WO2021023694A1

WO2021023694A1 - Method for writing to a secure data area of a computer on an on-board vehicle bus

Info

Publication number: WO2021023694A1
Application number: PCT/EP2020/071768
Authority: WO
Inventors: Eric Abadie; Sébastien BESSIERE
Original assignee: Renault S.A.S; Nissan Motor Co., Ltd.
Priority date: 2019-08-06
Filing date: 2020-08-03
Publication date: 2021-02-11
Also published as: FR3099835A1; FR3099835B1

Abstract

To write values of a data structure from a first computer (10) on board a vehicle to a secure data area (67, 68) of a second computer (9, 12, 13, 14) on board the vehicle, the method comprises steps of: - issuing a primary command to write a current signature contained in a write request to write values of the data structure, received by the first computer (10) from a remote server, the write request also comprising an identifier of the second computer, an identifier (DID) of said secure data area, the values of the data structure to be written; - checking that the current signature is able to be received independently of the values of the data structure to be written; - issuing a primary command to write values of the data structure if the current signature relates to the values of the data structure to be written; - checking that the current signature relates to the values of the data structure to be written when the current signature is able to be received; - writing the values of the data structure to the secure area (67, 68) of the second computer (9, 12, 13, 14) if the current signature relates to the values of the data structure to be written.

Description

DESCRIPTION

TITLE: Writing process in a secure data area of a computer on a vehicle's on-board bus.

The invention relates to a method for writing to a data area of a computer on a vehicle on-board bus when the data area is secure. The invention relates in particular to a method for writing a data structure from a first computer on board a vehicle, in the secure data area of a second computer on board the vehicle.

The method according to the invention is particularly useful for carrying out updates to vehicle configurations by assigning new values to the parameters managed by the on-board computers.

Updates to on-board computers and the execution of real-time programs generally require the issuance of commands on one or more on-board buses. Time counters are generally implemented to monitor the length of time between issuing a command and receiving a response to that command, with the drawback of increasing the time as the quantity of commands increases.

Such updates constitute intrusions on the vehicle's on-board network for which it is necessary to ensure their legitimacy.

For example, document WO2016 / 055730 discloses a method for real-time detection of intrusion into an on-board vehicle communication network. The disclosed method comprises steps consisting in observing a flow of messages circulating on the on-board network and in detecting an intrusion when the observed flow contains a prohibited message. The simple writing of values in a data structure can be satisfied with a single message constituted by a command to write values whose authenticity is checked by a digital signature. However, the verification of the authenticity of data by a signature presents drawbacks among which we can cite those of calling upon substantial computing resources to perform the operations. encryption and decryption. Mention may also be made of the risks of blocking the system due to the time required for the encryption and decryption operations, which may prove detrimental to the real-time operations which are executed in parallel.

To remedy the drawbacks posed by the prior state of the art, the subject of the invention is a method for writing values of a data structure from a first computer on board a vehicle, in a secure zone of data from a second computer on board the vehicle, comprising steps consisting in:

- issue a main write command for a current signature contained in a write request for the values of said data structure, received by the first computer from a remote server, the write request further comprising a identifier of the second computer, an identifier of said secure data area, the values of the data structure to be written;

- check that the current signature is admissible independently of the values of the data structure to be written;

- issue a main command for writing the values of the data structure provided that the current signature relates to the values of the data structure to be written;

checking that the current signature relates to the values of the data structure to be written when the current signature is admissible;

- write the values of the data structure, in the secure zone of the second computer if the current signature relates to the values of the data structure to be written.

In particular, the method comprises a step consisting in verifying that the current signature is admissible on the condition at least that the second computer shares the same confidence value with a third computer.

More particularly, the confidence value is the value of a previous signature, linked to a previous write request received. More particularly also, the method comprises steps consisting in:

- issue the main command for writing the current signature, by sending from the first computer, an auxiliary command for writing a description of the main command for writing the current signature to the third computer;

- send from the third computer, an auxiliary command for writing the confidence value to the second computer;

- check in the second computer that the current signature is admissible.

Even more particularly, the method comprises steps consisting in:

- send from the third computer, an auxiliary command for writing the current signature value to the second computer;

- check in the second computer that the current signature is admissible on condition that, moreover, the confidence value is different from the current signature value.

Advantageously, the method comprises steps consisting in:

- issue the main command for writing the values of the data structure, by sending from the first computer, an auxiliary command for writing a description of the main command for writing the values of the data structure to the destination the third calculator;

- check in the third computer that the current signature relates to the values of the data structure to be written.

Preferably, the signature also relates to an identifier of the vehicle.

Advantageously, the method comprises a step consisting in:

- send from the third computer, an auxiliary command for writing the values of the data structure so as to write the values of the data structure, in that of the secure zones of the second computer, provided that the current signature relates to the values of the data structure to write. Particularly, the data structure includes an anti-replay value, so that the method includes a step of:

- check that the anti-re-execution value, received with the auxiliary command for writing the values of the data structure, is greater than an anti-re-execution value previously received by the second computer.

More specifically, the anti-replay value is an integer that encodes a date expressed in year, month, day, hour, minute, second.

The method is remarkable in that its implementation in the second computer comprises a machine with finite number of states. Other advantages and characteristics of the invention will become apparent on reading the detailed description of the embodiments and embodiments, by way of illustrative and non-limiting examples, with reference to the accompanying drawings in which:

Figure 1 shows schematically an on-board vehicle system on which the invention is implemented;

Figure 2 shows schematically the command frames with which the invention is implemented;

Figure 3 shows process steps according to the invention, relating to a recognition phase; Figure 4 shows process steps according to the invention, relating to a current signature transmission phase;

Figure 5 shows process steps according to the invention, relating to the transition to a writing phase that is secure per se;

Figure 6 shows process steps according to the invention, relating to the secure writing phase per se.

Figure 1 shows two computers 9, 10 connected to an onboard bus 1 in a vehicle, and three computers 12, 13, 14 connected to an onboard bus 2 in the vehicle. The computer 9 is for example an on-board computer dedicated to IVC (In Vehicle Communication) type telecommunications. The computer 10 is for example an on-board computer of the IVI (In Vehicle Infotainment) type, the data processing capacities of which are comparable to those of a microcomputer. Other on-board computers, not shown, can be connected to the on-board bus 1. The computers 12, 13, 14 connected to the on-board bus 2 are preferably on-board computers for controlling and monitoring components of the vehicle of the ECU (Electronic) type. Control Unit). A computer 11 connected to the on-board bus 1 and to the on-board bus 2, acts as a gateway between the two on-board buses.

The on-board computer 12 comprises several areas 63 to 68 of rewritable memory for permanently storing data which are written therein, in particular by means of the method described below. Each memory zone is accessible in reading and writing by means of a data structure identifier, under the control of a memory access mechanism of the on-board computer 12. Purely by way of illustration and not limitation, the zone 63 dedicated to the permanent storage of a digital signature is accessible only in the computer 12 by an identifier of constant hexadecimal value F0A5 but is not directly accessible either in reading or writing by a command external to the computer 12. Similarly, the dedicated zone 64 the temporary storage of the digital signature is accessible only in the computer 12 by an identifier of constant hexadecimal value F0A6 but is not directly accessible either in reading or in writing by a command external to the computer 12. Each of several zones 65, 66 dedicated to a free writing of data structure values, is accessible in reading and writing by an external command by means of an identifier <DID> of distinct value which varies according to the zone 65, 66. Each of several zones 67, 68 dedicated to a secure writing of data structure values, is accessible only in read mode by a command external by means of an identifier <DID> of distinct value which varies according to the zone 67, 68 to which it is addressed, but is not accessible in writing by a command external by means of an identifier <DID> only under the particular control of the method explained in the remainder of the description.

The on-board computers 13, 14 contain rewritable memory areas (not shown) arranged in a similar manner to those of the on-board computer 12.

The on-board computer 11 includes several rewritable memory areas for permanently storing, and each accessible for reading and writing by means of a data structure identifier. For purely illustrative and non-limiting, a zone 61 constantly dedicated to the storage of a command is accessible by an identifier of constant hexadecimal value, for example F0A3, a zone 62 constantly dedicated to the storage of a response is accessible by a constant hexadecimal value identifier eg F0A4.

FIG. 3 shows process steps for securely writing values of a data structure from the first computer 10 on board the vehicle, in a first secure data area of a second computer 9, 12, 13, 14 in the vehicle. A data structure consists of a set of one or more numeric values, ordered to each instantiate a variable. At least one variable corresponds to an operating parameter of the vehicle. Advantageously, an additional variable corresponds to an anti-re-execution parameter. The data structure then further contains an anti-replay value which is designed to be consistently greater than a previously received anti-replay value. The anti-replay value can for example encode a date expressed in years, days, hours, minutes, seconds.

The computer 10 initially in a standby step 100, passes to a step 102 when a secure write request submitted by a higher order method, for example a method of configuring the computer 12, validates a transition 101. The request secure writing originates in particular from a remote server, directly by telecommunication, or indirectly by connection to the vehicle of a digital storage device. By way of illustration, the secure write request may contain a computer identifier among the computers 12, 13, 14 connected to the on-board bus 2, in this case the identifier of the computer 12 for the explanations which follow. The computer identifier can consist of a computer address conforming to the communication protocol of bus 2, of CAN (Controller Area Network), Flex Ray or TTP type also known in the aeronautical field, automotive Ethernet or other. The computer identifier can also consist of an ASCII character string, in particular an acronym which names the computer in its functional universe, for example “BCM” (Body Control Module for cash register control module), “HEVC” ( Hybrid Electric Vehicle Controller), "ADAS" (acronym for Advanced Driver Assistance System) or other. An ASCII character string has the advantage of being able to designate a computer independently of an embedded system architecture. A string of ASCII characters also has the advantage of being a mnemonic device that is more easily understood by humans. By way of further illustration, the write request may contain a data identifier <DID> in the identified computer.

The secure write request contains in particular the values of the data structure to be written in the secure zone of the second computer, a secure zone identifier <DID> in the memory of the second computer in which to write the values of the data structure, and a current signature which relates at least to said data structure.

In step 102, the computer 10 generates two main write commands by constructing for each a description of the main write command from the request which validated the transition 101. A first main write command aims to make write, by the second computer 12, the current signature in the zone 63 of its rewritable memory. The zone 63, of secure or non-secure data, is addressed for purely illustrative and non-limiting purposes by the identifier F0A5. A second The main write command is to have the second computer 12 write the data structure in that of areas 67, 68 of its rewritable memory, indicated by the identifier <DID> of the data area in which the request secure write received, requests to write the values of the current data structure. While the data area 63 remains the same for any write request received, successive write requests can address different data areas 65, 66, 67, 68 by identifiers <DID> of different values.

In step 102, the computer 10 then generates a first auxiliary command for writing the description of the first main command in a first dedicated data area 61, resident in the memory of the computer 11. The data area 61 is addressed purely. illustrative and non-limiting by the identifier F0A3 in the remainder of the description of the steps of the method.

FIG. 2 shows an example of an auxiliary write command which comprises a frame 21. The frame 21 comprises a field 31 identifying the command generated as a write command, a field 32 identifying the first dedicated zone 61, and at least a field 33, 34, 35, 36 to contain the description 27 of the main command.

The field 33 which makes up the description 27, gives a type of main order. Purely by way of illustration and without limitation, the type of main command is for example identified by two letters in ASCII code. The first letter identifies a main command class, in this case "W" for write. The second letter in combination with the first identifies an action within the main command class, in this case, "WD" to write a data structure. The field 34 which makes up the description 27, gives an on-board computer identifier, in particular as indicated in the request, in other words in the form of an acronym which names the final destination computer. The fields 35, 36 which make up the description 27, contain parameter values useful for the execution of the main command. In the example illustrated by FIG. 3, the parameter field 35 contains as parameter useful for the computer 11 to participate in the processing of the main command, the data identifier to be written which is that of the zone 63 in which to write the signature, purely by way of illustration and without limitation, the value identifier F0A5, and the current signature value. The parameter field 36 contains, as a parameter useful to the computer 11 to participate in the processing of the main command, a current signature value.

More particularly, the use of a write command conforming to the UDS protocol for unified diagnostic services has the advantage of benefiting from the mechanism generally preinstalled in a majority of on-board computers in the automotive world, in particular for performing diagnostic functions. , without having to modify the lower communication layers to implement the secure writing method according to the invention. In this particular case, field 31 then contains the SID (Service Identifier for service identifier in English) $ 2E which is the known hexadecimal code of a data entry by identifier DID, here of value F0A3 contained in field 32.

A transition 103 going from step 102 to step 104 is validated when the computer 11 is detected ready to respond to the first auxiliary write command supported by the frame 21. In this way, if the computer 11 performs a gateway function for another instance of the writing method according to the invention, or a gateway function for a command generated by another method such as for example a diagnostic method, the computer 10 remains on standby on step 102. The computer 10 does not unnecessarily encumber the bus 1 with attempted transmission of commands which would have no effect due to the occupation of the computer 11 by other functions. In the example of a processing in progress of a diagnostic command specific to another method, the momentary placing on standby of the secure write method on step 102, allows the execution of the diagnostic command without having to interrupt the diagnostic process. Several solutions can be considered for detecting whether the computer 11 is ready to respond to the auxiliary write command supported by the frame 21. For example in the case where the computer 10 is the only one to communicate with the computer 11 on the bus 1. , an upper scheduling layer in the computer 10, could control the ready state or not of the computer 11. This solution would be difficult to implement when another computer 9, would dialogue with the computer 11 on the bus 1, for example example to run a remote diagnostic. Otherwise, the computer 10 could for example observe the bus 1 in order to detect there the frames intended for the computer 11, for which the computer 11 would not be ready to respond to the write command supported by the frame 21. This other solution would present quickly a problem of complexity in the event of numerous methods taking the route of the bus 1. Other solutions can be envisaged without departing from the scope of the invention.

According to a preferred solution for detecting whether the computer 11 is ready, it is the computer 11 which declares itself ready or not to process the commands issued as part of the secure writing process according to the invention. The computer 11 periodically transmits on the bus 1, a signal comprising two states, ready, busy.

In an initial standby step 300, the computer 11 sets the signal to the ready state by default. As soon as the computer 11 receives a command, whether it be from the secure writing method according to the invention or from any other method such as for example from the diagnostic method, the computer 11 positions the signal in the occupied state until it has finished processing the current order.

In step 104, the computer 11 having been detected ready to respond to the write command, the computer 10 sends the main current signature write command, sending its description in the first auxiliary write command to the computer 11. To issue the auxiliary write command which is the auxiliary write command for the description of the first main command, the computer 10 can encapsulate the frame 21 in a CAN frame on the bus 1, or in another way, by example encapsulate the frame 21 in a frame over IP if the vehicle Ethernet protocol is used on bus 1.

A reception of the first auxiliary write command, in other words of the auxiliary write command of the description of the first main command, in the computer 11, validates a transition 301 which is necessary to make the computer 11 go through. the initial step 300 to a step 302 in which the computer 11 sends to that of the computers 12, 13, 14 identified in the field 34, for example the computer 12, a second auxiliary write command to process the first command main, from the description 27 of the main control, written in the dedicated data zone 61 of the computer 11.

Upon validation of the transition 301, the computer 11 executes in step 302 the first auxiliary write command and sends the computer 10 an acknowledgment of good execution. In addition, the computer 11 positions in step 302, the periodic signal in the busy state.

In the particular case of FIG. 3 for which the first main command is a command for writing the current signature in the computer 12, FIG. 2 gives an example of a second auxiliary command which comprises a frame 29 comprising a field 53 of identification of write command, a field 54 for identifying a data zone resident in the computer 12, with a field 55 which contains at least one value to be written in the data zone identified by the field 54.

More particularly, the use of a write command conforming to the UDS protocol of unified diagnostic services, has the above mentioned advantages. In this particular case, field 53 then contains the SID $ 2E which is the known hexadecimal code of a data entry by DID identifier.

For example, in the case of the use of the UDS protocol, the acknowledgment of proper execution of the first auxiliary write command is materialized by a frame 22 of which a first field 37 contains the SID code of value $ 6E, and of which a second field 38 contains the value of the field 32 of the frame 21 to allow the computer 10 to recognize the write command sent to which corresponds l 'acknowledgment of receipt received. In other words, the field 38 constitutes an identifier field of the first dedicated zone 61, by way of illustration of the value F0A3.

In a first variant of implementation of the method for which the computer 12 has sufficient calculation resources to process the conformity of the current signature to the data structure to be written, the computer 11 places in step 302, directly in the field 54 the identifier of the data zone 63, in this case of value F0A5, intended to contain the current signature.

In a second variant implementation of the method for which the recipient computers 12, 13, 14 do not have sufficient calculation resources to process the conformity of the current signature to the data structure to be written, the computer 11 accesses an associative table which lists, for each computer identifier, a previous signature received before the current signature. The previous signature is listed in the associative table as being currently equal to the content of the data zone 63 identified here by the value F0A5 of the computer identified by its trigram. In step 302, the computer 11 places in the field 54 not the identifier of the data zone 63 intended to contain the current signature, as indicated in the first description of the main write command, but an identifier of the zone 64 of intermediate data, of value for example equal to F0A6, purely by way of illustration and not by way of limitation. Concomitantly in step 302, the computer 11 places in the field 55 the a priori content of the data zone 64 as given by the associative table.

A reception by the computer 10 of the periodic signal positioned in the busy state, or of the frame 22, validates a transition 105 which causes the process of step 104 to step 106 in computer 10. In step 106, computer 10 waits for the signal positioned in the ready state.

The steps described now with reference to FIG. 3 correspond to the second variant implementation of the invention, which is particularly advantageous for the computer 12 which does not have sufficient computing resources to process a signature compliance. The computer 12 initially in a standby step 200 of the secure writing process according to the invention, validates a transition 201 when it receives the auxiliary command materialized by the frame 29 sent by the computer 11 on the onboard bus 2. A validation of the transition 201 activates a step 202 in which the computer 12 positions a machine state with a finite number of states, on an initial state value, for example of value 0x00.

In step 202, the computer 12 checks whether the content of the associative table which corresponds to it, as it is received by the second auxiliary write command, is equal to the previous signature that it contains in the data zone 63 The verification carried out in step 202 makes it possible to ensure that the computer 11 and the computer 12 share the same confidence value which is here that of the previous signature.

A mismatch between the previous signature value contained in the data area 63 and that received by the second auxiliary write command, validates a transition 203 which activates a step 204.

In step 204, the computer 12 sends to the computer 11 a negative response signifying a non-acknowledgment or in other words an acknowledgment of improper execution of the second auxiliary write command. The computer 12 then returns to the initial step 200 because the secure writing of the request has failed. A frame 30 illustrated in FIG. 2 can materialize the negative response by taking again in fields 56, 57, 58 the values of the fields 53, 54, 55 of the frame 29 and by adding a field 59 which contains a non-acknowledgment value. A match between the previous signature value contained in the data zone 64 and that received by the second auxiliary write command, validates a transition 205 which activates a step 206.

In step 206, the computer 12 positions the finite number of state machine on an acknowledged recognition phase state, for example but not necessarily of value 0x05.

In step 206, the computer 12 issues a positive response signifying an acknowledgment or in other words an acknowledgment of proper execution of the second auxiliary write command. The frame 30 illustrated in FIG. 2 also makes it possible to materialize the positive response by taking again in fields 56, 57, 58 the values of the fields 53, 54, 55 of the frame 29 and by placing in the field 59 an acknowledgment value.

The shared trust value in the example implementation described above is the last signature value received in a previous secure write. Other shared trust values can be used such as the last anti-replay value received in a previous secure write. The remainder of the description is based on the signature value previously received because it is considered easier to implement. Those skilled in the art would be able to adapt the remainder of the description for another shared trust value such as the last anti-replay value received if they preferred not to use the last signature value received.

Thus the second auxiliary write command constitutes an auxiliary write command with a confidence value shared by the second computer 12 and by the third computer 11.

FIG. 4 shows the process steps following the steps represented in FIG. 3, in particular for transmitting the current signature to the second computer when it is appropriate so. Receipt of a negative response by the computer 11 validates a transition 303 which passes the method from step 302 to a step 308 in which the computer 11 constructs a description of a negative response to the first main write command in the computer 12. The response description is based for example on a response description 28 which comprises fields 43, 44, 45, 46 to each respectively contain the values of the fields 33, 34, 35, 36 of the order description 27 so as to identify that the response description is indeed that which corresponds to the description of the first main write command. The response description 28 further includes a field 47 for containing a value indicating that the content of field 45 has not been written to area 63 of the rewritable memory of computer 12.

In a step 312 carried out directly following step 308, the computer 11 places the value 0x0000 in the field 47 then stores the response description 28 in a second data area 62, resident in the memory of the computer 11, dedicated to contain the response to the command stored in zone 61. In step 312, the computer 11 then positions the periodic signal in the ready state. The computer 11 can also more simply place the single value 0x0000 in the zone 62 to indicate the failure to execute the first main write command, without constructing the response description exposed in the previous paragraph.

Receipt of a positive response by the computer 11 validates a transition 305 which switches the method from step 302 to a step 306 in which the computer 11 issues a third auxiliary write command to the computer 12, in the form here again frame 29. Field 54 of frame 29 this time contains the identifier of the effective data zone to write the current signature there, for example purely by way of illustration, the value F0A5 to identify the data zone 63. Thus, the third auxiliary write command constitutes an auxiliary current signature write command. A reception of the auxiliary command for writing the current signature by the computer 12, validates a transition 207 which activates a step 208 in which the computer 12 verifies that the machine with finite number of states is indeed in the phase state of acknowledgment acknowledged. The acknowledgment phase state has the technical effect of reinforcing confidence in the origin of the current signature writing auxiliary command.

A negative check of the acknowledgment phase state validates a transition 209 which activates a step 210.

In step 210, the computer 12 sends to the computer 11 a negative response signifying a non-acknowledgment or in other words an acknowledgment of improper execution of the third auxiliary write command. The computer 12 then returns to the initial step 200 because the secure write has failed.

A positive check of the acknowledgment phase state validates a transition 211 which activates a step 212.

In step 212, the computer 12 positions the finite number of state machine in the initial state, for example in the aforementioned case, of value 0x00. The exit from the acknowledgment phase state protects the process against various problems, including that of an intrusive command reception following the auxiliary command to write the current signature. In step 212, the computer 12 further verifies that the signature value received by the third auxiliary write command is different from the content of the data zone 64 which hitherto contains the previous signature value. The current signature value should not be the same as the previous signature value which relates to previously written data structure values.

A signature value received by the third auxiliary write command, equal to the content of the data zone 63 identified for example by the value F0A5, validates a transition 213 which activates step 210 described above. Receipt of a negative response to the third auxiliary write command by the computer 11, validates a transition 307 which activates step 308 described above.

A signature value received by the third auxiliary write command, different from the content of the data area 63, validates a transition 215 which activates a step 216

In step 216, the computer 12 writes the current signature value in the zone 64, identified for example by the value F0A6 as above. When the machine with a finite number of states is used to reinforce security, the computer 12 positions the machine in an acknowledged second phase state, for example purely by way of illustration and without limitation, of value 0x0F. Finally, the computer 12 issues a positive response signifying an acknowledgment or in other words an acknowledgment of proper execution of the third auxiliary write command. Receipt of a positive response to the third auxiliary write command by the computer 11, validates a transition 309 which activates a step 310 in which the computer 11 constructs a description of a positive response to the first main write command in the computer 12 As above, the response description 28 preferably comprises fields 43, 44, 45, 46 which each contain respectively the values of fields 33, 34, 35,

36 of the command description 27 to identify that the response description is indeed that which corresponds to the description of the first main write command. The response description 28 also includes the field 47 to contain the value finally written in the data zone 63 of the computer 12. In a step 314 carried out directly following step 310, the computer 11 places the current signature value. in the field 47 then stores the response description 28 in the second dedicated data zone 62, resident in the memory of the computer 11. In step 314, the computer 11 then positions the periodic signal in the ready state. A transition 107 is validated when the computer 10 detects that the computer 11 is ready to respond. In the case of a preferred embodiment of the invention, the transition 107 is validated by the reception of the periodic signal in the ready state. A validation of the transition 107 activates a step 108 in the computer

10. In step 108, the computer 11 having been detected ready to respond to a read command, the computer 10 issues a first auxiliary read command from the second dedicated zone 62, intended for the computer 11. The auxiliary read command is given. for example materialized by a frame 23 as shown in FIG. 2. The frame 23 comprises a command identification field 39 as a read command, and a field 40 identifying the second dedicated data area 62, identified with purely illustrative and non-limiting by the value F0A4.

In particular, in the advantageous case of using the UDS protocol, the field 39 contains the value $ 22 which identifies a read command, and the field 40 contains for example a value F0A4 of DID which is the address of the dedicated zone 62 of data in the memory of the computer 11 in the example illustrated above.

A transition 315 is validated when the computer 11 receives the auxiliary read command materialized by the frame 23.

A validation of the transition 315 activates a step 316 in which the computer 11 sends a response to the computer 10. The response to the auxiliary read command received comprises a frame 24 which comprises a field 41 of the response command identifier field. reading, and an identifier field 42 of the second dedicated area 62, so as to be able to verify that the frame 24 constitutes the response to the read command materialized by the frame 23. The frame 24 subsequently contains the description 28 which comprises the fields 43, 44, 45, 46 each containing a value respectively equal to that contained in each of the fields 33, 34, 35, 36 to recall the description of the first main write command. Description 28 also includes field 47 which contains the value set in step 312 if the first main write command failed, or which contains the value set in step 314 if the first main write command was successful.

Thus ends the phase of transmission of the current signature to the on-board computer 12. It will be noted that, by declaring itself not ready from the start of the recognition phase to the end of the phase of transmission of the current signature, the computer 11 closes the access gate to the bus 2 via the areas 61 and 62 of its memory, so that the processing of the first main write command behaves like an atomic operation processing without the possibility of interruption by another command before the end of treatment.

Figure 5 shows process steps following the steps shown in Figure 4.

Following step 108, a transition 109 is validated when the computer 10 receives the response to the read command, materialized by the frame 24.

A validation of the transition 109 activates a step 110 in which the computer 10 waits for reception of the periodic signal in the ready state if the response received is positive, and returns to the initial step 100 if the response received is negative. because in the latter case, the secure writing process cannot continue.

A reception in the computer 10 of the periodic signal in the ready state, validates a transition 111 which activates a step 112 in which the computer 10 issues the main command for writing values of the data structure, by sending its description in a fourth auxiliary write command which contains the description of the second main write command. Thus, the fourth auxiliary write command intended for the computer 11 constitutes an auxiliary write command for the description of the main command for writing data structure values.

A reception of the fourth auxiliary write command in the computer 11, validates a transition 317 necessary to pass the computer 11 from step 316 to a step 318 which enables computer 11 to subsequently send to that of computers 12, 13, 14 identified in field 34, for example computer 12, a fifth auxiliary command d writing to process the second main command, based on the description 27 of the main command which is written in the dedicated data zone 61 of the computer 11.

Upon validation of the transition 317, the computer 11 executes in step 318 the fourth auxiliary write command and sends the computer 10 an acknowledgment of good execution. In addition, the computer 11 positions in step 317, the periodic signal in the busy state.

In the particular case of FIG. 5 for which the second main command is a command for writing data structure values in the computer 12, FIG. 2 gives an example of a fifth auxiliary command which comprises a frame 29 comprising a field 53 d 'write command identification, a field 54 for identifying the computer 12 and a data area resident in the computer 12, with a field 55 which contains the values of the data structure to be written in the data area identified by field 54.

More particularly, the use of a write command conforming to the UDS protocol of unified diagnostic services has the advantages mentioned above. In this particular case, the field 53 then contains the SID $ 2E which is the known hexadecimal code of a data entry by identifier DID. The field 54 contains the DID identifier of the data zone 67, 68 of the computer 12 which was indicated in the field 35 of the frame 21. For example, in the case of the use of the UDS protocol, the acknowledgment of good execution of the auxiliary write command is materialized by a frame 22 of which a first field 37 contains the SID code of value $ 6E, and of which a second field 38 contains the value of the field 32 of the frame 21 to allow the computer 10 to recognize the write command issued to which matches the acknowledgment received. In other words, the field 38 constitutes an identifier field of the first dedicated zone 61.

Note that the fifth auxiliary write command constitutes an auxiliary write command for values of the data structure.

In a first variant of implementation of the method for which the computer 12 has sufficient calculation resources to process the conformity of the current signature to the values of the data structure to be written, the computer 11 places in step 318, directly in the field 54 the identifier DID of the secure data zone, intended to contain the data structure, so as to send the fifth auxiliary command directly to the computer 12.

In a second variant implementation of the method for which the recipient computers 12, 13, 14 do not have sufficient calculation resources to process the conformity of the current signature with the values of the data structure to be written, the computer 11 does not issue the fifth auxiliary write command but activates a step 320 following step 318.

Reception by the computer 10 of the periodic signal positioned in the busy state, or of the frame 22, validates a transition 113 which causes the process to go from step 112 to a step 114 in the computer 10. In step 114 , the computer 10 waits for the signal positioned in the ready state.

Thus, the steps carried out following the transition 109 to steps 320 and 114, carry out a transition phase to the phase of writing the values in itself secure, controlled by a positive execution of the two preceding phases.

The steps relating to the secure writing phase per se which are now described with reference to FIG. 6, correspond to the second implementation variant of the invention, which is particularly advantageous for the computer 12 which does not have computer resources. calculation sufficient to process a signature conformance. Figure 6 shows process steps following the steps shown in Figure 5.

In step 320, the computer 11 checks whether the current signature and the values of the data structure received in the write request agree with each other. An improvement of the method may consist in further verifying that the current signature also matches a vehicle identification VIN number, for implementations in which it is received in the secure write request, the signature then also relates to the identification number VIN of the vehicle in which the computer 12 is installed. A lack of match relating to the signature validates a transition

321 which activates a step 326 in which the computer 11 constructs a negative response to the second main write command. In step 326, the computer 11 can send a signal to the computer 12 to make it go back directly to the initial step 200. A match relating to the signature validates a transition 323 which activates a step 324 in which the computer 11 effectively issues the fifth command. writing aid for the computer 12.

A reception of the fifth auxiliary write command in the computer 12, validates a transition 217 which activates a step 218 consisting of verifying whether the data structure identifier <DID>, received with the fifth auxiliary write command, is listed in calculator 12.

A transition 219 is validated if the data structure identifier <DID>, received with the fifth auxiliary write command, is not listed in the computer 12. A validation of the transition 219 activates a step 220 in which the computer 12 sends a write non-acknowledgment to computer 11. A transition 221 is validated if the data structure identifier <DID>, received with the fifth auxiliary write command, is listed in the computer 12.

Validation of the transition 221 activates a step 222 consisting in checking whether the data structure identifier <DID>, received with the fifth auxiliary write command, is listed in a list of secure data areas of the computer 12.

A transition 223 is validated if the data structure identifier <DID>, received with the fifth auxiliary write command, is not listed in the list of secure data areas of computer 12.

A validation of the transition 223 activates a step 224 in which the computer 12 positions the state machine in the initial state 0x00.

A step 236, activated following step 224, consists in writing the content of the fifth auxiliary write command in the data zone of the computer 12, identified at the head of the fifth auxiliary write command by the identifier <DID>. Step 236 in this case is particularly useful for the case where a non-secure write command, for example originating from a method other than that of the invention, would have been introduced accidentally between the first and the first. second main write command.

A transition 225 is validated if the data structure identifier <DID>, received with the fifth auxiliary write command, is listed in the list of secure data areas of the computer 12.

A validation of the transition 225 activates a step 226 consisting of verifying whether the state of the finite number of state machine is in state 0x0F with a positive response to the first main write command.

A transition 227 is validated if the machine with finite number of states is not on state 0x0F with a positive response to the first main write command. A validation of the transition 227 activates the step 220 in which the computer 12 sends a write non-acknowledgment to the computer 11.

A 229 transition is validated if the finite state machine is in state 0x0F with a positive response to the first main write command.

A validation of the transition 229 activates an optional step 230 consisting in verifying whether the anti-re-execution value, received with the fifth auxiliary write command, is greater than an anti-re-execution value previously received by the computer 12.

A transition 231 is validated if the anti-re-execution value, received with the fifth auxiliary write command, is not greater than the anti-re-execution value previously received by the computer 12.

A validation of the transition 231 activates the step 220 described above.

A transition 233 is validated if the anti-replay value, received with the fifth auxiliary write command, is greater than the anti-replay value previously received by the computer 12.

A validation of the transition 233 activates a step 234 in which the computer 12 copies into the zone 63 dedicated to the permanent storage of the current signature, the value contained in the zone 64 dedicated to the temporary storage of the current signature. This copy has the technical effect of being able to use the current signature of the values of the data structure received with the fifth auxiliary write command, as a signature previously validly received during a subsequent secure write.

Activated following step 234, step 236 then makes it possible to write the values of the data structure, as transmitted by the fifth auxiliary write command, in that of the secure zones 67, 68 of the computer 12 , which is identified at the head of the fifth auxiliary write command by the identifier <DID>. At the end of step 236, the computer 12 sends to the computer 11, a positive acknowledgment of the writing of values in the zone allocated to the data structure.

Returning to the initial step 200 marks the end of the steps performed in the computer 12 to perform the secure writing there. A write non-acknowledgment reception by the computer 11 validates a transition 325 which activates step 326 explained above.

A positive write acknowledgment reception by the computer 11 validates a transition 327 which activates a step 328 in which the computer 11 constructs a positive response to the second main write command. In step 328, the computer 11 copies the current signature into its associative table of validly received signatures, in association with the computer 12. It is considered that a signature is validly received when it corresponds to data structure values which have been validated. actually written in their destination area. If the shared trust value is assigned to a piece of data other than the current signature, it is in steps 236 and 328 that the new shared trust value is stored in each of the appropriate memory areas.

Following steps 326 and 328, a step 330 consists in setting to zero (in other words to be erased) the temporary signature address, for example F0A6. In step 330, the computer 11 positions the periodic signal in the ready state.

Receipt of the periodic signal in the ready state in the computer 10, validates a transition 115 which activates a step 116 in which the computer 10 issues a command to read the response contained in zone 62 of the computer 11, for example of an identifier. F0A4. A reception of the read command by the computer 11, validates a transition 331 which activates a step 332 in which the computer 11 sends the content of the zone 62 to the computer 10 in response to the read command, before returning to the initial step 300. Receipt of the response to the read command by the computer 10, validates a transition 117 which activates a step 118 in which the computer 10 prepares a negative or positive secure write report as a function of the response it has received. received from the computer 11. The method of the invention is not limited to the exemplary implementation described above.

For example, if the second computer 9 has sufficient resources to execute step 320, it can directly receive the two main write commands from the first computer 10 without going through the third computer 11. The computer 9 can then directly check the admissibility of the signature according to its own criteria.

For a second computer 12 having only few resources, we have seen above an example of sharing of a trust value with the third computer 11 to which the cryptographic signature processing is delegated. In the example illustrated above, step 302 allows the third computer 11 to send an auxiliary command for writing the confidence value to the second computer 12 to allow it to test whether it shares the same confidence value in step 202. The computer 12 can then send in step 206 a positive test result in the acknowledgment of receipt to the write command that it has received.

Claims

1. Method for writing values of a data structure from a first computer (10) on board a vehicle, in a secure data zone (67, 68) of a second computer (9, 12, 13, 14) on board the vehicle, comprising steps consisting of:

- issue (104) a main command for writing a current signature contained in a request for writing the values of said data structure, received (101) by the first computer (10) from a remote server, said write request further comprising an identifier of the second computer, an identifier (DID) of said secure data area, the values of the data structure to be written;

- verify (202, 208, 212) that the current signature is admissible independently of the values of the data structure to be written; - issue (112) a main command for writing the values of said data structure if the current signature relates to the values of the data structure to be written;

checking (320) that the current signature relates to the values of the data structure to be written when the current signature is admissible; - write (236) the values of the data structure, in the secure zone (67, 68) of the second computer (9, 12, 13, 14) if the current signature relates to the values of the data structure to be written.

2. Method according to claim 1, characterized in that it comprises a step (202) consisting in verifying that the current signature is admissible on condition at least that the second computer (9, 12, 13, 14) shares the same value. confidence with a third computer (11).

3. Method according to claim 2, characterized in that the confidence value is the value of a previous signature, linked to a previous write request received.

4. Method according to one of claims 2 or 3, characterized in that it comprises steps consisting in: - issue (104) the main command for writing the current signature, by sending from the first computer (10), an auxiliary command for writing a description of said main command for writing the current signature to the third calculator (11);

- send (302) from the third computer (11), an auxiliary command for writing the confidence value to the second computer (9, 12, 13, 14);

- check (202) in the second computer (9, 12, 13, 14) that the current signature is admissible.

5. Method according to claim 4, characterized in that it comprises steps consisting of:

- send (306) from the third computer (11), an auxiliary command for writing the current signature value to the second computer (9, 12, 13, 14);

- Check (212) in the second computer (9, 12, 13, 14) that the current signature is admissible on condition that, moreover, the confidence value is different from the current signature value.

6. Method according to one of claims 2 to 5, characterized in that it comprises steps consisting of:

- issue (112) the main command for writing the values of said data structure, by sending from the first computer (10), an auxiliary command for writing a description of said main command for writing the values of said data structure intended for the third computer (11);

- Check (202) in the third computer (11) that the current signature relates to the values of the data structure to be written.

7. Method according to one of claims 1 to 6, characterized in that the signature also relates to an identifier (VIN) of the vehicle.

8. Method according to claim 6, characterized in that it comprises a step consisting of:

- send (324) from the third computer (11), an auxiliary command for writing the values of said data structure in such a way to the values of the data structure, in that of the secure zones (67, 68) of the second computer (9, 12, 13, 14) if the current signature relates to the values of the data structure to be written.

9. Method according to claim 8, characterized in that said data structure comprises an anti-re-execution value, and in that it comprises a step consisting of:

- check (230) that the anti-re-execution value, received with the auxiliary command for writing the values of the data structure, is greater than an anti-re-execution value previously received by the second computer (9, 12 , 13, 14).

10. The method of claim 9, characterized in that the anti-re-execution value is an integer which encodes a date expressed in year, month, day, hour, minute, second.

11. Method according to one of the preceding claims, characterized in that the second computer (9, 12, 13, 14) comprises a machine with a finite number of states.