Over-The-Air (OTA) Update for Firmware of a Vehicle Component

Abstract

Executable code is part of an over-the-air (OTA) update received by, for example, a computing device in a vehicle. In one example, the update is a secure over-the-air (SOTA) update of software that is stored in firmware of a vehicle component (e.g., firmware stored in memory of a storage device or a boot device that are mounted in a vehicle).

What is claimed is: 
     
         1 . An apparatus comprising:
 a communication interface;   at least one controller; and   memory containing instructions configured to instruct the at least one controller to:
 detect a malfunction of the controller; 
 in response to detecting the malfunction, send at least one communication, via the communication interface, to a computing device to request a first update, the communication including at least one desired characteristic; 
 receive the first update from the computing device, wherein the first update corresponds to the desired characteristic; 
 determine authenticity of the first update; and 
 in response to determining authenticity of the first update, update a configuration of the controller using the first update, wherein updating the configuration comprises modifying at least one action performed by the controller. 
   
     
     
         2 . The apparatus of  claim 1 , further comprising a sensor, wherein the instructions are further configured to instruct the at least one controller to:
 store a computer model;   provide data from the sensor as an input to the computer model; and   determine, based on an output from the computer model, the desired characteristic.   
     
     
         3 . The apparatus of  claim 2 , wherein the instructions are further configured to instruct the at least one controller to train, using the first update, the computer model. 
     
     
         4 . The apparatus of  claim 1 , wherein the computing device collects and stores data from sensors of vehicles, and the first update includes the data from the sensors of the vehicles. 
     
     
         5 . The apparatus of  claim 1 , wherein determining authenticity of the first update comprises calculating a digest using a message authentication code. 
     
     
         6 . The apparatus of  claim 5 , wherein the first update and a secret key are inputs to the message authentication code, and wherein the secret key is stored in the controller. The apparatus of  claim 1 , wherein the controller is an application controller for a vehicle, and receiving the first update comprises receiving an over-the-air update of the first update. 
     
     
         8 . The apparatus of  claim 1 , further comprising a boot device, wherein the first update is firmware, and the received first update is stored on the boot device. 
     
     
         9 . The apparatus of  claim 1 , wherein the received first update is stored in system memory of the controller. 
     
     
         10 . The apparatus of  claim 1 , wherein the instructions are further configured to instruct the at least one controller to:
 control at least one function of a vehicle; and   prior to receiving the first update from the computing device, authenticate a user of the vehicle;   wherein the first update is received from the computing device in response to authenticating the user.   
     
     
         11 . The apparatus of  claim 1 , wherein the controller is an application controller, and the instructions are further configured to instruct the controller to:
 prior to receiving the first update from the computing device, load boot code to the application controller.   
     
     
         12 . An apparatus comprising:
 a sensor;   memory; and   a controller configured to:
 provide data from the sensor as an input to a computer model stored in the memory; 
 determine, based on an output from the computer model, at least one desired characteristic; 
 detect a malfunction; 
 in response to detecting the malfunction, request a first update from at least one server, wherein the requesting includes sending the desired characteristic to the server; 
 receive, by a wireless transmission from the server, the first update, wherein the first update corresponds to the desired characteristic; and 
 update firmware using the received first update, wherein updating the firmware modifies at least one action performed during execution of the firmware. 
   
     
     
         13 . The apparatus of  claim 12 , wherein the controller is further configured to:
 determine whether to accept the first update; and   in response to determining to accept the first update, train the computer model using the first update.   
     
     
         14 . The apparatus of  claim 12 , wherein the controller is further configured to:
 determine a cryptographic measurement of the first update; and   determine, based on the cryptographic measurement, whether to accept or reject the first update;   wherein the firmware is updated in response to determining to accept the first update.   
     
     
         15 . The apparatus of  claim 14 , wherein the controller is further configured to train the computer model using the first update. 
     
     
         16 . The apparatus of  claim 12 , wherein the controller is further configured to, in response to determining to accept the first update, copy the first update to system memory of the controller. 
     
     
         17 . The apparatus of  claim 12 , wherein a cryptographic measurement is determined by a cryptographic engine of the controller, and wherein the controller is further configured to:
 prior to determining the cryptographic measurement, receive a data value from a boot device, and store the data value in the memory.   
     
     
         18 . The apparatus of  claim 12 , wherein the first update includes a software update, and wherein the controller is further configured to, in response to determining to accept the first update, discard a previously-received software update. 
     
     
         19 . A system comprising:
 at least one controller of a first vehicle; and   memory containing instructions configured to instruct the at least one controller to:
 provide data from a sensor of the first vehicle as an input to a computer model; 
 determine, based on an output from the computer model, at least one desired characteristic; 
 send the desired characteristic to a first server; 
 request a first update from the first server, wherein the first server collects and stores data from sensors of vehicles other than the first vehicle; 
 receive, via wireless transmission, the first update from the first server, wherein the first update corresponds to the desired characteristic; 
 determine a cryptographic measurement of the first update; 
 determine, based on the cryptographic measurement, whether to accept or reject the first update; and 
   in response to determining to accept the first update, train, using the first update, the computer model.   
     
     
         20 . The system of  claim 19 , wherein the cryptographic measurement is determined by a cryptographic engine, and wherein the controller is further configured to, prior to determining the cryptographic measurement, receive a data value from a boot device, and store the data value in memory. 
     
     
         21 . The system of  claim 19 , wherein the controller is further configured to detect a malfunction, wherein the first update is requested in response to detecting the malfunction. 
     
     
         22 . The system of  claim 19 , wherein the controller is further configured to, in response to determining to reject a second update, update at least a portion of software stored in system memory. 
     
     
         23 . The system of  claim 19 , wherein a computer program corresponding to the first update is stored in system memory, and wherein the controller is further configured to, in response to determining to accept the first update, execute the computer program.