DE102013225755A1 - A method for time-limited release of access of an external device to data in a vehicle, and device therefor - Google Patents

Abstract

A method for the time-limited release of access of an external device to data in a vehicle or to a function, in particular a programming function, of a vehicle is presented. Here, the vehicle receives a release code for the release, which includes time information. The release code is processed in the vehicle and access to the data or function is released to the external device for a limited period of time determined based on the time information of the release code.

Description

Technical area

The present invention relates to the access of external devices to sensitive vehicle data or functions.

State of the art

In a vehicle, the prior art has a number of functions that may be accessed only protected. This concerns for example a programming of data or code or the reading of special data, which should not be publicly accessible. According to the prior art, this process is usually applied, for example, seed-and-key method, as described for example in the US 2013/0111582 A2 are described. With such methods, a cryptographically secured, but temporally unlimited access to data in a vehicle is possible.

Disclosure of the invention

By contrast, the method according to the independent claim is based on a method with which a time-limited and preferably authenticated release of protected functions (such as, for example, programming of electronic control units) can be implemented.

A release of an access of an external device to data in a vehicle or to a function, in particular a programming function, of a vehicle is thus time-limited and realized on the basis of a release code. The vehicle receives and processes the release code, which includes time information. Access to the data or function is released to the external device for a limited period of time determined based on the time information of the release code. Thus, remote clearances for external devices to sensitive or security-relevant data or functions in a vehicle no longer have unlimited, but can be limited in time to a requirement or the task to be performed.

Preferably, the vehicle or device sends a request for a release code to a server which manages these releases. The vehicle or device receives the release code again from this server, if a release is allowed. In order to ensure that no abusive accesses take place, information is exchanged for this purpose. For example, For example, the request may include vehicle identification information, in-vehicle time information, or authentication information of the external device. Some or all of this information may be determined as mandatory so that release can only be made if that information is included in the request. On the basis of the information, the release instance (preferably in the form of an internet-based trust center) can determine whether a release for the access of the authenticated device to the identified vehicle can take place. Based on the time information sent, the release instance can determine the form in which the time limit of the release should take place. For example, Here, time zone differences or errors of the vehicle's time average can be taken into account.

If the vehicle is notified of a successful release, it can automatically send this information to the external device so that it can begin access without further delay.

In the vehicle, the beginning and especially the end of the limited period of release are determined on the basis of in-vehicle, tamper-proof time means. Thus, a Aushebeln the time limit by manipulating the time average is impossible or at least difficult. To complicate further manipulations in the request and release phase, it may be provided that the release is prevented or aborted when a connection to the server or between the vehicle and the external device is interrupted for a predetermined period of time.

There are various variants for the course of the transmission of the release request and the receipt of the requested release code. In a first variant, the request is sent to the server by the vehicle, which receives information from the external device with which, in particular, an authentication of the external device is possible. Alternatively, the request is sent to the server by the external device, which receives information from the vehicle for this purpose. Preferably, the release code in both variants is in turn received by the sender of the release request.

In a preferred embodiment, the method for accessing a workshop testing device on a vehicle is performed.

The described methods can be executed by a computer program, in particular a computer program, which is stored in a machine-readable memory of a control device of the vehicle.

To carry out the described method, a device may be provided in the vehicle having means for performing all the steps of the methods. These include communication means for sending the request and receiving the release code, storage means for storing the release code and a computing unit for processing the release code. The device can either be a separate release module or an already existing control device, which has the appropriate means to take over the release functionality.

drawings

The invention is described in more detail below with reference to the accompanying drawings and to exemplary embodiments. Show 1 and 2 an exemplary method for time-limited sharing of access of an external device to data or functions in a vehicle.

Description of the embodiments

1 shows a first exemplary method for enabling a time-limited access of an external device to data or functions in a vehicle 3 , The vehicle 3 communicates with the external device 2 and sends this information, in particular information identifying the vehicle or time information. The external device 2 sends this information along with information for authentication of the external device 2 as one or with a request for release to the trustcenter 1 ,

There it is decided on the basis of the received information about the release. If a release can be granted, the Trustcenter sends 1 a release code with time information about the duration of the time-limited release to the external device 2 , If necessary, further information, in particular for the authentication of the trust center 1 , also to the external device 2 , This transmits the release code to the vehicle 3 , There, the release code is received and processed. Based on the received time information of the release code is in the vehicle 3 a release of data or functions of the vehicle for access by the external device 2 granted for a limited period of time.

The processing of the release code in the vehicle 3 as well as the occasion of the release are through a release module 31 carried out.

The vehicle 3 informs the external device 2 about the release.

2 shows an alternative method for enabling a time-limited access of an external device to data or functions of a vehicle. This is the requirement by the vehicle 3 even to the Trustcenter 1 sent. For this the vehicle needs 3 Information from the external device 2 , in particular for authentication of the external device 2 ,

With the request, in turn, this authentication information of the external device 2 as well as identification and time information of the vehicle 3 sent. The trust center 1 sends the release code directly to the vehicle 3 which receives and processes it and, based on the time information contained in the release code, releases it for time-limited access by the external device 2 causes.

Processing of the release code and the release itself are carried out by the release module 31 of the vehicle 3 ,

The vehicle 3 informs the external device 2 about the release.

The release method is explained below with reference to an example in which a control unit of a vehicle is to be reprogrammed in a workshop.

In the workshop vehicle information is preferably read out of the vehicle with a workshop test device. Among the read information, there is preferably a unique vehicle identification (e.g., a vehicle identification number or "vehicle identification number - VIN") and a local vehicle time.

The workshop testing device establishes a connection with a trust center and is there uniquely authenticated via its authentication information. Furthermore, the vehicle information (identification, vehicle time) with the release request is transmitted to the trust center.

Following successful authentication of the workshop test device, the trust center calculates a time-limited release code valid for the vehicle identified via the vehicle identification (in particular according to a hash value method) and transmits it to the workshop test device.

Failure to authenticate the workshop tester will result in the method being aborted. The authentication is usually done via a database with registered workshop test equipment, to which the trust center has access.

The workshop test device transmits the release code received from the trust center to the vehicle, which preferably verifies the release code based on the information transmitted to the trust center via a release module of the vehicle. After successful verification, the intended function (eg programming) is released. Furthermore, the release information is returned to the workshop testing device, so that it can perform the function. The released function can thus be executed.

However, the function is not permanently enabled, but only for a predetermined time. To make this possible, the vehicle must have a time source. This should be as reliable as possible and tamper-proof. By submitting a certain period of time or an absolute time when a release is to be completed, the trust center can use the release code to determine the duration of the release.

When specifying an absolute time, the trust center may consider time information transmitted by the vehicle (such as the in-vehicle time) to compensate for in-vehicle deviations at the time of the trust center (e.g., time shifts or malfunction of the in-vehicle time source). If a specific time frame is specified, a start time for the release must still be determined or determined, preferably by the release module in the vehicle. This can e.g. be placed on the receipt of the release code or done at the time when the workshop testing device accesses the released function for the first time.

After expiry of the specified time or after reaching the predetermined time, the release of the function or data ends. The workshop testing device can then no longer access the corresponding function or data of the vehicle. It is therefore understood that the release module including its time source for the described method should be configured as safe as possible manipulation, otherwise the manipulation of the time average of the vehicle as a result, an unlimited release could be achieved.

Preferably, the method described above is terminated without release of the function or the data if a connection between the workshop test device and the trust center or workshop test device and vehicle is interrupted for a predetermined period of time (for safety reasons, as low as possible). The release procedure can preferably only be considered valid if the workshop test device simultaneously has continuous contact with the vehicle and the trust center.

As already too 2 A release procedure can also be carried out via direct communication between the vehicle and the trust center. In this case, the vehicle transmits the vehicle information (identification and, if applicable, time) directly to the trust center and accordingly has to transmit the information that enables authentication of the workshop test device. For this purpose, first the authentication information is transmitted from the workshop testing device to the vehicle and from there (in addition to the further information) to the trust center. The release information (the release code) is in this variant, preferably directly to the vehicle.

Optionally, different functions or function groups or data or data groups may require different levels of release. The database of the trust center can be used for this e.g. different release types to allow staggered releases. In doing so, e.g. different users on the same test equipment, e.g. Identify via a PIN or smartcard. Thus, different test devices or different users of the same test device can receive different shares.

Since the presented methods mostly relate to sensitive data and functions of a vehicle, the described data transmissions are preferably encrypted. Used devices and stored data are preferably also as far as possible to protect against manipulation.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• US 2013/0111582 A2 [0002]

Claims (14)

A method for time-limited release of access of an external device to data in a vehicle or to a function, in particular a programming function, of a vehicle, characterized in that the vehicle receives a release code for the release that the release code includes time information that the release code in the vehicle is processed and the access to the data or the function is released to the external device for a limited period of time determined on the basis of the time information of the release code. Method according to one of the preceding claims, characterized in that a request for a release code is sent to a server, from which the release code is received. A method according to claim 2, characterized in that the request comprises vehicle identification information. Method according to one of claims 2 or 3, characterized in that the request comprises in-vehicle time information. Method according to one of claims 2 to 4, characterized in that the request comprises information for authentication of the external device. Method according to one of the preceding claims, characterized in that the vehicle informs the external device of a successful release. Method according to one of the preceding claims, characterized in that an end of the limited period is determined in the vehicle on the basis of an in-vehicle, manipulation-protected time source. Method according to one of claims 2 to 7, characterized in that the release is prevented or canceled when a connection to the server or between the vehicle and the external device is interrupted for a predetermined period. Method according to one of Claims 2 to 8, characterized in that the request is sent to the server by the vehicle, which receives information from the external device for this purpose. Method according to one of claims 2 to 8, characterized in that the sending of the request to the server by the external device, which receives information for this purpose from the vehicle. Method according to one of the preceding claims, characterized in that it is the external device is a workshop test device.  Computer program that is set up to carry out all steps of a method according to one of the preceding claims.  Device in a vehicle having means to perform all the steps of a method according to one of claims 1 to 11.  A release module in a vehicle having means for receiving a release code with time information for enabling access of an external device to data in the vehicle or to a function, in particular a programming function, of the vehicle, processing the release code, and accessing the data or release the function to the external device for a limited period of time determined based on the time information of the release code.

Images