Battery management software reset

Abstract

The present application relates to battery management software reset, in particular a computer system (100) of a vehicle (10), the computer system comprising processing circuitry (102) configured to: send a verification request message (M) to an electrical energy storage system (104) of the vehicle; receiving a response message from the electrical energy storage system (104), the response message depending on whether a correct digital key (106) is present in a memory (108) of the electrical energy storage system (104); when the digital key (106) is correctly validated, an electrical system (110) of the vehicle is allowed to use the electrical energy storage system, and when the digital key (106) cannot be correctly validated, the electrical system (110) of the vehicle is restricted from using the electrical energy storage system (104).

Description

Technical Field

[0001] The present disclosure generally relates to software security for vehicle electrical energy storage systems. In particular aspects, the present disclosure relates to secure battery management software resets. The present disclosure may be applicable to heavy vehicles such as trucks, buses, and construction equipment, among other vehicle types. Although the present disclosure may be described with respect to a particular vehicle, the present disclosure is not limited to any particular vehicle. Background Art

[0002] According to UNECE R155 regulation, vehicle battery management systems are required to have protection measures against the use of malicious software or third-party software. At the same time, the upcoming EU battery regulation will include requirements for software resets, allowing economic operators to download their own software in the battery management system. Meeting these two conflicting requirements at the same time has proven to be very complex. Summary of the invention

[0003] According to a first aspect of the present disclosure, a computer system for a vehicle is provided, the computer system comprising a processing circuit, the processing circuit being configured to: send a verification request message to an electric energy storage system of the vehicle; receive a response message from the electric energy storage system, the response message depending on whether a correct digital key exists in a memory of the electric energy storage system; and allow the electrical system of the vehicle to use the electric energy storage system when the digital key is correctly verified, and restrict the electrical system of the vehicle from using the electric energy storage system when the digital key cannot be correctly verified.

[0004] A first aspect of the present disclosure may seek to provide a vehicle with a method for verifying that the correct digital key is present in the electrical energy storage system to ensure that the software has not been tampered with or to ensure that the software is from an approved source. Technical benefits may include that the vehicle system can verify the authenticity of the software in the electrical energy storage system. If the key cannot be verified, then the software is cracked or is not from an approved source, the vehicle system will actively limit or prohibit the use of the electrical energy storage system in the vehicle.

[0005] Limiting use may include, for example, not allowing any charging current to enter the battery, shutting down other devices connected to the electrical system and / or displaying warnings and allowing only a limited number of driving cycles before servicing.

[0006] It should be noted that although a response message may be received, it may be wrong if the correct digital key is not present. That is, the digital key is only correctly verified if a valid and expected response is received.

[0007] Optionally, in some examples, including in at least one preferred example, the energy storage system may include a software reset function stored in the memory or accessible as a download file, the software reset function being configured to delete the digital key and the software access protection module from the memory when called. Technical benefits may include being able to use the energy storage system with third-party software, but not in the vehicle, after applying the software reset function. In other words, after deleting the digital key, the vehicle will no longer be able to authenticate the software of the energy storage system. However, with the software access protection module deleted from the energy storage system, the memory is available for downloading third-party software.

[0008] Optionally, in some examples, including at least one preferred example, the software access protection module may include one or both of a further digital key and a user authentication block. Technical benefits may include ensuring software integrity in a secure manner while allowing software to be removed if the software reset function is applied.

[0009] Optionally, in some examples, including at least one preferred example, the first digital key may be a vehicle digital key configured to be authenticated by the vehicle processing circuit, wherein the electrical energy storage system stores the further digital key that can be authenticated to grant access to the memory. That is, the software on the memory is authenticated using a specific vehicle digital key that is only authenticated by the vehicle. The further digital key is used to access the memory to download new software.

[0010] Optionally, in some examples, including in at least one preferred example, the further digital key may be deleted when the software reset function is invoked. That is, the memory may be used to download third-party software.

[0011] A vehicle is also provided, the vehicle comprising the computer system.

[0012] According to a second aspect of the present disclosure, a computer system of an electric energy storage system is provided, the computer system comprising a processing circuit, the processing circuit being configured to: store a vehicle digital key that can be verified by a vehicle processing circuit, a software access protection module configured to protect unauthorized access to the memory, and a software reset function in a memory of the electric energy storage system; receive a verification request message from the vehicle processing circuit; and send a response message to the vehicle processing circuit, namely: when the vehicle digital key is correctly verified, allowing the vehicle's electrical system to use the electric energy storage system, and when the vehicle digital key cannot be correctly verified, restricting the vehicle's electrical system from using the electric energy storage system.

[0013] A second aspect of the present disclosure may seek to provide a method for a vehicle to verify the authenticity of software in an electrical energy storage system. Technical benefits may include that a vehicle system may verify the authenticity of software in an electrical energy storage system. If the key cannot be verified, and therefore the software is compromised, the vehicle system will actively limit or prohibit the use of the electrical energy storage system in the vehicle.

[0014] Optionally, in some examples, including in at least one preferred example, the processing circuit can be configured to: receive a software reset signal that calls the software reset function, and in response, delete at least the vehicle digital key from the memory.

[0015] Optionally, in some examples, including in at least one preferred example, the processing circuit can be configured to: delete the vehicle digital key and the software access protection module from the memory. Technical benefits may include being able to use the energy storage system with third-party software, but not in the vehicle after applying the software reset function. In other words, after deleting the digital key, the vehicle will no longer be able to authenticate the software of the energy storage system. However, with the software access protection module deleted from the energy storage system, the memory is available for downloading third-party software.

[0016] Optionally, in some examples, including at least one preferred example, the software access protection module may include one or both of a further digital key and a user authentication block. Technical benefits may include ensuring software integrity in a secure manner while allowing software to be removed if the software reset function is applied.

[0017] Optionally, in some examples, including at least one preferred example, the user authentication block and the vehicle key are deleted when the software reset function is called. That is, the memory can be used to download third-party software, but can no longer be fully used in the vehicle because the vehicle digital key has been deleted.

[0018] Optionally, in some examples, including at least one preferred example, the electrical energy storage system may include a propulsion battery for the vehicle.

[0019] There is also provided an electrical energy storage system comprising the computer system according to the second aspect.

[0020] According to a third aspect of the present disclosure, a computer-implemented method is provided, the method comprising: sending, by a processing circuit of a computer system, a verification request message to an electric energy storage system of the vehicle; receiving, by the processing circuit, a response message from the electric energy storage system, the response message depending on whether a correct digital key exists in a memory of the electric energy storage system; allowing, by the processing circuit, the vehicle's electrical system to use the electric energy storage system when the digital key is correctly verified, and restricting, by the processing circuit, the vehicle's electrical system from using the electric energy storage system when the digital key cannot be correctly verified.

[0021] A third aspect of the present disclosure may seek to provide a method for a vehicle to verify that the correct digital key is present in the electrical energy storage system to ensure that the software has not been tampered with or is not from an approved source. Technical benefits may include that the vehicle system can verify the authenticity of the software in the electrical energy storage system. If the key cannot be verified, and therefore the software is compromised, the vehicle system will actively limit or prohibit the use of the electrical energy storage system in the vehicle.

[0022] Optionally, in some examples, including at least one preferred example, the digital key may be a vehicle digital key configured to be authenticated by the vehicle processing circuit, wherein the electrical energy storage system stores a further digital key that is authenticatable to grant access to the memory. That is, the software on the memory is authenticated using a specific vehicle digital key that is authenticated only by the vehicle. The further digital key is used to access the memory to download new software.

[0023] According to a fourth aspect of the present disclosure, a computer-implemented method is provided, the method comprising: a processing circuit of a computer system stores a vehicle digital key that can be verified by a vehicle processing circuit, a software access protection module configured to prevent unauthorized access to the memory, and a software reset function in a memory of the electric energy storage system; the processing circuit receives a verification request message from the vehicle processing circuit; and the processing circuit sends a response message to the vehicle processing circuit, namely: when the vehicle digital key is correctly verified, the electrical system of the vehicle is allowed to use the electric energy storage system, and when the vehicle digital key cannot be correctly verified, the electrical system of the vehicle is restricted from using the electric energy storage system.

[0024] A fourth aspect of the present disclosure may seek to provide a method for a vehicle to verify the authenticity of software in an electrical energy storage system. Technical benefits may include that a vehicle system may verify the authenticity of software in an electrical energy storage system. If the key cannot be verified, the software is compromised, and the vehicle system will actively restrict or prohibit the use of the electrical energy storage system in the vehicle.

[0025] Optionally, in some examples, including at least one preferred example, the method may include: receiving, by the processing circuit, a software reset signal that calls the software reset function, and in response, deleting, by the processing circuit, at least the vehicle digital key from the memory.

[0026] Optionally, in some examples, including in at least one preferred example, the method may include: deleting the vehicle digital key and the software access protection module from the memory. Technical benefits may include being able to use the energy storage system with third-party software, but not in the vehicle, after applying the software reset function. In other words, after deleting the digital key, the vehicle will no longer be able to authenticate the software of the energy storage system. However, with the software access protection module deleted from the energy storage system, the memory is available for downloading third-party software.

[0027] There is also provided a computer program product comprising program code for performing the method of any one of the examples disclosed herein when executed by a processing circuit.

[0028] Also provided is a non-transitory computer-readable storage medium comprising instructions which, when executed by a processing circuit, cause the processing circuit to perform the method of any of the examples disclosed herein.

[0029] The disclosed aspects, examples (including any preferred examples), and / or the appended claims may be appropriately combined with each other, which is obvious to any person skilled in the art. Additional features and advantages are disclosed in the detailed description, claims, and drawings, and in part will be obvious to those skilled in the art or recognized by practicing the disclosure as described herein.

[0030] Also disclosed herein are computer systems, control units, code modules, computer-implemented methods, computer-readable media, and computer program products associated with the technical benefits discussed above. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 is an exemplary system diagram of a computer system according to an example.

[0032] Figure 2 is a flow chart according to an example method.

[0033] Figure 3 is a flow chart according to an example method.

[0034] Figure 4 is a flow chart according to an example method.

[0035] Figure 5is an exemplary system diagram of a computer system according to an example.

[0036] Figure 6 Based on the example Figure 1 Another view of .

[0037] Figure 7 Based on the example Figure 1 Another view of .

[0038] Figure 8 is a flow chart of an exemplary method.

[0039] Fig. 9 is a flow chart of an exemplary method.

[0040] Fig.10 is a schematic diagram of an exemplary computer system for implementing the examples disclosed herein, according to an example. DETAILED DESCRIPTION

[0041] The detailed description set forth below provides information and examples of the disclosed technology in sufficient detail to enable those skilled in the art to practice the disclosure.

[0042] Currently, the law requires that the software in the vehicle's electrical energy storage system must be protected from tampering or replacement. Conversely, there is a regulation that requires the software to be replaced to enable a second life of the battery. These two aspects are in conflict but need to be reconciled.

[0043] In order to solve the above problems, the present disclosure proposes to set a digital key in the electric energy storage system, and the digital key is explicitly verified by the vehicle at startup to ensure that the software in the electric energy storage system is protected. In other words, the vehicle processing circuit must verify the digital key in the electric energy storage system every time it is started.

[0044] Figure 1 is an exemplary system diagram of a computer system 100 of a vehicle 10 . The computer system 100 includes a processing circuit 102 configured to send a verification request message M1 to an electrical energy storage system 104 of the vehicle 10 .

[0045] The electrical energy storage system 104 generally includes battery cells electrically connected to form a battery pack. The electrical energy storage system 104 may include a propulsion battery for the vehicle 10 .

[0046] The electrical energy storage system 104 includes a processing circuit 120 and a digital storage device 108. The processing circuit 102 may communicate with the electrical energy storage system 104, for example, with the processing circuit 120 of the electrical energy storage system 104, to perform various control actions, such as measuring voltage, current throughput, temperature, and other parameters of the electrical energy storage system 104. The processing circuit 120 and the memory 108 may be part of the same chip.

[0047] The digital storage device 108 stores a digital key 106 that can be authenticated by the vehicle processing circuit 102. In addition, the digital storage device 108 can store a further digital key 112 that can be authenticated by an external party 130 to access the protected memory 108 to download new software, and an authentication block 114 for user authentication. In some possible embodiments, the digital key 106 and the further digital key 112 are the same single key stored at the same address. However, the digital key 106 and the further digital key 112 can be two separate keys.

[0048] The digital key may be implemented, for example, by a public-private key pair or a public key that is stored in protected areas in both the energy storage system (eg, memory 108 ) and the vehicle control unit 102 .

[0049] Authentication software in the electronic processing circuit 102 may utilize the digital keys 106, 112 to generate a message authentication code, such as random data known to both the vehicle control unit 102 and the processing circuit 120. The vehicle control unit 102 may use the digital keys to decrypt the response M2.

[0050] The energy storage system 104 also includes a software reset function 111, which can be stored in the memory 108 or can be accessed as a download file 113. The software reset function is configured to delete the digital key 106 and the software access protection module from the memory 108 when it is called. The software access protection module includes one or both of a further digital key 112 and a user authentication block 114. The user authentication block 114 is a protection layer that requires an external user (for example, in a workshop) to confirm that he is an authorized user. In order to be granted permission to download new software, the authorized user must also have the correct key corresponding to the digital key 112. That is, the first digital key 106 is a vehicle digital key configured to be verified by the vehicle processing circuit 102. The energy storage system 104 stores a further digital key 112 for authenticating external users or authenticating software download files.

[0051] In addition, in other possible implementations, the software download integrity can be ensured by signing the software. In this case, the software download file, for example, includes a checksum calculated using a digital key.

[0052] Once the software reset function 111 is called and executed, the further digital key 112 is deleted or overwritten.

[0053] Now go to Figure 2 Flowchart of the process.

[0054] In step S102, a verification request message M1 is sent by the processing circuit 102 of the computer system 100 to the electrical energy storage system 104 of the vehicle 10. The verification request message may be a challenge response message, where the processing circuit 102 of the vehicle expects a predetermined response for successful verification. The response is determined based on the challenge response message each time a new message is generated. Once a new challenge response message is generated, an expected response is also generated.

[0055] In step S104 , a response message M2 is received by the processing circuit 102 from the electric energy storage system 102 , wherein the response message depends on whether a correct digital key 106 exists in the memory 108 of the electric energy storage system 104 .

[0056] When the digital key is correctly verified in step S105, in step S106, the processing circuit 102 allows the electrical system 110 of the vehicle 10 to use the electric energy storage system 104. For example, the processing circuit 102 sends a control message C to start the electrical system 110.

[0057] When the digital key cannot be correctly verified, in step S108, the processing circuit 102 limits the use of the electric energy storage system 104 in the electrical system 110 of the vehicle 10. Limiting the use may include the processing circuit not sending a control message to start the electrical system 110.

[0058] A vehicle 10 is also provided, the vehicle including a computer system 102 and an electrical energy storage system 104. The vehicle may be a truck, a car, a boat, or the like.

[0059] Further references Figure 1 The computer system 101 of the electric energy storage system includes a processing circuit 120, which is configured to store a vehicle digital key 106 that can be verified by a vehicle processing circuit 102, software access protection modules 112, 114 configured to prevent unauthorized access to the memory 104, and a software reset function 111 in the memory 108 of the electric energy storage system 104.

[0060] exist Figure 3 In the flowchart, in step S202, the processing circuit 120 of the computer system stores the vehicle digital key 106 that can be verified by the vehicle processing circuit 102, the software access protection modules 112, 114 configured to prevent unauthorized access to the memory 108, and the software reset function 111 in the memory 108 of the electric energy storage system 104.

[0061] In step S204 , the processing circuit 120 receives the verification request message M1 from the vehicle processing circuit 102 .

[0062] In step S206, the processing circuit 120 sends a response message M2 to the vehicle processing circuit 102, that is, when the vehicle digital key 106 is correctly verified, the vehicle's electrical system is allowed to use the energy storage system, wherein when the vehicle digital key 106 cannot be correctly verified, the vehicle's electrical system 110 is restricted from using the energy storage system.

[0063] The electrical energy storage system 110 may include, for example, a charger and driveline for a vehicle. These limitations may include, for example, preventing charging, reducing maximum voltage usage, maximum power usage, or even completely preventing any power from being drawn from the electrical energy storage system 104.

[0064] When the processing circuit 120 Figure 4 When a software reset signal is received from the vehicle 10 itself or from an external party in step S208 of the flowchart in FIG. 1 , the software reset function 111 is called. In response, the processing circuit 120 deletes at least the vehicle digital key 106 from the memory 106 in step S210.

[0065] In some examples, step S210 also includes deleting the vehicle digital key 106 and the software access protection module including one or both of the further digital key 112 and the user authentication block 114 from the memory 108 .

[0066] An electrical energy storage system including the computer system 101 is also provided.

[0067] Figure 5 1 is a block diagram of the vehicle 10 after the software reset function 111 is called and applied. Since the vehicle digital key 106 has been deleted from the memory 108, the software verification check performed by the vehicle processing circuit 102 will fail, and the vehicle electrical system 110 is not allowed to use or fully utilize the energy storage system 104. The processing circuit sends a control message C to restrict the use of the vehicle electrical system 110. It may still be allowed to reduce the functionality of the energy storage system. In addition, the software access protection module including one or both of the further digital key 112 and the user authentication block 114 is also deleted from the memory 108, thereby allowing a third party 130 to download new software 132 to the energy storage system 104. This can be performed by the energy storage system 104 in the vehicle 10, but the software reset function can also be applied after the energy storage system 104 is removed from the vehicle 10. Note that a response message can be received from the energy storage system 104 by the processing circuit 102, but since the digital keys 106, 112 have been deleted from the memory 108, this message will not provide a successful verification.

[0068] It is envisioned that if the digital key authentication fails, a diagnostic flag is set in the vehicle or the electrical energy storage system to indicate that the key authentication failed. These flags can be analyzed to better understand the cause and circumstances of the failure and choose to restrict the vehicle's electrical system from using the electrical energy storage system. That is, the restriction can be selected based on historical diagnostic flags.

[0069] There is also provided a computer program product comprising program code which, when executed by a processing circuit, performs the method of any one of the examples disclosed herein.

[0070] Also provided is a non-transitory computer-readable storage medium comprising instructions which, when executed by a processing circuit, cause the processing circuit to perform the method of any of the examples disclosed herein.

[0071] Figure 6 Based on the example Figure 1 Another view of the vehicle 10. The computer system 100 of the vehicle 10 includes a processing circuit 102, which is configured to: send a verification request message M1 to the vehicle's energy storage system 104; receive a response message from the energy storage system 104, the response message depending on whether there is a correct digital key 106 in the memory 108 of the energy storage system 104; when the digital key 106 is correctly verified, allow the vehicle's electrical system 110 to use the energy storage system, and when the digital key 106 cannot be correctly verified, restrict the vehicle's electrical system 110 from using the energy storage system 104.

[0072] Figure 7 Based on the example Figure 1 Another view of the invention. The computer system 101 of the electric energy storage system includes a processing circuit 120, which is configured to: store a vehicle digital key 106 that can be verified by a vehicle processing circuit 102, software access protection modules 112, 114 configured to prevent unauthorized access to the memory, and a software reset function 111 in a memory 108 of the electric energy storage system 104; receive a verification request message M1 from the vehicle processing circuit 102; and send a response message M2 to the vehicle processing circuit, namely: when the vehicle digital key is correctly verified, the vehicle's electrical system is allowed to use the electric energy storage system, and when the vehicle digital key cannot be correctly verified, the vehicle's electrical system is restricted from using the electric energy storage system.

[0073] Figure 8The invention is a flowchart of a method, wherein the method comprises: sending S102 a verification request message by a processing circuit of a computer system to an electric energy storage system of a vehicle; receiving S104 a response message from the electric energy storage system by the processing circuit, wherein the response message depends on whether a correct digital key exists in a memory of the electric energy storage system; when the digital key is correctly verified, allowing S106 the electrical system of the vehicle to use the electric energy storage system by the processing circuit, and when the digital key cannot be correctly verified, restricting S108 the electrical system of the vehicle from using the electric energy storage system by the processing circuit.

[0074] Fig. 9 The invention is a flowchart of a method, the method comprising: a processing circuit of a computer system stores S202 a vehicle digital key that can be verified by a vehicle processing circuit, a software access protection module configured to prevent unauthorized access to the memory, and a software reset function in a memory of an electric energy storage system; the processing circuit receives S204 a verification request message from the vehicle processing circuit; the processing circuit sends S206 a response message to the vehicle processing circuit, namely: when the vehicle digital key is correctly verified, the vehicle's electrical system is allowed to use the electric energy storage system, and when the vehicle digital key cannot be correctly verified, the vehicle's electrical system is restricted from using the electric energy storage system.

[0075] Fig.10 1 is a schematic diagram of a computer system 1000 for implementing the examples disclosed herein. The computer system 1000 is suitable for executing instructions from a computer-readable medium to perform these and / or any functions or processes described herein. The computer system 1000 can be connected (e.g., networked) to other machines in a LAN, an intranet, an extranet, or the Internet. Although only a single device is shown, the computer system 1000 may include any device collection that executes an instruction set (or multiple instruction sets) individually or jointly to perform any one or more of the methods discussed herein. Therefore, any reference to a computer system, a computing system, a computer device, a computing device, a control system, a control unit, an electronic control unit (ECU), a processor device, a processing circuit, etc. in the present disclosure and / or claims includes a reference to one or more such devices to execute an instruction set (or multiple instruction sets) individually or jointly to perform any one or more of the methods discussed herein. For example, the control system may include a single control unit or multiple control units connected to each other or otherwise communicatively coupled, so that any executed function can be distributed between the control units as needed. Furthermore, such devices may communicate with each other or other devices through various system architectures, such as directly or via a controller area network (CAN) bus, etc.

[0076] The computer system 1000 may include at least one computing device or electronic device that can include firmware, hardware and / or execute software instructions to implement the functionality described herein. The computer system 1000 may include a processing circuit 1002 (e.g., a processing circuit including one or more processor devices or control units), a memory 1004, and a system bus 1006. The computer system 1000 may include at least one computing device having a processing circuit 1002. The system bus 1006 provides an interface for system components (including, but not limited to, the memory 1004 and the processing circuit 1002). The processing circuit 1002 may include any number of hardware components for performing data or signal processing or for executing computer code stored in the memory 1004. The processing circuit 1002 may include, for example, a general purpose processor, a special purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a circuit containing a processing component, a group of distributed processing components, a group of distributed computers configured for processing, or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The processing circuit 1002 may also include computer executable code that controls the operation of the programmable device.

[0077] The system bus 1006 can be any of several types of bus structures, which can also be interconnected to a memory bus (with or without a memory controller), a peripheral bus, and / or a local bus using any of a variety of bus architectures. The memory 1004 can be one or more devices for storing data and / or computer code to complete or facilitate the methods described herein. The memory 1004 can include a database component, an object code component, a script component, or other types of information structures for supporting various activities herein. Any distributed or local memory device can be utilized with the system and method of the present specification. The memory 1004 can be communicatively connected to the processing circuit 1002 (e.g., via a circuit or any other wired, wireless, or network connection) and can include computer code for performing one or more processes described herein. The memory 1004 may include nonvolatile memory 1008 (e.g., read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.) and volatile memory 1010 (e.g., random access memory (RAM)) or any other medium that can be used to carry or store desired program code in the form of machine-executable instructions or data structures and that can be accessed by a computer or other machine having the processing circuit 1002. A basic input / output system (BIOS) 1012 may be stored in the nonvolatile memory 1008 and may include the basic routines that help to transfer information between elements within the computer system 1000.

[0078] The computer system 1000 may also include or be coupled to non-transitory computer-readable storage media such as storage device 1014, which may include, for example, an internal or external hard disk drive (HDD) (e.g., Enhanced Integrated Drive Electronics (EIDE) or Serial Advanced Technology Attachment (SATA)), a HDD for storage (e.g., EIDE or SATA), flash memory, etc. The storage device 1014 and other drives associated with computer-readable and computer-usable media may provide non-volatile storage of data, data structures, computer-executable instructions, etc.

[0079] Hard-coded or soft-coded computer code may be provided in the form of one or more modules. Modules may be implemented as software and / or hard-coded in circuits to implement the functionality described herein in whole or in part. Modules may be stored in a storage device 1014 and / or volatile memory 1010 that may include an operating system 1016 and / or one or more program modules 1018. All or part of the examples disclosed herein may be implemented as a computer program 1020 stored on a temporary or non-temporary computer-usable or computer-readable storage medium (e.g., a single medium or multiple media) such as a storage device 1014, the computer program including complex programming instructions (e.g., complex computer-readable program code) that cause the processing circuit 1002 to perform the actions described herein. Therefore, the computer-readable program code of the computer program 1020 may include software instructions that implement the functionality of the examples described herein when executed by the processing circuit 1002. In some examples, storage device 1014 may be a computer program product (e.g., a readable storage medium) having stored thereon a computer program 1020, wherein at least a portion of computer program 1020 may be loadable (e.g., loaded into a processor) to implement functionality of the examples described herein when executed by processing circuit 1002. Processing circuit 1002 may act as a controller or control system of computer system 1000 implementing the functionality described herein.

[0080] The computer system 1000 may include an input device interface 1022 configured to receive input and selections to be transmitted to the computer system 1000 when executing instructions such as from a keyboard, mouse, touch-sensitive surface, etc. Such input devices may be connected to the processing circuit 1002 through an input device interface 1022 coupled to the system bus 1006, but may be connected through other interfaces such as a parallel port, an Institute of Electrical and Electronics Engineers (IEEE) 1394 serial port, a universal serial bus (USB) port, an IR interface, etc. The computer system 1000 may include an output device interface 1024 configured to forward output to a display such as a display, a video display unit (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)). The computer system 1000 may include a communication interface 1026 suitable for communicating with a network as appropriate or as needed.

[0081] The operational actions described in any exemplary aspects of this article are described to provide examples and discussions. The actions may be performed by hardware components, may be embodied in machine executable instructions to cause a processor to perform the actions, or may be performed by a combination of hardware and software. Although a specific order of method actions may be shown or described, the order of these actions may be different. In addition, two or more actions may be performed simultaneously or partially simultaneously.

[0082] Example 1: A computer system for a vehicle, the computer system comprising a processing circuit, the processing circuit being configured to: send a verification request message to an electric energy storage system of the vehicle; receive a response message from the electric energy storage system, the response message depending on whether a correct digital key exists in a memory of the electric energy storage system; and allow the electrical system of the vehicle to use the electric energy storage system when the digital key is correctly verified, and restrict the electrical system of the vehicle from using the electric energy storage system when the digital key cannot be correctly verified.

[0083] Example 2: A computer system as described in Example 1, wherein the energy storage system includes a software reset function stored in the memory or accessible as a download file, and the software reset function is configured to delete the digital key and software access protection module from the memory when called.

[0084] Example 3: The computer system of Example 2, wherein the software access protection module includes one or both of a further digital key and a user authentication block.

[0085] Example 4: A computer system as described in Example 3, wherein the first digital key is a vehicle digital key configured to be verified by the vehicle processing circuit, and wherein the electrical energy storage system stores a further digital key that can be verified to grant access to the memory.

[0086] Example 5: The computer system of Example 4, wherein the further digital key is deleted when the software reset function is called.

[0087] Example 6: A vehicle comprising the computer system and electrical energy storage system described in any one of Examples 1-5.

[0088] Example 7: A computer system of an electric energy storage system, the computer system comprising a processing circuit, the processing circuit being configured to: A vehicle digital key that can be verified by a vehicle processing circuit, a software access protection module configured to prevent unauthorized access to the memory, and a software reset function are stored in the memory of the electric energy storage system; a verification request information from the vehicle processing circuit is received, and a response message is sent to the vehicle processing circuit, that is: when the vehicle digital key is correctly verified, the electrical system of the vehicle is allowed to use the electric energy storage system, and when the vehicle digital key cannot be correctly verified, the electrical system of the vehicle is restricted from using the electric energy storage system.

[0089] Example 8: The computer system of Example 7, wherein the processing circuit is configured to: receive a software reset signal that invokes the software reset function, and in response, delete at least the vehicle digital key from the memory.

[0090] Example 9: In the computer system of Example 8, the processing circuit is configured to: delete the vehicle digital key and the software access protection module from the memory.

[0091] Example 10: The computer system of any of Examples 7-9, wherein the software access protection module comprises one or both of a further digital key and a user authentication block.

[0092] Example 11: The computer system of Example 10, wherein the further digital key, the user authentication block, and the vehicle key are deleted when the software reset function is invoked.

[0093] Example 12: The computer system of any of Examples 7-11, wherein the electrical energy storage system comprises a propulsion battery for the vehicle.

[0094] Example 13: An electrical energy storage system, the electrical energy storage system comprising the computer system of any one of Examples 7-12.

[0095] Example 14: A computer-implemented method, the method comprising: a processing circuit of a computer system sending a verification request message to an electric energy storage system of a vehicle; the processing circuit receiving a response message from the electric energy storage system, the response message depending on whether a correct digital key exists in a memory of the electric energy storage system; when the digital key is correctly verified, the processing circuit allowing the electrical system of the vehicle to use the electric energy storage system, and when the digital key cannot be correctly verified, the processing circuit restricting the electrical system of the vehicle from using the electric energy storage system.

[0096] Example 15: A computer-implemented method as described in Example 14, wherein the digital key is a vehicle digital key configured to be verified by the vehicle processing circuit, and wherein the electrical energy storage system stores a further digital key that can be verified to grant access to the memory.

[0097] Example 16: A computer-implemented method, the method comprising: a processing circuit of a computer system storing a vehicle digital key that can be verified by a vehicle processing circuit, a software access protection module configured to prevent unauthorized access to the memory, and a software reset function in a memory of the electric energy storage system; the processing circuit receiving a verification request message from the vehicle processing circuit; and the processing circuit sending a response message to the vehicle processing circuit, namely: when the vehicle digital key is correctly verified, the electrical system of the vehicle is allowed to use the electric energy storage system, and when the vehicle digital key cannot be correctly verified, the electrical system of the vehicle is restricted from using the electric energy storage system.

[0098] Example 17: The computer-implemented method of Example 16, the method comprising: A software reset signal invoking the software reset function is received by the processing circuit, and in response, at least the vehicle digital key is deleted from the memory by the processing circuit.

[0099] Example 18: The computer-implemented method of Example 17, the method comprising: The vehicle digital key and the software access protection module are deleted from the memory.

[0100] Example 19: A computer program product comprising program code, which when executed by a processing circuit performs the method of any of Examples 14-18.

[0101] Example 20: A non-transitory computer-readable storage medium comprising instructions that, when executed by a processing circuit, cause the processing circuit to perform the method of any of Examples 14-18.

[0102] The terms used herein are only for the purpose of describing specific aspects and are not intended to limit the present disclosure. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items. It should also be understood that the terms "include" and / or "comprise" when used herein indicate the presence of stated features, integers, actions, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, integers, actions, steps, operations, elements, parts and / or their groups.

[0103] It should be understood that although the terms first, second, etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, without departing from the scope of the present disclosure, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element.

[0104] Relative terms such as "below" or "above" or "upper" or "lower" or "horizontal" or "vertical" may be used herein to describe the relationship of one element to another element, as shown in the figures. It should be understood that these terms and the terms discussed above are intended to cover different orientations of the device in addition to the orientations depicted in the figures. It should be understood that when an element is referred to as being "connected" or "coupled" to another element, the element may be directly connected or coupled to the other element, or there may be intervening elements. In contrast, when an element is referred to as being "directly connected" or "directly coupled" to another element, there are no intervening elements.

[0105] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art to which the present disclosure belongs. It should also be understood that, unless otherwise clearly defined herein, the terms used herein should be interpreted as meanings consistent with their meanings in the context of this specification and the relevant art, and should not be interpreted in an idealized or overly formal sense.

[0106] It should be understood that the present disclosure is not limited to the aspects described above and shown in the accompanying drawings; rather, the skilled person will recognize that many changes and modifications may be made within the scope of the present disclosure and the appended claims. In the drawings and description, various aspects have been disclosed for illustrative purposes only and not for limiting purposes, and the scope of the present disclosure is set forth in the appended claims.

Claims

1. A computer system (100) of a vehicle (10), the computer system comprising a processing circuit (102), the processing circuit being configured to: sending a verification request message (M) to the electric energy storage system (104) of the vehicle, receiving a response message from the electrical energy storage system (104), the response message being dependent on whether a correct digital key (106) is present in a memory (108) of the electrical energy storage system (104); When the digital key (106) is correctly authenticated, allowing the vehicle's electrical system (110) to use the electrical energy storage system, When the digital key (106) cannot be correctly authenticated, the electrical system (110) of the vehicle is restricted from using the electrical energy storage system (104).

2. A computer system as described in claim 1, wherein the energy storage system includes a software reset function (111) stored in the memory or accessible as a download file, and the software reset function is configured to delete the digital key and software access protection module from the memory when called.

3. The computer system of claim 2, wherein the software access protection module comprises one or both of a further digital key (112) and a user authentication block (114).

4. A computer system as described in claim 3, wherein the first digital key (106) is a vehicle digital key configured to be verified by the vehicle processing circuit (102), and wherein the energy storage system stores the further digital key that can be verified to grant access to the memory.

5. A computer system as claimed in claim 4, wherein the further digital key (112) is deleted when the software reset function (111) is called.

6. A vehicle (10), comprising a computer system according to any one of claims 1 to 5 and an electrical energy storage system (104).

7. A computer system of an electric energy storage system, the computer system comprising a processing circuit (120), the processing circuit being configured to: storing a vehicle digital key (106) verifiable by a vehicle processing circuit (102), a software access protection module (112, 114) configured to prevent unauthorized access to the memory, and a software reset function (111) in a memory (108) of the electrical energy storage system (104), receiving a verification request message (M1) from the vehicle processing circuit, Send a response message (M2) to the vehicle processing circuit, namely: When the vehicle digital key is correctly authenticated, allowing the vehicle's electrical system to use the electrical energy storage system, When the vehicle digital key cannot be correctly authenticated, the electrical system of the vehicle is restricted from using the electric energy storage system.

8. The computer system of claim 7, wherein the processing circuit is configured to: receiving a software reset signal invoking the software reset function, and in response, At least the vehicle digital key is deleted from the memory.

9. The computer system of claim 8, wherein the processing circuit is configured to: The vehicle digital key and the software access protection module are deleted from the memory.

10. The computer system of any one of claims 7 to 9, wherein the software access protection module comprises one or both of a further digital key and a user authentication block.

11. The computer system of claim 10, wherein the further digital key, the user authentication block and the vehicle key are deleted when the software reset function is invoked.

12. The computer system of any one of claims 7-11, wherein the electrical energy storage system comprises a propulsion battery for the vehicle.

13. An electric energy storage system, comprising the computer system according to any one of claims 7 to 12.

14. A computer-implemented method, the method comprising: The processing circuit of the computer system sends (S102) a verification request message to the electric energy storage system of the vehicle, receiving ( S104 ) a response message from the electrical energy storage system by the processing circuit, the response message depending on whether a correct digital key exists in a memory of the electrical energy storage system; When the digital key is correctly verified, the processing circuit allows (S106) the electrical system of the vehicle to use the electrical energy storage system, When the digital key cannot be correctly verified, the processing circuit restricts ( S108 ) the electrical system of the vehicle from using the electric energy storage system.

15. A computer-implemented method, the method comprising: The processing circuit of the computer system stores (S202) a vehicle digital key that can be verified by the vehicle processing circuit, a software access protection module configured to prevent unauthorized access to the memory, and a software reset function in the memory of the electric energy storage system, The processing circuit receives (S204) a verification request message from the vehicle processing circuit, The processing circuit sends (S206) a response message to the vehicle processing circuit, namely: When the vehicle digital key is correctly authenticated, allowing the vehicle's electrical system to use the electrical energy storage system, When the vehicle digital key cannot be correctly authenticated, the electrical system of the vehicle is restricted from using the electric energy storage system.

Images