Time-based encryption key derivation

1. An apparatus, comprising:

a first circuit having a local clock configured to maintain a local time value, wherein the first circuit is configured to:

apply a determined offset to a current local time value to determine a synchronized time value, wherein the synchronized time value is an expected time value of a reference clock, and wherein the offset is determined using previously received synchronization communications;

generate a first encryption key by calculating a key derivation function based on the synchronized time value;

encrypt a portion of a packet using the first encryption key, wherein the portion of the packet is to be communicated to a second circuit; and

provide the synchronized time value used to generate the first encryption key for inclusion in the packet.

2. The apparatus of claim 1 , further comprising:

a first network node coupled to the first circuit, wherein the first network node is configured to:

communicate the packet to a second network node coupled to the second circuit; and

include the synchronized time value in the packet as a packet identifier usable by the second circuit to validate the packet.

3. The apparatus of claim 2 , wherein the first circuit is configured to:

generate a second encryption key for the first network node by calculating a key derivation function based on the synchronized time value; and

provide the second encryption key to the first network node, wherein the first network node is configured to encrypt of a payload of the packet using the second encryption key.

4. The apparatus of claim 1 , wherein calculating the key derivation function includes encrypting the synchronized time value using a different encryption key that has a longer validity period than a validity period of the first encryption key.

5. The apparatus of claim 4 , wherein the first circuit is configured to receive the different encryption key from a source that is external to the first circuit.

6. The apparatus of claim 4 , wherein calculating the key derivation function includes:

generating a random value using a random number generator; and

encrypting the synchronized time value and the random value using the different encryption key to generate the first encryption key.

7. The apparatus of claim 6 , wherein the first circuit is configured to:

determine, based on the local clock, that the first encryption key has expired;

in response to the first encryption key expiring, generate a subsequent encryption key using the different encryption key to encrypt another synchronized time value and the random value; and

encrypt a portion of a different packet using the subsequent encryption key, wherein the portion of the different packet is to be communicated to the second circuit.

8. The apparatus of claim 1 , wherein the first circuit is configured to:

receive, from a third circuit, an encrypted portion of a different packet having a synchronized time value included by the third circuit; derive a key based on the included synchronized time value; and

use the derived key to decrypt the encrypted portion of the different packet.

9. A non-transitory computer readable medium having program instructions stored therein that are executable by an apparatus to cause the apparatus to perform operations comprising:

maintaining, by a first circuit of the apparatus, a local time value in a local clock;

determining a synchronized time value by applying a determined offset to the local time value, wherein the synchronized time value is an expected time value of a reference clock, and wherein the offset is determined using previously received synchronization communications;

generating a first encryption key by calculating a key derivation function based on the synchronized time value;

encrypting a portion of a packet using the first encryption key, wherein the portion of the packet is to be communicated to a second circuit; and

providing the synchronized time value used to generate the first encryption key for inclusion in the packet.

10. The computer readable medium of claim 9 , wherein calculating the key derivation function includes encrypting the synchronized time value using a different encryption key that has a longer validity period than a validity period of the first encryption key.

11. The computer readable medium of claim 10 , wherein the operations further comprise:

receiving the different encryption key from a source that is external to the first circuit.

12. The computer readable medium of claim 10 , wherein calculating the key derivation function includes:

generating a random value using a random number generator; and

encrypting the synchronized time value and the random value using the different encryption key to generate the first encryption key.

13. The computer readable medium of claim 9 , wherein the operations further comprise:

communicating, by a first network node coupled to the first circuit, the packet to a second network node coupled to the second circuit; and

including, by the first network node, the synchronized time value in the packet as a packet identifier usable by the second circuit to validate the packet.

14. A method, comprising:

maintaining, by a local clock of a first circuit, a local time value;

determining, by the first circuit, a synchronized time value by applying a determined offset to the local time value, wherein the synchronized time value is an expected time value of a reference clock, and wherein the offset is determined using previously received synchronization communications;

generating, by the first circuit, a first encryption key by calculating a key derivation function based on the synchronized time value;

encrypting, by the first circuit, a portion of a packet using the first encryption key, wherein the portion of the packet is to be communicated to a second circuit; and

providing, by the first circuit, the synchronized time value used to generate the first encryption key for inclusion in the packet.

15. The method of claim 14 , further comprising:

communicating, by a first network node coupled to the first circuit, the packet to a second network node coupled to the second circuit; and

including, by the first network node, the synchronized time value in the packet as a packet identifier usable by the second circuit to validate the packet.

16. The method of claim 15 , wherein the first network node is an electronic control unit (ECU) configured to control a system of a vehicle.

17. The method of claim 15 , further comprising:

generating, by the first circuit, a second encryption key for the first network node by calculating a key derivation function based on the synchronized time value; and

providing, by the first circuit, the second encryption key to the first network node, wherein the first network node is configured to encrypt of a payload of the packet using the second encryption key.

18. The method of claim 14 , wherein the reference clock is monotonic.

19. The method of claim 14 , wherein calculating the key derivation function includes encrypting the synchronized time value using a different encryption key that has a longer validity period than a validity period of the first encryption key.

20. The method of claim 19 , wherein calculating the key derivation function includes:

generating a random value using a random number generator; and

encrypting the synchronized time value and the random value using the different encryption key to generate the first encryption key.