FR3111447A1 - Management of embedded software versions from a computer footprint - Google Patents

Abstract

The invention relates to the management of versions of software executed by on-board components (ECU1, ECU2) in a motorized land vehicle (VEH) from the generation of a computer fingerprint (FGPRNT). FIG. 1

Description

Management of embedded software versions from a computer footprint

The present invention belongs to the field of on-board electronics in a land motor vehicle. In particular, it concerns the management of software versions executed by on-board electronics.

“Motor land vehicle” means any type of vehicle such as a motor vehicle, a moped, a motorcycle, a storage robot in a warehouse, etc.

A modern motor land vehicle incorporates many electronic components. These components are responsible, for example, for activating the motor of an electric window, executing artificial intelligence algorithms in charge of autonomous driving or even exchanging data with a remote server.

Each of these electronic components executes at least one software. The forms that such software can take are extremely varied, ranging from a high application level (man-machine interface of infotainment systems) to a very low level (digital and analog electronic circuits for the execution of basic commands).

As such, in the present application, “software” means any set of instruction sequences that can be interpreted by any electronic component. Thus, the hardware configuration of an analog component (configuration of a transfer function for example) or digital (FPGA type for example), the version of an operating system or even a type of boot loader (bootloader in English) are examples of software. Other examples will be given in the detailed description below.

It is necessary to be able to control the versions of these software. Indeed, an inconsistent version change can reflect a computer attack on an electronic component.

In addition, the organization of remote updating campaigns for electronic components implies detailed and up-to-date knowledge of the versions executed by the electronic components likely to be updated. Thus, the execution of an update for a component already executing a correct version of software is costly in terms of bandwidth and computing resources for the remote server in charge of the update and for the electronic components. concerned. In addition, the execution of these updates can be very restrictive in cases where it is a FOTA update, Firmware Over-The-Air (firmware updated remotely in French), because the component may not support an update while being in operation (a complete restart, very restrictive, may be required).

Several factors complicate the management of software versions, and especially the multiplication of software and possible versions for this software.

Indeed, the multiplication of components that can be updated remotely (over-the-air in English) has the consequence of multiplying the number of versions available for these components. These components that can be updated remotely also have more vulnerabilities (remote computer attacks) and must therefore run software that is resistant to the latest known computer attacks. They must therefore be updated very frequently.

Moreover, the computing resources of the components being more and more important, the software which they execute is more and more complex. Thus, software architectures initially comprising a few versions of some software (first version of Autosar for example) now involve hundreds of versions for thousands of software (modern architectures based on Linux/Unix).

Currently, the management of the versions of this software is done by an inventory at a fixed period, component by component, see software by software. The cumbersomeness of such an inventory process implies a relatively long period between each inventory (typically one month). The versions of all the software are therefore not known in real time.

This exposes the components to computer attacks and is costly in unnecessary updates.

The present invention improves the situation.

To this end, a first aspect of the invention relates to a method for managing versions of a first software configured to be executed by a first electronic component and of a second software configured to be executed by a second electronic component, the first and the second electronic component being included in a motorized land vehicle and connected by an internal data communication network to the vehicle, the first and the second software being configured to be able to be updated from at least a first off-board server, the method comprising the steps, implemented by a processing unit and upon detection of an activation of an electrical system of the vehicle, of:

• receipt of first information relating to a version of the first software;
• receipt of a second piece of information relating to a version of the second software;
• generation of a computer fingerprint from the first and second information;
• transmission of the fingerprint to a second dismounted computer server.

Thus, in the present invention, each time an electrical system of the vehicle is activated (typically when starting the vehicle as seen below), a computer fingerprint of the two software programs is sent to the second server.

The fingerprint is therefore generated, for a plurality of software and a plurality of electronic components, by a single processing unit for centralized sending to the second server.

It is not necessary to plan inventory campaigns, component by component, but in the transmission of a single computer footprint. From then on, it is possible to carry out this transmission each time the electrical system is activated and therefore to have a real-time view of the versions executed by the different vehicles under the supervision of the second server.

By “computer fingerprint” is meant any data (character string, image, etc.) formalizing the first and second information. Detailed explanations are given below in the detailed description.

In one embodiment, the first off-loaded server and the second off-loaded server are identical. In another embodiment, these two servers are distinct.

In one embodiment, the computer fingerprint is generated from:

• first and second information;
• a hardware configuration of the first and second component;
• a configuration of a bootloader of the first and the second component;
• of a version of an operating system of the first and the second component.

Such a combination corresponds to the best complexity/performance compromise for managing the versions of software executed by the components.

In one embodiment, the activation of an electrical system of the vehicle corresponds to a start of the vehicle.

In one embodiment, the activation of an electrical system of the vehicle corresponds to at least one element among:

• unlocking of at least one opening of the vehicle;

• an ignition of at least one powertrain of the vehicle;

• detection of the presence of an electronic terminal authenticated by a vehicle authentication system.

Thus, the transmission is made during a first provision of electrical energy in the vehicle, thus maximizing the possibilities of transmission of the imprint.

In one embodiment, the processing unit is a software block or a hardware electronic circuit.

In one embodiment, the processing unit is included on the first electronic component, the second electronic component or on a third electronic component included in the motorized land vehicle. In particular, in one embodiment, the processing unit is included on the third electronic component and in which the third electronic component is a telematic communication unit. Thus, the calculation and transmission capacities of the telematic communication unit are advantageously put to use.

In one embodiment, the method further comprising a step of hashing the computer fingerprint before transmission to the second server. Thus, the transmission of the fingerprint is advantageously secure and has little impact on the processing at the level of the second server insofar as the comparison step (detailed below) can be made from a fingerprint database. chopped.

A second aspect of the invention relates to a method for verifying a computer fingerprint, the computer fingerprint corresponding to a version of a first software configured to be executed by a first electronic component and to a version of a second software configured to be executed by a second electronic component, the first and the second electronic component being included in a land motor vehicle and connected by an internal data communication network to the vehicle, the first and the second software being configured to be able to be updated from at least a first off-board server, the method being implemented by a second computer server and comprising the steps of:

• receipt of the computer fingerprint;
• comparison of the computer fingerprint with a database comprising a plurality of computer fingerprints each corresponding to a combination of possible versions for the first and the second software;
• identifying a combination of an identified version of the first software and an identified version of the second software from the comparison.

A third aspect of the invention relates to a computer program comprising instructions for implementing the method according to the first or second aspect of the invention, when these instructions are executed by a processor.

A fourth aspect of the invention relates to a device for managing versions of a first software configured to be executed by a first electronic component and of a second software configured to be executed by a second electronic component, the first and the second component electronics being included in a motorized land vehicle and linked by an internal data communication network to the vehicle, the first and the second software being configured to be able to be updated from at least a first on-board server, the device comprising at least one processor and at least one memory configured to perform, upon detection of an activation of an electrical system of the vehicle, the operations of:

• receipt of first information relating to a version of the first software;
• receipt of a second piece of information relating to a version of the second software;
• generation of a computer fingerprint from the first and second information;
• transmission of the fingerprint to a second dismounted computer server.

A fifth aspect of the invention relates to a device for verifying a computer fingerprint, the computer fingerprint corresponding to a version of a first software configured to be executed by a first electronic component and to a version of a second software configured to be executed by a second electronic component, the first and the second electronic component being included in a land motor vehicle and connected by an internal data communication network to the vehicle, the first and the second software being configured to be able to be updated from at least one first off-board server, the device comprising at least one processor and at least one memory for performing the operations of:

• receipt of the computer fingerprint;
• comparison of the computer fingerprint with a database comprising a plurality of computer fingerprints each corresponding to a combination of possible versions for the first and the second software;
• identifying a combination of an identified version of the first software and an identified version of the second software from the comparison.

A sixth aspect of the invention relates to a vehicle comprising the device according to the fourth aspect of the invention.

Other characteristics and advantages of the invention will appear on examination of the detailed description below, and of the appended drawings in which:

is a diagram illustrating the background of the invention according to one embodiment of the invention;

is a diagram illustrating the steps of a method according to one embodiment of the invention;

illustrates the structure of a device according to one embodiment of the invention.

The invention is described below in its non-limiting application to the case of a motor vehicle comprising seven electronic components, two of which are configured to be able to be updated from a first off-board server. Other applications are naturally possible for the present invention. For example, the method according to the invention can be implemented for a motorcycle comprising twelve electronic components, all configured to be able to be updated from a first off-board server or even by an electric scooter comprising two electronic components, each configured to be able to be updated from a first off-loaded server.

Figure 1 illustrates an application context of the invention, according to one embodiment.

A motorized land vehicle (VEH) comprises seven electronic components ECU1, ECU2, ECU3, ECU4, ECU5, ECU6 and ECU7.

Of these seven electronic components, the components ECU1 and ECU2 are configured to be able to be updated from at least a first off-board server (not shown).

A computer fingerprint FGPRNT is generated by a processing unit to be transmitted to a second off-loaded CLD server. The processing unit here is the ECU3 component.

In one embodiment, the first and the second off-loaded server correspond to the same off-loaded server. In this embodiment, however, different software components may be responsible for remote updates (first server) and processing of the FGPRNT fingerprint (second server).

In another embodiment, the first and the second off-loaded server are distinct.

In one embodiment, the operations performed by the first and second off-board servers are implemented in cloud computing. Thus, for example depending on the resources available in different servers, different operations can be implemented in different cloud servers.

The electronic components are linked by a data communication network internal to the vehicle. An example of such a network is the CAN (Controller Area Network) data bus, standardized by the ISO 11898 standard. Another example is an Ethernet network dedicated to in-vehicle communications. .

The term "configured to be updated from at least a first server" means that at least one piece of software executed by the component can be updated by downloading (downloading in English) and/or uploading (uploading in English) from and/or to the first server. As mentioned above, in this application, software means any type of configuration (hardware or application) and any type of component element. For example, updating consists of downloading then applying a new version of a software source code, applying a different configuration of a transistor whose parameters can be changed, modifying the setting of a programmable electronic circuit ( FPGA for example), etc.

In the embodiment here illustrated in FIG. 1, the first electronic component ECU1 comprises four types of software executed by ECU1; Hardware, Bootloader, BasicSoftware, and Dataset, running builds 123456778 (for Hardware), 12344321 (for Bootloader), 12349876 (for BasicSoftware), and 12341749 (for Dataset), respectively. Other software can be executed by ECU1, such as actuator control software, etc. These versions are expressed here in an Osek/Autosar repository. In another embodiment, the versions are expressed with respect to a single reference, common to all the ECUs of the vehicle.

The second electronic component ECU2 runs nine kinds of software; Hardware, Bootloader, Hypervisor, OS1, OS2, Software1, Software2, Software3 and Software4, respectively running versions 22345678 (for Hardware), 22344321 (for Bootloader), 22349876 (for Hypervisor), 22348997 (for OS1), 22348997 (for OS2 ), 22341749 (for Software1), 22341750 (for Software2), 22341751 (for Software3), and 12341752 (for Software4). Other software can be executed by ECU1, such as actuator control software, etc. These versions are here expressed in a Linux/Unix repository. In another embodiment, the versions are expressed with respect to a single reference, common to all the ECUs of the vehicle.

Figure 2 is a diagram illustrating the steps of a method according to one embodiment of the invention.

In particular, the ECU3 column represents the steps performed at the processing unit, corresponding to ECU3 in the present embodiment. The CLD column corresponds to the steps performed at the level of the second CLD remote computer server.

At steps 20 and 22, at least a first piece of information INF1 relating to at least one version of at least one software executed by ECU1 is received. Here, ECU1, as seen in figure 1, ECU1 executes 4 softwares and 4 information corresponding to the versions (123456778 for Hardware, 12344321 for Bootloader, etc.) executed by these 4 softwares are therefore received.

At steps 24 and 26, at least one second information INF2 relating to at least one version of at least one software executed by ECU2 is received. Here, ECU2, as seen in figure 1, ECU1 executes ç software and ç information corresponding to the versions (22345678 for Hardware, 22344321 for Bootloader, etc.) executed by these 9 software are therefore received.

The first and second information is transmitted by the CAN network of the vehicle VEH. These transmissions can be integrated into existing processes of life cycle, supervision or version control of the electronic components of the vehicle.

At a step 28, upon detection of an activation of an electrical system of the vehicle, a computer fingerprint FGPRNT is generated from the first and second information.

The activation of a vehicle's electrical system corresponds to at least one element among:

• unlocking of at least one opening of the vehicle;
• ignition of at least one powertrain (thermal and/or electric engine) of the vehicle;
• detection of the presence of an electronic terminal authenticated by a vehicle authentication system. Typically, this corresponds to the case where a terminal (smartphone, hands-free key, etc.) of the owner/user of the vehicle is authenticated, i.e. the vehicle has identified that a person authorized to use the vehicle is present (unlocking a shared vehicle, unlocking a vehicle using a hands-free key, etc.).

In one embodiment, in addition to the implementation of the method described here upon detection of an activation of the electrical system of the vehicle, the method is implemented at a predetermined minimum period. For example, the predetermined minimum period is 1 day, 1 week, 2 weeks, 1 month, 2 months, 6 months or even 1 year.

In detail, ECU3 can start by generating an inventory map of software versions and then generate the fingerprint from this map. The inventory map is a file containing all software and all versions.

By “computer fingerprint” is meant any data (character string, image, etc.) formalizing the first and second information. Other names for “fingerprint” within the meaning of the present invention are device fingerprint or computer fingerprint or browser fingerprint.

This involves generating unique data, according to a particular format (for example a string of bits), corresponding to a particular combination of parameters (here the versions of the different software). In one embodiment, FGPRNT is hashed before transmission, according to methods known to those skilled in the art (SHA-1 or MD5 functions).

In a particular embodiment, the computer fingerprint is generated from:

• first and second information (for example 12341749 (for Dataset of ECU1) and 22341749 (for Software1 of ECU2));
• a hardware configuration of the first and second component (for example 12345678 (for Hardware of ECU1) and 22345678 (for Hardware of ECU2));
• a configuration of a first and second component bootloader (for example 12344321 (for Boatloader of ECU1) and 22344321 (for Boatloader of ECU2));
• of a version of an operating system of the first and second component (for example 12349876 (for BasicSoftware of ECU1) and 22348997 (for OS1of ECU2)).

At a step 30, the fingerprint FGPRNT is transmitted to the second off-board computer server CLD. In particular, FGPRNT is transmitted, via the vehicle's internal network, to a telematic communication unit (TCU, for Telematic Control Unit, telematic control unit in French) in charge of external transmissions to the vehicle, and which will transmit FGPRNT to the second computer server. In one embodiment, ECU3 is directly the telematics communication unit.

At a step 32, FGPRNT is received by the second computer server CLD.

At a step 34, a comparison of the computer fingerprint FGPRNT with a database 36 comprising a plurality of computer fingerprints each corresponding to a combination of possible versions for the first and the second software is carried out. In case FGPRNT has been hashed, the comparison is made with an already hashed fingerprint database.

If a combination of an identified version of the first software and an identified version of the second software from the comparison is identified, the versions of the software executed by the components of the vehicle HEV are validated at a step 40. This identification can identify VEH software as compliant and/or plan a version upgrade of at least one of these software.

Otherwise, an error is identified at step 38.

FIG. 3 represents an example of device D included in the vehicle VEH. This device D can be used as a centralized device in charge of at least certain steps of the method described above with reference to FIG. 1. In one embodiment, it corresponds for example to the device ECU3.

This device D can take the form of a box comprising printed circuits, of any type of computer or even of a smartphone.

The device D comprises a random access memory 1 for storing instructions for the implementation by a processor 2 of at least one step of the methods as described above. The device also comprises a mass memory 3 for storing data intended to be kept after the implementation of the method.

The device D may further comprise a digital signal processor (DSP) 4. This DSP 4 receives data to shape, demodulate and amplify, in a manner known per se, this data.

The device also comprises an input interface 5 for receiving data implemented by methods according to the invention and an output interface 6 for transmitting data implemented by the methods.

The present invention is not limited to the embodiments described above by way of examples; it extends to other variants.

Thus, an embodiment corresponding to an exemplary electronic architecture (seven electronic components, etc.) for a motor vehicle has been described. The present invention is also applicable to other electronic architectures (different number of components and/or software, etc.).

Claims (10)

Method for managing versions of a first software configured to be executed by a first electronic component (ECU1) and of a second software configured to be executed by a second electronic component (ECU2), the first and the second electronic component being in a motorized land vehicle (VEH) and linked by an internal data communication network to the vehicle, the first and the second software being configured to be able to be updated from at least a first off-board server, the method comprising the steps, implemented by a processing unit and upon detection of an activation of an electrical system of the vehicle, of:

• receiving (22) first information relating to a version of the first software;
• receiving (26) second information relating to a version of the second software;
• generation (28) of a computer fingerprint from the first and second information;
• transmission (30) of the imprint to a second off-board computer server.

A method according to claim 1, wherein the fingerprint is generated from:

• first and second information;
• a hardware configuration of the first and of the second component;
• a configuration of a bootloader of the first and the second component;
• of a version of an operating system of the first and of the second component.

Method according to one of the preceding claims, in which the activation of an electrical system of the vehicle corresponds to at least one element among:

• unlocking at least one opening of the vehicle;
• an ignition of at least one powertrain of the vehicle;
• detection of the presence of an electronic terminal authenticated by a vehicle authentication system.

Method according to one of the preceding claims, in which the processing unit is a software block or a hardware electronic circuit. Method according to one of the preceding claims, in which the processing unit is comprised on a telematic communication unit (ECU3). Method according to one of the preceding claims, the method further comprising a step of:

• hashing of the hash before transmission to the second server.

Method for verifying a computer fingerprint, the computer fingerprint corresponding to a version of a first software configured to be executed by a first electronic component (ECU1) and to a version of a second software configured to be executed by a second electronic component (ECU2), the first and the second electronic component being included in a motorized land vehicle (VEH) and linked by an internal data communication network to the vehicle, the first and the second software being configured to be able to be updated from at least a first off-board server, the method being implemented by a second computer server and comprising the steps of:

• reception (32) of the computer fingerprint;
• comparison (34) of the computer fingerprint with a database comprising a plurality of computer fingerprints each corresponding to a combination of possible versions for the first and the second software;
• identifying a combination of an identified version of the first software and an identified version of the second software from the comparison.

Computer program comprising instructions for implementing the method according to any one of the preceding claims, when these instructions are executed by a processor (2). Device (D) for managing versions of a first software configured to be executed by a first electronic component (ECU1) and of a second software configured to be executed by a second electronic component (ECU2), the first and the second electronics being included in a motorized land vehicle (VEH) and linked by an internal data communication network to the vehicle, the first and the second software being configured to be able to be updated from at least a first on-board server, the device comprising at least one processor and at least one memory configured to perform, upon detection of an activation of an electrical system of the vehicle, the operations of:

• receiving (22) first information relating to a version of the first software;
• receiving (26) second information relating to a version of the second software;
• generation (28) of a computer fingerprint from the first and second information;
• transmission (30) of the imprint to a second off-board computer server.

A vehicle (VEH) configured to include the device according to claim 9.