Method for activating a control instruction set in a motor vehicle of a user, and system for transferring the user authorization of

Abstract

The invention relates to a coupling of deactivation and activation of a control instruction set in a motor vehicle when the control instruction set is transferred from the motor vehicle to another motor vehicle. This is preferably accomplished using an external data processing device (backend system 40), in which messages (commands, Deakt., Akt.) and feedback (R1, R2) are exchanged between the external data processing device and the motor vehicle (1, 1 ').

Description

Technical Field

[0001] The present invention relates to a method for activating a control instruction set in a user vehicle to provide at least one predetermined function. The present invention also relates to a system for transferring the use rights of at least one control instruction set between a first user vehicle and a second user vehicle. Background Art

[0002] The predetermined functions mentioned may, for example, relate to the vehicle interior space experience, or vehicle functions used for the operation of the vehicle while driving, such as parking assistance, lane keeping assistance, vehicle speed regulation, map use of the navigation system, infotainment functions, etc.

[0003] When a control instruction set is activated, this refers to a piece of software that issues control instructions when it is run (a program running in a processor, etc.) The control instructions do not necessarily have to be determined in advance, but can depend on the acquired sensor data, for example also for control purposes.

[0004] Activating functions in a motor vehicle usually involves the use of an activation code.

[0005] For example, document DE 10 2016 215 628 A1 discusses the topic of associating predefined functions with authorizations that are to be transferred from one motor vehicle to another. In this case, person-related access authorizations are granted to individual vehicles or, for example, to groups of vehicles in the case of car sharing. This authorization is confirmed by possession of an electronic vehicle key, wherein the vehicle key has a communication module. The electronic vehicle key is not bound to a specific vehicle and the vehicle driver can log in when entering the vehicle using two-factor authentication.

[0006] The disadvantage of this is that users who frequently use the motor vehicle must log in again each time. Moreover, the necessity of having a key and associating the key with a certain vehicle also places requirements on the vehicle controller that are not easy to implement, for example, difficult to retrofit.

[0007] It is known from document US 2022 / 0291648 A1 that a vehicle user who initially uses a first vehicle and has authorization therein also uses at least part of his authorization in the second vehicle when he subsequently uses a second vehicle. In this case, a central data processing device serves as an intermediary. Summary of the invention

[0008] The object of the present invention is to improve a method for activating a control instruction set in a user motor vehicle to provide at least one predetermined function when multiple vehicles are to be used alternately, and to provide a corresponding system for transferring the use rights of at least one control instruction set between a first user vehicle and a second user vehicle.

[0009] This object is achieved by a method having the features according to claim 1 and a system having the features according to claim 6 .

[0010] The method for activating a control instruction set in a user's motor vehicle to provide at least one predetermined function according to the present invention comprises:

[0011] - Authenticate personnel with access to the control instruction set, and upon successful authentication:

[0012] first

[0013] - deactivate the control command set on another motor vehicle and only if deactivation is successful,

[0014] - Activating a control instruction set at a user vehicle.

[0015] Compared to the method according to DE 10 2016 215 628 A1, an advantage is that no electronic vehicle key is required. Compared to US 2022 / 0291648 A1, a reliable check is provided to ensure that the function is not used twice, since deactivation must first be successfully achieved in a motor vehicle.

[0016] The invention is also advantageous in particular in that authorizations can also be transferred from one motor vehicle to another in the backend, for example via a secure human-machine interface, for example by a vehicle fleet operator. Therefore, according to an advantageous embodiment, provision is made for a data processing device external to the motor vehicle to be used, at which the person can be authenticated and via which deactivation and activation can be performed.

[0017] In this regard, it is also advantageously provided that the external data processing device sends a deactivation command to another vehicle, which executes the command and cancels the use of at least one predetermined function (so that in a sense the function is temporarily interrupted until reactivated later), and then sends feedback to the external data processing device, and wherein the external data processing device, after receiving the feedback, sends an activation command to the user vehicle, which executes the command and enables / activates at least one predetermined function (and preferably also sends feedback as well).

[0018] This sequence of data exchange ensures greater safety, especially for fleet operators of vehicle fleets.

[0019] According to a preferred embodiment of this aspect, it is also provided that the external data processing device is accessed through a personal computer and / or a notebook computer and / or through an application on a smartphone, a smart watch and / or other wearable device and / or a tablet computer. Accordingly, for the external data processing device, the human-machine interface is provided, for example, through a mask in the Internet or through a specific application ("App", "Applet").

[0020] According to a preferred embodiment of the present invention, when a control instruction set for a predetermined user vehicle is activated for the first time, the control instruction set is also transferred to the user vehicle. This is particularly meaningful for a vehicle interior space experience that is not provided in every vehicle.

[0021] Alternatively or preferably, after the first activation of the control instruction set and when the control instruction set is reactivated again after the first deactivation, the control instruction set already stored in the user's vehicle can be used. This allows the vehicle manufacturer to set a large number of functions in the core and enable these functions for those who pay for them ("activation on demand").

[0022] The system for transferring the use right of at least one control instruction set between a first user vehicle and a second user vehicle according to the present invention comprises:

[0023] - an external data processing device having a communication interface for correspondingly communicating with a communication interface of a user vehicle; and

[0024] - a user data processing device for accessing an external data processing device,

[0025] Wherein, the external data processing device is designed to:

[0026] a) enabling the user data processing device to predetermine (via an input mask or an application) the deactivation of the authorization to use a user vehicle for which the authorization had previously been activated,

[0027] b) then sending the deactivation instruction to the corresponding user vehicle via the communication interface,

[0028] c) then receiving feedback via the communication interface that the deactivation was successfully achieved,

[0029] d) then enabling the user data processing device to pre-assign authorization to activate the user vehicle for which the authorization had been previously deactivated,

[0030] e) The activation instruction is then sent to the corresponding user vehicle via the communication interface.

[0031] The user data processing device of the system can be provided in particular for owners of a plurality of vehicles, i.e. at least a first user vehicle and a second user vehicle. This can be members of a family whose members alternately use a plurality of user vehicles as vehicle drivers. This can also be owners of a fleet of vehicles.

[0032] According to a preferred embodiment, the external data processing device is designed to query the user's authentication before processes a) and c). The user data processing device (in the above example, the smartphone of a family member) can perform this authentication, or the authentication can be performed by the person who is to be the user on his own personal data processing device.

[0033] If the personal data processing device and the user data processing device are identical, according to a preferred embodiment the user data processing device can communicate with the external data processing device via a communication interface of the motor vehicle, in particular the first motor vehicle or the second motor vehicle.

[0034] According to another preferred embodiment, corresponding data are stored for multiple persons in a first database of an external data processing device, which data provide information about the persons' use rights to a control instruction set, and stipulate that during a transfer, multiple or preferably all use rights of a person are always transferred at one time from one user vehicle to another user vehicle.

[0035] In this case, however, the fleet operator can of course also change the access rights of the personnel in the database.

[0036] It can therefore be provided that the external data processing device is designed to offer, when the authorization for the vehicle is activated, a purchase or rental option for authorization for another control instruction set that has not yet been activated. This offer can be realized, for example, by automated software or by an active decision of the fleet operator, for example when the fleet operator wants to recommend other authorizations to certain persons in addition to the already existing authorizations or to attract certain persons.

[0037] The motor vehicle is preferably designed as a car, in particular a passenger car or truck, or as a bus or a motorcycle.

[0038] As other solutions, the present invention also includes a computer-readable storage medium, which includes instructions, and when executed by a computer or a computer network, the instructions execute an embodiment of the method according to the present invention. The storage medium can be designed at least in part as a non-volatile data memory (such as a flash memory and / or an SSD solid state drive) and / or at least in part as a volatile data memory (such as a RAM random access memory). However, the storage medium can also be operated as a so-called application store server in the Internet, for example. A computer or a computer network can provide a processor circuit with at least one microprocessor. The instructions can be provided as a binary code or an assembler and / or as a source code of a programming language (such as C language).

[0039] The present invention also includes combinations of features of the described embodiments. Therefore, the present invention also includes implementations that respectively have a combination of features of a plurality of the described embodiments, as long as these embodiments are not described as mutually exclusive. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The embodiments of the present invention are described below with reference to the accompanying drawings, in which:

[0041] The only attached picture ( Figure 1 ) shows an embodiment of the system according to the invention, in which an embodiment of the method according to the invention can be implemented. DETAILED DESCRIPTION

[0042] The embodiments described below are preferred embodiments of the present invention. In the embodiments, the components described in the embodiments are corresponding to the individual features of the present invention that can be considered independently of each other, and they also improve the present invention independently of each other. Therefore, the present disclosure should also include other combinations of the feature combinations that are different from the embodiments. In addition, the described embodiments can also be supplemented by other features in the already described features of the present invention.

[0043] In the figures, the same reference numerals respectively denote elements with the same function.

[0044] In the vehicle 1 there is a central control unit 10, via which vehicle functions can be accessed. Examples of these are a vehicle parking aid (actuator 12a), a lane keeping aid (actuator 12b) and an actuator 12c (which may also represent a plurality of actuators) for providing a vehicle interior spatial experience, shown symbolically.

[0045] The motor vehicle 1 has a communication interface 14. The motor vehicle 1' is similarly equipped, and there may be other motor vehicles 2 and 3. Further actuators may also be provided in the vehicle 1', but they provide similar functions (12a', 12b' and 12c'); and at least one further actuator 12d' (for example for providing a navigation system), which may not be present in the motor vehicle 1.

[0046] In the present case, user 100 initially used motor vehicle 1 but then wanted to use motor vehicle 1 '. The fleet operator has assigned certain functional rights to the user. The assignment may be based on purchase or lease, or may be done by the employer based on income or employment contract content, etc.

[0047] In addition to the motor vehicle 1 and its vehicle systems (including the controller 10 as a central management unit and the communication interface 14 as a transceiver unit), the entire system also includes other units, such as a so-called front-end system for the user (having sub-components "input human-machine interface", transceiver unit and "processing unit") and a back-end system (having sub-components "transceiver unit", "processing unit", "document unit", "authentication unit" and, if necessary, "security unit") and, if necessary, a store system (having sub-components "transceiver unit", "management unit", "document unit" and "financial processing unit").

[0048] Each system is inherently tamper-proof, and all internal communications are key-encrypted.

[0049] The core of the method is the so-called backend or backend system 40, which implements a central data processing device in a system that is external to motor vehicles 1 and 1' (in principle, the unit can also be integrated in a special vehicle. As long as the unit is designated as an external system, this applies at least to vehicles 1 and 1' as well as 2 and 3).

[0050] The front-end system has a user data processing device 20, which, in addition to a central processor 22, also has a communication interface 24. The back-end system 40 also has a processor 42 and a communication interface 44, which can communicate wirelessly with the communication interface 14 of the motor vehicle 1, 1', if necessary via a satellite transmission (not shown here), and can also communicate with the communication interface 24 of the user data processing device 20, for example via the symbolically shown Internet 30. The store system 50 is also connected to the Internet.

[0051] This approach includes several aspects:

[0052] - User authentication,

[0053] - Vehicle-functional connection changes,

[0054] - Purchase feature upgrades,

[0055] - Implement join changes.

[0056] A user (e.g. user 100 or the relevant fleet operator) can log in via the user data processing device 20 in the external data processing device (backend system 40) (here symbolically represented by the arrow "Login" for logging in (English Login), for example for logging in via a mask or by using an application on a smartphone as user data processing device 20). The external data processing device 40 requests authentication. The user must enter his credentials / certificate via the human-machine input interface of the user data processing device. The request for input is symbolically represented by an arrow marked "Auth?". The result of the input is sent to the external data processing device according to the arrow "Auth!". In the processor 22 of the user data processing device as a "processing unit", the input is formally checked and, if formally valid, it is transmitted to the communication interface 44 by means of the communication interface 24. The communication channel is protected by encryption. For this purpose, the external data processing device 40 has a memory 48 for cryptographic keys K100, K200, K300 corresponding to the persons 100, 200, 300, where "K" stands for key.

[0057] The external data processing device accepts the user authentication and processes the user authentication in the processor 42. At this time, the result is: "user authenticated" or "user not authenticated". Here, the case of successful user authentication is further processed. Feedback is optionally provided to the user or his user data processing device 20 (here in Figure 1 ): Authentication has been successful and the result can be displayed to the user.

[0058] Only when the result is "user authenticated", the sub-step "vehicle-function connection change" is initiated, and the processor 22 of the user data processing device 20 as the front-end system decides to retrieve information about the vehicle, function and "vehicle-function" connection assigned to the user from the back-end system 40, that is, from the external data processing device. In the database 46 of the back-end system 40, that is, the external data processing device, in particular, a plurality of data groups corresponding to the persons 100, 200 and 300 are stored, which data groups are respectively associated with the names of the permissions assigned to the persons, wherein the data groups are stored in the back-end system 40, that is, the database 46 of the external data processing device. Figure 1 The 100-R, 200-R and 300-R correspond to personnel 100, 200 and 300 respectively, where "R" stands for "authority".

[0059] The communication interface 44 in the external data processing device receives the request and transmits it to the processor 42. The validity of the authentication is checked again there. The validity period may have expired after a duration specified in the process, for example. Then, the user authentication must be performed again.

[0060] The processor 42 reads the vehicle, vehicle-function functional connection assigned to the user 100 from the database 46 as a "document unit" based on the data set 100-R, and transmits the data packet from the database 46 to the processor 42 upon request, and the processor transmits the data set to the user data processing device 20 via the communication interface 44. Optionally, the data packet can now also be provided to the authenticated user for viewing. The authenticated user can appropriately edit the association or connection between the vehicle and the function within the limited validity period of the authentication.

[0061] Depending on the type of function acquisition (including or excluding modifiability), the user can now edit the association according to the data set 100-R. The user can cancel the "vehicle-function" connection and create a new connection between the unconnected function and the vehicle. Here, the store system 50 used later can also play a role.

[0062] The input human-machine interface 26 now communicates the desired connection to the processor 22, which checks the general availability of the functions for the vehicle to be connected. This is achieved by the combination of vehicle functions provided together in the data package. If the vehicle does not have the function, for example if the required sensors, actuators and / or controllers are not installed, the interface 26 refuses the connection and indicates this in a suitable manner.

[0063] If the function is available in a different function version, it is also checked here whether this is still available for the vehicle or whether the user can use the function with the vehicle only by upgrading the function. In the example case, the parking assistance according to the actuator 12a' in the vehicle 1' can, for example, work with more cameras than the parking assistance 12a in the vehicle 1. In this case, an upgrade of the function may be necessary.

[0064] The interface 26 offers the service of purchasing upgrades to authenticated users, for which the user is transferred to the store system 50. The user can purchase the upgrade there. After the transaction has taken place, the vehicle, function and vehicle-function connection associated with the user are updated and then retrieved again in the external data processing device (backend system 40). A suitable mask giving a simplified representation can be provided in the user data processing device 20 (frontend system).

[0065] The authenticated user actively saves the changes, because this is the only way to proceed to the next step.

[0066] With the saving, the user first transfers the new vehicle-function connection bindingly to the backend system 40. Therefore, a data packet is generated via the interface 26, which is formally checked by the processor 22 as a processing unit in the user data processing device 20 and then transmitted to the communication interface 44 of the external data processing device (backend system 40) via the communication interface 24 of the user data processing device 20. Here, the communication channel is also encrypted again.

[0067] At this point, either without or after purchasing the upgrade, you can complete the next substep, Implement the connection changes.

[0068] The processor 42 of the external data processing device now checks the consistency of the existing data to prevent possible tampering. If the data is inconsistent, the sub-step is terminated. The processor 42 now determines which changes should be made in the vehicle-function connection. Check the feasibility of the vehicles participating in this process for activation or deactivation of the function (accessibility of the corresponding communication interface 14). If at least one vehicle is currently not feasible, the sub-step is terminated and an error is sent to the user 100. If all required vehicles are feasible, a deactivation is generated for the vehicle from which the vehicle-function connection is to be removed. Here, this is explained using vehicle 1: an instruction is sent to the communication interface 14 of vehicle 1 via the communication interface 44 (arrow "Deakt."). After the vehicle function is deactivated, the motor vehicle 1 sends feedback according to R1 to the communication interface 44 of the external data processing device 40 via the communication interface 14. Here, deactivation can also be ensured individually for each vehicle using encryption (K100).

[0069] In vehicle 1 , the deactivation is transmitted via communication interface 14 to central control unit 10 , which interprets the data packet and performs the tasks required to change the authorization. A response is then generated.

[0070] If the processor 42 is provided with feedback R1 from the motor vehicle 1 (and possibly other motor vehicles), the function is successfully deactivated, and the processor 42 then sets up an activation for the motor vehicle to which the vehicle-function connection is to be added, here again encrypted. Figure 1 , is symbolically represented by the message "Akt." for "activation" transmitted from the communication interface 44 of the external data processing device (backend system 40) to the communication interface 14 of the motor vehicle 1'. Here again, a transmission from the communication interface 14 to the central control unit 10 takes place, which converts the data packet and in particular activates the authorization for the function. In this example, the function to be purchased additionally can be activated for the actuator 12a' and, in the case of identical functions, can also be activated for the actuators 12b' and 12c'.

[0071] Furthermore, it may optionally occur that a function for activating a navigation system with actuator 12 d ′ has been purchased in addition.

[0072] Control unit 10 of motor vehicle 1 ′ transmits feedback R2 to external data processing device 40 via communication interface 14 that the function is now activated.

[0073] Once all deactivations and activations have been completed, the database 46 is updated. For example, in the data 100-R it is stored that the functional authorization is associated with the motor vehicle 1' and is no longer associated with the motor vehicle 1 as before. (Of course, the history can also be stored until it is deleted after a predetermined time or after a predetermined event such as billing.)

[0074] A success message is then transmitted to the user data processing device 20 , whereupon the connection change is known, and a report including the time stamp of the last activation is then available, which is sent to the interface 26 of the authenticated user and displayed there.

[0075] The interface 26 does not allow any other changes to be made between the saving of the join changes and the reporting of the success of the executed join changes, or at least does not allow the saving.

[0076] The invention provides a vehicle fleet operator with the possibility of equipping a part of the vehicle fleet with customer-experienced functions or function extensions and of re-exchanging these functions or function extensions between vehicles. Thus, the vehicle fleet operator can offer its customers equivalent replacement vehicles, for example during service maintenance or the like.

[0077] In general, the examples demonstrate how methods for transferring access to functionality that a customer may experience between two or more vehicles may be provided.

Claims

1. A method for activating a control instruction set in a user's vehicle to provide at least one predetermined function, the method comprising: - Authenticate a person with permission to use the control instruction set, and upon successful authentication: first - deactivating the control command set on the other motor vehicle (1) and only if deactivation is successful, then - Activating a control command set on the user vehicle (1').

2. The method according to claim 1, characterized in that An external data processing device (40) is used relative to the motor vehicle (1, 1'), at which a person can be authenticated and via which deactivation and activation can be carried out.

3. The method according to claim 2, characterized in that For deactivation, the external data processing device (40) sends a command (Deakt.) to the other vehicle (1), the other vehicle executes the command, cancels the use of at least one predetermined function, and then sends feedback (R1) to the external data processing device (40), wherein the external data processing device (40) sends a command (Akt.) for activation to the user vehicle (1') after receiving the feedback (R1), the user vehicle executes the command and activates at least one predetermined function.

4. The method according to claim 2 or 3, characterized in that: The external data processing device (40) is accessed via a personal computer and / or a laptop and / or via an application on a smartphone, a smart watch and / or other wearable device and / or a tablet.

5. The method according to any one of the preceding claims, characterized in that When a control instruction set is activated for a certain user vehicle for the first time, the control instruction set is also transmitted to the user vehicle.

6. A system for transferring the right to use a control instruction set between a first user vehicle (1) and a second user vehicle (1'), the system comprising: - an external data processing device (40) having a communication interface (44) for correspondingly communicating with the communication interface (14) of the user vehicle (1, 1'); and - a user data processing device (20) for accessing an external data processing device (40), Wherein, the external data processing device (40) is designed to: a) enabling the user data processing device (20) to predetermine the deactivation of the right of use for a user vehicle for which the right of use had previously been activated, b) then sending a deactivation command (Deakt.) to the corresponding user vehicle (1) via the communication interface (44), c) then receiving feedback (R1) that the deactivation is completed via the communication interface, d) enabling the user data processing device (20) to predetermine the activation of access authorization for a user vehicle (1') for which access authorization had previously been deactivated, e) Then, the activation command (Akt.) is sent to the corresponding user vehicle (1') via the communication interface.

7. The system according to claim 6, characterized in that The external data processing device (40) is designed to query the user's authentication before processes a) and c), wherein the user data processing device (20) is preferably able to perform this authentication.

8. The system according to claim 6 or 7, characterized in that: The user data processing device communicates via a communication interface of a motor vehicle, in particular of the first motor vehicle or of the second motor vehicle.

9. The system according to any one of claims 6 to 8, characterized in that In a database (46) of an external data processing device (40), data (100-R, 200-R, 300-R) are respectively stored for a plurality of persons (100, 200, 300), which data provide information about the use rights of these persons for a control instruction set, wherein it is provided that during a transfer, a plurality of use rights of each person and preferably all use rights are always transferred at once from one user vehicle (1) to another user vehicle.

10. The system according to any one of claims 6 to 9, characterized in that The external data processing device (40) is designed to, when activating authorization for the vehicle, offer a purchase or lease option for authorization for another control instruction set that has not yet been activated.

Images