Upgrading vehicle software based on vehicle field data

Abstract

One aspect of the present disclosure relates to a computer-implemented method for trusted upgrade of control software of a vehicle based on vehicle field data. The method comprises receiving vehicle field data in a central system, which collects and is provided with at least one digital signature of the vehicle and / or of a user of the vehicle during operation of at least one vehicle. The method further comprises recording the received vehicle field data into a data corpus and processing the data corpus of the central system to generate training data for a machine learning model if the vehicle and / or the user is identified as a valid sender of the vehicle field data by means of the digital signature, a machine learning model is trained using training data in a training environment, and the trained machine learning model is signed with a digital signature of the training environment. The method also includes providing the trained machine learning model with the signature of the training environment to another vehicle for software upgrade.

Description

Background Art

[0001] The software for vehicles (especially control software) is becoming more and more complex, especially due to the progress in the degree of automation of vehicles. In addition, machine learning systems play an increasingly important role in the software for vehicles. In this regard, it is expected or even necessary to update the software of the vehicle on site (i.e. in operation). On the other hand, the machine learning system requires training data from the field in order to ensure or improve its functionality. If the quality of the field data, the preparation of the field data and / or the training of the machine learning system are unsatisfactory, it will have a significant impact on the functionality of the software (and thus the vehicle). Therefore, it will be necessary to impose very strict restrictions on the possible data sources of the software development cycle. On the other hand, it is expected that as many participants as possible will be integrated into the process of collecting and processing field data, because larger data volumes and data diversity generally result in better training of the machine learning system. These requirements are somewhat contradictory.

[0002] It would be desirable to provide techniques that enable safe and efficient upgrading of vehicle software based on vehicle field data. Summary of the invention

[0003] A first general aspect of the present disclosure relates to a computer-implemented method for trusted upgrading of vehicle software based on vehicle field data. The method includes receiving vehicle field data in a central system, the vehicle field data being collected during operation of at least one vehicle and the vehicle field data being provided with at least one digital signature of the vehicle and / or a user of the vehicle. The method also includes: if the vehicle and / or the user are identified as valid senders of the vehicle field data by means of the corresponding digital signature, the received vehicle field data is recorded in a data corpus, and the data corpus of the central system is processed to generate training data for a machine learning model, the machine learning model is trained using the training data in a training environment, and the trained machine learning model is signed with the digital signature of the training environment. The method also includes providing the trained machine learning model with the digital signature of the training environment to another vehicle for software upgrade.

[0004] A second general aspect of the present disclosure relates to a computer system designed to perform the method according to the first general aspect.

[0005] The techniques of the first and second general aspects may have one or more of the following advantages.

[0006] Firstly, by providing data with digital signatures at various points in the software development cycle, the origin of the corresponding data can be checked. In particular, this can occur automatically. In some cases, it can be ensured that vehicle field data, trained machine learning models or software updates for vehicles originate from a trusted source. This can ultimately ensure and / or improve the performance of vehicles (in particular at least partially autonomous vehicles) that are supplied with software updates.

[0007] Secondly, scalability and extendibility to different data sources (eg drivers or organizations) may be achieved through digital signatures, which in some examples are generated with the aid of decentralized key generation.

[0008] Certain terms are used in this disclosure as follows:

[0009] The term "vehicle" includes any device that transports passengers and / or cargo. A vehicle can be a motor vehicle (such as a passenger car or a truck), but can also be a rail vehicle. However, floating and flying devices can also be vehicles.

[0010] The term "user" includes any person who travels with the vehicle, is transported by the vehicle or monitors the operation of the vehicle. A user may be a passenger (especially the driver) of the vehicle. However, a user may also be located outside the vehicle and, for example, control and / or monitor the vehicle (e.g. during a parking process or from a remote control center).

[0011] A "digital signature" in the present disclosure is part of an asymmetric encryption system in which the sender calculates a date called a signature with the help of secret information (e.g. a secret signing key, also called a secret key or "Private Key" in English) about any data (in the present disclosure, for example, vehicle field data, machine learning models, or software upgrades). The date enables a third party to check the authorship and / or integrity of any data with the help of public information (e.g. a verification key, also called a "public key" or "Public Key" in English). In order to be able to associate a signature created with the help of a signing key with the author, the associated verification key must be explicitly associated with the person. Therefore, a digital signature can identify the author of the data in a verifiable manner.

[0012] "Vehicle field data" (or also simply "field data") includes all data accumulated in connection with the operation of one (or a large number) of vehicles and in particular used for designing (e.g. training) the vehicle (or its systems). For example, the vehicle field data can be used to generate corresponding operating scenarios in a simulation environment to train the vehicle (or the system contained therein). "Vehicle field data" is a corpus of field data. In some cases, the vehicle field data may include field data in a form structured according to a unique preset pattern. However, the corpus of vehicle field data may consist of different sub-data groups, which are respectively structured differently.

[0013] A "cloud computing system" (German Rechnerwolken-System or Datenwolken-System computer cloud system or data cloud system) is an infrastructure available via a network (e.g. via the Internet). A "cloud computing system" usually includes storage space, computing power and / or application software as a service (i.e. the user can use the resources via the network). In other words, a cloud computing system is an infrastructure provided via the network, which does not have to be present / installed on the local system. A "cloud computing system" can include distributed resources (e.g., multiple computer systems located at different locations). The resources of a "cloud computing system" are provided and used here via technical interfaces and protocols (e.g., with the help of a web browser). BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 An exemplary system according to the present disclosure is shown.

[0015] Figure 2 Flowchart showing the steps of the disclosed technique.

[0016] Figure 3 The issuance and checking of the digital signature of the present disclosure is shown. DETAILED DESCRIPTION

[0017] First, according to Figure 1 and Figure 2 Explain the technology of this disclosure. Figure 3 Other aspects of digital signatures (eg, generated with the aid of decentralized generated keys) of the present disclosure are discussed.

[0018] Figure 1 An exemplary system according to the present disclosure is shown. Figure 2 is a flow chart of the steps of the disclosed technique.

[0019] The method includes receiving 210 in a central system 104 vehicle presence data 105, which is collected during operation of at least one vehicle 101 and which is provided with at least one digital signature of the vehicle 102 and / or a user 103 of the vehicle, such as a driver 107 of the vehicle 101. In some examples, the vehicle presence data 105 may be received via an air interface, such as via a mobile radio channel.

[0020] The vehicle scene data 105 may include sensor data recorded during the operation of the vehicle 101. For example, the vehicle scene data 105 may exist as time series data. The vehicle scene data 105 may include image data (eg, single frame image or video image data).

[0021] The sensor data may include, for example, camera data (e.g. in the visible or infrared spectrum), lidar sensor data, radar sensor data, temperature sensor data and / or ultrasonic sensor data. Alternatively or additionally, the sensor data may be location data (e.g. GPS data) or vehicle field data describing the operating state of the vehicle (e.g. steering angle, rotation speed, operating mode, loading, etc.). The sensor data may characterize the environment of the vehicle, its interior space and / or its operating state. It is feasible that the corresponding sensor generating the sensor data is located in the vehicle (i.e., moves with the vehicle and moves through the vehicle). However, in other examples, the sensor may also be located outside the vehicle (e.g., in an infrastructure component or in other vehicles or traffic participants).

[0022] In an illustrative example, the sensor data may be camera data of a camera of the autonomous vehicle (eg, a camera pointing in the direction of travel). The camera data is continuously processed (eg, used to create an environment model of the autonomous vehicle).

[0023] The method further comprises recording 220 the received vehicle live data 105 into the data corpus if the vehicle 101 and / or the user 107 are identified as valid senders of the vehicle live data 105 by means of the corresponding digital signatures 102, 103. On the other hand, if the vehicle 101 and / or the user 107 are not identified as valid senders of the vehicle live data 105 by means of the digital signatures 102, 103, the received vehicle live data 105 cannot be recorded in the data corpus. In other examples, in this case, the central system 104 may request further information from the sender of the vehicle live data 105.

[0024] A digitally signed public key of the vehicle 102 and / or a user 103 of the vehicle (eg, a driver of the vehicle 101 ) may be stored in the public register 108 .

[0025] Checking the digital signature of the vehicle 102 and / or the user 103 of the vehicle may include querying the public register 108 for the public key of the corresponding signature 102, 103. In some examples, the sender of the vehicle presence data 105 may be considered a valid sender if the digital signature 102, 103 can be verified based on the corresponding public key from the public register 108. If the public key for the digital signature 102, 103 is not stored in the public register 108 and / or the digital signature of the vehicle 102 and / or the user 103 of the vehicle cannot be verified with the help of the corresponding public key, the sender of the vehicle presence data 105 cannot be considered a valid sender.

[0026] The digital signature of the vehicle 102 and / or the user 103 of the vehicle (as well as other digital signatures disclosed herein) may be a digital signature generated with the aid of a decentralized key. Figure 3 Additional aspects of decentralized generated keys and digital signatures generated therewith are discussed.

[0027] In some examples, central system 104 may be a first cloud computing system. In some examples, first cloud computing system may include cloud storage to receive vehicle field data 105 and store the data corpus.

[0028] The vehicle presence data 105 may be filtered and / or pre-processed.

[0029] The method also includes processing 230 the data corpus of the central system 104 to generate training data for the machine learning model.

[0030] In some examples, the step of generating training data may include one or more of the following steps.

[0031] The vehicle scene data 105 may be placed in a machine-readable format (e.g., placed in an input format for a training environment for a machine learning model). Alternatively or additionally, specific information (e.g., still image data or a sequence of image data and / or a sequence of position data) may be extracted from the vehicle scene data 105 and then further processed. Further alternatively or additionally, the vehicle scene data 105 (or information extracted therefrom) may be provided with labels 111 (e.g., to enable training a machine learning model, such as a classifier).

[0032] The technology of the present disclosure also includes training 240 the machine learning model using the training data in the training environment. Figure 1In the example of , the training environment is part of the central system 104. In other examples, the training environment can be arranged in another system (e.g., another cloud computing system or another system networked with other systems of the present disclosure).

[0033] The machine learning model can be a classifier. In some examples, the classifier can be an image classifier (e.g., for identifying objects in an environment or within a vehicle and / or for classifying the operating state of a vehicle and / or its environment). An image classifier can classify an image or the objects contained therein based on features of the image data (e.g., pixel values, edge positions, etc.) (e.g., to identify specific objects in the vehicle environment). In other examples, the classifier can process other data types and / or provide other classification results (e.g., regarding the operating state of a vehicle and / or the state of the vehicle environment). In other examples, the machine learning model can be a regressor or other type of model.

[0034] A machine learning model may include one or more neural networks.

[0035] The method also includes signing 250 the trained machine learning model 110 with the digital signature of the training environment 109. If the training environment is part of the central system 104 (e.g., part of the first cloud computing system), the digital signature of the training environment 109 can be the digital signature of the central system 104.

[0036] The method according to the present disclosure also includes providing 260 the trained machine learning model 110 with the signature of the training environment 109 to another vehicle 120 for software upgrade. In some examples, labels 111 of the training data used to train the machine learning model may also be provided.

[0037] The methods of the present disclosure may include additional steps.

[0038] In some examples, a method for trusted upgrade of vehicle software includes receiving a trained machine learning model 110 having a signature of a training environment 109 in a software test environment 112. In the software test environment 112, a digital signature of the training environment 109 (e.g., a central system) can be checked. In a further step, if the training environment 104 is identified as a valid sender of the trained machine learning model according to the digital signature of the training environment 109 (e.g., a central system), the trained machine learning model can be tested in the software test environment 112.

[0039] In some examples, the software testing environment is on a second cloud computing system. The second cloud computing system may be different from the first cloud computing system (on which the central system and / or the training environment are located) (e.g., the first cloud computing system and the second cloud computing system may be managed by different entities).

[0040] Checking the digital signature of training environment 109 (e.g., the central system) may include querying public register 108 for a public key of the digital signature of training environment 109. In some examples, training environment 104 may be considered a valid sender if the digital signature of training environment 109 can be verified with the help of a key stored in public register 108. If the corresponding key is not stored in public register 108 or the digital signature of training environment 109 cannot be verified with the help of a stored public key, training environment 104 cannot be considered a valid sender.

[0041] In some examples, trained machine learning model 110 in software testing environment 112 can be integrated into a simulation environment.

[0042] In a simulation environment or another testing environment of the software testing environment 112, the trained machine learning model 110 can be tested (e.g., for a specific function).

[0043] In some examples, the trained machine learning model 110 can be tested in a software testing environment 112 along with the associated software components of the vehicle.

[0044] The method may also include signing the tested machine learning model 117 with the help of a digital signature of the software testing environment 113 (for example, if specific functions have been identified in the software testing environment 112).

[0045] The method may also include providing the tested machine learning model 117 having the digital signature of the software testing environment 113 to a control unit of another vehicle 120 in a software upgrade. Figure 1 In some examples, in addition to (or in lieu of) the tested machine learning model 117, the vehicle's software component 116 may be provided as part of a software upgrade. Additionally or alternatively, a tag 111 may be provided as part of a software upgrade. The additional (or alternative) data may also be digitally signed by the software testing environment 113.

[0046] In some examples, the method may include receiving, in a vehicle 101, 120 (e.g., the other vehicle 120), a software upgrade having a digital signature of the software test environment 112 and / or a digital signature of the training environment 109. In the corresponding vehicle 101, 120, based on the digital signature of the software test environment 112 and / or the digital signature of the training environment 109, it may be checked whether the software test environment 112 and / or the training environment 109 is a valid sender of the software upgrade.

[0047] Checking the digital signature of the software testing environment and / or the digital signature of the training environment 109 may include querying the public register 108 for a public key of the corresponding digital signature.

[0048] In some examples, training environment 104 may be considered a valid sender if the signature can be verified with the public key from public register 108. However, if the public key of the training environment is not stored in public register 108 and / or the digital signature of training environment 109 cannot be verified with the stored public key, training environment 104 cannot be considered a valid sender.

[0049] In the same manner, the software testing environment 112 can be considered a valid sender if the signature can be verified with the help of the public key from the public register 108. If the public key of the software testing environment is not stored in the public register 108 and / or the digital signature of the software testing environment cannot be verified with the help of the stored public key, the software testing environment cannot be considered a valid sender.

[0050] In some examples, receiving the software upgrade and / or checking the digital signature of the software testing environment 112 and / or the digital signature of the training environment 109 may be performed by the connectivity module 116 of the vehicle 101 , 120 .

[0051] If the software test environment 112 and / or the training environment 104 are identified as valid senders of the software upgrade, the vehicle's software components may be updated according to the software upgrade in the vehicle 101, 120. If the software test environment 112 and / or the training environment 104 are not identified as valid senders of the software upgrade, the vehicle 101, 120 may prohibit updating the vehicle's software components according to the software upgrade.

[0052] Software upgrades may be provided to the vehicles 101 , 120 via the air interface.

[0053] In the above method, the provision of corresponding digital signatures for various data can be implemented for various participating systems: checking the corresponding sender as a valid data source. Here, the checking step can be performed automatically (i.e. without any user intervention). In some cases, this can improve the safety and efficiency of the development process of software components for vehicles (especially at least partially autonomous vehicles). In addition (and therefore), the method of the present disclosure can be more easily expanded, because through the verifiability of the data source, data sources different from those in the methods of the prior art can also be incorporated into the development process of the software components. This in turn leads to: providing a wider database for developing software components, which can improve the quality of software components based on machine learning.

[0054] exist Figure 1 A unique training environment and a unique software testing environment 112 are shown in FIG. In other examples, the system of the present disclosure may include multiple training environments and multiple software testing environments that exchange data using corresponding digital signatures.

[0055] In some examples, the data corpus of central system 104 can be processed to generate second training data for a second machine learning model. The second machine learning model can be trained using the second training data in a second training environment, and the trained second machine learning model can be provided with a digital signature of the second training environment.

[0056] The steps described above regarding generating training data and training a machine learning model can be similarly used in the generation of second training data and a second machine learning model.

[0057] The first training environment and the second training environment may be located on different cloud computing systems.

[0058] The first training environment and the second training environment can train machine learning models for different purposes of use. The different purposes of use can be one or more of different vehicle types and / or different control device types and / or different control software. As described above, the second machine learning model trained in the second training environment can be sent to the software testing environment 112 and / or the vehicle 101, 120 and further processed there.

[0059] In some examples, the system may include one or more additional training environments that can train the machine learning model as the first / second training environment.

[0060] In some examples, the system includes a second software testing environment.

[0061] The second software testing environment may receive the trained machine learning model 110 (and possibly the label 111) with the digital signature of the training environment 109. In the second software testing environment, if the training environment is identified as a valid sender of the trained machine learning model based on the digital signature of the training environment 109, the trained machine learning model 110 may be tested. Additionally, in the second software testing environment, the tested machine learning model may be signed with the aid of the digital signature of the second software testing environment. The tested second machine learning model may be provided to a control unit of another vehicle 120 along with the digital signature of the second software testing environment as part of a software upgrade.

[0062] In some examples, the software component of the vehicle is provided as part of a software upgrade in addition to the tested second machine learning model. Additionally or alternatively, the tag can be provided as part of the software upgrade. The additional data can also be provided with a digital signature of the second software testing environment.

[0063] The first and second software testing environments can train software components for different usage purposes. The different usage purposes can be one or more of different vehicle types and / or different control unit types and / or different control software.

[0064] The first software testing environment 112 and the second software testing environment may be located on different cloud computing systems.

[0065] In some examples, the system may include one or more additional software testing environments that can test the machine learning model and software components of the vehicle as the first / second software testing environment.

[0066] In some examples, the vehicle live data 105 may be sent by the vehicle 101. To this end, the vehicle live data 105 may be signed with at least one digital signature of the vehicle 102 and / or the user 103 of the vehicle, and the signed vehicle live data may be sent to the central system 104. The digital signature of the vehicle 101 may be added by the vehicle 101 itself or by the user 107. In some examples, the mobile device 106 (e.g., a smartphone) of the user 107 may be used to sign the vehicle live data 105. In other examples, a component of the vehicle (e.g., a mobile device) may be used to sign the vehicle live data 105. Figure 1 ) may perform signing with a digital signature of the vehicle 102 .

[0067] In some examples, sending the signed vehicle live data 105 may be triggered via the mobile device 106. In other examples, sending the signed vehicle live data 105 may be triggered via a user interface of the vehicle 101, 120.

[0068] In the foregoing examples, the technology of the present disclosure is explained based on two vehicles. In some examples, the technology of the present disclosure can be used to collect vehicle field data of a fleet of vehicles (e.g., more than 100 vehicles or more than 10,000 vehicles) and / or the software components of a fleet of vehicles (e.g., more than 100 vehicles or more than 10,000 vehicles) can be updated with the technology of the present disclosure.

[0069] In the previous examples, the digital signatures of the vehicle, the vehicle user, the training environment and / or the software test environment are added and checked at different points in the software development cycle. In other examples, the sequence may also be varied. Therefore, the digital signatures of the vehicle field data (e.g., from the vehicle and / or the user) may also be checked at other points (e.g., in the software test environment or the vehicle). In other examples, digital signatures other than the above digital signatures may be used.

[0070] Figure 3 The issuance and use of the digital signature of the present disclosure is illustrated.

[0071] As explained above, the digital signature of the present disclosure can be a decentralized digital signature. In this case, each participating system (or at least a plurality of participating systems) can independently issue information for generating digital signatures (i.e., there is no central authority that issues information for generating all digital signatures used in the present disclosure). For example, the signing key of the digital signature of a vehicle and / or a user and / or the signing key of the digital signature of a training environment and / or the signing key of the digital signature of a software testing environment (or other information for generating digital signatures) can be generated by at least two different points. In particular, the signing keys of the digital signatures of various training environments (or other information for generating digital signatures) can be generated by different points. Additionally or alternatively, the signing keys of the digital signatures of various software testing environments (or other information for generating digital signatures) can be generated by different points. In other examples, the signing keys of the signatures of different vehicles can be generated by different points (e.g., generated by various organizations that operate and / or manufacture the corresponding vehicles).

[0072] exist Figure 3 , a point 301 at which a signing key is issued for a digital signature of the present disclosure is shown on the left. This may include generating a key pair comprising a private key and a corresponding public key. The public key may be stored in a public register 108. The private key is provided to the corresponding user 302 of the key. Figure 3 For example, a vehicle user is shown who obtains a private key 303 for vehicle signature from a first point and a private key 304 for user signature from a second point. The user may store the private key in a suitable device (eg, a mobile device).

[0073] The keys of other digital signatures of the present disclosure (especially the digital signatures of the training environment and the software testing environment) can be generated in the same way.

[0074] Signing data with the aid of a signature may use the corresponding private keys 303, 304. For example, the user 302 may use the private key 304 for the user's signature to add the user's digital signature (and add digital signatures to other systems of the present disclosure in the same manner).

[0075] Data signed in this way can be verified by a test point 305 (e.g. a central network, a software test environment and / or a vehicle). To this end, the public key of the corresponding signer can be queried in a public register 108. If the digital signature can be verified with the aid of the public key, the digital signature and therefore the signed data can be evaluated as valid.

[0076] The present disclosure also relates to a computer system, which is designed to perform the method according to the present disclosure. As already described, the computer system may include a large number of distributed nodes connected to one or more networks (e.g., the Internet). Each node may in turn include a cloud computing system.

[0077] In one example, a computer system includes a first cloud computing system designed to perform the following steps: receiving vehicle field data, recording the received vehicle field data into a data corpus, processing the data corpus, training a machine learning model, and signing the trained machine learning model.

[0078] Additionally or alternatively, the computer system includes a second cloud computing system, which is designed to perform the following steps: checking the digital signature of the training environment, testing the trained machine learning model, and signing the verified machine learning model and / or the corresponding software components, and providing the tested machine learning model and / or the corresponding software components to a control unit of another vehicle.

[0079] As already discussed, the computer system may also include a public register in which a public key for a digital signature according to the present disclosure is stored. In some examples, the public register 108 may utilize a blockchain approach in order to store the public key of the present disclosure. In this case, there may be multiple versions of the public register. For example, the public register 108 may be a register that is multiply replicated and stored in different locations, wherein the various copies of the register 108 are synchronized (i.e., in the form of a "distributed ledger"). For example, various copies of the public register (108) may be stored in and / or managed by at least some of the systems described herein (i.e., not stored and / or managed by a single central point).

[0080] In some examples, the computer system also includes an onboard system of at least one vehicle (or an onboard system of a fleet of vehicles) that is designed to perform the following steps: receiving software upgrades, checking whether a software test environment and / or a training environment is a valid source of software upgrades, and updating software components of the vehicle based on the software upgrades.

[0081] In some examples, the computer system further comprises a mobile device configured to assign at least one digital signature of a vehicle and / or a vehicle user to the vehicle local data. The mobile device may also be configured to send the vehicle local data to the central system.

[0082] The present disclosure also relates to a computer program, which executes the steps of one of the methods of the present disclosure.

[0083] The present disclosure also relates to a computer-readable medium or a signal storing or containing the computer program of the present disclosure.

Claims

1. A computer-implemented method for performing a trusted upgrade of software of a vehicle (101; 120) based on vehicle field data, the method comprising: Receiving vehicle presence data (105) in a central system (104), the vehicle presence data being collected during operation of at least one vehicle (101) and being provided with at least one digital signature of the vehicle (102) and / or a user (103) of the vehicle; If the vehicle (101) and / or the user (107) is identified as a valid sender of the vehicle presence data by means of a corresponding digital signature (102; 103), the received vehicle presence data (105) is recorded in a data corpus, processing the data corpus of the central system (104) to generate training data for training a machine learning model, training a machine learning model using the training data in a training environment, Signing the trained machine learning model (110) with a digital signature of the training environment (109); and The trained machine learning model (110) having the signature of the training environment (109) is provided to another vehicle (120) for software upgrade.

2. The method of claim 1, wherein providing a trained machine learning system (110) comprises: checking the digital signature of the central system (109) in a software testing environment (112); If the training environment is identified as a valid sender of the trained machine learning model (110) based on the digital signature of the central system (109), testing the trained machine learning model (110) and / or software component in the software testing environment (112); Signing the tested machine learning model (117) and / or the software component (115) with a digital signature of the software testing environment (113); In the software upgrade, a tested machine learning model (117) and / or a tested software component (115) having a digital signature of the software testing environment (113) is provided to a control unit of the other vehicle (120).

3. The method according to claim 1, wherein the digital signature (102; 103; 109; 113) is generated with the aid of a decentralized generated key.

4. The method according to claim 3, wherein the digital signature of the vehicle (102) and / or the user (103) and / or the digital signature of the training environment (109) and / or the digital signature of the software testing environment are generated by at least two different points, optionally wherein the key is generated by the corresponding system itself.

5. A method according to any one of claims 1 to 4, wherein the public key of the digital signature is stored in a public register (108), optionally wherein the public register (108) is a multi-replicated register stored in different locations, wherein the different copies of the register (108) are synchronized.

6. A method according to any one of claims 1 to 5, wherein checking the digital signature (102; 103; 109; 113) includes querying the public key of the corresponding signature (102; 103; 109; 113) in a public register (108), and optionally wherein, if the digital signature can be verified with the help of the corresponding public key, the sender of the corresponding data is considered to be a valid sender.

7. The method according to any one of claims 1 to 8, wherein the central system (104) is a first cloud computing system.

8. The method according to claim 2 and optionally any one of the preceding claims 3 to 9, further comprising: Checking the digital signature of the central system (109) in a second software testing environment; If the central system is identified as a valid sender of the trained machine learning model based on the digital signature of the central system (109), testing the trained machine learning model (110) and / or the second software component in a second software testing environment; Signing the tested second machine learning model and / or the software component with the digital signature of the second software testing environment; The tested second machine learning model and / or the software component having the digital signature of the second software testing environment is provided to a control unit of another vehicle (120).

9. The method according to any of the preceding claims 1 to 10, wherein the software upgrade is provided to the vehicle (120) via an air interface.

10. The method according to any one of the preceding claims 1 to 11, further comprising: Receiving a software upgrade having a digital signature of the software testing environment (113) and / or a digital signature of the training environment (109); checking whether the software test environment (112) and / or the training environment is a valid sender of a software upgrade; and A software component of the other vehicle (120) is updated according to the software upgrade.

11. The method according to any one of claims 1 to 12, further comprising: The vehicle site data (105) is signed by a user (107) of the vehicle (101) using at least one digital signature of the vehicle (102) and / or the user (103); and The signed vehicle presence data (105) is sent to the central system (104). 12 . A computer system designed to execute the method according to claim 1 .

Images