DE102020005344B3 - Method for deactivating and activating individual authorizations and / or functions of a vehicle key - Google Patents

Abstract

The invention relates to a method for deactivating and then activating individual authorizations and / or functions of a vehicle key from a vehicle, in which the vehicle key is designed electronically or mechanically, the electronic vehicle key being assigned to a unique individual identity or the mechanical vehicle key to a shared shared identity , wherein the vehicle has a key recognition unit (2) which is suitable for securely recognizing, identifying and authenticating vehicle key types, and wherein the vehicle furthermore has a test control unit (5) for defining and establishing control conditions and for testing control conditions which has read access to at least part of a state space (1) of the vehicle system, the vehicle also has a central control unit (6), the central control unit (6) having the key recognition unit (2) and communicatively coupled to the test control unit (5) and connected to a display unit (7) and an input unit (8).

Description

The invention relates to a method for deactivating and subsequently activating (reactivating) individual authorizations and / or functions of a vehicle key from a vehicle, in which the vehicle key is designed electronically or mechanically.

From the DE 10 2019 008 608 A1 a method for operating a motor vehicle system is known which has a motor vehicle and a key system for the motor vehicle. The key system comprises at least one electronic key and at least one mechanical key. A selection for activating and deactivating functions of the electronic key is provided and the selection made is stored in a memory. The saved selection is taken into account when the key is subsequently used.

From the DE 10 2015 003 820 A1 it is known to provide different authorization levels and to assign different vehicle functions for release to the authorization levels. The authorization levels are released by password or personal characteristics. Multiple keys can also be used.

Vehicle locking systems in modern vehicles often have mechanical keys and a large number of different types of electronic keys. These include, for example, classic electronic keys with or without Keyless Go, smartphones with or without special key apps, special wearables, etc. In addition to the classic authorizations of a vehicle key (opening / closing, starting, driving), such a general electronic vehicle key can also have other authorizations or have functions. In particular, he can also save personal data of the driver or vehicle owner that are to be protected.

A distinction can be made between authorizations and functions of a vehicle key. The authorizations of a key define which functions of another system, in particular of a vehicle system, the owner of the key can use or which actions he is allowed to initiate in another system. The functions of a key may be made available to the user or another system independently of a third-party system. In the following, these terms will be used synonymously.

There are situations in which it makes sense to temporarily deactivate some of its authorizations or functions for a mechanical or electronic vehicle key. In general, it can be said that it can make sense to reduce the power of a key the more insecure the environment or the situation in which it is located, i.e. in which the key could be stolen or misused, for example.

A typical example of an everyday situation in which the electronic key can often not be kept safe is water sports, such as swimming or diving. Leaving the electronic key on the bank puts the key at risk due to theft. Taking the electronic key into the water endangers its functionality.

Methods are known which suggest using the mechanical key bit as an additional safeguard to deactivate an electronic key or some of its functions or to reactivate them afterwards. But such methods have several disadvantages. On the one hand, a mechanism for the reliable detection of the presence of a mechanical key bit is required on an electronic level, which requires additional hardware components. On the other hand, not all of the electronic keys described above have a mechanical key bit. In addition, it is not certain how long a mechanical key bit belonging to the “analog world” will generally be part of the equipment of future generations of vehicles. Finally, the known methods are not very general, since only a mechanical vehicle key is used to exclusively deactivate a conventional electronic vehicle key. Other possibilities are not covered.

Further examples of "unsecure environments" or "unsecure situations" are leaving the electronic key in so-called valet parking, whereby access to personal data stored in the electronic key should be prevented, or leaving the electronic secondary key to a third party for the purpose of depositing it an object in the trunk of the vehicle, whereby the key should only be able to access the trunk.

The secure deactivation of certain authorizations and / or functions of a key that has been fully activated up to then does not represent a challenge, because the mere possession of a fully activated electronic key and simultaneous access to the vehicle are sufficient authorization to enable or disable the key . to allow.

The object of the present invention is to provide a way to enable the subsequent secure activation of a previously deactivated authorization and / or function of a previously deactivated vehicle key in a simple and efficient manner, because the pure possession of a deactivated vehicle key does not necessarily entitle you to this Activation, since additional security is usually required for this step, in particular additional proof of authorization for activation.

This object is achieved by the subject matter of independent claim 1. Advantageous refinements are defined in the subclaims.

This object is achieved by a method for deactivating and subsequently activating individual authorizations and / or functions of a vehicle key from a vehicle in which the vehicle key is designed electronically or mechanically. The electronic vehicle key is assigned a unique individual identity or the mechanical vehicle key is assigned a shared shared identity, the vehicle having a key recognition unit which is suitable for securely recognizing, identifying and authenticating vehicle key types, the vehicle also having a test control unit to define and establish control conditions. This can now in particular also be designed to check control conditions and have read access to at least part of a status area of the vehicle system.

According to the invention, the vehicle also has a central control unit, the central control unit being communicatively coupled to the key recognition unit and to the test control unit and being connected to a display unit and an input unit. The central control unit offers the user the set of all vehicle keys identified and authenticated as present by the key recognition unit at this point in time for selection. In this case, after the vehicle key to be deactivated has been determined by the user, all authorizations and / or functions activated at this point in time in the vehicle key to be deactivated can be offered for selection. Furthermore, in addition or as an alternative to this, the user could be offered all types of control conditions supported by the test control unit for selection and definition, the user being able to select none, one or more control conditions and fully define them. After the control conditions have been defined by the user, a clear identity could be assigned to the ongoing deactivation and at least the following data could be stored in a tamper-proof manner: ID of the vehicle key, ID of the current deactivation, the amount of authorizations and / or functions to be deactivated selected by the user, and by the user selected set of fully defined control conditions.

According to the invention, the functions selected by the user that can be deactivated with the vehicle key are deactivated by the central control unit for the vehicle key to be deactivated, and when authorizations and / or functions of the vehicle key are reactivated, the central control unit offers the user the deactivations made for reactivation. The central control unit then releases the authorizations and / or functions for reactivation, the control conditions of which are determined by the test control unit ( 5 ) have been recognized as fulfilled.

For this purpose, the control unit could in particular offer the at least partially deactivated vehicle keys for selection, and in addition or as an alternative to this, for the vehicle key selected by the user, the list of deactivations stored in the central control unit for the selected vehicle key for which a corresponding reactivation is possible for Offer selection. Preferably, the central control unit could also check for the deactivation selected by the user with the help of the test control unit on the basis of the current vehicle state which of the control conditions stored for this deactivation are currently not met, and if the set of unfulfilled control conditions is not empty, and the maximum number of Attempts have not yet been reached, display the unfulfilled control conditions to the user and, after the user has confirmed after performing the necessary actions on his part that all necessary control conditions are met from his point of view, go back to the beginning of this step, and if the maximum number of Attempts are reached, view the ongoing reactivation by the central control unit as having failed and cancel. The state of the vehicle key and the central control unit could remain unchanged. However, if the set of unfulfilled control conditions is empty, the next step could be taken instead. In this case, all of the deactivated authorizations and / or functions stored for the selected deactivation and all of the deactivated authorizations and / or functions stored after the selected deactivation could then preferably be reactivated for the selected vehicle key, and the selected deactivation and all deactivations made after the selected deactivation including the associated stored data are deleted from the central control unit.

Vehicle key types are preferably conventional electronic, mechanical, a smartphone via Bluetooth, NFC, LTE, and / or a backend, mechanical vehicle keys not necessarily being individually identified and / or authenticated. The state space of the vehicle system is preferably tamper-proof.

Keys or vehicle keys can be personalized or non-personalized. Personalized keys preferably ensure that the user in possession of the key is a specific person or belongs to a specific group of people. Non-personalized keys, on the other hand, preferably do not know anything about the identity of the user; the mere availability of a non-personalized key at a specific point in time preferably gives the person all authorizations associated with the key at that point in time or preferably enables them to access all implemented functions.

According to an advantageous development, an implicit definition of the control conditions is used in addition to the control conditions to be determined.

According to an advantageous development, at least one or more of the following variables of the vehicle system state are used to define control conditions: the current time with or without a date, the current position of the vehicle, the presence of a specific electronic vehicle key, the presence of a mechanical vehicle key, in particular a mechanical vehicle key bit and a lock cylinder.

According to another advantageous development, at least one of the following control conditions is used: definition of a set of times at which reactivation has to take place; Definition of a set of positions in which the vehicle must be at the time of reactivation; Determination of one or more persons by whom a reactivation may be carried out or whose presence is necessary for a reactivation; Determination that the presence of the deactivated vehicle key is required for reactivation; Specification that, in the case of a personalized deactivated vehicle key, a certain person or a person from a certain group of people must be logged in to this vehicle key at the time of reactivation; Establishing that the presence of at least one control vehicle key is required at the time of reactivation, in particular the control vehicle key is designed as a mechanical vehicle key bit; Specification that, in the case of a personalized control vehicle key, a specific person or a person from a specific group of people must be logged in to this control vehicle key at the time of reactivation; Establishing that a control question must be answered correctly before reactivation, whereby both the question to be displayed during reactivation and the expected answer can be entered when defining the control condition; and stipulating that reactivation must be triggered by a specific action by a specific user.

According to another advantageous development, if several control conditions are specified, these are logically AND-linked, logically AND- or -OR-linked, or logically AND- or OR-linked or negated to determine the overall control condition for later reactivation.

According to another advantageous development, for all of the control conditions supported by the vehicle key system or selected and defined by the user, as well as for the overall control condition, the level of protection provided by the vehicle key system is determined and displayed to the user.

According to an advantageous development, the presence of the vehicle key to be deactivated is required in the event of deactivation, and a further protective mechanism, in particular the presence of a control vehicle key, is dispensed with.

According to another advantageous development, the presence of the deactivated vehicle key to be activated is dispensed with in the event of reactivation.

According to another advantageous development, at least one of the following electronic vehicle key types is supported: conventional electronic vehicle key which is adapted for an ignition lock; a smartphone that communicates with the vehicle using various communication mechanisms; Bluetooth; WiFi / WLAN, NFC via cellular network with a backend, which in turn communicates with the vehicle via cellular network; Desktop applications that communicate over the Internet with the backend that communicates with the vehicle over cellular networks; and wearables that work directly via WiFi or Bluetooth or communicate with the vehicle using a smartphone.

According to another advantageous development, the current authorization status of a mechanical vehicle key is stored in a memory unit of the central control unit, or the current authorization status of an electronic vehicle key is stored in the memory unit of the central control unit or in the electronic vehicle key.

According to another advantageous development, the current authorization status of a vehicle key is secured against manipulation by a cryptographic application or by using a hardware security module when it is stored.

Advantageously, there is the possibility of temporarily deactivating certain of its functions to leave a mechanical or electronic key at any location, for example in the vehicle, or to borrow it without running the risk of it being used to carry out undesired functions, for example opening or starting or driving the vehicle can be used or abused.

In addition, subsequent secure activation is made possible. The process is easy to use and implement, since, due to the clear link between (re-) activation and previous deactivation, when reactivating it does not have to be checked whether the key to be reactivated is generally authorized to perform certain functions or not. the control condition is sufficiently strong to (re) activate certain functions, all keys have equal rights in the sense that each key can be used as a control key for reactivating any other key, regardless of the level of protection required or the currently activated authorizations and / or functions etc. of the key to be reactivated or of the control key, because exactly the functions previously deactivated are always reactivated.

Furthermore, the method according to the invention is very flexible in that all types of electronic keys are supported, for example conventional electronic vehicle keys, smartphones, wearables, etc., the user can determine the control conditions for reactivation himself, the method regardless of the level of protection offered by the individual keys how is the authorization model used.

The method according to the invention is advantageously convenient in that it allows the user to implicitly select the control conditions for the reactivation, the deactivated authorizations and / or functions are saved by the system, which enables them to be reactivated "in one step", several deactivations one after the other in a consistent manner Way to be allowed.

One idea of the present invention is based on using a mechanism that is already present in the vehicle and implemented by the key system; in particular, no additional hardware is required, since it is primarily electronic keys that are reliably and forgery-proof recognized by the system today are used for the definition of control conditions and their checking in the vehicle and its environment, in particular smartphones, backend, existing mechanisms such as user management, position determination, key recognition, time, secure memory, input units, output units, etc.

The method according to the invention can be used very well to deactivate the driving function of the key and to specify the correct answer to a control question or the presence of a personalized, less powerful second key without driving authorization, for example a smartphone, as a control condition for reactivation.

It is an idea of the present invention to separate authorizations and functions so that the user selects a condition from predefined control conditions during deactivation with which the reactivation must take place, and that during deactivation the presence of the deactivating mobile device is required.

The invention is explained in more detail below using a preferred exemplary embodiment with reference to the drawing.

• 1 ein Fahrzeug-System zur sicheren Deaktivierung und Aktivierung von Schlüsselfunktionen in einer möglichen Ausgestaltung.

It shows:

• 1 a vehicle system for the safe deactivation and activation of key functions in one possible embodiment.

1 shows a vehicle system for the safe deactivation and activation of key functions in a preferred embodiment of the invention.

When a mechanical or electronic vehicle key or individual authorizations and / or functions are deactivated, in the preferred exemplary embodiment no additional protection, i.e. no control or protection mechanism, is used. All that is required is that the key to be deactivated proves its presence to the vehicle in a forgery-proof manner. If the key to be deactivated is personalized, a smartphone in the preferred exemplary embodiment, it is also required that the legitimate user of the key logs into it.

In connection with the deactivation, i.e. during or directly after the deactivation, the user who carries out the deactivation can define a protective mechanism in the form of a control condition that serves to protect the key that has just been deactivated from improper (re) activation. The user can select one or more control conditions implemented in the vehicle or vehicle key system, fully define them and define them as a prerequisite for later reactivation.

If the deactivation that has just been carried out is to be undone by this user or by another user in the future, i.e. if the deactivated authorizations and / or functions are to be reactivated, the key system checks when reactivating whether the control conditions specified during deactivation are met or fulfilled. If this is the case, the deactivated authorizations or functions are reactivated. If the check fails, reactivation is denied.

• Die Deaktivierung von Berechtigungen bzw. Funktionen verlangt die Gegenwart des Schlüssels, in dem die Deaktivierung vorgenommen werden soll. Diese Forderung ist notwendig, da kein weiterer Schutzmechanismus gegen eine unberechtigte Deaktivierung eingesetzt wird. Außerdem kann die Präsenz des zu deaktivierenden Schlüssels aus technischer Sicht notwendig sein, falls die Berechtigungen auf dem Schlüssel und nicht in der Zentralkontrolleinheit 6 abgelegt werden.

The deactivation with subsequent activation of authorizations and / or functions follows the following principles:

• The deactivation of authorizations or functions requires the presence of the key in which the deactivation is to be carried out. This requirement is necessary because no further protective mechanism is used against unauthorized deactivation. In addition, the presence of the key to be deactivated may be necessary from a technical point of view if the authorizations are on the key and not in the central control unit 6th be filed.

If the key, the authorizations and / or functions of which are to be deactivated, is personalized, there will be evidence of the presence of the authorized person; in the preferred exemplary embodiment, they must therefore be logged into the key to be deactivated. The application of a control condition, for example the presence of a control key, is not necessary in the case of a deactivation, since the current and present owner of the key to be deactivated reduces and does not increase the possibilities of their own key through the deactivation.

In the event of a deactivation, the user can specify the circumstances or conditions under which the later reactivation of exactly the same authorizations and / or functions deactivated during this process can take place, i.e. how the deactivation that has just been carried out can be reversed. When deactivating by the user, a control condition for reactivating the deactivated authorizations and functions can be set. The user can also do without specifying a control condition, i.e. opt for an unprotected reactivation.

In other preferred exemplary embodiments, the user can also specify a number of control conditions, all of which must then be met when reactivating. Alternatively, the user can link the individual control conditions with each other logically (i.e. with AND, OR, NOT) and thus flexibly form an overall control condition for later reactivation.

The user can choose from a set of control conditions supported by the key system. It makes sense to only include system properties in the control conditions that cannot be easily manipulated by a potential attacker. A variety of types of control conditions can be used. In this preferred embodiment, it is specified that the reactivation has to take place at certain times, for example by defining a fixed point in time in the future at which the reactivation has to take place, a fixed point in time in the future from which the reactivation is to take place. Activation may be carried out at the earliest, a fixed point in time in the future and an (infinite) sequence of repeating time periods, all of which are after this point in time, for example the time: December 20, 2020 5:00 p.m., time periods: every day 2:00 p.m. - 4:00 p.m. : 00 or every Tuesday 20: 00-24: 00, a finite sequence would involve the risk that after the last time interval has elapsed, reactivation could no longer be carried out in this way.

If, apart from a time condition, no further control condition is specified, the reactivation takes place automatically at the earliest point in time that fulfills the time condition. If further control conditions are specified, the reactivation takes place at the earliest point in time which fulfills the time condition and at which the other control conditions are fulfilled.

As a further control condition, it is specified that the vehicle in which the reactivation is to be carried out has to be in a specific local area at the time of reactivation, for example a fixed position with a fixed radius, a specific location or a specific street in a specific location or a maximum distance from a specific house number in a specific street in a specific location, the location restriction is sensibly combined with other control conditions, for example with one of the time conditions described, otherwise the reactivation takes place automatically as soon as the vehicle meets the location condition for the first time fulfilled, that is, drives into the defined area, the reactivation must be carried out by a specific person or by a person belonging to a specific group of people, the presence of the person in question, for example, by logging into the vehicle system system, for example on the input unit, the recording of their biometric features, e.g. by interior cameras or a fingerprint, logging in to a third-party device connected to the vehicle, in particular a smartphone, logging in via a third-party device on the backend and the subsequent transmission of this information from the backend to the control unit.

When reactivating, the presence of the deactivated key to be activated is required, whereby in the case of personalized keys one or a specific person must be logged into the key, so the presence of the key to be activated is not mandatory for reactivation, but the user can do this when deactivating are required. If the authorizations are not stored in the control unit but in the electronic key, the key to be activated must be present when reactivating.

During reactivation, the presence of a control key or a duplicate key, i.e. a key other than the one that has just been deactivated, is required, whereby the following characteristics of the control key or a combination thereof can be specified as mandatory: one or more identities of keys, at least one of which at the Reactivation must be present, a certain amount of authorizations that the control key must have at the time of reactivation of the at least partially deactivated key, in the case of a personalized control key a certain person or a person belonging to a certain group must be logged into the control key, as the control key of Mechanical key bit assigned to the electronic key 12th should be used.

When reactivating a control question must be answered correctly, whereby the user must enter both the question to be displayed during reactivation and the answer to define this type of control condition, for reactivation a specific explicit action, for example pressing a button, one or a specific one Is necessary for the user. Otherwise, the reactivation will be carried out "silently" or "automatically", ie without involving a user. In the preferred exemplary embodiment, it is assumed that an explicit triggering of a reactivation by the user is necessary, that is to say is defined as one of the control conditions in each case.

For reasons of convenience, the user can specify a suitable condition that is met in the key system at this point in time, for example a certain condition for the vehicle system state, as a control condition to be used when deactivating, simply by entering it on the input unit 8th is accepted as a control condition for the subsequent reactivation, for example when reactivating the same person or a person belonging to the same group should be logged into the vehicle in the same way as at the time of deactivation, for example the user who is currently deactivating the key If the presence of a control key presented to the system during deactivation and recognized by the system, for example by being inserted in the ignition lock or by the "Keyless Go" system 16, is to be defined as a control condition for the subsequent reactivation, this control key should at least all at the time of reactivation have their authorizations, which they had during the deactivation, the key is personalized, so the same person should be logged in to it during the reactivation as now during the deactivation, the reactivation may take place at the earliest after a certain period of time What can be done by taking over the current point in time and defining the desired duration of the period of time, for example two weeks, by the central control unit 6th it is communicated that the vehicle should be in the vicinity of its current position, which is communicated to the control unit by taking over the current position and defining a perimeter.

For each supported control condition, the key system can determine or estimate its level of protection and display it to the user. The estimate does not only include the protection against forgery of the respective implementation of the values such as location, which are included in the control condition 3 , Time 4th , Presence of a specific key, etc., for example, a system time that can be set manually by the user is naturally less forgery-proof as a signed time regularly obtained from a trustworthy server, but also its general "feasibility", ie a wider area with a location-based control condition makes it “easier to fulfill” than a narrower one.

After setting one or more control conditions, the central control unit saves 6th the following data under the identity (ID) of the key to be deactivated: a name / an identity / number for the deactivation for the purpose of later identification, if necessary also a brief description of the reason for the deactivation carried out in order to facilitate later identification for the user, the authorizations or functions deactivated during the process.

The deactivated authorizations and functions are saved and not the ones that are still valid, because in the event of a later reactivation the "old state" is not exactly restored, but exactly the authorizations and / or functions that were lost during deactivation are activated. The authorizations and / or functions not affected by the deactivation are not influenced by the subsequent reactivation. In particular, authorizations and / or functions that may have been added in the meantime are not deactivated when reactivated.

The control conditions determined by the user, together with the parameter values that may have been specified, are also stored in the storage unit 9 the central control unit 6th saved, in particular current time, current location and other data, if they are required for the evaluation of the control conditions or to identify the deactivation. If several deactivations of the same key are carried out one after the other without reactivation in between, then all deactivations together with their data, ie deactivated authorizations and / or functions, control conditions, etc., are stored in the central control unit 6th filed in the order in which they were carried out.

In the event of a subsequent reactivation, the presence of the key to be reactivated is not required, unless this is explicitly required by the user through a corresponding control condition. A reactivation always refers to exactly one previously carried out and in the central control unit 6th stored deactivation and is carried out exactly when the overall control condition specified for the corresponding deactivation is met.

Successful reactivation means that the authorizations and / or functions deactivated during the corresponding deactivation are (re) activated. Should the key have received further authorizations and / or functions between deactivation and the corresponding reactivation, it will retain these additional authorizations and / or functions even after reactivation.

If a “multiple deactivated” key is to be reactivated, the user is shown a list of previous deactivations and given the opportunity to select the deactivation that he / she wants to take back. If the user has then fulfilled all the control conditions linked to the reactivation of the selected deactivation, all deactivations that occurred after the selected deactivation will also be withdrawn. This makes sense because the subsequent deactivations were carried out on a "weaker" key and should therefore also be withdrawn by the "more powerful" reactivation that is currently taking place.

In the case of an electronic key, the currently activated authorizations and / or functions can be both in the central control unit 6th as well as on the key itself. In the case of a mechanical key, they can only be used in the central control unit 6th be filed.

• Der Nutzer wählt an der Eingabeeinheit 8 die Funktion „Schlüssel deaktivieren“ aus. Die Zentralkontrolleinheit 6 ermittelt mit Hilfe der Schlüssel-Erkennungseinheit 2 alle zu diesem Zeitpunkt als präsent identifizierten und authentifizierten, also sicher erkannten, Fahrzeugschlüssel und zeigt diese dem Nutzer an. Ist der gewünschte zu deaktivierende Schlüssel dabei, wählt ihn der Nutzer aus. Ist der gewünschte zu deaktivierende Schlüssel nicht dabei, so präsentiert der Nutzer ihn der Schlüssel-Erkennungseinheit 2, indem er beispielsweise den mechanischen Schlüssel in den Schlosszylinder 15 bzw. den konventionellen elektronischen Schlüssel 11 in das Zündschloss 17 steckt oder einen Smartphone-Schlüssel 13 in eine Schale mit NFC-Konnektivität 20 legt.

The deactivation of selected authorizations or functions of an electronic vehicle key takes place in the preferred embodiment as follows:

• The user dials on the input unit 8th the "Deactivate key" function. The central control unit 6th determined with the help of the key recognition unit 2 all vehicle keys identified and authenticated as present at this point in time, i.e. securely recognized, and displays them to the user. If the desired key to be deactivated is included, the user selects it. If the desired key to be deactivated is not there, the user presents it to the key recognition unit 2 by, for example, inserting the mechanical key into the lock cylinder 15th or the conventional electronic key 11 in the ignition lock 17th or a smartphone key 13th in a shell with NFC connectivity 20th lays.

The key recognition unit 2 recognizes and authenticates the desired key and reports its ID to the central control unit 6th , whereupon it adds it to the list of displayed keys, after which it is selected by the user.
The central control unit 6th offers the user all authorizations and / or functions activated at this point in time in the selected key to be deactivated. The user selects the authorizations and / or functions to be deactivated.
The central control unit 6th offers the user at the output unit 10 all from the test control unit 5 for the definition and determination of control conditions supported types of control conditions for selection and subsequent explicit definition.

The central control unit 6th also shows the user on the output unit 10 all from the test unit 5 implicit control conditions currently recognized as being fulfilled, including their parameter values, and requests him to add further implicit control conditions, if necessary, by switching the system to the corresponding vehicle state 1 offset.

If an implicit control condition preferred by the user from the central control unit 6th is not offered: The user puts the vehicle system in the required state 1 by fulfilling one or more of the control conditions preferred by him, for example by logging into the vehicle system via the input unit 8th or on the smartphone key 13th or the electronic key to be used as a control key in the ignition lock 17th sticks and turns. The newly fulfilled implicit control conditions are determined by the test control unit 5 recognized, this is the central control unit 6th transmitted. The central control unit 6th adds the newly recognized fulfilled control conditions to those already displayed and prompts the user to select one or more control conditions. The user selects none, one or more control conditions and defines or completes the selected explicit control conditions, for example by assigning values to the required parameters. The user defines the overall control condition by combining the selected and fully defined control conditions with propositional operators AND, OR, NOT to form a logical expression. The central control unit 6th assigns a unique identifier or identity to the ongoing deactivation and stores at least the following data in a tamper-proof manner: ID of the key, ID of the current deactivation, set of authorizations and / or functions selected by the user, set of fully defined control conditions selected by the user or the Overall control condition.

The central control unit 6th deactivates the authorizations and / or functions selected by the user for the key to be deactivated. The central control unit checks the next time a vehicle key is used 6th its authorizations and only performs actions to which the key is currently authorized.

• Der Nutzer wählt an der Eingabeeinheit 8 die Funktion „Schlüssel wiederaktivieren“ aus.

In the preferred exemplary embodiment, a vehicle key that has previously been at least partially deactivated is reactivated as follows:

• The user dials on the input unit 8th the function "reactivate key".

The central control unit 6th offers the user the set of keys that may have been at least partially deactivated at this point in time for selection and the user selects one of the keys offered. The central control unit 6th shows the user the list of in the central control unit for the key selected by the user 6th stored deactivations for which a corresponding reactivation is possible and prompts him to select one of the displayed deactivations. The user selects one of the deactivations. The central control unit 6th checks IDDEAKT for the deactivation selected by the user with the help of the test control unit 5 to check control conditions on the basis of the current vehicle status, which of the control conditions stored for this deactivation are currently not met, whereby, if a general logical formula has been used instead of a conjunction of the individual control conditions, only the overall control condition is checked or evaluated.

If the overall control condition is not met and the maximum number of attempts has not yet been reached, the unfulfilled control conditions in the case of a conjunction or the overall control condition in the case of a general propositional formula are displayed to the user and, after the user after Carrying out the necessary actions has confirmed on his part that all the necessary control conditions are met from his point of view, the system returns to the beginning of this step, ie to check the control conditions belonging to IDDEAKT.

If the overall control condition is not met and the maximum number of attempts is reached, the ongoing reactivation is carried out by the central control unit 6th regarded as failed and aborted, the state of the key and the central control unit 6th remain unchanged.

If the overall control condition is met, the next step is carried out.

The central control unit 6th reactivates all IDDEAKT deactivation and all deactivated authorizations and / or functions for the key to be activated stored for all deactivations made after IDDEAKT and deletes the IDDEAKT deactivation and all deactivations made after IDDEAKT together with the associated data stored in the storage unit 9 the central control unit 6th .

Claims (11)

Method for deactivating and then activating individual authorizations and / or functions of a vehicle key from a vehicle, in which the vehicle key is designed electronically or mechanically, the electronic vehicle key being assigned to a unique individual identity or the mechanical vehicle key to a shared shared identity, the vehicle has a key recognition unit (2) which is suitable for securely recognizing, identifying and authenticating vehicle key types, characterized in that the vehicle also has a test control unit (5) for defining and establishing control conditions, the vehicle also has a central control unit (6), the central control unit (6) being communicatively coupled to the key identification unit (2) and to the test control unit (5) and being connected to a display unit (7) and an input unit (8), the Zen central control unit (6): offers a user the set of all vehicle keys identified and authenticated as present at this point in time by the key recognition unit (2) for selection; and deactivates the authorizations and / or functions selected by the user for the vehicle key to be deactivated; with the reactivation of authorizations and / or functions of the vehicle key, the central control unit (6) offers the user the deactivations made for reactivation and releases the authorizations and / or functions for reactivation, the control conditions of which have been recognized as fulfilled by the test control unit (5). Procedure according to Claim 1 , characterized in that in addition to the control conditions to be specified, an implicit definition of the control conditions is used. Procedure according to Claim 1 or 2 , characterized in that at least one or more of the following variables of the vehicle system state are used to define control conditions: the current time (4) with or without a date, the current position (3) of the vehicle, the presence of a specific electronic vehicle key (11 ), the presence of a mechanical vehicle key (12), in particular a mechanical vehicle key bit and a lock cylinder (15). Method according to one of the Claims 1 until 3 , characterized in that at least one of the following control conditions is used: definition of a set of times at which reactivation has to take place; Definition of a set of positions in which the vehicle must be at the time of reactivation; Determination of one or more persons by whom a reactivation may be carried out or whose presence is necessary for a reactivation; Determination that the presence of the deactivated vehicle key is required for reactivation; Specification that, in the case of a personalized deactivated vehicle key, a certain person or a person from a certain group of people must be logged in to this vehicle key at the time of reactivation; Establishing that the presence of at least one control vehicle key is required at the time of reactivation, in particular the control vehicle key is designed as a mechanical vehicle key bit; Specification that, in the case of a personalized control vehicle key, a specific person or a person from a specific group of people must be logged in to this control vehicle key at the time of reactivation; Determination that a control question must be answered correctly before reactivation, whereby both the question to be displayed during reactivation and the expected answer can be entered when defining the control condition; and stipulating that reactivation must be triggered by a specific action by a specific user. Method according to one of the Claims 1 until 4th , characterized in that if several control conditions are specified, these are logically AND-linked, logically AND- or -OR-linked, or logically AND- or OR-linked or negated to determine the overall control condition for later reactivation. Method according to one of the Claims 1 until 5 , characterized in that for all of the control conditions supported by the vehicle key system or selected and defined by the user, as well as for the overall control condition, the level of protection provided by the vehicle key system is determined and displayed to the user. Method according to one of the Claims 1 until 6th , characterized in that in the event of a deactivation, the presence of the vehicle key to be deactivated is required, and a further protective mechanism, in particular the presence of a control vehicle key, is dispensed with. Method according to one of the Claims 1 until 7th , characterized in that when reactivated, the presence of the deactivated vehicle key to be activated is dispensed with. Method according to one of the Claims 1 until 8th , characterized in that at least one vehicle key from the following electronic vehicle key types is supported: a conventional electronic vehicle key (11) which is adapted for an ignition lock (17); a smartphone (13) that communicates with the vehicle via various communication mechanisms, in particular via Bluetooth (19), WiFi / WLAN (18), NFC (20) or via cellular with a backend (14), which in turn communicates with the vehicle via cellular communicates; Desktop applications that communicate via the Internet with the backend (14) that communicates with the vehicle via cellular; and wearables that communicate with the vehicle directly or via a smartphone (13) via WLAN (18) or Bluetooth (19). Method according to one of the Claims 1 until 9 , characterized in that the current authorization status of a mechanical vehicle key is stored in a memory unit (9) of the central control unit (6), or the current authorization status of an electronic vehicle key is stored in the memory unit (9) of the central control unit (6) or in the electronic vehicle key. Method according to one of the Claims 1 until 10 , characterized in that the current authorization status of a vehicle key is secured against manipulation by a cryptographic application or by using a hardware security module when it is stored.

Images