Cryptographic authentication of components in an electric vessel
According to embodiments of the present disclosure, various methods, apparatuses, and computer program products for cryptographic authentication of components in an electric vessel are described herein. In some aspects, a first device of a plurality of vessel powertrain components receives a first authentication message from a second device of the plurality of vessel powertrain components via a control area network. The first device identifies, based on the first authentication message, an encryption key, a cleartext message, and an encrypted message. The first device authenticates, using the first encryption key, the second device based on the first cleartext message and the first encrypted message.
1 . A method of cryptographic authentication of components in an electric vessel, the electric vessel comprising a plurality of vessel powertrain components, the method comprising:
receiving, by a first device of the plurality of vessel powertrain components, a first authentication message from a second device of the plurality of vessel powertrain components via a control area network;
identifying, by the first device based on the first authentication message, a first encryption key, a first cleartext message, and a first encrypted message; and
authenticating, by the first device using the first encryption key, the second device based on the first cleartext message and the first encrypted message.
2 . The method of claim 1 , wherein authenticating the second device based on the first cleartext message and the first encrypted message using the first encryption key includes:
encrypting, by the first device using the first encryption key, the first cleartext message to generate a second encrypted message; and
determining, by the first device, whether the first encrypted message and the second encrypted message are identical.
3 . The method of claim 1 , wherein authenticating the second device based on the first cleartext message and the first encrypted message using the first encryption key includes:
decrypting, by the first device using the first encryption key, the first encrypted message to generate a second cleartext message; and
determining, by the first device, whether the first cleartext message and the second cleartext message are identical.
4 . The method of claim 1 further comprising:
disabling the vessel in response to determining that the authentication of the second device failed.
5 . The method of claim 1 further comprising:
disabling the vessel in response to failing to receive an authentication message from at least one other device of the plurality of vessel powertrain components.
6 . The method of claim 1 , wherein the first authentication message includes an encryption key index, and wherein the encryption key index indicates one of a plurality of pre-shared encryption keys stored in a local key store.
7 . The method of claim 1 , wherein the first authentication message includes only a portion of the first cleartext message; and
wherein identifying, by the first device based on the first authentication message, a first encryption key, a first cleartext message, and a first encrypted message includes:
reconstructing, using a shared encoding/decoding mechanism, the first cleartext message from the portion of the first cleartext message included in the first authentication message.
8 . The method of claim 1 , wherein the first authentication message includes only a portion of the first encrypted message; and
wherein identifying, by the first device based on the first authentication message, a first encryption key, a first cleartext message, and a first encrypted message includes:
reconstructing, using a shared encoding/decoding mechanism, the first encrypted message from the portion of the first encrypted message included in the first authentication message.
9 . The method of claim 1 further comprising:
selecting randomly, by the first device, a second encryption key from a plurality of pre-shared keys stored in a local key store, the second encryption key being associated with a second encryption key index;
encrypting, by the first device, a second cleartext message to generate a third encrypted message;
selecting, by the first device based on a shared encoding/decoding mechanism, a portion of the second cleartext message and a portion of the third encrypted message; and
transmitting, by the first device, a second authentication message including the second encryption key index, a portion of the second cleartext message, and a portion of the third encrypted message, to any other device among the plurality of vessel powertrain components.
10 . The method of claim 1 , wherein two or more of the plurality of vessel powertrain components periodically exchange authentication messages.
11 . The method of claim 1 , wherein the plurality of vessel powertrain components includes a vessel control unit, one or more high voltage battery units, a power distribution unit, and an electric marine propulsion device.
12 . The method of claim 1 , wherein the first device and the second device are a pair of devices that includes a vessel control unit a battery management system of a high voltage battery unit.
13 . An apparatus for cryptographic authentication of components in an electric vessel, the apparatus comprising:
a processor disposed in a first device of the electric vessel;
a memory storing computer program instruction that, when executed by the processor, cause the processor to:
receive, by the first device of a plurality of vessel powertrain components, a first authentication message from a second device of the plurality of vessel powertrain components via a control area network;
identify, by the first device based on the first authentication message, a first encryption key, a first cleartext message, and a first encrypted message; and
authenticate, by the first device using an encryption key, the second device based on the first cleartext message and the first encrypted message.
14 . The apparatus of claim 13 , wherein authenticating, by the first device using an encryption key, the second device based on the first cleartext message and the first encrypted message includes one of:
encrypting, using the first encryption key, the first cleartext message to generate a second encrypted message and determining whether the first encrypted message and the second encrypted message are identical; and
decrypting, using the first encryption key, the first encrypted message to generate a second cleartext message and determining whether the first cleartext message and the second cleartext message are identical.
15 . The apparatus of claim 13 , wherein the computer program instructions, when executed by the processor, cause the processor to:
disable the vessel in response to determining that the authentication of the second device failed.
16 . The apparatus of claim 13 , wherein the computer program instructions, when executed by the processor, cause the processor to:
disable the vessel in response to failing to receive an authentication message from at least one other device of the plurality of vessel powertrain components.
17 . The apparatus of claim 13 , wherein the first authentication message includes only a portion of the first encrypted message; and wherein identifying, by the first device based on the first authentication message, a first encryption key, a first cleartext message, and a first encrypted message includes:
reconstructing, using a shared encoding/decoding mechanism, the first cleartext message from the portion of the first cleartext message included in the first authentication message; and
reconstructing, using a shared encoding/decoding mechanism, the first encrypted message from the portion of the first encrypted message included in the first authentication message.
18 . The apparatus of claim 13 , wherein the computer program instructions, when executed by the processor, cause the processor to:
select randomly, by the first device, a second encryption key from a plurality of pre-shared keys stored in a local key store, the second encryption key being associated with a second encryption key index;
encrypt, by the first device, a second cleartext message to generate a third encrypted message;
select, by the first device based on a shared encoding/decoding mechanism, a portion of the second cleartext message and a portion of the third encrypted message; and
transmit, by the first device, a second authentication message including the second encryption key index, a portion of the second cleartext message, and a portion of the third encrypted message, to any other device among the plurality of vessel powertrain components.
19 . The apparatus of claim 13 , wherein the second device is a high voltage battery.
20 . A computer program product comprising:
a set of one or more computer readable storage media; and
computer program instructions, collectively stored in the set of one or more storage media, that when executed cause a processor to perform computer operations comprising:
receiving, by a first device of a plurality of vessel powertrain components, a first authentication message from a second device of the plurality of vessel powertrain components via a control area network;
identifying, by the first device based on the first authentication message, a first encryption key, a first cleartext message, and a first encrypted message; and
authenticating, by the first device using the first encryption key, the second device based on the first cleartext message and the first encrypted message.