DE102022127502A1 - Method for updating a key for encrypted communication between a transmitter and a receiver of a vehicle using a new key encrypted using a public key of the receiver - Google Patents

Abstract

The invention relates to a vehicle (1), having a transmitter (2) for transmitting sensor data (101), which can be generated using a sensor (3) of the vehicle (1), and a receiver (4) for receiving the sensor data (101 ), wherein the transmitter (2) and the receiver (4) are set up and configured to transmit the sensor data (101) from the transmitter (2) to the receiver (4) in encrypted form using a key (100 ) perform, wherein the encrypted communication is a unidirectional communication in which only data from the transmitter (2) to the receiver (4) can be sent, and in the receiver (4) a private key (200) of the receiver (4) stored and the recipient (4) is designed and set up to decrypt a new key (400) encrypted with a public key (300) of the recipient (4) using the private key (200) of the recipient (4) in order to 100) to carry out the encrypted communication.

Description

The invention relates to a vehicle with a transmitter for the encrypted transmission of sensor data that can be generated using a sensor of the vehicle, and a receiver for receiving the sensor data. The invention further relates to a method for updating a key for transmitting sensor data that can be generated using a sensor from a transmitter in a vehicle to a receiver in the vehicle and a computer program product for carrying out the method.

Encrypting sensor signals in a vehicle is known in order to increase the security of data transmission from a sensor to a control unit. Security is increased in particular by the fact that the sensor signals can no longer be manipulated so easily. In the DE 10 2021 003 257 A1 describes, for example, encrypting a message with a first component of a vehicle and sending it to a second component, which decrypts this message.

A vehicle is proposed, having a transmitter for sending out sensor data, which can be generated using a sensor of the vehicle, and a receiver for receiving the sensor data. The transmitter and the receiver are set up and designed to carry out encrypted communication for transmitting the sensor data from the transmitter to the receiver in encrypted form using a key. Encrypted communication is unidirectional communication in which only data can be sent from the sender to the recipient. A private key of the recipient is stored in the recipient. Furthermore, the recipient is designed and set up to decrypt a new key encrypted with a public key of the recipient using the private key of the recipient in order to be able to replace the key for carrying out the encrypted communication.

The transmitter is preferably set up to process the sensor data generated using the sensor for the encrypted communication. In particular, the transmitter is designed and set up to encrypt the sensor data using the key in order to generate encrypted sensor data. For this purpose, the key is advantageously stored in a memory of the transmitter. To generate the encrypted sensor data, the transmitter can preferably have a coding circuit or an encryption program for coding. The coding circuit can be provided, for example, by a microcontroller system of the transmitter. The encryption program can be stored in the transmitter's memory. A processing unit of the transmitter is preferably set up to run the encryption program in order to generate the encrypted sensor data.

According to one variant, the transmitter and the sensor can be designed as a single component which can be mounted individually in the vehicle. For example, circuits, in particular at least one microchip, of the transmitter can be integrated in a common housing with circuits, in particular at least one microchip, of the sensor in a common housing. According to a further variant, the transmitter can have a housing that is independent of the sensor. In this case, the sensor is connected to the sensor for transmitting the sensor data from the sensor to the transmitter, preferably via a cable.

Furthermore, the receiver is designed and set up to decrypt the encrypted sensor data. In order to decrypt the encrypted sensor data, the receiver preferably has a decoding circuit or a decryption program for decoding. The decoding circuit can be provided, for example, by a microcontroller system of the receiver. The decryption program can be stored on a memory of the receiver. A processing unit of the receiver is preferably set up to run the decryption program in order to decrypt the encrypted sensor data.

The receiver is preferably designed and set up to decrypt the encrypted sensor data using the key. To this end, the key is advantageously stored in the receiver's memory. In practical terms, encrypting the sensor data and decrypting the encrypted sensor data involves a symmetrical encryption method.

In this case, the same key, namely the above-mentioned key, is used to encrypt the sensor data and to decrypt the encrypted sensor data. The symmetrical encryption method can be implemented, for example, according to the AES algorithm (Advanced Encryption Standard) or according to the IDEA algorithm (International Data Encryption Algorithm).

Advantageously, the transmitter and the receiver are each designed and set up to carry out the encrypted communication via lines. For this purpose, the transmitter and the receiver can each be connected to a bus system of the vehicle be connected. The transmitter preferably sends the encrypted sensor data to the bus system. The receiver receives the encrypted sensor data from the bus system. Alternatively, the transmitter can be connected to the receiver via a line that is used exclusively for communication between the transmitter and the receiver.

In principle it is also possible for the transmitter and the receiver to be designed and set up to carry out the encrypted communication wirelessly, in particular by radio. For this purpose, the transmitter and the receiver can each have an antenna.

The fact that the recipient's private key is stored in the recipient and the recipient is trained and set up to decrypt the new key encrypted with the recipient's public key using the recipient's private key makes it possible for the recipient to receive the new key in sent in a secure form. The new key can thereby be sent to the recipient in secure form by sending the new key to the recipient in encrypted form. The encrypted form of the new key can be generated using the recipient's public key.

The fact that the new key can be sent to the recipient in a secure form makes it possible to replace the key with the new key in a secure manner. In general, replacing the key with the new key can increase the security of the encrypted communication.

In order to replace the key with the new key, the recipient is preferably arranged to store the new key in the recipient's memory. The arithmetic unit of the recipient advantageously deletes the key after the new key has been stored.

By replacing the key with the new key it is meant that the encrypted communication can be performed using the new key instead of the key. In particular, the transmitter is designed and set up to encrypt the sensor data using the new key in order to generate the encrypted sensor data. As described above, this can be carried out using the coding circuit or the encryption program. Analogously, the receiver is preferably designed and set up to decrypt the encrypted sensor data using the new key. As described above, this can be carried out using the decoding circuit or the decoding program.

In order to be able to carry out the encrypted communication between the transmitter and the receiver using the new key, the new key is stored in the transmitter, preferably in the transmitter's memory.

According to one embodiment, the receiver is a control unit, in particular an engine control unit, of the vehicle. The control unit is preferably set up to process the sensor data for controlling and/or regulating at least one component of the vehicle in order to control and/or regulate the component as a function of the sensor data. In this specific embodiment, the encrypted communication between the sensor and the control device can increase the security of the control and/or regulation of the components of the vehicle.

The component of the vehicle, also referred to below as vehicle component, can be designed, for example, in the form of a brake system, a steering system or a drive system or in the form of a part of the brake system, the steering system or the drive system. The sensor is preferably a sensor of the vehicle component in order to detect a state of the vehicle component.

Within the scope of the invention, the receiver can be a receiver of the control unit. In principle, the receiver can be a receiver of any possible component of the vehicle that can process the sensor data.

The transmitter is advantageously set up to carry out the unidirectional communication according to a SENT protocol. This can make it possible for the transmitter to be used for a large number of possible components of the vehicle for unidirectional communication between the transmitter and the receiver, in particular the control unit. In this case, the sensor and the transmitter are part of one of the possible components.

SENT is an abbreviation for "Single Edge Nibble Transmission" and describes a communication protocol. The SENT protocol and a physical SENT interface for using the SENT protocol are defined by SAE J2716. SAE refers to the "Association of Automotive Engineers". In many cases, the SENT protocol and the SENT interface are used for communication between sensors and control units in automotive electronics.

The SENT interface is a unidirectional, asynchronous voltage interface that has three conductors. A supply voltage (5 volts) is transmitted on a first conductor. A signal voltage is transmitted on a second conductor and a ground is transmitted on a third conductor. The signal voltage has a low level, which is characterized by voltage values in a range from 0 to about 0.5 volts, and a high level, which is characterized by voltage values in a range from 4.1 volts to 5 volts.

The SENT protocol specifies that data is transmitted in units of 4 bits. A unit of 4 bits is also referred to as a nibble. A message is usually transmitted using the SENT protocol using an 8-nibble data format. Six of the eight nibbles are used here for a transmission of user data. One of the eight nibbles is typically used for error detection and another of the eight nibbles to indicate status and establish communication. It is also possible to use a 5-nibble data format in which only three nibbles are used to transmit a useful signal.

According to one possible embodiment, the encrypted new key is stored in a memory of the sensor. In this embodiment, the sensor is set up to send the encrypted new key to the recipient after the sensor has been installed in the vehicle. This makes it possible to replace the key with the new key by replacing the sensor. In this embodiment, the new key can be encrypted by a manufacturer of the sensor using the recipient's public key. The new key and the new key encrypted using the recipient's public key are preferably stored in a memory of the sensor. At the very least, the sensor manufacturer will store the new key in the sensor's memory. The memory of the sensor may include the memory of the transmitter. In this variant, the transmitter is preferably integrated in the sensor.

In principle, the embodiment in which the encrypted new key is stored in the memory of the sensor allows the public key to be known only to the manufacturer of the sensor. Furthermore, this embodiment allows the encrypted new key to be available only by reading out the memory of the sensor. The encrypted new key does not have to be transmitted over a public network, such as the Internet, to get to the recipient. In this embodiment, the encrypted new key can be transmitted to the recipient by physically transporting the sensor from the manufacturer of the sensor to the vehicle and then installing the sensor in the vehicle and subsequently sending the encrypted new key from the sensor to the receiver can be realized. The memory of the sensor can be in the form of the memory of the transmitter described above. Alternatively, the sensor may have a connection between the sensor's memory and the transmitter to transmit the encrypted new key from the sensor's memory to the transmitter.

The transmitter is advantageously integrated in the sensor. The sensor is preferably set up to send the encrypted new key to the recipient by sending out a number of messages. The respective messages can preferably each have the 8-nibble data format.

In one development, the sensor is set up to send the encrypted new key to the recipient in encrypted form using the key after the sensor has been installed in the vehicle. In this case, the sensor or the transmitter additionally encrypts the new key encrypted using the public key of the recipient using the key. As a result, the new key can be transmitted even more securely.

In a further refinement, the sensor has a connection via which the encrypted new key can be transferred to the memory of the sensor. This can further increase security since, in this embodiment, the encrypted new key can be transmitted to the memory of the sensor via the connection without using the Internet.

According to a further embodiment it can be provided that the recipient can be connected to an external computer via the Internet in order to receive the encrypted new key. In this embodiment, the encrypted new key is sent over the Internet from the external computer to the recipient. In this case, communication between the transmitter and the receiver is not necessary for storing the encrypted new key in the receiver's memory.

Furthermore, a method for updating a key for the transmission of sensor data that can be generated using a sensor from a transmitter in a vehicle to a receiver in the vehicle is proposed. The transmitter and the receiver are set up and trained, a ver carry out encrypted communication for transmitting the sensor data from the transmitter to the receiver in encrypted form using the key, the encrypted communication being a unidirectional communication in which only data can be sent from the transmitter to the receiver. The transmitter and the receiver can be designed according to one of the variants described above. The procedure has the following steps. In a first step, a new key is encrypted using a recipient's public key. As described above, the new key can be used as a replacement for the key for encrypted transmission of the sensor data from the transmitter to the receiver. In a second step, the encrypted new key is sent to the recipient. In a third step, the encrypted new key is decrypted using a private key of the recipient. The recipient's private key is stored in the recipient.

Furthermore, a computer program product with instructions that can be executed by one or more processors is proposed. Execution of the instructions causes the processors to carry out the proposed method. The processors can be distributed locally. For example, a first processor of a server external to the vehicle may execute initial instructions for encrypting the new key using the recipient's public key. A second processor, in particular of the sender, can carry out second instructions for sending the encrypted new key to the recipient. A third processor of the recipient may execute third instructions to decrypt the encrypted new key using the recipient's private key. The computer program product preferably comprises three parts, with a first part having the first instructions, a second part having the second instructions and a third part having the third instructions.

• 1 ein Fahrzeug mit einem Empfänger und einem Sensorsystem mit einem Sensor und einem Sender, in dem ein Schlüssel zum Durchführen einer verschlüsselten Kommunikation von dem Sender zu dem Empfänger gespeichert ist;
• 2 das in 1 gezeigte Fahrzeug, wobei in dem Sender ein verschlüsselter neuer Schlüssel zum Durchführen der verschlüsselten Kommunikation von dem Sender zu dem Empfänger gespeichert ist;
• 3 ein in Bezug zu dem in 1 gezeigten Fahrzeug externer Server zum Generieren des in 2 gezeigten verschlüsselten neuen Schlüssels;
• 4 Schritte eines Verfahrens zum Ersetzen des in 1 gezeigten Schlüssels durch den in 3 gezeigten neuen Schlüssel.

Preferred exemplary embodiments are explained in more detail with reference to the following figures. It shows schematically:

• 1 a vehicle with a receiver and a sensor system with a sensor and a transmitter in which a key for performing an encrypted communication from the transmitter to the receiver is stored;
• 2 this in 1 vehicle shown, wherein an encrypted new key for performing the encrypted communication from the transmitter to the receiver is stored in the transmitter;
• 3 a in relation to the in 1 shown vehicle external server to generate the in 2 displayed encrypted new key;
• 4 Steps of a procedure to replace the in 1 shown key by the in 3 shown new key.

1 shows a vehicle 1 having a transmitter 2 for sending out sensor data 101 which can be generated using a sensor 3 of the vehicle 1 . According to a possible variant, the transmitter 2 forms a sensor system 5 together with the sensor 3 . The sensor system 5 is preferably arranged in a common housing. Advantageously, the common housing can be exchanged manually to replace the sensor system 5 .

Furthermore, the vehicle has a receiver 4 for receiving the sensor data 101 . The transmitter 2 and the receiver 4 are each set up and designed to carry out encrypted communication for transmitting the sensor data 101 from the transmitter 2 to the receiver 4 in encrypted form using a key 100 . For this purpose, the key 100 is preferably stored in a memory 22 of a computing unit 20 of the transmitter 2 . Furthermore, the transmitter 2 has a coding means for encrypting the sensor data 101 using the key 100 . The coding of transmitter 2 is in the in 1 shown variant in the form of an encryption program 23, which is stored on the memory 22. In order to generate encrypted sensor data 102 , a processor 21 of the processing unit 20 advantageously executes commands from the encryption program 23 using the key 100 . The transmitter 2 sends the encrypted sensor data 102 to the receiver 4.

In order to decrypt the encrypted sensor data 102, the receiver 4 advantageously has a computing unit 40 with a processor 41 and a memory 42. The key 100 and a decryption program 43 are preferably stored in the memory 42 . In order to decrypt the encrypted sensor data 102 and to obtain the sensor data 101 therefrom, the processor 41 advantageously executes instructions from the decryption program 43 using the key 100 . The transmitter 2 advantageously sends the encrypted sensor data 102 to the receiver 4 via a data connection 6 between the transmitter 2 and the receiver 4.

The data connection 6 is advantageously in the form of a 1:1 connection. The 1:1 connection means a connection that only leads from the transmitter 2 to the receiver 4 . The data connection 6 is advantageously in the form of a unidirectional data connection in which the transmitter 2 can transmit to the receiver 4 but the receiver 4 cannot transmit to the transmitter 2 . The transmitter 2 sends the encrypted sensor data 102 preferably using the SENT protocol described above.

For this purpose, the transmitter 2 advantageously has the above-mentioned SENT interface. This means that the data connection 6 advantageously includes three lines. A supply voltage of 5 volts is present on a first line of the three lines, the signal voltage is present on a second line of the three lines, and ground is present on a third line of the three lines. The unidirectional communication is preferably implemented by the transmitter 2 using the SENT protocol. For this purpose the processor 21 can preferably generate messages which have the 8-nibble data format. In particular, the messages can each contain eight nibbles, with six of the respective eight nibbles having the information for transmitting the encrypted sensor data 102 . In some cases, the number of messages for transmitting the encrypted sensor data 102 is six. A total of 64 bits are available as user data of the messages for the transmission of the encrypted sensor data 102 .

Furthermore, a private key 200 of the recipient 4 is stored in the recipient 4 . The recipient 4 is designed and set up to decrypt a new key 400 encrypted with a public key 300 of the recipient 4 in order to carry out the encrypted communication using the private key 200 of the recipient. The computing unit 40 is advantageously set up to decrypt the encrypted new key 400 using the private key 200 . This can be implemented, for example, by the processor 41 of the processing unit 40 executing instructions from the decryption program 43 or from a further decryption program, not shown in the figures, using the private key 200 .

2 shows an embodiment in which the encrypted new key 400 reaches the receiver 4 via the transmitter 2 and the unidirectional data connection 6 . According to a variant of this embodiment, the encrypted new key 400 can be stored in the memory 22 of the processing unit 20 of the transmitter 2 . The sender 2 can send the encrypted new key 400 via the data connection 6, as in 2 shown to the receiver 4 send. The recipient 4 can use the encrypted new key 400, as in 2 shown, store in the memory 42 of the processing unit 40 of the receiver 4 in order to subsequently decrypt it.

3 shows a server 30 that is external to the vehicle 1. The external server 30 can be assigned to a manufacturer of the sensor 3 or the sensor system 5, for example. The external server 30 is preferably set up to download the public key 300 of the recipient 4 from a first additional server not shown in the figures. In particular, the public key 300 can be accessible to anyone on the Internet.

According to a possible embodiment, the external server 30 generates a new key 500 for the sensor system 5, in particular for carrying out the encrypted communication between the transmitter 2 and the receiver 4, with the help of a processing unit of the external server 30.

According to another variant not shown in the figures, the new key 500 can be produced using the Diffie-Hellman method. For this purpose, the external server 30 sets up a further data connection with a second further server, which is not shown in the figures. The new key 500 can be produced via this further data connection by exchanging generated intermediate results between the external server 30 and the second further server using the Diffie-Hellman method, so that it does not have to be exchanged via the further data connection. The second further server can in particular be assigned to a manufacturer of the receiver 4 . This makes it possible for the new key 500 to also be available to the manufacturer of the receiver 4 .

The external server 30 is advantageously designed and set up to encrypt the new key 500 using the public key 300 in order to thereby generate the encrypted new key 400 . According to one possible embodiment, the external server 30 sends the encrypted new key 400 to the sensor system 5 or the sensor 3. For this purpose, for example, an Internet connection can be set up between the external server 30 and the sensor system 5 or directly with the sensor 3.

According to another possible variant, the encrypted new key 400 can be used in a to the in 2 Sensor system shown 5 structurally identical sensor system are stored.

This in 1 In this case, the sensor system 5 shown can be replaced by the identical sensor system, in that the sensor system 5 is preferably removed from the vehicle 1 manually or mechanically and the identical sensor system is then installed in the vehicle 1 . 2 shows a state of the vehicle 1 after the in 1 sensor system 5 shown has been replaced. Opposite the inside 1 The sensor system 5 shown is on the memory 22 of the 2 sensor system 5 shown instead of the key 100, the encrypted new key 400 is stored.

The sensor system 5 is advantageously set up to send the encrypted new key 400 to the recipient 4 after the sensor system 5 has been installed in the vehicle 1 . According to a possible development, after the sensor system 5 has been installed, the sensor system 5 can also send the encrypted new key 400 in encrypted form to the receiver 4 using the key 100 . For this purpose, the vehicle 1 preferably has an additional memory (not shown in the figures) for storing the key 100 . According to a further variant, in addition to the encrypted new key 400, the key 100 can also be stored in the memory 22 of the computing unit 20 before the sensor system, which is structurally identical to the sensor system 5, is installed. For this purpose, a history of keys used for data exchange between the sensor system 5 and the receiver 4 is preferably available on the external server 30 .

4 shows steps of a method for updating the key 100 for the transmission of sensor data 101 that can be generated using the sensor 3 from the transmitter 2 of the vehicle 1 to the receiver 4 of the vehicle 1. The method has the following steps. In a first step 401, the new key 500 is encrypted using the public key 300 of the recipient 4. As described above, this can be done using the external server 30 . In other words, the encrypted new key 400 is generated by encrypting the new key 500 using the public key 300 .

The new key 500 can advantageously be used as a replacement for the key 100 for the encrypted transmission of the sensor data 101 from the transmitter 2 to the receiver 4 . For example, a character string representing the new key 500 can be of the same length as another character string representing the key 100 .

In a second step 402, the encrypted new key 400 is sent to the recipient 4. According to one variant, as described above, this can be done by sending the encrypted new key 400 from the transmitter 2 to the receiver 4 via the data connection 6 . According to a further variant, the receiver 4 can be connected to a maintenance computer, for example in a workshop, with the encrypted new key 400 being stored in the maintenance computer. In this case, the encrypted new key 400 is transmitted from the maintenance computer to the memory 42 of the processing unit 40 of the receiver 4 .

In a third step 403, the encrypted new key 400 is decrypted using the private key 200 of the recipient 4. Subsequently, if the key 100 is still stored in the memory 42, it is advantageously deleted.

QUOTES INCLUDED IN DESCRIPTION

This list of the documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• DE 102021003257 A1 [0002]

Claims (9)

Vehicle (1), having a transmitter (2) for sending out sensor data (101), which can be generated using a sensor (3) of the vehicle (1), and a receiver (4) for receiving the sensor data (101), wherein the Transmitter (2) and the receiver (4) are set up and configured to carry out encrypted communication for transmission of the sensor data (101) from the transmitter (2) to the receiver (4) in encrypted form using a key (100), wherein the encrypted communication is a unidirectional communication in which only data can be sent from the transmitter (2) to the receiver (4), and in the receiver (4) a private key (200) of the receiver (4) is stored and the receiver (4) is designed and set up to decrypt a new key (400) encrypted with a public key (300) of the recipient (4) using the private key (200) of the recipient (4) in order to carry out the key (100). the ve to be able to replace encrypted communication. Vehicle (1) after claim 1 , wherein the encrypted new key (400) is stored on a memory (22) of the sensor (3) and the sensor (3) is set up, the encrypted new key (400) after the sensor (3) has been installed in the vehicle ( 1) to send to the recipient (4). Vehicle (1) after claim 2 , The sensor (3) being set up to send the encrypted new key (400) to the recipient (4) in encrypted form using the key (100) after the sensor (3) has been installed in the vehicle (1). Vehicle (1) after claim 2 or 3 , The sensor (3) having a connection via which the encrypted new key (400) can be transferred to the memory (22) of the sensor (3). Vehicle (1) after claim 1 , The receiver (4) being able to be connected to an external computer via the Internet in order to receive the encrypted new key (400). Vehicle (1) according to one of the preceding claims, wherein the receiver (4) is a control unit of the vehicle (1) and the control unit is set up to transmit the sensor data (101) for controlling and/or regulating at least one component of the vehicle (1). process in order to control and/or regulate the component depending on the sensor data (101). Vehicle (1) according to one of the preceding claims, wherein the transmitter (2) is set up to carry out the unidirectional communication according to a SENT protocol. Method for updating a key (100) for the transmission of sensor data (101) that can be generated using a sensor (3) from a transmitter (2) of a vehicle (1) to a receiver (4) of the vehicle (1), the transmitter (2 ) and the receiver (4) are set up and configured to carry out encrypted communication for transmitting the sensor data (101) from the transmitter (2) to the receiver (4) in encrypted form using the key (100), the encrypted communication is a unidirectional communication in which only data can be sent from the transmitter (2) to the receiver (4), the method having the following steps: - Encrypting a new key (500) using a public key (300) of the recipient (4), the new key (500) as a replacement for the key (100) for encrypted transmission of the sensor data (101) from the transmitter (2) to the receiver (4); - sending the encrypted new key (400) to the receiver (4); - decrypting the encrypted new key (400) using a private key (200) of the recipient (4), the private key (200) being stored in the recipient (4). Computer program product with instructions that can be executed by one or more processors, the execution of the instructions requiring the processors to carry out the method claim 8 prompted.

Images