WO2020088910A1

WO2020088910A1 - Transmitting messages on board a motor vehicle

Info

Publication number: WO2020088910A1
Application number: PCT/EP2019/077588
Authority: WO
Inventors: Stefan Grosse
Original assignee: Bayerische Motoren Werke Aktiengesellschaft
Priority date: 2018-10-31
Filing date: 2019-10-11
Publication date: 2020-05-07
Also published as: DE102018127152A1

Abstract

The invention relates to a method for transmitting messages from a sender to a first and to a second receiver on-board a motor vehicle comprising steps of transmitting a first message from the sender to the first receiver; of transmitting a second message from the sender to the first and to the second receiver, wherein the messages each comprise authentication information for authenticating the sender with respect to the first receiver; of checking the authentication information of the sender by the first receiver; of transmitting a control message depending on a result of the check from the first receiver to the second receiver; and of processing received messages by the second receiver, depending on the transmitted control message.

Description

Transmission of messages on board a motor vehicle

The invention relates to the transmission of messages on board a

Motor vehicle. In particular, the invention relates to the secure transmission of messages from one sender to several recipients.

A motor vehicle includes a transmitter and several ready to receive

Control devices, which are each set up to process messages from the sender. The messages can relate, for example, to an operating state or a driving situation of the motor vehicle, and the control units can control a driving function of the motor vehicle on the basis of the messages. The messages can be both time-critical and security-relevant.

To secure a message, it can be encrypted and / or authenticated. This usually requires cryptographic operations that require a certain amount of processing power. The control units can have limited processing resources, so the use of

Cryptography can slow processing. Encryption can increase the bandwidth required for the transmission of messages and documentation of transmitted messages, for example for

Troubleshooting, complicate. Authentication of the message is usually only possible in point-to-point operation from the sender to an individual recipient.

One object on which the invention is based is to secure messages sent by a transmitter to a plurality of receivers on board a motor vehicle without putting a heavy burden on the receivers for the security. The invention solves the problem by means of the objects of the independent

Expectations. Sub-claims reflect preferred embodiments.

According to a first aspect of the invention, a method for transmitting messages from a transmitter to a first and a second comprises

Receiver on board a motor vehicle Steps of transmitting a first message from the sender to the first receiver; the transmission of a second message from the sender to the first and the second receiver, the messages in each case authentication information for authenticating the Transmitter compared to the first receiver; checking the authentication information of the transmitter by the first receiver; transmitting a control message depending on a result of the check from the first recipient to the second recipient; and processing received messages by the second receiver in

Dependency of the transmitted control message.

Using the first message, the sender can be authenticated to the first recipient. Authentication to the second recipient can be omitted, so that valuable resources in the provision, transmission or processing can be saved. In particular, the transmitter and the second receiver can be spared in terms of processing time and / or a transmission medium between the transmitter and the second receiver in terms of bandwidth. The sender can then send any number of second messages that can be processed by one or more second receivers. Optionally, the transmitted messages can also be processed by the first recipient.

It is preferred that the second recipient discards the second message if the control message indicates a failed check by the first recipient. In particular, if the second message relates to data that are to be processed by the second recipient, a message whose authenticity could not be confirmed can simply be rejected. A single message can thus be omitted in a series of messages. This can increase the quality of processed data. If the message concerns a measured value, for example, this can be ignored. A series of measured values can then have a gap at the relevant point.

The first message can be transmitted as unicast. It can

in particular, a point-to-point connection is established between the transmitter and the first receiver. This can be done on the basis of a known protocol such as the Internet Protocol (IP). The is preferred

However, authentication is handled via IPsec, in particular using the IKE key exchange protocol described therein, more preferably with version 2 (IKEv2). The second message can be transmitted as a multicast, for which the

Internet protocol (IP) can be used. The message to be transmitted can be provided with several recipients, so that it only has to be transmitted once. This transmission can also take place on the basis of a known protocol such as the Internet protocol.

Optionally, the control message is transmitted less frequently than the second one

Messages arrive at the first recipient. For example, a positive control message can be transmitted periodically as long as messages are received that can be authenticated. The control message can, for example, be time-controlled or in each case transmitted after receipt of a predetermined number of authenticated second messages. The

Control message can also be based on the type of sample with a

random frequency. The coincidence can relate to a time or a number of transmitted second messages. This can save processing time and / or bandwidth between the first and the second receiver.

Optionally, only part of the second message is checked. In the manner described above, for example, systematically or randomly, certain second messages can be checked and a corresponding control message can be transmitted for each check.

The first and / or the second message are preferably transmitted by means of IPSec. It is not necessary to encrypt the message. Authentication information from the sender can still be added. A data field provided for this is also called an authentication header.

The control message can be transmitted using SOME / IP. It is a communication protocol, which is used in particular in the

Automotive sector is used. The abbreviation stands for Scalable Service-Oriented Middleware over IP. A trust relationship between the first and the second recipient can be ensured using protocol properties of SOME / IP. According to a second aspect of the invention, a transmitter on board a motor vehicle comprises a transmission device which is set up to transmit a first message to a first receiver and to transmit a second message to a first and a second receiver, the

Messages each include authentication information for authenticating the transmitter to the first receiver.

The transmitter can comprise a sensor, the second message being determined on the basis of a measured value of the sensor. The sensor can in particular be set up to scan an environment of the motor vehicle.

For example, the sensor can comprise a radar or LiDAR sensor. The sensor can be attached in particular in the area of an outer skin of the motor vehicle. At this point, the sensor or transmitter can be exposed, so that an attacker can send messages to one of the receivers using a wired or wireless transmission method. A technique described here can prevent such a message from being evaluated and being used as a basis for controlling the motor vehicle.

According to a third aspect of the invention, a first receiver on board a motor vehicle comprises a receiving device for receiving

News from a broadcaster; an evaluation device which is set up to check authentication information which is comprised by a message received by the sender and to provide a control message as a function of a result of the check; and a transmitting device for transmitting the control message to a second recipient to whom the received message is also addressed.

According to a fourth aspect, a receiver on board a motor vehicle comprises a first receiving device for receiving messages which have been sent by a transmitter to the latter and a further receiver; a second receiving device for receiving a control message from a further receiver; and an evaluation device which is set up to process the received message as a function of the control message. According to yet another aspect of the invention, a system on board a motor vehicle includes a transmitter described herein, a first receiver described herein, and at least one second receiver described herein.

In accordance with yet another aspect of the invention, a motor vehicle includes a system described herein.

An evaluation device of a transmitter described here or one of the receivers described herein can be set up to carry out a method described here in whole or in part. For this purpose, the evaluation device can be a programmable microcomputer or

Microcontrollers include, the method in the form of a

Computer program product with program code means is present. The

Computer program product can also be stored on a computer-readable data carrier. Features or advantages of the method can be transmitted to the transmitter, the first receiver or the second receiver or to the system and vice versa.

The invention will now be described in more detail with reference to the accompanying drawings, in which:

Figure 1 shows a system, and

Figure 2 illustrates a flow diagram of a method.

FIG. 1 shows a system 100 which is mounted on board a motor vehicle 105 as an example. The system 100 comprises a transmitter 110, a first receiver 115 and at least a second receiver 120

are communicatively connected to one another, for example by means of a first data bus 125. Optionally, a second data bus 130 can optionally be provided separately, which communicatively connects the two receivers 115, 120, but not the transmitter 110. Both data buses 125, 130 are preferably set up to transmit data using the inter-protocol. The transmitter 110 comprises a transmission device 135 for transmitting a message via the first data bus 125, and preferably a sensor 140. The transmitter 110 is preferably set up to send messages which are determined on the basis of measured values from the sensor 140. The sensor 140 is preferably set up to scan an environment of the motor vehicle 105. For example, sensor 140 may include a non-contact sensor such as a radar or LiDAR sensor. The messages may include raw data from sensor 140. The sensor values of sensor 140 may require a wide bandwidth so that the first data bus 125 can be used to a high degree, even if a fast data bus such as Gigabit Ethernet is used.

The receivers 115, 120 can each comprise control devices, of which at least one sensor data of the transmitter 110 is processed in order to

To control motor vehicle 105 in the longitudinal and / or transverse direction. One or more of the receivers 115, 120 can be part of a partially autonomous or autonomous control of the motor vehicle 105.

The first receiver 115 comprises a receiving device 145, one

Evaluation device 150 and a transmission device 155

Receiving device 145 is set up to receive a message from transmitter 110 and is preferably connected to first data bus 125.

The second receiver 120 comprises a first receiving device 160, an evaluation device 165 and a second receiving device 170. The first receiving device 160 is set up to receive messages from the transmitter 110 and is preferably connected to the first data bus 125. The second receiving device 170 is set up to receive messages from the first receiver. The second receiving device 170 and the

Transmitting device 155 of the first receiver 115 can be connected to the first data bus 125 or the second data bus 130.

It is proposed that the transmitter 110 authenticate itself to the first receiver 115 by means of a first message and then second

Messages are sent to the first recipient 115 and the second recipient 120, each of which includes authentication information and on Measured values of the sensor 140 are based. The first receiver 115 is set up to check the authentication information of the transmitter 110 and to transmit a message to the second receiver 120 as a function of a test result. If the first recipient 1 15 cannot authenticate a message from the sender 1 10, then the corresponding one

Transmit control message to the second recipient 120, who can then reject the information contained in the unauthenticated message.

FIG. 2 shows a flow chart of an exemplary method 200, which can be carried out in particular by means of a system 100, preferably on board a motor vehicle 105. In the illustrated embodiment, steps associated with transmitter 110 are in a left area, those associated with first receiver 115 are in a central area, and steps associated with second receiver 120 are in a right area shown.

In a first step 205, information can be generated by the transmitter 110 using the sensor 140, for example. This can

In particular, an environment of the motor vehicle 105 can be scanned in a contactless manner by means of the sensor 140. In a step 210 can

Authentication information of the transmitter 1 10 the provided

Information will be attached. Steps 205 and 210 can run in the manner of an endless loop.

In step 215, a message can be generated based on the information previously provided. The message can be transmitted in a step 220 from the transmitter 110 to the first receiver 115 and optionally to the second receiver 120. Authentication can take place for the first time by means of a first message, which is preferably transmitted by the transmitter 110 exclusively to the first receiver 115 by means of a point-to-point connection.

More precisely, the transmitter 115 can be authenticated with respect to the first receiver 115, which can also comprise a plurality of messages which are exchanged between the transmitter 110 and the first receiver 115. Authentication can be carried out according to a predetermined protocol, in particular the IKEv2 protocol, which is part of the IPsec protocol collection. In this communication, no user data are preferred by the Transmitter 110 transmits, but at least one cryptographic key is transmitted. One or more second messages transmitted subsequently can be multicast from the transmitter 110 to the first receiver 115 and the second receiver 120. The authentication of the transmitter 110 to the first receiver 115 can take place again at predetermined intervals in the further course of the method 200.

In a step 225, the first recipient 115 checks the authentication information attached to the message. Verification can be part of the authentication protocol mentioned above. On the basis of a

A check message can be provided in a step 230 in a test result. This can be transmitted in a step 235 from the first receiver 115 to the second receiver 120.

Both the checking of the authentication information in step 225 and the transmission of the control message in step 235 can be carried out for every or every second message from the sender 110. However, reviews or submissions can be less frequent. In one embodiment, a negative test result is transmitted immediately, while positive test results are only transmitted sporadically. A reverse embodiment is also conceivable. The sporadically transmitted information can, for example, be selected on a time, event or random basis.

In a step 245, the second recipient 120 received the message from the sender 110 and the control message from the first recipient 115. Depending on the control message received, it can then process or reject the message received from the transmitter 110. If control messages only arrive sporadically, a control message can, for example, be received by all of the second recipient 120 since the last control message

Messages from the sender 1 10 concern. Step 245 can also be cycled through in the manner of an endless loop. Reference numerals

100 system

105 motor vehicle

110 transmitters

115 first recipient

120 second receiver

125 first data bus

130 second data bus

135 transmission device

140 sensor

145 receiving device of the first receiver

150 evaluation device of the first receiver

155 transmission device of the first receiver

160 first receiving device of the second receiver

165 evaluation device of the second receiver

170 second receiving device of the second receiver

200 procedures

205 scanning environment

210 Include authentication information

215 Post message

220 Submit first message

225 Check authentication information

230 Provide control message

235 Submit control message

240 Submit second message

245 Process or discard message

Claims

Expectations

1. A method (200) for transmitting messages from a transmitter (110) to a first (115) and a second receiver (120) on board a motor vehicle (105), the method (200) comprising the following steps:

Transmitting (220) a first message from the transmitter (110) to the first receiver (115);

Transmitting (220) a second message from the transmitter (110) to the first (1 15) and the second receiver (120),

wherein the messages each include authentication information for authenticating the transmitter (1 10) to the first receiver (115);

Checking (225) the authentication information of the transmitter (110) by the first receiver (1 15);

Transmitting (235) a control message depending on a

Results of the check from the first receiver (1 15) to the second receiver (120); and

Processing (245) received messages by the second

Receiver (120) depending on the control message transmitted.

2. The method (200) according to claim 1, wherein the second recipient (120) rejects the second message if the control message indicates a failed check by the first recipient (1 15).

3. The method (200) according to claim 1 or 2, wherein the first message is transmitted as a unicast.

4. The method (200) according to any one of the preceding claims, wherein the

second message is transmitted as a multicast.

5. The method (200) according to any one of the preceding claims, wherein the control message is transmitted less frequently than second messages arrive at the first recipient (1 15).

6. The method (200) according to claim 5, wherein only a part of the second

News is checked.

7. The method (200) according to one of the preceding claims, wherein the first and / or the second message are transmitted by means of IPSec.

8. The method (200) according to any one of the preceding claims, wherein the control message is transmitted by means of SOME / IP.

9. transmitter (1 10) on board a motor vehicle (105), the transmitter (1 10) comprising:

a transmission device (135) which is set up to transmit a first message to a first recipient (115) and to transmit a second message to a first and second recipient (120),

the messages each comprising authentication information for authenticating the transmitter (110) with respect to the first receiver (115).

10. The transmitter (1 10) according to claim 9, wherein the transmitter (110) comprises a sensor (140) and the second message is determined on the basis of a measured value of the sensor (140).

11. Receiver (115) on board a motor vehicle (105), the receiver (1 15) comprising:

a receiving device (145) for receiving messages from a transmitter (1 10);

an evaluation device (150) which is set up to

Verify authentication information contained in a message received from the sender (110) and in Provide a control message depending on a result of the check; and

a transmitting device (155) for transmitting the control message to a second recipient (120) to whom the received message is also addressed.

12. Receiver (120) on board a motor vehicle (105), the receiver (120) comprising:

a first receiving device (160) for receiving messages from a transmitter (110) to the latter and a further receiver

(115) have been shipped;

a second receiving device (170) for receiving a

Control message from the further recipient (1 15);

an evaluation device (165) which is set up to:

process received message depending on the control message.

13. System (100) on board a motor vehicle (105), comprising a transmitter (1 10) according to claim 9 or 10, a receiver (1 15) according to claim 11 and at least one receiver (120) according to claim 12.

14. Motor vehicle (105) comprising a system (100) according to claim 13.