Sensor and vehicle

Abstract

The invention relates to a sensor (1) for a vehicle, in particular a commercial vehicle, comprising: a housing (11); a measurement interface (2) which is designed to detect a measurement variable of the vehicle and to generate raw measurement data (3) describing the measurement variable; and a processing device (4) which is designed to process the raw measurement data (3) into measurement data (5), the sensor (1) having at least one protection against unauthorized access. In addition, a vehicle is disclosed.

Description

Technical Field

[0001] The invention relates to a sensor for detecting a measured variable of a vehicle. The invention also relates to a vehicle. Background Art

[0002] The progressive digitalization of vehicles offers various advantages. Most importantly, safety features such as electronic stability control and brake control have become possible. Existing functions such as fluid level control and oil level measurement have also been simplified. To enable the retrofitting of these functions in existing vehicles, for example, to correct software errors or simply install new software states, it is necessary to open the vehicle's software and / or hardware architecture to the outside world via appropriately designed interfaces for proper access.

[0003] However, these interfaces and data lines (not intended as interfaces, but rather connected wirelessly or via subsequent welding, for example) allow access and thus also create the possibility of unauthorized access to digital vehicle systems or at least their subsystems (such as electronic stability control, brake control or other functions mentioned above). Measures to increase the threshold for such unauthorized access are hereinafter referred to as "measures to increase cybersecurity", where the term "cybersecurity" describes the threshold for such unauthorized access.

[0004] Cybersecurity legislation already takes their growth into account. For example, there are regulations targeting the security of vehicles against cyberattacks (e.g., UNECE R 155) and regulations describing the requirements for software updates in vehicle ECUs (UNECE R 156). The latter regulation, in particular, requires vehicle manufacturers to provide a Software Update Management System (SUMS). SUMS is intended to ensure that updates to software functions relevant for type approval (e.g., exhaust, brakes, engine control) are developed and validated so that they continue to function legally after the update. UNECE R 156 also requires that such updates be "safe and secure" without requiring further implementation. The term "safe" refers to protection against malfunctions (errors) in the software itself. The term "secure" refers to the tamper-resistance of the update process. For example, update mechanisms are designed to prevent the installation of malware and software tweaks, both of which constitute unauthorized access. Summary of the Invention

[0005] Therefore, the object of the present invention is to specify measures for increasing network security, in particular in sensors.

[0006] This object is achieved by the subject matter of the independent claim. Advantageous developments are the subject matter of the dependent claims.

[0007] The present invention provides a sensor for a vehicle, in particular a commercial vehicle. The sensor comprises the following elements:

[0008] -case;

[0009] a measurement interface, which is designed to detect a measured variable of the vehicle and to generate raw measurement data describing the measured variable;

[0010] A processing device is designed to process the raw measurement data into measurement data.

[0011] Preferably, the sensor further comprises the following elements:

[0012] a data interface, which is designed for data exchange between the sensor and other transmitters or receivers and is connected to the processing device for data exchange;

[0013] a memory section which is designed to store at least one cryptographic key and to make it available only to the processing device, wherein

[0014] The processing device is configured to use the at least one key to encrypt, decrypt or authenticate data sent or received via the data interface, wherein:

[0015] The memory segment is designed as a hardware security module or is designed in a hardware security module.

[0016] The advantage of providing at least one key in the hardware security module configured as a memory segment is that the at least one key is protected against unauthorized access. The at least one key can prevent sensor data, such as measurement data, raw measurement data, or software, from being read or altered without authorization without a corresponding counterpart.

[0017] The hardware security module can be implemented in particular by means of SHE (Secure Hardware Extension) or by means of Evita light, medium or full Standard.

[0018] The hardware security module makes it possible to implement an encryption function for data exchange, which takes place in particular via a data interface of the sensor.

[0019] The memory section can be designed as a memory that is structurally separate from the processing device. As a result, the memory section can be relatively freely accommodated in the housing of the sensor.

[0020] Alternatively, it can be provided that the memory section and the processing device are constructed as a single unit. This provides a complete module that can be easily installed in the sensor housing. The processing device can be constructed at least partially, preferably completely, as part of a hardware security module. This protects the primary functions of the sensor, which are implemented using the processing device.

[0021] Preferably, the data received via the data interface is application data or program code, or the data contains application data or program code. In this way, the sensor can be updated. The processing device is preferably configured to verify the data received via the data interface. To this end, the data preferably contains a cryptographic key, a hash value, or a cryptographic signature. These can be compared by the processing device with cryptographic keys, hash values, or cryptographic signatures stored in the memory segment. If the comparison indicates that the key, hash value, or cryptographic signature of the data is as expected by the processing device, the processing device assesses the received data as correct and authentic and takes appropriate action, such as applying or adopting the application data or updating the sensor software.

[0022] Preferably, the data transmitted via the data interface is measurement data or status information of the sensor, or the data contains measurement data or status information. The sensor, preferably the processing device, is configured to provide the transmitted data with a cryptographic key, a hash value, or a cryptographic signature from the hardware security module, in particular from a memory section, so that other receivers can themselves perform a corresponding comparison of the keys to ensure that the sensor can be trusted as a data source and that the transmitted data is correct.

[0023] This can be achieved within the scope of Secure Onboard Communication (SecOC), which allows sensors to communicate securely with other receivers.

[0024] Preferably, the at least one key is associated with the sensor's identification and / or with its manufacturer-specific identification and / or with its user-specific identification. This allows a correspondingly configured system (as described further below) to check whether the sensor is the one intended or intended for the system. This allows for the detection of inappropriate copies or impermissible configurations of the sensor. It can then be provided that the system no longer uses the sensor. Further measures suitable for the corresponding system are explained below.

[0025] Alternatively or additionally, within the scope of a method for checking the permissibility of a combination of such a system for a vehicle with such a sensor, it is also possible to check whether the sensor is the desired or intended sensor for the system. This method will be explained in more detail below. In this way, a corresponding check can be performed during or before the installation of the sensor and system. This check can thus be performed at an early stage in the manufacturing process, for example, during the supply run of the system and sensor combination, which is being manufactured or assembled. For this purpose, for example, the ordering party, such as the vehicle manufacturer, or the delivery party can provide the supplier with the necessary keys and other information.

[0026] Preferably, the sensor's identification is a part number and / or serial number and / or vehicle identification number and / or electronic control unit identification number (ECU ID) and / or manufacturer's name. These identifications are uniquely assigned to the sensor by the manufacturer during production or later during vehicle manufacturing or assembly. These numbers allow the identification of permitted sensors, or, alternatively, errors in these numbers can be used to identify impermissible sensors. In particular, sensors can be assigned to specific vehicles or specific systems, such as braking systems or driving dynamics control systems.

[0027] Preferably, the memory segment is designed to store program parts of the processing device and / or raw measurement data and / or measurement data in a memory segment that is authorized using at least one key. In this way, such information can be protected and cannot be used without the corresponding cryptographic key. Unauthorized access is thus prevented.

[0028] Preferably, the sensor, in particular the processing device, is designed to check the authenticity of its transmitter, which is provided with a cryptographic key and receives data via an interface, or checks communications to the sensor received via an interface. Preferably, the sensor, in particular the processing device, is further designed to output a message via the interface, to deactivate itself, to deactivate a system in which the sensor is located, or to place itself in a secure state if a transmission source, received data, or communications to the sensor is classified as untrustworthy. This prevents the sensor, in particular the processing device, from using unwanted application data or unwanted program code.

[0029] Below, we describe the possibility of structurally protecting the sensor from unwanted or unauthorized external access, in particular from unwanted wireless external access. This can be done in conjunction with the above-described embodiments of the sensor or independently thereof. The following sensor is to be understood as a common element of the above-described and following sensors, which have already been described introductory above.

[0030] A sensor for a vehicle is disclosed. The sensor has the following elements:

[0031] -case;

[0032] a measurement interface designed to detect a measured variable of the vehicle and to generate raw measurement data describing the measured variable;

[0033] A processing device is designed to process the raw measurement data into measurement data.

[0034] The sensor is preferably protected, in particular structurally protected, against unauthorized access.

[0035] The sensor preferably has at least one protective measure against unauthorized access, in particular a structural protective measure.

[0036] Preferably, at least one subarea or the entire sensor is structurally shielded against wireless access, in particular unauthorized wireless access. To this end, at least one subarea or the entire sensor includes a shield against wireless access as a structural protective measure. Wireless access can be understood as inductive, capacitive, and / or optical access. Advantageously, a corresponding shield is provided so that the electromagnetic field generated by the current in the sensor is shielded from the outside, thereby preventing external access to the data within the sensor. It is also advantageous if the shield prevents external access via the electromagnetic field. In this way, unauthorized access to the data within the sensor and tampering with it can be avoided. The shield against optical access can, in particular, relate to a measuring interface that can be configured for optically detecting a measured variable. In this way, distortion of the detection of the measured variable due to light or radiation can be prevented by appropriately positioned shielding elements. Damage to light-sensitive sensor components such as chips, semiconductors, resistors, or diodes can also be prevented by the corresponding shield.

[0037] Preferably, the shielding of the partial areas is achieved by shielding elements, which are arranged within the housing of the sensor or in or on one or more walls of the housing. These shielding elements can be made of a special alloy that effectively shields electromagnetic fields. Preferably, the shielding elements are arranged so that the area where the corresponding wireless coupling element can be attached is completely or at least partially and to a sufficient extent shielded. If the housing is made of plastic, the shielding elements can be injection-molded into the plastic material of the housing. If the shielding elements are attached to the walls of the housing (inner or outer wall), this can be achieved in particular by gluing, plugging, or clamping. Alternatively, the housing of the sensor can be formed by the shielding elements. This can achieve complete shielding on all sides. If the shielding elements are arranged within the housing, they can preferably form an enclosure for the partial areas, so that a housing (encapsulation) is particularly preferably present within the housing.

[0038] Alternatively or additionally, it can be provided that the shielding of a subregion is achieved by a multi-layer structure of the sensor, and that the subregion to be shielded is shielded by layers of other sensor components arranged above the subregion or by correspondingly arranged shielding elements. In particular, it can be provided that the sensor in the housing has a multi-layer PCB structure (printed circuit board structure). In this case, specific lines or components to be shielded, such as communication lines or debugging circuits, can be shielded by other components printed above them or arranged above them and insulated therefrom, such as power supply lines.

[0039] A layered structure consisting of multiple circuit boards can also be provided. In this case, the circuit boards to be shielded can be arranged so that they are covered by other circuit boards relative to the nearest housing wall. Shielding elements, preferably plate-shaped shielding elements, can also be incorporated into this layered structure.

[0040] Preferably, the sensor is configured, in particular as a structural safeguard, to deactivate itself if the housing is opened without authorization. This can be achieved in a non-destructive manner, so that the sensor can be used again when it is reactivated, for example, using one or more cryptographic keys provided for this purpose. However, it is also possible for the sensor to permanently deactivate itself by self-destruction. This can be achieved, for example, by deliberately overloading the sensor circuit. The opening of the housing can be detected by a detection device on the housing, such as a sensor, which outputs a signal once the housing is opened. It can be provided that the housing is allowed to be opened when a corresponding release signal is received by the sensor via a data interface. This can in turn be verified using a key stored in a memory section. The detection device is preferably disposed on the housing and is configured to detect the opening of the housing. The sensor can be configured to output a corresponding signal, for example, via an interface of the detection device, to a processing device or another receiver external to the sensor when the housing is opened.

[0041] The sensor is preferably an angle sensor, and the measured variable detected via the measurement interface is a measured variable that describes the rotational movement of a rotatably arranged element. The rotatably arranged element can be, in particular, a steering column or an element of a vehicle steering system, from whose rotational movement the steering angle can be determined. In this case, the sensor is designed as a steering angle sensor.

[0042] Preferably, the sensor is a roll rate sensor. Preferably, the measured variable detected via the measurement interface is the yaw rate of the vehicle on which the sensor is provided. In this case, the sensor is designed as a yaw rate sensor. Alternatively or additionally, it can also be provided that the measured variable detected via the measurement interface is the pitch rate and / or roll rate of the vehicle.

[0043] Preferably, the sensor is an acceleration sensor, wherein the measured variable detected via the measurement interface is the acceleration of the vehicle on which the sensor is provided. The acceleration sensor can be uniaxial or multiaxial, so that it can detect acceleration in only one axis (the longitudinal axis, the transverse axis, or the vertical axis of the vehicle) or in several or all three axes.

[0044] Preferably, the sensor is configured as a combination of the above-mentioned rotation rate sensor and the above-mentioned acceleration sensor. In particular, the sensor can be configured to detect yaw rate, pitch rate and roll rate and to detect acceleration in all three axis directions.

[0045] The sensor is preferably a pressure sensor, wherein the measured variable detected via the measuring interface is pressure. The sensor may be, in particular, a brake pressure sensor. This allows for reliable detection of the brake pressure in fluidically actuated brakes, such as pneumatic or hydraulic brakes.

[0046] The sensor is preferably a force sensor, wherein the measured variable detected via the measurement interface is force. The sensor can, in particular, be a braking force sensor. This allows reliable detection of the braking force in fluidically actuated brakes, such as pneumatic or hydraulic brakes, as well as in electromechanically actuated brakes. The detected force can, in particular, be the clamping force of a friction brake.

[0047] Preferably, the sensor is a rotational speed sensor, wherein the measured variable detected via the measurement interface is the rotational speed. This can be the wheel speed or the motor speed. In particular, it can be an active rotational speed sensor.

[0048] The sensor is preferably a position sensor, wherein the measured variable detected via the measurement interface is, in particular, the position of a movable element. The movable element is, for example, a shift element of a transmission or an actuating element for actuating a clutch. In this way, the shift position or clutch position in the transmission device can be reliably detected.

[0049] Preferably, the sensor is a level sensor, wherein the measured variable detected via the measuring interface is the levelness of the vehicle body of the vehicle on which the sensor is provided. This makes it possible to improve the safety of leveling such a vehicle.

[0050] Preferably, the sensor is an oil level sensor, wherein the measured variable detected via the measuring interface is the oil level. This may be the oil level of an electrically driven compressor.

[0051] The sensor is preferably configured to detect whether an unauthorized data connection to the sensor has been established or is being established. This can be verified by using a cryptographic key from a memory section or by using a hash value or cryptographic signature generated by the processing device. The sensor is preferably configured to deactivate itself, place itself in a secure state, or interrupt the data connection if an unauthorized data connection is detected. The data connection can be based on CAN.

[0052] The present invention discloses a system for a vehicle, in particular a commercial vehicle, in particular a control system, a regulating system, or a monitoring system, comprising a sensor as described above. The system is configured to determine whether the sensor is permitted for use in the system by comparing at least one cryptographic key of the sensor with at least one cryptographic key of the system.

[0053] Preferably, the system is further designed to deactivate the sensor, output a message, or deactivate the system or transfer it to a safe state if an inadmissible sensor is detected by the system.

[0054] In this way, the use of sensors in the system that are not permitted for the system is prevented.

[0055] The system is preferably designed as a steering control system, for example, with a sensor designed as an angle sensor. Alternatively, the system can be designed as a driving dynamics control system, for example, with a sensor designed as an angle sensor, a rotation rate sensor, an acceleration sensor, a pressure sensor, a force sensor, and / or a rotation speed sensor. Alternatively, the system can be designed as a level control system, for example, with a sensor designed as a level sensor.

[0056] A vehicle, in particular a commercial vehicle, is disclosed, which has a sensor as described above or a system as described above.

[0057] A method for checking the permissibility of a system, in particular a combination of a control system, a regulating system or a monitoring system, for a vehicle having the aforementioned sensor is disclosed, wherein the method comprises the following steps:

[0058] - providing the system, in particular the above-mentioned system, wherein the system has a cryptographic key;

[0059] - providing a sensor as described above;

[0060] - comparing at least one cryptographic key of the sensor with at least one cryptographic key of the system;

[0061] If it is determined by the comparison that the sensor is authorized for use in the system, the system having the sensor is released.

[0062] In this way, when assembling the system and the sensor for the first time, it is possible to determine whether a sensor that has been allowed for the system has been used. Even afterwards, when replacing the sensor due to maintenance work or repair work, such an inspection can also be carried out. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings.

[0064] Figure 1 A sensor according to a first embodiment is shown.

[0065] Figure 2 A sensor according to a second embodiment is shown. DETAILED DESCRIPTION

[0066] Figure 1A sensor 1 according to a first embodiment is shown.

[0067] A sensor 1 for a vehicle is shown. The sensor 1 has the following elements:

[0068] - housing 11;

[0069] a measurement interface 2 , which is designed to detect a measured variable of the vehicle and to generate raw measurement data 3 describing the measured variable;

[0070] a processing device 4 designed to process the raw measurement data 3 into measurement data 5;

[0071] a data interface 6 , which is designed for data exchange between the sensor 1 and other transmitters or receivers and is connected to the processing device 4 for data exchange;

[0072] a memory section 7 which is designed to store at least one cryptographic key and to make it available exclusively to the processing device 4 , wherein

[0073] The processing device 4 is designed to use at least one key for encrypting, decrypting or authenticating data sent or received via the data interface 6 , wherein:

[0074] The memory section 7 is designed as a hardware security module or is designed in a hardware security module.

[0075] The key can be sent to the processing device 4 via the data connection 8 shown.

[0076] Measuring interface 2 has a detection device 2.1, which is designed to detect raw measurement data 3. Detection device 2.1 can be designed, in particular, to detect acceleration, rotational speed, pressure, force, or oil level. If a corresponding counterpart 2.2 is present, which can, for example, perform a relative movement (rotational or translational) relative to detection device 2.1, detection device 2.1 can be designed to detect rotational movements, such as in the case of level changes or when detecting the position of a moving element, or angles or displacements.

[0077] Figure 2 A sensor 1 according to a second embodiment is shown.

[0078] A sensor 1 is shown, in particular a sensor for detecting the steering angle of a vehicle. The sensor 1 has the following elements:

[0079] - housing 11;

[0080] a measuring interface 2 , which is designed to detect a rotational movement of a rotatably arranged element 10 of the vehicle and to generate raw measurement data 3 describing the rotational movement;

[0081] A processing device 4 is designed to process the raw measurement data 3 into measurement data 5 .

[0082] The rotatably arranged element 10 is configured as a steering column of a vehicle. The steering column is arranged to be rotatable about a vertical imaginary axis.

[0083] Measuring interface 2 comprises a detection device 2.1 and a counterpart 2.2, wherein counterpart 2.2 is connected to element 10 and performs a rotational movement. This rotational movement is detected by detection device 2.1 and transmitted to processing device 4 as raw measurement data 3. The depiction of measuring interface 2 is merely exemplary. Further configurations are possible. For example, measuring interface 2 may comprise an annular element, which is arranged coaxially with the axis of element 10 and fixedly fixed relative to the axis, wherein its rotational movement is detected by detection device 2.1.

[0084] Furthermore, the sensor 1 has the following elements:

[0085] a data interface 6 , which is designed for data exchange between the sensor 1 and other transmitters or receivers and is connected to the processing device 4 for data exchange;

[0086] a memory section 7 which is designed to store at least one cryptographic key and to make it available exclusively to the processing device 4 , wherein

[0087] The processing device 4 is designed to use the at least one key to encrypt, decrypt or authenticate data sent or received via the data interface 6 , wherein:

[0088] The memory section 7 is designed as a hardware security module or is designed in a hardware security module.

[0089] The following description applies to Figure 1 and Figure 2 The embodiment shown.

[0090] The memory section 7 is arranged here separately from the processing device 4 in a sub-area 9 which has the aforementioned shielding against wireless access (not shown).

[0091] The data interface 6 has a receiving section 6 . 1 , via which application data or program code can be sent to the sensor 1 , so that in particular the processing device 4 can be updated and maintained.

[0092] The data interface 6 has a measurement data section 6 . 2 , via which measurement data 5 and status information of the sensor 1 can be transmitted.

[0093] Memory section 7 enables secure storage of at least one cryptographic key, which is additionally shielded from wireless access from outside in subregion 9 of housing 11. This subregion can have a correspondingly configured alloy in or on the wall of housing 11.

[0094] According to another exemplary embodiment (not shown), processing device 4 is partially, preferably completely, arranged in subregion 9 of housing 11 in order to protect the main functions of sensor 1 that are implemented by processing device 4 .

[0095] Figure 1 and Figure 2 The sensor shown in FIG can be configured as a protective measure against unauthorized access, such that, as described above, it deactivates itself upon unauthorized opening of housing 11. This can be done in a non-destructive manner, allowing sensor 1 to be used again upon reactivation, for example, using one or more cryptographic keys provided for this purpose. However, it is also possible to provide for sensor 1 to permanently deactivate itself by self-destruction. This can be achieved, for example, by deliberately overloading the circuitry of sensor 1.

[0096] Reference Signs List

[0097] 1 sensor

[0098] 2 measurement interfaces

[0099] 2.1 Detection device

[0100] 2.2 Mating parts

[0101] 3 Original measurement data

[0102] 4 Processing device

[0103] 5 Measurement data

[0104] 6 data interface

[0105] 6.1 Receiving Section

[0106] 6.2 Measurement Data Section

[0107] 7 memory segments

[0108] 8 data connections

[0109] 9 sub-areas

[0110] 10 Rotatably arranged element

[0111] 11 Shell

Claims

1. A sensor (1) for a vehicle, in particular a commercial vehicle, comprising: - housing (11); a measuring interface (2) designed to detect a measured variable of the vehicle and to generate raw measurement data (3) describing the measured variable; a processing device (4) designed to process the raw measurement data (3) into measurement data (5), wherein: The sensor (1) has at least one protection measure against unauthorized access.

2. The sensor (1) according to claim 1, wherein At least one sub-region (9) or the entire sensor (1) has a shield against wireless access as a structural protective measure.

3. The sensor (1) according to claim 2, wherein The shielding of the sub-region (9) is achieved by a shielding element, which is arranged in the housing of the sensor (1) or in or on one or more walls of the housing (11), or wherein the housing of the sensor (1) is formed by the shielding element.

4. The sensor (1) according to claim 2 or 3, wherein The shielding of the sub-region (9) is achieved by a multi-layer structure of the sensor (1), and the sub-region (9) to be shielded is shielded by a layer of other components of the sensor (1) arranged above the sub-region or by a correspondingly arranged shielding element.

5. The sensor (1) according to one of the preceding claims, wherein The sensor (1) is configured to deactivate itself when the housing (11) is opened without authorization.

6. The sensor (1) according to claim 5, wherein The sensor (1) is configured to deactivate itself in a non-destructive manner if the housing (11) is opened without authorization.

7. The sensor (1) according to claim 6, wherein The sensor (1) is designed to be reactivated after deactivation by means of one or more cryptographic keys (8) provided for this purpose.

8. The sensor (1) according to claim 5, wherein The sensor (1) is designed to permanently deactivate itself by destruction if the housing (11) is opened without authorization.

9. The sensor (1) according to claim 8, wherein The sensor (1) is designed to achieve the destruction by targeted overloading of an electrical circuit of the sensor (1).

10. The sensor (1) according to claim 5, wherein: A detection device is provided on the housing (11), and is configured to detect opening of the housing (11).

11. The sensor (1) according to claim 1, wherein The sensor (1) is designed as a protective measure to detect whether an unauthorized data connection to the sensor (1) has been established or is being established.

12. The sensor (1) according to claim 1, wherein The sensor (1) is an angle sensor, and the measured variable detected via the measuring interface (2) is a measured variable describing the rotational movement of a rotatably arranged element (10), wherein the rotatably arranged element (10) is in particular a steering column or an element of a vehicle steering system, from whose rotational movement the steering angle can be determined, or wherein The sensor (1) is a rotation rate sensor, wherein the measured variable detected via the measurement interface (2) is in particular the yaw rate, pitch rate and / or roll rate of the vehicle on which the sensor (1) is provided, or wherein The sensor (1) is an acceleration sensor, wherein the measurement variable detected via the measurement interface (2) is acceleration, or wherein: The sensor (1) is a pressure sensor, wherein the measured variable detected via the measuring interface (2) is pressure, or wherein: The sensor (1) is a force sensor, wherein the measured variable detected via the measuring interface (2) is a force, or wherein: The sensor (1) is a rotational speed sensor, wherein the measured variable detected via the measuring interface (2) is the rotational speed, or wherein: The sensor (1) is a position sensor, wherein the measured variable detected via the measuring interface (2) is in particular the position of a displaceable element, or wherein The sensor (1) is a level sensor, wherein the measurement variable detected via the measuring interface (2) is the levelness of the vehicle body of the vehicle on which the sensor (1) is provided, or wherein The sensor (1) is an oil level sensor, wherein the measured variable detected via the measuring interface (2) is the oil level.

13. A vehicle, in particular a passenger car, comprising a sensor (1) according to one of claims 1 to 12.

Images