Unified secure automatic ECU provisioning and ECU message validation
A system includes an electronic control unit (ECU) including a processor that determines that the ECU has been communicably connected to a vehicle communication system. The processor sends a provisioning message, via the communication system, to a remote server, responsive to connection to the vehicle communication system. The message includes a vehicle identifier provided by an element of the vehicle system and signed with a unique security key specific to the ECU. The processor is also receives a confirmation response from the remote server and enables further communication for the ECU responsive to the confirmation response.
1. A system comprising:
one or more hardware processors configured to:
receive a provisioning message from a vehicle electronic control unit (ECU), the provisioning message having a signature from being signed by the ECU with a key unique to the ECU;
check the signature of the provisioning message against a set of stored unique keys, to validate that the message is from a known ECU having the unique key and to determine which ECU the message is from based on the unique key;
responsive to validating the signature, determine a vehicle identifier with which the ECU is to be associated, the vehicle identifier included in a message payload;
store a relationship between the ECU and the vehicle identifier in a database such that the ECU is uniquely associated with a specific vehicle identifier;
receive an alert message from the ECU, the message signed by the ECU with the unique key and including a vehicle identifier in a payload;
based on the signature, validate the message and identify the ECU;
extract the vehicle identifier from the payload of the message, responsive to validating and identifying the ECU;
determine if the identified ECU has an existing stored relationship with the vehicle identifier based on information in the database; and
validate the message based on the identified ECU having the existing stored relationship with the vehicle identifier as indicated in the database.
2. The system of claim 1 , wherein the vehicle identifier includes a vehicle identification number (VIN).
3. The system of claim 1 , wherein the payload includes an ECU hardware level or ECU software level.
4. The system of claim 3 , wherein the relationship between the ECU and vehicle identifier is further cross-referenced with ECU characteristics of the ECU, including at least one of the hardware level or software level.
5. The system of claim 1 , wherein the hardware processors are further configured to send a confirmation message to the ECU, responsive to storing the relationship.
6. The system of claim 5 , wherein the confirmation message includes the vehicle identifier identified in the relationship stored by the storing.
7. A method comprising:
receiving a provisioning message from a vehicle electronic control unit (ECU), the provisioning message having a signature from being signed by the ECU with a key unique to the ECU;
checking the signature of the provisioning message against a set of stored unique keys, to validate that the message is from a known ECU having the unique key and to determine which ECU the message is from based on the unique key;
responsive to validating the signature, determining a vehicle identifier with which the ECU is to be associated, the vehicle identifier included in a message payload;
storing a relationship between the ECU and the vehicle identifier in a database such that the ECU is uniquely associated with a specific vehicle identifier;
receiving an alert message from the ECU, the message signed by the ECU with the unique key and including a vehicle identifier in a payload;
based on the signature, validating the message and identify the ECU;
extracting the vehicle identifier from the payload of the message, responsive to validating and identifying the ECU;
determining if the identified ECU has an existing stored relationship with the vehicle identifier based on information in the database; and
validating the message based on the identified ECU having the existing stored relationship with the vehicle identifier as indicated in the database.
8. The system of claim 7 , wherein the vehicle identifier includes a vehicle identification number (YIN).
9. The system of claim 7 , wherein the payload includes an ECU hardware level or ECU software level.
10. The system of claim 9 , wherein the relationship between the ECU and vehicle identifier is further cross-referenced with ECU characteristics of the ECU, including at least one of the hardware level or software level.
11. The system of claim 7 , wherein the processors are further configured to send a confirmation message to the ECU, responsive to storing the relationship.
12. The system of claim 11 , wherein the confirmation message includes the vehicle identifier identified in the relationship stored by the storing.