FR2881905A1 - File downloading system for logic controller of motor vehicle, has secured remote server connected by data transmission network to local downloading tool to be connected to logic controller of vehicle, by multiplex transmission network - Google Patents

Abstract

The system has a secured remote server (10) in which a file (11) to be downloaded is stored. The server is connected by a data transmission network (12) e.g. Internet type network, to a local downloading tool (13) that is to be connected to a logic controller (14) embarked inside a motor vehicle, by a multiplex transmission network (15). The tool has communication units for exchanging data with the controller and the server. An independent claim is also included for a method for downloading a file in a controller/computer embarked inside a motor vehicle.

Description

2881905 1

  The present invention relates to a system for downloading a file into an on-board computer on board a motor vehicle and a downloading method for implementing this system.

  Such methods and download systems are already known in the state of the art.

  For example, reference may be made to document FR-A-2 719 924 in the name of the applicant.

  This document effectively describes a method of unlocking the access of a tool for downloading a file to a control computer for the operation of at least one functional unit of a motor vehicle, in which the file to be downloaded comprises, in particular identification information of the calculator in which it must be downloaded and an access key to it. The computer comprises a microprocessor unit associated with data storage means in which computer identification information and an access key to it are stored. This method then comprises different steps of transmission of information between the downloading tool and the computer, calculating first and second unlocking codes of access to the computer and comparing these codes, to allow access to the download tool to the calculator in case of correspondence between these codes.

  However, such a download function which is used, for example, today in the after-sales networks of certain motor vehicle manufacturers, may be directly concerned by a potential conflict resulting from the contradictory requirements that will emerge between the new European regulation on the competition concerning the car maintenance and the obligation made to the manufacturers to guarantee the integrity of the software embedded on board the vehicles, like for example those related to the anti-theft devices, the systems of security and depollution, etc ...

  It is known, for example, that Directive EC 1400/2002, which came into force in October 2002 with the aim of fostering competition in the field of automobile maintenance, sets a number of requirements for car manufacturers, which oblige them to in particular to allow all independent repairers interested to have full access to all technical information, diagnostic and other systems necessary for the repair and maintenance of motor vehicles.

  To fully understand the problematic, it is necessary to specify succinctly the various steps required during an operation of downloading a file in a computer.

  At first, the download tool points to the file to download after identifying the calculator. The tool then asks the calculator to generate a random number.

  Depending on this number, the key available in the download file and the protection algorithms coded in the tool, the tool calculates a result that it sends to the control computer.

  In parallel, the computer calculates the expected result as a function of the random number it has transmitted to the tool, internal protection algorithms and the key entered in the manufacture of the product, in part of its memory not readable since external tool. Then the calculator compares the result calculated internally to that received from the tool and authorizes the download of the code only in the case of a tie.

  The calculator memory is then erased and the software code is downloaded.

  Finally, a step of checking and marking this operation is performed in the computer.

  But if we analyze this way of proceeding, we see that all the constituents of the function, that is to say the file to be downloaded, the keys and the algorithms of protection of the code, as well as the procedures , are available in the download tool.

  It is easy to imagine that access to this type of information can lead to a proliferation of file manipulation, in particular to modify the performance of the engine by changing the calibration of the software.

  Such maneuvers can then have consequences on the longevity of the engine, but also have other repercussions concerning for example the conformity of the vehicles.

  The object of the invention is therefore to solve these problems.

  For this purpose, the subject of the invention is a system for downloading a file into an on-board computer on board a motor vehicle, characterized in that it comprises a secure remote server, in which the file is stored. download, connected by an information transmission network to a local download tool, adapted to be connected to the vehicle computer and provided with means for exchanging information with the computer and the remote server.

  According to other characteristics: the information transmission network is an Internet type network; the local downloading tool is adapted to be connected to the computer via a multiplexed information transmission network on board the vehicle; the download tool is adapted to be connected to the computer through a serial line K of the vehicle.

  According to another aspect, the invention also relates to a method of downloading a file in an on-board computer on board a motor vehicle, for implementing the system according to any one of the preceding claims, characterized in that it comprises the following steps: a) initialization of the communication between the tool and the calculator and transmission by the tool of a request for identification of the calculator; b) transmission by the computer to the tool of its identification; c) initialization of the communication between the tool and the server and transmission by the tool to the server, the identification of the calculator 25 and the signature of the tool; d) request sent by the server to the tool to cause the calculator to generate a random number; e) request by the tool to the calculator generating this random number; f) generation and transmission by the computer to the random number tool; g) transmission by the tool to the server of the random number generated by the computer; 2881905 4 h) generation and transmission by the server to the tool of a corresponding first unlock code; i) transmission by the tool to the calculator of this first code; j) comparison by the computer of this first code with a second code generated by it to validate or invalidate the download of the file, in case of concordance or discrepancy between the codes; k) transmission of information validating or invalidating the download of the calculator to the tool! local; I) transmission of this corresponding information from the local tool to the server; m) if the download is validated, transmission by the server of the file to be downloaded to the tool and tracing of this downloading operation; n) sending an acknowledgment of the file by the tool to the server; o) transmission by the tool of a request for erasure of the computer memory and transmission of the file to download; p) acknowledgment by the computer of the erasure request and each request for data received to the tool after checking the integrity of the data; q) transmission by the tool to the calculator of a self-check request for the received data; r) implementation of the self-check by the computer and transmission by it to the tool of the corresponding response; and s) transmission by the marking data tool of this downloading operation and acknowledgment by the computer of the reception thereof.

  The invention will be better understood on reading the description which follows, given solely by way of example and with reference to the appended drawings, in which: FIG. 1 represents a block diagram illustrating the structure and operation a download system of the state of the art; FIG. 2 illustrates the structure and operation of a download system according to the invention; and FIG. 3 illustrates a timing diagram showing the various steps of a downloading method according to the invention.

  FIG. 1 shows a prior art downloading system, using a download tool designated by the general reference 1, for loading data into a computer designated by the general reference 2, embedded in example in a motor vehicle.

  The downloading tool is then connected to the computer through a multiplexed information transmission network on board the CAN-type vehicle for example or a serial line K of this vehicle, designated by the general reference 3.

  The download tool then stores the download file designated by the general reference 4, which contains the identification information of the calculator and a key, as well as the code to download.

  Download means 5 of this tool are associated with code protection algorithms designated by the general reference 6, to enable the file to be transmitted to corresponding means 7 of the computer, also associated with code 8 protection algorithms and a predetermined key 9, to recover the downloaded code.

  Additional information on the procedure implemented to ensure the download of a file through such a system, can be found in the document FR-A-2 719 924, mentioned above.

  To solve the problems described above, a downloading system is used as illustrated in FIG. 2. This downloading system then comprises a secure remote server designated by the general reference 10, in which is stored the file to be downloaded designated by FIG. general reference 11 and which is connected by an information transmission network designated by the general reference 12, for example of the Internet type, to a local download tool, designated by the general reference 13, adapted to be connected to the vehicle calculator designated by the general reference 14 and provided with means for exchanging information with the computer and the remote server.

  It will be noted that the local downloading tool 13 is adapted to be connected to the computer 14 through, for example, an onboard multiplexed information transmission network on board the vehicle, for example of the CAN or other type, or a serial line K designated by the general reference 15 in this figure.

  In fact, this system makes it possible to split the downloading means into two parts, namely a first part in the secure server 10 containing the sensitive elements such as for example the key and a second part in the local download tool 13 containing the non-sensitive organs necessary for communication with the computer 14 to download, and which can then be freely accessible.

  The downloading method implemented in such a system is illustrated in FIG. 3, in which the transitions are described in the following table.

  TRANSITION ACTION REALIZED COMMENTS

  Transition 1 The local tool initializes the communication with the computer and asks it to identify itself Transition 2 The calculator transmits to the tool The calculator has its local identification identification in its memory (it is references of type constructor) .

  The VIN vehicle number will also be transmitted for the traceability of the operation.

  Transition 3 The local tool initializes the Each tool has a communication with the own signature server in order to and transmits the identification allow the traceability of received from the calculator as well as the operation its own signature Transition 4 The server asks the local tool to generate a random number to the calculator 2881905 7 Transition 5 The local tool asks the calculator to generate a random number Transition 6 The calculator returns to the local tool the random number generated Transition 7 The local tool transmits to the server the random number received from the Transition 8 computer The server transmits to the tool According to the local random number the result of a received calculation, code access protection algorithms and the CLEF present in the file to download, the server calculates the result expected by the Transition 9 calculator The local tool transmits the result received to the Transition 10 calculator The calculator transmits towards the calculator has carried out in the local tool the answer to the parallel, the same computation (but request of download according to its algorithms, the random number generated and CLEF which it has in memory).

  It compares the result calculated internally with the result received and transmits: - an authorization to download the application code if the two results are identical.

  2881905 8 - A refusal to download if the two results are different.

  Transition 11 The local tool transmits to the server the response of the Transition 12 calculator The server transfers the file to the state of the download in the local and technical tool, the transmitted file traces this operation. does not contain the KEY to calculate the expected result by the calculator after generating the random number.

  Transition 13 The local tool sends an acknowledgment The traceability mechanism is received by the server. detailed later.

  Transition 14 The local tool emits requests These transitions (14 and 15) are erasing the memory and repeat until the transfer of the entire software code file has been to the transmitted computer.

  Transition The calculator acknowledges the requests to the local tool after checking the integrity of the data.

  Transition 16 The local tool transmits to the calculator checks the calculator the memory request in which it has to autocontrol the received code stored data received Transition 17 The calculator transmits to - If the verification is the local tool the response to the correct, the self-check calculator gives its agreement to execute the rest of the procedure - If the check is not correct, it interrupts the procedure (the code received remains inactive).

  Transition 18 The local tool transmits These data will constitute the new identification marking data of the operation software contents of the calculator (for a possible other download) Transition 19 The calculator acknowledges the frame The calculator declares that the received data code received is valid and performs a Reset to take it into account.

  It is thus conceivable that, thanks to such a method, the key necessary for unlocking the component giving access to the code never circulates on the various supports, namely the Internet network, the embedded multiplexed network or the serial link K, which guarantees that it can not be intercepted. The same is true for code protection algorithms.

  Thus, a temporary file created on the local tool does not contain the key, which would allow for example this software to be downloaded to a computer after code corruption, as would be the case by a person who would have intercepted the file and who would like to reinject it after modification, for example of parameters.

  Moreover, this method and this system make it possible to improve the traceability of the operations.

  Indeed, they allow to always be able to provide the correct file to 15 download a customer request.

  The mechanism is then as follows: according to the identification of the software stored in the computer, as determined by the identification information, the server is still able to know if it has in its database, d a newer software strictly compatible. He is then perfectly able to select and distribute this file.

  By analyzing this method and this system, it is also clear that there is no longer any exchange between the server and the local tool from the transitions 12 and 13 of FIG.

  Thus, if the download process is interrupted during subsequent transitions, the server no longer has the means to notice.

  Legally, this server will then consider that the software on board the vehicle is at the version n + 1, while the process has been interrupted and that there is no longer valid application software in the memory of the calculator at this moment.

  In such a case, the calculator is no longer functional and the only function it is able to achieve is to download again.

  Indeed, as long as the computer has not received the marking data of the operation related to the transition 18, with the previous transitions successfully crossed, it does not consider the data as valid and can not therefore use these data. marking as the next identification of software version n + 1.

  Thus, in case of subsequent connection, the identification of the computer shows a software version in the n state, which is the last known valid state and stored in memory, thereby allowing the download of the n + 1 version.

  This then ensures that we are still able to deliver the right software expected by the calculator of a vehicle.

  Another aspect of the traceability of such a method and system is to allow vehicle manufacturers to trace what is assembled on the vehicles they produce. This is not always the case today. Indeed, because the updating of software is now performed locally, there: 30 no real traceability archived by the manufacturers.

  With the method according to the invention, a manufacturer is able to trace by vehicle, from the identification number identifying a single vehicle, a history of update in a database and thus derive a return of usable experience without manual reprocessing.

  The manufacturer may then provide on request the software composition of a vehicle in circulation as may for example be required in the context of the application of the legislation of certain countries.

  In addition, it is also not necessary to modify the download procedure already coded in the vehicle calculators, this having the main advantage of making it possible to operate with all the vehicles already on the market and not to impose additional development costs. related to the destandardization of the known procedure of the suppliers of calculators.

  However, this also makes it possible to work with all the vehicles already on the market.

  Indeed, in the case where a new application would be put into service for the bodies in development, it could benefit the old vehicles sold, only to the extent that one decides to modernize them. The cost associated with such an operation could indeed be dissuasive given the fact that the procedure for downloading a computer is not contained in the application software (the one that is precisely updated by the operation of download and which serves for example, to operate the engine), but in the BOOT of the calculator which is not modifiable by tools of manufacturers.

  Of course, other embodiments of the invention may be envisaged.

2881905 12

Claims (5)

  1. System for downloading a file (11) into a computer (14) on board a motor vehicle, characterized in that it comprises a secure remote server (10), in which is stored the file to download (11), connected by an information transmission network (12) to a local downloading tool (13), adapted to be connected to the computer (14) of the vehicle and provided with information exchange means with the computer and the remote server.   2. System according to claim 1, characterized in that the information transmission network (12) is an Internet type network.   3. System according to claim 1 or 2, characterized in that the local downloading tool (13) is adapted to be connected to the computer (14) through a multiplexed information transmission network (15) on board the vehicle.   System according to claim 1 or 2, characterized in that the local downloading tool (13) is adapted to be connected to the computer (14) through a serial line K (15) of the vehicle.   5. A method of downloading a file in an onboard computer on board a motor vehicle, for the implementation of the system according to any one of the preceding claims, characterized in that it comprises the following steps (Fig. 3): a) initialization of the communication between the tool (13) and the computer (14) and transmission by the tool (13) of an identification request of the computer (14); b) transmission by the computer (14) to the tool (13) of its identification; c) initialization of the communication between the tool (13) and the server (10) and transmission by the tool (13) to the server (10), the identification of the computer (14) and the signature of the tool (13); d) a request sent by the server (10) to the tool (13) to generate a random number to the computer (14); e) request by the tool (13) to the calculator (14) for generating this random number; F) generation and transmission by the computer (14) to the tool (13) of the random number; g) transmission by the tool (13) to the server (10) of the random number generated by the computer (14); h) generation and transmission by the server (10) to the tool (13) of a corresponding first unlocking code; i) transmission by the tool (13) to the computer (14) of this first code; j) comparison by the computer (14) of this first code with a second code generated by it for validating or invalidating the download of the file (11), in case of concordance or discrepancy between the codes; k) transmitting validation or invalidation information for downloading the calculator (14) to the local tool (13); I) transmitting this corresponding information from the local tool (13) to the server (10); m) if the download is validated, transmission by the server (10) of the file to download (11) on the tool (13) and tracing this download operation; n) sending an acknowledgment of the file (11) by the tool (13) to the server (10); o) transmission by the tool (13) of a request for erasure of the computer memory (14) and transmission of the file (11) to download; p) acknowledgment by the computer (14) of the erasure request and each request for data received to the tool (13) after checking the integrity of the data; q) transmission by the tool (13) to the computer (14) of a self-check request for the received data; r) implementation of the self-check by the computer (14) and transmission by it to the tool (13) of the corresponding response; and s) transmission by the tool (13) of marking data of this downloading operation and acknowledgment by the computer (14) of the reception thereof.