WO2020200996A1

WO2020200996A1 - System for transmitting data for a utility vehicle, and method therefor

Info

Publication number: WO2020200996A1
Application number: PCT/EP2020/058506
Authority: WO
Inventors: Stefan PRAMS
Original assignee: Knorr-Bremse Systeme für Nutzfahrzeuge GmbH
Priority date: 2019-04-02
Filing date: 2020-03-26
Publication date: 2020-10-08
Also published as: CN113924742B; EP3949192A1; CN113924742A; DE102019108504A1

Abstract

The present invention relates to a system (10) for transmitting data for a utility vehicle, comprising at least one first communication path (12) and at least one second communication path (14), wherein: the first communication path (12) has a first securing module (16); the second communication path (14) has a second securing module (18); the first securing module (16) is of such a nature and is designed in such a way that the first securing module secures data to be sent via the first communication path (12) in a first manner; and the second securing module (18) is of such a nature and is designed in such a way that the second securing module secures data to be sent via the second communication path (14) in a second manner, which is different from the first manner.

Description

DESCRIPTION

System for data transmission for a commercial vehicle and method for this

The present invention relates to a system for data transmission for a

Commercial vehicle and a method for this.

Systems for data transmission in commercial vehicles and the corresponding processes are used for secure data transmission on the on-board communication equipment of

Vehicles, in particular commercial vehicles. In particular, the question of securing the communication channels of electronic systems and components for such vehicles arises.

The requirement to provide adequate protection is made, for example, by safety standards in the automotive industry, such as ISO 26262 and other standards.

In relation to the protection of data communication, there are a number of

basic methods that are widely used as individual methods and are referenced by current technical standards.

For example, the ISO 26262 safety standard names a number of such methods for

Protection, such as "information redundancy", "frame counter" etc. (ISO 26262-5 Table D6).

However, the concrete application and design of the methods is not specified and the achievement of an appropriate level of security is left to the developer himself.

The strength of a protection of the communication by means of a protocol depends on the exact design of the protocol or the protection measures. It is therefore limited / influenced, for example by the technical possibilities of the protocol (configuration), the transmission unit or the requirements for a maximum transmission time (per measured value) etc.

It would be desirable to improve the overall security of the communication channels in order to be able to rule out remote access and manipulation.

According to the invention, this object is achieved by a system for data transmission for a commercial vehicle having the features of claim 1.

It is then provided that a system for data transmission for a commercial vehicle is provided, with at least one first communication path and with at least one second communication path, the first communication path having a first protection module and the second communication path having a second protection module, the first protection module such procured and set up, in a first way over the first

Secure communication path to send data, and the second

The protection module is designed and set up in a second way that differs from the first way and / or in an at least partially identical way to protect data to be sent via the second communication path.

The invention is based on the basic idea that the fundamental

technological possibilities of transmission protocols in the context of redundant versions of the communication paths can be used in an advantageous manner. Redundancy is achieved by providing at least two communication paths. Then there should be diversity with regard to the communication content with regard to data and measurement data on the redundant communication channels. The diversity also affects the design of the

Safeguarding measures for the individual redundant communication channels. This enables increased security of communication. As advantages are

especially a higher protection, a lower residual risk for

Mention the population and users of the devices. In model calculations based on ISO 26262 has shown that the invention can significantly increase the ability to detect communication errors (so-called diagnostic coverage). This increase can be around 30% (relative) or much higher, depending on the application context.

The further advantage of the numerically calculated increase in

Going beyond diagnostic coverage is that (increased) coverage against

Communication errors can be created in terms of various causes.

Further advantages are, for example, that the achievement of the

Requirements of higher automotive safety integrity levels become possible. In addition, it is possible to use newer and further technologies in the product as well as further components or protocols accordingly. A larger scope of required integrity levels with the same technology or the same components is also made possible. This allows economies of scale in purchasing, such as cost reduction, streamlining in the procurement effort, generally better cost management. Another advantage is that implementation with so-called "off the shelf" components improves the overall provision and design of the systems. No change to a custom protocol is necessary, i.e. So no self-produced solution is necessary, as you can fall back on existing solutions in new combinations. Overall, the development effort and the change effort can be reduced and at the same time the availability ensured.

It is also possible to achieve savings in components, for example in internal vehicle communication, such as CAN communication (Can transmitters or external microcontrollers, which should be mentioned in this context).

A faster data / measured value transmission in the sense of a refresh rate of the protocols, the updater rate, a higher number of message packets or useful data per time is also made possible. This also arises because of a shorter one

"Telegram length" when maintaining or increasing the protection. In particular, it can be provided that the first protection module and the second protection module are designed and set up such that the

Protection level of the first protection module differs from the protection level of the second protection module or vice versa. In particular, the aim is to ensure that a higher degree of protection can be achieved through a diversity of the protection than is the case with conventional methods.

In particular, it can be provided that the first protection module and the second protection module implement asymmetrical protection of the data to be sent. The asymmetry improves the protection and thus a higher degree of protection. At the same time, the effort is the

Overall, security measures are lower than with a symmetrical one

Protection, which at the same time strives for a very high degree of protection, is the case.

The strengths of the protection can be different in each case, so that in the later offsetting, i.e. in the comparison, an overall stronger protection, and with inverted data values, a higher resolution can be achieved.

The data can in particular be and / or comprise sensor data. Sensor data are to be used particularly advantageously here or the system presented works with sensor data particularly advantageously because they are often partially

safety-critical runtime and timing requirements are provided, for which other security methods, such as integrating or comparing several data values sent one after the other, are problematic and disadvantageous in terms of time.

In addition, it can be provided that the first protection module is designed and set up in such a way that a message counter functionality takes place or can take place on the first communication path.

In particular, protection can be provided against inserted and / or lost and / or repeatedly sent message packets. For example, it is conceivable that the message counters are so-called rolling counters, which enable protection against, among other things, inserted, lost or repeatedly sent message packets. The security strength here is in

Based on ISO 26262, for example, an average security level of 8 bits can be mentioned.

Furthermore, it can be provided that the first protection module is additionally designed and set up in such a way that an information redundancy functionality takes place or can take place on the first communication path in which a

At least a part of the useful data is secured by repeated and / or inverted storage in sent message packets. This can be, for example, a so-called information redundancy using redundant bits, i.e. a protection of a small part of the user data by repeated (possibly

inverted) storage in the message package. The strength here is a low strength of 4 bits.

It is also conceivable that the first protection module is additionally designed and set up in such a way that a CRC information redundancy functionality takes place or can take place on the first communication path, in which at least part of the useful data is secured by forming a checksum. With information redundancy ("CRC"), the user data is secured by forming a checksum, the strength of which, however, clearly depends on the length of the bits. A low strength of 4bit should be mentioned as strength.

It is conceivable, for example, that the first communication path is identical to the second communication path.

In particular, it can be provided that the second protection module is designed and set up in such a way that a message counter functionality takes place or can take place on the second communication path, in particular with protection against inserted and / or lost and / or repeatedly sent message packets. It is also conceivable that the second protection module is designed and set up in such a way that information redundancy functionality takes place or can take place on the second communication path in which at least part of the user data is protected by repeated and / or inverted storage in sent message packets .

It is also conceivable that the second protection module is additionally designed and set up such that a CRC information redundancy functionality takes place or can take place on the second communication path in which a

At least a part of the user data is secured by forming a checksum.

It is also conceivable that the information redundancy functionality of the second

The protection module is designed and created in such a way that the entire part of the user data is protected by repeated and / or inverted storage in sent message packets.

In addition, it can be provided that an adjustment module is further provided that is designed and set up in such a way that the means of the first and second

Protection module secured data are at least partially compared to each other after sending or receiving this data.

Further details and advantages of the invention will now be explained on the basis of an exemplary embodiment shown in more detail in the drawings.

Show it:

1 shows a first exemplary embodiment of a system for data transmission for a commercial vehicle;

2 shows a second exemplary embodiment of a system for data transmission for a commercial vehicle; and Fig. 3 shows a further, third embodiment of a system for

Data transmission for a commercial vehicle according to the present

Invention.

1 shows a first exemplary embodiment of a system 10 for data transmission for a utility vehicle (the utility vehicle is not shown in more detail).

The system 10 has a first communication path 12 and at least one second communication path 14.

The first communication path 12 has a first protection module 16.

The second communication path 14 also has a second protection module 18.

The first protection module 16 is designed and set up in such a way that it can protect data to be sent via the first communication path 12 in a first manner.

The second protection module 18 is designed and set up in such a way that it can protect data to be sent via the second communication path 14 in a second way that differs from the first way.

The system 10 can be used, for example, in connection with the communication of data from position sensors to a control unit of a

Commercial vehicle (electronic control unit (ECU)) or a microcontroller (pC).

An application for communication of data between

Sensors / highly integrated hardware elements are also conceivable.

It is also possible that the system is used to communicate data within the ECU or between control units. The system 10 can be designed as follows (with a focus on increased coverage) with non-diverse redundancy in the coverage measures:

The first communication path 12 with the first protection module 16 is created and designed such that the following measures are implemented:

As a first measure M1 of the communication security in the first

Communication path 12, MessageCounters ("rolling counters") are used, which provide protection, among other things. against inserted, lost or repeatedly sent message packets (strength, based on IS026262: medium, 8 bit).

As an additional second measure M2 in the first communication path 12 there is information redundancy ("redundant bits"), which provides protection for a (small) part of the user data by repeated (possibly inverted) storage in the message package (strength: low, 4 bits).

As a further, additional third measure M3 in the first communication path 12, there is a further information redundancy (“CRC”), which realizes a protection of the useful data by forming a checksum, the strength of which, however, clearly depends on the length of the bits (strength: low, 4 bits ).

The second communication path 14 with the second protection module 18 is created and configured in such a way that it is identical to the first

Communication path 12 is formed and secured with the first security module 16, i.e. the second communication path 14 with the second

Protection module 18 also implements the measures M1, M2 and M3, denoted in FIG. 1 by the reference symbols MT, M2 ‘and M3‘.

With the second communication path (with the same measures), the overall security of the

Increase the useful signal, but the basic weaknesses of the measures remain. For example (depending on the requirements of the application) the Measure of the "redundant bits" for large parts of the (possibly safety-critical)

User data area no protection at all.

FIG. 2 shows a second exemplary embodiment of a system 110 for data transmission for a utility vehicle (the utility vehicle is not shown in more detail).

The system 110 is identical in terms of its structural and functional features to the system 10 according to FIG. 1 and as described above

educated. Identical or comparable features are identified by a reference number increased by 100.

There are the following differences:

The system 110 can be configured as follows (with a focus on increased coverage) with diverse redundancy in the coverage measures:

As a first measure M1 of the communication security in the first

Communication path 112, MessageCounters ("Rolling Counters") are used, which provide protection, among other things. against inserted, lost or repeatedly sent message packets (strength, based on IS026262: medium, 8 bit).

As an additional second measure M2 in the first communication path 112, there is information redundancy (“redundant bits”), which provides protection for a (small) part of the user data by repeated (possibly inverted) storage in the message package (strength: low, 4 bits).

As a further, additional third measure M3 in the first communication path 112 there is a further information redundancy (“CRC”), which realizes a protection of the user data by forming a checksum, the strength of which, however, clearly depends on the length of the bits (strength: low, 4 bits ).

In contrast to the first exemplary embodiment according to FIG. 1 described above, the second communication path 114 is configured differently as follows: The first measure M4 in the second communication path 114 is information redundancy (“redundant bits”), which safeguards the entire part of the

User data through repeated (possibly inverted) storage in the message package (strength: high, 12bit).

As a further, additional second measure M5 in the second communication path 114, there is a further information redundancy (“CRC”), which realizes a protection of the user data by forming a checksum, the strength of which, however, depends clearly on the length of the bits (strength: low, 4 bits ).

The diverse safeguarding of the communication path enables one

downstream comparison logic, the strengths of the security measures

to combine profitably. With a suitable design, the lack of a message counter in the second communication path 114 becomes significant in practice

negligible / no influence on the overall security that can be achieved, while the increase in information redundancy can bring about a great gain in security (e.g. through redundancy of all or all of the safety significant bits).

One advantage of this architecture is that in this so-called diverse design, the (measurement) data transmission is more secure.

In addition, other diverse configurations are advantageous and can be implemented (for example, strong “CRC” when “redundant bit” or “rolling counter” is not used in a communication path). These options for diversified hedging are also included here, even if they are not given as an example down to the last detail.

Furthermore, the above example of the comparison logic enables not only the improved detection of communication errors but also the evaluation and methods of compensation. For example through a 2oo3 voting with an optimal / high

Resolution / accuracy of the user data area (12bit x 3 (+ 4bit x 1)). Advantage regarding

Robustness of communication and fail-operational properties. 3 shows a second exemplary embodiment of a system 210 for data transmission for a utility vehicle (the utility vehicle is not shown in more detail).

The system 210 is identical in terms of its structural and functional features to the system 10 according to FIG. 1 and as described above

educated. Identical or comparable features are identified by a reference number increased by 200.

There are the following differences:

The system 210 can be implemented as follows (with a focus on fast data availability, but with a high level of overall security) with diverse redundancy

Security measures should be designed:

As a “measure” M6, the communication path 212 can be trimmed to a short “telegram length” and a high transmission rate / update rate, e.g. by jumping in bits during the security measures. It is conceivable here, only (4bit) rolling counter, etc.

to use.

The communication path 214 can be equipped as "measure" M7 with a longer "telegram length" and strong security measures, e.g. with rolling counter, many redundant bits, strong CRC, or comparable safeguards.

It is also conceivable to coordinate the times so that, for example

Communication path 212 sends in an integer multiple of communication path 214.

This is particularly advantageous when implementing several

(System) functions with different requirements in terms of protection and timing as well as in the implementation of a (system) function that has different requirements in terms of 'performance timing' and 'protection timing'. An application example in this connection is given, for example, in connection with pressure sensors.

REFERENCE LIST

10 system

12 first communication path

14 second communication path

16 first protection module

18 second protection module

110 system

112 first communication path

114 second communication path

116 first protection module

118 second protection module

210 system

212 first communication path

214 second communication path

216 first protection module

218 second protection module

M1 measure

M2 measure

M3 measure

M4 measure

M5 measure

M6 measure

M7 measure

Claims

PATENT CLAIMS

1. System (10; 110; 210) for data transmission for a commercial vehicle, with at least one first communication path (12; 112; 212) and with at least one second communication path (14; 114; 214), the first communication path (12; 112 ; 212) has a first protection module (16; 116; 216) and wherein the second communication path (14; 114; 214) has a second protection module (18; 118; 218), the first protection module (16; 116; 216) such is created and set up to secure data to be sent via the first communication path (12; 112; 212) in a first way, and the second protection module (18; 118; 218) is created and set up in a second way, from the first Way in a different manner and / or in an at least partially identical manner to secure data to be sent via the second communication path (14; 114; 214).

2. System according to claim 1,

characterized in that

the first protection module and the second protection module are designed and set up such that the protection level of the first protection module differs from the protection level of the second protection module or vice versa.

3. System according to claim 1 or claim 2,

characterized in that

an asymmetrical protection of the data to be sent is realized by the first protection module and the second protection module.

4. System according to one of the preceding claims,

characterized in that

the data are at least partially or include sensor data.

5. System according to one of the preceding claims,

characterized in that

the first protection module (16; 116) is designed and set up in such a way that a message counter functionality takes place or can take place on the first communication path (12; 112), in particular with protection against inserted and / or lost and / or repeatedly sent Message packets takes place.

6. System (10; 110) according to one of the preceding claims,

characterized in that

the first protection module (16; 116) is designed and set up in such a way that an information redundancy functionality takes place or can take place on the first communication path (12; 112) in which at least part of the user data is protected by repeated and / or inverted Filing in sent

Message packets.

7. System (10; 110) according to one of the preceding claims,

characterized in that

the first protection module (16; 116) is designed and set up in such a way that a CRC information redundancy functionality takes place or can take place on the first communication path (12; 112) in which at least part of the user data is protected by forming a checksum he follows.

8. System (10) according to one of the preceding claims,

characterized in that

the second protection module (18) is designed and set up in such a way that a message counter functionality takes place or can take place on the second communication path (14), in particular with protection against inserted and / or lost and / or repeatedly sent message packets.

9. System (10; 110) according to one of the preceding claims,

characterized in that

the second protection module (18; 118) is designed and set up in such a way that an information redundancy functionality on the second communication path (14; 114) takes place or can take place in which at least part of the user data is secured by repeated and / or inverted storage in sent

Message packets.

10. System (10; 110; 210) according to one of the preceding claims,

characterized in that

the second protection module (18; 118; 218) is additionally designed and set up in such a way that a CRC information redundancy functionality takes place or can take place on the second communication path (14; 114; 214) in which a

At least a part of the user data is secured by forming a checksum.

11. System (10; 110) according to claim 9 or claim 10,

characterized in that

the information redundancy functionality of the second protection module (18; 118) is designed and created in such a way that protection of the entire part of the user data by repeated and / or inverted storage in sent

Message packets.

12. System (10; 110; 210) according to one of the preceding claims,

characterized in that

a comparison module is also provided that is designed and set up in such a way that the data secured by means of the first and second security modules (16; 18; 116; 118; 216; 218) are at least partially compared with one another after these data have been sent or received.