Secure communication of network traffic

Abstract

Techniques are disclosed relating to securely communicating traffic. In some embodiments, an apparatus includes a secure circuit storing keys usable to encrypt data communications between devices over a network The secure circuit is configured to store infomation that defines a set of usage criteria for the keys. The set of usage criteria specifies that a first key is dedicated to encrypting data being communicated from a first device to a second device. The secure circuit is configured to receive a request to encrypt a portion of a message with the fast key, the request indicating that the message is being sent from the first device to the second device, and to encrypt the portion of the message with the first key in response to determining that the set of usage criteria permits encryption with the first key for a message being sent from the first device to the second device.

What is claimed is: 
     
         1 . An apparatus, comprising:
 a first electronic control unit (ECU) included in a vehicle and configured to generate a message authentication code (MAC) for a data frame to be transmitted from the first ECU to a second ECU included in the vehicle; and   a first secure circuit coupled to the first ECU, wherein the first secure circuit is configured to encrypt the MAC with a first encryption key; and   wherein the first ECU is configured to transmit the data frame with the encrypted MAC included in the data frame.   
     
     
         2 . The apparatus of  claim 1 , wherein the first ECU is configured to indicate, to the first secure circuit, that the second ECU is a destination of the data frame; and
 wherein the first secure circuit is configured to determine whether to allow encryption of the MAC with the first encryption key based on the indicated destination of the data frame.   
     
     
         3 . The apparatus of  claim 2 , wherein the first secure circuit is configured to:
 store a plurality of encryption keys including the first encryption key;   store a policy that specifies, for ones of the plurality of encryption keys, a respective use and a respective set of associated ECUs, wherein the policy specifies that the first encryption key is to be used for encryption and is associated with a set of ECUs that includes the second ECU; and   determine whether to sign the MAC with the first encryption key based on the stored policy.   
     
     
         4 . The apparatus of  claim 1 , further comprising a network gateway configured to:
 receive a set of keys from via a wireless network interface, wherein the set of keys includes the first encryption key; and   distribute the set of keys to a plurality of secure circuits including the first secure circuit.   
     
     
         5 . The apparatus of  claim 4 , wherein the first secure circuit is configured to:
 after receiving the first encryption key from the network gateway, modify the first encryption key such that the first encryption key is unknown to the network gateway.   
     
     
         6 . The apparatus of  claim 1 , wherein the first secure circuit is coupled to the first ECU via a first interconnect, and wherein the first ECU is configured to transmit the data frame to the second ECU via a second interconnect that is different from the first interconnect. 
     
     
         7 . The apparatus of  claim 1 , wherein the first and second ECUs are further configured to control a respective one or more operations of the vehicle. 
     
     
         8 . A method comprising:
 generating, by a first electronic control unit (ECU) included in a vehicle, a message authentication code (MAC) for a data frame to be transmitted from the first ECU to a second ECU included in the vehicle;   encrypting, by a first secure circuit coupled to the first ECU, the MAC with a first encryption key; and   transmitting, by the first ECU, the data frame with the encrypted MAC included in the data frame.   
     
     
         9 . The method of  claim 8 , further comprising:
 decrypting, by a second secure circuit coupled to the second ECU, the encrypted MAC included in the data frame; and   verifying, by the second ECU, integrity of the data frame using the decrypted MAC.   
     
     
         10 . The method of  claim 8 , wherein encrypting the MAC with the first encryption key includes determining, by the first secure circuit, whether to allow encrypting of the MAC with the first encryption key based on an indication that the second ECU is a destination of the data frame. 
     
     
         11 . The method of  claim 8 , further comprising:
 storing, by the first secure circuit, a plurality of encryption keys including the first encryption key;   storing, by the first secure circuit, a policy that specifies, for ones of the plurality of encryption keys:
 a respective use; and 
 a respective set of associated ECUs; and 
   in response to determining that the policy specifies the first encryption key is to be used for encryption and is associated with the second ECU, signing, by the first secure circuit, the MAC with the first encryption key.   
     
     
         12 . The method of  claim 8 , further comprising:
 receiving, by a network gateway, a set of keys from via a wireless network interface, wherein the set of keys includes the first encryption key; and   distributing, by the network gateway, the set of keys to a plurality of secure circuits including the first secure circuit.   
     
     
         13 . The method of  claim 12 , further comprising:
 after receiving the first encryption key from the network gateway, modifying, by the first secure circuit, the first encryption key such that the first encryption key is unknown to the network gateway.   
     
     
         14 . The method of  claim 8 , further comprising:
 controlling, by the first ECU, a first operation of the vehicle; and   controlling, by the second ECU, a second operation of the vehicle, different from the first operation.   
     
     
         15 . An apparatus, comprising:
 a first electronic control unit (ECU), included in a vehicle, configured to receive, from a second ECU in the vehicle, a data frame including an encrypted message authentication code (MAC); and   a first secure circuit, coupled to the first ECU, configured to decrypt the encrypted MAC included in the data frame using a first encryption key that is stored in the first secure circuit and in a second secure circuit coupled to the second ECU; and   wherein the first ECU is configured to verify integrity of the data frame using the decrypted MAC.   
     
     
         16 . The apparatus of  claim 15 , wherein the first ECU is configured to indicate, to the first secure circuit, that the second ECU is a source of the data frame; and
 wherein the first secure circuit is configured to determine whether to allow decryption of the MAC with the first encryption key based on the indicated source of the data frame.   
     
     
         17 . The apparatus of  claim 15 , wherein the first secure circuit is configured to:
 store a plurality of encryption keys including the first encryption key;   store a policy that specifies, for ones of the plurality of encryption keys, a respective use and a respective set of associated ECUs, wherein the policy specifies that the first encryption key is to be used for decryption and is associated with a set of ECUs that includes the second ECU; and   determine whether to decrypt the MAC with the first encryption key based on the stored policy.   
     
     
         18 . The apparatus of  claim 15 , further comprising a network gateway configured to:
 receive a set of keys from via a wireless network interface, wherein the set of keys includes the first encryption key; and   distribute the set of keys to a plurality of secure circuits including the first secure circuit.   
     
     
         19 . The apparatus of  claim 15 , wherein the first secure circuit is coupled to the first ECU via a first interconnect, and wherein the first ECU is configured to receive the data frame from the second ECU via a second interconnect that is different from the first interconnect. 
     
     
         20 . The apparatus of  claim 15 , wherein the first and second ECUs are further configured to control a respective one or more operations of the vehicle.