Short-lived symmetric keys for autonomous vehicles

1. A method, comprising:

after a reboot of a vehicle, performing mutual authentication between a first device and a key server located on the vehicle;

after the reboot of a vehicle, performing mutual authentication between a second device and the key server;

storing, by the key server, a cryptographic key in a first volatile memory;

receiving, by the first device and the second device, from the key server, the cryptographic key;

storing, by the first device, the cryptographic key in a second volatile memory of the first device;

storing, by the second device, the cryptographic key in a third volatile memory of the second device;

in response to determining that the cryptographic key has been provisioned to the first device and the second device, discarding, by the key server, the cryptographic key from the first volatile memory;

using, by the first device and the second device, the cryptographic key for symmetric cryptography, comprising one or more of: signing messages transmitted between the first device and the second device and verifying messages transmitted between the first device and the second device; and

clearing data stored in the first volatile memory, the second volatile memory, and the third volatile memory at a further reboot of the vehicle.

2. The method of claim 1 , further comprising accepting a message by the first device from the second device only in response to determining a signature provided with the message can be verified with the cryptographic key.

3. The method of claim 1 , further comprising incrementing a nonce counter for each message received by the first device from the second device, and accepting a received message only in response to determining a nonce value appended to the received message matches the nonce counter.

4. The method of claim 1 , further comprising:

incrementing a nonce counter for each message received by the first device from the second device;

accepting a received message only in response to determining a nonce value appended to the received message is greater than or equal to the nonce counter; and

in response to determining the nonce value appended to the received message is greater than the nonce counter, setting the nonce counter to the nonce value appended to the received message.

5. The method of claim 1 , wherein performing mutual authentication comprises participating in mutual transport layer security authentication with the key server.

6. The method of claim 5 , further comprising:

determining on reboot of the vehicle whether a transport layer security certificate for the first device is valid and unexpired; and

in response to determining the transport layer security certificate is invalid, expired, or within a threshold of expiration, receiving a new certificate from a trusted certificate authority external to the vehicle.

7. The method of claim 1 , wherein the messages transmitted between the first device and the second device are user datagram protocol messages.

8. The method of claim 1 , comprising appending nonce values to messages sent by the first device to the second device.

9. The method of claim 8 , wherein the nonce values are sequential positive integers.

10. The method of claim 9 , further comprising:

maintaining a nonce counter; and

incrementing the nonce counter for each message sent by the first device to the second device.

11. The method of claim 10 , wherein the nonce counter is a 32-bit or 64-bit counter.

12. The method of claim 1 , wherein the cryptographic key is stored in a first key store in the first volatile memory.

13. A vehicle, comprising:

a hardware platform comprising a processor circuit, a memory to store instructions, a volatile memory, and a network interface, wherein the instructions, when executed, cause the processor circuit to:

after a reboot of the hardware platform, perform mutual authentication with a key server, and receive from the key server a symmetric key;

maintain the symmetric key within a volatile-only key store in the volatile memory, wherein the symmetric key is cleared at a further reboot of the hardware platform;

receive via the network interface a message from a sender, wherein the sender is a device on the vehicle;

verify a signature affixed to the message with the symmetric key;

in response to the verification succeeding, accept the message; and

in response to the verification failing, reject the message; and

the key server comprising a further volatile memory, the key server to:

store the symmetric key in the further volatile memory;

provision the symmetric key on the hardware platform and the sender; and

in response to determining the symmetric key has been provisioned to the hardware platform and the sender, discard the symmetric key from the further volatile memory.

14. The vehicle of claim 13 , wherein the instructions are further to increment a nonce counter for each message received from the sender, and accept the message only if a nonce value appended to a received message matches the nonce counter.

15. The vehicle of claim 13 , wherein the message is a user datagram protocol message.

16. The vehicle of claim 13 , wherein the instructions are further to maintain a nonce counter, and incrementing the nonce counter for each message received.

17. A method of provisioning symmetric cryptography keys in a vehicle, comprising:

participating in mutual authentication with a first device of the vehicle;

provisioning a symmetric cryptographic key to the first device;

participating in mutual authentication with a second device of the vehicle;

determining that the second device is expected to communicate with the first device;

provisioning the symmetric cryptographic key to the second device;

storing the symmetric cryptographic key in a volatile memory, wherein the symmetric cryptographic key is cleared at reboot of the vehicle; and

in response to determining that the symmetric cryptographic key has been provisioned to the first device and the second device, discarding the symmetric cryptographic key.

18. The method of claim 17 , further comprising determining that the second device is not expected to communicate with the first device, and provisioning a different symmetric cryptography key to the second device.

19. The method of claim 18 , wherein storing the symmetric cryptographic key in the volatile memory comprises storing the symmetric cryptographic key in a key store in the volatile memory.

20. The method of claim 17 , wherein participating in mutual authentication comprises participating in mutual transport layer security.