DE102018212879A1 - Control device and control method - Google Patents

Abstract

The choice of appropriate measures against the problems in question, even in the event of security problems. [Means for solving the problem] Control device with a certification processing part for authentication in relation to the security Certification body under certain conditions, which via special interfaces with independent is equipped with access to the aforementioned components controlling units and controls the access to the aforementioned components due to the aforementioned authentication results on the aforementioned interfaces.

Description

[Technical area]

The present invention relates to a control device and a control method.

[State of the art]

In recent years, in-vehicle systems are equipped with a so-called electronic control unit (ECU), and this ECU controls the various functions in the vehicles concerned. Further, these ECUs are connected to in-vehicle networks called in-built network. There are numerous standards for such built-in networks, among which the CAN (Controller Area Network) can be cited as a representative example. The structure described above, for example, allows the ECU to receive instructions from other control units (other ECUs, etc.) via the embedded network concerned, and to control the various components in the vehicle based on these instructions. Such components may be, for example, the brakes, the engine, or the like components related to the operation of the vehicle.

In recent years, various technologies have also been proposed in connection with the development of LTE, Bluetooth (registered trademark), Wi-Fi (registered trademark) and the like, which allow the devices in the vehicles to be connected to external networks such as WAN (World Area Network) or the Internet. As a concrete example, DCM (Data Communication Module) or TCU (Telematics Communication Unit) and the like communication units access external networks to allow connection with on-vehicle devices. In recent years, in particular, technologies attract attention, in which, in the context of the implementation of the so-called automatic driving and the like by accessing in-vehicle devices from the outside, the various components involved in the operation of the subject vehicle are controlled.

[Prior Art Documents]

[Patents]

• [Patent Document 1] Japanese Laid-Open Publication 2017-73765
• [Patent Document 2] International Publication No. 2014-199687

[Overview of the Invention]

[Problems to be Solved by the Invention]

However, this also creates the danger that a communication between in-vehicle and out-of-vehicle devices is possible, so that in the relevant communication through a dedicated interface malicious attacks from outside the vehicle-internal devices are exposed to dangers. In particular, if attacks by malicious attackers illegitimately overwrite the program code of the CPU or microcontroller, the components involved in the operation may be improperly put into operation via the ECU. Against this background, the implementation of technologies is required, which ensures the safety of the systems installed in the vehicle. For example, in Patent Documents 1 and 2, there has been exemplified an example of the safety of technologies installed in the vehicle.

On the other hand, it is not necessarily true that some of the malicious attackers' attacks on the CPU or microcontroller also directly affect the function of other parts (eg, parts of the vehicle that are in operation) from the attacks in question. In other words, under these conditions, it is not necessarily realistic to prove that a malicious attack has disabled the features of those parts that are not directly affected. It is particularly desirable, when starting from an operation of the vehicle, that if possible, for example, even if some of the functions are impaired when security problems occur, these relevant functions are deactivated, but appropriate measures continue to make the operation possible.

In this context, the technique proposed here allows the choice of appropriate countermeasures if security problems arise.

[Means for solving the task]

In order to achieve the above-mentioned object, a device is offered which, in certain circumstances, can be used for authentication between the certification processing part (). 111 ) and the security certification authority is equipped with a specific interface for the vehicle-mounted components connected to the internal network independent unit, based on the results of the aforementioned authentication access to the control of the aforementioned components via the aforementioned interface with the control part ( 113 ) he follows.

Further, to solve the above object, a method is provided in which for connecting the built-in vehicle connected to the internal network components via a specific interface an independent computer is provided with the under certain circumstances, the authentication with the security certification authority is carried out and based on the results of the aforementioned authentication, the access to the control of the aforementioned components via the aforementioned interface.

[Effects of the Invention]

This invention offers a technique that allows to take appropriate action if security problems occur as described above.

list of figures

• [ 1 ] The figure shows a control network formed of a plurality of vehicle-mounted and interconnected control devices.
• [ 2 ] Block diagram of an example of the functional structure of a security monitoring part according to the embodiment published here.
• [ 3 ] Diagram of an application example of a security monitoring part according to the same embodiment.
• [ 4 ] An overview of a graph showing the gateway.
• [ 5 ] Diagram of another application example of a security monitoring part according to the same embodiment.
• [ 6 ] Diagram of another application example of a security monitoring part according to the same embodiment.
• [ 7 The flowchart illustrates an example of the processing flow in the in-vehicle system according to the same embodiment.
• [ 8th The flowchart illustrates an example of the processing flow in the in-vehicle system according to the same embodiment.
• [ 9 ] The flowchart illustrates an example of the processing flow in the in-vehicle system according to the same embodiment.
• [ 10 ] The flowchart represents another example of the processing flow in the in-vehicle system according to the same embodiment.
• [ 11 ] The flowchart represents another example of the processing flow in the in-vehicle system according to the same embodiment.
• [ 12 ] The flowchart represents another example of the processing flow in the in-vehicle system according to the same embodiment.

Embodiments of the Invention

Hereinafter, an appropriate embodiment of this invention will be explained in detail with reference to the accompanying drawings. In this specification and figures, identical symbols are used for substantially identical functional structures and elements to avoid overlapping explanations.

<< Example of the basic structure of the in-vehicle network >>

For example 1 an example of the structure of the control network 10 interconnected vehicle-mounted multiple control devices (ECU: Electronic Control Unit).

The control network shown in the figure 10 includes the body CAN network 20 and the chassis / powertrain CAN network 30 , The body CAN network 20 and the chassis / powertrain CAN network 30 can through the gateway ECU 50h communicate with each other.

The body CAN network 20 and the chassis / powertrain CAN network 30 a plurality of mutually communicable via the respective CAN (Controller Area Network) communication line connected control parts 50a - 50h (hereinafter unless specifically required, summarizing as a control device 50 designated).

The body CAN network 20 is with airbag ECU 50a , Body control ECU 50b , Dashboard control ECU 50c and an instrument ECU 50d equipped to communicate with each other via a communication line.

The airbag ECU 50a mainly detects collisions from the vehicle and controls the airbags accordingly. The airbag ECU 50a is via the LIN (Local Internet Network) with the ECU 50i connected on the passenger side.

The body control ECU 50b controls mainly the air conditioning, windows, windscreen wipers, door lock and the electrically operated seat adjustment. The dashboard control ECU 50c controls mainly the indications on the dashboard in the vehicle and the switching on of light. The instrument ECU 50d controls mainly the detection and recording of the vehicle speed and the transmission of the vehicle speed to the other parts.

The chassis / powertrain CAN network 30 is with an over a communication line communicable with each other automatic transmission ECU 50e , Vehicle stabilizer control ECU 50f as well as engine-ECU 50g fitted.

The automatic transmission ECU 50e controls mainly the automatic transmission. The vehicle stabilizer control ECU 50f Integrally controls mainly the automatic transmission, the brake system and the engine and prevents the vehicle from skidding. The engine-ECU 50g predominantly controls the engine.

The above description with reference to 1 is an example of a basic structure of a vehicle-mounted network.

<< Safety considerations >>

Based on the explanations of the essential points concerning the safety of the vehicle-mounted system, the technical tasks of the in-vehicle system according to the same embodiment are summarized.

In recent years, in connection with the development of radio technologies such as DCM or TCU or WAN, it has become possible to access the devices in vehicles via the Internet and to exchange information with external devices. An application of these mechanisms to various services such as automatic driving is currently under discussion.

On the other hand, in safety circles the fact is taken into account that by misuse of the above-mentioned communication interfaces by malicious attackers the systems installed in the vehicle can be exposed to dangerous attacks. In other words, by allowing communication between in-vehicle devices and external devices, there is also a risk that the vehicle-mounted devices may be exposed to malicious attacks from outside the vehicle via the communication interface in question.

In a specific example, a malicious attacker could attempt to modify the code of the CPU or microcontroller in the vehicle by executing their own malicious code via the communication interface mentioned above. And then, if the malicious attacker executes the code, it can essentially intentionally let the ECU execute an executable operation. This makes it possible, for example, that the attacker detects GPS data and the like based on the recognition results from the various sensors provided in the vehicle. Further, for example, the attacker may deliberately put the various actuators into operation. This allows the attacker to deliberately control, for example, the operation of the brakes or various engine components as desired and thereby cause accidents. In the worst case, the attacker can, for example, attack the ECUs of numerous vehicles via the Internet so that the numerous vehicles concerned can each behave dangerously at the same time (for example, perform emergency braking).

In this context, ensuring the safety of vehicle-mounted devices (especially the ECU) is an important task. Therefore, numerous safety-ECU techniques have already been proposed. As an example of such a technique, HSM (Hardware Security Modules) or IDS (Intrusion Detection Systems) can be cited.

The current technique here focuses on protective measures (for example for the ECU) against malicious attacks, such as malicious attacks on the CPU or microcontrollers of the ECU or the like and tend to have the primary task of ensuring that the code of the attacker concerned is not executed can be. Because of this tendency, research on the above-mentioned technologies has focused primarily on increasing the detection speed of security breaches such as malicious attacks.

On the other hand, the choice of countermeasures for detection of security problems is often given a low priority. For this reason, manufacturers may decide to eliminate the function of the ECU if they find any problems.

As a concrete example, in case of problems with the program for the ECU via an OBD (On-board Diagnostics) board, a connection to the CAN BAS terminals can be made and then a self-diagnosis of the ECU can be made via the respective terminals, whereby the program in question is reprogrammed becomes. On the other hand, if there are security problems and the on-board diagnostic systems can no longer perform their function, reprogramming of the faulty program may be silent (it will come to the scrapping called "bricking" situation). In this case, there is a tendency for costs to increase if, in the event of security problems, manufacturers can only solve them by replacing the hardware. Especially with regard to the provision of services such as automatic driving, it must be assumed that the devices installed in the vehicle, such as the ECU, etc., acquire infrastructure information through networks, so that the influences described above can conceivably easily manifest themselves.

For this reason, by using conventional technology, it is possible to improve safety, but when security problems are in fact encountered, the possibility of keeping the repair function of the ECU and other equipment to a minimum and repairing a trouble becomes difficult.
Therefore, there is a risk that the reliability of the devices concerned will decrease under these circumstances.

On the other hand, it is also not necessarily the case that when safety problems occur and the repair functions are impaired, the functions relating to the operation of the vehicle itself are also impaired. For example, it is conceivable that the CPU of the ECU can function normally while it comes from improper instructions from the outside to faults of the ECU concerned. Turning off the ECU under these circumstances and replacing the affected ECU hardware can hardly be called a practical solution.

In this case, with regard to the practical implementation, in particular a construction is desirable in which, for example, when security problems occur and impairment of a portion of the functions, the functions concerned are deactivated as far as possible, but at the same time the vehicle can still continue to be operated.

Taking into account this situation, this publication proposes a technique which allows appropriate measures to be taken even when security problems arise in order to protect the equipment to be protected from the problems in question.

<< Technical characteristics >>

In the following, the technical characteristics of one embodiment of this publication of a vehicle-mounted system will be explained.

<Safety monitoring part>

A vehicle-mounted system according to the present embodiment protects the individual devices of the on-vehicle system such as ECU, GW, and TCU and the like from the problems involved by detecting security-related problems by introducing a security watchdog. In this context, it should first be based on the 2 an example of the functional structure of the safety monitoring part will be explained. 2 Fig. 12 is a block diagram for an example of the functional construction of a security monitoring part according to an embodiment of this publication.

As in 2 The safety monitoring part comprises 100 the encryption module 101 , a code generator (True Random Number Generator) 103 , a communication interface 105 , a timer 107 and a general input-output module (GPIO: General Purpose Input Output) 109 , Furthermore, the safety monitoring part 100 can also have several general InputOutput modules 109 and then for each general input-output module 109 a timer 107 can be provided.

The communication interface 105 is a communication interface for data exchange between the individual components within the safety monitoring unit 100 and various devices outside the safety monitoring part 100 , The structure of the communication interface 105 can also depend on the network to which the relevant communication interface 105 connected is modified as needed. For example, the communication interface 105 be constructed as a communication interface, which corresponds to the UART (Universal Asynchronous Receiver Transmitter), SPI (Stateful Packet Inspection), CAN or Ethernet (registered trademark) and the like standards.

The general InputOutput module 109 when triggered by predetermined trigger transmits predetermined signals to the cable or the like transmission channels connected Equipment. In a concrete example, the general InputOutput module 109 optionally switch the ECU between an enable signal to be output (for the Enable PIN provided in the communication interface) and a disable signal. With this control it can be achieved that the data transmission is switched on or off via the relevant communication interface.

The general InputOutput module 109 may also be the above-mentioned signal, for example, also due to the timing results on the timer 107 send. Further, in another example, the general input-output module sends 109 the above signal, if it was stimulated by a given event. In the explanations below, the general InputOutput module sends 109 due to the timing results, the above-mentioned signal via the timer 107 ,

The timer 107 has a timing function, so that after a set period of time, the time span concerned the general InputOutput module 109 is communicated. In addition, the timer can 107 reset the measurement of the set period of time according to the instructions given. In addition, the above-mentioned period of time may be changed following instructions from outside.

The encryption module 101 includes the certification processing part 111 and the control part 113 , By the certification processing part 111 via the communication interface 105 Accessing a given security certification authority (SA), the certification processing is performed in relation to the security authority concerned. Further, when the certification processing part 111 To perform authentication in relation to the security certification authority, the choice of the relevant certification procedure does not need to be specially defined.

For example, a challenge-response method can be used for the above-mentioned certification method. In this case, the certification processing part 111 for example, using the code generator described later 103 produced code to be used for authentication with the security certification authority.

Specifically, this means that the certification processing part 111 Contact the security certification authority keystore information 190 Splits. The certification processing part 111 encrypts those from the code generator 103 generate code (challenges) with the keystore information 190 and then sends this code after encryption to the security certification authority. Furthermore, the certification processing part 111 In response, the security authority then receives encrypted code from the security authority, with the encrypted code in question then based on the keystore information 190 decodes and checks in a comparison with the code based on the decoding results (challenges) whether the authentication is right or wrong (in other words, a correct answer to the challenge was obtained).

In the following, the certification processing part uses 111 from the code generator 103 generated code as part of a challenge-response process to perform authentication with the security certification authority.

The control part 113 controls the sending of the signals based on the authentication results from the security certification authority from the general InputOutput module 109 ,

In a concrete example, the timer can 107 to be reset if the authentication between control part 113 and security certification authority was successful. In this case, the control part 113 also from the timer 107 change measured periods. By this control, the duration of processing due to the timing by the timer 107 updated (for example, extended). Further, during processing due to the timing by the timer 107 can, for example, the general InputOutput module 109 send an enable level signal to the enable terminal (in other words an enable signal) provided in the communication interface of the ECU. In this case, for example, the access to certain components is activated via the relevant communication interface.

If the authentication between the control part 113 and the security certification authority fails, processing may re-adjust the timer 107 or an update of the time switch 107 measured periods are also omitted. If under these circumstances a predetermined time has expired and the processing of the time measurement by the timer 107 is completed, for example, the general InputOutput module 109 send an enable level signal to the enable terminal (in other words, a disable signal) provided in the communication interface of the ECU. This ensures that, for example, the access to certain components is deactivated via the relevant communication interface.

The code generator 103 generates the code for authentication between the encryption module 101 (Certification processing part 111 ) and the security certification authority. In a concrete example, the code generator 103 be equipped with a random number generator, wherein the random numbers generated by the respective random number generator are output as the above-mentioned code to the encryption module.

Furthermore, the location where the above-mentioned security certification authority is established is not particularly specified. In a concrete example, in contrast to local HSM or IDS, a function corresponding to the above-mentioned security certification authority can also be provided. In other words, the above-mentioned HSM or IDS can also perform the function of the above-mentioned security certification authority. It is also possible that the provided in the vehicle safety monitoring part 100 and distinguishing other devices (for example, via the vehicle-mounted network connected devices) is equipped with a function corresponding to the above-mentioned safety certification authority. Furthermore, the server for the key remote management (KMS: Key Management Service) server can take over the task of the above-mentioned security certification authority.

Above was based on the 2 an example of the functional structure of the safety monitoring part explained. A concrete example of the individual controls by the security monitoring part will be explained separately below, together with the application of the relevant security monitoring part.

<Application examples on motor vehicle ECU>

Next, as an example of the application of a safety control part for controlling automotive ECU according to the present embodiment, it will be explained how this related safety monitoring part controls the operation of the motor vehicle. For example 3 a block diagram illustrating the functional structure of the motor vehicle ECU concerned, which illustrates an example of the application of a security monitoring part according to the present embodiment, showing the application of the security monitoring part to the motor vehicle ECU.

As in 3 is shown, the ECU comprises 310 the main control part 311 , the detection part 313 , the actuator driver 315 , the communication interface 317 and the security monitoring part 100 , Furthermore, the safety monitoring part 100 corresponds to the basis of the 2 explained safety monitoring part 100 ,

The detection part 313 is built for the collection of information from outside. For example, the detection part 313 be constructed of different types of sensors such as acceleration sensor and pressure sensors. In addition, the detection part 313 also in the form of buttons or the like as an interface for entering information from the outside into the ECU 310 serve.

The actuator driver 315 For example, the drive of the individual actuators involved in the operation of the vehicle (for example, the in 3 illustrated actuator 331 ) Taxes. As concerned components, for example, the brake, lighting system, motor and the like may be mentioned.

The communication interface 317 is a communication interface for data transfer between the individual components in the ECU 310 and the external devices of the ECU concerned 310 ,

In a concrete example, the communication interface 317 be constructed as a communication interface that accesses the CAN and the like built-in networks in the vehicle. This will allow the individual components within the ECU 310 (For example, the main control section described later 311 ) via the relevant communication interface 317 Information with other ECU 310 exchanges. Further, in another example, the communication interface 317 also be built as a communication interface on the vehicle external networks such as an Internet 350 accesses. This will allow the individual components within the ECU 310 exchange information with other vehicles via the networks concerned. Furthermore, the communication interface 317 also be constructed as a communication interface pointing to the wireless network 360 accesses. This will allow the individual components within the ECU 310 Exchange information with other devices via the wireless network in question.

By such a communication interface 317 is provided, the individual components within the ECU 310 also other than the proof part 313 collected information from outside the ECU 310 Collect information. Furthermore, the structure of the individual components within the ECU 310 allows the transmission of various information (for example, that of the proof section) 313 collected information and the like) outside the ECU concerned 310 external devices (for example consignments).

The control part 311 controls the individual functions of the ECU 310 , The control part 311 can for example be realized from one or more CPUs (or microcontrollers) and executes the implemented logic.

As a concrete example, it may be stated that if the main control part 311 via the detection section 313 Detects a sudden deceleration, by activating the airbag actuator 331 controlling actuator driver 315 the relevant airbag can be activated. In another example, in addition, by activating the actuator 331 the brake controlling actuator driver 315 the brake in question are activated when the main control part 311 detecting an obstacle via the ADAS (Advanced Driver Assistance System).

The safety monitoring part 100 shares with the security certification authority 200 Key information. Furthermore, in the following explanations, the safety monitoring part 100 stored key information "key information 190 "And the relevant in the security certification body 200 stored key information called "key information 190". As a specific example, it may be stated that when using a public-key encryption method, the security certification authority 200 as key information 195 Secret key stores and the security monitoring part 100 as key information 190 has a public key in connection with the secret key. It is difficult to see if there are differences in the structure of the key information 190 in the security monitoring part 100 and of the security surveillance part in question 100 distinctive structures (for example, the main control section 311 ) gives.

In addition, the safety monitoring part controls 100 whether the individual components in the ECU 310 (For example, at least one element under the main control part 311 , Detection section 313 , Actuator driver 315 and the communication interface 317 ) are either activated or deactivated. In other words, the security monitoring part 100 Enables or disables the individual components in the ECU 310 depending on the authentication results in relation to the security certification authority 200 , At this point, desirably, a direct activation or deactivation of the individual components in the ECU 310 through the main control section 311 be limited. This will make it difficult for the main control part 311 without the interposition of the safety monitoring unit 100 other structures enabled or disabled.

The safety monitoring part 100 For example, per time interval challenges the security certification authority 200 send and then from this security certification authority 200 Responding to the challenges received. If the security certification authority 200 has proven a security problem, it interrupts the sending of replies to the security surveillance part 100 sent challenges. In this case, it comes in the security monitoring part 100 at a timeout and by sending a disable signal to the desired components in the ECU 310 the relevant components are switched off.

In a concrete example, access is from outside the ECU 310 at least some of the components inside the ECU 310 limited if it is in the security surveillance section 100 comes to a timed out and over the communication interface 317 a part of the functions is switched off. Further, by the safety monitoring part 100 the detection part 313 disabled, the functions involved in verifying the various information are also temporarily disabled. By the safety monitoring part 100 also the actuator driver 315 deactivated, the occurrence of impermissible controls by the actuator driver 315 controlled actuators 331 prevented.

In the manner described above is in the ECU 310 According to this embodiment, a part of the functions (for example, at least part of the functions within the ECU 310 ) if proof of a safety problem by the safety certification authority 200 based on the authentication results of said security certification authority 200 via the security monitoring section 100 disabled. By this control it is achieved that even when security problems occur important components (for example, brake actuators and the like) by deactivating the ECU 310 can be protected without switching off the CPU or the microcontroller.

In this way, by applying the technique according to this embodiment, it becomes possible to temporarily or permanently shut down the ECU without effectively deactivating the part (for example, switching to the safe mode) without the CPU or the microcontroller. This can, for example, make it possible for the ECU manufacturer to be able to diagnose or repair the ECU without having to replace it, even in the event of serious security incidents. It also means that, compared to a physical replacement of the ECU, the cost of the corrective actions can be reduced if security incidents occur.

As described above, the installation site for the security certification authority 200 For example, a remote server may also not have the task of security certification authority 200 take. If a remote server in this way the task of security certification authority 200 For example, if there is a risk of a security incident, the vulnerable functions can be switched off in advance for protection.

This can be achieved, for example, that the IDS the ADAS system against detection of a worldwide attack by the manufacturer (for example, an automaker), the ADAS remotely disabled and thus protects the passengers.

Furthermore, if security vulnerabilities are found, ECU functions may be temporarily disabled until manufacturers provide updated software. Under these circumstances, the manufacturer may control the respective remote servers so that the remote server in question is not open to the security monitoring part concerned 100 Challenges sent to the ECU (for example, disabling the remote server). This ensures that when the safety monitoring part times out 100 the functions in the ECU by the relevant safety monitoring part 100 be switched off.

Moreover, the application of the technique according to this embodiment would expect hazards to be reduced by hardware Trojan horses or back doors.

Concretely, this means that it is difficult for manufacturers of the ECU to take complete measures for preventing security risks such as hardware attacking Trojan horses and the like in advance at the stage of designing the CPUs and microcontrollers. Under these circumstances, providing independent security watchdogs for the CPUs and microcontrollers can ensure the reliability of the ECU even when CPUs and microcontrollers are not reliable.

Above is a description of the application of safety monitoring parts according to this embodiment with reference to FIG 3 for an example of the application of the relevant safety monitoring part to the control of the operation of a vehicle by means of a motor vehicle ECU.

<3.3 Application example of a gateway (GW)>

Next, in another application example of a security monitoring part according to this embodiment, the application of the subject security monitoring part as an ECU connected to a plurality of in-vehicle networks (GW) is explained in this example.

A gateway serves to connect several different networks (subnetworks) built into the vehicle and to control the transmission of information between the several networks concerned. There are also networks with different priorities in the vehicle. Specifically, this means that among several networks, compared to other networks, the priority of those networks that demand high reliability is set higher than the other networks concerned. To put it even more concretely, this means that for networks the devices not directly involved in the operation of the vehicle, such as the air conditioning or infotainment and the like, may be set to a lower priority. On the other hand, for networks of devices directly involved in the operation of the vehicle, such as the window regulators or the bodywork ECU (in other words, devices that are more likely to be dangerous due to misuse), a higher priority may be set.

For example 4 a diagram describing the gateway in outline. In the in 4 example shown is the gateway 410 to the different networks N41 and N43 connected between the networks concerned N41 and N43 the information exchange is controlled.

The network N41 is shown schematically as a network with a high priority, to which the various devices possibly directly involved in the operation of the vehicle are connected. In a concrete example are to the network N41 the ADAS 430 , the steering column 440 as well as the brakes 450 and the like components are connected.

The network N43 is schematically as a network (for example, a network with lower priority than the network 41 ) with a comparatively low priority, to which the various devices not directly involved in the operation of the vehicle are connected. In a concrete example are to the network N43 the infotainment 460 , the air conditioner 470 , the diagnostic tool 480 as well as the lighting system 490 and the like components are connected.

As described above, when multiple networks (subnetworks) are interconnected (especially when networks of different priorities are interconnected), it is desirable that they be controlled such that there is only limited information exchange between the networks. With this in mind, guaranteeing gateway security is important.

A concrete example will be in 4 shown, it being assumed that the infotainment 460 the state of the ADAS 430 indicates relevant information. In this case, for example, the information from the ADAS 430 over the gateway 410 to infotainment 460 transfer.

On the other hand, the structure of infotainment 460 complex and the plant has many features, so the risk of security risks tends to be higher than other devices. Starting from the assumption of this situation, it is necessary to ensure that even if a normal operation of infotainment 460 over the gateway 410 should be difficult, due to malfunction not messages are transmitted (for example, brake signals, etc.) which could lead to dangerous situations. For this purpose are for the gateway 410 numerous security measures required.

As usual measures can be cited Secure Boot or Run Time Tuning Detection and by using these measures, the integrity of the microcontroller data storage through the gateway 410 guaranteed. However, if an error is detected in Secure Boot or Run Time Tuning Detection, the available choices are to reset the gateway 410 or deactivation of the gateway 410 (in other words a scrapping) limited.
In this case it can happen that the gateway 410 permanently no longer diagnosed or repaired.

In this context, this publication is for the gateway 410 a security monitoring part 100 provided to solve the above-mentioned problems and whose structure is explained by an example.

For example 5 5 is a diagram for another application example of the security monitoring part according to this embodiment, wherein the security monitoring part concerned is constructed in application to a gateway as in the block diagram of the function of the relevant gateway.

As in 5 illustrated, includes the gateway 410 the main microcontroller 411 , as well as the CAN communication parts 416a and 416b , The CAN communication part 416a is like in 4 presented to the network N41 connected. Furthermore, the CAN communication part 416b is like in 4 presented to the network N43 connected. Also, in the remarks below, compared with the network N43 a higher level of security from the network N41 required. In other words, for the network N41 is set higher priority than for the network N43 ,

The main microcontroller 411 includes the control part (CPU) 414 , a store 415 , the HSM 413 and the security monitoring part 100 , At the in 5 example shown takes over the HSM 413 the function of the security certification authority. For this reason, key information from the security monitoring part 100 and the HSM 413 divided. In the remarks below, the relevant ones are included in the safety monitoring part 100 stored key information as "key information 190" and the relevant in the HSM 413 (that is, the security certification authority) stored key information as "key information 195 ' designated.

In the example shown in Figure, those are to the network N41 connected components subject of protection. In other words, when there are security issues, the security monitoring part disables 100 the CAN communication part 416a , so that access to the relevant components no longer from outside the network N41 is physically limited, thereby protecting the components in question from malicious attacks. The contents of the respective functions are explained in detail below.

The control part 414 transmits messages between the CAN communication part 416a and 416b , In other words, if the control part 414 from one of the CAN communication part 416a or 416b Receives messages, it transmits them to the corresponding other page. That way, it's going to be connected to the network N41 or the network N43 connected devices to the devices connected to the other network.

The control part 414 also has the task of exchanging messages between the CAN communication part 416a and 416b (in other words the network N41 and the network N43 ). If, for example, the control part 414 from one of the CAN communication part 416a or 416b received messages do not meet the conditions set for these messages the transmission to the other side is denied (that is, the transmission to the other side is blocked). Through this control, the message transmission between the network N41 and the network N43 over the gateway 410 (Control section 414 ).

The memory 415 stores the individual information temporarily or permanently. As a concrete example, the program data for execution of the control part 414 offered functions (for example program libraries etc.) or also control information data in the memory 415 get saved. Furthermore, those between the CAN communication part 416a and 416b exchanged information (for example at least part of the messages) temporarily in memory 415 get saved.

The HSM 413 for example, those in memory 415 regularly monitor stored information and, if abnormalities occur (eg, anomalies related to safety), prove the anomalies concerned.

Further, the HSM 413 can also act as a security certification authority. In other words, if the HSM 413 No abnormalities have been detected by the safety monitoring section 100 faced challenges based on key information 195 generates a response and the relevant response to the relevant safety monitoring part 100 sent. On the other hand, if the HSM 413 Unusualities (for example, safety-related anomalies) have been demonstrated, the transmission of an answer to that of the security surveillance part 100 restricted challenge. In this case, it comes in the security monitoring part 100 at a timeout at the timer.

Between safety monitoring part 100 and HSM 413 (that is, the security certification authority), an authentication is performed at regular intervals. In a concrete example, the safety monitoring part sends 100 one based on the key information 190 generated challenge to the HSM 413 and decodes and authenticates those from the HSM in question 413 sustaining answer based on the key information 190 , If the authentication by the security monitoring part 100 was successful, the timer is reset.

On the other hand, only if the authentication by the security monitoring part 100 was successful, the timer is reset. In other words, if the HSM 413 Unusuals have proven and the answer to the safety monitoring part 100 has been limited, the counter for the timer continues to run and this then results in a timeout. If there is a timeout, the security monitoring part sends 100 a the CAN communication part 416a disconnecting signal (ie a disable signal) to the relevant CAN communication part 416a ,

As a concrete example is in the in 5 illustrated example, an enable terminal 417 for the CAN communication part 416a provided so that on this CAN communication part 416a based data transfer function can be toggled between activation and deactivation. In other words, the safety monitoring part 100 transmitted Disable signal is via the Enable connection 417 into the CAN communication part 416a enters and deactivates this CAN communication part 416a ,

By the construction described above, for example, when engaged on the control part 414 also when transmitting malicious messages (signals) from the relevant control part 414 to the network N41 connected components, the transmission of these messages in this CAN communication part 416a physically blocked. Because even in this state the network N43 still enabled, can with the diagnostic tool 480 over the relevant network N43 the gateway 410 be diagnosed, so that a repair of the relevant gateway 410 is possible.

At the in 5 Example shown are the HSM 413 and the security monitoring part 100 shown as separate components, but the HSM concerned 413 and the security monitoring part 100 can also be integrated. Furthermore, the authentication between the HSM 413 and the security monitoring part 100 performing part outside the gateway 410 be provided.

As an application example of a security monitoring part according to this embodiment described above, this related security monitoring part will be described with reference to FIG 4 and 5 as an example of an application to the function of a gateway (GW) ECU connected to a plurality of in-vehicle networks.

<3.4 Application example as Telematics Communication Unit (TCU)>

Next, as an application example of a security monitoring part according to this embodiment, the security surveillance part concerned will be given as an example of one Application as Telematics Communication Unit (TCU) explained.

The TCU is a component for implementing the data transmission between the vehicle and the outside world. 6 For example, Fig. 16 is a diagram for explaining an application of a security monitoring part according to this embodiment, in which the security control part concerned is applied to said TCU and an example of the function of the related TCU is shown as a block diagram.

The TCU 510 is like in 6 displayed on the vehicle-mounted network such as CAN 530 connected. For example, the communication parts 512 the communication interface for connecting the TCU 510 to the CAN 530 shown schematically. Further, the TCU 510 may also be constructed so that it can be connected to networks corresponding to 3G / 4G, Wi / Fi (Registered Trade Mark) and Bluetooth (Registered Trade Mark) and the like radio standards. In the 6 are the networks 550 . 560 and 570 schematically represented as 3G / 4G, Wi / Fi (registered trademark) and Bluetooth (registered trademark) and the like radio standards corresponding networks. Further, the communication parts 513 . 514 and 515 schematically show the to the networks 550 . 560 and 570 connected TCU. The TCU 510 It can also be designed to work on infrastructures 540 how Smart City can be connected. For example, a communication interface for the connection of the communication part 512 by means of the TCU 510 to the infrastructure 540 shown schematically.

As in 6 shown is the TCU 510 designed to connect to multiple networks, including in-vehicle and external networks. With this structure it is achieved that, for example, both in-vehicle devices as well as off-board devices via the TCU 510 can exchange information with each other. That's why the TCU 510 often involved in important functions (for example unlocking the door and the like), which tends to create security vulnerabilities. As an example of a malicious attack on the TCU 510 can be called a so-called "worldwide attack". Specifically, this means that in the presence of security vulnerabilities in the interface of the TCU 510 the relevant interface is exploited to spread computer worms and the like.

To obtain information about the events described above (for example, the intrusion of computer worms), an IDS can also be introduced. However, taking action other than IDS alone can prove difficult.

As action on events such as those described above, the transmission of a program update may be called. On the other hand, program update based actions are only effective for TCUs that have not yet been threatened or attacked by the computer worms or the like, while in TCUs that have already been attacked by the computer worms, it has limited effectiveness (that is, the problem must be solved) not necessarily solved).

Therefore, in this publication, the TCU 510 with a security monitoring part 100 equipped to solve the above problems and is explained by an example.

For example, in the case of 6 The illustrated example includes the TCU 510 a security monitoring part 100 and the relevant safety monitoring part 100 Performs authentication between the outside of the vehicle provided security certification authority 200 like Key Remote Management Server (KMS). In other words, the security monitoring part 100 accesses a 3G / 4G radio standard based radio network 550 , or via a wireless network based on the Wi-Fi (registered trademark) radio standard 560 or the like on the security certification authority 200 and performs authentication. Furthermore, in which 6 illustrated example share the safety monitoring part 100 and the security certification authority 200 the key information. Furthermore, in the following explanations, the safety monitoring part 100 stored key information "key information 190 ' and the relevant in the security certification authority 200 stored key information "key information 190 ' called.

At the in 6 example shown is the safety monitoring part 100 via transmission lines and the enable connection of the respective communication parts 511 - 515 connected to a general input output module (GPIO). If the safety monitoring part 100 from the security certification authority 200 Reply returns, the timer of the above-mentioned general input output module is continuously updated. In other words, as long as the security certification body 200 Answers are transmitted, remain the communication parts 511 - 515 activated.

On the other hand, for example, the IDS has a security vulnerability (for example, infection with a computer worm) in the interface (for example the communication part 511 ) for access to the network 550 Proven according to the 3G / 4G standard. In this case, the security certification authority 200 (for example, the KMS) based on the results detected by the IDS, the response from the security monitor 100 limit the challenges that have been transferred.

Specifically, this means that the security monitoring part 100 due to the key information 190 Then generates challenges and then those challenges through the networks 550 respectively 560 for safety remote certification authority 200 (for example the KMS) sends. The security certification authority 200 then checks the validity of the safety monitoring part 100 transferred challenges based on the key information 195 and sets the timer values for the communication parts 511 - 515 firmly. At this time, the timer values for the communication parts 511 - 515 from the security certification authority 200 for the communication parts 511 - 515 be set independently. And the security certification authority 200 then associates the specified timer values with the responses from the safety monitor 100 and then sends the relevant replies to the security monitoring part 100 , The safety monitoring part 100 then check the security certification authority 200 responses returned based on the key information 190 , The safety monitoring part 100 checks the validity of the respective answers, and on the basis of the timer values associated with the respective responses then the timers of the respective communication parts 511 - 515 updated.

On the basis of this construction, the manufacturers of the TCU 510 the return of answers from the security certification authority 200 to the safety monitoring part 100 at least partially deactivated TCU 510 (for example one of the communication parts 511 - 515 ) restrict. In this case, it is associated with a timeout from the security monitor 100 from that security surveillance unit concerned 100 sent to the corresponding interface a disable signal and so physically disabled the relevant interface.

In another example, even if you set "0" as the value for the timer by using the security certificate authority 200 to the safety monitoring part 100 sent response information (in other words, the timer value) are limited. In this case, the timer value on receipt of a response from the safety monitoring part 100 updated to 0. In other words, when the time switch concerned times out, the safety monitoring part will 100 sends a disable signal to the corresponding interface, thus physically deactivating the relevant interface.

Due to the limitations described above, it becomes possible to prevent the TCU 510 computer worms continued to spread in connection with penetration into the interface. Furthermore, because of the security monitoring part 100 that of the interface (for example, the communication parts 511 - 515 etc.) corresponding hardware is rendered difficult for computer worms and the like malicious programs to bypass the software and so spread.

The explanations for the example described above focus, for example, on an intrusion into the interface of the TCU 510 but do not have to be limited to this situation. If, for example, in an external device of the TCU 510 has penetrated, the relevant TCU 510 by physically disabling security breaches of the external devices concerned by switching off the interface used to exchange messages with the external devices concerned.

In the above descriptions, the security updates the certification authority 200 the time switch of the safety monitoring part 100 but an interface may also be provided via which, through user operation, the timer of the security monitoring part 100 can be deliberately adjusted. With such a construction, for example, it becomes possible for the user (or the maintenance personnel) to control the time switch of the safety monitoring part via an operation 100 , sets to "0", thus immediately a timeout in the relevant safety monitoring part 100 and thereby protects the desired components.

Above was referring to 6 as another application example of a security monitoring part according to this embodiment, an example of the application of the subject security monitoring part as a Telematics Communication Unit (TCU) explained.

<3.5 processing>

Next, an example of the processing flow when the safety monitoring part according to this embodiment is applied to the in-vehicle system will be explained.

(If the HSM acts as a security certification authority)

First, based on the 7 to 9 an example of the function of HSM as a security certification authority 200 explained. In other words, this control example explains how certain components are protected by the security monitoring part 100 performs the authentication between the HSM and deactivates the CAN communication parts based on the relevant authentication results. The 7 to 9 show an example of the flow of processing in the vehicle-mounted system according to the same embodiment, which schematically shows in an example how the safety monitoring part 100 certain devices enabled or disabled. In addition, the HSM monitors whether the security of the CPU is compromised or not, and according to the monitoring results in question, the operation is then linked to the authentication with the security monitoring part 100 controlled.

For example, in 7 an example of being a security certification authority 200 HSM, the CPU and the respective functions. Specifically, processing flow in the operation of the CPU is schematically the one with the symbols S131 - S135 marked shown. Furthermore, the operation of the HSM in the processing flow is schematically the one with the symbols S101 - S107 marked shown.

For example, under certain conditions, the CPU will start operating ( S131 ) transmits a VAN message directed to certain components to the CAN communication part described below ( S133 ) and then switch off the operation temporarily ( S135 ). The CPU successively repeats the above-described series of processings (in other words, those with the reference symbols S131 - S135 marked processes). On the other hand, if a malicious program has invaded the CPU, for example, the one with the reference symbol S133 marked processing from the CPU sent a malicious message to the CAN communication part.

The HSMs monitor the security state of the CPU sequentially ( S101 ). Unless HSM proves that it has any unusual features related to the security of the CPU at this time ( S101 , YES), they respond to authentication requests (challenges) from the security monitor 100 and send the relevant safety monitoring part 100 new setting values for the time switches ( S103 ). On the other hand, if the HSM have demonstrated unusualities in connection with the security of the CPU ( S101 , NO), refuse requests for authentication from the security monitor 100 (for example, restricting responses to the queries concerned), thus causing a timeout for the security guarding in question 100 ( S105 ).

The HSMs lead the ones with the reference symbols S101 - S105 characterized series of processing at regular intervals. In other words, after execution with the reference symbols S101 - S105 characterized series of processing and waiting of a certain period of time ( S107 ), the relevant series of processings is carried out again at the end of the relevant period.

Subsequently, the sequence of the series of processings by the security monitoring part 100 based on 8th explained.

The safety monitoring part 100 generates a challenge to authenticate on a random and the like code and the challenge then becomes the HSM (in other words, the security certification authority 200 ) ( S151 ).

The safety monitoring part 100 then receives from the HSM answers to the above challenges and only if a successful authentication can be confirmed ( S153 , YES), a control activating the CAN communication part is carried out ( S161 ). As a concrete example, the safety monitoring part gives 100 an enable signal to the enable port and thereby activates the CAN communication part.

On the other hand, if the security monitoring part 100 is unable to receive the above challenges from the HSM and authentication failed ( S153 , NO), it waits for a certain period of time and unless there is a timeout ( S155 ) is then again waited for a response from the HSM ( S153 ). And if the state in which the security monitoring part 100 HSM can not receive replies and times out ( S157 , YES), the system is controlled so that the CAN communication part is deactivated ( S159 ). As a concrete example, the CAN communication part is deactivated when the safety monitoring part 100 sends a disable signal to the enable terminal of the CAN communication part.

The safety monitoring part 100 guides you with the reference symbols S151 - S161 characterized series of processing at regular intervals. In other words, after the security monitoring part 100 the with the reference symbols S151 - S161 waits for a certain period of time ( S163 ) and, at the end of this period of time, reruns the series of processes concerned.

Subsequently, based on the 9 the flow of a series of processing by the CAN communication part explained.

The CAN communication part receives CAN messages from the CPU ( S171 ). If the CAN communication part is activated at this time ( S173 , YES), the CAN communication part transmits the receiving CAN messages to the addresses of the components ( S175 ). On the other hand, if the CAN communication part due to the control of the safety monitoring part 100 is deactivated ( S173 , NO), the CAN messages sent by the CPU to the CAN communication part are ignored ( S177 ).

Above was based on 7 to 9 an example of a controller for protecting certain components by deactivating the CAN communication part based on the authentication results between the security monitoring part 100 according to this embodiment and the safety certification authority 200 explained.

(If the OEM remote server performs the function of the security certification authority) 10 to 12 An example explaining how the OEM remote server performs the function of the security certification authority 200 exercises. In other words, depending on the results of authentication between the security monitor 100 and the OEM remote server, an example of a controller for protecting certain components by deactivating the CAN communication part is explained. The 10 to 12 Fig. 10 are flowcharts showing another example of the processing procedure of a vehicle-mounted system according to this embodiment.

For example, shows 10 an example of the operation of the safety monitoring part 100 , At the in 10 The example shown generates the safety monitoring part 100 by encoding a random number code and an identification system (ID) for self-recognition challenges and sends the relevant challenges to the CPU ( S211 ). These challenges are then sent to the OEM server via the CPU. And by the security surveillance part 100 then, through the CPU from external OEM servers, receives responses to the above challenges, authentication is performed in relation to the OEM server concerned ( S213 ). In the remarks below (in other words, those with the reference symbols S215 - S223 marked processing) will be explained in more detail 8th shown example with the reference symbols S155 - S163 labeled identical processing omitted.

Subsequently, based on the 11 the flow of a series of processing by the CPU communication part explained. In these explanations, it will be explained how the CPU controls a first hardware part and a second hardware part separately from each other.

The CPU will start up for some reason ( S231 ). In the in the 10-12 As shown, the CPU mediates the data transfer between the security monitoring part 100 and the OEM server ( S233 ). In other words, if the CPU from the security monitoring part 100 addresses challenges addressed to the OEM server, these challenges are transferred to the OEM server. If the CPU then receives responses from the OEM server to the above-mentioned challenges, these answers can also be sent to the security monitoring part 100 be transmitted.

The CPU also controls the first hardware part and the second hardware part ( S235 . 237 ). In a concrete example, the CPU sends messages or signals to the first hardware part and the second hardware part, and so can control the respective first hardware part and the second hardware part, respectively.

And when the CPU completes each of the above processing, its operation can be temporarily suspended ( S239 ). The CPU repeats the above-described series of processings (in other words, those with the reference symbols S231 - S239 characterized processes) periodically.

The following is based on the 12 An example of the processing flow is explained when the OEM server performs the security CA function 200 exercises. In these explanations, the OEM server decides individually whether or not there is a security problem for the first hardware part and the second hardware part, and then adjusts the individual time switch values for the respective first hardware part and the second hardware part as part of the control.

As in 12 The OEM server, in conjunction with authentication requests, receives the security monitor part 100 that of the security surveillance part in question 100 generated challenges ( S251 ). At this time, the OEM server can decode the challenge in question based on the corresponding key information and the identification information for the security monitoring part from the relevant challenge 100 extract.

Next, the OEM server checks if any security issues have been reported to the first piece of hardware in conjunction with the controller ( S253 ). At this time, the OEM server makes inquiries to the IDS or the security monitoring system so that the above reports can be checked for faults. Furthermore, the OEM server determines the security monitoring part 100 captured identification information and makes the above request, so that relevant information can also be narrowed. If there are no reports of controller malfunctions on the first hardware part ( S253 , NO), a new timer value is set in conjunction with the control of the first hardware part ( S257 ). On the other hand, if there are reports of disturbances of the control on the first hardware part ( S253 , YES), the safety monitoring part refuses 100 the authentication of the relevant requests with regard to the control of the first hardware part by the OEM server ( S255 ). In this case, it comes in the security monitoring part 100 during the control of the first hardware part at a timeout. In other words, by the safety monitoring part 100 For example, if a disable signal is sent to the interface required to receive signals from the CPU through the first hardware part, that interface is turned off.

Likewise, the OEM server checks for security-related issues with the control of the second piece of hardware ( S259 ). If no faults in the control of the second hardware part are reported ( S259 , NO), the OEM server sets new timer values for the second hardware part ( S263 ). On the other hand, however, if disturbances of the control of the second hardware part are reported ( S259 , YES), the OEM server denies the security monitoring part 100 authentication related requests for control of the second hardware part ( S261 ). In this case, it comes in the security monitoring part 100 when controlling the second hardware part at a timeout. In other words, by the safety monitoring part 100 For example, if a disable signal is sent to the interface required to receive signals from the CPU through the second hardware part, that interface is turned off.

The OEM server generates responses to the challenges of the security monitoring part based on the above decisions regarding the first hardware part and the second hardware part 100 and then sends the relevant replies to the relevant security monitoring part 100 ( S265 ).

The OEM server repeats the series of processings described above (in other words, those with the reference symbols S251 - S265 characterized processes) periodically.

Above was based on the 10 Figure 12 illustrates an example where an OEM remote server performs the function of the security certification authority 200 exercises.

<< 4. Conclusions >>

As stated above, in a vehicle-mounted system according to this embodiment, a security watchdog for the ECU and such control devices is provided, with interfaces set via CPUs and the like, the components are controlled, and the control parts are provided independently of each other. On the basis of such a structure, an authentication is carried out between the security monitoring part and the security certification authority, and then the access to the abovementioned components is controlled (for example limited) on the basis of the authentication results via the abovementioned interface. At this time, access to the above-mentioned components can also be limited physically by deactivating the above-mentioned interface via the aforementioned security monitoring part. Further, the security monitoring part is provided with a timer, so that if the detection of the answers concerning authentication by the above-mentioned security certification authority fails and the time switches are timed out, access to the above-mentioned components can be restricted.

With the technique according to the present embodiment as described above, it is possible to restrict access to protected components even in the case where some of the vehicle-mounted devices have become abnormal (for example, security abnormalities). This ensures that the affected devices are isolated from the components to be protected and the components concerned so against malicious misuse of the devices concerned can be protected. Furthermore, since access to the components to be protected is physically blocked, even with the entry of computer worms or such malicious programs into the vehicle-mounted networks, the programs concerned can be made difficult to access to the respective components by software bypasses.

In this way, by applying the technique according to this publication, it becomes possible to effectively disable some of the devices within in-vehicle networks (for example, the CPU or the microcontroller) even in the event of disruption of part of the modules without switching off the devices temporarily or permanently. As a result, it is possible, for example, to enable the manufacturer to diagnose or repair the ECU and similar devices without having to replace them, even in the event of serious security incidents. In other words, by applying the technique according to this publication, it is also possible, when incidents occur, to choose more numerous and varied measures to solve the problems in question than before and, moreover, to choose more appropriate measures.

However, the structure described above is only one possible example, and the structure of a vehicle-mounted system need not necessarily be limited to this embodiment of the publication. In a concrete example, the location of the function of the above-mentioned security certification authority 200 not be specially defined. For example, the security certification authority 200 as well as the security monitoring part 100 be provided within the device. Furthermore, the security certification body can 200 as well as the security monitoring part 100 be provided outside the device. In this case, the security certification authority 200 be provided in a remote server. In another example, the security is Certification Authority 200 provided within the vehicle-mounted networks and instead of having a security monitoring part 100 equipped devices may also be provided other devices. At the in 4 The concrete example shown is the ADAS 430 with a security monitoring part 100 equipped and the gateway 410 assumes the function of security certification authority 200 (in other words, the gateway 410 can also use a security certification authority 200 be equipped).

Furthermore, it is not absolutely necessary to have a safety monitoring part 100 to offer appropriate construction. For example, parts of the above-mentioned devices ECU, GW, TCU, and the like may also be offered. Further, in one example, the devices ECU, GW, TCU and the like may be used as detachable components of the safety monitoring part 100 (for example, as chips) are offered. In this case, the structure of the respective units corresponds to an example of a "control device".

Above, appropriate embodiments of the present invention have been explained with reference to the figures, but the inventions are not limited to these examples. Persons with relevant general knowledge in the technical field pertaining to this invention can certainly imagine a wide variety of modifications and corrections within the scope of the technical concepts described in the claims, but these are of course to be considered as belonging to the technical scope of this invention.

LIST OF REFERENCE NUMBERS

10

Control network

20

network

30

network

50, 50a-50h

control device

100

Security Watchdog

101

encryption module

111

Certification processing part

113

control part

103

code generator

105

Communication Interface

107

time switch

109

general input-output module

200

Security certification authority

311

Main control part

313

detection part

315

Actuator driver

317

Communication Interface

331

actuator

340

in-vehicle network

350

Internet

360

network

410

gateway

411

main microcontroller

414

control part

415

Storage

416a, 416b

communication part

417

Enable pin

440

steering column

450

brake

460

infotainment

470

air conditioning

480

diagnostic tool

490

lighting system

510

TCU

511-515

communication parts

540

infrastructure

550, 560, 570

networks

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• JP 2017073765 [0003]

Claims (14)

A control device equipped with a certification processing part (111) which, under certain conditions, performs authentication in relation to the security certification authority, and for controlling the components connected to the networks installed in the vehicle with independently and specifically designated interfaces for the control units, based on the results of the aforementioned authentication based access to the aforementioned components via the aforementioned interfaces by a control part (113) is controlled. Control device after Claim 1 in which the aforementioned control part (113) in the event of failure of the aforementioned authentication, the access to the aforementioned components via the aforementioned interfaces is limited. Control device after Claim 2 in which the aforementioned control part (113) restricts access to the aforementioned components in the event of a failure to detect a response concerning the aforementioned authentication from the aforementioned security certification authority. Control device according to one of Claims 1 - 3 which is equipped with a code generator (103) for generating codes used for authentication, and the aforesaid certification processing part performs authentication with the aforementioned security certification authority based on the aforementioned code. Control device after Claim 4 in which the aforesaid authentication is performed using the aforementioned code according to a challenge-response method. Control device according to one of Claims 1 - 5 in which the control part (113) controls the access to the aforementioned components via the aforesaid interfaces after a set time has elapsed. Control device after Claim 6 in which the aforementioned period of time is set by the aforementioned safety certification body. Control device according to one of Claims 1 - 7 which is equipped with a security certification authority (200). Control device according to one of Claims 1 - 7 wherein a certification processing part (111) performs the authentication between certain networks and the aforementioned security certification authority. Control device after Claim 9 wherein said certain networks are the in-vehicle networks maintained by said control device. Control device after Claim 9 in which the aforesaid particular networks also comprise the outside of the vehicle to access the networks maintained by the aforesaid control device. Control device according to one of Claims 1 - 11 wherein said control device is a multi-network control device, said control device (113) restricts access to the protected networks among said plurality of networks by different networks other than said networks in accordance with said authentication results. Control device after Claim 12 in which the aforementioned networks to be protected are the in-vehicle networks with which the aforesaid control device exchanges stored information concerning the operation. Control method comprising a computer with components independently of each other connected to the networks installed in the vehicle via special interface controlling units, which under certain circumstances perform authentication with the security certification authority and controls the access to the aforementioned components due to the aforementioned authentication results on the aforementioned interfaces.

Images