DE10143556A1 - Vehicle management system, undertakes authorization testing when data access is attempted from control locations - Google Patents

Abstract

The communications system (8) undertakes authorization testing (13) when a user (3, 5, 6) attempts data access from the control location (3). The authorization test system provides an authorization mask and undertakes bit-by-bit logical comparison with the data access code word (12) originating from the control location (3). The result determines user authorization for data access.

Description

The invention relates to a vehicle management system with a vehicle-mounted control computer and one via a wireless Interface connected to the control computer central Control center, wherein the control computer is a communication unit for Provision and storage of over the wireless Interface to data to be transmitted and a data bus interface has to be arranged over the data bus of in the vehicle ECUs to capture various sensor data.

A vehicle management system called Fleetbord is already in use on DaimlerChrysler transport. This vehicle management system is mainly used in heavy Trucks used. From the vehicle to a Central control center transmitted data can be, for example, the Vehicle location, the condition of the vehicle, the type of goods, the Cooling state of perishable goods and theft-relevant Determine data. Because of the data can then from the central control center new orders or routes, diagnostic data or a new software for repairing technical errors on the Vehicle to be transmitted.

From EP 708 427 A2 a vehicle management system is known, which vehicle data recorded due to sensors in the vehicle and these via a telematics interface to the central Control center in order to inform the driver or the logistics Entrepreneur to provide various service. In the vehicle is an onboard system available, which required Data from the various sensors receives and stores. The Sensor data are transmitted via a data bus and various Controllers transmitted to the onboard system. In particular Vehicle diagnostic data will be used for monitoring technical defects in the vehicle and data on the route of the Vehicle stored in the onboard system and become a central Control center. From there can then the most important Vehicle functions and the route of the vehicle monitored and adjusted via data transmitted back to the vehicle become.

DE 197 55 686 A1 shows a vehicle management system several arranged in a vehicle and networked Control units and a vehicle independent central Control center, through a wireless communication device Data collected from the vehicle is collected, evaluated and new Data back to the vehicle returns. In the vehicle is a Basic module available, that of the individual control units transmitted sensor data stores and also an input from Data allowed by the driver. It is also envisaged that the control center changes specifications for vehicle management and Messages to the driver transmit.

It is an object of the present invention Vehicle management system of the type mentioned in such a way, that it is related to service providers of others Vehicle manufacturer is flexible. This is in particular a improved access authorization checking and deployment a simulation model for the vehicle required.

This task is characterized by the characteristics of the independent Claim 1 solved. Thereafter, the communication unit has Access authorization on a data access from the control center the access authorization of the accessing Participant checks, and that the access authorization check an authorization mask provided by bitwise logical Link to one from the control center Data Access Codeword The access authorization of the subscriber certainly.

According to the invention, the access authorization check means checks each incoming data access via the wireless interface. Codeword on its access authorization. At a Data access, for example, when transmitting a diagnostic Protocol from the principal, has the data access codeword a predetermined format, for example 16 bytes. By means of a Authorization mask that is in the data length of the length of the Data Access Codeword is a permission check intended. The data access received by the control center Codeword becomes bitwise with the authorization mask compared or via a logical "Or" or "And" link bitwise linked.

In addition to the bitwise logical link provided Authorization mask can still be provided a valuation mask which determines which bit or byte for the Evaluation of the access authorization is to be evaluated and which bit or byte related to the access permission is not Is evaluated. The evaluation mask can evaluate and don't set care points within the mask.

The access authorization check means may be by bitwise Masking the data access codeword additionally determine which of the control devices from the external subscriber over the Control center can be accessed. In addition, over the bitwise masking only a specific instruction set for the Control computer or the individual control units are allowed.

The data access codeword is preferred with a data format provided that a sender, and destination identifier and Has data fields. The sender ID can be a name of an external Participant who wants to access data of the vehicle, and A control unit designation may be provided as the destination address his. In the data fields, for example, a control command and the appropriate parameters for this arranged. The Authorization mask becomes at least the destination and sender address as well as the control command to be executed by the masking to verify. In case of a positive test result, the receiver allowed by means of the data access codeword to the specified Controller to access and on this controller the Execute command. In this case, for example, a data query certain sensor data are triggered by the command, so that the data is sent back to the wireless interface Control center be transferred back.

The task is also characterized by the characteristics of the independent Claim 4 solved. Thereafter, the communication unit has Access Control Checking, which is a data access from the control center the access authorization of the accessing Participant checks that provided a driving condition testing unit is, based on sensor data, the driving condition of the vehicle determined and that the access authorization check a Overwriting data in the communication unit only allows if the Fahrzustandsprüfeinheit a data access assigned driving state of the vehicle indicates.

According to the invention, a data access by means of Data access codewords first to an access authorization checked. For example, if the data access is a data or software modification on the control computer or a Control unit of the vehicle carried out, it must be ensured that Data writing preferably only in a stationary vehicle allowed is. A change of software or a change of parameters at control devices during vehicle operation can create security risks. That's why one is Fahrzustandsprüfeinheit provided that due to sensor data the Driving condition of the vehicle determined.

The Fahrzustandsprüfeinheit can in connection with the Be provided, and for example from outside the Vehicle determine the vehicle positions. This can do that Mobile network can be used, from which the position of the Vehicle can be determined. However, the preferred is Fahrzustandsprüfeinheit provided within the vehicle and the Driving position is then via a GPS system on board the Vehicle determined. Only when the vehicle is stationary and, in particular secured by a braking system for larger amounts of data is, the data write is triggered. Only that Reading the data can also be done while the vehicle is moving as far as the access authorization by the in Claim 1 described in claim 1 is.

Due to the two access authorization procedures, there is now the Possibility that also handles requests from external participants can not be on a software of the Vehicle manufacturer based. For this only the data format and the Sender address determined by the vehicle manufacturer and the external participants can then access specific information of the Sensors accessible by the vehicle manufacturer for the external Participants are unlocked. For example, a Logistics contractors rely on sensor data, the for example, the temperature in a trailer of a truck indicates which is intended for a refrigerated transport of food. On the other hand, from a security service cyclically the Location and condition of an alarm system within the Vehicle, or the trailer / semitrailer, are queried.

Through the development of the vehicle management system and the special access authorization procedures can now also external participants, d. H. Customers have not been able to had a data query from the controllers of the network, on access individual functions within the ECUs. By The authorization mask can only give one external participant one certain function, a control command or a destination address assigned and with permission a certain access to it be allowed. This even makes it possible the Access to safety-critical ECU functions to admit if the access authorization and the driving situation allow this.

The object is achieved by the features of the invention Claim 7 solved. After that is a software supported Simulation model for the vehicle provided by the control center is responsive. Due to the vehicle to the control center transmitted sensor and diagnostic data, the functionality of the vehicle based on the simulation model, preferably in Real time, be checked. This simulation model can either be provided in the control computer or at the control center and Due to the sensor and diagnostic data of the vehicle can be a Driving condition or a loading condition or a route a truck be checked before a new one Control command is transmitted to the vehicle.

Due to the simulation system, there is the possibility for external participants with access authorization, certain scenarios play through, for which the route and the optimal Driving condition of the vehicle are necessary.

There are now different ways of teaching to design present invention in an advantageous manner and further education. This is on the one hand to the subordinate Claims and on the other hand to the following explanation of a Embodiment refer. In the drawing is a Embodiment of the device according to the invention for simulation shown. Each show in a schematic representation,

Fig. 1 shows the structure of a vehicle management system according to the present invention,

FIG. 2 shows an example of a masking of a data access codeword according to an embodiment of the present invention and FIG

Fig. 3 is an illustration of the sequence in an access authorization check for a vehicle management system according to the present invention.

The vehicle management system 1 has a control computer 2 and a central control center 3 , which is related to the vehicle with other external systems 4 , for example, the central computer of a logistics company 5 and the central computer of a security service 6 . The control center 3 is connected via a wireless interface 7 to the communication unit 8 of the control computer 2 . The control computer 2 forms, together with the communication unit 8 , the data bus interface 9 and the diagnosis-capable control units 10, the in-vehicle systems 11 . As soon as a data access to the communication unit 8 by means of a data access code word 12 takes place from the call center 3 via the wireless interface 7 , the wireless interface 7 of the vehicle is automatically woken up by a so-called wakeup signal, the control computer 2 then being activated by another wakeup signal. Signal is placed in a receive state, so that the data access code word 12 can be processed in the control computer by an access authentication 13 . The data access code word 12 can be transmitted from the communication unit 8 of the wireless interface 7 to the control computer 2 via a data bus 14 .

In the access authorization check means 13 , on the one hand, it is checked whether the data access code word 12 , which originates, for example, from the central computer of the logistics entrepreneur 5 and represents a position request of the vehicle, is present. For this purpose, the data access codeword 12 has a predetermined data format in which the sender name, the destination address, a control command and further data are provided. Due to the known data format, certain bit or byte positions of the data format can be discriminated by a mask, in which case certain code areas of the data format are checked, while other areas of the data format remain unconsidered (do not care).

FIG. 2 shows by way of example one of a plurality of data access code words 12 transmitted successively via the wireless interface 7 . The data access code word 12 consists of addressing areas 15 , control command areas 16 and data areas 17 . The data format of the data areas 17 can in this case vary according to the application or a standard for data transmission formats. It must be set only before the data transmission, a data format, so that the communication unit 8 can perform the wireless data transmission and the access authorization means 13 can discriminate by means of an authorization mask 18, the addressing areas 15 with the sender and destination address. The authorization mask 18 has a mask name 19 in the form of a byte, which denotes a specific one of several masks. Furthermore, the authorization mask 18 has a discrimination matrix 20 , wherein a discrimination bit is present for the subsequent control and data bytes in the authorization mask 18 , wherein a "1" indicates that the control or data byte must be checked and a "0" indicates that a check for the control or data byte at the appropriate location is not required. In the exemplary embodiment, the first four bytes in the addressing area 15 and the first byte in the control command area 16 must be checked for authorization. The remaining control or data bytes are not checked and therefore passed by the authorization mask 18 without change, resulting in the logic operation, which is performed in the embodiment in the form of a hexadecimal addition, that in the authorization mask 18 at the appropriate location a "FF" is entered.

The provided logical link, in particular an OR link, results in a legitimate data access code word 21 whenever it matches the original data access code word 12 after the access authorization check. This is always the case if an "FF" is entered at the corresponding position of the authorization mask 18 at the byte position or if the same bit sequence is entered both in the authorization mask 18 and in the data access code word 12 as in the first byte of the addressing area 15 is. This is the "18" in the example. In this way, only a group of control command areas 16 can be permitted by the authorization mask 18 , wherein, for example, the control commands whose control command area 16 begins with the value 1 A, only the reading of data and storing data when the vehicle is stopped. The different control commands are then differentiated in the following bytes of the control command area 16 . The vehicle manufacturer is therefore able to manipulate certain external data transmissions from third party service providers via the authorization mask 18 and to block requests from other users against unwanted data readings.

The authorization mask 18 is essentially bit-masked, that is to say that although shown byte-by-byte in FIG. 2, the authorization mask 18 may be variable with respect to each bit. The authorization mask can additionally be encrypted to prevent external access. It is precisely this increased data security and the access authorization check that allows the customer to access certain control functions within the vehicle. For this purpose, for example, the cooling temperature in a semi-trailer of a truck can be controlled by an external system or it can also be an alarm by a transmission of a data access code word 12 via the wireless interface 7 again turned off.

FIG. 3 shows the time sequence of an access authorization check. When starting a vehicle, it is first checked whether the communication unit 8 and the access authorization checking means 13 of the control computer 2 are each completely initialized. It is also checked whether a tester, for example, to create a workshop diagnosis, is connected to the control computer. After the self-test of the communication unit 8 on communication capability and testing of the individual authorization masks in the access authorization means 13 , the initialization phase is completed and as a result incoming data access code words 12 are received by the communication unit 8 and passed to the access authorization check means for discrimination by the authorization mask 18 . As a result of the various incoming data access codewords 12 (ID1.IDn), only authorized data access codewords 21 are passed to the control computer 2 for further processing and for storage there.

The described method allows external customers to access vehicles or vehicle fleets of a vehicle manufacturer via telematics quickly and flexibly, if they have previously been activated by an access authorization. The communication unit 8 is designed as a telematics platform, which is also used for other telematics services of the vehicle manufacturer.

The access authentication means 13 collects in-vehicle data such as ignition, brake actuation, and stores this data after completion of a trip when the access authorization check means 13 has a specific command. This tour data of a vehicle can then be retrieved, for example via an external service of a logistics company 5 via its central computer, as far as this service is enabled. The tour data can be transmitted in the simplest case as SMS messages or as an Internet page to the central computer 5 via the wireless interface 7 . The method that can be carried out on the described vehicle management system 1 can be adapted to future needs of the customer by allowing the access authorization masks to be flexibly parameterized. For increased security, multiple authorization masks 18 can also be compared with the incoming data access code word 12 . In this case, a comparison can be carried out by means of a positive list and then a comparison by means of a negative list, wherein very special control commands or destination addresses can be blocked from the unchecked bytes or bit locations. Even if an access authorization is not granted by the access authorization check means 13 , certain data can be transmitted back to the customer. For example, addresses for obtaining an access authorization can then be specified or an error message can be retransmitted.

The external central computer 5 then sends a first request to the communication unit 8 of the vehicle. After successful reception of the request, a diagnostic message is transmitted to the control computer 2 via a telematics CAN data bus after the authorization check. The request is then evaluated in the control computer and the diagnostic use can be performed. In addition, an update of the software within the vehicle and the software state information can be transmitted to the control center 3 to document the software state within the vehicle.

In another embodiment, from the sensor data of the vehicle queried by the access authorization check means 13, a simulation model can be stored within the control computer 2 or at the control center 3 that provides a specialized description model of the vehicle. The individual sensor data can be represented by means of symbols and based on the sensor data, a driving state, a route, the current driving situation or the expected driving time can be calculated. The simulation model can provide the customer with improved information about the vehicle, as long as an access authorization has been granted for it. In addition, it can also be decided on the basis of the simulation model whether data access to the vehicle in the current driving situation is possible. For example, the simulation model can calculate the situation of the cargo and the vehicle and therefore determine information about a safe location of the vehicle. If a safe vehicle location is detected on the basis of the simulation model, a data write to the vehicle can be permitted. For example, new software may then be transferred to the vehicle, that is, flashed, or error codes, measurements, parameters, and other data may be transmitted to the vehicle's control computer.

In addition to customer systems, external systems also count certain servers, parameterisation or flash stations and Diagnostic tester.

Claims (8)

1. Vehicle management system with a vehicle-mounted control computer ( 2 ) and a via a wireless interface ( 7 ) to the control computer ( 2 ) connected to the central control center ( 3 ), wherein the control computer ( 2 ) a communication unit ( 8 ) for providing and storing over the wireless interface ( 7 ) to be transmitted data and a data bus interface ( 9 ) to detect via a data bus arranged in the vehicle control units ( 10 ) different sensor data, characterized in that the communication unit ( 8 ) has an access authentication means ( 13 ) in the case of data access from the control center ( 3 ) checks the access authorization of the accessing subscriber ( 3 , 5 , 6 ), and that the access authorization check means ( 13 ) provides an authorization mask ( 18 ) which is linked bit by bit to one of the control center ( 3 ) derived data access codeword ( 12 ) the access authorization of the subscriber ( 3 , 5 , 6 ). 2. Vehicle management system according to claim 1, characterized in that the access authorization checking means ( 13 ) additionally determines by bitwise masking to which of the control devices ( 10 ) the data access code word ( 12 ) can access. 3. Vehicle management system according to claim 1 or 2, characterized in that the access authorization check means ( 13 ) by bitwise masking additionally determines which command in which control unit ( 10 ) is permitted. 4. Vehicle management system with a vehicle-mounted control computer ( 2 ) and a via a wireless interface ( 7 ) to the control computer ( 2 ) connected central control center ( 3 ), wherein the control computer ( 2 ) has a communication unit ( 8 ) for providing and storing over the wireless interface ( 7 ) to be transmitted data and a data bus interface ( 9 ) to detect via a data bus arranged in the vehicle control units ( 10 ) different sensor data, characterized in that the control computer ( 2 ) has an access authentication means ( 13 ) in the case of a data access from the control center ( 3 ), the access authorization of the accessing subscriber checks that a driving condition checking unit is provided which determines the driving condition of the vehicle on the basis of sensor data, and that the access authorization checking means ( 13 ) only overwrites data in the communication unit ( 8 ) allows, if the driving condition checking unit displays a driving condition of the vehicle associated with the data access ( 12 ). 5. Vehicle management system according to claim 4, characterized in that the Fahrzustandsprüfeinheit is provided as part of the control computer ( 2 ) or a control device ( 10 ). 6. Vehicle management system according to claim 4 or 5, characterized characterized in that the Fahrzustandsprüfeinheit a letter of data in the vehicle only at its stoppage permits. 7. Vehicle management system with a vehicle-mounted control computer ( 2 ) and a via a wireless interface ( 7 ) to the control computer ( 2 ) connected central control center ( 3 ), wherein the control computer ( 2 ) a communication unit ( 8 ) for providing and storing over the wireless interface ( 7 ) to be transmitted data and a data bus interface ( 9 ) to detect via a data bus arranged in the vehicle control units ( 10 ) different sensor data, characterized in that a software-based simulation model for the vehicle with the control center ( 3 ) in Connection stands and due to the transmitted from the vehicle to the control center ( 3 ) sensor and diagnostic data, the functionality of the vehicle based on the simulation model is verifiable. 8. Vehicle management system according to claim 7, characterized characterized in that the simulation of the vehicle with the IST Sensor data of the vehicle is feasible.