Method for the secure transmission of data between a server and a control unit and device for carrying out the method

Abstract

Method for the secure transmission of data between a central server (1) and at least one control unit (4) of a vehicle (9), comprising the following process steps: a) Transmitting a function instruction to a vehicle-side switching unit (3) which is in communication technology connection with the central server (1), and transmitting the function instruction to the control unit(s) (4) associated with the function instruction by means of the vehicle-side switching unit (3); b) Generating a reservation ticket associated with the function instruction within the control unit(s) (4) and encrypting the reservation ticket using a coding key of the control unit (4) and transmitting the encrypted reservation ticket to the vehicle-side communication unit (3); c) Encrypting the encrypted reservation ticket with a coding key of the vehicle-side intercom unit (3) and transmitting the doubly encrypted reservation ticket to the central server (1); d) Decrypting the doubly encrypted reservation ticket using the coding key of the vehicle-side intercom unit (3) and the coding key of the control unit(s) (4); e) Generating a session key on the central server (1) and generating an instruction ticket associated with the reservation ticket; f) Encrypting the instruction ticket together with the session key using the coding key of the control unit(s) (4) to form an ECU ticket and encrypting the ECU ticket using the coding key of the vehicle-side switching unit (3); (g) Transferring the encrypted ECU ticket to the vehicle-side switching unit and decrypting the encrypted ECU ticket using the coding key of the vehicle-side switching unit (3); h) Transmitting the ECU ticket to the control unit(s) (4) and decoding the ECU ticket using the coding key of the control unit(s) (4); i) Check using the control unit(s) (4) whether the ECU ticket belongs to the reservation ticket.

Description

[0001] The invention relates to a method and a device by means of which a secure transmission of data between a central server and at least one control unit of a vehicle is provided based on generated tickets.

[0002] A device for carrying out the described method is also provided. Furthermore, according to a first embodiment, the device comprises, in addition to the central server and the at least one control unit, a vehicle-mounted switching unit. According to a further embodiment, an external switching unit is provided instead of the vehicle-mounted switching unit, for example, a diagnostic device from a workshop or the like.

[0003] In the prior art, depending on the type and design as well as the location of use, it is known that communication between the vehicle and a central server, for example for installing updates or the like, is unsecured or weakly secured, for example by means of a security measure with a fixed coding key that is the same for all units of the present series.

[0004] Safer methods are usually significantly more complex and time-consuming, so they are generally not used. Safer methods usually require a higher level of performance within the control units, so they are only used in complex units, if at all.

[0005] DE 10 2009 053 230 A1 shows a method for authorizing an external system on a control unit of a vehicle.

[0006] DE 10 2014 017 618 B4 concerns a method for enabling a vehicle function.

[0007] It is therefore an object of the present invention to provide a method for the secure transmission of data between a server and a control unit of the vehicle, which on the one hand ensures a high level of security and yet still allows fast communication and a flexible design of access rights.

[0008] This object is achieved by a method for the secure transmission of data between a central server and at least one control unit of a vehicle, comprising the method steps: a) transmitting a functional instruction to a vehicle-side switching unit which is in communication connection with the central server, and transmitting the functional instruction to the control unit(s) associated with the functional instruction by means of the vehicle-side switching unit; b) generating a reservation ticket associated with the functional instruction within the control unit(s), preferably with assignment of a ticket identifier to identify the affiliation of the reservation ticket, and encrypting the reservation ticket using a coding key of the control unit and transmitting the encrypted reservation ticket to the vehicle-side switching unit; c) Encrypting the encrypted reservation ticket with an encryption key of the vehicle-side switching unit and transmitting the doubly encrypted reservation ticket to the central server; d) decrypting the double-encrypted reservation ticket using the coding key of the on-board switching unit and the coding key of the control unit(s); e) generating a session key in the central server and generating an instruction ticket associated with the reservation ticket, particularly preferably with an access code for enabling functions in the control unit; f) encrypting the instruction ticket together with the session key using the coding key of the control unit(s) to form an ECU ticket and encrypting the ECU ticket using the coding key of the vehicle-side switching unit; g) transmitting the encrypted ECU ticket to the vehicle-side switching unit and decrypting the encrypted ECU ticket using the encryption key of the vehicle-side switching unit; h) transmitting the ECU ticket to the control unit(s) and decrypting the ECU ticket using the coding key of the control unit(s); i) Checking, using the control unit(s), whether the ECU ticket is associated with the reservation ticket, in particular whether the ECU ticket is associated with the reservation ticket using the ticket identifier.

[0009] The reservation ticket serves as a reservation for later use of the instruction ticket.

[0010] Preferably, the functions can be released after step i) of verification.

[0011] Regardless of the design, the central server stores the respective existing coding keys of the at least one control unit, the vehicle-side switching unit, and the external switching unit. Furthermore, the central server stores the complete or entire network topology, from which it can be determined which functionality must be enabled in which control unit to perform the planned operations.

[0012] Each control unit has its own coding key, as does the on-board switching unit and the external switching unit. This also applies, for example, to every possible vehicle in a fleet or manufacturer, as well as to all external switching units found in workshops, for example. Furthermore, the keys are uniquely assigned, preferably one-to-one, to the respective component.

[0013] The following describes an embodiment of a method using a vehicle-based switching unit. All possible process steps are listed, although they are not necessarily required.

[0014] In a first step, a functional instruction is generated and transmitted to the vehicle-side switching unit and received by the vehicle-side switching unit, which then transmits an access request with the functional instruction to the corresponding control unit or units.

[0015] According to a preferred embodiment, after receipt of the functional instruction at the control unit(s), in particular for generating the reservation ticket, a number stored in a counter of the respective control unit is incremented, newly stored in the respective control unit, and the incremented number is entered into the reservation ticket as a ticket identifier. The respective control unit receives this access request with the functional instruction and, based on a counter located in the control unit (with a stored number), creates a counter which is incremented by the control unit based on the functional instruction, preferably newly stored, and entered into a reservation ticket. Likewise, the intended function of the functional instruction is preferably entered into the reservation ticket as a binary code and, if applicable, further information, such as a serial number, for example of the control unit.

[0016] According to a further preferred embodiment, when encrypting the reservation ticket or during or after generating the encrypted reservation ticket in the respective control unit, a timer of the control unit is started with a predetermined duration. This makes it possible to monitor the validity period of the reservation or reservation ticket.

[0017] The reservation ticket created in this way is then encrypted using the control unit's coding key, and a timer on the control unit is preferably started with a specified time period within which the instruction ticket corresponding to the ticket reservation or reservation ticket must be received by the control unit. The encrypted reservation ticket is then transmitted to the vehicle's switching unit.

[0018] According to a preferred embodiment, after the reservation ticket has been generated in the respective control unit, a copy of the reservation ticket is generated and stored in the control unit. A copy of the reservation ticket remains in the control unit as a ticket reservation for later verification of the ticket.

[0019] The vehicle-based switching unit then encrypts the encrypted reservation ticket with its encryption key and transmits the now doubly encrypted reservation ticket to the central server. With this encryption, it is conceivable that additional information, such as the vehicle's VIN (vehicle identification number), is added to the reservation ticket.

[0020] Particularly preferably, the transmission between the vehicle-side switching unit and the central server is a wireless transmission.

[0021] After the central server receives the double-encrypted reservation ticket, it first decrypts the double-encrypted reservation ticket using the coding key of the vehicle's communication unit and then using the coding key of the control unit. The central server therefore knows the (consecutive) number of the control unit, the requested function, and, if applicable, the serial number and VIN.

[0022] The central server then creates a session key, also called a session coding key, uniquely assigned to the reservation ticket, and also creates an instruction ticket, preferably in accordance with the authorizations contained in the central server's authorization database. The instruction ticket includes the (consecutive) ticket number of the control unit or the control unit's counter, a function code (in binary representation), a switch bar with various switch positions, and, optionally, a validity period for the instruction ticket, i.e., the length of time the instruction ticket is valid. This validity period can be set variably depending on the intended operation specified by the function instruction.

[0023] According to a preferred embodiment, after the reservation ticket has been generated in the respective control unit, a copy of the reservation ticket is generated and stored in the control unit.

[0024] The instruction ticket together with the session coding key is then encoded by the central server with the coding key of the control unit to create an ECU ticket, which is then encoded again with the coding key of the vehicle-side switching unit together with the session coding key.

[0025] The now encoded ECU ticket is transmitted from the central server to the vehicle-side switching unit and decoded using the vehicle-side switching unit's coding key. The vehicle-side switching unit therefore has both the session coding key and the ECU ticket, which cannot be decoded by the vehicle-side switching unit because it is encoded using the control unit's coding key. Through decoding, the vehicle-side switching unit also has the requested operation and the ticket's validity period.

[0026] The vehicle-side switching unit transmits the ECU ticket, which also contains the session coding key, to the respective control unit, where it is decoded. This only occurs if the ECU ticket was received within the time period initiated and monitored by the control unit since the reservation ticket was issued.

[0027] The control unit now has the decoded ECU ticket with the (consecutive) number (counter number) assigned by the control unit, as well as the ticket validity period and the session coding key. The control unit also checks whether the (consecutive) number of the ticket reservation stored since the reservation ticket was issued matches the (consecutive) number of the decoded ECU ticket. If the match is positive, the control unit is enabled to execute actions according to the functions enabled in the ticket. In addition, a timer is started in the control unit, which monitors the ticket's validity period, depending on the validity period specified in the ticket.

[0028] According to a preferred embodiment, - after generating the instruction ticket and the session key, a copy of the instruction ticket and the session key is stored on the central server; - after decrypting the encrypted ECU ticket in the vehicle-side switching unit, the instruction ticket and the session key are stored in the vehicle-side switching unit; - after decrypting the ECU ticket, the instruction ticket and the session key are stored in the respective control unit.

[0029] The control unit checks whether the (consecutive) number of the reservation ticket matches the (consecutive) number of the decoded ECU ticket.

[0030] If the numbers match, a secure data transfer can be carried out using the session coding key between the central server, the vehicle-side switching unit, and the control unit(s). The data to be transmitted is encoded and decoded using the session coding key.

[0031] After the ticket's validity period expires, or when the ticket is explicitly closed by issuing a corresponding instruction to the control unit, the control unit is secured again and the stored ticket reservation or reservation ticket is deleted. Tickets created during the process and the session encryption key lose their validity and cannot be used again at a later time to reopen access to the control unit. With particular preference, all created tickets and the session encryption key are deleted. This also means that the requested function or operation can no longer be executed after the validity period expires.

[0032] In the following, the method according to the further embodiment is described, wherein no vehicle-side switching unit is provided, but the control units are connected to an external switching unit.

[0033] The object is further achieved by a method for the secure transmission of data between a central server and at least one control unit of a vehicle, comprising the method steps: a) transmitting a functional instruction to an external switching unit, which initially has no communication connection with the central server, and transmitting the functional instruction to the control unit(s) associated with the functional instruction by means of the external switching unit; b) generating a reservation ticket associated with the functional instruction within the control unit(s), preferably with assignment of a ticket identifier to identify the affiliation of the reservation ticket, and encrypting the reservation ticket using a coding key of the control unit and transmitting the encrypted reservation ticket to the external switching unit; c) establishing a data connection between the external switching unit and the central server and transmitting a connection request from the external switching unit, encoded with an encryption key of the external switching unit, to the central server; d) Authentication of the encrypted connection request in the central server and, after positive authentication, generation of a session key and encryption of the authenticated connection request together with the session key and transmission of the encrypted connection request to the external switching unit; e) decrypting the encrypted authenticated connection request by means of the external switching unit so that the session key is available to the external connection unit; f) Encrypting the encrypted reservation ticket using the session key in the external switching unit and transmitting it to the central server, decrypting the doubly encrypted reservation ticket in the central server using the session key and the encryption key of the respective control unit; g) generating an instruction ticket associated with the reservation ticket, particularly preferably with an access code for enabling functions in the control unit, and encrypting the instruction ticket using the coding key of the respective control unit to form an ECU ticket and encrypting the ECU ticket with the session key; h) transmitting the encrypted ECU ticket to the on-board switching unit and decrypting the encrypted ECU ticket using the encryption key of the on-board switching unit; i) transmitting the ECU ticket to the control unit(s) and decrypting the ECU ticket using the coding key of the control unit(s); j) Checking, using the control unit(s), whether the ECU ticket belongs to the reservation ticket, in particular whether the ECU ticket belongs to the reservation ticket based on the ticket identifier.

[0034] Preferably, the functions can be released after step j) of verification.

[0035] The problem is thus solved by the same method as in the previous embodiment for the secure activation of functions and transmission of data between a central server and at least one control unit of a vehicle, wherein the external switching unit replaces the vehicle-side switching unit. Deviating from the previously described method, an asymmetric key pair is used to authenticate the external switching unit with the central server. This key pair was generated in the external switching unit before the external switching unit was registered with the central server, and whose public key was transmitted to the central server during the registration process.The registration procedure of the external switching unit with the central server is not part of this procedure and is assumed to ensure the authenticated transmission of the public key with sufficient security.

[0036] In this embodiment, the action initiative originates from the external switching unit, which communicates with the control units via the vehicle's on-board interface. First, the access request (with functional instructions) is transmitted to the corresponding control unit(s) along with the functional instructions.

[0037] The respective control unit receives this access request with the function instruction and creates a counter (with a stored number) located in the control unit, which is incremented by the control unit based on the function instruction, preferably stored again, and entered into a reservation ticket. Likewise, the intended function of the function instruction is entered as a binary code and, if applicable, further information, such as a serial number, for example, of the control unit, in the ticket reservation or reservation ticket.

[0038] The reservation ticket thus created is then encrypted using the control unit's coding key, and a timer on the control unit is preferably started with a specified time period within which the instruction ticket corresponding to the ticket reservation must be received by the control unit. The encrypted reservation ticket is then transmitted to the external switching unit. A copy of the reservation ticket remains in the control unit for later verification.

[0039] Up to this step, the method according to the further embodiment is largely identical to the method of the first embodiment.

[0040] The external switching unit, which initially has no connection to the central server, establishes a data connection, possibly by relocating the external switching unit to a data interface, and sends a connection request to the central server in order to establish a connection to the central server.

[0041] This connection request is signed with the encryption key of the external switching unit. Preferably, the encryption key consists of a private key and a public key, with the public key stored on the central server.

[0042] After the central server has received the connection request signed using the encryption key of the external switching unit, it is decoded and authenticated using the public key.

[0043] After authenticating the connection request, a session encryption key is also created and the connection request together with the session encryption key is encrypted using the public key and transmitted to the external switching unit.

[0044] After receiving the encrypted connection request with the session encryption key, the encrypted connection request is decoded using the encryption key, specifically the private key. The external switching unit then has the session encryption key. An authenticated connection with a coordinated session encryption key is now established.

[0045] The encrypted reservation ticket still available to the external switching unit is then encrypted using the session encryption key and transmitted to the central server.

[0046] The central server now decodes the reservation ticket encrypted with the session encryption key (which is further encrypted using the ECU's encryption key), first using the session encryption key and then using the ECU's encryption key. The central server now has the ECU's ticket request.

[0047] The central server then creates an instruction ticket based on the authorizations contained in the authorization database. The instruction ticket includes the (consecutive) ticket number from the control unit, a function code or (in binary representation) a switch bar with the switch positions of the functions to be enabled, and optionally a validity period for the instruction ticket, i.e., the length of time the instruction ticket is valid. This validity period can be set depending on the intended operation specified by the function instruction.

[0048] The instruction ticket is then encoded by the central server with the control unit's coding key to create an ECU ticket, which is then encoded again with the session coding key agreed upon during the connection establishment of the external switching unit.

[0049] The now encoded ECU ticket is transmitted from the central server to the external switching unit and decoded using the session coding key. The external switching unit therefore has both the session coding key and the ECU ticket, which cannot be decoded by the vehicle-side switching unit because it is encoded using the control unit's coding key. Through decoding, the vehicle-side switching unit also has the requested operation and the ticket's validity period.

[0050] The external switching unit transmits the ECU ticket to the respective control unit, where it is decoded using the control unit's coding key. This only occurs if the ECU ticket was received within the time period that the control unit started issuing the reservation ticket.

[0051] The control unit now has the decoded ECU ticket with the (consecutive) number assigned by the control unit, as well as the ticket's validity period. The control unit also checks whether the (consecutive) number of the ticket reservation stored since the reservation ticket was issued matches the number of the decoded ECU ticket. If the check is positive, the control unit is enabled to execute actions based on the validity period and the functions enabled in the ticket.

[0052] If the numbers match, data can be transferred from the external switching unit and the control unit(s).

[0053] During runtime, data exchange between the external switching unit and the respective control unit is now possible, in particular without further encryption of the data.

[0054] Data that is to be securely exchanged between the central server and the control unit(s) via the external switching unit, for example the control unit software during reprogramming, is encoded with the control unit's coding key and is thus hidden from the external switching unit.

[0055] After the ticket's validity period expires, or when the ticket is explicitly closed by issuing a corresponding instruction to the control unit, the control unit is secured again and the saved ticket reservation or reservation ticket is deleted. Tickets created during this process lose their validity and cannot be used again at a later time to reopen access.

[0056] According to a further, third embodiment, a further method is presented for ensuring that certain functions in the control units are enabled by the central server. Due to reduced security, this embodiment requires special authorization for the application and is particularly aimed at situations where neither the vehicle-side switching unit nor an external switching unit is connected to the central server, for example, when the network of embedded systems, such as the vehicle, is located in a remote location but requires data.

[0057] However, this embodiment has the disadvantage that the time period between issuing the instruction ticket and using it to access the control unit is not monitored by the control unit, meaning the ticket can be stored in reserve. In this case, it is possible for the instruction ticket to be created based on the next (consecutive) ticket number stored in the control unit. This means that the ticket has a different number than the one stored in the control unit, namely in particular the number in the control unit + 1, which would correspond to the incrementation of the (consecutive) number. This requires that the most recently used ticket number is stored (maintained) on the central server for each control unit. The instruction ticket also contains the required function coding and information for unique assignment to the control unit, such as the serial number.

[0058] In this case, it may be possible for ticket information to be created based on the next (consecutive) ticket number stored in the control unit. This means that the ticket has a different number than the one stored in the control unit, specifically the control unit number plus 1, which would correspond to the increment of the (consecutive) number.

[0059] The required function is also stored in the ticket, as well as the serial number and VIN if applicable.

[0060] According to this embodiment, the starting point is the central server from which data is to be transmitted to control units or which requests data from control units without having a communication connection to the control units or a switching unit. In this embodiment, a data storage device, such as a USB stick or a memory in a data processing medium, serves as the transport medium. A session encryption key is generated on the central server, and an instruction ticket is generated with the (consecutive) number, the function, the runtime, and the session encryption key. The instruction ticket is then encrypted using the encryption key of the control unit and, if used, further with the public key of a (portable) external switching unit.

[0061] This encrypted instruction ticket, along with the data to be transmitted, which has been encoded with the session coding key, is stored on a portable data storage device, such as a USB stick, and transported to the destination. At the location of the target system, such as the vehicle, the data and ticket information are loaded onto either an external switching unit or a system-side switching unit (built into the target system; vehicle-side). Thus, the session coding key and the ECU ticket are present, which are then transmitted to the control unit and decoded in the control unit using the control unit's coding key.

[0062] The control unit then compares the (consecutive) number of the ticket with the (consecutive) number stored in the memory unit; if the ticket number is equal to the incremented number of the control unit, the process continues, enabling secure communication using the session encryption key within a time window specified by the central server.

[0063] After the time window has expired, the control unit is secured again and communication is stopped.

[0064] Furthermore, a device is provided for carrying out one of the methods, wherein the device comprises at least: the central server and at least one control unit and a vehicle-side switching unit and / or an external switching unit.

[0065] In particular, the switching units have a secure memory for storing tickets in order to be able to store tickets for a limited period of time and only for specific functions.

[0066] It should be noted that the control units are not always active, but can also be in sleep mode. Therefore, it is particularly advantageous if the respective control unit has a timer (time counter) that is also active in sleep mode, by means of which the elapsed time can be further monitored. Furthermore, the respective control unit has a memory and ticket counter that is active in sleep mode but volatile when power is off, so that the tickets or ticket information, especially the reservation ticket, can be retained by the control unit even during sleep mode.

[0067] Furthermore, it is proposed in particular that the sleep mode counter and memory as well as the ticket counter be a particularly secure hardware area.

[0068] In particular, the method and device proposed here makes it possible to enable secure access control with individual access without requiring a master key for extended access. Access profiles for the control unit(s) are created on the server within the framework of authorization structures defined there and can thus be dynamically configured over the entire service life of the system within the framework of the authorization switches provided in the control unit's design.

[0069] For each specific access, secure access is provided via tickets, which can be time-limited, ensuring a high level of system security. Keys obtained through complex attacks (along with secrets) are not usable in the rest of the system, so any achieved result is disproportionate to the effort required for the attack.

[0070] Access rights can be assigned by storing new authorizations in the central server, which lead to the issuance of the corresponding tickets in the application case.

[0071] The access rights to an ECU assigned via tickets consist of individually switchable access functions that can be planned very finely and from a purely technical perspective in the technical design of the ECU. The previously described secure activation of these switches using individual bits in the ticket's function code allows access profiles to be designed very flexibly for a large number of networked ECUs. This allows the decision regarding the configuration of access rights to be shifted, within the scope of the switches provided from a technical perspective, to the period of system use.

[0072] It is also conceivable that access rights could be assigned based on the person's experience or authorization. To do this, various control options are assigned bits in the software, which the person can access. Depending on the person's authorization, all or only selected bits of the control unit can be changed. These authorizations can also be stored on the central server. If a person requests access to a system for which they are not authorized, they will not be issued a corresponding ticket.

[0073] Further advantageous embodiments emerge from the subclaims.

[0074] Further objects, advantages, and benefits of the present invention will become apparent from the following description taken in conjunction with the drawings, in which: Fig. 1 Flow diagram of a preferred method; Fig. 2 Flowchart of another preferred method Fig. 3 Device for carrying out a method according to an embodiment; Fig. 4 schematic representation of a control unit.

[0075] The figures briefly illustrate the methods according to preferred embodiments. A device according to a preferred embodiment is also shown. A control unit is also briefly illustrated.

[0076] In the Fig. 1 shows a method according to a first preferred embodiment, wherein communication between at least one control unit 4 is to be established via a vehicle-side switching unit 3 and a central server 1.

[0077] The connection between the central server 1 and the vehicle-side switching unit 3 is preferably wireless, and particularly preferably at least one selected from the group comprising WLAN, Bluetooth, NFC and the like or is designed as a mobile radio connection.

[0078] The at least one control unit 4, like the vehicle-side switching unit 3, is arranged within a vehicle 9 (shown only schematically here). A (consecutive) number is stored in the control unit 4.

[0079] In a first step S1, an access request with a function request is transmitted to the vehicle-side switching unit 3 and received by the vehicle-side switching unit 3. In a next step S2, the access request with the function request is transmitted via the vehicle-side switching unit 3 to the respective control units 4, i.e., to those control units 4 that are associated with the requested function. The respective control unit 4 receives the function request.

[0080] In the next step S3, a ticket reservation or reservation ticket is created within the control unit 4. This ticket reservation contains a consecutive number of a counter in the control unit 4, as well as the functional instructions and, if necessary, other information. At the same time, a timer is started with a specified duration or runtime. Furthermore, the ticket is encrypted using a coding key of the control unit 4.

[0081] In the next step S4, the reservation ticket encrypted with the coding key of the control unit 4 is transmitted to the vehicle-side switching unit 3 and encoded again using the coding key of the switching unit 3.

[0082] Subsequently, in step S5, the doubly encrypted ticket is transmitted to the central server 1 and decoded there using the coding keys of the switching unit 3 and the control unit 4 stored in the central server 1.

[0083] Next, in step S6, a session encryption key is created by the central server 1, along with a corresponding instruction ticket based on the authorizations in the authorization database. The instruction ticket includes the (consecutive) ticket number of the control unit, a function code or a button bar in binary representation, and a validity period for the instruction ticket, i.e., the length of time the instruction ticket is valid.

[0084] This encrypted instruction ticket is transmitted from the central server 1 to the switching unit 3 and decoded using the encryption key of the switching unit 3, whereby the switching unit 3 has in particular the session key, also called session encryption key.

[0085] The ECU ticket also received (which is still encrypted using the coding key of control unit 4) is transmitted to control unit 4 and decrypted in control unit 4. Control unit 4 then has, in particular, the session coding key and, furthermore, the ticket validity period and the (consecutive) number.

[0086] The control unit 4 then checks in step S9 whether the (consecutive) number of the ticket reservation stored since the reservation ticket was issued matches the (consecutive) number of the decoded ECU ticket. If the check is positive, the control unit is enabled to perform an action depending on the runtime according to the functions enabled in the ticket. In particular, it also checks whether the ticket was received within the time period started by the timer.

[0087] If the numbers match, a secure transmission of data can be carried out using the session coding key between the central server 1, the vehicle-side switching unit 3 and the control unit 4.

[0088] In the Fig. 2 shows a method according to another embodiment.

[0089] In this embodiment, the action initiative comes from the external switching unit 2, which communicates with the control units via the on-board interface (S0).

[0090] In the first step S1, the access request is transmitted with the functional instruction to the corresponding control unit 4.

[0091] The respective control unit 4 receives this access request with the function instruction and creates a reservation ticket with an incremented (consecutive) number of the counter based on a counter located in the control unit.

[0092] The created reservation ticket is then encrypted using the coding key of the control unit 4 and a timer is started with a specified time period within which the instruction ticket matching the ticket reservation must be received (S2).

[0093] In the next step S3, the external switching unit 2, which initially has no connection to the central server 1, establishes a data connection and sends a connection request to the central server 1.

[0094] This connection request is signed with the encryption key of the external switching unit 2.

[0095] After the central server receives the signed connection request, it is authenticated using the public key. After authentication, a session encryption key is created. The connection request, along with the session encryption key, is encrypted using the public key and transmitted back to the external switching unit 2 (S4).

[0096] After receiving the encrypted connection request with the session encryption key, the encrypted connection request is decoded using the private key. The session encryption key is available to switching unit 2 (S5).

[0097] The instruction ticket is then encoded by the central server with the coding key of the control unit to create an ECU ticket, which is then encoded again with the session coding key agreed upon during the connection establishment of the external switching unit (S6).

[0098] The now encoded ECU ticket is transmitted from the central server to the external switching unit and decoded using the session coding key. The external switching unit therefore has both the session coding key and the ECU ticket, which cannot be decoded by the vehicle-side switching unit because it is encoded using the control unit's coding key. Through decoding, the vehicle-side switching unit also has the requested operation and the ticket's validity period (S7).

[0099] The external switching unit transmits the ECU ticket to the respective control unit, where it is decoded using the control unit's coding key. This only occurs if the ECU ticket was received within the time period that the control unit started issuing the reservation ticket.

[0100] The control unit now has the decoded ECU ticket with the (consecutive) number assigned by the control unit, as well as the ticket's validity period. The control unit also checks whether the (consecutive) number of the ticket reservation stored since the reservation ticket was issued matches the number of the decoded ECU ticket. If the check is positive, the control unit is enabled to execute actions based on the validity period and the functions enabled in the ticket.

[0101] If the numbers match, data can be transferred from the external switching unit and the control unit(s).

[0102] During runtime, data exchange between the external switching unit and the respective control unit is now possible, in particular without further encryption of the data.

[0103] Data that is to be securely exchanged between the central server and the control unit(s) via the external switching unit, for example the control unit software during reprogramming, is encoded with the control unit's coding key and is thus hidden from the external switching unit.

[0104] After the ticket's validity period expires, or when the ticket is explicitly closed by issuing a corresponding instruction to the control unit, the control unit is secured again and the saved ticket reservation or reservation ticket is deleted. Tickets created during this process lose their validity and cannot be used again at a later time to reopen access.

[0105] In the Fig. 3 shows a device according to a particularly preferred embodiment.

[0106] What can be seen here is a central server 1, which has a first connection unit 6, and a vehicle 9 (shown only schematically here), in which a vehicle-side switching unit 3, which has a second connection unit 7, at least one control unit 4, a central gateway 8, which is connected to the vehicle-side switching unit 3 and the control units 4, in particular is connected between the switching unit 3 and the control units 4, and has an on-board interface 5, for example to connect an external switching unit 2. The central server and the vehicle-side switching unit 3 establish a connection to one another by means of the first connection unit 6 and the second connection unit 7, particularly preferably wirelessly.

[0107] In the Fig.4 shows a control unit 4 with the mentioned memory and timer and various switches, which are represented as bits.

[0108] The access rights to a control unit 4 assigned via tickets consist of individually switchable access functions that can be planned very finely and from a purely technical perspective in the technical design of the control unit. The previously described secure activation of these switches using individual bits in the ticket's function code allows access profiles to be designed very flexibly for a large number of networked control units. This allows the decision regarding the design of access rights to be shifted, within the scope of the switches provided from a technical perspective, to the period of system use.

[0109] It is also conceivable that access rights could be assigned based on the person's experience or authorization. To do this, various control options are assigned bits in the software, which the person can access. Depending on the person's authorization, the corresponding bits are set in the control unit. These authorizations can also be stored on the central server. If a person requests access to a system for which they are not authorized, they will not be issued a corresponding ticket.

[0110] The functional instruction, which can be represented in binary form, corresponds to the switch positions of the switches within control unit 4. As an example, the entire switch position 10010010 is shown here, where 0 represents inactive and 1 represents active. The number of switches 10 within control unit 4 can, of course, vary.

[0111] All features disclosed in the application documents are claimed as essential to the invention, provided that they are new, individually or in combination, compared to the prior art. List of reference symbols 1 central server 2 external switching units 3 vehicle-side switching unit 4 Control unit 5 On-board interface 6 first connection unit 7 second connection unit 8 central gateway 9 vehicle 10 switches

Claims

[1] Method for the secure transmission of data between a central server (1) and at least one control unit (4) of a vehicle (9), comprising the method steps: a) transmitting a functional instruction to a vehicle-side switching unit (3) which is in communication connection with the central server (1), and transmitting the functional instruction to the control unit(s) (4) associated with the functional instruction by means of the vehicle-side switching unit (3); b) generating a reservation ticket associated with the functional instruction within the control unit(s) (4) and encrypting the reservation ticket by means of a coding key of the control unit (4) and transmitting the encrypted reservation ticket to the vehicle-side switching unit (3); c) encrypting the encrypted reservation ticket with a coding key of the vehicle-side switching unit (3) and transmitting the doubly encrypted reservation ticket to the central server (1); d) decrypting the double-encrypted reservation ticket using the coding key of the vehicle-side switching unit (3) and the coding key of the control unit(s) (4); e) generating a session key in the central server (1) and generating an instruction ticket associated with the reservation ticket; f) encrypting the instruction ticket together with the session key using the coding key of the control unit(s) (4) to form an ECU ticket and encrypting the ECU ticket using the coding key of the vehicle-side switching unit (3); g) transmitting the encrypted ECU ticket to the vehicle-side switching unit and decrypting the encrypted ECU ticket using the coding key of the vehicle-side switching unit (3); h) transmitting the ECU ticket to the control unit(s) (4) and decrypting the ECU ticket using the coding key of the control unit(s) (4); i) Checking by means of the control unit(s) (4) whether the ECU ticket belongs to the reservation ticket. [2] Method according to claim 1, characterized by that after receipt of the functional instruction at the control unit(s) (4), a number stored in a counter of the respective control unit (4) is incremented, is newly stored in the respective control unit (4) and the incremented number is entered in the reservation ticket. [3] Method according to claim 1 or 2, characterized bythat the functional instruction is entered into the reservation ticket as a binary code by means of the respective control unit (4). [4] Method according to one of claims 1 to 3, characterized by that when the reservation ticket is encrypted or after the encrypted reservation ticket is generated in the respective control unit (4), a timer of the control unit (4) is started with a predetermined running time. [5] Method according to one of claims 1 to 4, characterized by that after the reservation ticket has been generated in the respective control unit (4), a copy of the reservation ticket is generated and stored in the control unit (4). [6] Method according to claim 5, characterized by , that - after the instruction ticket and the session key have been generated, a copy of the instruction ticket and the session key is stored in the central server (1); - after decrypting the encrypted ECU ticket in the vehicle-side switching unit (3), the instruction ticket and the session key are stored in the vehicle-side switching unit; - after decrypting the ECU ticket, the instruction ticket and the session key are stored in the respective control unit (4). [7] Method according to claims 2 and 4, characterized by that after decrypting the ECU ticket in the respective control unit (4) by means of the respective control unit (4) - the running time of the timer is checked and, if the running time has been exceeded, the ECU ticket is deleted; - if the running time is exceeded, checking the number of the reservation ticket with the number of the ECU ticket, and if the check is negative, deleting the ECU ticket, and if the check is positive, enabling communication between the central server (1), the vehicle-side switching unit (3) and the respective control unit (4). [8] Method according to one of claims 1 to 6, characterized by that after a predetermined period of time the reservation ticket, the session key and the instruction ticket are deleted. [9] Method for the secure transmission of data between a central server (1) and at least one control unit (4) of a vehicle (9), comprising the method steps: a) transmitting a functional instruction to an external switching unit (2), which initially has no communication connection with the central server (1), and transmitting the functional instruction to the control device(s) (4) associated with the functional instruction by means of the external switching unit (2); b) generating a reservation ticket associated with the functional instruction within the control unit(s) (4) and encrypting the reservation ticket by means of a coding key of the control unit (4) and transmitting the encrypted reservation ticket to the external switching unit (2); c) establishing a data connection between the external switching unit (2) and the central server (1) and transmitting a connection request from the external switching unit (2) coded with an encryption key of the external switching unit (2) to the central server (1); d) Authentication of the coded connection request in the central server (1) and, after positive authentication, generation of a session key and encryption of the authenticated connection request together with the session key and transmission of the encrypted connection request to the external switching unit (2); e) decrypting the encrypted authenticated connection request by means of the external switching unit (2) so that the session key is available to the external connection unit (6); f) Encrypting the encrypted reservation ticket using the session key in the external switching unit (2) and transmitting it to the central server (1), decrypting the doubly encrypted reservation ticket in the central server (1) using the session key and the coding key of the respective control unit (4); g) generating an instruction ticket associated with the reservation ticket and encrypting the instruction ticket using the coding key of the respective control unit (4) to form an ECU ticket and encrypting the ECU ticket with the coding key of a vehicle-side switching unit (3); h) transmitting the encrypted ECU ticket to the vehicle-side switching unit (3) and decrypting the encrypted ECU ticket using the coding key of the vehicle-side switching unit (3); i) transmitting the ECU ticket to the control unit(s) (4) and decrypting the ECU ticket using the coding key of the control unit(s) (4); j) Checking by means of the control unit(s) (4) whether the ECU ticket belongs to the reservation ticket. [10] Device for carrying out a method according to one of claims 1 to 9, comprising a central server (1), at least one control unit (4), a vehicle-side switching unit (3) and / or an external switching unit (2), wherein the switching units each have a secure memory.

Images