Method and control device for performing secure on-board communication

Abstract

Method for secure on-board communication between components (2, 4) of a vehicle via a communication bus (6) of the vehicle, the method comprising the steps of sending (S1) a message from a component (2; 4) to the communication bus (6), storing (S2) information of the sent message at the component (2; 4), reading (S3) all messages on the communication bus (6) by the component (2; 4), comparing (S4) the information of the read messages with the information of the sent message by the component (2; 4), and introducing (S5) a countermeasure in response to a deviation based on the comparison of the information of the read messages with the information of the sent message. Also related are control devices, systems and vehicles which are set up to perform such a method for secure on-board communication between components.

Description

Technical Field

[0001] The technical field relates to in-vehicle communication between vehicle components via a communication bus, particularly secure in-vehicle communication. Background Technology

[0002] The possibility of secure communication between components via a communication bus is known from existing technology. For example, a monitoring device can be used to centrally monitor communication on the bus, where all messages communicated on the bus are assigned to the issuing component and the central component checks whether these notifications can be manipulated. Summary of the Invention

[0003] This invention relates to a method for secure in-vehicle communication between vehicle components via a vehicle communication bus. One or more components may be controllers, such as engine controllers or brake controllers, actuators, such as electric motors for moving movable parts of the vehicle (e.g., tailgate), or sensor devices, such as temperature or engine speed sensors. The vehicle may be a passenger car or a truck. The communication bus may be a CAN bus, FlexRay bus, LIN bus, or MOST bus. In-vehicle communication can occur between at least two components, such as between a controller and an actuator. Alternatively or additionally, in-vehicle communication can occur between more than two components, such as between multiple controllers, actuators, and sensors. Secure in-vehicle communication between vehicle components via a communication bus can be a type of communication where only components authorized to use the in-vehicle communication are authorized to communicate. Alternatively or additionally, secure in-vehicle communication can involve communication of the correct content between authorized components.

[0004] The method includes the step of sending a message from a component to a communication bus. Alternatively or additionally, multiple messages can be sent from a component to the communication bus. The component may have a microcontroller and transceiver devices, which can be configured to perform the sending step. A message may have a header data segment and a main data segment. A message can be sent from a first component to a second component, wherein information about the first and second components may be included in the header data segment. The main data segment of the message may contain data to be transmitted. For example, a temperature sensor, which is the first component, can send a message to a heating controller, which is the second component, wherein the header data segment of the message contains information about the temperature sensor and the heating controller, and the main data segment contains information about the measured temperature value.

[0005] The method further includes the step of storing information about the sent messages on the component. For this purpose, the component may have a storage medium, such as flash memory. In the storage step, all the sent messages may be stored on the storage medium. Alternatively, only a portion of the sent messages may be stored on the component's storage medium. For example, header segment information, and alternatively or additionally, main data segment information may be stored on the component's storage medium. The information about the sent messages may be stored on the component for a determinable time period. This time period may be predetermined. This time period may depend on events or states, such as the available storage space on the storage medium. Alternatively or additionally, the information about the sent messages may be stored on the component until a determinable point in time, such as until the component is shut down. The storage of information about the sent messages can be performed for all messages sent from the component.

[0006] The method further includes a step of the component reading all messages on the communication bus, wherein the transceiver can be configured to perform this step. In the reading step, information about all messages transmitted via the communication bus can be acquired. The information may be about the header data segments of all messages. Alternatively or additionally, it may be about the main data segments of all messages. The reading step may include an intermediate storage step of storing the information acquired from all messages. The intermediate storage of the acquired information about all messages can be performed on the component's storage medium, and the microcontroller can be configured to perform this intermediate storage step.

[0007] The method also includes a step of comparing information from read messages with information from sent messages via a component. The comparison step can be performed between all messages read from the communication bus and all messages stored on the component. In the comparison step, only a portion of the information from the read messages can be compared with a portion of the information from the sent messages. For example, the header data segments of one or more read messages can be compared with the header data segments of one or more sent messages. Alternatively or additionally, the main data segments of one or more read messages can be compared with the main data segments of one or more sent messages.

[0008] The method further includes a step of introducing countermeasures in response to a discrepancy based on a comparison of information from a read message and information from a sent message. The discrepancy may also be based on a comparison between information from a read message and information from all stored messages. The discrepancy between information from a read message and information from a sent message may exist, for example, due to discrepancies in the header data segments of the read and sent messages. Alternatively or additionally, the discrepancy between information from a sent and read message may exist due to discrepancies in the header data segments of the read and sent messages. The countermeasures may include, for example, introducing or establishing a safe vehicle state. For example, a safe vehicle state can be obtained by disconnecting the vehicle drive system or limiting the engine power of the vehicle drive unit. A safe vehicle state can also be obtained by changing the drive control of at least one actuator used to operate at least one vehicle component.

[0009] If there is exactly one discrepancy between the message read and the message sent, a countermeasure can be implemented. Alternatively or additionally, if there are more than one discrepancy between one or more read messages and one or more sent messages, a countermeasure can be implemented.

[0010] Actuators can be, for example, electric motors or solenoid valves, which drive vehicle components. Vehicle brakes can also be driven as vehicle components. Vehicle brakes can be designed as service brakes, retarders, or integrated retarders. Retarders are wear-free, hydraulically or electrically powered, continuous brakes, primarily used in heavy-duty vehicles. Unlike retarders, so-called integrated retarders can be integrated into the vehicle's transmission in a space-saving manner.

[0011] For example, if a safe vehicle state should be achieved by braking the vehicle, then actuators for operating the vehicle brakes, such as retarders or integrated retarders, can be driven. Conversely, if the vehicle brakes are activated based on a manipulation message, the vehicle brakes can be disabled again based on a discrepancy between the information in the read message and the information in the sent message (which has led to the activation of the vehicle brakes).

[0012] Starting from a safe vehicle state, if a predetermined driving or operating state exists, the vehicle can switch back to the standard vehicle state. For example, this can be done after the vehicle stops, after the parking brake is activated, or after an ignition switch is turned on / off. This avoids the vehicle stopping due to a limited-time manipulation message.

[0013] However, if a control message appears again after switching to standard vehicle mode, it can be configured to prevent a return to standard vehicle mode. Preventing a return to standard vehicle mode could also be configured to occur only after a control message has appeared several times.

[0014] Components, such as controllers as described above, may include a microcontroller, a storage medium, and a transceiver. The microcontroller and transceiver can be configured to transmit messages. The microcontroller can be configured to store the transmitted messages on the storage medium. The transceiver can be configured to read all messages on the communication bus. Furthermore, the transceiver can be configured to transmit the read messages to the microcontroller, and the microcontroller can also be configured to store the received and read messages on the storage medium. The microcontroller compares the information of the read messages with the information of the transmitted messages, particularly with all messages stored on the storage medium. Additionally, the microcontroller can be configured to confirm discrepancies based on the comparison and, in response, implement countermeasures, wherein the microcontroller can send corresponding signals to the communication bus via the transceiver.

[0015] Therefore, there is an advantageous method that provides secure in-vehicle communication based on a comparison of information from messages read from the communication bus with information from messages sent. By storing one or more sent messages on the component, the comparison step ensures the current information about the one or more sent messages. Advantageously, the predetermined comparison list from an external source, such as from another controller, can thus be avoided for comparison with messages read from the communication bus; instead, the comparison can be performed autonomously by the component, particularly independent of any predetermined comparison list. This further enhances the security of in-vehicle communication because the predetermined comparison list from the external source to the component may be corrupted. The comparison step allows the component to identify the corrupted state of the communication bus on which messages are sent (messages that do not have comparable, stored messages on the component). Advantageously, the component can therefore automatically implement countermeasures in response to discrepancies based on the comparison. This minimizes the time during which the communication bus is corrupted and this situation has not yet been identified. This further enhances the security of in-vehicle communication.

[0016] According to another embodiment, message groups can be sent from a component. Here, a message group can contain two or more messages. Messages sent sequentially in time can also be combined into message groups. Alternatively, messages sent to a specific component can be grouped together. Therefore, the sending step can be sending message groups from a component to a communication bus. Additionally, information about the sent message groups is stored on the component. Here, the microcontroller can be configured to perform the step of sending information about the sent message groups on the component and storing the information about the sent message groups on a storage medium. Furthermore, the information of read messages is compared with the information of the sent message groups. Here, the microcontroller can be configured to perform the step of comparing the information of read messages with the information of the sent message groups. Additionally, countermeasures are implemented in response to discrepancies between the information of read messages and the information of sent message groups. Thus, the microcontroller can be configured to perform countermeasures based on discrepancies between the information of read messages and the information of sent message groups. Alternatively, multiple message groups can be sent, stored, and compared with read messages.

[0017] Storing sent messages as message groups reduces the amount of management data required for each sent message. This reduces the storage capacity required by the storage medium. Furthermore, the step of comparing a message read from the communication bus with one or more sent message groups can be performed efficiently by the microcontroller; specifically, instead of comparing with a single sent message, it can be compared with a group or multiple message groups.

[0018] According to another implementation, each message is assigned an identifier. Alternatively or additionally, one or more, and in particular all, groups of messages sent may be assigned identifiers. The identifier can identify a message one-to-one, or alternatively or supplementarily, a group of messages. For example, the identifier can be stored in the message header data segment. Alternatively or supplementarily, the identifier can be stored in the message's main data segment. The message identifier may, for example, contain information about the sending component, the receiving component, and at least a portion of the message content.

[0019] Advantageously, a message can be assigned to the sending component, the receiving component, and alternatively or additionally to the message content using its identifier. Thus, messages and related information can be efficiently processed based on their identifiers, particularly by storing, retrieving, or comparing only the message identifiers. This improves the efficiency of methods for safe in-vehicle communication, specifically by avoiding the storage, retrieval, or comparison of unnecessary data.

[0020] According to another implementation, each identifier has a source address for the component. Here, the source address can represent each component one-to-one. The source address can be, for example, an IP address.

[0021] Therefore, it is advantageous, particularly simple and efficient, to assign each message sent on the communication bus to a source component. Consequently, information about the source component can be read by each component participating on the communication bus via an identifier. Thus, each message on the communication bus can be assigned to a component.

[0022] According to another implementation, the discrepancy between the information of the messages read by the component and the information of the messages sent is determined through a comparison step. In the first sub-step, it is checked which read messages have identifiers that contain the component's source address. In the second sub-step, it is then checked for these read messages: whether the information of all read messages differs from the information of the sent messages. Alternatively or additionally, this can be done with respect to information about the group of messages sent, and further alternatively or additionally, with respect to information about multiple messages sent.

[0023] Here, the microcontroller can, for example, be configured to compare the identifiers of all messages read from the communication bus with the source address of the component. When the comparison is positive, that is, when the identifier of the message read from the communication bus has the source address of the component, the microcontroller can be configured to perform a second sub-step to check the discrepancies between the information of the read message and the information of the sent message, alternatively or additionally with the information of the group of sent messages, and further alternatively or additionally with the information of multiple sent messages. The discrepancy here can be a discrepancy between all the information of the read message and the sent message, or alternatively or additionally, a discrepancy between only a portion of the information of the read and sent messages. The information of the read and sent messages can, for example, include check data, such as a checksum. This allows for particularly simple confirmation of the discrepancy between the read and sent messages.

[0024] Advantageously, the step of determining the deviation through comparison can be divided into two sub-steps. First, the identifiers of all read messages are compared with the component's source address. Then, a second sub-step is performed only for messages read from the communication bus whose identifiers contain the component's source address, checking the information deviation between the read and sent messages. Thus, resources, especially the microcontroller's comparison resources, can be focused on messages only related to the component, i.e., messages with identifiers containing the component's source address. This improves the efficiency of the method.

[0025] According to another implementation, a deviation is determined when at least one read message differs from all messages sent by the component. In other words, a deviation may exist if a message read from the communication bus (which has an identifier corresponding to the component's source address) is confirmed to deviate from the corresponding sent message of the component. For example, a deviation can also be confirmed if a message read from the communication bus carries an identifier with the component's source address and there is no corresponding message for that message among all messages sent by the component, or among one or more sets of sent messages.

[0026] Advantageously, the component can thus perform a comparison with all messages sent by it, especially messages stored by it, for all messages on the communication bus that are assigned to the component, i.e., all messages carrying an identifier with the component's source address. Thus, when a message with an identifier assigned to the component but which happens not to be sent from that component is sent on the communication bus, the corruption of the communication bus can be confirmed.

[0027] According to one implementation, countermeasures are directly implemented by the components. Alternatively or additionally, countermeasures can be indirectly implemented by the components. Direct implementation of countermeasures by the components may include, for example, directly sending control signals, such as signals to the drive system components for disconnecting the drive system. Indirect implementation of countermeasures by the components may include, for example, sending information about damage to the communication bus (e.g., detected by the method described) to another component, which may, for example, directly implement the countermeasures. Alternatively or additionally, implementation of countermeasures by the components may include sending a notification via the communication bus to all components connected to the communication bus, the notification containing information about damage to the communication bus. Advantageously, all components can thus be notified of communication bus damage.

[0028] According to another embodiment, it can be configured to allow the sending of predefined messages with the same identifier from at least two components. To ensure that comparing the information of a read message with the information of a sent message by a component does not lead to the implementation of countermeasures in response to identified discrepancies, these messages are predefined and stored in a storage medium. The storage medium can, for example, be designed as the component's non-volatile memory. The storage medium can, for example, be integrated within the component's microcontroller. The storage medium can contain a list of messages whose reading by a component does not trigger countermeasures. The list thus stores messages whose identifiers have the source address of the component itself. Therefore, a message read by another component will not itself lead to the implementation of countermeasures, even if the message has the same identifier as this component. This allows mapping a special case where at least two components are allowed to use the same identifier for messages.

[0029] Another aspect of the present invention relates to a control device for safe in-vehicle communication, comprising a microcontroller, a storage medium, and a transceiver, wherein the microcontroller is configured to perform a method according to one embodiment when using the storage medium and the transceiver. The storage medium may be flash memory. The transceiver may be configured to transmit messages only to and read messages from the communication bus.

[0030] Another aspect of the invention relates to a system for safe in-vehicle communication, having a control device, a communication bus, and additional control devices according to another aspect of the invention. The system may have an in-vehicle network. Alternatively or additionally, the system may have one or more actuators and alternatively or additionally one or more sensors.

[0031] According to another embodiment, the additional control device is a control device according to the foregoing aspects of the invention, that is, a control device that executes the method for safe in-vehicle communication according to one aspect of the invention. Advantageously, a system can thus be provided in which each component reads all messages transmitted on the communication bus, checks which messages read from the communication bus carry identifiers with the source addresses of their respective components, and checks for these read messages whether the corresponding messages were sent from their respective components. Thus, the method for safe in-vehicle communication can be performed distributedly by the components of the system. Particularly advantageously, the system can be extended with other components, such as other controllers, sensors, or actuators. Thus, the method for safe in-vehicle communication can be performed modularly.

[0032] Another embodiment of the invention relates to a system in which an additional control device has transceivers configured to centrally execute a secure in-vehicle communication method for other control devices in the system. Thus, the control device executing the method according to one embodiment can also be easily and quickly connected to an existing centralized system. Here, the control device, operating modularly, utilizes the method according to one embodiment without needing to extend the existing system. In particular, to ensure secure in-vehicle communication, there is no need to further enable existing centralized systems with conventional hardware to inspect messages with identifiers corresponding to the newly connected control device. These can be monitored automatically by the newly connected control device.

[0033] Another aspect of the present invention relates to a vehicle having a system according to the foregoing aspects of the present invention for secure in-vehicle communication. The vehicle may be a passenger car or a truck. Attached Figure Description

[0034] Figure 1 A system according to one embodiment is shown, which is used to perform a method for conducting secure in-vehicle communication.

[0035] Figure 2The steps of a method for conducting secure in-vehicle communication according to one embodiment are illustrated schematically. Detailed Implementation

[0036] Figure 1 System 14, an embodiment of the present invention, is shown. System 14 is used for secure in-vehicle communication. System 14 has a communication bus 6 and components 2 and 4. Components 2 and 4 are control devices. Communication bus 6 is a CAN bus. Components 2 and 4 can be powered, for example, via communication bus 6 or via a separate power supply. Component 2 has a microcontroller 8, a storage medium 10, and a transceiver 12. Here, storage medium 10 is designed as flash memory and is used for non-volatile data storage. In particular, this allows data to be stored on storage medium 10 of component 2 for a period of time, during which the power supply to component 2 is not provided at any point in time. Instructions for executing methods for secure in-vehicle communication (as described in the following steps) are stored on storage medium 10. Storage medium 10 is connected to microcontroller 8. Alternatively, microcontroller 8 may include storage medium 10, or storage medium 10 may be integrated within microcontroller 8.

[0037] Furthermore, transceiver 12 is configured to read data from communication bus 6. Additionally, transceiver 12 is configured to convert the data read from communication bus 6 into data that can be processed by microcontroller 8. Furthermore, transceiver 12 is connected to microcontroller 8. Transceiver 12 is also configured to transmit the converted data from communication bus 6 to microcontroller 8. Additionally, transceiver 12 is configured to convert data received from microcontroller 8 into data that can be processed by communication bus 6 and transmit it to the communication bus. Transceiver 12 is configured to implement the protocols of layers 1 and 2 of the OSI layer model.

[0038] Microcontroller 8 is configured to execute a method for secure in-vehicle communication according to one implementation scheme. Figure 2 The steps are illustrated schematically. Here, the microcontroller 8 utilizes the storage medium 10 and the transceiver device 12. In the first step S1, component 2 sends a message to the communication bus 6. Here, the microcontroller 8 controls the transmission of the S1 message to the communication bus 6 via the transceiver device 12. Here, the microcontroller 8 is configured to implement layers 3 and 4 of the OSI layer model. According to one embodiment, the message to be sent to the communication bus 6 is first read by the microcontroller 8 from the storage medium 10. Alternatively or additionally, the message is sent to the microcontroller 8 via another interface of component 2 (not shown) before being sent to the communication bus 6. The source address of component 2 is obtained from the message sent by the microcontroller 8. The source address of the component is stored in the storage medium 10 and can be read by the microcontroller 8 from the storage medium 10, for example, for sending S1 or comparing S4, as described later.

[0039] Component 2 is configured to perform step S2, which stores information about the sent message on the component. Specifically, microcontroller 8 is configured to perform step S2, which stores information about the sent message on storage medium 10. According to one embodiment, microcontroller 8 stores the source address of the message (which corresponds to the source address of component 2) and information about the message content (e.g., notification), particularly as a checksum on storage medium 10. According to one embodiment, microcontroller 8 stores the entire message on storage medium 10.

[0040] Component 2 is configured to perform step S3, which involves reading all messages on the communication bus 6. Specifically, the microcontroller 8 is configured to drive the transceiver 12 to read all notifications sent on the communication bus 6, convert them into data that the microcontroller 8 can process, and send them to the microcontroller 8.

[0041] Component 2 is also configured to perform step S4, which compares the information of the read messages with the information of the sent messages. Specifically, microcontroller 8 is configured to read the information of the sent messages stored on storage medium 10 and compare it with the messages and their information read from communication bus 6 via transceiver device 12. In one embodiment, microcontroller 8 reads information of all sent messages of component 2 stored on storage medium 10 for comparison step S4.

[0042] Step S4 includes a first sub-step S4.1 that checks the source address of the read message from component 2. Here, component 2 is configured to, in the first sub-step, in order to determine the discrepancy between the information of the read message and the information of the sent message, first check which read messages have a source address in their respective identifiers. Specifically, microcontroller 8 is configured to check whether the source address exists in the identifier of each message read from communication bus 6.

[0043] The information comparison step S4 for determining the deviation also includes a second sub-step S4.2 for checking the information deviation. The microcontroller 8 is specifically configured to check for information that differs from all transmitted messages stored on the storage medium 10 for all messages read from the communication bus 6 that have an identifier corresponding to the source address of component 2. In particular, the microcontroller does not perform information deviation checks between the read messages and the transmitted messages stored on the storage medium 10 for messages read from the communication bus 6 that have an identifier that does not correspond to the source address of component 2. In one embodiment, the identifier corresponding to the source address includes the source address. If at least one message with the source address of component 2 is read but is not stored on the storage medium 10, in other words, differs from all messages stored on the storage medium 10, then a deviation exists.

[0044] Component 2 is also configured to execute step S5 of implementing countermeasures. Specifically, microcontroller 8 is configured to implement countermeasures when a discrepancy exists in step S4 based on the information comparison of the read and sent messages. According to one embodiment, microcontroller 8 controls the disconnection of the drive system of the vehicle (in which the system 14 uses secure vehicle communication). A safe vehicle state is established by disconnecting the drive system.

[0045] System 14 also has another component 4. This component is a control device 4. According to one embodiment, components 2 and 4 are configured to communicate with each other via a communication bus 6. According to one embodiment, the structure of component 4 is similar to that of component 2, and component 4 is specifically configured to perform the aforementioned method including steps S1 to S5. According to another embodiment, component 4 has a transceiver device configured to centrally execute methods for safe in-vehicle communication with other control devices of the system. In particular, in order to execute the methods for safe in-vehicle communication on component 4, it is not necessary to store all messages on the storage medium of component 4.

[0046] In the secure vehicle communication shown here, each component 2, 4 of system 14 is configured to inspect the messages transmitted by it. This provides a modular structure for secure vehicle communication via communication bus 6. Consequently, secure vehicle communication is distributed across components 2, 4. Expanding communication bus 6 with other components while adhering to secure vehicle communication requirements is easy and, in particular, inexpensive. It can also be achieved by using the aforementioned method including steps S1 to S5, whereby each other component with conventional transceivers can be used for secure vehicle communication via communication bus 6, in such a way that instructions for performing the aforementioned method of secure vehicle communication are stored on the respective storage medium of the component, and the microcontroller of that component is configured to execute these instructions. Further enabling or modification of the hardware configuration of other components is unnecessary, especially regarding the transceivers specifically configured for secure vehicle communication.

[0047] Figure Labels

[0048] 2.4 Components / Control Device

[0049] 6. Communication bus

[0050] 8 Microcontrollers

[0051] 10 Storage Media

[0052] 12 Transceiver Device

[0053] 14 Systems

[0054] S1 (Step) Send Message

[0055] S2 (Step) Store the information of the sent message.

[0056] S3 (Step) Read all messages on the communication bus

[0057] S4 (Step) Compare the information in the read and sent messages.

[0058] S4.1 (Step) Check the component source address of the read message.

[0059] S4.2 (Step) Check for information deviation

[0060] S5 (Steps) Implementation Strategy

Claims

1. A method for secure in-vehicle communication between vehicle components via a vehicle communication bus, the method comprising the following steps: Send a message to the communication bus from at least one of the components; The component that sends the message stores information about the message. The component that sends the message reads all messages on the communication bus; The component that sends the message compares the information of the read message with the information of the sent message. and In response to discrepancies arising from comparisons between information read from the message and information sent from the message, a countermeasure is implemented. Specifically, when at least one read message that deviates from the message sent by the component that sent the message is consistent with a pre-defined message in the storage medium, an import prevention countermeasure is implemented.

2. The method according to claim 1, wherein, A message group is sent from at least one of the components, information of the sent message group is stored on the component that sent the message, information of the read message is compared with information of the sent message group, and countermeasures are implemented in response to discrepancies between information of the read message and information of the sent message group.

3. The method according to claim 1, wherein, Each message is assigned an identifier.

4. The method according to claim 2, wherein, Each message group is assigned an identifier.

5. The method according to claim 3 or 4, wherein, Each identifier has the source address of the component that sent the message.

6. The method according to claim 5, wherein, The deviation between the information of the message read by the component that sent the message and the information of the message sent is determined by a comparison step, wherein in the first sub-step, it is checked that for which read messages, the respective identifier has the source address of the component that sent the message, and in the second sub-step, it is then checked for these read messages that the information of all read messages is different from the information of the message sent.

7. The method according to claim 6, wherein, A discrepancy is determined when at least one read message differs from all messages sent by the component that sent the message.

8. The method according to any one of claims 1 to 4, wherein, The countermeasures are directly imported by the component that sends the message.

9. The method according to any one of claims 1 to 4, wherein, Import strategies include importing or establishing a safe vehicle status.

10. The method according to claim 9, wherein, A safe vehicle state is introduced or established by disconnecting the vehicle's drive system, limiting the engine power of the vehicle's drive unit, or by driving at least one actuator used to operate vehicle components.

11. A control device for safe in-vehicle communication, the control device comprising a microcontroller, a storage medium, and a transceiver, wherein, The microcontroller is configured to perform the method according to any one of claims 1 to 10 when using the storage medium and the transceiver.

12. A system for secure vehicle-mounted communication, the system having a control device, a communication bus, and additional control devices as claimed in claim 11.

13. The system according to claim 12, wherein, The additional control device is an additional control device for safe vehicle communication, the additional control device having a microcontroller, a storage medium and a transceiver, wherein the microcontroller of the additional control device is configured to perform the method according to any one of claims 1 to 10 when using the storage medium and transceiver of the additional control device.

14. The system according to claim 12, wherein, The additional control device has a transceiver, which is configured to centrally execute a method for safe in-vehicle communication for the additional control device of the system.

15. A vehicle having the system according to any one of claims 12 to 14.

Images