Brake system for motor vehicle and corresponding method for operating brake system

Abstract

The invention relates to a brake system (1) for a motor vehicle, comprising: an actuation device (2), in particular a brake pedal, for detecting an actuation parameter specified by a driver of the motor vehicle; at least one wheel brake associated with one of the wheels of the motor vehicle; the invention relates to a wheel brake device (1) for a motor vehicle, comprising an actuating device (2) for actuating a wheel brake, and at least one actuatable actuator device (3, 4), by means of which the braking force of the wheel brake can be adjusted, the actuator device (3, 4) being coupled to the actuating device (2) via at least one signal connection (5) in order to adjust the braking force as a function of an actuating parameter of the actuating device (2). According to the invention, the signal connection (5) transmits the actuating parameter from the actuating device (2) to the actuator device (3, 4) in an encrypted manner. The invention also relates to a method for operating a brake system.

Description

Technical Field

[0001] The invention relates to a brake system for a motor vehicle, comprising an actuating device, in particular a brake pedal, for detecting an actuating parameter that can be specified by a driver of the motor vehicle, at least one wheel brake assigned to one of the wheels of the motor vehicle, and at least one controllable actuator device, by means of which the braking force of the wheel brake can be adjusted, wherein the actuator device is connected to the actuating device via at least one signal connection in order to adjust the braking force as a function of the actuating parameter of the actuating device. The invention also relates to a method for operating a brake system of a motor vehicle. Background Art

[0002] Braking systems are known in the prior art which form so-called "brake-by-wire" braking systems for motor vehicles. In this case, an actuation parameter provided by a brake pedal, which corresponds, for example, to a pedal deflection of the brake pedal and / or a pedal force acting on the brake pedal, is transmitted to an actuator device of the brake system via an electrical signal connection. The actuator device then adjusts a braking force corresponding to the pedal deflection and / or the pedal force at the wheel brakes of the motor vehicle.

[0003] However, the braking system cannot identify whether the actuation parameters transmitted via the signal connection correspond to the pedal deflection or pedal force actually present on the brake pedal. In particular, it is impossible to determine whether the actuation parameters transmitted via the signal connection are actually provided by the brake pedal, or whether they are generated or manipulated in other ways, for example, by a third-party device. Specifically, the signal connection between the brake pedal and the actuator device is publicly accessible and in principle manipulable. Manipulation of the actuation parameters should be understood in particular as targeted changes to the actuation parameters transmitted via the signal connection. In known braking systems, there is neither confidential transmission of the actuation parameters nor verification thereof. At most, a plausibility check is performed, which, for example, checks the pedal deflection and / or pedal force with the aid of the physical limits of the brake pedal. However, targeted manipulation of the actuation parameters can neither be reliably identified nor prevented by the plausibility check. Summary of the invention

[0004] The object of the present invention is to provide a braking system which has advantages over known braking systems, in particular making undesired manipulation of a signal connection of the braking system or of an actuation parameter transmitted via the signal connection more difficult and / or making attempts at such undesired manipulation recognizable.

[0005] This is achieved according to the invention by a brake system having the features of claim 1. It is provided that the signal connection transmits the actuation parameters from the actuation device to the actuator device in encrypted form.

[0006] Advantageous designs with beneficial developments of the invention are given in the dependent claims. It should be pointed out that the embodiments explained in the description are not restrictive, and rather any variation of the features disclosed in the description, the claims and the drawings can be implemented.

[0007] The brake system is in particular a component of a motor vehicle. The motor vehicle preferably has a drive mechanism, by means of which a drive torque is provided or can be provided for driving the motor vehicle. The motor vehicle also has at least one wheel to which a wheel brake is assigned. With the aid of the wheel brake, a braking force can be provided for braking a wheel or the motor vehicle. The motor vehicle preferably has a plurality of wheels, wherein each wheel is assigned a corresponding wheel brake. For example, the motor vehicle has at least two wheel axles, each of which has at least one wheel.

[0008] In order to adjust the braking force of the wheel brakes, the brake system has at least one actuator device. The actuator device is, for example, a component of a hydraulic brake device, via which the wheel brakes are acted upon by the brake pressure. Alternatively, the actuator device is a component of an electromechanical brake device, which acts upon the wheel brakes by means of an electric drive and an optional transmission.

[0009] The brake system also has an actuating device, which is in particular designed as a brake pedal. The actuating device detects a braking request of the driver and provides it in the form of the mentioned actuating parameters. The actuating parameters correspond in particular to a pedal deflection of the brake pedal and / or a pedal force acting on the brake pedal. The actuating parameters are thus specified by the driver of the motor vehicle by corresponding actuation of the actuating device.

[0010] At least one actuator device adjusts the braking force of the wheel brake as a function of the actuation parameter. In this respect, the braking force is adjusted as a function of the pedal deflection and / or the pedal force. For this purpose, the actuator device is coupled to the actuation device via at least one signal connection. The signal connection thus serves to transmit the actuation parameter from the actuation device to the actuator device.

[0011] The invention provides that the actuation parameters are transmitted in encrypted form via the signal connection. This is to be understood in particular to mean that the actuation parameters are encrypted by the actuation device using at least one key before being transmitted. The encrypted actuation parameters are then transmitted via the signal connection to the actuator device and decrypted by the actuator device. The encryption is preferably performed by the actuation device and the decryption is preferably performed by the actuator device. Since a targeted change of the encrypted actuation parameters is not possible without knowledge of the key used, this makes such manipulation more difficult or allows the detection of attempted manipulation.

[0012] A development of the invention provides that the signal connection is a serial bus system of the motor vehicle, in particular a CAN bus. Since modern motor vehicles generally have a large number of controllers, they generally have at least one central bus system. The bus system is preferably a component of the motor vehicle and is used, for example, for communication between a plurality of controllers of the motor vehicle. As such a bus system is known, for example, the "Controller Area Network" (CAN).

[0013] It can be provided that the signal connection between the actuating device and the actuator device is preferably implemented via a bus system of the motor vehicle. The bus system enables encrypted transmission of the actuating parameters. For example, encrypted transmission via the CAN bus can be performed using the Advanced Encryption Standard (AES).

[0014] The actuating device preferably has a controller which is designed to encrypt the actuating parameters according to the encryption standard used. The key for encryption is provided by the controller and is set, for example, at the factory. The encrypted actuating parameters are transmitted to the actuator device via a signal connection or a bus system. The actuator device then decrypts the actuating parameters. For this purpose, for example, the key for encryption is also stored in the actuator device at the factory. The actuating device and the actuator device are thus used in the factory for symmetrical encryption of the actuating parameters. This makes it particularly easy to implement encrypted transmission.

[0015] Additionally or alternatively, the key exchange between the actuating device and the actuator device is provided by a higher-level asymmetric key exchange method. For example, when the brake system is activated, a key is randomly selected and exchanged between the actuating device and the actuator device using a key exchange method. The above-described symmetric encryption is then performed using the randomly selected key. When the brake system is subsequently activated, a new key can be randomly selected. This increases the security of the encryption, since targeted manipulation when the factory-set key is known can be detected or made more difficult.

[0016] In order to prevent manipulation of the signal connection by so-called "replay" attacks, provision can be made for the use of random values, in which the encrypted transmitted actuation parameters are recorded and the manipulated actuation parameters are subsequently played back based on the recorded encrypted actuation parameters. When the brake system is started, the random values ​​are randomly selected by the controller of the actuation device and transmitted to the actuator device via the signal connection. Periodically, in particular each time an actuation parameter is sent, the random values ​​are then appended to the actuation parameters, so that even when constant operating parameters are transmitted, changed encrypted operating parameters are always transmitted. When the brake system is subsequently started, the random values ​​are randomly selected again, so that such a change of the encrypted operating parameters is ensured during the restart of the brake system. This can prevent the "replay" attack explained above, or at least make it more difficult.

[0017] A development of the invention provides that the actuator device is additionally coupled to the actuating device via at least one further signal connection, wherein the further signal connection transmits the actuating parameters to the actuator device in unencrypted form. The further signal connection is present in addition to the signal connection. In particular, the further signal connection is not implemented via a serial bus system, but is present independently of the serial bus system.

[0018] It is therefore provided that the actuation parameters are transmitted to the actuator device both in encrypted form via the signal connection and in unencrypted form via the further signal connection. If there are a plurality of actuator devices, it can be provided that the actuation parameters are transmitted to all actuator devices via a common bus system, but preferably at least one further signal connection is present for each actuator device, via which the actuation parameters are additionally transmitted in unencrypted form to the respective actuator device. Of course, it can also be provided as an alternative that the actuation parameters are transmitted to a plurality or all actuator devices via a common further signal connection. Via the further signal connection, it is ensured that the actuation parameters for adjusting the braking force are provided to the actuator device, even if the encrypted transmission via the signal connection is not fault-free or is only delayed in time (for example due to errors and / or an overload of the bus system).

[0019] A development of the invention provides that the further signal connection is a serial interface and / or a pulse width modulator. As already explained above, the further signal connection exists independently of the signal connection, in particular the bus system. The further signal connection is, for example, a serial interface, in particular a serial point-to-point interface, via which the actuation parameters are transmitted directly and unencrypted from the actuation device to the actuator device. Alternatively, the further signal connection is a clocked electrical signal, with which the actuation parameters are transmitted in unencrypted form, for example via a pulse width modulator. The use of a serial interface or pulse width modulation makes it particularly easy to realize the further signal connection.

[0020] A development of the invention provides that at least one actuator device comprises a brake booster and / or a control unit for an electronic stability control. The actuator device is, for example, a component of a wheel brake, but can also be present separately therefrom. The actuation parameters specified by the driver using the actuation device are transmitted from the actuation device to the actuator device via a signal connection. The actuator device has a brake booster, by means of which the braking force of the wheel brake is adjusted as a function of the actuation parameters.

[0021] Additionally or alternatively, the actuator device has a control unit for an electronic stability control, which regulates the braking force as a function of the actuation parameters, wherein, for example, wheel locking is prevented and / or the motor vehicle is longitudinally stabilized. Since the actuation parameters are transmitted in encrypted form via the signal connection, it is ensured that the brake booster or the control unit for the electronic stability control is provided with actuation parameters that correspond to the actual braking request of the driver.

[0022] The invention also relates to a method for operating a braking system of a motor vehicle, in particular a braking system according to the description, which has an actuating device, in particular a brake pedal, for detecting an actuating parameter specified by a motor vehicle driver, at least one wheel brake assigned to a wheel of the motor vehicle, and at least one controllable actuator device, by which the braking force is adjusted as a function of the actuating parameter, which is transmitted from the actuating device to the actuator device via at least one signal connection. It is provided that the actuating parameter is transmitted to the actuator device via the signal connection in encrypted form.

[0023] The invention also relates to a motor vehicle having a brake system, in particular a brake system according to the statements in this description.

[0024] The advantages of this design of the brake system, the motor vehicle and the corresponding method have been pointed out. Both the brake system and the motor vehicle, as well as the method for their operation, can be improved according to the statements in this specification, so reference is made to these statements in this regard.

[0025] A development of the invention provides that the actuation parameter is additionally transmitted in unencrypted form by the actuation device via at least one further signal connection to the actuator device, and the braking force is adjusted primarily as a function of the actuation parameter transmitted in unencrypted form. The further signal connection and the unencrypted transmission of the actuation parameter have already been mentioned above.

[0026] The actuation parameters are therefore transmitted to the actuator device in an encrypted manner via the signal connection on the one hand and in an unencrypted manner via the further signal connection on the other hand. Since the actuation parameters are encrypted for transmission via the signal connection, they are delayed in time compared to the unencrypted transmitted actuation parameters. This is particularly the case if the signal connection is via a bus system.

[0027] It is now provided that the braking force is regulated primarily as a function of the unencrypted transmitted actuation parameters. This allows the braking force to be regulated as quickly as possible as a function of the unencrypted transmitted actuation parameters. The encrypted transmitted actuation parameters are only used to detect manipulation of the transmitted actuation parameters. This provides a particularly fast-responding and safe braking system.

[0028] A development of the invention provides that the unencrypted transmitted actuation parameters are verified by comparison with encrypted transmitted actuation parameters. Since the further signal connection transmits the actuation parameters only in unencrypted form, the actuation parameters transmitted via the further signal connection can in principle be manipulated. In order to detect this, a comparison with the encrypted transmitted actuation parameters is provided.

[0029] By means of this comparison, the actuation parameters transmitted in unencrypted form are verified. As long as there are no faults or manipulations, the actuation parameters transmitted in encrypted form and the actuation parameters transmitted in unencrypted form should in principle be consistent with one another. It is therefore possible to verify the actuation parameters transmitted in unencrypted form by comparison with the actuation parameters transmitted in encrypted form. This makes it particularly easy to detect manipulations or faults.

[0030] A development of the invention provides that, for verifying the actuation parameters transmitted in unencrypted form, a deviation of the actuation parameters transmitted in unencrypted form from the actuation parameters transmitted in encrypted form is determined, wherein if the deviation is greater than a threshold value, a manipulation is concluded. As already discussed above, the actuation parameters transmitted in unencrypted form and the actuation parameters transmitted in encrypted form should in principle be consistent with one another.

[0031] In order to detect a manipulation, a deviation is determined, which is formed, for example, by the difference between the actuation parameters transmitted in unencrypted form and the actuation parameters transmitted in encrypted form. A suitable threshold value is provided for the deviation, which takes into account, for example, the signal noise of the signal connections. Thus, if the deviation is greater than the threshold value or exceeds the threshold value, a manipulation can be inferred. This makes it possible to verify the actuation parameters transmitted in unencrypted form as easily as possible.

[0032] A refinement of the present invention provides that the waiting time of the signal connection and / or the further signal connection is taken into account when determining the deviation. Both the signal connection and the further signal connection have a non-zero delay. The waiting time is to be understood as the time delay for the actuation parameters detected by the actuation device to be transmitted to the actuator device. The waiting time of the signal connection may be different from the waiting time of the further signal connection. In particular, the waiting time of the signal connection is greater than the waiting time of the further signal connection, because the actuation parameters must be encrypted before transmission via the signal connection and decrypted after transmission, while these steps are omitted when transmitting via the further signal connection. If the signal connection exists as a bus system, the waiting time of the signal connection can in principle be greater than the waiting time of the further signal connection.

[0033] Therefore, when verifying the actuation parameters transmitted in unencrypted form by comparison with the actuation parameters transmitted in encrypted form, non-zero deviations may occur due to different waiting times. In order not to erroneously identify this deviation as a manipulation, the waiting time is taken into account when determining the deviation. For example, the waiting time can be determined by transmitting the specified test parameters from the actuation device to the actuator device simultaneously both via the signal connection part and via the further signal connection part. Due to the different waiting times, the test parameters are provided to the actuator device with a corresponding time delay. This makes it possible to determine the waiting time at the actuator device, or more precisely, the difference between the waiting times of the signal connection part and the further signal connection part. Subsequently, when verifying the actuation parameters transmitted in unencrypted form, the waiting time or the difference determined in this way is taken into account. In this way, erroneous identification of the waiting time as a manipulation is prevented.

[0034] A development of the invention provides that, when there is a maneuver, the braking force is adjusted primarily as a function of the actuation parameters transmitted in encrypted form and / or the motor vehicle is decelerated by the wheel brakes, in particular until the motor vehicle is stationary. When there is a maneuver, the braking force is thus no longer adjusted as a function of the actuation parameters transmitted in unencrypted form. Specifically, the actuation parameters transmitted in unencrypted form are preferably discarded and the braking force is adjusted primarily, in particular exclusively, as a function of the actuation parameters transmitted in encrypted form. This ensures that the braking force is adjusted exclusively as a function of the actuation parameters specified by the motor vehicle driver.

[0035] Additionally or alternatively, it is provided that the braking force of the wheel brakes is adjusted so that the motor vehicle is decelerated. Preferably, the motor vehicle is decelerated until the motor vehicle is stationary. When the stationary state is reached, the braking force is preferably adjusted to keep the motor vehicle stationary. This provides a particularly safe motor vehicle.

[0036] The features and feature combinations described in the specification, in particular the features and feature combinations introduced in the following description of the figures and / or shown in the figures, can be used not only in the respectively given combination, but also in other combinations or alone without departing from the scope of the present invention. Therefore, embodiments that are not explicitly shown or explained in the specification and / or the figures but are derived or derivable from the explained embodiments by the feature combination are also considered to be covered by the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The invention is explained in more detail below with reference to an exemplary embodiment shown in the drawing.

[0038] The only Figure 1 is a schematic diagram of a braking system for a motor vehicle according to the invention. DETAILED DESCRIPTION

[0039] Figure 1 A schematic diagram of a braking system 1 according to the invention of a motor vehicle, not shown in detail, is shown. The braking system 1 has an actuating device 2 which is present as a brake pedal. The actuating device 2 is at least temporarily actuated by the driver of the motor vehicle. For example, the driver applies a pedal force to the actuating device 2 which causes a corresponding pedal deflection. The actuating device 2 serves to detect the pedal deflection and / or the pedal force and to provide it in the form of an actuating parameter. In this respect, the actuating parameter corresponds to a braking request specified by the driver of the motor vehicle.

[0040] In the exemplary embodiment shown, the brake system 1 has two actuator devices 3 and 4. The first actuator device 3 is, for example, a component of a brake booster, while the second actuator device 4 is a component of an electronic stability control system. The first actuator device 3 and the second actuator device 4 both adjust the braking force of wheel brakes (not shown in detail) of the motor vehicle.

[0041] The two actuator devices 3 and 4 can be controlled to adjust the braking force. For this purpose, the two actuator devices are connected to the actuating device 2 via at least one signal connection 5. The signal connection 5 transmits the actuating parameters from the actuating device 2 to the two actuator devices 3 and 4 in an encrypted form. The signal connection 5 is a component of a serial bus system 6, for example a CAN bus, or the signal connection 5 is connected to a serial bus system.

[0042] The encrypted transmission is carried out using a symmetric encryption method, in particular using encryption according to the AES standard. In order to be able to transmit the actuation parameters encrypted via the signal connection 5, the actuation device 2 has a controller 7. The controller 7 holds in particular a key, with which the actuation parameters are encrypted and transmitted via the signal connection 5.

[0043] The actuator devices 3 and 4 are used to decrypt the actuation parameters transmitted in encrypted form via the signal connection 5. For this purpose, the key used for encryption is available in the actuator devices 3 and 4. In this respect, the same symmetric key is stored both in the control unit 7 of the actuator device 2 and in the actuator devices 3 and 4.

[0044] For example, the key is set at the factory. Additionally or alternatively, a higher-level key exchange method, in particular an asymmetric key exchange method, is provided. By means of the key exchange method, in particular randomly selected keys are exchanged between the actuating device 2 and the two actuator devices 3 and 4 .

[0045] In addition to the signal connection 5 for encrypted transmission of actuation parameters, the actuator devices 3 and 4 are each coupled to the actuation device 2 via at least one further signal connection 8 or 9. The further signal connections 8 and 9 are present, for example, in the form of serial interfaces and / or pulse width modulation.

[0046] The actuation parameters are transmitted in unencrypted form to the actuator devices 3 and 4 via the further signal connections 8 and 9. The actuation parameters are therefore transmitted encrypted via the signal connection 5 on the one hand and unencrypted via the further signal connections 8 and 9 on the other hand. It is provided that the braking force at the wheel brakes is adjusted primarily as a function of the actuation parameters transmitted in unencrypted form, since these are transmitted with a small time delay due to latency of the bus system 6.

[0047] The actuation parameters transmitted in unencrypted form are verified by comparison with the actuation parameters transmitted in encrypted form. For this purpose, for example, deviations of the actuation parameters transmitted in unencrypted form from the actuation parameters transmitted in encrypted form are determined, wherein latency times of the bus system 6 are taken into account. By comparing the deviation with a threshold value, for example, if the deviation is greater than a specified threshold value, it can be concluded that a manipulation has occurred.

[0048] If a manipulation is detected, the braking force is adjusted primarily as a function of the actuation parameters transmitted in encrypted form. Additionally or alternatively, provision is made for the motor vehicle to be decelerated by the wheel brakes, in particular until the motor vehicle comes to a standstill. A further start of the motor vehicle can then be prevented, for example by holding the motor vehicle stationary using the wheel brakes.

Claims

1. A braking system (1) for a motor vehicle, the braking system comprising: an actuating device (2), in particular a brake pedal (2), for detecting an actuating parameter specified by a driver of the motor vehicle; at least one wheel brake assigned to one of the wheels of the motor vehicle; and at least one controllable actuator device (3, 4), by means of which the braking force of the wheel brake can be adjusted, wherein the actuator device (3, 4) is connected to the actuating device (2) via at least one signal connection (5) so as to adjust the braking force according to an actuating parameter of the actuating device (2), characterized in that the signal connection (5) transmits the actuating parameter from the actuating device (2) to the actuator device (3, 4) in encrypted form.

2. The brake system (1) according to claim 1, characterized in that The signal connection (5) is a serial bus system of the motor vehicle, in particular a CAN bus (6).

3. The brake system (1) according to any one of the preceding claims, characterized in that The actuator device (3, 4) is additionally connected to the actuating device (2) via at least one further signal connection (8, 9), wherein the further signal connection (8, 9) transmits the actuating parameters from the actuating device (2) to the actuator device (3, 4) in unencrypted form.

4. Braking system (1) according to any one of the preceding claims, characterized in that The further signal connections (8, 9) are serial interfaces and / or pulse width modulators.

5. Braking system (1) according to any one of the preceding claims, characterized in that At least one of the actuator devices (3, 4) comprises a brake booster and / or a controller for an electronic stability control.

6. A method for operating a braking system (1) of a motor vehicle, in particular a braking system according to one or more of claims 1 to 5, the braking system having: an actuating device (2), in particular a brake pedal, for detecting an actuating parameter specified by a driver of the motor vehicle; at least one wheel brake assigned to one of the wheels of the motor vehicle; and at least one controllable actuator device (3, 4), by means of which the braking force of the wheel brake can be adjusted, wherein the braking force is adjusted according to an actuation parameter transmitted from the actuation device (2) to the actuator device (3, 4) via at least one signal connection (5), characterized in that the actuation parameter is transmitted to the actuator device (3, 4) via the signal connection (5) in encrypted form.

7. The method according to claim 6, characterized in that The actuation parameter is additionally transmitted in unencrypted form from the actuation device (2) via at least one further signal connection (8, 9) to the actuator device (3, 4), and the braking force is adjusted primarily as a function of the actuation parameter transmitted in unencrypted form.

8. The method according to claim 6 or 7, characterized in that: The actuation parameters transmitted in unencrypted form are verified by comparison with the actuation parameters transmitted in encrypted form.

9. The method according to any one of claims 6 to 8, characterized in that In order to verify the actuation parameter transmitted in unencrypted form, a deviation of the actuation parameter transmitted in unencrypted form from the actuation parameter transmitted in encrypted form is determined, wherein a manipulation is inferred if the deviation is greater than a threshold value.

10. The method according to any one of claims 6 to 9, characterized in that When determining the deviation, the latency of the signal connection (5) and / or the further signal connection (8, 9) is taken into account.

11. The method according to any one of claims 6 to 10, characterized in that If the actuation is present, the braking force is adjusted as a function of the actuation parameters transmitted in encrypted form and / or the motor vehicle is decelerated by means of the wheel brakes, in particular until the motor vehicle comes to a standstill.

Images