Access control to motor vehicle

Abstract

The invention relates to a method (300) for controlling access to a motor vehicle (105), comprising the following steps: receiving a tracking request for a new digital key for the motor vehicle (105); wherein the digital key is comprised by a chain (405) of digital keys generated mutually; wherein the tracking request comprises a chain (420) of authentication packets, the authentication packets being arranged in pairs with keys; determining that a key in the chain (405) provided with one of the authentication packets has been authenticated with respect to the motor vehicle (105); removing, from the chain (410), an authentication packet associated with a key located in front of the determined key in the chain (405); and providing a trace reply with at least one remaining authentication packet.

Description

Technical Field

[0001] The present invention relates to access control to motor vehicles. In particular, the present invention relates to access control by means of a digital vehicle key. Background Art

[0002] Access to a motor vehicle can be secured with the aid of a digital key. The digital key can be stored on a device, such as a smartphone. The device and the motor vehicle can authenticate each other and, if the authentication is successful, a request for use of a predetermined function of the motor vehicle can be executed.

[0003] The owner of a motor vehicle can transfer authorization for the use of the entire motor vehicle or only a predetermined function to a friend. In order to create a valid key for the friend, a predetermined exchange process can be carried out, which includes communication with a central agency, which can manage the keys for the motor vehicle. In order to document which key was activated at what time with authorization for which functions of the motor vehicle, a tracking service can be implemented. If a key is to be transferred from the owner to a friend, it can be stored or archived in the tracking service. The newly created key is only valid if the tracking service confirms the key.

[0004] A key can be used to issue another key or to sign another key, so that the other key is valid. The other key can also authorize key creation, so that a key chain can be created step by step, wherein each key is generated based on the previous one in the key chain. A key can be assigned an authentication package (Attestation Package), which can be checked on the part of the motor vehicle when the key is presented for the first time in the motor vehicle. The authentication package refers to the previous key in the key chain. A further authentication package can be set up for this key, so that a chain of multiple authentication packages can also exist for a chain of multiple keys, wherein the authentication packages are assigned to the keys in pairs.

[0005] If a new key is presented at the motor vehicle, the complete chain of authentication packets may also need to be presented. Here, an authentication packet can take up many times more memory space than a digital key. The wireless transmission of the chain of authentication packets may require a certain amount of time, which increases with the length of the chain. The user may have to wait a relatively long time before being able to access the motor vehicle, until all required checks have been performed. In addition, during the transmission, the user may not be aware of the progress of the checks. Both situations may be inconvenient for the user. Summary of the invention

[0006] One of the objects on which the invention is based is to provide a technique with which a digital key that is tracked by a tracking service can be initially checked more quickly. The invention achieves this object by means of the technical solution of the independent claim. The dependent claims give preferred embodiments.

[0007] According to a first aspect of the invention, a method for controlling access to a motor vehicle comprises the following steps: receiving a tracing request for a new digital key for a motor vehicle; wherein the digital key is comprised of a chain of mutually generated digital keys; wherein the tracing request comprises a chain of authentication packages which are assigned to the keys in pairs; determining that a key in the chain which is assigned one of the authentication packages has been verified relative to the motor vehicle; removing from the chain the authentication package which is assigned to the key which is located before the determined key in the chain; and providing a tracing response with at least one remaining authentication package.

[0008] The technology described here is advantageously based on concepts known as digital vehicle keys or digital car keys. The specifications for digital car keys have been published by the Car Connectivity Consortium and are available as version 1.1.0 as of July 20, 2022 at the time of writing this document. See in particular Chapter 11.8 "Key Sharing Process: Steps", Chapter 11.9 "Owner Device OEM Server Notification", Chapter 11.10 "Key Tracking and Online Authentication Delivery" and Chapter 11.11 "Vehicle Authentication". Possible solutions for chained authentication packages can correspond to corresponding recommendations for extending the standard ("chained attestations"). The technology described here can be regarded as an extension recommendation for this extension recommendation.

[0009] Here, the owner is understood to be a person who is equipped with the motor vehicle in a special way and in particular has special authorization. These authorizations can in particular include creating or signing other keys for the motor vehicle. There can be multiple owners for the motor vehicle at a time point. Regarding the control method or exchange method described here, the owner operates with the help of the owner's device. The owner's device preferably includes a mobile device equipped with the owner personally, in particular a smart phone, a smart watch, a smart bracelet, a tablet or a laptop. In order to use the owner's device for sensitive actions within the scope of the technology described here, it may be necessary to verify the owner relative to the owner's device. To this end, the owner can show a biometric feature or enter a password (password, PIN code). The inspection can be checked by the operating system of the mobile device.

[0010] A buddy is understood here to be a person who should be authorized to use the motor vehicle. Like the owner, a buddy is generally a natural person. With regard to the technology described here, the buddy preferably operates with the aid of a buddy device, which is preferably associated with the buddy person, just as the owner device is associated with the owner person. The buddy can also authenticate himself to his buddy device in order to activate safety-sensitive operations within the scope of the technology described here.

[0011] The designations "owner" and "friend" come from the documentation of the digital car key and should not have a limiting effect. Therefore, the chained distribution of keys can therefore be more easily expressed in terms such as "friend-friendly". With regard to the issuance or distribution of digital keys, the owner can also be called, for example, the sender and the friend can be called the recipient. The owner device can then preferably be called the sending device and the friend device can be called the receiving device. In some cases, the owner or friend can also be formed by a device instead of a natural person.

[0012] Here, we will simplify the discussion of motor vehicle-device communication, although the communication is carried out by a control device on the motor vehicle to be precise. The communication is preferably carried out wirelessly, for which one or more different wireless interfaces can be provided on the motor vehicle. Preferred data interfaces include Bluetooth (BT) or Bluetooth Low Energy (BLE); preferred interfaces for relative positioning of the device with respect to the motor vehicle preferably include Ultra-Wideband (UWB). In addition, an interface for near-field communication (NFC) can be provided. The communicating devices can use one or more such wireless interfaces.

[0013] By removing the authentication package from the corresponding chain, the amount of data that a friend must present to the vehicle in order to gain initial access can be reduced. Although a digital key may take up relatively little memory space, an authentication package may require several times more storage space. The transmitted data includes additional formatting data and management data, which further increases the amount of data. The transmission speed to the motor vehicle may be limited, especially if the transmission is carried out with the aid of UWB. A chain of multiple authentication packages may require a transmission time of in the range of half a minute together with the new key. The person presenting the key may not be prepared for such a long waiting time, and there may not be an interface for providing the person with the corresponding information, especially when the key is stored on a handheld device (Fob). The access attempt may then fail, even if all technical prerequisites for the success of the access attempt are met.

[0014] It has been recognized that in the context of manufacturer services or tracking services for digital keys for motor vehicles there may be knowledge of which keys in a chain have been authenticated on the motor vehicle. It is therefore proposed that in these sectors redundant authentication packages be removed within the scope of the creation process of a new key.

[0015] Preferably, all authentication packages that are associated with the key that is located in the chain before the determined key are removed from the chain. This allows a maximum amount of redundant data to be saved. The key chain can include a plurality of keys, wherein a key can be created based on a predecessor key of the key or signed by the predecessor key. The authentication package chain can be constructed accordingly. An authentication package can be signed with a key that is located in the key chain before the key that is associated with the package.

[0016] In order to be able to use a motor vehicle with a new key, the new key and at least one authentication package are required. If the authentication package is signed with a key that has not yet been authenticated on the motor vehicle, further authentication packages in the chain may be required. The technology described here aims to keep the chain of required authentication packages as short as possible.

[0017] Furthermore, it is preferred to determine the key that has already been verified with respect to the motor vehicle, which is located closest in the chain to the new key. For example, if keys zero, one, two, three, four and five are provided in the chain, wherein key zero has no predecessor key and is considered verified, a new key six can be created on the basis of key five. If keys two and four are already verified, then of the verified keys, key four is closest to the new key six in the chain. Accordingly, the authentication packages signed with keys zero to three can be removed from the authentication package chain.

[0018] Furthermore, preferably, a message is received which indicates that the key has been authenticated with respect to the motor vehicle. The motor vehicle can transmit the message as soon as wireless information transmission is available. The message can be stored by the service so that it can be determined later, when tracking new keys, which keys in the chain have been authenticated with respect to the motor vehicle.

[0019] Such a message can be transmitted from the motor vehicle to the manufacturer, to a service or tracking service when a key is first authenticated to the motor vehicle or thereafter. The message can indicate that the authentication package associated with the key has been successfully checked on the motor vehicle side. In this case, the chain of authentication packages associated with the key can be positively verified.

[0020] Furthermore, it is preferred that the tracing response is signed before it is provided. This allows the motor vehicle to ensure that the attached authentication packet chain is sufficient to maintain a predetermined security against misuse.

[0021] The new key can be authenticated relative to the motor vehicle; and the authentication package associated with the key can be successfully checked on the motor vehicle side. Only then is access to the motor vehicle permitted. The access can, for example, involve unlocking or opening a vehicle door or a vehicle flap. The access can also involve driving with the motor vehicle.

[0022] The new key and the authentication package associated with the key are preferably transmitted wirelessly to the motor vehicle. Various interfaces can be used for this purpose. In one embodiment, the key is transmitted by means of UWB or NFC. The transmission speed of the interface can be low compared to the amount of data to be transmitted.

[0023] According to another aspect of the invention, a tracking service for tracking digital keys for controlling access to a motor vehicle comprises: an interface for receiving a tracking request for a new digital key for a motor vehicle; and a processing device. Here, the digital key is comprised of a chain of digital keys generated from one another; wherein the tracking request comprises a chain of authentication packages, which are assigned to the keys in pairs. Here, the processing device is configured to determine that a key in the chain that is assigned one of the authentication packages has been verified relative to the motor vehicle; and to remove from the chain an authentication package that is assigned to a key that is located before the determined key in the chain. In addition, an interface is provided for providing a tracking response with at least one authentication package.

[0024] Preferably, the processing device is arranged to partially or completely execute the method described herein. Other parts of the method can be executed by a processing device of a control device on a motor vehicle. The processing device can be implemented electronically and, for example, comprises an integrated circuit, a programmable logic module or a programmable microcomputer. The method can be implemented in the form of a configuration or as a computer program product with program code segments for the processing device. The configuration or the computer program product can be stored on a computer-readable data carrier. Features or advantages of the method can be transferred to a device or system, or vice versa.

[0025] According to another aspect of the invention, a control device for a motor vehicle is configured to allow access to the motor vehicle when a new digital key has been authenticated and the chain of an authentication package associated with the key has been successfully checked. The key and the authentication package can be transmitted by means of a wireless interface, for example via UWB or NFC.

[0026] According to another aspect of the present invention, a motor vehicle comprises a control device as described herein. The motor vehicle may in particular be a car, a truck or a bus.

[0027] According to yet another aspect of the present invention, a system includes the tracking service described herein and the vehicle described herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The present invention will now be described in more detail with reference to the accompanying drawings, in which:

[0029] Figure 1 A system and a first method are shown;

[0030] Figure 2 a flow chart showing a second method; and

[0031] Figure 3 The flow when forming a key chain is shown. DETAILED DESCRIPTION

[0032] Figure 1 A system 100 is shown for controlling access to a motor vehicle 105. The system 100 includes the motor vehicle 105, an owner device 110, a friend device 115, a manufacturer service 120, and a tracking service 125. The owner device 110 is associated with an owner 130, and the friend device 115 is associated with a friend 135.

[0033] Access to motor vehicle 105 may include, in particular, opening a door or a flap or driving motor vehicle 105 . Owner 130 is authorized to use motor vehicle 105 and, in particular, to transfer authorization for use of motor vehicle 105 to buddy 135 .

[0034] The owner 130 and the friend 135 preferably include natural persons who can use the motor vehicle 105 in a predetermined manner. The manufacturer service 120 can be operated by the manufacturer of the motor vehicle 105. The manufacturer can also be called OEM, and the manufacturer service 120 can also be called OEM server 120. Information about the motor vehicle 105 and one or more persons assigned to the motor vehicle can be stored in the manufacturer service 120. The task of the tracking service 125 is to track or archive the keys with which the motor vehicle 105 can be used. The tracking service 125 can also be called a key tracking server (Key Tracking Server). It should be noted that the names used here are used according to the digital car key standard mentioned. It is intended to correspond to the names or terms used there.

[0035] A control device 140 is provided on motor vehicle 105 and is provided for controlling access to motor vehicle 105. Predefined safety functions, such as unlocking, opening or driving motor vehicle 105, can only be controlled or used after a suitable digital key has been handed over to control device 140.

[0036] Figure 1Also shown is a method 200 for controlling access to a motor vehicle 105. The method steps are shown as arrows between the individual elements of the system 100. The method 200 can be part of an access control described within the scope of a digital vehicle key. It is proposed that the access control described in the standard be expanded by transmitting additional information in the method 200 described below.

[0037] In step 205 , owner 130 may transmit a configuration to buddy 135 , which configuration contains instructions as to which motor vehicle 105 is to be used in what manner with the digital key to be created.

[0038] In step 210, the friend device 115 may generate a key corresponding to the transferred configuration. In step 215, the generated key may be transmitted from the friend device 115 to the owner device 110 for signing.

[0039] In step 220, the owner device 110 of the owner 130 may digitally encrypt and sign the transmitted key of the friend device 115. In step 225, the owner device 110 may transmit the import request together with the authentication packet to the friend device 115. The authentication packet may contain information about which further steps are to be performed by the friend device 115 in order to make the generated key valid.

[0040] In step 230, the friend device 115 may send the authentication packet together with the tracking request to the tracking service 125. In step 235, the tracking service 125 may notify the manufacturer service 120 of the received tracking request. Subsequently, in step 240, predetermined data may be exchanged between the manufacturer service 120 and the tracking service 125, the predetermined data being related to the key of the friend device 115. In step 245, the tracking service 125 may sign the created key of the friend device 115. In addition, the tracking service 125 may store information about the created or signed key to enable tracking.

[0041] In step 250, the key together with the authentication package may be transmitted from the tracking service 125 to the friend device 115. At the same time, in step 255, the manufacturer service 120 may transmit the authentication package directly to the motor vehicle 105. It should be noted that this step may not be performed if there is no communication link between the manufacturer service 120 and the motor vehicle 105, for example because the motor vehicle 105 is parked in an underground parking lot without access to a mobile wireless network.

[0042] In step 260, friend device 115 enters communication range with motor vehicle 105. Information can be exchanged here, which can include the key identification of friend device 115 and the authentication packet. This initial data transmission is known in the digital car key standard as the Friend First Approach. It should be noted that the actual authentication between friend device 115 and motor vehicle 105 can only take place later.

[0043] In step 265, the friend device 115 can be authenticated with respect to the motor vehicle 105. In addition, the authentication packet can be checked on the part of the motor vehicle 105. If both the authentication and the check are run positively, the access control of the friend device 115 to the motor vehicle 105 can be controlled based on the transmitted additional information.

[0044] In step 270 , a message may be sent to the tracking service 125 indicating that a digital key was able to be successfully authenticated to the motor vehicle 105 for the first time and that the authentication package associated with the key has been successfully checked.

[0045] Figure 2 A flow chart of a second method 300 is shown, which can be implemented integratedly or interleaved with the first method 100. The second method 200 is preferably implemented at least partially in the tracking service 125. A first step 305 can correspond to step 230. Here, a tracking request is received, which is accompanied by a new digital key and a plurality of authentication packages.

[0046] In step 310, the last verified key in a chain including the new key may be determined. Typically the new key is the last link in the chain. The keys of the chain may be known based on previously received tracking requests 230. Which keys have been verified may be known from previously received messages 270.

[0047] In step 315, it is determined whether the key is included in the key chain from which the new key is created. Through steps 310 and 315, a key that has been used for authentication and is located closest to the new key in the chain can be determined. In step 320, the authentication package signed with the determined key can be removed from the authentication package chain attached to the new key.

[0048] In step 325, the new key and / or the authentication package can be signed by the tracking service 245. This step corresponds to step 245 of the second method 200. In step 325, the new key and the remaining authentication package can be transmitted to the friend device 115. This step can correspond to step 250. In addition, the key and / or the authentication package can also be transmitted to the motor vehicle 105 by the manufacturer service 120, as described in the first method 200 with respect to steps 240 and 255.

[0049] Figure 3 An exemplary process 400 is shown when forming a key chain 405. An element of the key chain 405 is associated with an authentication package chain 410. In the left area, the tracking service 125 is symbolized as a vertical line, and in the right area, the motor vehicle 105 is symbolized as another vertical line. Time runs along the lines from top to bottom. Time runs along the lines from top to bottom

[0050] Between the lines, a key is represented by a circular symbol and an authentication packet is represented by a square symbol. Corresponding numbers are given in the symbols. For example, an authentication packet with the number zero is signed with a key with the same number.

[0051] Initially, there is only one digital key zero, which has no preceding key and is considered authenticated with respect to motor vehicle 105. Key zero can be used directly to use motor vehicle 105. The following process is shown in a partially simplified manner compared to methods 200 and 300.

[0052] Key one is created on the basis of key zero. For this purpose, a tracking request is made to the tracking service 125 (or system 100) in step 415. A corresponding tracking response is made in step 420. Authentication package zero is assigned to key one.

[0053] Now, a further key two can be created based on key one. For this purpose, a tracing request can be made again in step 425 and a tracing response can be received again in step 430. Authentication package 1 is assigned to key two. With the help of authentication package 1, key two can be traced back to key one. In addition, authentication package zero is also required, with which key one can be traced back to key zero. Key chain 405 can now have three entries (two entries if the initial key zero is not counted), and authentication package chain 410 can have two entries.

[0054] In the present example, key two is now handed over to the motor vehicle 105 together with the authentication package one and zero in step 435 , and the authentication package is verified and successfully checked. In step 440 , the motor vehicle 105 notifies the tracking service 125 of this.

[0055] In step 445, a new key three is created based on key two. For this purpose, a tracking message is sent to the tracking service 125. It is known there that key two has already been authenticated on the motor vehicle 105. Therefore, the entry before key two can be removed from the authentication chain 410 without loss of security. In step 450, only authentication package two is still assigned to key three in the tracking response. The user can access the motor vehicle 105 by showing key three and authentication package two. The previous authentication package of the chain 410 is not required.

[0056] Reference numerals list

[0057] 100 systems

[0058] 105 Motor Vehicles

[0059] 110 Owner Equipment

[0060] 115 Friend Devices

[0061] 120 Manufacturer Service (OEM Server)

[0062] 125 Tracking Service (Key Tracking Server)

[0063] 130 Owners

[0064] 135 Friends

[0065] 140 control equipment

[0066] 200 First Method

[0067] 205 Request to generate key, with configuration

[0068] 210 Friend device generates a key with permissions

[0069] 215 Request to sign key

[0070] 220 Owner device signs the key

[0071] 225 Import request with authentication package

[0072] 230 The friend device sends a tracking request to the tracking service

[0073] 235 Tracking Service Notification Manufacturer Service

[0074] 240 Exchange of shared data about keys

[0075] 245 Tracking Service signs the key and saves it

[0076] 250 Tracking response: Transmit signature and authentication package to friend device

[0077] 255 Signature and authentication package from manufacturer services to motor vehicles

[0078] 260 Friends device's first contact with a motor vehicle

[0079] 265 verification, evaluation certification package, and access authorization

[0080] 270 Tips for first successful authentication with a new key

[0081] 300 Second Method

[0082] 305 Tracking request received

[0083] 310 Confirm the last verified key

[0084] 315 Is the key present in the verification chain?

[0085] 320 Remove previous authentication package

[0086] 325 Signature and authentication package to friend's device

[0087] 400 Process

[0088] 405 Digital Keychain

[0089] 410 certification package chain

[0090] 415 tracking inquiry

[0091] 420 Tracking Response

[0092] 425 tracking inquiry

[0093] 430 Tracking Response

[0094] 435 First contact with a motor vehicle

[0095] 440 Activation Message

[0096] 445 Tracking Inquiry

[0097] 450 Tracking Response

Claims

1. A method (300) for controlling access to a motor vehicle (105), wherein: The method (300) comprises the following steps: - receiving ( 305 ) a tracking request for a new digital key for a motor vehicle ( 105 ); - wherein the digital key is comprised of a chain (405) of mutually generated digital keys; - wherein the tracking request includes a chain of authentication packets (420), the authentication packets being paired with a key; - determining ( 315 ) that a key in the chain ( 405 ) which is provided with one of the authentication packages has been authenticated with respect to the motor vehicle ( 105 ); - removing ( 320 ) from the chain ( 410 ) the authentication package associated with the key that precedes the determined key in the chain ( 405 ); and - Providing (325) a traceback reply with at least one remaining authentication packet.

2. The method (300) according to claim 1, wherein: All authentication packets associated with the key that precedes the determined key in the chain (405) are removed from the chain (410).

3. The method (300) according to claim 1 or 2, wherein: A key that has already been authenticated to the motor vehicle (105) is determined, which key is located closest to the new key in the chain (405).

4. The method (300) according to any one of the preceding claims, wherein: A message is received indicating that the key has been authenticated to the motor vehicle (105).

5. The method (300) according to claim 4, wherein: The message is received only after the key has been authenticated for the first time relative to the motor vehicle (105).

6. The method (300) according to claim 4 or 5, wherein: The message indicates that the authentication package associated with the key has been successfully checked on the part of the motor vehicle (105).

7. The method (300) according to any of the preceding claims, wherein: The trace reply is signed before being provided.

8. The method (300) according to any one of the preceding claims, wherein: The new key is authenticated to the motor vehicle (105); and an authentication package associated with the key is successfully checked on the part of the motor vehicle (105).

9. The method (300) according to claim 8, wherein: Access to motor vehicles (105) is permitted.

10. The method (300) according to any one of claims 8 or 9, wherein: The new key and the authentication packet associated with the key are transmitted wirelessly to the motor vehicle (105).

11. A tracking service (125) for tracking a digital key for controlling access to a motor vehicle (105); wherein: The tracking service includes the following elements: - an interface for receiving a tracing request for a new digital key for a motor vehicle (105); - wherein the digital key is comprised of a chain (405) of mutually generated digital keys; - wherein the tracking request includes a chain of authentication packets (420), the authentication packets being paired with a key; - a processing device, which is configured to determine that a key in the chain (405) which is provided with one of the authentication packages has been authenticated with respect to the motor vehicle (105); and to remove from the chain (410) the authentication package associated with the key which is located before the determined key in the chain (405); and - Interface for providing a trace reply with at least one authentication packet.

12. A control device (140) for a motor vehicle (105), wherein the control device is configured to allow access to the motor vehicle (105) when a verification has been performed with respect to a new digital key and a chain (410) of authentication packets associated with the key has been successfully checked.

13. A motor vehicle (105) comprising a control device (140) according to claim 12.

14. A system (100) comprising a tracking service (125) according to claim 11 and a motor vehicle (105) according to claim 13.

Images