DE102022209301A1 - Method for transferring a control device to a safe system state - Google Patents

Abstract

The invention relates to a method for transferring a control device in a vehicle (10) to a safe system state, wherein data is exchanged between a first control device (12) and a second control device (14) and a third control device (22) via a wired communication link (16 ) takes place, the first control device (12) additionally having an interface (18) for wireless communication and the wired communication route being implemented using a CAN bus system (20). In the method in which the hardware and software effort is minimized, It is provided that, if necessary, the second control device (14) transmits CAN messages with a predetermined priority in the CAN bus system, so that it is avoided that the first control device (12) and/or the third control device (22) send CAN messages in the CAN bus system (20).

Description

The invention relates to a method for transferring a control device in a vehicle, in particular a motor vehicle, to a safe system state, with data exchange between a first control device and a second control device taking place via a wired communication link, the first control device additionally having an interface for wireless communication , wherein the wired communication route is implemented by means of a CAN bus, with CAN messages being transmitted to a third control device by the second control device, the third control device acting as an actuator, at least the second control device containing an internal counter reading according to the CAN standard, which is increased when faulty CAN messages are detected, with at least the second control device being transferred from a first operating mode to a second operating mode when an internal counter reading reaches a first limit value.

In addition, the invention relates to a vehicle with at least a first control device, a second control device and a third control device, the control devices being connected to one another by means of a CAN bus system.

A large number of sensor devices, control devices and control computers are installed in modern motor vehicles. These elements are usually connected to one another via an on-board network, which is often implemented as a bus system. Data can be exchanged with each other via the bus system. External higher-level systems can also be addressed via an interface. The control devices, control computers and sensor devices, hereinafter collectively referred to as control devices, are designed to carry out various monitoring and control functions occurring in the vehicle. This includes, among other things, controlling and/or monitoring the engine and transmission controls or anti-lock braking systems. In some cases, these systems have to work in real time or with as little time delay as possible, since important processes, such as braking deceleration, have to be controlled.

If there are control devices on a vehicle bus that have radio interfaces, for example WLAN and/or Bluetooth, an attacker could hack into these control devices and manipulate the vehicle bus.

To solve this problem, it is known from the prior art, for example, to transmit encrypted CAN messages. However, such encryption requires a corresponding hardware and software infrastructure, which is not available in every bus system.

The invention is therefore based on the object of specifying a method and a vehicle in which, in the event of a cyber attack, it is possible to put the system into a secure mode, while at the same time minimizing the hardware and software effort.

In the present invention, this object is initially achieved by the features of the characterizing part of patent claim 1 in that CAN messages with a predetermined priority are transmitted in the CAN bus system by the second control device, so that it is avoided that the first control device and / or the third control device can transmit CAN messages in the bus system when the second control device is in the second operating mode or when it is detected that a CAN message is transmitted to the third control device that does not come from the second control device.

In this context, an actuator is a device that converts signals from a control device into actions. An actuator can be, for example, an electric motor or electromagnetic valves. In the state of the art, actuators are installed in a large number of electronic control systems in vehicles. Actuators are responsible, for example, for adjusting flaps, regulating fluid flows and/or activating pumps in order to build up a desired pressure. Actuators are also used in engine control and comfort systems in modern motor vehicles. In engine control, actuators are used, for example, to regulate idle speeds, to control ventilation flaps, to optimize torque or performance and/or to meter fuel for optimal combustion.

Actuators are also used in comfort systems, for example for locking and unlocking vehicle doors or for remote operation of fuel tank caps, tailgates, hoods and/or storage compartments. Thanks to powerful actuators in a wide variety of designs, numerous safety and assistance systems have been implemented in recent years. In this way, actuators help to support drivers in critical situations and thus avoid accidents.

The normal state of the second control unit is in the first operating mode The way the control devices are used is to be understood in general, in which CAN messages can be received and sent. In the second operating mode, the second control device is restricted. The second operating mode can, for example, correspond to an error-passive mode known from the CAN standard. If a frame is transmitted incorrectly on the CAN bus system, the other participants, i.e. the other control devices, recognize this and intervene with an active error frame, which causes the sender to send its CAN message again. Under certain circumstances, this can be repeated until the internal error counter of the corresponding control unit that sends the error frame is too high. It is then planned that the control unit itself assumes that there is a defect and is transferred to error-passive mode.

If a cyber attack occurs via the wireless communication interface, there are basically two scenarios through which malware could manipulate the bus system. On the one hand, it is conceivable that malware manipulates any transmission messages from the second control device via the first control device. This causes the second control unit to send out error frames, which destroys the messages in accordance with the CAN specification. The internal counter reading is increased, with the second control device being transferred to error-passive mode when the first limit value is reached. Afterwards, the second control device no longer sends error frames. This means that the malware from the first control unit can send CAN messages to the third control unit. The error is not recognized by the third control unit and is not converted into emergency mode. As a result, the malware can manipulate the bus system.

A second conceivable scenario is that potential malware from the first control device sends messages to the third control device with a cycle time of 1 ms in parallel to the messages from the second control device to the first control device. The third control device does not recognize which control device the correct messages come from. Achieving safe emergency operation cannot then be guaranteed for the third control device.

The method according to the invention now takes measures in the case of these scenarios. The CAN message with a predetermined priority can accordingly also contain a predetermined cycle rate and user data with only dominant bits. In this way it can be avoided that another control device can send data to the bus. Manipulation of the bus system can thus be prevented.

The predetermined priority can correspond to a highest priority according to the CAN standard, so that the CAN messages from the second control device flood the CAN bus system and messages from a possibly compromised control device with installed malware cannot be forwarded.

Further preferred embodiments of the invention result from the remaining features mentioned in the subclaims.

In a first embodiment of the method according to the invention, an error memory is provided. An entry is made in the error memory when CAN messages with a predetermined priority are transmitted in the CAN bus system by the second control unit. In this way, possible cyber attacks can be tracked. In addition to the error, the date and time can also be saved.

Additionally or alternatively, in a further embodiment of the method according to the invention, it is provided that information about a possible cyber attack is displayed in a display area of a display device. In this way, the driver of the vehicle is warned and can decide whether it is safe to continue driving.

The display area of the display device can be a display in the middle area or in the cockpit area, for example in the instrument cluster of the vehicle. Alternatively or additionally, the display area of the display device can be designed as a head-up display. A head-up display is a display area in which the driver can maintain the position of his head or line of sight because the information is projected into his field of vision, for example onto the windshield of the vehicle.

In order to increase safety, in a further exemplary embodiment of the invention it is provided that the driver of the vehicle is asked to turn off the vehicle when CAN messages with a predetermined priority are transmitted in the CAN bus system by the second control unit. Since in this scenario there is a very high probability that a cyber attack will be carried out on at least one control unit, it is advisable to turn off the vehicle so that no malfunctions can occur while driving.

In a further advantageous embodiment of the invention, it is provided that the internal counter reading is reset when CAN messages are sent by the second control unit be transmitted with the correct priority in the CAN bus system. Since a number of incorrect messages have already been transmitted and a cyber attack may be carried out by a third party, the internal counter reading does not need to continue to be set so high that the second control device is in the second operating mode.

In a particularly preferred embodiment of the method according to the invention, it is provided that the second control device transmits CAN messages with a predetermined priority in the CAN bus system until the vehicle is switched off. When the vehicle is switched off, for example when the ignition is switched off, the vehicle cannot establish a wireless connection using the first control unit. It is therefore likely that a hacker attack is no longer possible when the vehicle is switched off. It can therefore be assumed that the bus system will function without any problems when the ignition is restarted. The second control device then initially does not transmit any prioritized messages in order to prevent other devices in the bus system from transmitting messages. It is initially assumed that there is no longer a cyber attack. If this is the case, it will be recognized accordingly and the second control device will again transmit prioritized messages in the bus system.

A further embodiment of the invention provides that the CAN messages are transmitted with a predetermined priority by controlling a MOSFET. The MOSFET allows the voltage level of a CAN transceiver to be set to “dominant” so that the maximum voltage level for the system is achieved. In general, the voltage levels are changed accordingly when a transmitter transmits a message on a CAN bus. The “dominant” setting means that other possible messages from other control devices are overlaid and not registered.

Furthermore, in a further embodiment of the method according to the invention, it is provided that the CAN messages have a message counter and a CRC checksum. In this way, messages can be checked and assigned in advance, so that only the two scenarios described above exist for the transmission of malware.

According to a further embodiment of the invention, it is provided that the second control device is transferred to the second operating mode when the internal counter reading is 128. It can generally be provided that the internal counter reading of a CAN controller in the second control unit is incremented by +8 when an error frame is transmitted. If the internal counter reading is 128, the second control unit then goes into error-passive mode. With an internal counter reading of 256, the second control unit can be switched to a third operating mode, for example a bus off state known according to the CAN standard. The second control device then no longer sends messages. A second limit value of the internal counter reading can thus be defined, which causes a further change in the state of the second control device.

Electronic or electrical devices and/or other relevant devices or components according to the embodiments of the present invention described herein may be implemented using any suitable hardware, firmware (e.g., an application-specific integrated circuit), software, or a combination of software, firmware, and hardware. For example, the various components of these devices can be housed on an integrated circuit (IC) or on separate IC chips. Furthermore, the various components of these devices can be implemented on a flexible printed circuit film, a tape carrier package (TCP), a printed circuit board (PCB), or on a single substrate. Additionally, the various components of these devices may be a process or thread that runs on one or more processors in one or more computing devices, executes computer program instructions, and interacts with other system components to perform the various functions described herein. The computer program instructions are stored in a memory that can be implemented in a computing device using standard memory such as random access memory (RAM). The computer program instructions may also be stored in other non-transferable, computer-readable media, such as a CD-ROM, flash drive, or the like. A person skilled in the art should also recognize that the functionality of various computing devices may be combined or integrated into a single computing device, or that the functionality of a particular computing device may be distributed to one or more other computing devices without departing from the scope of the exemplary embodiments of the present invention.

The aforementioned task is also achieved by a vehicle with at least a first control device, a second control device and a third control device, the control devices being connected to one another by means of a CAN bus system. It is intended that the control devices are set up and designed for this purpose carry out the method according to the invention. The statements regarding the method according to the invention also apply accordingly to the vehicle according to the invention.

The various embodiments of the invention mentioned in this application can be advantageously combined with one another, unless stated otherwise in individual cases.

• 1 eine schematische Darstellung eines CAN-Bussystems in einem Fahrzeug,
• 2 eine schematische Darstellung des Innenraums eines Fahrzeugs mit einer Anzeigeeinrichtung und
• 3 eine Blockdarstellung verschiedener Schritte eines Ausführungsbeispiels der Durchführung eines erfindungsgemäßen Verfahrens.

The invention is explained below in exemplary embodiments using the associated drawings. Show it:

• 1 a schematic representation of a CAN bus system in a vehicle,
• 2 a schematic representation of the interior of a vehicle with a display device and
• 3 a block representation of various steps of an exemplary embodiment of carrying out a method according to the invention.

1 shows an arrangement of various control devices in a vehicle 10. A first control device 12 is connected to a second control device 14 by means of a wired communication link 16. The first control device 12 additionally has an interface 18 for wireless communication. The wired communication route 16 is a CAN bus system 20. Furthermore, a third control device 22 is connected within the CAN bus system 20 to the first control device 12 and the second control device 14. The third control device 22 serves as an actuator in this exemplary embodiment, with CAN messages to the third control device 22 only being reserved for the second control device 14.

The interface 18 for wireless communication of the first control device 12 is equipped with both Bluetooth and WLAN. These interfaces also represent an opportunity for a hacker to import malware into the first control device 12. The potential malware could, for example, cause a targeted disruption of the CAN bit stream of CAN messages and thus, for example, manipulate signal requests, i.e. CAN messages from the second control device 14 to the third control device 22, in such a way that the requests do not reach the third control device 22. The software and logic requirements for controlling a specific function lie in the second control unit 14. When the transmitter transmits a message on the CAN bus, the voltage levels are changed accordingly. This is done by controlling a MOSFET, not shown here, which can set the voltage level to “dominant” or “recessive”, for example.

If a cyber attack occurs via the wireless communication interface 18, there are basically two scenarios through which malware could manipulate the CAN bus system 20. On the one hand, it is conceivable that malware manipulates any transmission messages from the second control device 14 via the first control device 12. This causes the second control unit to send out 14 error frames, which destroys the messages according to the CAN specification. An internal counter reading is increased, with the second control device 14 being transferred to an error-passive mode when a first limit value is reached. After that, the second control device 14 no longer sends error frames. This means that the malware of the first control device 12 can send CAN messages to the third control device 22. The error is not recognized by the third control device 22 and the third control device 22 is not put into emergency mode. As a result, the malware can manipulate the CAN bus system 20.

In the present exemplary embodiment it is now provided that the second control device 14 transmits CAN messages with a predetermined priority in the CAN bus system, so that it is avoided that the first control device 12 and/or the third control device 22 sends CAN messages in the CAN bus system. Bus system 20 can transmit when the second control device 14 is in error-passive mode or when it is recognized that a CAN message is being transmitted to the third control device 22 that does not come from the second control device 14. In this way it can be avoided that another control device can send data to the bus. Manipulation of the bus system can thus be prevented.

2 shows an exemplary embodiment of the aforementioned method in which a cyber attack was detected. In addition to a corresponding error entry in an error memory (not shown here), the driver of the vehicle 10 is informed via a display area 24 of a display device 26 that a cyber attack may have occurred. The driver of the vehicle 10 then has the opportunity to drive the vehicle 10 to the side of the road and park it. The likelihood that a cyber attack will continue to be carried out when the ignition is switched off is comparatively unlikely, as the wireless connection can no longer exist.

3 shows a schematic block representation of individual method steps of an exemplary embodiment of a method according to the invention. In step 100 it is assumed that malware manipulates any transmission messages from the second control device 14. The second control unit 14 first sends error frames to destroy the message according to the CAN specifications. An internal counter of a CAN controller in the second control device 14 is incremented by +8. When the counter reads 128, the second control device 14 goes into an error-passive mode, in which case no more error frames are sent out. At a counter reading of 256, the second control device 14 goes into a bus-off state, in which case no more messages are sent from the second control device 14.

As soon as the second control device is in error-passive mode, the malware of the first control device 12 can send CAN messages to the third control device 22. The third control device 22 does not recognize any errors and, in the worst case, accepts the manipulated messages.

Alternatively, in step 102 it is conceivable that the malware in the first control device 12 sends messages to the third control device 22 with a cycle time of 1 ms, parallel to the messages from the second control device 14 to the first control device 12 (cycle time 10 ms). The third control device 22 does not recognize which control device the “correct” messages come from. Achieving safe emergency operation of the third control device 22 cannot be guaranteed.

A corresponding solution is offered against these two attack scenarios, which requires as little or no additional hardware effort as possible in order to bring at least certain functions in the third control device 22 into safe emergency operation and additionally indicate the malfunction or manipulation to the driver of the vehicle 10. The emergency operation is a safe system state, which allows the system or the vehicle 10 to continue to operate and/or to shut it down safely.

For this purpose, it is provided in step 106 that the second control device 14 transmits CAN messages with a predetermined priority in the CAN bus system 20, so that it is avoided that the first control device 12 and / or the third control device 22 CAN messages in the CAN -Bus system 20 can transmit when the second control device 14 is in error-passive mode, or when it is recognized that a CAN message is transmitted to the third control device 22 that does not come from the second control device 14.

In step 108 it is provided that an entry is made in an error memory when the second control device 14 transmits CAN messages with a predetermined priority in the CAN bus system. In this way, possible cyber attacks can be tracked. In addition to the error, the date and time can also be saved.

In step 110, information about a possible cyber attack is displayed in a display area 24 of a display device 26. In this way, the driver of the vehicle is warned and can decide whether it is safe to continue driving.

In a final step 112 it is provided that the second control device 14 transmits CAN messages with a predetermined priority in the CAN bus system until the vehicle 10 is switched off. When the vehicle 10 is switched off, for example when the ignition is switched off, the vehicle 10 cannot establish a wireless connection using the first control unit 12. It is therefore likely that a hacker attack is no longer possible when the vehicle 10 is switched off. It can therefore be assumed that the CAN bus system 20 will function without any problems when the ignition is restarted. The second control device 14 then initially does not transmit any prioritized messages in order to prevent other devices of the CAN bus system 20 from transmitting messages. It is initially assumed that there is no longer a cyber attack. If this is the case, the corresponding scenarios of steps 100 or 102 are recognized and the second control device 14 again transmits prioritized messages in the CAN bus system 20.

Reference symbol list

10

vehicle

12

first control unit

14

second control unit

16

wired communication route

18

Wireless communication interface

20

CAN bus system

22

third control unit

24

Display area

26

Display device

Claims (10)

Method for transferring a control device in a vehicle (10), in particular a motor vehicle, to a safe system state, wherein a data exchange takes place between a first control device (12) and a second control device (14) via a wired communication link (16), the first control device (12) additionally an interface (18) for wireless communication cation, wherein the wired communication route is implemented by means of a CAN bus system (20), with CAN messages being transmitted to a third control device (22) by the second control device (14), the third control device (22) acting as an actuator, whereby at least the second control device (14) according to the CAN standard contains an internal counter reading which is increased when faulty CAN messages are detected, wherein at least the second control device (14) is transferred from a first operating mode to a second operating mode when an internal counter reading reaches a first limit value, characterized in that the second control device (14) transmits CAN messages with a predetermined priority in the CAN bus system, so that it is avoided that the first control device (12) and / or the third Control unit (22) can transmit CAN messages in the CAN bus system (20) when the second control unit (14) is in the second operating mode or when it is recognized that a CAN message is being transmitted to the third control unit (22). does not come from the second control unit (14). Procedure according to Claim 1 , characterized in that an error memory is provided and that an entry is made in the error memory when CAN messages with the predetermined priority in the CAN bus system are transmitted by the second control unit (14). Procedure according to Claim 1 or 2 , characterized in that information about a possible cyber attack is displayed in a display area (24) of a display device (26). Procedure according to one of the Claims 1 until 3 , characterized in that the driver of the vehicle (10) is asked to turn off the vehicle (10) when CAN messages with the predetermined priority in the CAN bus system are transmitted by the second control unit (14). Procedure according to one of the Claims 1 until 4 , characterized in that the internal counter reading is reset when CAN messages with a predetermined priority are transmitted in the CAN bus system by the second control unit (14). Procedure according to one of the Claims 1 until 5 , characterized in that the second control unit (14) transmits CAN messages with a predetermined priority in the CAN bus system until the vehicle (10) is switched off. Procedure according to one of the Claims 1 until 6 , characterized in that the CAN messages are transmitted with a predetermined priority by controlling a MOSFET. Procedure according to one of the Claims 1 until 7 , characterized in that the CAN messages have a message counter and a CRC checksum. Procedure according to one of the Claims 1 until 8th , characterized in that the second control device (14) is transferred to the second operating mode when the internal counter reading is 128. Vehicle (10) with at least a first control device (12), with a second control device (14) and a third control device (22), the control devices (12, 14, 22) being connected to one another by means of a CAN bus system (20), characterized in that the control devices (12, 14, 22) are set up and designed to carry out a method according to one of the Claims 1 until 9 to carry out.

Images