key and the key slot obtained from the MACT, the MAC.
8 . The method of claim 7 , wherein determining the message type includes determining that the message type is a service discovery.
9 . The method of claim 7 , wherein generating the KSN/service ID table includes associating an offered service of the message with the KSN of the second device.
10 . The method of claim 9 , wherein verifying the MAC includes determining an error based on the KSN from the message and the stored service ID at the KSN/service ID table and issuing an error message and terminating the service event.
11 . The method of claim 10 , wherein bypassing the MGAL includes verifying, by a high performance crypto accelerator (HPCA), the service event.
12 . The method of claim 7 , wherein identifying the key includes executing a key derivation function and generating the secondary key.
13 . A secure message system for a vehicle, the secure message system comprising:
data processing hardware; and memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
generating, at a first device, a message having a header including a message type and a service identifier (ID), the message type being one of a service discovery and a service event;
receiving, at a secure environment of a second device, the message including the header and a key serial number (KSN) of the first device;
generating, outside of a secure environment of the first device, a KSN/service ID table including storing the KSN and the service ID from the message;
determining, based on the header, the message type of the message;
verifying, at a high performance crypto accelerator (HPCA) of the second device, a message authentication code (MAC) of the message based on the determined message type being the service event;
obtaining, based on the KSN from the message, a key slot from a message authentication code table (MACT);
identifying, based on the key slot, a key associated with the key slot obtained from the MACT, the key including at least one of a primary key and a secondary key; and
verifying, using the key and the key slot obtained from the MACT, the message authentication code (MAC).
14 . The secure message system of claim 13 , wherein determining the message type includes determining that the message type is a service discovery.
15 . The secure message system of claim 13 , wherein generating the KSN/service ID table includes associating an offered service of the message with the KSN of the second device.
16 . The secure message system of claim 15 , wherein verifying the MAC includes determining an error based on the KSN from the message and the stored service ID at the KSN/service ID table.
17 . The secure message system of claim 16 , wherein determining the error includes issuing an error message and terminating the service event.
18 . The secure message system of claim 13 , wherein identifying the key includes executing a key derivation function and generating the secondary key.