Method for carrying out a decommissioning of an electrical energy store of a motor vehicle, computer program product and system

Abstract

The invention relates to a method for carrying out a decommissioning (16) of an electrical energy store of a motor vehicle by means of a system (14), the method comprising the steps: making a request to modify a control program on an electronic computing device (10) of the electrical energy store to a further electronic computing device (12) of the system (14) (S5), confirming the request by means of the further electronic computing device (12) and storing the request in a memory device of the further electronic computing device (12) (S7), deleting security certificates on the electronic computing device (10) after receipt of the confirmation (S8), and releasing the control program for modification and decommissioning (16) of the electrical energy storage device (10) (S9). The invention further relates to a computer program product and to a system (14).

Description

[0001] Method for carrying out a decommissioning of an electrical energy storage device of a motor vehicle, computer program product and system

[0002] The invention relates to a method for carrying out a decommissioning of an electrical energy storage device of a motor vehicle by means of a system according to the applicable patent claim 1. Furthermore, the invention relates to a computer program product and a system.

[0003] It is already known from the prior art that, for example, electrical energy storage devices of a motor vehicle, in particular of an at least partially electrically powered motor vehicle, can be reused after their use in the vehicle. This often requires installing a new software program, in particular a new control program, on a so-called battery management system (BMS) of the electrical energy storage device in order to continue using it for so-called second-life applications outside the vehicle.

[0004] However, this requirement is currently diametrically opposed to security requirements, which are intended to prevent the installation of third-party software or view it as a threat. In particular, the issue of the so-called transfer of responsibility has not been clarified and is not known in the current state of technology.

[0005] JP 5500252 discloses a battery recycling method, a battery management system, a battery management device, and an information communication terminal. When batteries mounted in vehicles are recovered, methods for handling the recovered batteries at low cost are determined. Measurement data from each of a plurality of stacks constituting a battery pack is transmitted to a terminal. The terminal stores the received measurement data in a history information storage unit as history information. If the history information of a battery pack mounted in the vehicle is not stored in the history information storage unit of the terminal, that battery pack is subjected to recycling processing.When history information is stored in the history information storage unit of the terminal, a method for reusing the battery pack is determined based on the history information.

[0006] The object of the present invention is to provide a method, a computer program product and a system by means of which a decomissioning of an electrical energy storage device of a motor vehicle can be realized in a simplified manner.

[0007] This object is achieved by a method, a computer program product, and a system according to the independent patent claims. Advantageous embodiments are specified in the subclaims.

[0008] One aspect of the invention relates to a method for performing decommissioning of an electrical energy storage device of a motor vehicle using a system. A request to change a control program on an electronic computing device of the electrical energy storage device is sent to another electronic computing device of the system. The request is confirmed by the another electronic computing device, and the request is stored in a storage device of the another electronic computing device. Upon receipt of the confirmation, security certificates on the electronic computing device are deleted. The control program is then released for a change and decommissioning of the electrical energy storage device.

[0009] In particular, a method is described that reconciles the diametrically opposed requirements of, for example, EU regulations and safety. Third-party software can be installed on the electronic computing device of the electrical energy storage system, which can also be referred to as a battery management system, with at least partial responsibility for safety being transferred to the user, who can also be referred to as the economic operator. The decommissioning of the electrical energy storage system, whereby the electrical energy storage system can in particular also be designed as a high-voltage battery, and the prevention of its operation in other corresponding vehicles can also be carried out by deactivating the corresponding safety control instances that prevent the installation of third-party software.This electrical energy storage device is then also marked as decommissioned, which can prevent further installation of this electrical energy storage device by, for example, a corresponding OEM.

[0010] In particular, the method according to the invention describes decommissioning the electrical energy storage device or even just parts of the electrical energy storage device, thus blocking it from use, for example, in an OEM product. This blocking is accompanied by permission to overwrite or modify certain parts of the control program, which is particularly implemented as software, or to install custom software. In this case, it may be necessary, for example, to retain runtime / life data relating to the battery or cells.

[0011] In modern electronic computing devices, also known as control units, there is a separation of code, particularly executable machine code, and data, such as runtime-variable parameters or counters. These can be stored in different segments in microcontrollers. Security-relevant data is often stored in so-called hardware security modules (HSMs), as this area must be protected against access. If no HSM is provided by the microcontroller, this data can also be stored in unprotected memory. The following examples are discussed using a microcontroller with an HSM. However, they are also transferable to a microcontroller without an HSM. In code, a distinction is usually made between the flash boot loader (FBL) and the application software (ASW).The FBL represents the initial entry point for program execution, and many security controls, such as protection against tampering, can be initiated from this point. In particular, the FBL also offers the option of installing new software. For this reason, the FBL is specially protected and only allows the installation of previously authorized or signed software created by a trusted authority. This represents the primary protection mechanism against the installation of third-party software.

[0012] The FBL can be used to modify both the FBL itself and the ASW. The ASW represents the usual program flow, which represents the software-described functionality of the component.

[0013] A flash process can also change the so-called data. This data stores states or parameters, and it may be necessary to retain at least some of these during decommissioning so that they can continue to be used by the Economic Operator (EO) / user. The exact data that must be retained is defined by the regulations.

[0014] The HSM supports and / or stores security controls and sensitive data. These can be, for example, keys for a secure boot procedure or counters that detect security violations. In addition, certificates that uniquely authenticate a control unit are often stored in the HSM. These certificates are a particularly important part of the security concept, and if they are compromised or used in an unauthorized manner, this can result in a wide range of damages for both the customer and the company. Therefore, it is important that no third-party software can access or use these certificates.

[0015] According to an advantageous embodiment, an identification of the electrical energy storage device with the modified control program is stored in the storage device. In particular, decommissioned electrical energy storage devices are thus stored in the storage device, which can prevent these electrical energy storage devices from being installed again by a corresponding OEM or operator of the further electronic computing device in the future. In particular, this can be achieved, for example, by placing the electrical energy storage devices that have been modified on a so-called blacklist. Alternatively, it can be provided that the electrical energy storage devices with the modified control program are deleted from a so-called whitelist. This can prevent the decommissioned electronic energy storage device from being used again by the OEM.

[0016] Furthermore, it has proven advantageous to install a new control program when the current control program is changed. For example, the current OEM control program can be completely deleted and a new Economic Operator control program can be installed. Alternatively, it can be provided that only parts of the current control program are deleted and reinstalled when the control program is changed. This way, for example, corresponding data from the electrical energy storage device can continue to be stored and only safety-relevant codes are deleted. A further advantageous embodiment provides that the request to change the control program is initiated by the electronic computing device using a flash program on the electronic computing device.In particular, specially designed software, known as decommissioning software, can be used to initiate decommissioning. For this purpose, software is loaded onto the electronic computing device, which makes the necessary changes to the segments. The software is advantageously loaded into a volatile part of the microcontroller, such as RAM. When executed, the code initiates the decommissioning described above and releases certain memory segments for overwriting. These can be, in particular, the FBL, the HSM, and the ASW. Security controls required for the safe operation of the electronic computing device can be weakened, deleted, or overwritten. This has the advantage that decommissioning can also be implemented retrospectively in the control unit.In other words, the functionality can also be used for older electronic computing devices already in the field. Once decommissioning has been completed, responsibility for the electronic energy storage system will be transferred to the incoming operator, or to the so-called economic operator mentioned in the planned regulation.

[0017] A further advantageous embodiment provides that the request to change the control program is initiated by an external user on the additional electronic computing device, wherein, prior to confirmation of the request by the additional electronic computing device, a potentially new control program is checked and subsequently signed. In particular, it can also be provided that the potentially new control program is checked for vulnerabilities and / or compliance violations, in particular by means of a penetration test. In particular, this can provide greater control over the type of software or over the software creators, so that only a correspondingly signed flash process can take place for the third-party software. For this purpose, in particular, an additional path for signing the software is provided. This signing process, in turn, takes place outside the electronic computing device.For proprietary software, signing can be done with a dedicated key. For third-party software, a second key is used, which is owned by, for example, the OEM and is not issued. An economic operator provides third-party software to a signing service of the OEM. The main task of this service is to create a signature, which can then be verified later during the flash process, particularly on the electronic computing device. Optionally, an analysis of the third-party software can be performed. This can, for example, be an automated test for vulnerabilities and compliance violations. A so-called penetration test can also be performed in this step, which can uncover security gaps in particular. If flash packages are to be imported in encrypted form, encryption can also be performed.If the verification is satisfactory or no verification is performed, a signature can be sent to the Economic Operator so that they can create a corresponding flash package. Alternatively, this can be provided with an encrypted flash package. If the verification is unsuccessful, no signature is provided, and thus flashing is not possible. With this procedure, it is advisable that only the ASW is overwritable in order to weaken or delete security controls there. It is particularly advisable to leave the FBL persistent so that only software certified by the corresponding signing service can be written to the ECU. Therefore, all security controls for the FBL and the HSM should remain active.This procedure has the advantage of allowing decisions to be made regarding which user can write software for the battery and ensuring that a minimum set of software requirements must be met. This makes it possible to specify and verify specific implementation specifications. The third-party software can be installed via a corresponding flash process after a compliant flash package has been created. To do this, decommissioning is performed first, followed by the installation of the third-party software. Once the third-party software has been flashed, responsibility for the safe operation of the battery is transferred to the user or economic operator.

[0018] A further embodiment provides for the request to change the control program to be initiated by an external user on the additional electronic computing device, whereby only a trusted user who has already been registered with the additional electronic computing device will receive authorization. In particular, this makes it possible to provide a diagnostic service for decommissioning. This requires an additional diagnostic service secured with special certificates. Special certificates are already a standard tool for securing particularly critical services. Therefore, these services also require additional documentation upon use. Each user of these special certificates must register specifically for this service and is recorded by name. The issuance of a special certificate is linked, for example, to a vehicle identification number and is time-limited.This ensures a high level of control over use and the group of people involved in decommissioning. The diagnostic service deactivates security controls, particularly the signature verification of the flashware. This then makes it possible to install third-party software via a standard flash process. Once the diagnostic service has been performed, responsibility is transferred to the user or the service performing the decommissioning. The advantages of the diagnostic service for decommissioning lie in its simplicity for both the user and the developer. Standardized procedures, particularly special certificates, can be used, making implementation comparatively simple.

[0019] The presented method is, in particular, a computer-implemented method. Therefore, a further aspect of the invention relates to a computer program product with program code means that, when the program code means are processed by the electronic computing device, cause an electronic computing device to perform a method according to the preceding aspect. The computer program product can also be referred to as a computer program. Furthermore, the invention therefore also relates to a computer-readable storage medium containing the computer program product.

[0020] Yet another aspect of the invention relates to a system for performing decommissioning of an electrical energy storage device of a motor vehicle, comprising at least one further electronic computing device, wherein the system is designed to perform a method according to the preceding aspect. In particular, the method is performed by means of the system.

[0021] The electronic computing device or the further electronic computing device has, in particular, electronic components, such as processors, circuits, in particular integrated circuits, and further electronic components in order to be able to carry out corresponding method steps.

[0022] Advantageous embodiments of the method are to be regarded as advantageous embodiments of the computer program product and of the system. For this purpose, the system has specific features which enable implementation of the method or an advantageous embodiment thereof. Further advantages, features, and details of the invention will become apparent from the following description of preferred embodiments and from the drawings. The features and combinations of features mentioned above in the description as well as the features and combinations of features mentioned below in the description of the figures and / or shown alone in the figures can be used not only in the respective specified combination, but also in other combinations or on their own, without departing from the scope of the invention.

[0023] Showing:

[0024] Fig. 1 is a schematic flow diagram according to an embodiment of the method;

[0025] Fig. 2 shows a further schematic flow diagram of the method; and

[0026] Fig. 3 shows yet another schematic sequence of an embodiment of the method.

[0027] In the figures, identical or functionally identical elements are provided with the same reference symbols.

[0028] Fig. 1 shows a schematic flow diagram according to one embodiment of the method. In particular, Fig. 1 shows a breakdown of the different steps. The steps are shown on an electronic computing device 10 and on a further electronic computing device 12. The presented method is carried out using a system 14, wherein the system 14 is configured for decomissioning 16. Furthermore, Fig. 1 also shows a production line 18.

[0029] Fig. 1 shows in particular that during (control unit) production 18, in a first step S1, a request for a certificate signing is transmitted from the electronic computing device 10, wherein the electronic computing device 10 is configured in particular on an electronic energy storage device, for example, as a battery management system (BMS), to the further electronic computing device 12 of the system 14. In a second step S2, the request is stored. In a third step S3, the certificate is signed by the further electronic computing device 12, and in a fourth step S4, the signed certificate is stored on the electronic computing device 10.

[0030] In order to now carry out the decommissioning 16, in a fifth step S5, a request to change a control program on the electronic computing device 10 is transmitted to the further electronic computing device 12. This process can also be referred to as revocation. In a sixth step S6, the certificate stored in production is saved as "in revocation." In a seventh step S7, the request is confirmed by the further electronic computing device 12 and stored in a corresponding storage device of the further electronic computing device 12. In an eighth step S8, security certificates are deleted on the electronic computing device 10 after receipt of the confirmation. In particular, corresponding certificates are deleted.In a ninth step S9, the confirmation of the deletion is sent to the further electronic computing device 12, wherein in a tenth step S10 the certificate is again marked as “revoked” in the further electronic computing device 12.

[0031] In particular, Fig. 1 shows that the corresponding certificates represent one of the most important components of the security concept for electrical energy storage devices. These certificates are signed during production by a trusted authority, in particular the additional electronic computing device 12, for example, using a root certificate. This signing allows a so-called chain of trust to be established.

[0032] In production 18, the electronic computing device 10, which can also be referred to as the control unit or ECU, sends a so-called Certificate Signing Request (CSR) to the further electronic computing device 12. The further electronic computing device 12, which can also be referred to as the backend, saves this request and returns a certificate signed by a root certificate. This can also be done using a certificate chain; for example, the root certificate signs an intermediate certificate, and the intermediate certificate signs a control unit certificate. This can also include several smaller intermediate steps. The electronic computing device 10 can then use this certificate to authenticate itself to other electronic computing devices.All certificates signed in this way can be recorded in a database, and thus it can be precisely tracked which of the electronic computing devices 10 has a valid authorization.

[0033] These authorized electronic computing devices 10 can, in turn, be documented in the backend, and authorization can be verified if necessary. This makes sense, for example, when electronic computing devices 10 are transferred from one old vehicle to another, since a new learning process for the control units must be initiated each time the control unit configuration is changed. During the learning step, a check can then be made to determine whether a control unit is on a blacklist, for example, because a decommissioning was performed.

[0034] In the following, "locking the control unit" and "locking the control unit certificate" are used synonymously, although they are technically different. An electronic computing device 10 is always uniquely identified or authenticated via the control unit certificate, and therefore they form a virtual unit.

[0035] If an electronic computing device 10 is placed on the blocking list, for example, a blacklist, then this electronic computing device 10 can no longer be trained in a (OEM-produced) motor vehicle and thus used. Therefore, an untrained electronic computing device will not function in the vehicle network. Alternatively, it is possible to allow a so-called whitelist only for electronic computing devices 10 that are approved for training.

[0036] During demissioning 16, a so-called certificate revocation (CR) is performed. This means that the electronic computing device 10 withdraws its own certificate. The request for a CR is signed by a message containing the still valid certificate. This ensures the authenticity of such a request. The request becomes even more secure if the additional electronic computing device 12 also sends a challenge, for example a so-called nonce, which is then also signed. This prevents any old request that was not fully executed from being used again, which in particular represents so-called replay protection. In the backend, after the CR has been verified, the certificate is marked as withdrawn so that it can no longer be used in the future. Therefore, the control unit can either be placed on the blacklist or removed from the whitelist.Confirmation of the revocation is sent from the backend to the control unit, ideally via a signed message. The control unit also deletes and overwrites the certificate.

[0037] Additionally, security controls can be relaxed or disabled during decommissioning. This could include, for example, disabling secure or authenticated boots, disabling security counters such as security violation counting, and accepting non-authentic / authorized / authenticated communications and software.

[0038] Depending on the type of decommissioning, it may be advisable to leave a certain level of protection on the electronic computing device 10 despite decommissioning 16. Therefore, two scenarios arise. The first scenario is the complete release of the control unit or the electronic computing device 10, thus enabling writing to every segment. The second scenario is the continued protection of, for example, the FBL 30 (Fig. 3), thus controlling which software can be installed on the electronic computing device 10.

[0039] To comply with EU regulations, certain memory areas may not be changed during decommissioning. These are contained in the so-called data segment. This can include all parameters important for proper battery operation, operating windows and safety limits, as well as safety-relevant counters.

[0040] In particular, three decommissioning methods are available. First, decommissioning 16 can be initiated using special decommissioning software. In particular, the request to change the control program is initiated by means of a flash program on the electronic computing device 10 using the electronic computing device 10. For this purpose, software is loaded onto the electronic computing device 10, which makes the necessary changes to the segments. The software is advantageously loaded into a volatile part of the controller, for example, into a RAM. When executed, the code leads to the decommissioning 16 described above and releases certain memory segments for overwriting. In particular, these can be the FBL 30, the HSM, and the ASW.Security controls required for the secure operation of the electronic computing device 10 can either be weakened, deleted, or overwritten. This has the particular advantage that this can be performed retrospectively with the electronic computing device 10. In other words, the functionality can also be used for older electronic computing devices 10 that are already in the field. Once the decommissioning 16 has been performed, responsibility for the product is transferred to the user or to the so-called Economic Operator (EO) / User 20 mentioned in the planned regulation (Fig. 2).

[0041] Fig. 2 shows a further schematic embodiment of the method. Fig. 2 shows, in particular, that the request to change the control program is initiated by the external user 20 at the further electronic computing device 12, wherein, prior to the confirmation 24, a potentially new control program 22 is checked and subsequently signed during the request. In the present exemplary embodiment, the checking is shown by a check 26. For this purpose, it can further be provided that a signing service 28 is provided. In particular, in order to have greater control over the type of software or over the software creators, the decommissioning 16 is carried out by means of a flash process with a signature for the potential control program 22. The potential control program 22 is also referred to below as third-party software. For this purpose, an additional method for signing the software is provided.This process takes place outside the electronic computing device 10.

[0042] For example, for proprietary software, such as from an OEM (Original Equipment Manufacturer), signing can be done with a dedicated key. For third-party software, a second key is used, which is owned by, for example, the OEM and is not issued. The user 20 provides their potential control program 22 to a signing service 28. The main task of this service is to create a signature, which later verifies the flash process on the electronic computing device 10. Optionally, an analysis of the third-party software can be performed. This can, for example, be an automated test for vulnerabilities or compliance violations. A so-called penetration test can also be performed in this step, which specifically uncovers security gaps. If flash packages are to be imported in encrypted form, encryption can also be performed.If the verification is OK, or if no verification is performed, a signature can be sent to user 20 so they can create a compliant flash package. Alternatively, if the flash package is encrypted, the encrypted package can be provided. If the verification is not OK, no signature is provided, and flashing is therefore not possible.

[0043] With this approach, it is advisable to only make the ASW overwritable and to weaken or delete security controls only there. It is particularly advisable to keep the FBL 30 persistent so that only software certified by the Signing Service 28 can be written to the ECU. Therefore, all security controls for the FBL 30 and the HSM should remain active.

[0044] This method has the advantage of allowing decisions about which user can write 20 pieces of software for the battery, and also ensuring that a minimum set of software requirements must be met. This makes it possible to specify specific implementation specifications and verify them. The third-party software can be installed during the flash process after a compliant flash package has been created.

[0045] Fig. 3 shows a further schematic flow diagram according to an embodiment of the method. In particular, an FBL 30 is shown. A first area of ​​responsibility 32 is also shown, which lies with the OEM. Furthermore, a second area of ​​responsibility 34 is shown, which lies with the user 20. Furthermore, it is shown that the FBL 30 can be loaded via a flash package with an OEM signature. This is illustrated in particular in block 36, with the responsibility then still lying with the OEM. According to the method of Fig. 2, a flash package with a third-party software signature can also be provided in a block 38. Decommissioning 16 then follows, followed by the flash process of the third-party software without overwriting the FBL, which is illustrated by block 40. Block 40, in turn, already lies within the area of ​​responsibility of the user 20.

[0046] Thus, after creating a compliant flash package, the third-party software can be installed via a compliant flash process. For this purpose, decommissioning 16 is performed first, followed by the installation of the third-party software. As soon as the flash process for the third-party software is installed, responsibility for the safe operation of the electrical energy storage device is transferred to the responsibility of the user 20. This provides a clear technical demarcation point for the transfer of responsibility. Another possibility for initiating the request is, in particular, that only a trusted user 20 who has already been registered with the additional electronic computing device 12 and is already registered receives authorization to change the control program using the external user 20. In particular, a diagnostic service for decommissioning 16 can thus be provided.This requires an additional diagnostic service secured with special certificates. Special certificates are already a standard tool for securing particularly critical services. Furthermore, these services also require additional documentation upon use. Each user of these special certificates must register specifically for this service and is recorded by name. The issuance of a special certificate is linked to a vehicle identification number and is time-limited. This ensures a high level of control over use and the group of persons during decommissioning. The diagnostic service deactivates security controls, particularly during signature verification of the flashware. This then makes it possible to install third-party software via a standard flash process. Once the diagnostic service has been performed, responsibility is transferred to the user or the person providing the service.After performing decomissioning 16, segmentation is achieved. The advantages of the diagnostic service for decomissioning 16 lie in its simplicity for both the user and the development team. Standardized procedures, especially the special certificates, can be used, making implementation comparatively simple.

[0047] List of reference symbols

[0048] 10 electronic computing device

[0049] 12 additional electronic computing devices

[0050] 14 Systems

[0051] 16 Decomissioning

[0052] 18 Production

[0053] 20 users

[0054] 22 potential tax program

[0055] 24 Signing

[0056] 26 Review

[0057] 28 Signing service

[0058] 30 FBL

[0059] 32 first area of ​​responsibility

[0060] 34 second area of ​​responsibility

[0061] 36 blocks

[0062] 38 Block

[0063] 40 blocks

[0064] S1 to S10 steps of the procedure

Claims

Patent claims Method for carrying out a decommissioning (16) of an electrical energy storage device of a motor vehicle by means of a system (14), comprising the steps: - Requests to change a control program on an electronic computing device (10) of the electrical energy storage device to another electronic computing device (12) of the system (14); (S5) - Confirming the request by the further electronic computing device (12) and storing the request in a memory device of the further electronic computing device (12); (S7) - deletion of security certificates on the electronic computing device (10) after receipt of the confirmation; (S8) and - Releasing the control program for a change and decommissioning (16) of the electrical energy storage device (10). (S9). Method according to claim 1, characterized in that an identification of the electrical energy storage device (10) with the changed control program (22) is stored in the storage device. Method according to claim 1 or 2, characterized in that a new control program (22) is installed as a change to the current control program. Method according to claim 1 or 2, characterized in that as a change to the control program, only parts of the current control program are deleted and reinstalled. Method according to one of the preceding claims, characterized in that the request to change the control program by means of a flash program on the electronic computing device (10) is initiated by the electronic computing device (10). Method according to one of claims 1 to 4, characterized in that the request to change the control program is initiated by an external user (20) at the further electronic computing device (12), wherein during the request, before confirmation by the further electronic computing device (12), a potentially new control program (22) is checked and subsequently signed. Method according to claim 6, characterized in that the potentially new control program (22) is checked for vulnerabilities and / or compliance violations, in particular by means of a penetration test.Method according to one of claims 1 to 4, characterized in that the request to change the control program is initiated by an external user (20) at the further electronic computing device (12), whereby only a trustworthy user (20) who has already been previously registered with the further electronic computing device (12) receives approval. A computer program product with program code means which cause an electronic computing device (10, 12) to carry out a method according to one of claims 1 to 8 when the program code means are processed by the electronic computing device (10, 12). System (14) for carrying out a decommissioning (16) of an electrical energy storage device of a motor vehicle, comprising at least one further electronic computing device (12), wherein the system (14) is designed to carry out a method according to one of claims 1 to 8.

Images