CN111200498B

CN111200498B - Verification of data packets in a motor vehicle

Info

Publication number: CN111200498B
Application number: CN201911133725.7A
Authority: CN
Inventors: C.布罗克豪斯
Original assignee: Robert Bosch GmbH
Current assignee: Robert Bosch GmbH
Priority date: 2018-11-20
Filing date: 2019-11-19
Publication date: 2024-05-03
Anticipated expiration: 2039-11-19
Also published as: CN111200498A; DE102018219868A1

Abstract

Verification of data packets in a motor vehicle. The invention relates to a method (100) for verifying the authenticity of data packets exchanged by members of a communication network (30), in particular control devices (5, 10, 15, 20, 25), of a motor vehicle via the communication network (30), wherein in particular a verification controller (50) is provided, which is constructed and arranged to detect a communication via the communication network (30), having the following steps: -determining (120) an identifier, data, signature from a data packet transmitted via the communication network (30), -verifying (130) the authenticity of the data packet by checking the signature by means of a public key, -providing (140) the result of the verification, and-sending (150) the result as a reaction to a challenge by a member of the communication network (30).

Description

Verification of data packets in a motor vehicle

Technical Field

The invention includes a method for verifying the authenticity of a data packet transmitted by a member of a communication network of a motor vehicle and a verification controller.

Background

In the automotive field, electronic control devices are increasingly used nowadays. These control devices form a control device complex. The control devices exchange information, data or signals via a communication bus, for example a CAN bus. The plurality of control devices communicate with each other. Some control devices send data packets that are important to a plurality of the remaining control devices, for example, the state of charge is important to the inverter and to the engine controller. In order to check for a possible undesired manipulation of a communication, for example a possible undesired tampering of the communication by means of manipulated information or control instructions, it is known to encrypt the communication. However, encryption results in an increase in the required bandwidth.

Disclosure of Invention

The method according to the invention for verifying the authenticity of a data packet exchanged, in particular transmitted, preferably sent, by a member of a communication network of a motor vehicle via the communication network comprises at least the method steps listed below, wherein the data packet comprises an identifier, data and a signature. And wherein preferably the signature is generated by the sender by means of a private key based on the data to be transmitted and the identifier. Preferably, the data packets are not encrypted. Advantageously: the method can be applied even if only a part of the control devices is extended with the possibility of checking the query Ü berpr u fungsanfrage.

According to the invention, it is proposed that: in one method step, the determination of the identifier, data, signature is performed from a data packet transmitted via the communication network.

According to the invention, it is proposed that: in one method step, the authenticity of the data packet is verified by means of a signature using a public key. The signature is formed by the sender by means of a private key from the data to be transmitted and the identifier.

It is also proposed that: providing the result of the verification.

According to the invention, it is also proposed that: in one method step, the transmission of the result is performed in response to a query, in particular a check query of a member of the communication network.

In the method according to the invention, it is advantageous that: in particular forgery or manipulation can be identified and/or only a small additional load of communication, in particular bandwidth, is required and/or the method can be applied to the entire topology. The method can also be applied, in particular retrofitted, in an already existing control device complex. Furthermore, no or only minimally higher demands are made on the processor performance of the control device.

Advantageous developments and improvements of the method specified in the independent claims result from the measures recited in the dependent claims.

Advantageously: the data package consists of data, an identifier and a signature, wherein the signature is created from the identifier and the data by means of a private key. The data packets are organized by the transmitting control device and transmitted by means of a communication network. The signature is created by the sending control device.

One possible embodiment is characterized in that: the authenticity of the data packet is verified through additional use of the data and/or identifier. A still more accurate statement may also be made in terms of authenticity.

One possible development is characterized by the following method steps: the results of the verification, in particular the inspection, are provided by storing the results in a data store, in particular a ring store (RINGSPEICHER). Thus, these results can also be accessed at a later point in time.

Also conceivable are: the result of the verification is provided and sent encrypted and/or signed. The signature is performed by means of a private key. These results cannot be manipulated by themselves.

One possible embodiment is characterized in that: a pseudo-unique identifier is generated and exists for each data packet. An identification of each data is given.

The invention also relates to a verification controller for a communication network of a motor vehicle. The authentication controller has a communication interface that is connectable to a communication network of the motor vehicle. The communication interface is constructed and arranged to: data packets exchanged, in particular transmitted, via the communication network are read out, in particular together. Advantageously: the authentication controller is constructed and arranged to implement the method according to the invention.

The communication network is in particular designed as a communication bus, in particular as a CAN, LIN, MOST, FLEXRAY or IP-based network.

One possible embodiment is characterized in that: providing a processing device configured and arranged to: the identifier and the data are determined from the signature contained in the data packet in accordance with the public key. The processing device is also constructed and arranged to: the data packet is verified with respect to authenticity and the result of the verification is provided to a member of the communication network. Preferably, the processing device is designed as a computing unit, in particular as a microcontroller or microprocessor.

One possible extension is: the communication interface is constructed and arranged to: these results are transmitted, in particular, by the member of the control device complex, in particular by the query of a control device, and are preferably transmitted in an encrypted manner. The communication interface is also constructed and arranged to read and receive data packets transmitted via the communication network together.

Drawings

The invention is described hereinafter with reference to the accompanying drawings. In the drawings:

FIG. 1 shows a control device complex without an authentication controller according to the present invention;

FIG. 2 shows a control device complex with an authentication controller according to the present invention;

fig. 3 shows a method according to the invention; and

Fig. 4 to 7 show the flow of the method according to the invention with a simplified control device complex as an example.

Detailed Description

The control device complex 1 is composed of a plurality of electronic control devices. Increasingly, each component has a control device, in particular an engine control device, ABS, window lifter or the like. The control device has communication means, whereby the control device can communicate with other control devices, in particular by means of a communication network, preferably a communication bus.

The control device combinations comprising which control devices depend on the type of equipment and/or drive of the motor vehicle, in particular internal combustion engines, fuel cell engines, hybrid engines, plug-in hybrid engines, electric motors.

Fig. 1 shows a part of a control device arrangement 1 of an electrically driven motor vehicle, for example. The control devices 5, 10, 15, 20, 25 of the control device complex 1 responsible for the drive are shown by way of example. The control device shown shows only an exemplary part of a control device combination 1 of a motor vehicle, in particular of a motor vehicle. The control device complex 1 shown comprises:

An engine control device 5 for actuating a drive, in particular an electric drive and/or an internal combustion engine of the motor vehicle.

An inverter 10 or a converter having the following tasks: the multiphase alternating voltage, in particular the three-phase alternating voltage, of the generator is converted into a direct voltage for charging the electrical energy store. In the reverse case, the direct voltage of the electric accumulator is converted into a multiphase alternating voltage when the electric motor is driven. The inverter has other tasks such as converting voltage or current. Preferably, the drive motor also acts as a generator at the same time, and vice versa. Correspondingly, the inverter must also convert the electrical energy generated, for example, during deceleration, so that this electrical energy can be fed into the electrical energy store. The electric energy store is an electrochemical-based rechargeable store for electrical energy. The electrical accumulator comprises at least one battery cell. Preferably, the battery cell is a rechargeable memory element, in particular a storage battery, preferably a secondary element or a secondary battery.

The BDU 15, battery disconnect unit (battery pack disconnection unit), regulates electrical switches, such as relays or transistors, which interrupt and/or open the current supply and current consumption of the electrical energy store.

The BCU 20, battery control unit (battery control unit), takes over the calculation of parameters of the energy store, such as the state of charge, the state of the energy store, etc.

CSC 25, cell supervision circuit (battery monitoring circuit), undertakes data detection of the energy store data, such as the battery voltage, the current and/or the temperature of the individual batteries or of the entire energy store.

The plug-in hybrid control device combination 1 comprises, for example, the following control devices: a motor control device, a transmission control device, an exhaust gas aftertreatment control device, a battery pack management control device, an internal combustion engine control device, and the like.

The individual control devices 5, 10, 15, 20, 25 are connected to each other via a communication network 30. The communication network 30 is in particular a wireless network or a wired network. In particular, it relates to a communication bus, preferably a MOST bus, a CAN bus, a LIN bus, a FlexRay bus. The communication network 30 may also be IP based. The individual control devices 5, 10, 15, 20, 25 exchange data packets by means of a communication network 30. These data packets include, inter alia, data, such as measurement data and/or control instructions, power requirements, energy calls, status information, etc.

An example of the communication of the control device complex 1 according to fig. 1 shown in fig. 1 may be. The CSC 25 periodically detects data of the accumulator, such as voltage, current and temperature, and communicates these data via the communication network 20. The BCU 20 periodically calculates the state of charge, state of health and possibly the power that can be invoked of the battery pack. The BCU 20 transmits this information to the BDU 15 and the engine control apparatus 5. At the beginning of the drive cycle, the BDU 15 has already performed the precharge and has closed the electrical switch, in particular the relay. The torque request for the drive motor is sent via the communication network 30, for example because the vehicle should be moved from a stationary state. In this regard, the BCU reports the callable power. The inverter 10 calculates what torque can be applied to the drive motor. The engine control device 5 operates the drive motor with corresponding power. In this case, the engine control device 5 accesses the data of the BCU 20, CSC 25.

The entire communication takes place via the communication network 30. It becomes apparent in this example that: the control devices 5, 10, 15, 20, 25 communicate with each other and exchange data packets. In the case of the known control device complexes, the control devices 5, 10, 15, 20, 25 communicate with one another without checking whether the forwarded data packets are transmitted by an authorized control device. The checking in the individual control devices may in particular increase the demands on the computational performance of the control devices.

In fig. 2, the same control device complex 1 as in fig. 1 is shown. The control device complex 1 is extended by members that can implement the method, in particular the authentication controller 50 according to the invention.

The authentication controller 50 enables checking of data packets sent via the communication network 30 with respect to accuracy and authenticity. The verification controller enables, for example, an identification of an impermissible commissioning, in which a manipulated data packet, for example, representing a high accumulator power, is transmitted, whereby the engine control device calls more power from the accumulator. Disallowed debugging may be done by changing the software controlling the device, by manipulating the data packets or sending the data packets with the content being manipulated.

Disallowed debugging may result in: more energy is retrieved from the electrical energy store than the electrical energy store can provide without damage. Sensor data packets can also be falsified, for example, in order to reach a higher state of charge of the battery pack. Such commissioning measures are mostly at the expense of the service life of the electrical energy store or other components of the motor vehicle.

The authentication controller 50 is constructed and arranged to implement the method 100 according to the present invention.

In fig. 3 a flow chart of a method 100 according to the invention is shown. The method 100 comprises a plurality of method steps, the order of which may be interchanged.

In a method step 110, the communication via the communication network 30 is monitored. Monitoring of the communication includes, inter alia, reading data packets sent via the communication network 30 together. The data packets sent via the communication network 30 are received by the authentication controller 50. Especially in bus systems, the data packets are also sent to members of the bus system which do not need the individual data packets of the data packets at all. The member identifies, in particular, from the sender and/or receiver and/or identifier and/or data of the data packet, whether the data packet is specific to said member.

In a method step 120, a signature and/or data and/or identifier and/or sender is determined from the received data packet.

The signature is preferably created by the sender by means of a private key from the identifier and the data. Preferably, an asymmetric cryptographic system. A signature is a value calculated by means of a private key, in particular a secret key. The private key is fixedly assigned to the sender, i.e. the control device. A private key is assigned to each control device since shipment. Learning is performed by a diagnostic service that is protected in the factory. Each individual control device obtains its own private key. Advantageously, only the control device in which the data packet has to be checked with respect to authenticity has to be extended for this function. This is for example a safety-relevant control device and/or a control device that is important for the drive.

In a method step 130, the authenticity of the data packet is determined by means of the signature and the public key.

Preferably, the verification is performed by means of data and/or an identifier, a signature and a public key. The determination corresponds to authentication of the signature by means of a public key.

In method step 140, the result of the verification 130 is provided. This provision may be realized in particular by means of transmission via the communication network 30 and/or as storage in a data memory. The result of the verification 130 is stored in a data memory, in particular a ring memory, together with the identifier of the data packet.

In an optional method step 145, a query of the control device is detected with respect to the authenticity of the data packet.

In a method step 150, the result is transmitted as a reaction to the detected, in particular received, inquiry, which inquiry has been transmitted by a member of the communication network 30, in particular the control device. The query comprises in particular an identifier of the data packet. Preferably, the authentication controller 50 extracts the result of the authentication from the data storage. To determine the correct result, the data memory is searched for an identifier and the associated result is read out. The data store is in particular a database or a table.

Preferably, the result of the verification is sent encrypted to the querying control device.

The control device may send a challenge to the authentication controller 50 and obtain information about the authenticity of the data packet. The query includes an identifier of the data packet whose authenticity and/or accuracy is queried.

In fig. 4 a fragment of the control device complex 1 is shown. The fragment includes the authentication controller 50, BCU 20 and CSC 25. The method 100 according to the invention should be explained with reference to the following examples and figures 4 to 7.

The CSC 25 detects measurement data of the electric accumulator such as voltage, current and temperature. For example, the CSC 25 detects that the accumulator provides a voltage of 400V and a current of 50A. The CSC 25 also detects, for example, that the accumulator has a temperature of 30 ℃. For transmitting the data, the control device, here the CSC 25, generates a pseudo-unique identifier. The generated identifier is 488213, for example.

The signature is determined from the data (here the measurement data), the identifier and the private key. The signature determined is, for example, 0XB1F4D32. The measurement data, signature and identifier are collected in a data packet and transmitted, in particular sent, by means of a communication network. In particular, the data packets are transmitted to the BCU 20 via a communication network, in particular a bus system.

In fig. 5, the BCU 20 and other control devices receive data packets that have been sent onto the communication network. The BCU 20 receives the data packet with the data, identifier and signature. If the data is important to the BCU, the BCU processes the data.

The control device may extract this data and directly process it further. Alternatively and/or additionally, the control device may allow for checking authenticity by verifying the controller 50 and/or the method 100.

The authentication controller 50 receives the data packet. The authentication controller 50 has also received the data packet by detecting, in particular together with reading, the communication of the communication network. To this end, the authentication controller monitors the communication network 30 according to method step 110.

In method step 120, a signature, data, identifier and/or sender is determined from the received data packet.

In a method step 130, the authenticity of the data packet is verified by means of the public key. The data package is verified in dependence of, inter alia, the data and/or the identifier, signature and public key. It may be determined, in particular by the authentication controller 50: whether the data is authentic or whether the data packet is sent by an authorized control device. The verification controller 50 receives the same data and checks the validity of the measurement data and the identifier by means of the public key of the CSC 25.

In a method step 140, the result of the check is provided, in particular stored, together with the identifier. In particular, the result is stored in a data memory, preferably in a ring buffer, together with the identifier.

Often, but not necessarily, in every data packet, the control device, here illustratively the BCU 20, requests the result of the verification using the description of the identifier at the time of verification of the control 50. Fig. 6 shows such a query by way of example.

The verification control 50 sends the result back to the control device that has requested the check, according to method step 150 and fig. 7. The communication is preferably carried out, in particular, encrypted and/or signed, only between the BCU 20 and the authentication control 50. The necessary keys are programmed in the factory. In case the check is more negative, the BCU 20 can take corresponding measures.

The method 100 may also be implemented by an already existing control device of the control device complex 1. The control devices required for this need only be constructed and set up to implement method 100. The control device preferably requires a processing unit, in particular a microcontroller or microprocessor, which is designed and designed to carry out the method 100 according to the invention.

According to one embodiment of the invention, only certain data packets have to be protected by the method 100. In particular, not all packets must be validated by the method 100. The data packets to be protected are specified in the system design, for example safety-related data, drive-related data or data which, in the case of manipulation, may lead to damage. Preferably, information for authentication may be transmitted in addition to the data packet that is normally transmitted.

According to one embodiment, only certain data packets have to be checked, in particular verified 130. The checking of authenticity is optional. Thereby, the calculation performance in the authentication controller 50 can be reduced.

For the reduction, the frequency of the checking can be reduced and the verification, i.e. the method steps starting from 120, can be performed, for example, every second or every 10 seconds. The selected delay is not allowed to cause security risks.

Preferably, a temporal, message-related or control-device-related limitation may be performed. Therefore, the number of times of verification can be reduced.

The proposed method 100 extends the possibilities of simultaneously verifying important data packets while enabling a flexible control device architecture.

Claims

1. Method (100) for verifying the authenticity of data packets exchanged by members of a communication network (30) of a motor vehicle via the communication network (30), wherein a verification controller (50) is provided, which is constructed and arranged to detect a communication via the communication network (30), the method having the following steps:

-determining (120) an identifier, data, signature from a data packet transmitted via the communication network (30),

Verifying (130) the authenticity of the data package by checking the signature by means of a public key,

Providing (140) the result of said verification, and

-Sending (150) the result as a reaction to a query by a member of the communication network (30),

The method comprises the following steps:

a pseudo-unique identifier is generated for each data packet.

2. The method (100) according to claim 1, wherein the member of the communication network (30) is a control device (5, 10, 15, 20, 25).

3. The method (100) according to any of the preceding claims 1 to 2, wherein the data packet consists of data, an identifier and a signature, wherein the signature is created from the identifier and the data by means of a private key.

4. The method (100) according to one of the preceding claims 1 to 2, wherein the providing (140) comprises storing the result of the verification in a data storage.

5. The method (100) of claim 4, wherein the data store is a ring store.

6. The method (100) according to one of the preceding claims 1 to 2, characterized in that the result is provided and transmitted encrypted and/or signed.

7. Authentication controller (50) for a communication network (30) of a motor vehicle, having a communication interface which can be connected to the communication network (30) of the motor vehicle and which is constructed and arranged to read out data packets transmitted via the communication network (30), characterized in that the authentication controller (50) is constructed and arranged to carry out a method (100) according to one of the preceding claims.

8. Authentication controller (50) according to claim 7, characterized in that processing means are provided, which are structured and arranged to authenticate the authenticity of a data packet by means of a public key and to provide the result of the authentication to a member of the communication network (30).

9. Authentication controller (50) according to one of the claims 7 to 8, characterized in that the communication interface is constructed and arranged to send the result.

10. The authentication controller (50) of claim 9, wherein the result is sent upon interrogation of a member.

11. The authentication controller (50) of claim 9, wherein the result is sent encrypted.