Access control to a motor vehicle

Abstract

A method (200) for controlling access to a motor vehicle (105) comprises the steps of creating a digital key for a friend device (115) to access the motor vehicle (105); signing the created key by an owner device (110) of the motor vehicle (105); transmitting a tracking request for the signed key to a tracking service (125); transmitting a tracking response from the tracking service (125) to the friend device (115), wherein the tracking response includes encrypted information from the tracking service (125); and presenting the encrypted information by the friend device (115) to the motor vehicle (105). The tracking response includes additional information that the tracking service (125) has obtained from a manufacturer service (120) regarding the tracking request.

Description

[0001] The present invention relates to access control for a motor vehicle. In particular, the invention relates to access control using a digital vehicle key.

[0002] Access to a motor vehicle can be secured using a digital key. The digital key can be stored on a device. The device and the motor vehicle can mutually authenticate each other, and a request to use a predetermined function of the motor vehicle can be executed upon successful authentication. More specifically, mutual authentication can preferably be based on an asymmetric cryptographic encryption method, in which a pair of private and public cryptographic keys is assigned to the device and the motor vehicle.

[0003] The owner can pass on authorization to use the entire vehicle or just a predetermined function to a friend. To create a valid key for the friend, a predetermined exchange process can be carried out. This involves communication with a central authority that can manage keys for the vehicle. A tracking service can be implemented to document at what time which keys with authorizations for which functions of a vehicle were active. If a key is to be passed on from an owner to a friend, it can be deposited or documented with the tracking service. A newly created key can only become valid once the tracking service has confirmed the key.

[0004] At the time of authentication of the friend to the vehicle, it may be advantageous for certain additional information from the external party to be already available on the vehicle. To do this, the external party can send the additional information to the vehicle in encrypted form. However, direct communication between the external party and the vehicle may not be possible before the newly generated key is to be used, for example, due to a wireless connection failure.

[0005] One object underlying the present invention is to provide a method by which additional information from the external location can be securely transmitted to the motor vehicle. The method achieves this object by means of the subject matter of the independent claims. Subclaims specify preferred embodiments.

[0006] For the sake of simplicity, the following refers to a motor vehicle communicating with a device, although strictly speaking, the communication is handled by a control device on board the motor vehicle. Communication is preferably wireless, for which one or more different wireless interfaces may be provided on the motor vehicle. A preferred data interface comprises Bluetooth (BT) or Bluetooth Low Energy (BLE); a preferred interface for positioning a device relative to the motor vehicle preferably comprises ultra-wideband (UWB). A communicating device may comprise wireless interfaces for one or both protocols.

[0007] An owner is understood herein to be a person who is assigned to the motor vehicle in a special way and who has special authorizations. These authorizations can include, in particular, the creation or signing of an additional key for the motor vehicle. There can be multiple owners of the motor vehicle at any one time. With regard to a control or exchange method described herein, the owner acts using an owner device. The owner device preferably comprises a mobile device that is personally assigned to the owner, in particular a smartphone, a smart watch, a smart band, a tablet computer or a laptop computer. In order to use the owner device for a sensitive action within the framework of a technology described herein, it may be necessary for the owner to authenticate themselves to the owner device.To do this, the owner can present a biometric feature or enter a secret code (password, PIN). Authentication can be verified by the mobile device's operating system.

[0008] A friend is defined herein as a person who is to be authorized to use the motor vehicle. Like the owner, the friend is typically a natural person. With regard to a technology described herein, the friend preferably acts using a friend device, which is preferably personally assigned to him or her, just as the owner device is to the owner. The friend can also authenticate himself or herself to his or her friend device in order to trigger a security-sensitive operation within the scope of the technology described herein.

[0009] According to a first aspect of the present invention, a method for controlling access to a motor vehicle comprises the steps of creating a digital key for accessing the motor vehicle from a friend device; signing the created key with an owner device of the motor vehicle; transmitting a tracking request for the signed key to a tracking service; transmitting a tracking response from the tracking service to the friend device; wherein the tracking response comprises encrypted information from the tracking service; and presenting the encrypted information by the friend device at the motor vehicle. The tracking response comprises additional information that the tracking service has obtained from a manufacturer service regarding the tracking request.

[0010] The manufacturer service may refer to a data management service provided by a motor vehicle manufacturer. This may contain information about the vehicle, an owner, or other relevant information. The tracking service may be required for legal or insurance reasons to document the creation, existence, or revocation of a digital key for a motor vehicle.

[0011] It was recognized that a mechanism by which the tracking service transmits release information to the friend device can be used to securely deliver additional information to the vehicle, whereas a direct connection between the manufacturer's service and the vehicle is not usable. The additional information may already be available at the vehicle before or at the exact moment of the friend device's initial authentication with the vehicle. In particular, the information may be decrypted by the vehicle before authentication with the friend device has taken place.

[0012] Digital keys or key pairs of an asymmetric cryptographic method can be used to securely transmit the additional information. Similar to the owner device, the friend device, and the vehicle, the manufacturer service and the tracking service can each be assigned a public and a private cryptographic key. In a known manner, one device can encrypt a message with the public key of another device and deliver it to the other device, even over an insecure medium. The other device can decrypt the message using its private key. All other devices cannot decrypt the message. The additional information can be encrypted by the manufacturer service or the tracking service using the vehicle's public key, so that it can only be decrypted by the vehicle itself.Information transmitted from the tracking service to the friend device can be encrypted with the friend device's public key. This allows the additional information to be transported to the vehicle via the tracking service and the friend device in a nested encryption.

[0013] It is preferred that the motor vehicle evaluate the additional information to control access of the friend device to the motor vehicle. For this purpose, it is particularly preferred that the additional information be transmitted to the motor vehicle in encrypted form, even before any authentication takes place between the friend device and the motor vehicle.

[0014] A technique described herein advantageously builds on a concept known as the digital vehicle key or digital car key. A specification for the digital car key has been published by the Car Connectivity Consortium and, at the time of writing, is version 1.1.0, dated July 20, 2022. Particular reference is made to chapters 11.8 "Key Sharing Flow: Steps," 11.9 "Owner Device OEM Server Notification," 11.10 "Key Tracking and Online Attestation Delivery," and 11.11 "Vehicle Attestation."

[0015] The additional information can be forwarded to the vehicle as part of a data transmission known as the Friend First Approach in the aforementioned standard. This is described in more detail in Chapter 19.5.8.2 of the aforementioned documentation. It is preferred that the additional information be transmitted as part of a Friend First Approach. After the corresponding steps have been performed, the friend device can be known to the vehicle, and a further Friend First Approach is usually not performed.

[0016] In one embodiment, the additional information includes an indication of a friend device's or owner device's key that has been invalidated. The motor vehicle can delete the relevant key from its internal memory.

[0017] Typically, only a finite number of memory locations are available for keys from friend or owner devices on the vehicle. To prevent all memory locations from being occupied, a key can be removed from the memory based on the indication in the additional information, making room for a new key, in particular the key for the existing friend device.

[0018] In another embodiment, the additional information comprises a device class of the friend device. Example device classes include a smartphone, a smart watch, a smart band, a laptop computer, a tablet computer, or a handheld device (fob). This additional information can be used for informational purposes, for example, controlling an icon on an output device of the motor vehicle that indicates the specified device class. In another embodiment, the device class can be taken into account to differentiate communication or sharing control. For example, a wearable computer may have less processing power than a smartphone. Cryptographic operations required of the friend device may be less complex if it is a wearable and more complex if it is, for example, a smartphone.

[0019] According to a further embodiment, the additional information comprises data that is characteristic for identifying the friend device for a predetermined user service. The friend can have multiple devices that can be used as friend devices to control the use of the motor vehicle. These devices can be synchronized with each other via a uniform user ID. The user service can, in particular, be managed by a manufacturer of the friend device. For example, for Apple devices, an Apple ID is known as the user ID. Multiple friend devices can be jointly managed via a uniform Apple ID. In particular, a digital key can be transferred from one friend device to another. The additional information can include the user ID as a cryptographic hash value. This makes it impossible to determine the user ID from the additional information.

[0020] In a further embodiment, it is assumed that each owner device of the motor vehicle is assigned a consecutive number. The additional information can include the number of the owner device that signed the key of the friend device. Access of the friend device to the motor vehicle can only be permitted if a current owner device with the consecutive number of the signing owner device is known. Thus, an additional measure can be taken to prevent a case in which the owner device with which the key of the friend device was signed loses its owner status with regard to the motor vehicle between the issuance of the key to the friend device and the first access to the motor vehicle. This can be the case, for example, if the motor vehicle is sold or the key of the owner device is declared invalid for other reasons.

[0021] According to yet another embodiment, the additional information includes an indication of a usable function of an access control method. The access control method executed between the owner device, the friend device, the motor vehicle, the manufacturer service, and the tracking service can be further developed or subject to changes. The additional information can specify a version number of a standard according to which access control is to take place. For example, a subscriber can be required to adhere to a predetermined minimum version of the standard. Conversely, if a vulnerability in a new function becomes known, the additional information can be used to enforce an older or lower version of the access control to be executed.

[0022] According to yet another embodiment, the additional information specifies an additional authentication factor required for accessing the motor vehicle. In particular, a second factor of a two-factor authentication method can be specified in this way. Such a second factor can, for example, require the entry of a transaction number on the motor vehicle, which was previously sent, for example, via SMS, to the friend's device.

[0023] The additional authentication factor can be specified in the form of a bitmap. Several additional authentication factors can be predetermined, and the additional information can include several required authentication factors. In one embodiment, several alternatively usable additional authentication factors can be specified. In another embodiment, several authentication factors can be specified, all of which are required to gain access to the motor vehicle.

[0024] According to another aspect of the present invention, a system comprises a motor vehicle, an owner device, a friend device, a manufacturer service, and a tracking service configured to perform a method described herein.

[0025] According to yet another aspect of the present invention, a tracking service is configured to receive a tracking request from a friend device; determine additional information from an external location; encrypt the additional information and transmit it to a friend device in a tracking response.

[0026] Preferably, the tracking service is also configured to store or document information about a key that is the subject of the tracking request. The tracking request concerns a digital key for a motor vehicle. Additional information can originate, in particular, from a manufacturer's service of the motor vehicle. The additional information can relate to the motor vehicle, an owner, their owner's device, a friend, or their friend's device.

[0027] The invention will now be described with reference to the attached figure.

[0028] Fig. 1 shows a system 100 for controlling access to a motor vehicle 105. The system 100 comprises the motor vehicle 105, an owner device 110, a friend device 115, a manufacturer service 120, and a tracking service 125. The owner device 110 is assigned to an owner 130, and the friend device 115 is assigned to a friend 135. The owner 130 and the friend 135 preferably comprise natural persons who are each capable of using the motor vehicle 105 in a predetermined manner. Use can, in particular, include opening a door or a hatch or driving the motor vehicle 105. The owner 130 is authorized to dispose of the motor vehicle 105 and, in particular, to pass on authorization to use the motor vehicle 105 to the friend 135.

[0029] The manufacturer service 120 can be operated by a manufacturer of the motor vehicle 105. The manufacturer can also be called an OEM, and the manufacturer service 120 can also be referred to as an OEM server 120. Information about the motor vehicle 105 and one or more persons assigned to it can be stored in the manufacturer service 120. The tracking service 125 has the task of tracking and documenting keys with which the motor vehicle 105 can be used. The tracking service 125 can also be referred to as a key tracking server. It should be noted that the names used herein are based on the aforementioned Digital Car Key standard. Correspondence to the names or terms used therein is intended.

[0030] Fig.1 also shows a method 200 for controlling access to the motor vehicle 105. Method steps are represented as arrows between elements of the system 100. The method 200 can be part of an access control system described in the context of the Digital Car Key. It is proposed to expand the access control system described in the standard by transmitting additional information in the method 200 described below.

[0031] In a step 205, the owner 130 can transmit to the friend 135 a configuration containing information about which motor vehicle 105 is to be used and in what manner with a digital key to be created.

[0032] In a step 210, the friend device 115 can generate a key that corresponds to the transferred configuration. In a step 215, the generated key can be transmitted from the friend device 115 to the owner device 110 for signing.

[0033] In a step 220, the owner device 110 of the owner 130 can digitally and cryptographically sign the transmitted key of the friend device 115. In a step 225, the owner device 110 can transmit an import request along with an attestation package to the friend device 115. The attestation package can contain information about which further steps must be performed by the friend device 115 to make the generated key valid.

[0034] In a step 230, the friend device 115 can send the attestation package together with a tracking request to the tracking service 125. The tracking service 125 can inform the manufacturer service 120 of the received tracking request in a step 235. Then, in a step 240, predetermined data relating to the key of the friend device 115 can be exchanged between the manufacturer service 120 and the tracking service 125. In a step 245, the tracking service 125 can sign the created key of the friend device 115 and store additional information that the tracking service 125 has received from the manufacturer service 120 in a predetermined storage area of ​​the digital key. With regard to the digital car key, a private mailbox or a confidential mailbox can be used as such a storage area. In addition, the tracking service 125 can store information about the created orSave the signed key.

[0035] In a step 250, the key, along with the additional information obtained from the manufacturer service 120, can be transmitted from the tracking service 125 to the friend device 115. Concurrently, in a step 255, the manufacturer service 120 can transmit the additional information directly to the motor vehicle 105. Note that this step may not be able to be performed before the friend 135 attempts to use the motor vehicle 105 with the friend device 115.

[0036] In a step 260, the friend device 115 enters communication distance with the motor vehicle 105. Information can be exchanged, which may include an identification of the key of the friend device 115 and the aforementioned additional information. Such an initial data transfer is known in the Digital Car Key Standard as the Friend First Approach. It should be noted that actual authentication between the friend device 115 and the motor vehicle 105 can only occur later, after the additional information from the key's private or confidential mailbox has already been forwarded to the motor vehicle 105.

[0037] In a step 265, the received additional information can be evaluated on board the motor vehicle 105. Subsequently, access control of the friend device 115 to the motor vehicle 105 can be controlled depending on the transmitted additional information.

[0038] In the following, additional information is described once again in summary, which can advantageously be transmitted to the motor vehicle 105 via the tracking service 125 and the friend device 115. 1.) Specify a cryptographic key that is stored in an internal memory of the motor vehicle 105 and that is to be deleted. The memory contains keys of known devices and has a limited number of storage locations for such keys. 2.) Specify a device class of a friend's device 115 on which a key for using the motor vehicle 105 is stored. Example device classes include wearable, smartphone, or personal computer. 3.) Specify one or more additional factors to be used to activate or use the key. This information can be implemented as a bitmap, allowing one or more of the predetermined factors to be specified. 4.) Hash value of a user ID of friend 135. The user ID can refer to a service, operating system, or mobile device 115 of friend 135. Can be used to group stored keys of friend 135 together. 5.) Sequence number of the owner 130 who signed the key of the friend 135. If a new owner 130 joins the motor vehicle 105, they receive a new sequence number. If an owner 130 leaves, their key is deleted. Can be used as an additional measure to prevent the use of a key belonging to a friend 135 whose signing owner 130 has since left. 6.) Specify features or functions to be used or not to be used. In one embodiment, specify a minimum and / or maximum version number of a standard according to which access control with a digital key should be implemented. Reference symbol 100 systems 105 Motor vehicle 110 Owner device 115 friend device 120 Manufacturer Service (OEM Server) 125 Tracking Service (Key Tracking Server) 130 owners 135 friend 200 procedures 205 Request to generate a key, with configuration 210 Friend device generates key with entitlement 215 Request to sign the key 220 Owner device signs key 225 Import request with attestation package 230 Friend device sends tracking request to tracking service 235 Tracking service notifies manufacturer service 240 Exchange of shared data regarding the key 245 Tracking service signs key with additional information and saves the key 250 Tracking response: Send signature and additional information to friend device 255 Signature with additional information from the manufacturer's service to the vehicle 260 First contact of the friend device with the motor vehicle 265 Evaluate additional information

Claims

[1] Method (200) for controlling access to a motor vehicle (105); the method (200) comprising the following steps: - creating (210) a digital key for accessing a friend device (115) to the motor vehicle (105); - signing (220) the created key by an owner device (110) of the motor vehicle (105); - transmitting (230) a tracking request for the signed key to a tracking service (125); - transmitting (250) a tracking response from the tracking service (125) to the friend device (115); - wherein the tracking response comprises encrypted information of the tracking service (125); and - presenting (260) the encrypted information by the friend device (115) on the motor vehicle (105); - wherein the tracking response comprises additional information that the tracking service (125) has obtained (240) from a manufacturer service (120) regarding the tracking request. [2] Method (200) according to claim 1, wherein the motor vehicle (105) evaluates (265) the additional information in order to control access of the friend device (115) to the motor vehicle (105). [3] The method (200) of claim 1 or 2, wherein the additional information includes an indication of an invalidated key of a friend device (115) or owner device (110); and wherein the motor vehicle (105) deletes the relevant key from an internal memory. [4] Method (200) according to one of the preceding claims, wherein the additional information comprises a device class of the friend device (115). [5] Method (200) according to one of the preceding claims, wherein the additional information comprises data which is characteristic for an identification of the friend device (115) in a predetermined user service. [6] The method (200) of claim 5, wherein the user service is maintained by a manufacturer of the friend device (115). [7] Method (200) according to one of the preceding claims, wherein owner devices (110) of the motor vehicle (105) are each assigned a consecutive number; wherein the additional information comprises the number of the owner device (110) that signed the key of the friend device (115); wherein access of the friend device (115) to the motor vehicle (105) is only permitted if a current owner device (110) with the consecutive number of the signing owner device (110) is known. [8] Method (200) according to one of the preceding claims, wherein the additional information comprises an indication of a usable function of a method (200) for access control. [9] Method (200) according to one of the preceding claims, wherein the additional information indicates an additional authentication factor required for access to the motor vehicle (105). [10] The method (200) of claim 9, wherein a plurality of additional authentication factors are predetermined and the additional information comprises a plurality of required authentication factors. [11] A system comprising a motor vehicle (105), an owner device (110), a friend device (115), a manufacturer service (120) and a tracking service (125) configured to carry out a method (200) according to any one of the preceding claims. [12] Tracking service (125) configured to receive a tracking request from a friend device (115); determine additional information from an external location; encrypt the additional information and transmit it to a friend device (115) in a tracking response.

Images