Apparatus and method for transmitting messages to at least two receivers of a motor vehicle

Abstract

One aspect of the invention relates to a device for sending a message to at least two receivers of a motor vehicle, wherein the motor vehicle comprises the device and the at least two receivers and the device is arranged for: determining, from the message, information (cs) characterizing the integrity of the message; sending the information characterizing the integrity of the message to the at least two receivers by a communication protocol which ensures the authenticity of the information characterizing the integrity of the message; sending the message to the receivers by a multipoint protocol.

Description

Technical Field

[0001] The present invention relates to an apparatus and method for sending messages to at least two receivers in a motor vehicle. Background Technology

[0002] In the context of this article, the term "autonomous driving" can be understood as driving with automatic longitudinal or lateral guidance, or autonomous driving with both automatic longitudinal and lateral guidance. The term "autonomous driving" includes autonomous driving with any level of automation. Exemplary levels of automation are assisted, partially automated, highly automated, or fully automated driving. These levels of automation are defined by the Federal Highway Research Institute (BASt) (see BASt publication "Forschung kompakt", No. 11, 2012). In assisted driving, the driver continuously provides longitudinal or lateral guidance, while the system takes over other functions to a certain extent. In semi-autonomous driving (TAF), the system takes over longitudinal and lateral guidance for a period of time and / or under specific circumstances, where the driver must continuously monitor the system, similar to assisted driving. In highly automated driving (HAD), the system takes over longitudinal and lateral guidance for a period of time, and the driver does not need to continuously monitor the system; however, the driver must be able to take over vehicle control for a certain period of time. In fully automated driving (VAF), the system can automatically handle driving in all situations for a specific application scenario; for such applications, a driver is no longer required. According to the BASt definition, the four levels of automation mentioned above correspond to SAE Levels 1 to 4 of the SAE J3016 standard (SAE - Society of Automotive Engineers). For example, according to BASt, Highly Automated Driving (HAF) corresponds to Level 3 of the SAE J3016 standard. Furthermore, SAE Level 5 is specified in SAE J3016 as the highest level of automation, which is not included in the BASt definition. SAE Level 5 corresponds to fully automated driving, where the system can automatically handle all situations throughout the journey like a human driver; typically, a driver is no longer needed.

[0003] In autonomous vehicles, a large amount of data must be transmitted from one controller to multiple other controllers. This data must be protected in terms of authenticity and integrity during transmission.

[0004] IPsec protects communications in terms of authenticity and integrity, but one limitation of the IPsec standard is its focus on one-to-one communication. This precludes efficient, protected one-to-N communication, leading to a significant increase in resource requirements on the communication bus and in the controller. Summary of the Invention

[0005] The purpose of this invention is to reduce the resource requirements on the communication bus and in the controller, while still ensuring the authenticity and integrity of the transmitted data.

[0006] This objective is achieved through the features of the independent claim. Advantageous embodiments are described in the dependent claims. It should be noted that additional features of a claim dependent on the independent claim, in the absence of features of the independent claim or in combination with only a subset of features of the independent claim, can form an independent invention that is independent of all combinations of features of the independent claim, and this independent invention can be the subject of the independent claim, a divisional application, or a subsequent application. This also applies to the technical teachings described in the specification, which can form an invention independent of the features of the independent claim.

[0007] A first aspect of the invention relates to an apparatus for sending messages to at least two receivers in a motor vehicle. This apparatus is particularly a software component executed by a controller from which messages are sent to the at least two receivers.

[0008] The motor vehicle includes the device and at least two receivers. Therefore, this involves communication within the motor vehicle and the associated resource constraints.

[0009] The device is configured to determine information characterizing message integrity based on the message.

[0010] Message integrity exists when at least two receivers receive the message unchanged, or when at least one undesirable modification that cannot be prevented is identified.

[0011] Information characterizing message integrity includes, for example, checksums or parity bits. Essentially, a checksum is a value calculated from the original data and can detect at least one bit error in the data. Depending on the complexity of the checksum calculation rules, several errors can be identified or corrected. The calculated checksum is either stored or transmitted by the sender along with the data. The receiver then calculates the checksum from the received data using the same procedure and compares it to the checksum transmitted by the sender. If the two checksums differ, a transmission error has occurred. If the two checksums match, there is a high probability that the message was transmitted correctly. A simple example of a checksum is the parity bit.

[0012] Therefore, the device is configured, for example, to determine information characterizing the integrity of the message based on the message, in such a way that the device is configured to calculate a checksum from the message.

[0013] Furthermore, the device is configured to send information characterizing message integrity to at least two receivers via a communication protocol that ensures the authenticity of the information characterizing message integrity. Authenticity refers to the characteristics of authenticity, verifiability, and trustworthiness. This is demonstrated by verifying the data source, indicating that the data can be associated with a specified sender, which can be achieved, for example, through digital signatures.

[0014] In addition, the device is configured to send messages to the receiver via a multipoint protocol.

[0015] Multipoint protocols, especially multicast or broadcast protocols.

[0016] Multicast refers to the transmission of a message from one point to a group. Here, the message is transmitted simultaneously to several participants or a closed group of participants, and the data transmission rate used by the sender for this purpose is not multiplied by the number of receivers. In the case of packet-oriented data transmission, packets are copied at each individual distributor (router, switch, or hub) on the route.

[0017] The difference between multicast and broadcasting is that, in the case of broadcasting, the content distributed using appropriate receiving equipment can be seen by anyone, while for multicasting, an application must be made to the transmitter in advance.

[0018] In an advantageous embodiment, the device is configured to separately transmit information characterizing message integrity to at least two receivers via a communication protocol that ensures the authenticity of the information characterizing message integrity. Thus, for example, the device transmits its own integrity message, including information characterizing message integrity, to each of the at least two receivers.

[0019] This invention is based on the understanding that although a message itself can be very large, the information characterizing the integrity of the message is usually quite small. To ensure the authenticity of the message, it is sufficient to transmit the information characterizing the message's integrity through a communication protocol that guarantees authenticity.

[0020] In another advantageous implementation, the multipoint protocol is a multicast protocol.

[0021] In another advantageous implementation, the communication protocol that ensures the authenticity of the information characterizing the integrity of the message is the IPsec protocol.

[0022] Internet Protocol Security (IPsec) is a set of protocols designed to enable secure communication over potentially insecure IP networks.

[0023] IPsec operates directly at the network layer (“Internet layer”, corresponding to OSI layer 3) of the DoD model, representing a further development of the IP protocol. Its goal is to provide encryption-based security at the network level. IPsec provides connection-related data integrity and authentication.

[0024] Implementations of IPSec are specifically defined in RFC 4301 and RFC 4306 of the Internet Engineering Task Force.

[0025] In another advantageous implementation, the communication protocol that guarantees the authenticity of the information representing the integrity of the message is the IPsec unicast protocol.

[0026] Unicast refers to addressing a message to a single receiver. Therefore, the IPsec protocol is used to send a separate message to each of at least two receivers.

[0027] In another advantageous implementation, the information characterizing message integrity is the message checksum. A suitable checksum is effectively derived from existing end-to-end security layers (E2E protection) used for communication in motor vehicles.

[0028] A second aspect of the invention is a method for sending messages to at least two receivers in a motor vehicle.

[0029] One step in this method is to determine information characterizing message integrity based on the message. This integrity information is effectively derived from the calculated checksum of end-to-end protection (E2E-protection). If there is no end-to-end security, the integrity information is determined directly from the message.

[0030] Another step of the method is to send information characterizing message integrity to at least two receivers via a communication protocol that ensures the authenticity of the information characterizing message integrity.

[0031] Another step in this method is to send the message to the receiver via a multipoint protocol.

[0032] The foregoing description of the apparatus according to the first aspect of the invention is also applicable in a corresponding manner to the method according to the second aspect of the invention. Advantageous embodiments of the method according to the invention not expressly described herein and in the claims correspond to advantageous embodiments of the apparatus according to the invention described above or in the claims. Attached Figure Description

[0033] The present invention will now be described with reference to the accompanying drawings and embodiments. Wherein:

[0034] Figure 1 An embodiment of the device according to the invention is shown;

[0035] Figure 2 An embodiment of the method according to the present invention is shown; and

[0036] Figure 3 Another embodiment of the device according to the invention is shown. Detailed Implementation

[0037] Figure 1 An embodiment of the device sr according to the present invention for sending a message msg to at least two receivers r1, r2 of a motor vehicle is shown, wherein the motor vehicle includes the device sr and at least two receivers r1, r2.

[0038] The device sr is configured to determine 100 information cs characterizing the integrity of message msg, specifically the checksum, based on message msg.

[0039] In addition, the device sr is configured to send information cs characterizing the integrity of message msg to at least two receivers r1, r2 via a communication protocol that ensures authenticity, particularly the IPsec unicast protocol, and to protect it with authenticity information ah1, ah2.

[0040] In addition, device sr is configured to send 300 messages msg to receivers r1 and r2 via multipoint protocols, particularly multicast protocols.

[0041] Figure 2 An embodiment of the method according to the present invention for sending a message msg to at least two receivers r1, r2 in a motor vehicle is shown.

[0042] One step of this method is to determine information cs representing the integrity of message msg based on message msg.

[0043] Another step of the method is to send 200 pieces of information cs representing the integrity of the message msg to at least two receivers r1 and r2 via a communication protocol that ensures the authenticity of the information cs representing the integrity of the message msg.

[0044] Another step in this method is to send a 300 message msg to receivers r1 and r2 via a multipoint protocol.

[0045] Figure 3 Another embodiment of the device sr according to the invention is shown for sending a message msg to at least two receivers r1, r2 of a motor vehicle.

[0046] The device sr is configured to determine, based on the message msg, (1) information cs characterizing the integrity of the message msg, particularly the checksum.

[0047] In addition, the device sr is configured to calculate the authenticity information ah1 and ah2 for each receiver r1 and r2(2) based on the integrity information cs, in particular using a communication protocol that ensures authenticity and integrity, such as IPSec.

[0048] In addition, the device sr is configured to send (3) a data packet p1 containing a message msg and integrity information cs to receivers r1 and r2 via a multipoint protocol (e.g., IP multicast), and to send (4) data packets p2.1 and p2.2 containing authenticity information ah1 and ah2 to receivers r1 and r2 respectively, wherein these data packets p2.1 and p2.2 further include integrity information cs respectively.

[0049] Receivers r1 and r2 are each set to check the authenticity of integrity information cs based on authenticity information ah1 and ah2.

[0050] In addition, receivers r1 and r2 are respectively configured to check the integrity of message msg (6) by receiving integrity information cs.

[0051] Furthermore, receivers r1 and r2 are specifically configured to check the similarity of integrity information cs between data packets p1 and p2.1 or p2.2 (7). If there is a discrepancy or error in the authenticity check (5) or integrity check (6), the user is notified, for example, by a secure output "secure". In the case of similarity and no error, a message msg is provided to the user, for example, by the corresponding output.

Claims

1. An apparatus (sr) for sending messages (msg) to at least two receivers (r1, r2) of a motor vehicle, wherein, The motor vehicle includes the device (sr) and the at least two receivers (r1, r2), the device (sr) being configured to: • Determine (1) information (cs) characterizing the integrity of the message (msg) based on the message (msg); • Based on the determined information (cs) characterizing the integrity of the message (msg), calculate (2) the corresponding authenticity information (ah1, ah2) for each of the at least two receivers (r1, r2). • Send the message (msg) and information (cs) characterizing the integrity of the message (msg) to the at least two receivers (r1, r2) respectively via a multicast protocol; • The IPsec unicast protocol sends (4) information (cs) characterizing the integrity of the message (msg) and the corresponding authenticity information (ah1, ah2) to the at least two receivers (r1, r2), respectively, and the IPsec unicast protocol ensures the authenticity of the information characterizing the integrity of the message (msg).

2. The apparatus (sr) according to claim 1, wherein, The information (cs) that characterizes the integrity of the message (msg) is the checksum of the message (msg).

3. A method for sending a message (msg) to at least two receivers (r1, r2) of a motor vehicle, wherein, The method includes the following steps: • Determine (1) information (cs) characterizing the integrity of the message (msg) based on the message (msg); • Based on the determined information (cs) characterizing the integrity of the message (msg), calculate (2) the corresponding authenticity information (ah1, ah2) for each of the at least two receivers (r1, r2). • Send the message (msg) and information (cs) characterizing the integrity of the message (msg) to the at least two receivers (r1, r2) respectively via a multicast protocol; • The IPsec unicast protocol sends (4) information (cs) characterizing the integrity of the message (msg) and the corresponding authenticity information (ah1, ah2) to the at least two receivers (r1, r2), respectively, and the IPsec unicast protocol ensures the authenticity of the information characterizing the integrity of the message (msg).

Images