What you have, what you know, who you are
Those are the three ways that an unknown person is authenticated and authorized. For humans, "what you have" usually means a physical key or pass card. "What you know" means a password or passphrase. "Who you are" means unique biological data that is difficult to fake or duplicate, such as finger prints, retina, etc.
The digital equivalent of "who you are" is a hash. Hashes are a form of one way compression where a quantity of binary data is put through a hash function resulting in another, much shorter number. Hash functions are designed in such a way that if a single bit of that number changes, there will be large, easy to see differences in the resulting hash. There is only a one bit difference between 8 and 9. The below example shows the large differences that a single bit will bring.
$ echo "01234566789" > 09.txt
$ sha1sum.exe 09.txt
$ echo "01234566788" > 08.txt
$ sha1sum.exe 08.txt
The requirement for these three methods to be secure, in real life and digitally, is that they are extremely difficult to duplicate. Note also, that encryption is used for verification as well as concealment. In this case, encryption will be used to ensure that the AI gestalt installed in the car is authorized to be there.
What the car has
The car has a stamped nameplate with a barcode/QR code of its serial number and certificate of authenticity. The certificate of authenticity contains two thumbprint hashes of the AI's gestalt; one by the manufacturer and one by the certifying authority. It also has a QR code of that AI's public key. In addition, the car will have a FIPS 140-3 cryptographic module for generating hashes of itself and responding to authentication claims. This crypto module will work much the same way as the chip in your debit card. Of necessity, this physical protection must extend to whatever hardware the AI is running on in the car.
What the cops/inspectors have
The cops have a big list of authorized AI gestalts hashes and associated public keys. They have the public keys associated with the private keys that signed the AI gestalts. With the hashes and public keys, they have everything they need to cryptographically verify that the AI gestalt is "who it says it is".
What the certifying authority has
They have a copy of the gestalt (though not the source code that created the gestalt), the manufacturer's hash of the gestalt and manufacturers public keys. They do not get the private keys because that only leads to shenanigans (which this whole complicated expensive process is trying to avoid).
When the certifying authority creates their hash for the gestalt, they will add a salt to the gestalt before hashing. Salting the gestalt before hashing ensures that the gestalt is different from the manufacturer's hash ('cause it doesn't make much sense if the two hashes are the same). Salting also makes it much harder for attackers to recover the certifying authorities private key because to recover the key would require recovering the salt as well as the private key. This is much much harder.
Spot check that the cars crypto module and AI brain are FIPS 140-3 compliant.
What manufacturer has
The car/AI manufacturer has the private key that they use to sign the AI gestalt before installing it in cars. They also produce a hash of the gestalt. Manufacturers go through the same process of salting and hashing the gestalt that the certifying authority does.
They also make sure that the crypto module and AI brains actually are FIPS 140-3 compliant. For each crypto module, they install a new private key.
Buzzword Compliance: Blockchain
As much as I despise buzzwords and handwaving "it'll do magic" tech, there is a valid use case for blockchain tech in this instance. Consider that blockchains are really just big distributed ledgers shared by people who really don't trust each other.
In this case, a blockchain would be built to hold the car specific public keys, the manufacturer and certifying authority public keys, and hashes of certified gestalts. The blockchain becomes the canonical record of who did what and when. This prevents attacks where someone attempts to change a public key sneakily. They can't since the record is immutable. Well, they can change it but that will require enough resources to get a majority on the blockchain. Such a majority will be noticed.
As each new gestalt is published then certified, all the appropriate information about that gestalt is added to the blockchain. Once added, it's permanent.
Authorization Verification Process
This is how things might go
- The cop will scan the name plate of the car for manufacturer, model, manufacturer AI gestalt hash and certifying authority AI gestalt hash.
- The scanner looks up the manufacturer, model and both hashes against the known-good configurations. If all four data points match, then the AI in the car is probably good to go. This is the weakest but fastest verification of the car's AI.
- For stronger verification, the cop will plug in the scanner to a data port on the car. Once connected, the car will respond to a command to encrypt some long really long and randomly generated number with the AI's private key. Since the scanner also has the public key associated with this car, if the crypto module returns a strong that can decrypted with the public key then the cop/scanner knows that the crypto module is genuine. This verification process prevents an attacker from stealing the correct response from authorized hardware and just replaying it back to the scanner. This, in addition to previous verification steps.
- The strongest verification will be to take the car into a shop and examine the crypto module. Since it's FIPS 140-3 compliant, any tampering will be evident and the car will fail inspection. This, in addition to all the previous verification steps.
Since everyone messes up and even strong security systems eventually are compromised, as described, this system does not account for the need for rapid change of public-private keys should they be compromised. Say, someone at the manufacturer or certifying authority fat fingers which key to add to the block chain and they add the private key when it should have been the public key.
There are a thousand ways to break this system and it will take a lot of very careful planning in order to make it very hard, even for nation-states to compromise it. (Ha! Well, that's far far beyond the original threat model but this was fun to write.)
Modern Web Cryptography
Much of the process and crypto primitives described above can also be found in modern web crypto. If you see an 'https' then your browser is using a system of public and private keys to authenticate and authorize the server you're connecting to.
Not yet covered areas
What this process doesn't cover is the data that the AI uses to navigate with. Where that comes from and how it's used is outside the scope of this question.
Attacks on this data would preserve the integrity of the AI but cause errant behavior.