BACKGROUND

The present invention relates to systems and methods for securing communications in a vehicle network including, for example, a plurality of vehicle devices communicatively coupled via a controller-area network (CAN) bus.

SUMMARY

In some embodiments, the invention provides system and methods for facilitating secure communications over a vehicle CAN bus with a reduced runtime load on the central processing unit (CPU) and/or the electronic control unit (ECU). This gives the central processor unit an opportunity to perform other tasks without waiting for the dedicated crypto hardware module to finish its operations. In some embodiments, a direct memory access (DMA) module is communicatively coupled to the crypto hardware module and configured to provide data transfer between the crypto hardware module and a memory module (e.g., a system RAM).

In one embodiment, the invention provides a system for secure vehicle communication with a DMA module configured to handle data transfer between a crypto hardware module—such as, for example a Secure Hardware Extension (SHE) module—and a memory module (e.g., a RAM). When the crypto hardware module completes a task of generating and/or validating a message authentication code (MAC), it triggers an input/output request that is sent to the DMA module. The DMA module is configured to move the data from the crypto hardware module to the appropriate location in the RAM in response to the input/output request from the crypto hardware module.

In another embodiment, the invention provides a system for facilitating secured communications in a controller area network for a vehicle system. The system includes a non-transitory computer-readable memory, a first electronic processor, a second electronic processor, and a direct memory access (DMA) module. The first electronic processor is communicatively coupled to the memory and configured to operate one or more vehicle systems. The second electronic processor is configured to generate message authentication codes to verify data communications between the first electronic processor and at least one other vehicle system controller in the controller area network. The direct memory access (DMA) module is configured to facilitate communications between the second electronic processor and the memory. The DMA module is further configured to access message data stored on the memory and to transmit the accessed message data to the second electronic processor. The second electronic processor is configured to generate a first message authentication code based on the message data received from the DMA module and to transmit the generated first message authentication code to the DMA module for storage on the memory.

In some embodiments, the message data is stored to the memory by the first electronic processor and intended to be transmitted to another device on the controller area network. After the message authentication code is generated by the second electronic processor, the message data and the generated message authentication code are both transmitted to the other device via the controller area network so that the receiving device can use the message authentication code to verify the authenticity/security of the message data.

In some embodiments, the message data is stored to the memory along with a received message authentication code that are both received via the controller area network from another device. After a new message authentication code is generated by the second electronic processor based on the received message data, the generated message authentication code is compared to the received message authentication code and the received message data is processed by the first electronic processor only after confirming that the generated message authentication code matches the received message authentication code.

Other aspects of the invention will become apparent by consideration of the detailed description and accompanying drawings.

