WO2019081395A1

WO2019081395A1 - Method and device for updating software of a motor vehicle control unit

Info

Publication number: WO2019081395A1
Application number: PCT/EP2018/078830
Authority: WO
Inventors: Daniel Krippner; Andreas Heyl; Manfred Spraul
Original assignee: Robert Bosch Gmbh
Priority date: 2017-10-23
Filing date: 2018-10-22
Publication date: 2019-05-02
Also published as: CN111480141A; DE102017218872A1

Abstract

The invention relates to a method for updating the software of at least one motor vehicle control unit (4, 6, 8) built into a motor vehicle (2), said method comprising the following steps: (A) transmitting a preliminary command, particularly a command for blocking the motor vehicle (2), from an updating device (12a, 12b) to the motor vehicle control unit (4, 6, 8); (B) transmitting a confirmation message from the motor vehicle control unit (4, 6, 8); (C) transmitting new software from the updating device (12a, 12b) to the motor vehicle control unit (4, 6, 8); (D) soliciting a characteristic value from at least one motor vehicle control unit (4, 6, 8) built into the motor vehicle (2); (E) calculating an activation code on the basis of the solicited characteristic values; (F) using the calculated activation code for the subsequent communication with the motor vehicle control unit (4, 6, 8) that has blocked the vehicle function; and (G) implementing a command for reinstating the drivability of the motor vehicle (2) by the motor vehicle control unit (4, 6, 8) only once the motor vehicle control unit (4, 6, 8) has directly or indirectly checked whether the activation code is correct.

Description

Description title

Method and device for updating software of a motor vehicle control unit

The invention relates to a method and a device for updating the software of at least one motor vehicle control unit installed in a motor vehicle.

State of the art

The updating of software of vehicle control units is in a field of tension, since the vehicle control units have to implement on the one hand safety requirements ("Safety Goals") up to ASIL-D (ISO 26262), on the other hand for updating the software of the vehicle ECUs or other external devices that contain complex programs and much existing software and therefore can not easily meet the requirements that are imposed when ASIL security objectives are affected.

Since a faulty update of the software of the vehicle control units can lead to a breach of safety goals up to ASIL D, the use of such components is not readily permitted. However, the use of such components is permitted if the absence of feedback has been demonstrated within the meaning of ISO 26262-1: 2011, §1.49.

In a simple case, end-to-end protection is used: the ASIL-compliant target controller checks itself after an update and only releases when it finds that the software update was done without error. Consequently, there is no feedback for the updating device.

In a modern motor vehicle, several vehicle control units generally interact closely: An engine control unit may, for example, have the function of limiting the maximum speed. For this purpose, the engine control unit receives information about the vehicle speed from an ESP control unit. In addition, the currently engaged gear is interrogated by a transmission control unit, so that the engine control unit can perform a plausibility check of the vehicle speed on the basis of the engaged gear and the engine speed.

However, the previously described "simple" self-plausibility update of an updated automotive control device can not reliably detect an incompatible configuration of the entire system created by the update.

Disclosure of the invention:

It is therefore an object of the invention to provide a method and a device for safely updating the software of at least one motor vehicle control unit installed in a motor vehicle. In particular, it is an object to ensure that the overall system configuration of all the vehicle control devices installed in the motor vehicle is in a mutually compatible and reliable state after the software has been updated.

According to one exemplary embodiment of the invention, a method of updating the software of at least one motor vehicle control device installed in a motor vehicle comprises at least the following steps:

(A) transmitting an instruction, in particular a command for blocking at least one function of the motor vehicle, from an updating device to the at least one motor vehicle control unit;

(B) transmitting an acknowledgment message confirming the execution of the preparatory command from the vehicle control unit to the updating device;

(C) transferring new software from the updating device to the at least vehicle controller and installing the new software on the at least one vehicle controller;

(D) querying a software dependent characteristic value, in particular the software version number of one or more vehicle control units, which are installed in the motor vehicle; (E) calculating an activation code from the requested characteristic values;

(F) communicating the update device with at least the vehicle control unit that has blocked at least one function of the motor vehicle using this activation code, wherein the communication is configured such that the vehicle control device securely detects if the updating device does not have the correct activation code features;

(G) executing an instruction to reactivate the at least one stalled function of the motor vehicle by the vehicle control unit only after the motor vehicle

Control unit directly or indirectly tested and confirmed that the correct activation code is present.

An updating device for updating the software of a motor vehicle control device mounted in a motor vehicle, according to an embodiment of the invention, a storage device, which is adapted to store the software to be updated, a transmitting device, which is used to transmit a preparatory command, in particular a command to block the Motor vehicle, is formed on the vehicle control unit; and a receiving device configured to receive a confirmation message confirming execution of a received preparatory command by the vehicle controller.

The transmitting device is designed to transmit the software to be updated to the vehicle control unit. The receiving device is designed to receive a parameter dependent on the software, in particular a current software version number, of one or more vehicle control units. The updating device has a calculating device which is designed to calculate an activation code from the received characteristic values; and the transmitting device is formed using this

Activation codes with at least one other car control unit too

communicate.

A vehicle control unit according to an embodiment of the invention is designed to cooperate with an updating device to carry out a method according to an embodiment of the invention. In particular, the vehicle control unit comprises a receiving device, which is used for receiving a preparatory command, in particular a command for blocking of the motor vehicle, is formed by an updating device, and a transmitting device, which is adapted to transmit an acknowledgment message, which confirms the execution of a received preparatory command by the vehicle control unit. The transmitting device is designed to transmit a parameter dependent on the software, in particular a current software version number, to the updating device. The

Receiving device is configured to communicate with the updating device. The vehicle control unit further comprises a comparison and release device, which is designed to validate the received messages and to restore the driving readiness of the motor vehicle only if this validation has been completed successfully.

Not all functions have to be present in all vehicle control units. In particular, the transmitting device of the vehicle control unit that processes the command for blocking need not necessarily be configured to transmit a software-dependent characteristic value, in particular a current software version number, to the updating device. This feature only needs to be present in the car control unit to be updated.

The function for blocking the motor vehicle, as well as the comparison and release device must be formed only in a vehicle control unit in the vehicle.

The activation code is not kept on the update device, but it is calculated from the feedback from the environment (other vehicle control units, backend, driver interaction, support hotline, etc.).

The decision to reactivate the vehicle function is transferred from the update device to another vehicle control unit: The

Updater calculates the activation code from the

Feedback from the other vehicle control units and uses the code especially for the reactivation of the vehicle function. The code is not known to the updater, so there are no (potential misdepects that can be made in the updater.

The activation code is in particular calculated by the updating device from data queried by the updated (reprogrammed) vehicle control units. If at least one of the vehicle control devices has not been successfully updated and / or is not in the expected state, it provides different data from which the updating device calculates a different activation code, which is subsequently used in the attempt of

Reactivation of the vehicle function leads to a rejection.

It is a basic idea of the invention that the activation code is not compared by the updating device with a reference value. In such an approach the comparison could be skipped by an error or

Result of the comparison will be misinterpreted. Consequently, there is a feedback from the updating device on vehicle functions.

The updating device may maintain the result of a one-way function of the activation code and pre-check before step (F) and (G) whether the restoration of the blocked vehicle function will be successful. In particular, hash functions such as MD4, MD5, SHA1 or SHA256 could be used for this purpose.

The activation code can be sent in step (F), in particular directly as a value to the device that has blocked the vehicle function. In particular, the value may represent a Service ID ("SID") or be used as a parameter in a U DS communication (ISO 14229: 2013), on which device the activation code must be validated, for example by comparison with a reference code, or by checking whether the result of a one-way function corresponds to a reference value.

As one-way functions could be MD4, MD5, SHA1 or the

Multiplication of two (prime) numbers are used.

Alternatively, the activation code in step (F) may be included in the algorithm for authenticating the updating device to the at least one vehicle controller. This authentication could be done in particular according to UDS security access (see ISO 14229-1: 2013, §9.4 - service 0x27) or according to ASAM XCP MCD-1 "UNLOCK".

Alternatively, the activation code in step (F) may be used to decrypt a program that requires the communication required Contains algorithms and commands. The encryption does not have to offer any cryptographic security, it is sufficient if it is impossible for the updating device to reach the unencrypted program without knowing the activation code. AES256 is an example of a cryptographically secure encryption algorithm, DES or RC4 are examples of algorithms that do not provide cryptographic security. Algorithms without cryptographic security usually require less computation time, depending on

In case of need this may be necessary.

In particular, encryption has the advantage that an arbitrarily complex algorithm for reactivating the vehicle function can be used without changes, and nevertheless it is ensured by the encryption that no part of this algorithm can be triggered without the presence of the activation code. In particular, this can be communicated with each vehicle control unit.

The test carried out in step (G) may be implemented as a simple comparison with a reference code: the updating device sends the calculated activation code to the vehicle control unit, which compares the activation code with a reference code.

However, one-way functions can also be used. If a one-way function is used, also the comparison device only the result of the function is known: The car control unit calculates the result of the one-way function with the activation code as input (s). If the result matches the reference value, the activation code is correct.

The two methods described are direct tests: the

Activation code is sent to the car control unit and checked by the vehicle control unit.

The recognition can also take place in the context of existing authentications, in particular UDS Security Access or XCP UNLOCK: In the vehicle control unit, an authentication according to the prior art is implemented, but in the updating device - in contrast to the prior art - the necessary algorithms stored so that they are usable only when the correct activation code is present. This variant has the advantage that no change to the vehicle control unit is required. This is an example of an indirect check: The activation code is not sent, but without the value the authentication would fail.

In another approach to indirect testing, the program (instructions, algorithms) executed by the updating device for communication with the vehicle controller is stored in encrypted form. As a password for the decryption is the activation code, only by the

Decryption, the update device has access to the required commands. When the vehicle controller receives the correct commands, or commands with the correct parameters, from the updater, it is indirectly demonstrated that the updater has the correct activation code.

In one embodiment, a key (hereinafter "key B") is sent by the vehicle control unit upon successful blocking of the vehicle function.

A key B is required if, in addition to preventing a false reactivation of the vehicle function, it must also be demonstrated that no erroneous start of the reprogramming is possible (point (C) in the

Disclosure of the invention).

In one embodiment, the key B is calculated from a key A, which has been previously transferred from the updating device to the vehicle control unit.

The use of a key A, which has been previously transmitted from the updating device to the vehicle control unit, has the advantage that the key B is no longer constant. Consequently, an erroneously stored old acknowledgment message can not lead to an inadmissible start of the reprogramming.

In addition, the addressed in step (A) at least one vehicle control unit to store the key A long term and thus recognize and reject old keys safely. The keys may also be digitally signed so that the updater does not function as the vehicle

can block incorrectly. It is also possible that the key A is sent either before or after the command to block the at least one vehicle function. Key B can also be sent after the successful blocking message.

It is also possible that the car control unit always calculates keys A from key A - and that enters into this calculation when a vehicle function is blocked. This has the advantage that both states are safe, e.g. "Safe" in this context means that faults in the updater always result in a different code (Activation Code, Activation Code, Start Code, "Code n"), and these errors may then be noticed by the vehicle controllers become.

It is only necessary here that the blocking status is received in some form in the key B. In particular, the vehicle control unit in the normal state can respond to requests for a key B with an error message and answer these requests only if at least one vehicle function is blocked. Alternatively, the algorithm for calculating key B may be constructed such that the blocked vehicle function enters the key B as a parameter.

In order to avoid an erroneous start of the programming, a start code can be calculated by the updating device from data (characteristic values) which are requested by the motor vehicle control units, in particular from the key B. This start code can then be used in step C. This has the advantage that without a previous blocking of the vehicle function, the SW update process can not be started.

The start code is used in the same way as the activation code: In particular, it can be used to decrypt commands for the execution of the software update; the start code can be used to decrypt the new software to be installed. The start code can be used as a parameter or command to a vehicle manufacturer. Control unit are shipped, and / or it can be used for authentication.

In another embodiment, the method includes updating the software of multiple vehicle control devices. This is a code ("code n"), in particular from feedback of an nth vehicle control unit, its software has been updated, used to perform the SW update for a n + l-tes car control unit. Since the code that contains data of the nth vehicle control unit exists only when this vehicle control unit has been successfully updated and this code is used for the update of the n + lst car control unit, it is ensured that the car Control units can only be updated in the given order.

After updating the software of all vehicle ECUs to be updated, once again the characteristics and / or memory contents of all updated vehicle ECUs can be checked to verify the final configuration. This step is formally not necessary because the update of the last vehicle control unit only takes place if all vehicle control units were previously successfully updated. However, it may be advantageous to still re-address all car control units, for example to always be able to use the same software module for this step. In particular, vehicle control unit can be addressed, which have not been updated.

The same approaches as for the start code and the activation code can be used for the use of these codes: In particular, commands can be decrypted with them, they can be sent as parameters or commands to a motor vehicle control unit, and / or they can be used for authentication be used.

The transmission between the updating device and at least one vehicle control unit can also take place via an intermediary gateway. On the one hand, this gateway can be designed to filter impermissible messages, on the other hand, the gateway can connect a wireless interface to a wired interface.

Illegal messages could be, for example, messages that contain speed information from the engine or a driving speed: This information may only be sent by the responsible vehicle control units. The gateway can thus prevent the update device from disturbing vehicle functions. For the decision as to whether a message is admissible, the gateway may in particular have a CAN message identifier, a source or a destination IP address (eg according to IPV6, RFC2460), and / or a source or a destination port (eg after TCP, RFC793), and / or evaluate the direction from which the gateway received the message. It may also be inadmissible be too many messages are sent by the updating device, since the consequent bus load could lead to a malfunction of vehicle functions.

In one embodiment, the gateway must be enabled by the updating device before transferring data between the updating device and at least one vehicle control unit. In particular, the gateway may be designed so that it does not forward messages that are required for reprogramming during normal operation, such as, for example, the UDS programming session (ISO 14229-1: 2013, §9.2.2.2). For the activation, a code ("gateway activation code") can be used, which is initially not available on the diagnostic tester, but is calculated in particular from the communication with at least one vehicle control unit. The Gatwway unlock code may be the same as the start code, but it is also possible that both codes are different, in particular the gateway may receive feedback from the gateway.

In one embodiment, the step of transmitting the calculated activation code to the vehicle control unit also includes transmitting the keys A and / or B, and the step of validating comprises evaluating all values (activation code, and / or key A, and / or Key B). Mixed forms are also possible: for example, the activation code could be used for decryption and the key A is transmitted. The transmission of key A and / or B could be advantageous if these keys on the vehicle control unit that has blocked at least one vehicle function, can not be stored / should.

In one embodiment, blocking the motor vehicle includes activating an immobilizer and / or blocking a starter and / or a fuel pump. In this way, the motor vehicle can be reliably blocked.

In one embodiment, the method further includes computing the codes (activation code, enablement code, start code, "code n") from the content of at least portions of a memory of a vehicle controller, thereby further verifying the success of the software update who- because errors that result in different memory contents can be reliably detected.

To confirm a successful update, additional

Hedges are used; these may include, for example:

- write the data forward and read it backwards;

- the data both via "ReadMemoryByAddress" and above

Read "ReadDataByldentifier" (ISO 14229: 2013);

- Not only read the (flash) memory of each vehicle control unit, but also also query results of the respective car control unit.

It is also possible to query the same data multiple times, so as to achieve protection against disturbed bus messages.

In one embodiment, interrogating the characteristic value comprises interrogating the characteristic values of one or more vehicle control units which, during operation, interact with the vehicle control unit whose software has been updated. This ensures that all car control units that work together in operation are equipped with compatible software versions so that they can cooperate easily.

In one embodiment, the communication between the updating device and the vehicle control device is encrypted. As a result, unauthorized changes to the vehicle control devices is prevented or at least considerably more difficult.

In one embodiment, the interrogation of characteristic values comprises the query of data in at least one external backend system, for example a server of the manufacturer of the vehicle or the vehicle control unit. This makes it easier to exclude unauthorized manipulations and allows complete documentation of the changes made, in particular the final or target state of the vehicle control devices. In a further embodiment, two processes for restoring the driving readiness of the motor vehicle by the vehicle control device are provided on the updating device: A first process which requires an activation code which can be calculated in the event of a successful update. In addition, a second sequence is provided, for which an activation code is required, which is calculated from the backend and / or hotline feedback, which then activates an emergency operation of the vehicle. This has the advantage that on the one hand accidental activation of the emergency operation is impossible, and on the other hand, it is avoided that the vehicle is no longer usable if the update has failed.

In one embodiment, the method further includes user input (driver interaction), a chassis number, and / or a vehicle identification number in the calculation of the activation code. In this way it can be ensured that the motor vehicle is only reactivated when the user has confirmed the update of the software and / or the newly installed software with the respective motor vehicle (type) is compatible.

In one embodiment, the interface for transmitting the data between the updating device and the vehicle control device is configured as a wired interface. A wired interface enables reliable data transmission and is inexpensive to implement. The wired interface can be designed as a standardized interface, in particular as an OBD / OBD2 interface.

In one embodiment, the interface for transferring the data between the updating device and the vehicle control device is configured as a wireless interface. A wireless interface allows a particularly convenient data transmission, since no cables need to be laid and connected. The wireless interface can be made in particular as a WLAN or Bluetooth® connection.

Optionally, communications between the updating device and the vehicle controllers may be known for communication purposes

Watchdog blocks are used. The vehicle control units can, for example, observe minimum and maximum permissible times and

Reject messages that arrive outside these times. The updating device can also selectively use incorrect codes and then incorporate the negative response code of the respective vehicle control unit in another code. The update device may be a separate vehicle control unit, but it may also be a software module in a vehicle control unit. For example, it could also be designed as a virtual machine on an existing vehicle control unit. The advantage of a virtual machine is that a small, ISO 26262 compliant hypervisor can enforce boundary conditions. For example, the virtual machine might not contain writable non-volatile memory, and the hypervisor clears the volatile memory at the end or at the abort of the update. This prevents old acknowledgment messages or old key-values or activation codes from leading to invalid retries.

The invention is based on the recognition that the updating of the software ("re-breathing") of a vehicle control unit or of a vehicle control unit network is a variant of a "mobile agent" / "hostile host" configuration:

- The "Mobile Agent" are the programs for updating the software

- The "hostile host" is the updating device on which the programs for updating the software run.

The updating device may be a true "hostile hosts", for example when an end user's smartphone, tablet or laptop is used as an updating device.

Consequently, it is possible to resort to algorithms known from the literature for the so-called "Mobile Cryptography" in order to achieve proven freedom from feedback

"Environmental Key Generation", as well as the use of "Homomorphic Encryption".

An embodiment of the invention will be described below with reference to the accompanying drawings.

Brief description of the figures

FIG. 1 a shows a motor vehicle with a plurality of vehicle control devices and an external updating device. Figure lb shows a motor vehicle with several vehicle control devices and an internal updating device.

Figure 2 shows an enlarged schematic view of an external updating device.

Figure 3 shows an enlarged schematic view of an internal updating device.

FIG. 4 shows an enlarged schematic view of a vehicle control device.

FIG. 5 shows a schematic diagram of the sequence of a method for updating the software of at least one motor vehicle control device installed in a motor vehicle according to an exemplary embodiment of the invention.

figure description

FIG. 1 a shows a motor vehicle 2 with a plurality of vehicle control devices 4, 6, 8, of which at least one is supplied ("updated") with new software by means of an external updating device 12 a.

FIG. 1b shows a motor vehicle 2 with a plurality of motor vehicle control devices 4, 6, 8, of which at least one is supplied ("updated") with new software by means of an internal updating device 12b.

Figure 2 shows an enlarged schematic view of an external updating device 12a. The external updating device 12a may e.g. B. a suitably equipped automotive diagnostic tester or a smartphone / tablet PC / laptop to be a user on which a suitable software ("App") is installed.

FIG. 3 shows an enlarged schematic view of an internal updating device 12b. The internal updating device 12b may be a vehicle control device 4, 6, 8 built into the motor vehicle 2 for this purpose, or a module in an existing vehicle control device 4, 6, 8. The internal updating device 12b may also be a software module in a motor vehicle Control 4, 6, 8 be. In particular, it can be designed as a virtual machine on an existing vehicle control unit 4, 6, 8. The advantage of a virtual machine is that here a small, to ISO 26262 compliant hypervisor 38 conditions can force.

FIG. 4 shows an enlarged schematic view of a vehicle control device 4.

The updating device 12a, 12b in each case has a transmitting device 17 and a receiving device 19, which are connected via a wireless or wired data connection 10 to a transmitting device 30 and a receiving device 28 of at least one of the vehicle control devices 4, 6, 8.

A wired data connection 10 can be produced, for example, via a standard interface 16 present in the motor vehicle 2, in particular an OBD / OBD2 interface 16. A wireless data connection 10 may be made, for example, by a WLAN or Bluetooth connection.

The transmission between the updating device 12a, 12b and at least one vehicle control device 4, 6, 8 can also take place via an intermediary gateway 34. On the one hand, this gateway 34 can be designed to filter impermissible messages, on the other hand, the gateway 34 can connect a wireless interface to a wired interface.

The vehicle control units 4, 6, 8 can communicate with one another via data lines 18, in particular a data bus 18, or wirelessly.

The sequence of a method for updating the software of at least one of the motor vehicle control units 4, 6, 8 installed in the motor vehicle 2 according to an exemplary embodiment of the invention is shown schematically in FIG.

In a first step 110, the updating device 12a, 12b receives an order for updating the software via an input device 14 formed on the updating device 12a, 12b or an interface 15, in particular a mobile radio, WLAN, Bluetooth® or USB interface 15 at least one of the vehicle control units 4, 6, 8.

The new software, which is to be transmitted to the at least one vehicle control device 4, 6, 8, is stored either in a storage device 13 of the updating device. direction 12a, 12b is stored or via the interface 15, z. B. from a USB storage device ("USB stick", "Flash Drive"), transferred to the updating device 12 a, 12 b and possibly stored (temporarily) in the storage device 13.

The software may optionally be in encrypted form, so it must first be decrypted before it can be used. In particular, in this case, the updating device 12a, 12b of the key necessary for decrypting the software may not be (yet) known.

The updating device 12a, 12b then sends (at step 120) a command to at least one of the vehicle controllers 4, 6, 8 to shut down the motor vehicle 2 for the duration of the software update. The command may include, for example, to activate an immobilizer 20 of the motor vehicle 2 and / or to block a starter 22 or a fuel pump 24 of the motor vehicle 2.

"Blocking" the motor vehicle 2 in this context may also mean placing the motor vehicle 2 in an "emergency operating state" in which, for example, only limited engine power is available, and / or activating a warning light which indicates that some functions of the motor vehicle 2, such as. As ABS or ESP, are not available.

There is also the possibility that the operation of the motor vehicle 2 is initially completely blocked, and the motor vehicle 2 is placed in an emergency operating state after the expiry of a predetermined period of time, which makes it possible, for example, to drive the motor vehicle 2 into a (different) workshop. z. For example, if the software update failed to complete successfully.

The activation of the "emergency mode" may include user input by which the user confirms that he is aware that the motor vehicle 2 is in a restricted emergency mode in which not all functions are available. The motor vehicle 2 is activated only in the emergency mode after the user has confirmed to have taken note of this. Together with the command to block the motor vehicle 2 may optionally a key ("key A") to the relevant vehicle control unit 4, 6, 8 are transmitted. Once the car control unit 4, 6, 8 has executed the command to block the motor vehicle 2, it sends in step 130 a confirmation message confirming that the command has been executed to the updating device 12a, 12b. The vehicle control unit 4, 6, 8 can also send a key B to the updating device 12a, 12b, which has been calculated in the vehicle control unit 4, 6, 8. If a key A was previously transmitted (in step 120) to the motor vehicle control unit 4, 6, 8, the key B can be calculated in particular from this key A.

The algorithm for calculating the key B, or at least parameters which are included in the calculation, is known to the motor vehicle control unit 4, 6, 8 but not to the updating device 12a, 12b. The vehicle control unit 4, 6, 8 may be designed so that key B is only shipped when the at least one vehicle function has been blocked. If the function is not blocked, an error message will be sent. Alternatively, providing a key B may be an always active function, and "Is the vehicle blocked?" Is a parameter that enters the calculation of the key.

A calculation device 26 provided in the updating device 12a, 12b calculates a code from data (characteristics) retrieved from the vehicle control devices 4, 6, 8 (step 130). The

Computation device 26 may be implemented in hardware or software.

In particular, the key B can also be included in this calculation.

The interrogation of the data (characteristic values) can also include the interrogation of data in at least one external back-end system 40, eg a server of the manufacturer of the motor vehicle 2 or the vehicle control units 4, 6, 8, to exclude unauthorized manipulations and a Complete documentation of the changes made, in particular the final or target state of the vehicle control units 4, 6, 8, to allow. If the new software is stored on the updating device 12a, 12b in encrypted form, this code can be used in particular for

Decrypt the software (step 140). The encryption of the software does not have to provide cryptographic security.

Alternatively, it is also possible that this code is included in the algorithm for the U DS Secure Access (ISO 14229: 2013, §9.4 - service 0x27) or for ASAM XCP MCD-1 "UNLOCK".

After the possibly encrypted stored software has been decrypted, the software is transmitted in step 150 via the data link 10 on at least one of the vehicle control units 4, 6, 8 and installed on the at least one vehicle control unit 4, 6, 8.

The software may also comprise a plurality of software packages, wherein in particular each software package for updating each one of the vehicle control units 4, 6, 8 is provided. In particular, an order may be predetermined in which the software packages are to be recorded on the various vehicle control devices 4, 6, 8.

In this case, a vehicle controller 4, 6, 8 whose software has been successfully installed can provide a key value. This key value is in turn used by the calculation device 26 to calculate a new code. This new code is then used in particular for decrypting and updating the next software package.

In this way, since the new code is present only when the preceding software package has been successfully installed on its vehicle controller 4, 6, 8, it is ensured that the software of the vehicle controllers 4, 6, 8 is updated only in the predetermined order can be.

It is also possible that an nth software package certain functions of the motor vehicle 2, such. B. the injection system is deactivated to bring the motor vehicle 2 in a safe state, and a subsequent m-th software package (m> n), which is later decrypted and installed, the deactivated function reactivated after the software update has been successfully performed is. After the software update has been completed, ie after all software packages have been successfully loaded onto the associated vehicle control units 4, 6, 8, the calculation device 26 can be used again to generate data (characteristic values) generated by the motor vehicle control units 4, 6, 8 to calculate an activation code (step 160).

In this case, depending on the application data, all vehicle control units 4, 6, 8 or only data of those vehicle control units 4, 6, 8 are queried whose software has been updated. In order to ensure correct interaction of all vehicle control units 4, 6, 8 in the motor vehicle 2, in particular data of those vehicle control units 4, 6, 8 can be queried, which interact with the updated vehicle control units 4, 6, 8.

The queried data may include, for example, version numbers of the software currently installed on the respective vehicle control device 4, 6, 8 and / or the content of at least one defined subarea or an entire memory 7 of the respective vehicle control unit 4, 6, 8.

The queried data can additionally also comprise a user input, which is entered via an input device 5 provided on / in the motor vehicle 2. This makes it possible to ensure that the motor vehicle 2 is activated only after the software update has been confirmed by a user input on the motor vehicle 2 itself. In addition to a simple yes / no, the user input can also be the copying of a release code ("captcha"), which has the advantage that this code can enter into the calculation of the activation code and thus can not be skipped.

In particular, it can be provided that an "emergency operation" of the motor vehicle 2, in which not all functions of the motor vehicle 2 are available, is activated only after the user has confirmed that he has taken note of the existence of an emergency operation and the associated restrictions Has.

Additionally or alternatively, the queried data may also include a vehicle identification number and / or a vehicle identification number or another variable that uniquely identifies the motor vehicle 2 or the vehicle type of the motor vehicle 2. Also features of the vehicle configuration, such as the Motorization, the number of driven axles and other equipment features can be included in the calculation of the activation code.

Since the data of an unsuitable motor vehicle 2 does not lead to the calculation of the correct activation code, it can be ensured in this way that the motor vehicle 2 is reactivated only when only software suitable for the respective motor vehicle 2 has been installed.

The activation code calculated in this way is used by the updating device 10 for communication with the at least one of the vehicle control units 4, 6, 8 (step 170), optionally additionally the previously calculated key A or B can be transmitted.

A comparison and release device 32 of the at least one vehicle control unit 4, 6, 8, which has received the activation code, validates the received messages in step 180 with a predetermined reference algorithm stored in the respective motor vehicle control unit 4, 6, 8 reactivates the motor vehicle 2 (step 200), eg by unlocking the immobilizer 20 and / or activating the starter 22 or the fuel pump 24, (only) in the case of a positive validation of the received activation code.

If the activation code with the algorithm stored in the respective vehicle control device 4, 6, 8 is not positively validated, the motor vehicle 2 is not reactivated. Instead, an error message is issued (step 210).

The comparison and release device 32 may be implemented in hardware or software.

To prevent or at least aggravate unauthorized manipulations, the communication between the updater 10 and the car controllers 4, 6, 8 may be cryptographically secured, i. encrypted and / or signed done.

Optionally, for the communication between the updating device 12a, 12b and the vehicle control units 4, 6, 8 known concepts of

Communication with "watchdog" blocks are used. For example, the vehicle control units 4, 6, 8 may consider minimum and maximum allowable times and activation codes that arrive outside these times, reject. The updating device 12a, 12b can also send targeted false activation codes and then incorporate the negative response code of the respective vehicle control unit 4, 6, 8 in the broad process.

Claims

claims

A method of updating a software of at least one in one

Motor vehicle (2) built vehicle control unit (4, 6, 8), the method comprising:

(A) transmitting a preparatory command, in particular a command for blocking the motor vehicle (2), from an updating device (12a, 12b) to at least one motor vehicle control unit (4, 6, 8);

(B) transmitting to the updating device (12a, 12b) an acknowledgment message confirming the execution of the preparatory command from the at least one vehicle control unit (4, 6, 8);

(C) transferring new software from the updating device (12a, 12b) to the at least one vehicle control unit (4, 6, 8) and installing the new software on the at least one vehicle control unit (4, 6, 8);

(D) querying a software-dependent characteristic value, in particular the software version number, of at least one vehicle control unit (4, 6, 8);

(E) calculating an activation code from the at least one requested characteristic value;

(F) using this activation code in the subsequent communication with at least one vehicle control unit (4, 6, 8);

(G) executing a command, in particular a command for restoring the driving readiness of the motor vehicle (2), by the at least one motor vehicle control unit (4, 6, 8), only if the motor vehicle control unit (4, 6, 8) checked the activation code directly or indirectly and determined that there was a valid activation code.

2. The method of claim 1, wherein in step (F) of the activation code from the updating device (12a, 12b) to the at least one vehicle control unit (4, 6, 8) is transmitted and validated by this vehicle control unit according to a predefined algorithm becomes; and / or wherein in step (F) the activation code is used to generate at least one command or to decrypt an algorithm used for communication with the least one car control unit (4, 6, 8) with this activation code; and / or wherein in step (F) the activation code is used for authentication of the updating device (12a, 12b) to the at least one vehicle control device (4, 6, 8).

Method according to one of the preceding claims, wherein the method comprises, prior to step (C) to transmit a key from the at least one vehicle control unit (4, 6, 8) to the updating device (12a, 12b) and in step (C) Use start code calculated from at least this key.

The method of claim 1 or 2, wherein the method comprises prior to step (C) to send a key from the updating device (12a, 12b) to the at least one vehicle control device (4, 6, 8) and wherein the addressed vehicle control device a message, in particular dependent on this key, to the updating device (12a, 12b) and wherein the updating device (12a, 12b) uses in step (C) a start code calculated from at least this message.

The method of claim 3 or 4, wherein in step (C) the start code from the updating device (12a, 12b) to the at least one vehicle control unit (4, 6, 8) is transmitted and validated by this vehicle control unit according to a predefined algorithm becomes; and / or wherein in step (C) the start code is used to decrypt at least one command or algorithm used for communication with the at least one vehicle controller (4, 6, 8) with that start code;

and / or wherein in step (C) the start code is used to authenticate the updating device (12a, 12b) with respect to the at least one motor vehicle control unit (4, 6, 8).

Method according to one of claims 1 to 5, wherein the method comprises in step (C) the data via a gateway (34) from the updating device (12a, 12b) to the vehicle control unit (4, 6, 8) to transmit wherein the gateway (34) in particular performs a check of the messages and forwards only allowed messages.

The method of claim 6, wherein the updating device (12a, 12b) must enable the gateway (34) for at least one message using a gateway code comprising at least one of a vehicle control unit (4, 6) , 8) has been calculated.

The method of claim 7, wherein the gateway unlock code is transmitted from the updating device (12a, 12b) to the gateway (34) and validated by that gateway (34) according to a predefined algorithm; and / or wherein the gateway unlock code is used to decrypt at least one command or algorithm used to enable the gateway (34) with that gateway unlock code; and / or wherein the gateway enabling code is used to authenticate the updating device (12a, 12b) to the gateway (34).

9. Method according to one of the preceding claims, wherein the method comprises updating the software of a plurality of vehicle control devices (4, 6, 8), wherein a code consisting of characteristic values of at least the nth vehicle control unit (4, 6 8, the software of which has been updated, is used for the communication with the n + 1-th vehicle control unit (4, 6, 8).

10. The method according to any one of the preceding claims, wherein the interrogation of the characteristic value of one or more motor vehicle control units (4, 6, 8), the / the characteristic value (s) of one or more vehicle control units (4, 6, 8) query that cooperate with the at least one vehicle control unit (4, 6, 8) whose software has been updated.

11. The method of claim 1, wherein the method comprises calculating one of the codes from the content of at least one subarea of a memory of the vehicle control device; and / or wherein the method comprises calculating one of the codes from a user input, a chassis number, and / or a vehicle identification number; and / or wherein the method includes sending data about the software update to an external backend and using the feedback from the backend to calculate a code.

12. The method according to any one of the preceding claims, wherein the test takes place in which the vehicle control device (4, 6, 8), in particular the vehicle control unit (4, 6, 8) that has blocked at least one driving function and / or the vehicle control unit (4, 6, 8) that is to be reprogrammed and / or the vehicle control unit (4, 6, 8) that acts as a gateway (34) received messages, in particular commands and / or parameters compare with stored reference values; and / or wherein the check is made in which the vehicle control unit (4, 6, 8) uses the received messages as parameters for at least one one-way function and compares the results with stored reference values, and / or wherein the check is successful Authentication takes place.

13. Updating device (12a, 12b) for updating the software

at least one vehicle control device (4, 4) installed in a motor vehicle (2)

6, 8), the updating device (12a, 12b) comprising: a storage device (13) adapted to store the software to be updated; a transmitting device (17) adapted to transmit a preparatory command, in particular a command to block the motor vehicle (2), to the motor vehicle control unit (4, 6, 8); a receiving device (19) adapted to receive an acknowledgment message confirming the execution of the received preparatory command by the vehicle control unit (4, 6, 8); wherein the transmitting device (17) is adapted to transmit the software to be updated to the vehicle control unit (4, 6, 8); wherein the receiving device (19) is adapted to receive at least one characteristic value, in particular the software version number, of one or more motor vehicle control units (4, 6, 8); wherein the updating device (12a, 12b) has a calculation device (26) which is designed to generate a code, in particular an activation code and / or a code from the received characteristic values Start programming and / or code to enable a gateway; and wherein the transmission device (17) is designed such that this code is required for communication with the vehicle control unit (4, 6, 8).

14. A motor vehicle control unit for a motor vehicle (2), the at least one

Hypervisor (38) and an updating device (12b) according to claim 13, wherein the hypervisor (38) after a successful or unsuccessful update, in particular the memory device (13) and / or the receiving device (19) and / or the transmitting device (17) and or at least partially deletes and / or resets the calculating device (26) of the updating device (12b).

15. A vehicle control unit (4, 6, 8) for a motor vehicle (2), which is designed to cooperate with an updating device (12a, 12b) and other vehicle control units (4, 6, 8), wherein the vehicle control unit (4, 6, 8) comprises: a receiving device (28) adapted to receive a preparatory command, in particular a command to block the motor vehicle (2), from an updating device (12a, 12b); a transmitting device (30) adapted to transmit an acknowledgment message confirming the execution of a received preparatory command by the vehicle control unit (4, 6, 8); wherein the sending device (30) is adapted to transmit a conclusion, in particular a key dependent on the previous communication between the updating device (12a, 12b), to the updating device (12a, 12b), the key in particular depending on whether the vehicle function was blocked; wherein the receiving device (28) is adapted to forward messages received by the updating device (12a, 12b) to a comparison and release device (32), which is designed to validate the messages according to a predetermined algorithm and to control the driving readiness of the motor vehicle (2). restore only on positive validation.