Abstract: Embodiments of the present disclosure are directed to methods and systems for providing secure over-the-air firmware updates to one or more vehicles. More specifically, the present disclosure describes applying to firmware images distributed to one or more vehicles encryption that is unique to each update version. The encryption is also unique to each vehicle receiving the update. Embodiments of the present disclosure can also include determining and verifying the integrity of an available OTA firmware update prior to authorizing installation of the firmware update in a vehicle.

Abstract: Embodiments of the present disclosure are directed to a secure vehicle communication interface device that authorizes communication to one or more systems of a vehicle through a diagnostic, or other, communication port. A service device used to access the secure communication channel may be configured as a small apparatus that is connected to a port to authenticate communications across the port. Without the device, the port would remain locked and prevent access to any systems or subsystems of the vehicle.

Abstract: Embodiments of the present disclosure monitor certificates or other credentials loaded to various components and systems of a vehicle. A set of information identifying credentials that are expected to be present and/or in use can be saved. Periodically, on request, or upon the occurrence of an event or condition, checks can be performed on the credentials individually or in the aggregate using the saved information to determine whether the certificates present and/or in use are those expected or if a change has occurred. If a change is detected, i.e., a difference between the current set of certificates and the saved set of information, the network security system can take some action. The action, depending on the nature of the change detected, can vary from recording and/or reporting the condition up to and including isolating or even disabling a particular component or system on which the changed certificate is used.

Abstract: Embodiments of the present disclosure are directed to a secure vehicle communication interface device that authorizes communication to one or more systems of a vehicle through a diagnostic, or other, communication port. A service device used to access the secure communication channel may be configured as a small apparatus that is connected to a port to authenticate communications across the port. Without the device, the port would remain locked and prevent access to any systems or subsystems of the vehicle.

Abstract: Embodiments of the present disclosure are directed to methods and systems for providing secure over-the-air firmware updates to one or more vehicles. More specifically, the present disclosure describes applying to firmware images distributed to one or more vehicles encryption that is unique to each update version. The encryption is also unique to each vehicle receiving the update. Embodiments of the present disclosure can also include determining and verifying the integrity of an available OTA firmware update prior to authorizing installation of the firmware update in a vehicle.

Abstract: Embodiments of the present disclosure monitor certificates or other credentials loaded to various components and systems of a vehicle. A set of information identifying credentials that are expected to be present and/or in use can be saved. Periodically, on request, or upon the occurrence of an event or condition, checks can be performed on the credentials individually or in the aggregate using the saved information to determine whether the certificates present and/or in use are those expected or if a change has occurred. If a change is detected, i.e., a difference between the current set of certificates and the saved set of information, the network security system can take some action. The action, depending on the nature of the change detected, can vary from recording and/or reporting the condition up to and including isolating or even disabling a particular component or system on which the changed certificate is used.

Abstract: When operating these different environments, the infrastructure of and around a vehicle should be secure to prevent unauthorized and possibly malicious access to the vehicle and the systems therein. To obtain this security, the various systems and components of the vehicle can utilize certificates to authenticate and authorize users as well as equipment and/or components interfacing with the vehicle. According to one embodiment, a portable compute device or tool with internet access can be used in any one or more environments to transport certificates used to support secure connectivity for vehicle systems in a state where the vehicle may or may not have immediate internet access. This tool can also provide various service functions in these different environments. These functions can include performing diagnostics, updating firmware images, collecting log and other data from the vehicle, etc.