Device, method, computer program for secure, highly available transmission of messages, vehicle comprising the device

Abstract

A method for the secure, highly available transmission of messages, particularly in a steer-by-wire steering system of a vehicle (100), characterized in that communication on a, preferably redundant, private data bus (110), which connects a first control unit (102), in particular a control unit of an operating element, preferably a steering wheel actuator, and a second control unit (104), in particular a control unit of a drive, preferably a rack and pinion drive, is secured on a first channel (112) with a message authentication code, in particular a message authentication code, wherein communication on a second channel (114) takes place without security with the message authentication code, wherein the messages are signals, in particular from a sensor (106) or an actuator (108) of the vehicle (100), transmitted (202).wherein in a first operating state signals from the first channel (112) are used (206), and wherein in a second operating state signals from the second channel (114) are used (208).

Description

State of the art

[0001] The invention is based on a device, a method, a computer program for secure, highly available transmission of messages, and a vehicle comprising the device.

[0002] A vehicle comprises control units that evaluate data from various sensors and control various actuators. Sensor data must be transmitted very reliably and at very high frequencies, e.g., 1 kHz. Latencies in the millisecond range lead to a deterioration of a function, e.g., steering feel, and can lead to loss of control, e.g., of the vehicle's steering.

[0003] Private data buses are known for communication between control units with such requirements. These can have multiple redundant channels for transmitting the same signals. These channels are protected against attacks with a message authentication code. For example, a Message Authentication Code (MAC), e.g., AES CMAC according to NIST Special Publication 800-38B, is used.

[0004] If a violation of data integrity or authenticity is detected for a piece of data secured with the message authentication code, it will not be used. This increases security but also bandwidth on the data bus, since all redundantly transmitted instances of the piece of data are secured with the message authentication code.

[0005] Corresponding methods for the secure transmission of messages in vehicles are known, for example, from US 2019 / 0 013 930 A1, DE 10 2013 206 185 A1, DE 10 2021 208 459 A1, DE 10 2007 013 511 A1, DE 10 2013 217 595 A1 and US 2015 / 0 172 298 A1. Disclosure of the invention

[0006] It is desirable to achieve a solution for the conflict of objectives between the goal of high availability of control variables and sensor data and the goal of integrity and authenticity of control variables and sensor data.

[0007] This is achieved by the method and the device and the vehicle and the computer program according to the independent claims.

[0008] The method for secure, highly available transmission of messages, in particular in a steer-by-wire steering system of a vehicle, provides that on a preferably redundant, private data bus, which connects a first control unit, in particular a control unit of an operating element, preferably of a steering wheel actuator, and a second control unit, in particular a control unit of a drive, preferably of a rack and pinion drive, for communication, communication for transmitting messages on a first channel is secured with a message authentication code, in particular a message authentication code, wherein communication for transmitting messages on a second channel takes place without being secured with the message authentication code, wherein the messages transmit signals, wherein in a first operating state, signals from the first channel are used,and wherein, in a second operating state, signals from the second channel are used.,

[0009] The connection of control units involved in lateral vehicle guidance, for example, is realized via a private data bus, with none of the bus participants having direct connectivity to public networks. This private bus is considered a secure zone. Communication on the first channel is secured with regard to integrity / authenticity using MACs. Communication on the second channel is not additionally secured with MACs. This dual-channel data transmission is used in such a way that only the first channel is secured with regard to integrity / authenticity. This results in the fact that in the first operating state, normal operation, only data from the first channel may be used. The second channel then merely represents a fallback level for a particularly limited period of time in case the availability of the first channel should be restricted. This results in the following advantages: A bus load on the second channel decreases.

[0010] Software / hardware components used for integrity / authenticity testing do not need to be qualified according to the requirements of the Automotive Safety Integrity Level classification level ASIL D.

[0011] For the second operating state, a physical attack cannot be ruled out. However, the potential damage scenario is very manageable, as such an attack would be considered misuse, and the benefit appears minimal due to the limited timeframe. Nevertheless, the resulting residual risk must be recognized and accepted.

[0012] The duration of operation in the second operating state is, or preferably is, limited. This operating state is limited in time. This reduces the risk of a successful attack.

[0013] Preferably, the signals from the second channel are used when an error is detected, in particular an intentionally caused or accidentally occurring error, which results in no signals from the first channel being available. In the first operating state, normal operation, only signals whose integrity / authenticity can be verified via valid MACs are used. If, due to an intentionally caused or accidentally occurring error, no signals whose integrity / authenticity can be verified via valid MACs are available, unsecured signals from the second channel are used to fulfill an availability requirement.

[0014] Preferably, the error is reported. Particularly preferably, the error is reported to a central control unit of the vehicle, with a coordinated response to the error being provided by the central control unit.

[0015] To secure communication with the message authentication code, a data packet of a message to be sent can be secured with a key, the data packet being sent, and the data packet being verified with the key. These keys can be injected into the first control unit and / or the second control unit during production or generated at runtime based on a shared master secret.

[0016] It can be provided that multiple data packets for transmitting the message are secured together with the key. This is particularly advantageous for conserving computing capacity on the participating control units, but also for reducing the bus load.

[0017] It can be provided that on the private data bus, communication on at least one further channel for transmitting messages is secured with the message authentication code.

[0018] The device for the secure, highly available transmission of messages, particularly in a steer-by-wire steering system of a vehicle, provides that the device comprises a preferably redundant, private data bus, a first control unit, particularly a control unit of an operating element, preferably a steering wheel actuator, and a second control unit, particularly a control unit of a drive, preferably a rack and pinion drive. The data bus connects the first control unit and the second control unit for communication, and the device is configured to carry out the method. This device has advantages corresponding to the advantages of the method.

[0019] The vehicle includes the device and has advantages corresponding to the advantages of the device.

[0020] A computer program comprising computer-readable instructions which, when executed by a computer, execute the method. This computer program has advantages corresponding to the advantages of the method.

[0021] Further advantageous embodiments can be found in the following description and drawing. The drawing shows: Fig. 1 a schematic representation of a vehicle with a device for secure, highly available transmission of messages, Fig. 2 steps in a process for secure, highly available message transmission.

[0022] In Fig. 1 schematically shows a vehicle 100 with a device for secure, highly available transmission of messages.

[0023] The device is described in the example for the secure, highly available transmission of messages in a steer-by-wire steering system of the vehicle 100.

[0024] The device comprises a first control unit 102 and a second control unit 104.

[0025] In this example, the first control unit 102 is a control unit for an operating element, preferably a steering wheel actuator. The second control unit 104 is a control unit for a drive, preferably a rack and pinion drive.

[0026] The vehicle 100 includes at least one sensor 106 and at least one actuator 108.

[0027] One sensor 106 and one actuator 108 are each connected to one of the control units for communication, in particular via a respective data connection 109.

[0028] In the example, the control element comprises one of the sensors 106 and one of the actuators 108, in the example those connected to the first control unit 102.

[0029] In the example, the drive comprises one of the sensors 106 and one of the actuators 108, in the example those connected to the second control unit 104.

[0030] The device comprises a preferably redundant private data bus 110. The data bus 110 connects the first control unit 102 and the second control unit 104 for communication.

[0031] The data bus 110 includes a first channel 112. In the example, the first channel 112 is a bidirectional channel. The first channel 112 can also be unidirectional.

[0032] The data bus 110 includes a second channel 114. In the example, the second channel 114 is a bidirectional channel. The second channel 114 can also be unidirectional.

[0033] The first control unit 102 comprises a first primary computing device 115 and a first secondary computing device 116.

[0034] The second control unit 104 comprises a second primary computing device 117 and a second secondary computing device 118.

[0035] The first primary computing device 115 comprises a first device 119 for determining a message secured with a message authentication code for transmitting a signal.

[0036] The second primary computing device 117 comprises a second device 120 for determining a message secured with the message authentication code for transmitting a signal.

[0037] The first primary computing device 115 comprises a first device 121 for verifying a message secured with the message authentication code for transmitting a signal.

[0038] The second primary computing device 117 comprises a second device 122 for verifying a message secured with the message authentication code for transmitting a signal.

[0039] In the example, the primary computing devices are configured to communicate via the first channel 112, with messages being transmitted securely using the message authentication code. In the example, the secondary computing devices are configured to communicate via the second channel 114, with messages being transmitted without the message authentication code.

[0040] In the example, the control units are also designed to communicate via a public data bus 124.

[0041] The device is designed to carry out a method described below.

[0042] A computer program comprises computer-readable instructions which, when executed by a computer, e.g. the computing devices, carry out the method.

[0043] The method is used for the secure, highly available transmission of messages, in particular in a steer-by-wire steering system of a vehicle 100.

[0044] The method includes a step 202.

[0045] In step 202, the messages are transmitted with the signals, in particular from at least one of the sensors 106 or at least one of the actuators 108 of the vehicle 100.

[0046] Communication for transmitting the messages is secured on the first channel 112 with the message authentication code, in particular a message authentication code.

[0047] Communication for transmitting messages on a second channel 114 takes place without being secured with the message authentication code.

[0048] For example, a data packet of a message to be sent is secured with a key to secure it with the message authentication code, the data packet is sent, and the data packet is verified with the key.

[0049] It can be provided that several data packets for transmitting the message are secured together with the key.

[0050] On the private data bus 110, communication may be provided on at least one further channel for transmitting messages secured with the message authentication code.

[0051] The method includes a step 204.

[0052] In step 204, it is checked whether an error, in particular an intentionally caused or accidentally occurring error, is detected, due to which no signals are available from the first channel 112.

[0053] If no error occurs, step 206 is executed. Otherwise, step 208 is executed.

[0054] In step 206, signals from the first channel 112 are used in a first operating state. These signals are secured with respect to integrity / authenticity using MACs.

[0055] In step 208, signals from the second channel 114 are used in a second operating state. These signals are not additionally protected by MACs.

[0056] If communication on the private data bus 110 is secured on at least one further channel for transmitting messages with the message authentication code, it may be provided to initially use these instead of the signals from the second channel 114.

[0057] In one embodiment, a time period for operation in the second operating state is or will be limited.

[0058] In one embodiment, the error is reported, in particular to a central control unit of the vehicle 100.

[0059] It may be provided that a response to the fault is coordinated by the central control unit.

Claims

[1] Method for secure, highly available transmission of messages, in particular in a steer-by-wire steering system of a vehicle (100), characterized bythat on a preferably redundant, private data bus (110) which connects a first control unit (102), in particular a control unit of an operating element, preferably of a steering wheel actuator, and a second control unit (104), in particular a control unit of a drive, preferably of a rack and pinion drive, for communication, communication for transmitting messages on a first channel (112) is secured with a message authentication code, in particular a message authentication code, wherein communication for transmitting messages on a second channel (114) takes place without being secured with the message authentication code, wherein the messages transmit signals, in particular from a sensor (106) or an actuator (108) of the vehicle (100) (202), wherein in a first operating state, signals from the first channel (112) are used (206),and wherein in a second operating state signals from the second channel (114) are used (208)., [2] Method according to claim 1, characterized by that a period of time for operation in the second operating state is or is limited (208). [3] Method according to one of the preceding claims, characterized by that the signals from the second channel (114) are used when an error, in particular an intentionally caused or accidentally occurring error, is detected (204), due to which no signals from the first channel (112) are available. [4] Method according to claim 3, characterized by that the error is reported (208) to a central control unit of the vehicle (100), wherein a reaction to the error is coordinated by the central control unit. [5] Method according to one of the preceding claims, characterized byin that, in order to secure the communication with the message authentication code, a data packet of a message to be sent is secured with a key (202), wherein the data packet is sent, and wherein the data packet is verified with the key. [6] Method according to claim 5, characterized by that several data packets for transmitting the message are secured together with the key (202). [7] Method according to one of the preceding claims, characterized by that on the private data bus (110) communication on at least one further channel for transmitting messages is secured with the message authentication code (202). [8] Device for the secure, highly available transmission of messages, in particular in a steer-by-wire steering system of a vehicle (100), characterized bythat the device comprises a, preferably redundant, private data bus (110), a first control unit (102), in particular a control unit of an operating element, preferably of a steering wheel actuator, and a second control unit (104), in particular a control unit of a drive, preferably of a rack and pinion drive, wherein the data bus (110) connects the first control unit (102) and the second control unit (104) for communication, and wherein the device is designed to carry out the method according to one of claims 1 to 7. [9] Vehicle (100), characterized by that the vehicle (100) comprises the device according to claim 8. [10] Computer program, characterized by that the computer program comprises computer-readable instructions, when executed by a computer, the method according to one of claims 1 to 7 takes place.

Images