WO2022175536A1

WO2022175536A1 - Method for authenticating data between a control module and a lighting module for a motor vehicle

Info

Publication number: WO2022175536A1
Application number: PCT/EP2022/054288
Authority: WO
Inventors: Benoit PIRONNET; Patrice VOIRIN; Hafid El-Idrissi
Original assignee: Valeo Vision
Priority date: 2021-02-22
Filing date: 2022-02-21
Publication date: 2022-08-25
Also published as: CN116917891A; FR3120142B1; FR3120142A1; JP2024507245A

Abstract

The invention proposes a method for authenticating image data between a lighting module for a motor vehicle comprising a matrix light source having a plurality of elementary light sources, and a control module of a motor vehicle. The method is remarkable in that the projection of image data by the lighting module is carried out on condition of successful authentication.

Description

DATA AUTHENTICATION METHOD BETWEEN A CONTROL MODULE AND A LIGHTING MODULE FOR A MOTOR VEHICLE

The invention relates to lighting modules for motor vehicles. In particular, the invention relates to such modules involving pixelated light sources.

A light-emitting diode, LED, is a semiconductor electronic component capable of emitting light when it is traversed by an electric current having at least a threshold intensity. In the automotive field, LED technology is increasingly being used for various light signaling solutions. LED matrices are particularly interesting in the field of automotive lighting. Pixelated or matrix light sources can be used for functions of the "leveling" type, i.e., adjustment of the height of the light beam emitted, according to the attitude of the vehicle and the profile of the road. Other applications include DBL (Digital Bending Light) which corresponds to the adjustment of the direction of the light beam emitted, to follow the road in the horizontal plane, ADB (Adaptive Driving Beam) which corresponds to an anti-dazzle function which generates shadow areas in the light beam emitted by a main beam so as not to disturb other road users, but also functions for projecting patterns on the ground using the pixelated light beam .

It is known to use light sources of different types of technologies for the cited lighting applications. This is for example the monolithic technology, according to which a large plurality of elementary sources of the LED type, equivalent to pixels, are etched in a common semiconductor substrate. Integrated electrical connections allow the pixels to be activated independently of each other. Another known technology is that of microLEDs, which generates a matrix of LEDs of small dimensions, typically less than 150 μm. There are also modules of the micro-mirror type, DMD (“Digital Micro-Mirror Device”), which involve projection technology using an intensity modulator on a uniform beam. Micro-mirrors, the position of which is controlled by means of piezoelectric elements, are oriented so as to selectively reflect an incident light beam, so that each micro-mirror corresponds to an elementary source of the matrix of pixels thus generated . The light coming from a source is directed onto the matrix of micro-mirrors by an optic. This light therefore has a variable distribution from one module to another, due to the positioning and manufacturing tolerances of the optics and the light source. This generates a variable maximum intensity from one module to another, for a given pixel. In this case, each pixel will have a different maximum intensity depending on the command transmitted to it. Such lighting devices are designed by mass production methods. There is necessarily a clearance between the constituent elements of the lighting and/or signaling device on the one hand to allow easy assembly, and on the other hand because the parts are generally not machined but rather molded in plastic, which which reduces production costs.

It should be emphasized, in particular, the difficulty of perfectly aligning a micro-mirror matrix with the optical projection part, which generally comprises at least one lens. Due to the large numerical aperture of the lens used for the projection function, the image projection quality deteriorates significantly as soon as the lateral shift of the optical axis reaches a few micrometers. In practice, distortions of the projected image are therefore inevitable using solutions known in the art. Each projection module of this type has its own set of optical characteristics, in particular geometric aberration characteristics, including optical distortion and spherical aberration properties. During the production of micro-mirrors, geometric aberrations can be introduced. All these elements result in non-homogeneous behavior of the matrix light source.

All of these aforementioned modules have their own characteristics linked to the combination of the manufacturing tolerances of the components. During the production of semiconductor components such as LEDs or LED arrays, direct current variations are currently unavoidable. It follows that in a given matrix of LEDs, at equal load current, the LEDs emit light beams of variable, non-homogeneous intensities. While it is possible to correct projection instructions in order to take into account the electronic and/or optical specificities of a lighting module, when a fault occurs at the level of the lighting module, it is important to be able to project a default image that fails to dazzle other road users.

During pairing between a control module of a motor vehicle and a lighting module, data describing the characteristics of one or the other of the modules can be exchanged between the modules in order to be able to take account when operating the motor vehicle. These parameters are specific to the lighting module instance and can be different between two lighting modules from the same manufacturing process. It is therefore important to be able to ensure the concordance between the parameters exchanged during pairing and the parameters used during operation of the lighting module – all the more so in the event of a possible exchange of the module. lighting.

It has been proposed to drive pixelated light sources in voltage: a common electric voltage is applied to all the elementary light sources which form the matrix of the pixelated light source. The intensity of the electric current which passes through each elementary light source is then controlled by means of a pulse-width modulated signal. The duty cycle of the signal has an impact on the average intensity of the current, which in turn influences the degree of luminosity emitted by the elementary light source. In order to prevent a thermal runaway situation, an electrothermal calibration dependent on the individual characteristics of each matrix light source must be stored in a control module, for example when pairing the two modules in question. A thermal runaway occurs when a semiconductor junction of an elementary light source heats up following the electric current passing through it, which implies that the intensity of this electric current increases further, until the junction either damaged or destroyed. An erroneous calibration does not prevent this situation.

The invention aims to overcome at least one of the problems posed by the prior art. More specifically, the aim of the invention is to propose a method for authenticating data between a control module of a motor vehicle and a lighting module controlled by the latter.

transmission de données d’image comprenant au moins un facteur d’authentification du module de commande vers le module d’éclairage ;
suite à la réception desdites données d’image au niveau du module d’éclairage, vérification du facteur d’authentification moyennant une unité de calcul;
au niveau du module d’éclairage, abandon de la communication avec le module de commande si ladite vérification échoue, sinon poursuite de la communication.

According to a first aspect of the invention, a method for authenticating image data between a transmitter control module and a receiver lighting module for a motor vehicle is proposed. The two modules comprise a transmission unit respectively for receiving image data and are connected by a first channel for transmitting image data. The process is remarkable in that it includes the steps of:

transmission of image data comprising at least one authentication factor from the control module to the lighting module;
following receipt of said image data at the lighting module, verification of the authentication factor by means of a calculation unit;
at the level of the lighting module, abandoning the communication with the control module if said check fails, otherwise continuation of the communication.

By image data, we understand digital values of which at least a part represents an image intended to be projected by means of the receiver lighting module, that is to say that these are data transmitted within a frame as an integral part of the image intended to be projected by means of the receiver lighting module. This is particularly advantageous in the case where the data transmission channel between the transmitting control module and the receiving lighting module does not offer the possibility of circulating an authentication factor, for example when the rate provided for d 'data other than image data is very restricted, such as for certain channels dedicated to video.

Preferably, the receiver lighting module comprises a pixelated light source. In this case, the image data may for example comprise data organized in a matrix, each element of the matrix constituting a pixel associated with a digital value of the image data. Each pixel can be used to form a projected image by means of the pixelated light source and/or to participate in the formation of the authentication factor of the control module.

In one example, each pixel in the matrix is part of the image to be projected and some of the numeric values are changed so that the authentication factor. For example, a group of pixels located in an area of the image corresponding to an area usually illuminated when switching on a lighting function such as a low beam. For example, this information can be inserted by modifying the least significant bits (for example the 2 least significant bits) of the group of pixels.

In another example, not all pixels are part of the image to be projected and the image pixel matrix has additional rows and/or columns comprising authentication factor data.

Preferably, the method may include a step of projection of the image data by the lighting module conditional on a successful verification of the image data received.

Preferably, the authentication factor may include cryptographically encrypted data. The lighting module may comprise a memory element in which are stored verification data making it possible to verify said encrypted data.

The cryptographically encrypted data may preferably include a hash value covering at least the image data transmitted in step a).

Preferably, the authentication factor may include an indication of a date, or of a counter of data exchanges between the two modules.

The method may preferably comprise the preliminary step of exchanging public encryption keys between the two modules, said encryption keys forming part of public/private encryption pairs associated with the two modules respectively.

The authentication factor may preferably include data signed or encrypted using the control module's private key. Preferably, it can comprise a hashed value covering at least part or all of the image data transmitted in step a), the hashed value being signed using the private encryption key associated with the control module.

Data describing the at least one authentication factor can preferably be added to the image data before transmission.

Preferably, a second bidirectional data transmission channel can connect the control module and the lighting module. The method can preferably comprise a step of authenticating the control module to the lighting module and/or vice versa by means of an exchange of data on the second data transmission channel. The second channel may preferably be a control channel associated with the first image data transmission channel.

In accordance with a second aspect of the invention, a lighting system for a motor vehicle is proposed. The system comprises a transmitter control module as well as a receiver lighting module, the two modules comprising a transmission unit respectively for receiving image data and are connected by a first image data communication channel. The lighting system is remarkable in that the control module and the lighting module are configured to implement the steps of the method according to the previous aspect of the invention.

Preferably, the lighting module may comprise a secure memory element intended to store verification data making it possible to verify the encrypted data received. Preferably, the element can be integrated into the light source so that the secure memory element is encapsulated with components of the pixelated source, so as to be inseparable from said light source without damaging the light source in such a way irreversible. The secure memory element is preferably integrated into an ASIC type chip which forms the light source. It can in particular be integrated into the substrate of a pixelated source of the monolithic type.

The control unit may preferably include a microcontroller element. The control unit may preferably comprise a chip of the “Field Programmable Gate Array”, FPGA, “Application Specific Integrated Circuit”, ASIC, or “Complex Programmable Logic Device”, CPLD type. These elements are configured using an appropriate computer program to implement the functionalities described.

The lighting module can preferably comprise a pixelated light source comprising a substrate in which said secure memory element is integrated.

Preferably, each of the two modules can comprise a clock, the clocks of the two modules being synchronized. Preferably, a counter can be initialized to a common value when pairing the lighting module and the control module. Preferably, the counter can be incremented on transmission and/or reception of a message at the level of each of the two modules.

Preferably, the cryptographically encrypted data can comprise a hashed value of a date indication, or of a counter of data exchanges between the two modules.

Preferably, the authentication factor can comprise data signed or encrypted using the private key of the transmitter module.

The communication between the two modules can preferably be abandoned following a predetermined number of data verification failures describing an authentication factor of the transmitting module.

The matrix light source can preferably comprise a monolithic source, comprising elementary electroluminescent light sources with semiconductor elements etched in a common substrate and activatable independently of each other.

The matrix light source can preferably comprise a matrix of the micro LED type, comprising a matrix of elementary sources produced by light-emitting diodes, LEDs, of small dimensions, typically less than 150 μm, preferably assembled on a common substrate.

The matrix light source may preferably comprise a micro-mirror device, DMD, ("Digital micromirror device"), in which an elementary source comprises a micro-mirror of a matrix, which reflects selectively as a function of its position an incident beam of light.

The lighting module may preferably include a control unit. The control unit can preferably be configured to control said matrix light source.

Preferably, the lighting module and/or the control module can comprise a processor programmed to encrypt and/or sign data using a cryptographic key stored in said memory element.

Preferably, a failure at the level of the lighting module and/or of the control module of the motor vehicle can be detected when the decryption of the data does not succeed or when said signature cannot be validated.

The lighting module may preferably include a data receiving/sending unit. The data reception and sending unit can preferably comprise a network interface capable of receiving/sending data on a data bus internal to the motor vehicle. For example, the bus can be an Ethernet bus, a Gigabit Multimedia Serial Link, GMSL type bus, or a Low Voltage Differential Signaling, LVDS technology bus, such as an FPD-Link III bus.

According to another aspect of the invention, a computer program is proposed, comprising a series of instructions which, when executed by a processor, cause the processor to implement a method according to one aspect of the invention .

According to yet another aspect of the invention, a non-transitory computer-readable storage medium is provided, said medium storing a computer program according to the previous aspect of the invention.

By using the measures proposed by the present invention, it becomes possible to propose a method for authenticating image data between a control module of a motor vehicle and a lighting module controlled by the latter. This allows the two modules to automatically ensure that the module which transmits image data to it, for example on a video bus of the motor vehicle, is indeed the module with which a pairing process has previously taken place during the motor vehicle assembly.

In addition, the method makes it possible to verify the integrity of the data received. When, during pairing, the parameters describing, for example, the attitude of the vehicle, the position of the lighting module within the motor vehicle, or even calibration data (electrothermal or other) of a light source of the module lighting are exchanged, it is important that the modules can ensure that the parameters initially exchanged remain valid. This is possible using the data authentication method according to aspects of the invention. Successful authentication can for example mean that the modules have been paired correctly beforehand, while unsuccessful authentication means that one or other of the modules has been exchanged in the meantime, that a new pairing is necessary, or that either module is in failure mode.

By integrating the authentication data into the stream of images transmitted on the video bus, the proposed solution makes it possible to quickly detect an authentication problem, without however requiring a specific and dedicated connection for this purpose. By using hashed values of the command images transmitted, the bandwidth required for this authentication process is also controlled and limited.

montre la séquence des étapes principales d’un procédé en accord avec un mode de réalisation préférentiel de l’invention ;
est une illustration d’un système d’éclairage en accord avec un mode de réalisation préférentiel de l’invention.

Other characteristics and advantages of the present invention will be better understood with the help of the description of the examples and the drawings, among which:

shows the sequence of the main steps of a method according to a preferred embodiment of the invention;
is an illustration of a lighting system according to a preferred embodiment of the invention.

Unless specifically indicated to the contrary, technical characteristics described in detail for a given embodiment may be combined with the technical characteristics described in the context of other embodiments described by way of example and without limitation.

The description focuses on the elements of a lighting module for a motor vehicle which are necessary for understanding the invention. Other elements, which are known to be part of such modules, will not be mentioned or described in detail. For example, the presence and operation of a converter circuit involved in the power supply of a matrix light source, known per se, will not be described in detail. The same applies to optical elements such as lenses for example.

The illustrates the main steps of an authentication method according to a preferred embodiment of the invention. The method involves a lighting system 100 as illustrated by the .

The control module 110 and the lighting module 120 each comprise a unit for transmitting 114 image data, respectively for receiving image data 124 and they are linked by a data communication channel 140 which allows the transmission of image data intended for the lighting module 120. The communication channel comprises for example a video data bus or a high-speed data transmission channel. It makes it possible to transmit digital image data, in which the value of each pixel typically corresponds to a light instruction, which is to be produced by an elementary light source 124 of a pixelated light source 122 of the lighting module, by means of a proper piloting per se known in the art.

During a first step a) image data 130, F1 comprising at least one authentication factor F1 are transmitted from the control module to the lighting module. At step b) the image data is received at the level of the lighting module 120, and the authentication factor F1 is verified using a calculation unit 126. Then, at step c ), the method abandons the communication with the control module 110 if said verification fails. If the check succeeds, the communication is continued, and the image data 130 is preferably projected using appropriate control of the rasterized light source.

Preferably, the module in question is put into failure and a corresponding message is sent to a central unit of the motor vehicle.

The authentication function can for example comprise the preliminary exchange of public cryptographic keys between the two modules in

question

110, 120 thus allowing the verification by one and the other of the authenticity of data signed by means of the private cryptographic keys. corresponding. The keys are preferably stored in

memory elements

118, 128 of the two

modules

110, 120. According to a preferred embodiment, the exchange of keys can take place on a second bidirectional channel 150 which connects the two modules. It may for example be a control channel of a video bus, or a data bus with a relatively low bit rate, for example of the CAN type.

d'un temps ou d'une date, pouvant être exprimé en une unité de temps quelconque, par exemple en millisecondes, ou
d'un compteur comptant des échanges ou des cycles de calcul, ou
d'un autre élément qui évolue avec le nombre d'échanges, pouvant être réinitialisé lorsque qu'il dépasse une taille prédéfinie.

In order to perform the authentication function, the lighting module 120 as well as the control module 110 of the motor vehicle comprise calculation means 126, 116 for generating respectively verifying the authentication factor F1. Preferably, the generation of the authentication factor is done according to

a time or a date, which can be expressed in any unit of time, for example in milliseconds, or
a counter counting exchanges or calculation cycles, or
another element that evolves with the number of exchanges, which can be reset when it exceeds a predefined size.

According to a particular embodiment, the authentication factor F1 comprises a hash value, calculated using a cryptographic hash function, using the image data 130 as input. This hashed value can optionally be cryptographically signed using a private encryption key associated with the control module 110.

Before the transmission of the image data 130, the authentication factor F1 is added to the luminous instruction data. Preferably, the concatenated data is transmitted on the video bus 140. Alternatively, coding of the factor F1 by steganography methods in the image data 130 itself can be considered without departing from the scope of the present invention. The authentication factor F1 is therefore preferably transmitted as if it were additional pixel or line values or es that are part of the image data. After reception at the level of the lighting module 120, the calculation unit 126 makes it possible to verify the signature of the hashed value F1, and to verify whether a local hash of the image data 130 received corresponds to the value F1 received. If the signature is not verified or if the received and calculated hash values do not match, the authentication has failed and the corresponding image is not projected by the pixelated light source. Hash functions known in the art allow a different result to be generated for any different computational input presented to it. Differing hash values therefore lead to the conclusion that the input data (here: transmitted image data and received image data) presented to the hash function are different. If the signature cannot be validated, the control module has for example been exchanged (it thus includes a new private key, or no encryption key) without an appropriate pairing procedure. The authentication failure no longer makes it possible to guarantee that the data 130 received is suitable for projection by means of the matrix 122.

If the two modules include synchronized clocks and/or counters, one and the other can verify the corresponding data of the authentication factor F1 by comparing them to the value of its own clock, or of its own corresponding counter.

In case the authentication between the controller and the microcontroller fails, the lighting function can be put into a communication failure mode. Advantageously, the failure mode is activated only when authentication failures are repeated, which makes it possible to avoid activating the failure mode if the link has been disturbed, for example by transient electromagnetic disturbances.

l'arrêt de la fonction d'éclairage ou la projection par le module d'éclairage d'une image par défaut,
la génération par le module de commande 110 d'un signal de défaillance émis vers un système central de gestion de l'automobile.

The communication failure mode may involve the following procedures, taken alone or in combination:

stopping of the lighting function or projection by the lighting module of a default image,
the generation by the control module 110 of a failure signal transmitted to a central management system of the automobile.

The lighting module 120 preferably comprises a matrix light source 122 grouping together a plurality of elementary light sources 123. In the example illustrated, it is a matrix of LEDs without the invention being limited to this example. The matrix light source can also be produced by a micro-mirror device, for which each mirror is adapted to generate an elementary light beam from a matrix. The module comprises a data reception and sending unit 124, this is for example an interface capable of receiving and decoding messages on a emptied data bus internal to the motor vehicle, such as a type bus GMSL ("Gigabit Multimedia Serial Link").

The data reception unit 124 is intended to receive data from at least one control module 110 of the motor vehicle – in particular it can carry out the exchanges of steps a) or b) of the authentication method described previously, preferably together with the calculation unit 126 to which the data reception unit 124 is connected.

The module 120 further comprises a memory element 128, such as a flash type memory, to which the calculation unit 130 is functionally linked and has read access.

In all the embodiments, it can be a secure optional memory element which allows the storage of data necessary for the verification of the authentication factor F1. This data can for example comprise the private key of the lighting module 120 and/or the public encryption key of the control module 110. Preferably, this memory element is integrated in a box which incorporates the pixelated light source, or in an ASIC type chip which produces the pixelated light source 122. Thus it becomes impossible to access the secure memory without destroying the light source.

A memory element can also comprise calibration data specific to the matrix source 122. By way of example, the data can comprise for each elementary light source 123 a value indicating the difference in luminosity with respect to the average luminosity of the matrix source 122, possibly over a range of load amperages. The calibration data may nevertheless include more complex optical, thermal or geometric calibration parameters, without thereby departing from the scope of the present invention.

In all embodiments of the invention, the lighting system 100 may further comprise a second data transmission channel 150, which allows two-way data exchange between the control module and the lighting module 120. It may be a CAN bus or a low data rate control channel that is part of a video bus. This channel 150 can for example be used to exchange cryptographic encryption keys. Channel 150 may also be used to authenticate control module 110 to lighting module 120. frame 130 received. The authentication process between the

modules

120, 110 can in particular be of the challenge-response type, which requires two-way communication. Such methods may in a known manner require the supply, by the control module 110, of a password, or of a response value calculated using a predetermined algorithm following the reception of a random challenge value received. Authentication can be validated by the calculation unit 126 of the lighting module by comparing the response received with the expected response. If the authentication fails, the module 120 can preferably go into failure, as described above.

It goes without saying that the embodiments described do not limit the scope of the protection of the invention. By making use of the description which has just been given, other embodiments are possible without departing from the scope of the present invention.

The scope of protection is determined by the claims.

Claims

A method of authenticating image data (130) between a transmitter control module (110) and a receiver lighting module (120) for a motor vehicle, the two modules (110, 120) comprising a transmission unit ( 114) respectively for receiving (124) image data and being connected by a first image data transmission channel (140), characterized in that the method comprises the steps of

transmission of image data (130, F1) comprising at least one authentication factor (F1) from the control module to the lighting module;

following receipt of said image data at the lighting module, verification of the authentication factor (F1) by means of a calculation unit (126);

at the level of the lighting module, abandoning the communication with the control module if said check fails, otherwise continuation of the communication.
Method according to the preceding claim, characterized in that the receiver lighting module (120) comprises a pixelated light source.
Method according to one of the preceding claims, characterized in that the authentication factor (F1) comprises cryptographically encrypted data, the lighting module comprising a memory element (128) in which are stored verification data making it possible to verify said encrypted data.
Method according to the preceding claim, characterized in that the cryptographically encrypted data comprise a hashed value covering at least the image data (130) transmitted in step a).
Method according to the preceding claim, characterized in that the authentication factor (F1) comprises an indication of a date, or of a counter of data exchanges between the two modules (110, 120).
Method according to one of the preceding claims, comprising the preliminary step of exchanging public encryption keys between the two modules (110, 120), said encryption keys being part of public/private encryption pairs associated with the two modules respectively .
Method according to the preceding claim, characterized in that the authentication factor (F1) comprises data signed or encrypted using the private key of the control module.
Method according to one of the preceding claims, characterized in that data describing the at least one authentication factor (F1) is added to the image data (130) before transmission.
Method according to one of the preceding claims, characterized in that a second bidirectional data transmission channel (150) connects the control module (110) and the lighting module (120), and in that the method comprises a step of authentication of the control module with the lighting module and/or vice versa by means of an exchange of data on the second data transmission channel.
Lighting system (100) for a motor vehicle, the system comprising a transmitter control module (110) as well as a receiver lighting module (120), the two modules comprising a transmitting unit (114) respectively receiving (124) of image data and being linked by a first image data communication channel (140), characterized in that the control module and the lighting module are configured to implement the steps of the method according to one of the preceding claims.
Lighting system according to the preceding claim, characterized in that the lighting module (120) comprises a secure memory element (128) intended to store verification data making it possible to verify encrypted data received.
Lighting system according to the preceding claim, characterized in that the lighting module comprises a pixelated light source (122) comprising a substrate in which said secure memory element (128) is integrated.
Computer program comprising a sequence of instructions which, when executed by a processor, lead the processor to implement a method according to one of Claims 1 to 10.