DE102022106746A1 - Method for operating a cryptographically secured system for a motor vehicle - Google Patents

Abstract

The invention relates to a method for operating a cryptographically secured system (1) for a motor vehicle (2), according to the method in response to a request from a person authorized to use the motor vehicle (2) at a key management point (14) and/or according to a predetermined During the term, key material (12) is disclosed to the person authorized to use the motor vehicle (2).

Description

The invention relates to a method for operating a cryptographically secured system for a motor vehicle. The invention further relates to a motor vehicle system.

In modern motor vehicles, at least one electronic control device is usually used to control vehicle functions, but usually even several decentralized electronic control devices. Such control devices are, for example, an engine control device which - in the case of an internal combustion engine - controls injection times, mixture settings and the like, a control device for an anti-lock braking system, a control device for airbags or the like. These control devices are usually also in communication with each other or at least with a central control device, which, for example, also provides a human-machine interface - usually in the form of a graphical user interface (“GUI”).

In order to make the communication between the control devices with one another tamper-proof, but also to prevent unauthorized third-party access to such a control device, the control devices are usually secured cryptographically (ie using one or more cryptographic keys - hereinafter “key material”). In DE 10 2014 019 496 A1 describes an example of how such secure communication takes place within a network environment of a motor vehicle.

“External access” to a control unit occurs, for example, when servicing or repairing a motor vehicle. In order to be able to call up a specific function of a control unit, for example to be able to test the brakes of the motor vehicle, a release (or “permission”) is required. For this purpose, a diagnostic device is usually connected to a corresponding interface on the motor vehicle. So that certain (secure) functions can be accessed via this diagnostic device, this diagnostic device communicates with the control unit. The latter gives the diagnostic device its unique identifier and a task (“challenge”), which are passed on by the diagnostic device to a secure server (e.g. a secure database of the motor vehicle manufacturer). The server returns an answer to the task, which can only be answered correctly with knowledge of the unique identifier and the key material (usually several cryptographic keys) stored on the secure server (and on the individual control device), to the diagnostic device. This gives the latter access to the corresponding function. Such an approach is in DE 10 2012 110 499A1 described. DE 10 2018 104 079 A1 describes a modified procedure.

What is uniform, however, is that the specific cryptographic key required for the access described above is not disclosed to a (worst case scenario, unauthorized) third party (in this case not even the diagnostic tool), but rather only information that is only exchanged with the knowledge of the The corresponding cryptographic key can be correct and thus lead to unlocking. This prevents permanent access to functions of the motor vehicle that need to be secured accordingly.

The invention is based on the object of making the maintenance of a motor vehicle customer-oriented.

This object is achieved according to the invention by a method with the features of claim 1. Furthermore, this object is achieved according to the invention by a motor vehicle system with the features of claim 10. Advantageous and partly inventive embodiments and further developments of the invention are in the subclaims and the following Description presented.

The method according to the invention is used to operate a cryptographically secured system for a motor vehicle (“motor vehicle system”). According to the procedure, key material is disclosed to the person authorized to use the motor vehicle upon request by a person authorized to use the motor vehicle at a key management office and/or after a predetermined period of time.

The person authorized to use is in particular an owner, optionally also an owner, of the motor vehicle or maintenance or servicing personnel who - optionally on behalf of the owner (or possessor) - repairs, maintains or maintains the motor vehicle or optionally retrofit vehicle functions at a later date (the latter to enable continued participation in road traffic, for example). For convenience, this authorized person is hereinafter referred to as the “User”.

In other words, the key material in the sense of the invention is made known to the user of the motor vehicle - in contrast to an activation of a specific function in the event of service. The user can therefore have one Using the key material, the area of a control unit or several control units protected from access can be “entered” for maintenance, repair, replacement purposes or the like and thus influenced. For example, under this condition the user is able to change settings. This is particularly advantageous for motor vehicles that have exceeded a term referred to here and below as “end of life”, product life or maintenance life. This end of life is understood here in particular to mean that up to this point in time, maintenance support for the specific motor vehicle is available, in particular from the manufacturer, but beyond that, a supply of spare parts, etc. is no longer provided and/or supported by the manufacturer. At such a point in time, the means of providing the above-mentioned key material (e.g. databases or the like) usually expire. This means that in a motor vehicle that has exceeded its end of life, a control unit could no longer be replaced because the required cryptographic key material is no longer provided and can therefore be accessed. The invention advantageously provides a remedy here by disclosing the key material to the user, so that the user can, for example, provide a replaced control device with the correct key material even after the end of life and can therefore continue to use and maintain their motor vehicle.

Here and below, “key material” is understood to mean in particular a number of cryptographic (individual) keys, usually sequences of numbers and letters. One or more individual keys are used to access an assigned system area or for use by a specific vehicle function.

The motor vehicle system, which also represents an independent invention, comprises the motor vehicle, which in turn has at least one cryptographically secured control device - preferably several such control devices - and preferably the key management point. The motor vehicle system is set up to carry out the method described in more detail here and below, preferably in interaction with the user of the motor vehicle.

Preferably, the motor vehicle system comprises a database system, in particular separate from the motor vehicle, which is set up to carry out at least parts of the method described here and below - again preferably automatically.

The key management center is optionally the database system mentioned above - in short: database. In addition, the key management point can also be a staffed point that has access to the database or the like (e.g. to a storage medium on which the key material is stored) and can release the key material to the user.

In a preferred method variant, key material for system areas that are security-relevant and/or need to be protected from manipulation (in particular one or possibly several control devices) is excluded from disclosure. In other words, the key material required for this is not disclosed. Such a system area to be protected against manipulation is, for example, a memory for an absolute distance traveled by the motor vehicle. However - particularly with regard to the increasing autonomization of motor vehicles - system areas that could lead to a safety hazard in road traffic can also be excluded.

In an expedient variant of the method, the key material is handed over to the user (in particular directly) for disclosure. In particular, the key material to be disclosed does not remain secret in a (possibly protected) system area of a control unit of the motor vehicle. For example, the key material is given to the user on a data carrier or made available for download. If necessary, the key material can then be transmitted by the user to the motor vehicle, for example by reading the data carrier (e.g. via a USB interface) or sending it wirelessly to the motor vehicle. In principle, it is also conceivable that the key material is communicated to the user by telephone, i.e. H. In particular, the individual keys are dictated for transcription.

In an expedient method variant, the user is informed of all individual keys (i.e. possibly excluding the individual keys for the system areas described above that are to be secured against manipulation) of the key material, so that the user can at least fundamentally activate individual system areas in a selected manner.

In an optional method variant, in order to disclose the key material, a generally valid key material, in particular a default key or key set, is transferred to overwrite the current key material. This generally valid key material preferably contains the release (e.g. a corresponding certificate) to be allowed to overwrite the existing key material (preferably only for a specific motor vehicle). “Generally valid key material” is understood in particular to mean that after this key material has been used, every motor vehicle to which this key material has been applied (in particular with a corresponding specific release) would have the same cryptographic key or keys.

In an expedient variant of the method, a cryptographic master key (also referred to as a “master key”) is given to the user to disclose the key material. This master key is, for example, a key that is not required for conventional maintenance work or the like. The key material is preferably disclosed when this master key is entered in the motor vehicle. For example, the key material is displayed and/or offered for use on a display, in particular a graphical user interface. For example, a QR code containing the key material (optionally also several QR codes or a sequence of QR codes into which the key material is “divided”) is displayed or the key material is made available for download via an interface. Optionally, security functions that use the previous key material, in particular to block access to further functions of the motor vehicle, are deactivated so that all system areas are accessible, in particular permanently.

In a further expedient method variant, in order to disclose the key material, a certificate is activated on a predetermined date, on the basis of which the key material is then disclosed. In particular, the disclosure takes place as described above for the method variant with the master key.

In a preferred method variant, the disclosure of the key material is noted in a database and/or in the motor vehicle itself. The database is, for example, a central one (optionally a state one, e.g. maintained by the Federal Motor Transport Authority in Germany), a manufacturer-side database or the like. This is particularly useful in cases where a user receives the key material disclosed well before the end of life, for example several years. In this case, the database entry can be used to document which individual motor vehicles in a model fleet are disclosed and could potentially pose a security risk. Furthermore, it is also possible to take a motor vehicle whose key material has been disclosed back into “maintenance” at a later point in time by assigning it new cryptographic key material and resetting the control devices to a factory state. Optionally, an “initial key” of the key material is not disclosed for this purpose. Such a “resumption” of the motor vehicle for maintenance is preferably preceded by a conformity test to determine whether impermissible changes to the vehicle settings have been made. Furthermore, it is also advisable to notify a new owner of this if a motor vehicle whose key material has been disclosed is possibly resold. For this purpose, the disclosure status is displayed in particular in the aforementioned graphical user interface, optionally permanently or can at least be viewed there under a corresponding menu item.

In a further optional method variant, the key material is transmitted from the key management point to the motor vehicle for disclosure, in particular for display to the user (e.g. via the graphical user interface). In this case, the key material optionally remains in the vehicle, whereby the user can read it if necessary.

In a preferred variant of the method, the user who makes the request to disclose the key material is required to provide authentication. This can optionally consist of presenting an identification document, preferably in combination with proof of ownership of the motor vehicle (e.g. the “vehicle registration document”). For example, the ID number and the number of the vehicle registration document can be entered in the vehicle or stated directly to the key management office or presented in another way (e.g. via video conference).

In order to increase the security when disclosing the key material, an optional method variant uses a combination of the certificate activated on a specified date and the use of the master key. For example, the user receives the master key when he purchases the vehicle. However, this is only accepted by the motor vehicle at a certain point in time, for example when the certificate is activated (for example at the end of the maintenance lifespan), so that the master key cannot be used beforehand. In this case, the key material is not disclosed directly when the certificate is activated, but only when the master key is entered.

The conjunction “and/or” is to be understood here and below in particular in such a way that the features linked by this conjunction can be designed both together and as alternatives to one another.

An exemplary embodiment of the invention is explained in more detail below with reference to a drawing. The only figure in it shows 1 in a schematic principle sketch a method for operating a cryptographically secured motor vehicle system.

1 shows a motor vehicle system 1. The motor vehicle system 1 includes a motor vehicle 2 and a database 4. The motor vehicle 2 is a land and wheel-based passenger car. The motor vehicle 2 includes a plurality of control devices 6, which control different functions of the motor vehicle 2. For example, one of the control devices 6 controls a traction motor (an electric motor or alternatively an internal combustion engine), another controls a driving safety system and yet another controls a graphical user interface and thus represents an “on-board computer” with a touch-sensitive screen 8.

The control devices 6 are integrated into an on-board network 10 and are set up to communicate with one another via this on-board network 10. In order to make communication tamper-proof, the control devices 6 and the on-board network 10 are cryptographically secured. Specifically, the communication between the individual control devices 6 is encrypted with specific (individual) keys, i.e. H. Each control device 6 has an individually assigned key. Only if the key of the communication partner is stored in the corresponding other (receiving) control device 6 can these two control devices 6 communicate with one another. Furthermore, a control device 6 can also have a separate key for different functions, each of which is assigned a “system area”, which is required for access, for example in the event of maintenance.

In order to enable access to a control unit 6 (or possibly only a system area of this control unit 6) from outside, for example for service personnel, the keys of each motor vehicle 2 are in the database 4 - which in the present exemplary embodiment are operated by the manufacturer of the motor vehicle 2 is deposited as so-called key material 12. However, for a service, the corresponding key is not transmitted to the service personnel, but rather a request is generated during service access to the motor vehicle 2, specifically to the corresponding control unit 6, which is transferred to the database 4. This query can only be answered correctly in the database if the correct key is stored there. Service access is only released by the control unit 6 if the correct answer is transmitted.

In order to prevent that when a maintenance lifespan expires, i.e. H. If a vehicle model is no longer supported for maintenance by the manufacturer and access to the corresponding control unit 6 is no longer possible, the method described in more detail below is carried out.

In one variant, the user of the motor vehicle 2 submits a request to a key management point 14. In the present exemplary embodiment, this key management point 14 is part of the motor vehicle system 1. Optionally, the key management point 14 is part of the database 4 and is implemented as an automated interface. The request includes an application for the release and disclosure of the key material 12 relating to the individual motor vehicle 2. The user 2 must identify himself to the key management office 14, for example by showing the vehicle registration document of the motor vehicle 2. In the present example, the request is already made via the touch-sensitive screen 8 of the motor vehicle 2 and thus via a communication channel with the database 4 that is usual for the motor vehicle 2.

If the user of the database 4 or at least the key management office 14 is credentialed, it issues the key material 12 to the user, whereby the key material 12 and thus the individual keys contained therein are disclosed. For release, in the present exemplary embodiment, the key material 12 is transmitted to the motor vehicle 2 and stored there in a readable manner in the on-board computer (i.e. the corresponding control unit 6).

The disclosure of the key material 12 is noted in the database 4. Additionally or alternatively, the disclosure of the key material 12 can also be stored in a central (specifically state) database (not shown).

In an alternative embodiment, which is also based on 1 is explained, a certificate is stored in the motor vehicle 2, which is activated after a predetermined time or on a predetermined date and then automatically discloses the key material 12, i.e., for example, displays it to the user of the motor vehicle 2 on the screen 8 or from the database 4 queries and then displays. Alternatively, the certificate is stored in the database 4 and results in the key being given to the user or the motor vehicle 2 after a corresponding period of time material 12 is transmitted and thus disclosed. The note in the database 4 about the disclosure is made analogously to the previous exemplary embodiment. The variant in which the certificate is stored in the database 4 is useful in that manipulation of the certificate stored in the motor vehicle 2 can be prevented.

In another, also based on 1 In the exemplary embodiment explained, upon request from the user (or upon activation of the certificate), not all individual keys are handed over as key material 12, but only a “master key” that can be used to unlock all system areas or control devices 6 (i.e. something like that like a cryptographic master key).

Excluded from disclosure are system areas that may not be released due to legal requirements, for example an absolute distance traveled by the motor vehicle 2 (the “mileage” of the motor vehicle 2), data protection-relevant or other safety-critical functions, for example the basic functions of the motor vehicle 2 (e.g. B. the brakes) influencing system areas (e.g. it can be excluded that the braking function is permanently switched off). In addition, a so-called initial key of the key material 12 is optionally not disclosed. This can be used, for example, to - if the maintenance lifespan has not yet expired - return the motor vehicle 2 to a "safe" state, i.e. H. to provide it with secret key material again.

The subject matter of the invention is not limited to the exemplary embodiments described above. Rather, further embodiments of the invention can be derived by the person skilled in the art from the above description. In particular, the individual features of the invention described using the various exemplary embodiments and their design variants can also be combined with one another in other ways.

REFERENCE SYMBOL LIST:

1

Motor vehicle system

2

motor vehicle

4

Database

6

Control unit

8th

Screen

10

Onboard network

12

Key material

14

Key management agency

QUOTES INCLUDED IN THE DESCRIPTION

This list of documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102014019496 A1 [0003]
• DE 102012110499 A1 [0004]
• DE 102018104079 A1 [0004]

Claims (10)

Method for operating a cryptographically secured system (1) for a motor vehicle (2), wherein according to the method, upon request by a person authorized to use the motor vehicle (2) at a key management center (14) and/or after a predetermined term, a disclosure of Key material (12) is sent to the person authorized to use the motor vehicle (2). Procedure according to Claim 1 , whereby key material (12) for system areas that are security-relevant and/or need to be protected from manipulation remains excluded from disclosure. Procedure according to Claim 1 or 2 , whereby the key material (12) is handed over to the user in order to disclose it. Procedure according to one of the Claims 1 until 3 , wherein in order to disclose the key material (12), a generally valid key material (12) is handed over to overwrite the current key material (12). Procedure according to one of the Claims 1 until 4 , wherein a cryptographic master key is handed over to the user in order to disclose the key material (12), in particular wherein the key material (12) is disclosed when the master key is entered in the motor vehicle (2). Procedure according to one of the Claims 1 until 5 , wherein to disclose the key material (12), a certificate is activated on a predetermined date, on the basis of which the key material (12) is then disclosed. Procedure according to one of the Claims 1 until 6 , wherein the disclosure of the key material (12) is noted in a database (4) and/or in the motor vehicle (2) itself. Procedure according to Claim 3 , wherein the key material (12) is transmitted to the motor vehicle (2), in particular for display to the user, or to the user himself. Procedure according to one of the Claims 1 until 8th , whereby authentication of the user is required in order to disclose the key material (12). Motor vehicle system (1), comprising at least one motor vehicle (2) with at least one cryptographically secured control device (6), and the method according to one of the Claims 1 until 9 to carry out.

Images