Communication and identification between a vehicle user device with head unit and a remotely located device

Abstract

Method for performing secure communication between a user device with a head unit (2,3,4,5) of a motor vehicle and a remote device (6) via a publicly accessible network using digital certificates, comprising the steps: - Generating (a) a non-specific certificate by the remote device (6) and sending (b) the non-specific certificate to the head unit (2,3,4,5), - Receiving (c) and storing (d) the non-specific certificate on the head unit (2,3,4,5), - Establishing (e) an initial connection from the head unit (2,3,4,5) to the device (6) using (e') the non-specific certificate as an identifier, - Accept (f) the initial connection by the device (6) if the identifier is the non-specific certificate, otherwise abort (f') the initial connection, - from the device (6) requesting (g) vehicle identification information from the head unit (2,3,4,5) of the motor vehicle, - from Head Unit (2,3,4,5) return (h) the identification information to the device (6), - by the device generating (i) a specific certificate using the identification information and sending (j) the specific certificate to the head unit (2,3,4,5), - Receiving (k) and storing (I) the specific certificate by the head unit (2,3,4,5), - Establishing (m) a working connection from the head unit (2,3,4,5) to the device (6) and storing (n) the specific certificate as an identifier on the device (6) so that it identifies the head unit (2,3,4,5).

Description

[0001] The invention relates to a method for carrying out secure communication between a user device with a head unit of a motor vehicle and a device located remotely therefrom via a publicly accessible network using digital certificates, as well as a corresponding communication system and a computer program for carrying out the method and a corresponding computer program product.

[0002] A secure communication method, such as the one of interest here, is used, for example, when connecting a vehicle to the internet and an information processing system via a secure communication link. Such methods are particularly well-known in server-based information processing systems, often referred to as backend IT systems: The user device in the vehicle includes the "head unit," which, as the main unit on the motherboard, contains RAM and a processor, similar to a personal computer. Additional components for audio processing, MP3 decoding, and graphics, as well as a GPS receiver for navigation, may also be included in the head unit. Furthermore, a head unit includes a device for establishing a connection between the vehicle and a specific backend IT system via the secure communication link.

[0003] The functions of a head unit can be divided into the areas of entertainment, navigation, vehicle settings, and communication. The communication function, via an internet connection, can also support the other functions, such as internet radio reception and the integration of traffic information into the navigation system. It is also conceivable that it could be used to communicate with a repair shop in the event of vehicle error messages.

[0004] To uniquely identify and authenticate the head unit to the backend IT system, individual certificates are required for each vehicle or head unit. Head units are typically manufactured by automotive manufacturers' suppliers. After production, they do not have individual certificates, as generating and uploading individual, vehicle-specific certificates to the head units during production at the supplier is a complex and costly process. Furthermore, ensuring adequate data security proves challenging.

[0005] Therefore, individual certificates are currently generated by the car manufacturer as part of the car production process and stored in the head unit, which incurs additional costs.

[0006] US patent 2008 / 0235509 A1 discloses a method for exchanging messages between nodes in an ad-hoc network. Furthermore, US patent 2004 / 0185824 A1 discloses a method for controlling the use of proprietary resources assigned to a vehicle.

[0007] EP 1 494 428 B1 discloses a method for conducting secure communication between a mobile device capable of accessing the internet and a communication network. The communication includes, in particular, access to a remotely located server using known digital certificates. This method requires user action, such as input from the user on the mobile device, to establish the secure connection. This method is therefore time-consuming and complex, since if the system were transferred to a vehicle for internet access, a delay for input would have to be factored in before each start-up.

[0008] Based on this state of the art, it is desirable to enable vehicle users to connect their vehicles to the internet without requiring any input from the vehicle user. After the vehicle is started, the internet connection should be established automatically and without further user input.

[0009] This problem is solved by an improved method for performing secure communication between a user device and a remotely located device with the features of claim 1. Further developments are described in the dependent claims.

[0010] A further object of the present invention is to provide the system for communication between a user device and a remotely located device, as well as the corresponding identification.

[0011] The task of creating an improved communication system for secure communication over a publicly accessible network between a user device and a remote device, wherein the remote device identifies the head unit, is solved by the features of claim 7.

[0012] A first embodiment of the method according to the invention enables secure communication between a user device with a motor vehicle's head unit and a remote device via a publicly accessible network using digital certificates and, particularly advantageously, with the remote device identifying the head unit. For this purpose, a non-specific certificate is created by the remote device, hereinafter referred to as the "device," which is sent to, received by, and stored by the head unit. This allows an initial connection to be established between the head unit and the device, using the non-specific certificate as the identifier.The device accepts the initial connection if the identifier is the desired "correct" non-specific certificate; otherwise, the initial connection is aborted or terminated, thus advantageously preventing unauthenticated connections.

[0013] The device now requests vehicle identification information from the head unit, including specific details such as the vehicle identification number (VIN). The head unit sends this identification information back to the device, which then generates a specific certificate using this information and sends it to the head unit. The head unit receives and stores this certificate, enabling the desired working connection between the head unit and the device. This specific certificate is stored as an identifier on the device, ensuring a clear association between the vehicle, the user device connected to the head unit, and the remote device.

[0014] The so-called remote device could be a backend IT system.

[0015] Once the head unit receives the specific work certificate, it is stored there and used from that point on to establish a connection to the backend IT system. Advantageously, no user action is required for this. Furthermore, the specific work certificate is not stored on the user device's head unit during its production.

[0016] According to an advantageous embodiment of the method, the non-specific initialization certificate is stored in the head unit during its manufacture for the user device. Since the same non-specific initialization certificate can be used for a large number of devices, the additional effort required for manufacturing the head units is minimal.

[0017] To enhance security, the identification information sent by the head unit can be checked in a remote device, such as the backend IT system. The backend IT system compares the received identification information with a list of identification information previously created by the vehicle manufacturer within the backend IT system. The specific certificate is only generated in the backend IT system if a match is found between the received identification information and an entry in the stored list.

[0018] The method according to the invention can be carried out with the communication system according to the invention, which in a first embodiment comprises a user device of a motor vehicle equipped with a head unit comprising at least one processor, and which further comprises a device located remotely from the motor vehicle. Communication takes place via a publicly accessible network, and the head unit and the remote device each have at least one receiving device, at least one storage device, and at least one transmitting device.Furthermore, the remotely located device advantageously has a device for generating digital certificates, so that a non-specific certificate can be generated as an identifier for an initial connection, and so that a specific certificate can be created which advantageously supports the realization of the authenticated working connection.

[0019] The receiving device of the head unit is therefore designed to receive the non-specific certificate and the specific certificate, which are identifiers. Using these identifiers, a connection for secure communication, with the head unit being identified by the remote device, can thus be established between the user device and the remote device in a simple, efficient, and cost-effective manner.

[0020] Furthermore, the communication system according to the invention can contain identification information of the motor vehicle in a storage unit of the user device or the head unit.

[0021] Advantageously, in one embodiment, a computer program with program code is also used, by means of which the execution of the method according to the invention is carried out when the program is executed in a computer.

[0022] Finally, a computer program product with program code for executing the method according to the invention, when the program is executed in a computer, is also the subject of the invention. Character description

[0023] Figures and descriptions serve to improve understanding of the subject. It shows Fig. 1 a process flow diagram of an embodiment of the method according to the invention, relating to the connection of the head unit of a vehicle with a backend IT system, and Fig. 2 a scheme of an arrangement of a communication system according to the invention, comprising the user device according to the invention and a device spaced apart from it. Detailed description

[0024] In this context, the "user device" can be understood as a motor vehicle's head unit, and the "remote device" as a specific backend IT system. The backend IT system could be a computer network belonging to a service provider or the vehicle manufacturer, another computer network, or a server.

[0025] A computer program containing program code for carrying out the method can run on at least one computer in the computer network or on the server; the program must be executed by a suitable data processing device, or, in short, a computer. The computer program can be executed with the corresponding program code for carrying out the method according to the invention after the program has been loaded using a computer program product.

[0026] The head unit, a computer with a processor, provides the means to establish a connection to the internet. The computer program containing the aforementioned program code for carrying out the procedure runs on the head unit.

[0027] The connection between the vehicle's head unit and the backend IT system is established via a publicly accessible network, such as a mobile network.

[0028] To establish a secure connection between the vehicle and the backend IT system, VPN (Virtual Private Network) technology can be used. VPN is a familiar concept. Using a VPN, the head unit can establish a connection to the internet. To do this, it starts VPN software, the VPN client, which virtually replicates the structure of the backend IT system on the head unit. The VPN software then establishes a connection to the VPN access point of the backend IT system. For this, the head unit needs a VPN certificate, which it uses to authenticate itself with the VPN access point of the backend IT system. Only after successful authentication is a secure connection established.

[0029] In the first step of the method according to the invention, the backend IT system generates a generic initialization certificate and sends it to the head unit manufacturer. The head unit manufacturer stores this initialization certificate in a large number of produced head units, ensuring that the initialization certificate is identical across a large number of head units. From time to time, the backend IT system generates a new initialization certificate and transmits it to the manufacturer. This can occur, for example, after a defined period, such as every month, or after the production of a predetermined number of head units, such as every 10,000 head units. The backend IT system manages the initialization certificates it generates and transmits to the head unit manufacturer.

[0030] The backend IT system receives information from the vehicle manufacturer about vehicles equipped with an internet-enabled head unit. This information can include not only the vehicle identification number (VIN) but also additional details, such as the serial numbers of specific control units. When a VPN connection is established between the head unit and the backend IT system, the initialization certificate stored in the head unit is used as the VPN certificate during the first secure connection. The backend IT system recognizes the initialization certificate and requests specific vehicle information from the head unit. This specific vehicle information is stored in the head unit, for example, by being entered when the head unit is installed in the vehicle.

[0031] Alternatively, automatic vehicle detection from the vehicle bus system upon connection of the head unit is also conceivable. The head unit transmits this specific vehicle information to the backend IT system. The backend IT system checks whether the transmitted vehicle information matches information provided by the vehicle manufacturer that correlates with the non-specific initialization certificate. If this is not the case, the connection is terminated. If the check is successful, the backend IT system generates a new, individual certificate specific to the head unit and sends it to the head unit via the secure connection. The new, specific certificate is stored there and used as the VPN certificate from then on. Thus, from this point forward, every secure VPN connection is established using the individual, specific working certificate.The vehicle information can be used when generating the individual, specific certificate.

[0032] The backend IT system can assign a validity period to the individual, specific certificate. After this period expires, a new, specific certificate is created in the same way as described above.

[0033] Advantages of the method according to the invention include the following: No additional process steps are required in the production of the head units, no certificates are generated at the supplier who manufactures the head units, and the individual, specific certificate establishes a unique assignment between the vehicle and the backend IT system via the vehicle information.

[0034] Fig. Figure 1 shows the inventive method as a flowchart, with the steps executed by the head unit on the left and those executed by the backend IT system on the right. The communication method is executed via a publicly accessible network using digital certificates. It starts with the generation of a non-specific certificate by the backend IT system in step a and continues with the sending of the non-specific certificate to the head unit in step b. This is followed by receiving and storing (steps c and d) the non-specific certificate on the head unit, and then by establishing an initial connection (step e) from the head unit to the backend IT system using the non-specific certificate (step e', so to speak) as an identifier.The initial connection is accepted by the backend IT system in step f if the identifier is the non-specific certificate; otherwise, it is rejected (see step f'), or the initial connection attempt is aborted. In step g, the device requests vehicle identification information, such as a chassis number, from the vehicle's head unit, and this information is sent back to the backend IT system by the head unit (step h). The backend IT system then creates a specific certificate as a working certificate in step i, using the identification information as a basis. This working certificate is then sent to the head unit (step j), which receives and stores it in the next step k (step i).The establishment of a working connection (step m) from the head unit to the device and saving (step n) can now be performed, advantageously using the working certificate as the identifier and ensuring that the backend IT system identifies the head unit.

[0035] A device according to the invention is now described using the following Fig. Figure 2 explains this. It schematically shows a communication system 1 with four user devices 2, 3, 4, 5 according to the invention, here head units of motor vehicles, and a device 6 spaced apart from them, here a server 6 or a backend IT system. Each head unit 2, 3, 4, 5 can be connected to the server 6 via a secure connection 7, 8, 9, 10 over the publicly accessible network 11. Each head unit 2, 3, 4, 5 has a processor 21, 31, 41, 51, which is equipped to carry out the steps necessary for establishing a secure connection. The server 6 has a communication interface 61.

[0036] To manufacture head units 2, 3, 4, and 5, server 6 can connect to the production system 13 of the head unit manufacturer via connection 12. Server 6 transmits the non-specific initialization key to production system 13 via connection 12. Production system 13 then transmits this key to the head units 2, 3, 4, and 5 via production connections 22, 32, 42, and 52 during their manufacture, ensuring that all head units have the same non-specific initialization key. Once production is complete, production connections 22, 32, 42, and 52 are terminated. The head units 2, 3, 4, and 5 are then installed in vehicles at the automotive manufacturer and establish a secure connection to server 6 via the publicly accessible network, following the procedure described above in connection with the... Fig. 1 has been described.

[0037] Although the invention was described using the example of head units in motor vehicles that communicate with a backend IT system via a secure connection, it is not limited to this application. All types of mobile devices that communicate securely with remote computers or computer networks via public networks are also included in the subject matter of the invention. These can be, for example, mobile phones, personal computers, personal digital assistants, as well as so-called "smart" household appliances or "smart field devices," i.e., measuring and control devices used in industrial process plants to monitor physical or chemical process parameters and which have a network interface.

Claims

[1] Method for carrying out secure communication between a user device with a head unit (2,3,4,5) of a motor vehicle and a remote device (6) via a publicly accessible network using digital certificates, comprising the steps: - Generating (a) a non-specific certificate by the remote device (6) and sending (b) the non-specific certificate to the head unit (2,3,4,5), - Receiving (c) and storing (d) the non-specific certificate on the head unit (2,3,4,5), - Establishing (e) an initial connection from the head unit (2,3,4,5) to the device (6) using (e') the non-specific certificate as an identifier, - Accept (f) the initial connection by the device (6) if the identifier is the non-specific certificate, otherwise abort (f') the initial connection, - from the device (6) requesting (g) vehicle identification information from the head unit (2,3,4,5) of the motor vehicle, - from Head Unit (2,3,4,5) return (h) the identification information to the device (6), - by the device generating (i) a specific certificate using the identification information and sending (j) the specific certificate to the head unit (2,3,4,5), - Receiving (k) and storing (I) the specific certificate by the head unit (2,3,4,5), - Establishing (m) a working connection from the head unit (2,3,4,5) to the device (6) and storing (n) the specific certificate as an identifier on the device (6) so that it identifies the head unit (2,3,4,5). [2] Method according to claim 1, wherein the remote device (6) is a backend IT system. [3] Method according to claim 1 or 2, wherein the non-specific certificate is an initialization certificate and wherein the specific certificate is a working certificate. [4] Method according to at least one of claims 1 to 3 above, comprising the step - after the identification information is sent back to the device (6) checks whether the identification information of the motor vehicle corresponds to vehicle information previously stored in the device (6). [5] Method according to at least one of claims 1 to 4 above, comprising the step - after the Head Unit (2,3,4,5) has received and stored the specific certificate, the Head Unit (2,3,4,5) sends a message to the device (6) and confirms the installation of the specific certificate. [6] Method according to at least one of claims 1 to 5 above, comprising the step - Executing the saving of the non-specific certificate during the manufacture of the head unit (2,3,4,5). [7] Communication system comprising a motor vehicle user device with a head unit (2,3,4,5) with a processor (21,31,41,51), and a device (6) located remotely from the motor vehicle, for performing a secure communication method by identifying the head unit (2,3,4,5) by the remote device (6) according to any one of claims 1 to 6, wherein the communication takes place via a publicly accessible network, and wherein the head unit (2,3,4,5) and the remote device (6) each comprise at least one receiving device, at least one storage device, and at least one transmitting device, characterized by , that the remotely located device includes a device for generating a non-specific certificate and a specific certificate, and that the receiving device of the head unit (2,3,4,5) is suitable for receiving the non-specific certificate and the specific certificate, wherein the non-specific certificate and the specific certificate are identifiers by means of which a connection for providing secure communication can be established between the user device and the device (6) by means of the device (6) to identify the head unit (2,3,4,5). [8] Communication system according to claim 7, wherein a storage unit of the processor of the user device contains identification information of the motor vehicle. [9] Computer program with program code for carrying out a method according to any one of claims 1 to 6, when the program is executed in a computer. [10] Computer program product comprising program code for performing the method according to any one of claims 1 to 6 when the program is executed in a computer.

Images