Apparatus for transmitting message, transmission apparatus and method, apparatus for receiving message, transmission apparatus and method, and vehicle including transmission apparatus or apparatus

Abstract

The invention relates to a device, a transmission device and a method for transmitting messages, in which a plurality of messages are transmitted (202-1, 202-n), in which a reference message authentication code, in particular a Message Authentication Code, is determined (208) from at least two messages of the plurality of messages from reception (204-1, 204-m) to reception acknowledgement, and in which the reference message authentication code is transmitted (210). The invention relates to a device, a transmission device and a method for receiving messages, in which a plurality of messages are received (202-1,..., 202-m), in which a message authentication code, in particular a Message Authorization Code, is determined from a message from the plurality of messages.

Description

Technical Field

[0001] The present invention relates to a device and method for sending messages, a device and method for receiving messages, and a vehicle including the device. Background Art

[0002] Message authentication codes such as Message Authentication Code (MAC) have been used in communication between different control devices to ensure the integrity of the data transmitted in the message and the authenticity of the data. Summary of the Invention

[0003] By the method, device and vehicle according to the independent claims, the processor load and bus load during message transmission are reduced.

[0004] A method for sending messages provides for sending a plurality of messages, wherein a reference message authentication code, in particular Message Authentication Code, is determined based on at least two messages among the plurality of messages that have received a reception confirmation, and wherein the reference message authentication code is sent. Thereby, the bandwidth on the medium (e.g., data bus) used for communication is reduced.

[0005] Preferably, a hash function is used to determine a penultimate hash value based on the penultimate message among the plurality of messages, wherein the hash function is used to determine a last hash value based on the last message and the penultimate hash value among the plurality of messages, and the reference message authentication code is determined based on the last hash value. This means that the reference message authentication code is determined based on recursively and iteratively determined hash values. This requires less memory capacity.

[0006] Preferably, the reference message authentication code is determined independently of at least one message among the plurality of messages that has not received a reception confirmation. The messages considered have been received by the recipient. The consistency between the reference message authentication code based on these messages and the message authentication code determined by the recipient can be checked.

[0007] Preferably, an instruction for triggering a response is sent.

[0008] Preferably, a message including the reference message authentication code is determined, and wherein the message is transmitted at least once, in particular until a reception confirmation of the message is received for the first time. Thereby, the recipient can check the integrity and authenticity. By aborting the transmission of the reference message authentication code when the first reception confirmation is obtained, the load on the medium can be reduced or minimized.

[0009] A first transmission device is configured to execute the method for sending. The first transmission device has advantages corresponding to the advantages of the method for sending.

[0010] A first device, in particular a steering controller or a control device, includes a first transmission device configured to perform a method for sending. The device has advantages corresponding to the advantages of the method for sending.

[0011] A method for receiving messages provides for receiving a plurality of messages, wherein a message authentication code, in particular a Message Authentication Code (MAC), is determined based on the messages among the plurality of messages.

[0012] Preferably, a hash function is used to determine a second-to-last hash value based on the second-to-last message among the plurality of messages, wherein the hash function is used to determine a last hash value based on the last message and the second-to-last hash value among the plurality of messages, and the message authentication code is determined based on the last hash value.

[0013] Preferably, a reference message authentication code is received, wherein it is checked whether the message authentication code is consistent with the reference message authentication code, and wherein if the message authentication code and the reference message authentication code are different from each other, a response is triggered. The hash values are determined recursively and iteratively among the plurality of messages, and the message authentication code is determined based on the hash values. Thus, the message authentication code is determined in a recursive and iterative manner. This saves bandwidth and memory resources.

[0014] Preferably, an instruction for triggering a response is received, and the response is triggered. Thus, a response, in particular error handling, can be performed based on the message authentication code.

[0015] Preferably, it is checked whether a message including a reference message authentication code is received, wherein the message authentication code is determined based on a pre-given number of messages received before this message.

[0016] A second transmission device is configured to perform a method for receiving. The second transmission device has advantages corresponding to the advantages of the method for receiving.

[0017] A second device, in particular a steering actuator, includes a second transmission device configured to perform a method for receiving. The device has advantages corresponding to the advantages of the method for receiving.

[0018] A vehicle including the first transmission device, the second transmission device, and a data bus for transmitting messages and connecting the transmission devices has advantages corresponding to the advantages of the said devices.

[0019] A vehicle including the first device, the second device, and a data bus for transmitting messages and connecting the said devices has advantages corresponding to the advantages of these devices. Description of the Drawings

[0020] Other advantageous embodiments can be seen in the following description and the drawings. In the drawings: Figure 1 Shows a schematic diagram of a vehicle; Figure 2 Shows a sequence diagram; Figure 3 Shows a schematic diagram of segments for transmitting messages. Detailed implementation

[0021] Figure 1 Schematically shows vehicle 100.

[0022] Vehicle 100 includes a first device 102. The first device 102 is, for example, a steering controller. The first device 102 can also be other controllers or sensors of vehicle 100. The first device 102 includes, for example, a vehicle integration platform on which the steering controller is implemented.

[0023] In this example, the first device 102 includes a control device or a part of a control device.

[0024] Vehicle 100 includes a second device 104. In this example, the second device 104 is a steering actuator. The second device 104 can also be other actuators. In this example, the second device 104 includes a control device or a part of a control device.

[0025] In this example, the steering actuator and the steering controller are configured to perform the steering function of vehicle 100. This function can include, for example, steering feel or vehicle stability.

[0026] Vehicle 100 can also include other control devices, such as control devices for its driveline or its brakes, especially a brake-by-wire system. The first device 102 and / or the second device 104 can include one of these control devices or a part of one of these control devices.

[0027] The first device 102 can be a central control device that undertakes complex tasks, such as controlling especially steering assistance or steering feel, calculating manipulation variables and sending the manipulation variables to one or more actuators. The actuators can have the task of implementing these manipulation variables and sending sensor data to the central control device.

[0028] Vehicle 100 includes a data bus 106 for transmitting messages, which connects these devices. In this example, the data bus 106 is private, that is, only one sender and one receiver are connected to the data bus 106.

[0029] In order to meet requirements such as those for driving feel and controller dynamics, both the manipulated variables and the sensor data must be transmitted at a very high frequency (e.g., 1 kHz) or in real time. Even a delay in the millisecond range can lead to deterioration of control, especially deterioration of steering assistance or steering feel, and in the worst case even lead to loss of control of the steering. The first device 102, the second device 104, and the data bus 106 are all configured to meet these requirements.

[0030] The first device 102 includes a first transmission device 108, which is configured to perform the steps in the method for sending messages described below.

[0031] The first transmission device 108 is configured to combine a plurality of messages to be sent into one segment. In this example, one segment contains 8 messages. More or fewer messages can be combined into one segment.

[0032] The second device 104 includes a second transmission device 110, which is configured to perform the steps in the method for receiving messages described below.

[0033] The second transmission device 110 is configured to confirm the reception of the message, in particular by sending an acknowledgment ACK. The data bus 106 is, for example, configured according to the CAN protocol. This CAN protocol provides for acknowledgment frames for notifying the sending control device that the message has been received by at least one other control device.

[0034] The first transmission device 108 is configured to determine a message authentication code, in particular a Message Authentication Code (MAC), for messages from the same segment that have been acknowledged as received by the device 104 for receiving messages. Hereinafter, this message authentication code will also be referred to as a reference message authentication code. The Message Authentication Code is, for example, based on the AES CMAC of NIST Special Publication 800-38B, in particular with 128 bits.

[0035] The second transmission device 110 is configured to determine a message authentication code, in particular a Message Authentication Code, for the received messages from the same segment.

[0036] In this example, the first transmission device 108 and the second transmission device 110 are configured to determine a hash value using the same hash function. This hash function is, for example, configured to determine a 64-bit or 256-bit hash value. In this example, the hash value is a 64-bit number or a 256-bit number.

[0037] In this example, the first transmission device 108 and the second transmission device 110 are configured to determine the hash value iteratively and recursively.

[0038] In the first iteration, a first hash value is determined based on a first message among a plurality of messages assigned to the first segment and an initialization value. In the last iteration, a last hash value is determined. The last hash value is determined based on the hash value of the second-to-last iteration and the last message among the plurality of messages assigned to the first segment. After the last iteration, a message authentication code is determined based on the last hash value. In this example, for a hash value of 64 bits, the initialization value is a 64-bit number, or for a hash value of 256 bits, the initialization value is a 256-bit number.

[0039] In one example, the first transmission device 108 is configured to send the determined reference message authentication code. It may be stipulated not to send the reference message authentication code. In this example, the reference message authentication code of the first segment is sent in one message among the plurality of messages assigned to the second segment.

[0040] The first transmission device 108 is configured to frequently send the determined reference message authentication code in one message until an acknowledgment of receipt of the message is obtained. It may be stipulated that the first transmission device 108 is configured to send different reference message authentication codes in one message among the plurality of messages assigned to other segments for different segments respectively.

[0041] In one example, the second transmission device 110 is configured to check whether the received reference message authentication code is consistent with the message authentication code determined by the second transmission device 110 for the same segment. In one example, the second transmission device 110 is configured to receive the reference message authentication code. In one example, the second transmission device 110 is configured to trigger a response when the reference message authentication code is different from the message authentication code.

[0042] In one example, the first transmission device 108 is configured to send an instruction to trigger a response.

[0043] In one example, the second transmission device 110 is configured to receive the instruction to trigger a response and trigger a response.

[0044] Figure 2 A sequence diagram showing the steps in the method and their interactions is shown by way of example.

[0045] The following describes the transmission of a plurality of messages in a segment including n messages.

[0046] In this example, the first transmission device 108 sends n messages 202-1,......, 202-n-1, 202-n. These messages are sent without being protected by a message authentication code (in particular, not protected by a Message Authentication Code).

[0047] In this example, the second transmission device 110 receives m messages 202-1,......, 202-m-1, 202-m.

[0048] The second transmission device 110 determines hash values in an iterative and recursive manner. Exemplarily shown: determining 203-1 the first hash value according to the first message 202-1 among the multiple messages; determining 203-m-1 the penultimate hash value according to the penultimate message 202-m-1; and determining 203-m the last hash value according to the last message 202-m.

[0049] In this example, the first message 202-1 and the last message 202-n are received. If the first message 202-1 and / or the last message 202-n are not received, the hash values of each received message are determined.

[0050] If all n messages are received, m = n hash values are determined. If not all messages are received, that is, m < n messages are received, the hash values of the received messages are determined.

[0051] A reception confirmation is sent for the received messages. In this example, after receiving the corresponding messages 202-1,......, 202-m-1, 202-m, reception confirmations 204-1,......, 204-m-1, 204-m are sent.

[0052] In step 205, a message authentication code is determined according to the last hash value.

[0053] In step 208, the first transmission device 108 determines a reference message authentication code, particularly a Message Authentication Code. In this example, the reference message authentication code is determined according to the sent messages for which reception confirmations have been received.

[0054] The first transmission device 108 determines hash values in a recursive and iterative manner. Exemplarily shown: determining 206-1 the first hash value according to the first sent message 202-1, determining 206-m-1 the penultimate hash value according to the penultimate sent message 202-n-1, and determining 206-m the last hash value according to the last sent message 202-n.

[0055] In this example, the first sent message 202-1, the penultimate sent message 202-n-1, and the last sent message 202-n are received. If the first sent message 202-1 and / or the penultimate sent message 202-n-1 and / or the last sent message 202-n are not received, the hash value of each received sent message is determined.

[0056] If all n sent messages are received, m = n hash values are determined. If not all sent messages are received, i.e., m < n messages are received, the hash values of the received sent messages (i.e., for which a receipt confirmation has been received) are determined.

[0057] A reference message authentication code is determined based on at least two of the plurality of messages. In this example, the last hash value is used to determine the reference message authentication code.

[0058] If all n sent messages are received, the reference message authentication code is determined based on the m = n hash values. If not all sent messages are received, i.e., m < n messages are received, the reference message authentication code is determined based on the hash values of the received sent messages.

[0059] If not all sent messages are received, the reference message authentication code is determined independently of at least one of the messages for which no receipt confirmation has been received among the plurality of messages.

[0060] In step 210, the reference message authentication code is sent. For example, a message including the reference message authentication code is determined. In one example, the reference message authentication code is sent in the message. In one example, the segmented reference message authentication code is sent in a message from the next segment.

[0061] In step 212, the second transmission device 110 checks whether the reference message authentication code matches the message authentication code.

[0062] If they are different, in one example a response is triggered in step 214.

[0063] In step 218, the second transmission device 110 sends a status message for the message, and the first transmission device 108 receives the status message.

[0064] For example, in step 220, a message including an instruction to trigger a response is determined. In one example, the instruction is sent in message 222. In one example, the instruction for the segment is sent in a message from the next segment.

[0065] In one example, when the instruction to trigger a response is received, a response is triggered in step 224.

[0066] It can be stipulated that the second transmission device 110 checks whether a message including a reference message authentication code is received. It can be stipulated that when the message is received, the message authentication code is determined based on a pre-given number of messages received before this message. In this example, the pre-given number is the number of messages sent in this segment. For example, if this segment includes n = 8 messages, the message authentication code is determined based on the pre-given number m = 8 messages.

[0067] It can be stipulated that other segments also follow the method described for this segment.

[0068] To ensure the integrity of multiple messages using only one MAC, for example, a hash value formed by multiple messages is used, and this hash value serves as a kind of fingerprint for this message sequence.

[0069] This fingerprint is used to calculate and verify the MAC. To ensure that the receiving party also correctly calculates the hash value, in this example, only m successfully transmitted messages are included in the calculation of the hash value.

[0070] In this example, the hash value is iteratively calculated after each send / receive process, so there is no need to buffer multiple messages.

[0071] In one example, the calculated MAC value is immediately transmitted to the second device 104, that is, the receiving party control device, after its calculation. Since the second device has no way of knowing how many messages are mis-transmitted, in one example, the second device interprets the received MAC as the end of the message sequence consisting of m messages. In one example, the second device 104 calculates the hash value of these m messages and then verifies the MAC. Messages received after the MAC is received will be interpreted as part of a new message sequence. This implementation is particularly advantageous because it can thus dispense with transmitting an additional message counter.

[0072] Figure 3 An example of a segment for transmitting messages is shown.

[0073] Eight messages #1.1, #1.2, #1.3, ……, #1.8 are arranged in the first segment 302. Eight messages #2.1, #2.2, #2.3, ……, #2.8 are arranged in the second segment 304. Eight messages #3.1, #3.2, #3.3, …… are arranged in the third segment 306.

[0074] The first reference message authentication code 308 of the first segment 302 is a MAC with 128 bits in this example and is sent in the first message #2.1 of the second segment 304. The second reference message authentication code 310 of the second segment 304 is a MAC with 128 bits in this example and is sent in the first message #3.1 of the third segment 306. In one example, if an acknowledgment of receipt of the first message #2.1 of the second segment 304 is obtained, the first reference message authentication code 308 is not resent. In one example, if an acknowledgment of receipt of the first message #2.1 of the second segment 304 is not obtained, the first reference message authentication code 308 is resent. In this example, it is shown that the first reference message authentication code 310 is resent in the second message #3.2 of the third segment 306.

[0075] It may be stipulated to identify whether the reference message authentication code of a certain segment fails multiple times. In this case, alternative measures may be stipulated. For example, if it is identified that although the reference message authentication code has been sent multiple times, an acknowledgment of receipt of one of the messages including the reference message authentication code has not been obtained, the device 102 for sending messages takes alternative measures. For example, if it is identified that although a pre-given waiting time has elapsed, a message including the reference message authentication code has not been received, the device 104 for receiving messages takes alternative measures.

Claims

1. A method for sending messages, characterized in that, send (202-1, 202-n) multiple messages, wherein a reference message authentication code, in particular a Message Authentication Code, is determined (208) based on at least two messages among the multiple messages that receive (204-1, 204-m) a reception confirmation, and wherein the reference message authentication code is sent (210).

2. The method according to claim 1, characterized in that, based on the penultimate message among the multiple messages, a penultimate hash value is determined (206-m-1, 206-m) using a hash function, wherein based on the last message among the multiple messages and the penultimate hash value, the last hash value is determined (206-m) using the hash function, and the reference message authentication code is determined (208) based on the last hash value.

3. The method according to any one of the preceding claims, characterized in that, the reference message authentication code is determined independently of at least one message among the multiple messages that does not receive a reception confirmation.

4. The method according to any one of the preceding claims, characterized in that, send (222) an instruction to trigger a response.

5. The method according to any one of the preceding claims, characterized in that, determine a message including the reference message authentication code, and wherein this message is transmitted (210) at least once, in particular until a reception confirmation of this message is received for the first time.

6. A first transmission device (108), characterized in that, the first transmission device (108) is configured to execute the method according to any one of claims 1 to 5.

7. A first device (102), in particular a steering controller or a control device, characterized in that, the first device (102) includes a first transmission device (108) configured to execute the method according to any one of claims 1 to 5.

8. A method for receiving messages, characterized in that, receive (202-1,......, 202-m) multiple messages, wherein a message authentication code, in particular a Message Authentication Code, is determined (205) based on the messages among the multiple messages.

9. The method according to claim 8, characterized in that, based on the penultimate message among the multiple messages, a penultimate hash value is determined (203-m-1) using a hash function, wherein based on the last message among the multiple messages and the penultimate hash value, the last hash value is determined (203-m) using the hash function, and the message authentication code is determined (205) based on the last hash value.

10. The method according to any one of claims 8 or 9, characterized in that, receive (210) a reference message authentication code, check (212) whether the message authentication code is consistent with the reference message authentication code, and wherein if the message authentication code is different from the reference message authentication code, a response is triggered (214).

11. The method according to any one of claims 8 to 10, Characterized in that Receive (222) an instruction to trigger a response and trigger (224) the response.

12. The method according to any one of claims 8 to 11, Characterized in that Check whether a message including the reference message authentication code is received (202-1,......, 202-m), wherein the message authentication code is determined (205) according to a pre-given number of messages received before this message.

13. A second transmission device (110), Characterized in that The second transmission device (110) is configured to execute the method according to any one of claims 8 to 12.

14. A second device (104), in particular a steering actuator, Characterized in that The second device (104) includes a second transmission device (110) configured to execute the method according to any one of claims 8 to 12.

15. A vehicle (100), Characterized in that The vehicle includes a first transmission device (110) according to claim 6 and a second transmission device (108) according to claim 13, and a data bus (106) for transmitting messages, the data bus connecting the transmission devices (108, 110).

16. A vehicle (100), Characterized in that The vehicle (100) includes a first device (102) according to claim 7 and a second device (104) according to claim 13, and a data bus (106) for transmitting messages, the data bus connecting the devices (102, 104).

Images