DE102019220450A1 - Device with an interface and method for operating a device with an interface - Google Patents

Abstract

Method (300) for operating a device (100) which has an interface (120) for data exchange with an external unit (200) and at least one first memory device (130) for non-volatile storage of a first analysis flag (FA), and at least a second memory device (140) for storing at least one computer program (PRG1), in particular executable by a computing device (110) of the device (100), the method (300) comprising the following steps: checking (310) whether the first Analysis flag (FA) is set in the first memory device (130), and if the first analysis flag is set, a step (320a) for transmitting the at least one computer program (PRG1) from the external unit (200) via the Interface (120) is executed in the second memory device (140) of the device (100), and / or in a step (320b) for executing the computer program (PRG1) by the computing device (110) d, and if the first analysis flag (FA) is not set, the step for transmitting and / or the step for executing is not carried out.

Description

State of the art

The disclosure relates to a method for operating a device which has an interface for data exchange with an external unit.

The disclosure also relates to a device with an interface for exchanging data with an external unit.

Disclosure of the invention

Preferred embodiments relate to a method for operating a device which has an interface for data exchange with an external unit and at least one first memory device for non-volatile storage of a first analysis flag, and at least one second memory device for storing at least one, in particular by one Computing device of the device executable, computer program, the method comprising the following steps: checking whether the first analysis flag is set in the second memory device, and if the first analysis flag is set, a step for transmitting the at least one computer program from of the external unit is executed via the interface in the second memory device of the device, and / or is executed in a step for executing the computer program by the computing device, and if the first analysis flag is not set, the step of transmitting and / or the step to execute is not carried out.

The first analysis flag generally serves as a status indicator for identifying a particular condition. The first analysis flag can be set, deleted or checked. According to the invention, access via the interface of the device is enabled or denied on the basis of the first analysis flag.

According to a preferred embodiment, the computer program comprises a boot loader for the computing device. As soon as it is executed, the bootloader can then, for example, control the subsequent loading and / or execution of at least one further computer program by the computing device.

In further preferred embodiments, the computer program is a computer program for controlling the execution of software, in particular test software, in particular end-of-line (EoL) software. According to further preferred embodiments, the computer program can also include the test software, in particular the end-of-line (EoL) software, or parts thereof. The interface for transmitting the computer program is also referred to below as the EoL interface.

In further preferred embodiments, the device is put into an analysis state by executing the computer program and / or transmitting the computer program. The first analysis flag advantageously indicates whether the invention can be placed in the analysis state. According to the invention, the computer program is executed and / or transmitted, that is to say access via the EoL interface, only when the analysis flag is set. Unauthorized execution and / or transmission can be prevented on the basis of the analysis flag and thus the operational reliability of the device can be increased.

In further preferred embodiments it is provided that the device is put into an application state if the first analysis flag is not set.

The method according to the invention is advantageously carried out when the device is booted, with the device being able to be switched to either an analysis state or an application state as a function of the analysis flag.

In further preferred embodiments, the computer program is advantageously designed to carry out operations, in particular system-related operations, in particular a hardware test, in particular a final hardware test, of the device and / or data input to the device, in particular transferring at least one function and / or at least a configuration. For example, the computer program can also be designed to run activation software, in particular function-on-demand activation software for activating functions of the device. According to further embodiments, the computer program can also comprise the activation software or parts thereof.

In further preferred embodiments, the device is an electronic control unit (ECU), in particular for a motor vehicle, for example for an internal combustion engine of a motor vehicle. In further preferred embodiments, however, the application of the principle according to the embodiments is not limited to the motor vehicle sector or the area of control devices.

In further preferred embodiments, the at least one second memory device is a memory device for volatile storage of at least one computer program, in particular that can be executed by the device. This can be advantageous, for example, if the computer program, in particular a computer program for controlling the execution of test software, in particular end-of-line (EoL) software, or the test software, in particular end-of-line (EoL) software, or parts of it, should not be stored permanently in the storage device.

In further preferred embodiments, the computer program includes privileged rights, in particular when executing the computer program, in particular when executing test software, in particular end-of-line (EoL) software, access to hardware of the device and / or reading and / or writing of storage devices of the device be possible. A potential abuse of these privileged rights can be avoided using the method according to the invention.

In further preferred embodiments, the first memory device comprises a memory area with privileged access rights. The write and / or read access to this memory area is advantageously only possible through a software security module (SSM).

In further preferred embodiments it is provided that the first storage device comprises a hardware security module (HSM), in particular a cryptography module, or is part of a hardware security module (HSM), in particular a cryptography module. The hardware security module is designed, for example, to execute cryptographic methods or algorithms or at least parts thereof.

In further preferred embodiments it is provided that the hardware security module (HSM) has a protected, in particular separate, memory for storing the first analysis flag.

In further preferred embodiments it is provided that the method further comprises: checking whether a further analysis flag is set, and if the further analysis flag is set, the step of checking the first analysis flag is carried out. This can prove to be advantageous in particular for reasons of performance or cycle time when the device is booted. The first analysis flag, which is stored in the first storage device of the device, is only checked if the further analysis flag is also set. The further analysis flag is stored, for example, in a high-performance readable memory device of the device, in particular in a working memory, RAM, random access memory, in particular a retention RAM. A retention RAM is a volatile memory, the memory content of which is retained in the event of a software / software reset. The memory is reset with a hardware / hardware reset.

In further preferred embodiments it is provided that, when the first analysis flag is set, a step for authenticating the external unit and / or a user of the external unit between the step of checking the first analysis flag and the step of transmitting the computer program is carried out, wherein after successful authentication the step of transmitting the at least one computer program is carried out via the interface into the second memory device of the device, and after unsuccessful authentication the at least one computer program is not transmitted.

In further preferred embodiments it is provided that the method further comprises: authenticating the transmitted computer program, the transmitted computer program being executed by the device after the transmitted computer program has been successfully authenticated, and the transmitted computer program not being executed after the computer program has not been successfully authenticated . The authentication includes in particular an integrity and / or authenticity check of the transmitted computer program.

In further preferred embodiments it is provided that the method according to at least one of the preceding claims, wherein the authentication of the external unit and / or a user of the external Unit and / or the authentication of the transmitted computer program using a signature-based or key-dependent, checksum-based approach, also referred to as a Message Authentication Code, MAC. In the signature-based approach, the signature with a private key is verified by an associated public key. In the key-dependent, checksum-based approach, a checksum, also referred to as a message authentication code, MAC, is calculated on the basis of a secret key and verified using the secret key.

In further preferred embodiments it is provided that the authentication of the external unit and / or a user of the external unit and / or the authentication of the transmitted computer program takes place using at least one cryptographic, in particular private, key. The authentication and / or authentication can advantageously take place using an asymmetric key pair or using a signed, cryptographic hash or using a key-dependent, cryptographic checksum.

Advantageously, different keys are used to authenticate the external unit and / or a user of the external unit and to authenticate the transmitted computer program.

In further preferred embodiments it is provided that the authentication of the external unit and / or a user of the external unit and / or the authentication of the transmitted computer program further comprises: generating a challenge, in particular comprising a random number and / or a pseudo-random number, transmitting the challenge to the external entity and receiving the challenge from the external entity. The challenge is signed by the external unit. In the signature-based approach, the external unit signs the challenge with the cryptographic, in particular private, key. The associated public key for verification of the private key is stored in the device. In the key-dependent, checksum-based approach, the external unit transmits a key-dependent checksum, also referred to as a message authentication code, MAC, the message authentication code being calculated based on a secret key. To verify the message authentication code, the secret key is stored in the device.

In further preferred embodiments it is provided that the method further comprises: setting the first and / or further analysis flag. By setting the first and possibly the further analysis flag, access via the EoL interface is enabled without making irreversible changes to the hardware of the device.

In further preferred embodiments it is provided that the method further comprises: deleting the first and / or further analysis flag. By deleting the first and possibly the further analysis flag, access via the EoL interface is blocked without making irreversible changes to the hardware of the device.

In further preferred embodiments it is provided that the first and / or further analysis flags are set and / or deleted by the external unit and / or a user of the external unit.

In further preferred embodiments it is provided that a step for authenticating the external unit and / or a user of the external unit is carried out before the setting and / or deletion, and the setting and / or deletion only takes place after successful authentication. In contrast, it can also prove to be advantageous if the first and / or the further analysis flag can be deleted without prior authentication.

In further preferred embodiments it is provided that the checking of the first and / or further analysis flag is carried out as a function of a usage phase, in particular a phase of a life cycle, of the device.

Further preferred embodiments relate to a device with an interface for data exchange with an external unit and with at least one first memory device for non-volatile storage of a first analysis flag and with at least one second memory device for storing at least one computer program, in particular that can be executed by the device, in particular for controlling an execution of a test software, in particular an end-of-line software, wherein the device is designed to execute the method according to the embodiments.

In further preferred embodiments, the interface of the device is preferably bidirectional communication interface (address bus and / or data bus and / or serial communication bus or the like), via which the device can be connected for data exchange with an external unit, in particular for testing the device.

In further preferred embodiments, the second memory device is a memory device for volatile storage of the at least one computer program, in particular that can be executed by the device. In further preferred embodiments, the second memory device is a working memory, RAM, random access memory.

In further preferred embodiments it is provided that the interface is a test and / or diagnostic interface, in particular an Ethernet or CAN interface.

In further preferred embodiments, the first memory device comprises a memory area with privileged access rights. The write and / or read access to this memory area is advantageously only possible through a software security module (SSM).

In further preferred embodiments it is provided that the first storage device comprises a hardware security module (HSM), in particular a cryptography module, or is part of a hardware security module (HSM), in particular a cryptography module. The hardware security module is designed, for example, to execute cryptographic methods or algorithms or at least parts thereof.

In further preferred embodiments it is provided that the hardware security module (HSM) has a protected, in particular separate, memory for storing the first analysis flag.

In further preferred embodiments, only the device, in particular the computing device of the device, which is designed to carry out the method according to the embodiments, has read access to the protected, in particular separate, memory, in particular to the first analysis flag stored in the hardware security module. It can advantageously also be provided that the hardware security module stores a copy of the first analysis flag in a memory device, in particular a shared RAM memory, to which the computing device has access.

In further preferred embodiments it is provided that the device has a computing device, in particular a computing device of a computer, in particular a computing device of a device according to the embodiments, in particular for carrying out the method according to the embodiments.

In further preferred embodiments, the computing device of the device has at least one of the following elements: a microprocessor, a microcontroller, a digital signal processor (DSP), a programmable logic module (e.g. FPGA, field programmable gate array), an ASIC (application-specific integrated circuit), a hardware circuit. In further preferred embodiments, combinations of these are also conceivable.

Further preferred embodiments relate to a computer-readable storage medium, comprising instructions, in particular in the form of a computer program, which, when executed by a computer, in particular by a computing device of a computer, in particular by a computing device of a device according to the embodiments, cause it to execute the method according to carry out the embodiments. In further preferred embodiments it can be provided that the storage medium comprises the first storage device of the device or is part of the first storage device of the device.

Further preferred embodiments relate to a computer program that includes computer-readable instructions, when they are executed by a computer, in particular by a computing device of a computer, in particular by a computing device of a device according to the embodiments, the method according to the embodiments.

Further preferred embodiments relate to a data carrier signal which the computer program transmits according to the embodiments.

Further preferred embodiments relate to a use of the method according to the embodiments and / or the device according to the embodiments and / or the computer program according to the embodiments for activating, in particular reactivating, an interface, in particular a test, in particular an end-of-line ( EoL) interface, and / or for deactivating the interface of the device of a device for transmitting a computer program that can be executed by the device, in particular for controlling an execution of test software, in particular end-of-line (EoL) software depending on a first and / or or another analysis flag FA , FR .

Further preferred embodiments relate to a use of the method according to the embodiments and / or the device according to the embodiments and / or the computer program according to the embodiments for enabling or not enabling the execution of a computer program that can be executed by the device and transmitted via the interface of the device .

Further features, possible applications and advantages of the invention emerge from the following description of exemplary embodiments of the invention, which are shown in the figures of the drawing. All of the features described or illustrated form the subject matter of the invention individually or in any combination, regardless of how they are summarized in the claims or their back-reference and regardless of their formulation or representation in the description or in the drawing.

• 1 ein vereinfachtes Blockdiagramm einer Vorrichtung gemäß bevorzugten Ausführungsformen und eine externe Einheit;
• 2 schematisch ein vereinfachtes Flussdiagramm von Teilen eines Verfahrens gemäß weiteren bevorzugten Ausführungsformen;
• 3 schematisch ein vereinfachtes Flussdiagramm von Teilen eines Verfahrens gemäß weiteren bevorzugten Ausführungsformen;
• 4 schematisch ein vereinfachtes Flussdiagramm von Teilen eines Verfahrens gemäß weiteren bevorzugten Ausführungsformen;
• 5 schematisch ein vereinfachtes Flussdiagramm von Teilen eines Verfahrens gemäß weiteren bevorzugten Ausführungsformen, und
• 6 schematisch ein vereinfachtes Flussdiagramm von Teilen eines Verfahrens gemäß weiteren bevorzugten Ausführungsformen.

In the drawing shows:

• 1 a simplified block diagram of an apparatus according to preferred embodiments and an external unit;
• 2 schematically, a simplified flow diagram of parts of a method according to further preferred embodiments;
• 3 schematically, a simplified flow diagram of parts of a method according to further preferred embodiments;
• 4th schematically, a simplified flow diagram of parts of a method according to further preferred embodiments;
• 5 schematically a simplified flow diagram of parts of a method according to further preferred embodiments, and
• 6th schematically a simplified flow diagram of parts of a method according to further preferred embodiments.

1 shows schematically a simplified block diagram of an apparatus 100 according to preferred embodiments. At the device 100 it is preferably an electronic control unit (ECU).

In further preferred embodiments, the device 100 be designed as a control device, in particular for a motor vehicle, for example for an internal combustion engine of a motor vehicle. In further preferred embodiments, however, the application of the principle according to the embodiments is not limited to the motor vehicle sector or the area of control devices.

The device 100 preferably has at least one computing device 110 on, for example, a storage device 130 , 140 can be assigned, in particular for at least temporarily storing at least one computer program PRG1 , PRG2 , in particular for controlling an operation of the device 100 . In further preferred embodiments, in the memory device 130 , 140 several computer programs can be stored, for example a bootloader, that is to say a computer program that initiates a start process for the device or the computing device 110 the device 100 or calling up other computer programs PRG1 , PRG2 , especially after the start process, can control, as well as the other computer programs PRG1 , PRG2 which are, for example, an operating system and / or application programs of the device 100 acts.

In further preferred embodiments, the computing device 110 at least one of the following elements: a microprocessor, a microcontroller, a digital signal processor (DSP), a programmable logic module (e.g. FPGA, field programmable gate array), an ASIC (application-specific integrated circuit), a hardware circuit. In further preferred embodiments, combinations of these are also conceivable.

The device 100 assigns an interface 120 on. At the interface 120 it can be, for example, a, preferably bidirectional, communication interface (address bus and / or data bus and / or serial communication bus or the like) via which the device 100 for data exchange with an external unit 200 , especially for testing the device 100 , is connectable. The external unit is, for example, a computer, in particular a test computer, which has a computing unit and at least one storage unit connected to the computing unit, and on which software, in particular testing software, is stored in an executable manner. For testing the device 100 , for example as part of an end-of-line (EoL) test, in particular at the end of the device manufacturing process 100 , is via the interface 120 a computer program PRG1 , in particular for controlling an execution of test software, in particular end-of-line (EoL) software, from the external unit 200 into the device 100 , in particular in a storage device 140 the device 100 , transfer.

In further preferred embodiments it is provided that the interface 120 a, in particular universal, test and / or diagnostic interface, in particular an Ethernet or CAN interface.

It is advantageous over the interface 120 a test, in particular hardware and / or software testing of the device 100 possible. Doing this is through the interface 120 , in particular when running test software, in particular end-of-line (EoL) software, access to hardware of the device 100 possible. To avoid potential misuse of this access via the interface 120 to prevent the interface 120 secured with suitable measures. Advantageous embodiments of such measures for protecting the interface 120 are discussed below with reference to the 1 to 6th described.

According to a preferred embodiment, the device comprises 100 at least one first storage device 130 for the non-volatile storage of a first analysis flag FA and at least one second storage device 140 for storing the at least one computer program, in particular that can be executed by the device PRG1 , in particular for controlling an execution of test software, in particular end-of-line (EoL) software.

In the case of the second storage device 140 for storing the computer program PRG1 it is, for example, a memory device for volatile storage of the computer program PRG1 , for example a working memory, RAM, random access memory. As part of the testing of the device 100 , for example as part of an end-of-line (EoL) test, in particular at the end of the device manufacturing process 100 , is via the interface 120 the computer program PRG1 into the storage device 140 the device 100 , transfer.

In further preferred embodiments, the computer program comprises PRG1 privileged rights, especially when executing the computer program PRG1 , in particular when running test software, in particular end-of-line (EoL) software, access to hardware of the device 100 and / or the reading and / or writing of storage devices of the device 100 to be possible. In order to prevent a potential abuse of these privileged rights, it can be advantageous to use the computer program PRG1 after executing from the second storage device 140 the device 100 to delete.

Due to the characteristic behavior of volatile memories, the computer program PRG1 in particular when performing a hardware, HW / power-off reset, in particular switching off a supply voltage for the device 100 , from the second storage device 140 deleted. The deletion of the computer program PRG1 takes place when the hardware / power-off reset is carried out; an explicit deletion is not required. The computer program also claims PRG1 no, in particular permanent, memory of the first memory device due to locating in the volatile memory 130 .

With the computer program PRG1 it is in particular a computer program for controlling the execution of test software, in particular end-of-line (EoL) software. According to further preferred embodiments, the computer program PRG1 also include the test software, in particular the end-of-line (EoL) software, or parts thereof. The computer program PRG1 is advantageously designed to perform operations, in particular system-related operations, in particular a hardware test, in particular a final hardware test, of the device 100 , and / or data for the device 100 , in particular transferring and / or activating at least one function and / or at least one configuration.

In further preferred embodiments, the computer program is PRG1 advantageously for setting and / or deleting the first and / or the further analysis flag FA , FR educated. The computer program PRG1 advantageously comprises computer readable instructions when executed by the device 100 , in particular by the computing device 110 the device 100 setting and / or deleting the analysis flags FA , FR is carried out, cf. the following descriptions with reference to FIG 5 and 6th .

The computer program PRG1 can in particular as one file, in particular hex file, or successively as several, in particular independently executable files, in particular hex files, in the second storage device 140 The term hex file can include any machine-readable code form. In particular, the transmission of the computer program PRG1 as a total hex file or as a plurality of individual hex files, advantageously in the available storage space of the second storage device 140 be adjusted.

At the first storage device 130 it is, for example, a memory area with privileged access rights. The write and / or read access to this memory area is advantageously only possible through a software security module (SSM). A software security module comprises, in particular, an encryption program implemented in software in which at least one encryption algorithm is implemented. According to one embodiment, the software security module manages cryptographic key material, in particular for executing the encryption algorithm. In further preferred embodiments it is provided that the software security module at least partially or completely executes the method according to the embodiments, in particular a step for setting and / or deleting the first analysis flag FA . In further preferred embodiments it is provided that the software security module the first analysis flag FA manages (in particular sets and / or deletes), and / or checks. In further preferred embodiments it is provided that the software security module is formed, a result of checking the first analysis flag FA to another unit, for example the computing device 110 to output.

In further preferred embodiments it is provided that the first storage device 130 a hardware security module (HSM), in particular a cryptography module, or part of a hardware security module (HSM), in particular a cryptography module. The hardware security module is designed, for example, to execute cryptographic methods or algorithms or at least parts thereof. According to one embodiment, the hardware security module manages cryptographic key material, in particular for executing cryptographic methods or algorithms. In further preferred embodiments it is provided that the hardware security module (HSM) has a protected, in particular separate, memory for storing the first analysis flag FA disposes. Only the device is particularly preferred 100 , especially the computing device 110 the device 100 , which is designed to carry out the method according to the embodiments, read access to the first analysis flag stored in the hardware security module FA . In further preferred embodiments it is provided that the hardware security module or cryptography module at least partially or completely executes the method according to the embodiments, in particular a step for setting and / or deleting the first analysis flag FA . In further preferred embodiments it is provided that the hardware security module or cryptography module the first analysis flag FA manages (in particular sets and / or deletes), and / or checks. In further preferred embodiments it is provided that the hardware security module or cryptography module is designed to generate a result of the checking of the first analysis flag FA to another unit, for example the computing device 110 to output.

The device 100 , especially the computing device 110 the device 100 , is to perform a procedure 300 formed, which is described below with reference to the figures.

• Prüfen 310, ob das erste Analyse-Flag FA in der ersten Speichereinrichtung 130 gesetzt ist, und wenn das erste Analyse-Flag gesetzt ist, Ausführen eines Schritts 320a zum Übertragen des wenigstens eine Computerprogramms PRG1, von der externen Einheit 200 über die Schnittstelle 120 in die zweite Speichereinrichtung 140 der Vorrichtung 100, und/oder Ausführen eines Schritts 320b zum Ausführen des Computerprogramms durch die Recheneinrichtung, und wenn das erste Analyse-Flag FA nicht gesetzt ist, der Schritt zum Übertragen 320a und/oder der Schritt zum Ausführen 320b nicht ausgeführt wird.

Further preferred embodiments relate to a method 300 to operate the device 100 , the procedure 300 advantageously in the context of and / or following a start process or a boot process of the device 100 is performed. The procedure 300 according to the embodiments comprises the following steps, see also the simplified flowchart from FIG 2 :

• Check 310 whether the first analysis flag FA in the first storage device 130 is set, and if the first analysis flag is set, then take a step 320a for transmitting the at least one computer program PRG1 , from the external unit 200 through the interface 120 into the second storage device 140 the device 100 , and / or executing a step 320b for executing the computer program by the computing device, and if the first analysis flag FA is not set, the step to transfer 320a and / or the step of performing 320b not running.

It is advantageous if the first analysis flag FA is not set, the device 100 in one step 330 placed in an application state. A further, in particular optional, step can advantageously be used to query whether a programming request, in particular a reprogramming request, in particular for programming the device 100 with an application program, be provided. Depending on the result of the query, further, in particular optional, steps for carrying out programming, in particular reprogramming, or carrying out an application are then advantageously carried out.

Following the broadcast 320a becomes the computer program PRG1 advantageously executed (in 2 not shown).

After running the computer program PRG1 becomes the computer program PRG1 , in particular when performing a hardware / power-off reset, in particular switching off a supply voltage for the device 100 , from the second storage device 140 deleted. The reservation of memory space by the computer program PRG1 therefore takes place exclusively temporarily, in particular in the context of testing the device 100 , especially as part of an end-of-line (EoL) test. The corresponding memory location of the second memory device can then be used 140 , for example when using the device 100 in normal operation, for example as a control unit in a motor vehicle, for executing further functions, applications of the device 100 be used.

In further preferred embodiments, the transmission takes place 320a and / or execute 320b of the computer program PRG1 from the external unit 200 through the interface 120 into the second storage device 140 depending on the first analysis flag FA .

In further preferred embodiments it is provided that in one step 340 it is checked whether another analysis flag FR is set, and if the further analysis flag FR is set, the step 310 to check the first analysis flag FA is performed.

The further analysis flag is stored, for example, in a high-performance readable memory device of the device, in particular in a working memory, RAM, random access memory. This can prove to be advantageous in particular for reasons of performance or cycle time when the device is booted. The first analysis flag FA that is in the first storage device 130 the device 100 is stored, is checked according to this embodiment only if the further analysis flag FR is also set.

The further analysis flag FR for example in the second storage device 140 saved.

Further preferred embodiments of the method are described below with reference to FIG 3 explained.

In further preferred embodiments it is provided that between step 310 checking the first analysis flag FA and the step of transferring 320a of the computer program one step 350 to authenticate the external unit 200 and / or a user of the external unit 200 is executed, after successful authentication the step 320a for transmitting the at least one computer program PRG1 , through the interface 120 into the second storage device 140 the device 100 is executed, and after unsuccessful authentication the at least one computer program PRG1 , is not transmitted.

In further preferred embodiments, is a step 360 to authenticate the transmitted computer program PRG1 provided, after successful authentication of the transmitted computer program PRG1 executing 320b of the transferred computer program PRG1 through the device 100 takes place, and after unsuccessful authentication the computer program PRG1 not running. Authenticating 360 includes in particular an integrity and / or authenticity check of the transmitted computer program

In further preferred embodiments it is provided that the authentication 350 the external unit 200 and / or a user of the external unit 200 and / or authenticating 360 of the transferred computer program PRG1 takes place using a signature-based or key-dependent, checksum-based approach.

In further preferred embodiments it is provided that the authentication 350 the external unit 200 and / or a user of the external unit 200 and / or authenticating 360 of the transferred computer program PRG1 using at least one cryptographic, in particular private, key. The authentication and / or authentication can advantageously take place using an asymmetric key pair or using a signed, cryptographic hash or using a key-dependent, cryptographic checksum.

In further preferred embodiments it is provided that the authentication 350 the external unit 200 and / or a user of the external unit 200 and / or authenticating 360 of the transferred computer program PRG1 further comprises: generating a challenge, in particular comprising a random number and / or a pseudo-random number, transmitting the challenge to the external unit 200 and receiving the challenge from the external entity 200 .

Authenticating 350 the external unit 200 and / or a user of the external unit 200 and / or authenticating 360 of the transferred computer program PRG1 for the signature-based approach, reference is now made to FIG 3 and 4th described.

Authenticating the external unit 200 and / or a user of the external unit 200 compared to the device 100 includes in particular the placing of a security query by the external unit 200 and / or the user of the external unit 200 . In one step 400 a challenge, in particular comprising a random number and / or a pseudo-random number, is then generated and sent to the external unit 200 , in particular in response to the security request made 410 .

In further embodiments it is provided that the generation 400 the challenge takes place via HSM or by generating it using suitable software. The external unit 200 and / or the user of the external unit 200 signs the challenge with a, in particular project-specific, private key and transmits a response to the device 100 .

In one step 420 receives the device 100 the response. In one step 430 verifies the device 100 the received response by means of a to the private key of the external unit 200 and / or the user of the external unit 200 suitable other, in particular public, key.

In the case of a successful verification 430 if the response is authentic, the computer program will PRG1 in step 320a transfer. In the event of an unsuccessful verification, the computer program will not be transmitted.

According to the embodiment shown, it is further provided that the method further comprises: Authentication 360 of the transferred computer program PRG1 , being running 320b of the computer program PRG1 only after successful authentication 360 he follows.

The external unit signs for this purpose 200 and / or the user of the external unit uses the computer program PRG1 also with a, in particular project-specific, private key and transmits the signed computer program PRG1 to the device 100 . The device 100 receives the signed computer program PRG1 .

In one step 440 verifies the device 100 the signed computer program received PRG1 by means of a to the private key of the external unit 200 and / or the user of the external unit 200 suitable other, in particular public, key.

In the case of a successful verification 440 , so if it can be verified that the computer program PRG1 is integer, the computer program becomes PRG1 in step 320b executed. In the event of an unsuccessful verification 440 becomes the computer program PRG1 not executed.

Further preferred embodiments of the method are described below with reference to FIG 5 explained

In further preferred embodiments, the method comprises 300 one step 500 to set the first analysis flags FA . The setting 500 of the first analysis flag FA takes place, for example, by means of a software security module (SSM) or a hardware security module (HSM).

According to a further embodiment, the method comprises 300 one step 510 to set the further analysis flag FR .

Moving the device 100 into an analysis state by setting the first and possibly the further analysis flag FA , FR enables the analysis state to be activated without irreversibly changing the system behavior of the device. This advantageously enables the device to be reusable 100 .

According to further preferred embodiments, the method comprises 300 one step 520 to clear the first analysis flag FA , see. 6th . The deleting 520 the first analysis flag takes place, for example, by means of a software security module or a hardware security module.

According to a further embodiment, the method comprises 300 one step further 530 to delete the further analysis flag FR .

In this way, securing the EoL access can activate the analysis state without irreversibly changing the system behavior of the device.

In further preferred embodiments it is provided that the setting 500 , 510 and / or delete 520 , 530 of the first and / or further analysis flag FA , FR by the external unit and / or a user of the external unit 200 he follows.

In further preferred embodiments it is provided that before setting 500 , 510 and / or delete 520 , 530 one step to authenticate 350 the external unit 200 and / or a user of the external unit 200 is executed, and the setting and / or deletion only takes place after successful authentication. The step 350 authentication takes place, for example, as already described above.

In further embodiments, the first and / or further analysis flags can be automatically deleted FA , FR be provided. Automatic deletion can take place in particular by means of a hardware reset (reboot) or after a certain number of hardware resets or after a specifiable time has elapsed.

In further preferred embodiments it is provided that the checking 310 , 340 of the first and / or further analysis flag FA , FR as a function of a usage phase, in particular a phase of a life cycle, of the device 100 is performed. Phases of use of the device 100 According to preferred embodiments, for example, a first use phase, also referred to as the production phase (Tier 1 production), a second use phase, also referred to as the storage phase (warehouse), a third use phase, also referred to as the field phase (OEM production / field), a fourth use phase , also known as the returns phase (returns analysis). In the first phase of use, the device 100 produced and located at the manufacturer (Tier1). In this phase, especially following the manufacturing process of the device 100 , advantageously a test of the device 100 , for example an end-of-line (EoL) test. In the second use phase, the device 100 stored at least temporarily, in particular in a storage facility of the manufacturer or in an external storage facility. In this phase, in particular before delivery to a customer, in particular an OEM, the device is advantageously tested again 100 , for example an end-of-line (EoL) test. In the third use phase, the device 100 used by the customer, especially at an OEM or in the field. The device should not be tested during this usage phase 100 , in particular no EoL test, may be possible. The device is in the fourth usage phase 100 back to the manufacturer and is (again) checked there, for example as part of a return analysis. The method according to the invention can in particular be used to reactivate the interface 120 as part of the return analysis and to deactivate the interface 120 can be used after the returns analysis is complete.

Further embodiments relate to the use of the method 300 according to the embodiments and / or the device 100 according to the embodiments for activating, in particular reactivating, the interface 120 the device 100 , in particular a test, in particular an end-of-line (EoL) interface, and / or to deactivate the interface 120 the device 100 for transmitting a through the device 100 executable computer program PRG1 , especially for controlling an execution 360 a test software, in particular an end-of-line (EoL) software as a function of a first and / or a further analysis flag FA , FR .

Claims (17)

Method (300) for operating a device (100) which has an interface (120) for data exchange with an external unit (200) and at least one first memory device (130) for non-volatile storage of a first analysis flag (FA), and at least a second memory device (140) for storing at least one computer program (PRG1), in particular executable by a computing device (110) of the device (100), the method (300) comprising the following steps: checking (310) whether the first Analysis flag (FA) is set in the first memory device (130), and if the first analysis flag is set, a step (320a) for transmitting the at least one computer program (PRG1) from the external unit (200) via the Interface (120) is executed in the second memory device (140) of the device (100), and / or in a step (320b) for executing the computer program (PRG1) by the computing device (110) d, and if the first analysis flag (FA) is not set, the step for transmitting and / or the step for executing is not carried out. Method (300) according to Claim 1 wherein the method further comprises: checking (340) whether a further analysis flag (FR) is set, and if the further analysis flag (FR) is set, the step (310) for checking the first analysis flag ( FA) is carried out. The method (300) according to at least one of the preceding claims, wherein, if the first analysis flag (FA) is set, between the step of checking (310) the first analysis flag (FA) and the step of transmitting (320b) the Computer program (PRG1) a step for authenticating (350) the external unit (200) and / or a user of the external unit (200) is carried out, wherein after successful authentication (350) the step (320a) for transmitting the at least one computer program ( PRG1) is executed via the interface (120) in the second memory device (140) of the device (100), and after unsuccessful authentication (350) the at least one computer program (PRG1) is not transmitted. The method (300) according to at least one of the preceding claims, wherein the method further comprises: authenticating (360) the transmitted computer program (PRG1), after successful authentication (360) of the transmitted computer program (PRG1) executing (320a) the transmitted computer program ( PRG1) takes place by the device (100), and after unsuccessful authentication (360) of the computer program (PRG1) the transmitted computer program (PRG1) is not executed. The method (300) according to at least one of the preceding claims, wherein the authentication (350) of the external unit (200) and / or a user of the external unit (200) and / or the authentication (360) of the transmitted computer program (PRG1) is used a signature-based or key-dependent, checksum-based approach takes place. The method (300) according to at least one of the preceding claims, wherein the method further comprises: setting (500, 520) the first and / or further analysis flags (FA, FR). The method (300) according to at least one of the preceding claims, wherein the method (300) further comprises: deleting (520, 530) the first and / or further analysis flags (FA, FR). Method (300) according to at least one of Claims 6 or 7th wherein the setting (500, 510) and / or deletion (520, 530) of the first and / or further analysis flags (FA, FR) by the external unit (200) and / or a user of the external unit (200) he follows. Procedure according to Claim 8 , wherein before the setting (500, 510) and / or deletion (520, 530) a step for authenticating (350) the external unit (200) and / or a user of the external unit (200) is carried out, and the setting ( 500, 510) and / or deletion (520, 530) only takes place after successful authentication (350). Method according to at least one of the preceding claims, wherein the step of checking (310, 340) the first and / or the further analysis flag (FA, FR) is carried out as a function of a usage phase of the device (100). Device (100) with an interface (110) for data exchange with an external unit (200) and with at least one first memory device (130) for non-volatile storage of a first analysis flag (FA) and with at least one second memory device (140) for storage of at least one computer program (PRG1), in particular executable by the device (100), in particular for controlling an execution (360) of test software, in particular end-of-line (EoL) software, the device (100) for executing the method (300) according to at least one of the Claims 1 to 10 is trained. Device (100) according to Claim 11 , the interface (120) being a test and / or diagnostic interface, in particular an Ethernet or CAN interface. Device (100) according to at least one of the Claims 11 or 12th wherein the first storage device (130) comprises a hardware security module (HSM), in particular a cryptography module, or is part of a hardware security module (HSM), in particular a cryptography module. Device (100) according to at least one of the Claims 11 to 13th , wherein the device (100) comprises a computing device (110), in particular for executing the method (300) according to at least one of the Claims 1 to 10 , having. Computer-readable storage medium (SM), comprising commands, in particular in the form of a computer program (PRG2), which, when executed by a computer, in particular by a computing device of a computer, in particular by a computing device (110) of a device (100) according to at least one of the Claims 11 to 14th , cause this to execute the method (300) after at least one of the Claims 1 to 10 to execute. Computer program (PRG2) which comprises computer-readable instructions, when they are executed by a computer, in particular by a computing device of a computer, in particular by a computing device (110) of a device (100) according to at least one of the Claims 11 to 14th , the method according to at least one of the Claims 1 to 10 expires. Use of the method (300) according to at least one of the Claims 1 to 10 and / or the device (100) according to at least one of the Claims 11 to 14th and / or the computer-readable storage medium (SM) according to Claim 15 and / or the computer program (PRG2) Claim 16 for activating, in particular reactivating, an interface 120, in particular a test, in particular an end-of-line (EoL) interface, and / or for deactivating the interface (120) of the device (100) for transmitting a signal through the device (100 ) executable computer program (PRG1), in particular for controlling an execution (360) of test software, in particular end-of-line (EoL) software as a function of a first and / or a further analysis flag (FA, FR).

Images