Method for verifying the integrity of a data processing device of a vehicle system

Abstract

The invention relates to a method for verifying the integrity of an electronic data processing device (10) in a vehicle system (12), comprising: i) a vehicle (14), ii) one or more system vehicle tires (16a-f) arranged on the vehicle (14), each comprising one or more electronic sensor units (18a-f), iii) a data processing device (10) arranged in or on the vehicle (14), with stored configuration information, and iv) a data processing system (20) separate from the vehicle (14), with stored reference information, comprising the method steps: a) transmitting tire information to the data processing device, b) processing the tire information, and the method step: d) comparing the configuration information with the reference information by the data processing system (20) or the data processing device.Depending on whether the comparison yields a match or not, one or more reaction measures are triggered.

Description

The invention relates to a method for verifying the integrity of an electronic data processing device in a vehicle system, to a method for modifying the configuration of the electronic data processing device in a vehicle system which is linked thereto, and to a vehicle system which is designed for use in such methods.Progressive technical development and increasing digitalization also relate in particular to the field of vehicle technology and vehicle tires. There is continuing interest in continually capturing performance data for the components deployed in vehicles to continuously monitor performance and operational safety, for example. Information that can be monitored on vehicle tires includes, for example, tire pressure, tire temperature, or acceleration experienced by the vehicle tire during operation.In most cases, such information is obtained by a sensor system installed in the vehicle tire, for example by using acceleration sensors, pressure sensors or temperature sensors, wherein the data obtained in this way can be used, for example, to predict or calculate the physical state of the vehicle tire, for example the already occurring abrasion or the subsequent resurfacing capability.The tire sensors installed in vehicle tires must be configured for the respective intended use and for communication with the further components of the vehicle and, for this purpose, comprise, for example, suitable software which regulates the operation of the individual components of the sensor unit, the processing of the sensor data and the communication with external transmitters and receivers. These external receivers, which are sometimes also referred to as control units and which collect the sensor data transmitted by the tire sensors during operation in order to process them, are regularly arranged on or in the vehicle.In the course of an increasing awareness of the relevance of cybersecurity, the risk of an impermissible manipulation of the tire sensors or of the measured values stored thereon as well as a manipulation of the data transmission and processing is increasingly coming into the focus of interest. Given the increasing relevance of the corresponding data captured by tire sensors in controlling and optimizing operation of vehicles, as well as the increasing importance in documentation of the loads experienced by vehicle tires, a corresponding manipulation may cause significant damage. In particular in tire pressure monitoring systems, it is important that a possible large pressure drop is reliably detected.In this case, different parts of the data acquisition and data transmission are susceptible to tampering attempts in different ways, wherein targeted securing measures can be taken in each case, for example by encrypting the communication between the tire sensors and the control device.In particular in many commercial vehicles, for example trucks, the control units are relatively easily accessible from the outside or can be addressed using wireless communication at least in the short range. A manipulation of the control unit can result in printing warnings no longer being detected. It is therefore important to recognize and optionally prevent such a manipulation. The solutions known from the prior art are thus perceived as disadvantageous in many cases.The primary object of the present invention was to eliminate or at least reduce the disadvantages of the prior art.In particular, it was the object of the present invention to specify a method for verifying the integrity of an electronic data processing device, which is part of a system for monitoring tyres, in a vehicle system, with which method the integrity of the corresponding electronic data processing device can be reliably verified in order to ensure the trustworthiness of the tyre information processed therewith.In this case, it was an object of the present invention that the method to be specified should be implementable as easily as possible, in particular also using components which are already in use today in modern vehicles.It was a further object of the present invention that the method should be able to be executed as energy-saving as possible, so that the energy requirement of the data processing devices involved therein should be as low as possible. In addition, it was an object of the present invention that the method should desirably also be as data-saving as possible, so that possible costs for the data transmission can be minimized.Moreover, it was an object of the present invention that the method to be specified should desirably be able to prevent an unauthorized manipulation of the electronic data processing device, wherein it was particularly desirable that the method to be specified should enable automatic recovery of the correct state.It was a further object of the present invention, based on the method to be specified for verifying the integrity of the electronic data processing device, to additionally provide a method for changing the configuration of the electronic data processing device in a corresponding vehicle system, with which method the configuration of the electronic data processing device can be changed in a controlled manner by an authorized user, so that the corresponding securing mechanisms can be bypassed.It was also an object of the present invention to provide a vehicle system which is optimized for use in the method to be specified.The inventors of the present invention have now found that the above-described objects can be achieved if, in addition to the configuration information of the vehicle-side data processing device, reference information about the configuration of the vehicle-side data processing device is also stored in an electronic data processing system separate from the vehicle, and the corresponding configuration information or reference information is exchanged between the vehicle-side data processing device and the separate data processing system in such a way that they can be matched with one another, such that one or more suitable reaction measures can be triggered in the vehicle system depending on whether this matching results in a match or not, as defined in the claims.The above objects are thus achieved by the subject matter of the invention as defined in the claims. Preferred embodiments according to the invention are evident from the dependent claims and the following explanations.Such embodiments, which are referred to below as preferred, are combined in particularly preferred embodiments with features of other embodiments referred to as preferred. Combinations of two or more of the embodiments referred to below as particularly preferred are thus very particularly preferred. Also preferred are embodiments in which a feature of one embodiment designated as preferred to any extent is combined with one or more further features of other embodiments designated as preferred to any extent. Features of preferred vehicle systems result from the features of preferred methods.Particularly preferred embodiments of the invention are disclosed in the exemplary embodiments. Particularly preferred embodiments of the invention have correspondingly two or more, preferably three or more, very particularly preferably four or more, of the preferred features of the invention disclosed below, which are also realized in the exemplary embodiments.The invention relates to a method for verifying the integrity of an electronic data processing device in a vehicle system, comprising:i) a vehicle,ii) one or more system vehicle tires arranged on the vehicle, each comprising one or more electronic sensor units for detecting tire information of the system vehicle tires,iii) an electronic data processing device arranged in or on the vehicle, having a first memory unit and configuration information stored thereon about the configuration of the data processing device, andiv) an electronic data processing system separate from the vehicle, having a second storage unit and a reference information item stored thereon about the configuration of the data processing device, iv, comprising the method steps: a) transmitting the tire information recorded by the sensor units to the data processing device, b) processing the transmitted tire information with the data processing device and / or the data processing system, and the method steps:c) transmitting the configuration information from the data processing device to the data processing system and / or the reference information from the data processing system to the data processing device by means of a transmission signal using a wireless data transmission method, andd) matching the configuration information with the reference information by the data processing system or the data processing device, wherein one or more reaction measures are triggered depending on whether the comparison yields a match or not.The method according to the invention serves for verifying the integrity of an electronic data processing device in a vehicle system, i.e. for checking whether the corresponding data processing device and the software running thereon are free from manipulations.The method is executed on a vehicle system that initially includes a vehicle. It can be seen as an advantage of the method according to the invention that it can be adapted efficiently to all possible types of vehicles. By way of example, a method according to the invention is provided, wherein the vehicle is a commercial vehicle or a bus, preferably a commercial vehicle, particularly preferably a truck.According to the invention, the vehicle comprises one or more system vehicle tires arranged on the vehicle. The expression "system vehicle tires" expresses that they are vehicle tires which, by virtue of the specific configuration, are suitable for the interaction in the vehicle system or in the method according to the invention. In principle, advantages can be achieved with the method according to the invention even if only one of the vehicle tires of the vehicle is designed as a system vehicle tire. However, the skilled person inevitably understands that for the widely predominant number of applications in practice it will be preferable to equip the vehicle as extensively as possible with system vehicle tires which can be used in the method according to the invention. A method according to the invention is preferred accordingly, wherein the vehicle system comprises two or more, preferably four or more, system vehicle tires arranged on the vehicle, wherein particularly preferably all vehicle tires of the vehicle are system vehicle tires.A method according to the invention is generally preferred, wherein the system vehicle tires are pneumatic vehicle tires. In addition or alternatively, a method according to the invention is preferred, wherein the sensor units are arranged at least partially, preferably predominantly, particularly preferably all, in the interior of the vehicle tire, preferably on the tire inner layer of a vehicle tire designed as a pneumatic vehicle tire, particularly preferably in the radial direction below the tread.The suitability of the system vehicle tires for use in the method according to the invention arises in particular from the fact that they each comprise one or more electronic sensor units with which sensor data can be acquired. This sensor data is referred to as "tire information" within the scope of the present invention. It can be seen as an advantage of the present invention that for sensor mounting of the system vehicle tires, a wide range of electronic sensor units can be used, which is already used today in the prior art. In addition to acceleration and deformation sensors, temperature sensors and pressure sensors are particularly important. Among the possible sensor units, a particular importance is attributed in particular to the pressure sensors because of the high driving safety relevance, so that particularly pronounced advantages of the method according to the invention result in particular when the system vehicle tires comprise pressure sensors. A method according to the invention is preferred accordingly, wherein the electronic sensor units are selected from the group consisting of temperature sensors for detecting the tire temperature, acceleration sensors for detecting the experienced acceleration, pressure sensors for detecting the tire pressure and deformation sensors for detecting the tire deformation, preferably selected from the group consisting of temperature sensors for detecting the tire temperature, acceleration sensors for detecting the experienced acceleration and pressure sensors for detecting the tire pressure, particularly preferably selected from the group consisting of acceleration sensors for detecting the experienced acceleration and pressure sensors for detecting the tire pressure, very particularly preferably selected from the group consisting of pressure sensors for detecting the tire pressure.By using a plurality of sensor units per system vehicle tire, very comprehensive data about the system vehicle tires can be obtained in an advantageous manner. This makes it possible in particular to create a broad data basis, on the basis of which, for example, the control of the vehicle can be optimized or the state of the vehicle tires can be evaluated. A method according to the invention is therefore preferred, wherein the system vehicle tires each comprise two or more, preferably three or more, electronic sensor units. A method according to the invention is particularly preferred in this case, wherein the sensor units of the system vehicle tires are each integrated into a single component.A combination of sensor units which has proven to be particularly advantageous for use in the method according to the invention is the combination of the use of an acceleration sensor with a pressure sensor. While the pressure sensor serves to detect the tire pressure that is particularly relevant to safety, the acceleration sensor can be used to register the start of the vehicle, for example. This makes it possible to identify reference points in the movement behavior of the vehicle, on the basis of which the execution of method steps c) and d) can be carried out. A method according to the invention is therefore preferred, wherein the system vehicle tires each comprise at least one acceleration sensor for detecting the experienced acceleration and at least one pressure sensor for detecting the tire pressure.In addition to the specifically equipped system vehicle tires, the vehicle system also includes an electronic data processing device, which is also referred to as a "control unit" in many cases by the skilled person. According to the invention, this control device is arranged in or on the vehicle and correspondingly moves with the vehicle. Particularly great advantages of the method according to the invention are obtained in cases in which the vehicle-side data processing device is arranged outside the vehicle in such a way that it is relatively easily accessible from the outside. A corresponding arrangement provides advantages in particular in the management of fleets of commercial vehicles, since the control units are accessible comparatively without problems to the fleet operators. At the same time, however, this type of arrangement also increases the risk of unintentional manipulation, for example on a freeway stop, with the result that the advantages of the method according to the invention are particularly pronounced. A method according to the invention is thus conceivable, wherein the electronic data processing device is arranged in the interior of the vehicle. However, a method according to the invention is preferred, wherein the electronic data processing device is arranged on the vehicle, wherein the electronic data processing device is preferably accessible from outside the vehicle.In the method according to the invention, the tire information recorded by the sensor units is transmitted to the data processing device, as is also known in principle from the prior art in the case of corresponding systems. Even if it would theoretically be possible to transmit the corresponding tire information to the data processing device via a corresponding cable, the production and long-term securing of such a signal-conducting connection to the sensor units arranged in the vehicle tire is very challenging in many cases. For this reason, it is preferred for the widely predominant number of applications that the system vehicle tires comprise means for wireless communication, in particular as part of the electronic sensor units or of a sensor system formed by the electronic transmitter units. A method according to the invention is accordingly preferred, wherein the system vehicle tires comprise an electronic transmission unit for transmitting signals in the wireless communication method. A method according to the invention is particularly preferred, wherein the wireless communication method is a radio method, preferably using a frequency of 433 MHz or of Bluetooth. A method according to the invention is preferably correspondingly analogous, wherein the electronic data processing device comprises an electronic receiving device for receiving signals in the wireless communication method.The tire information transmitted in method step a) corresponds to the measurement parameters that can be detected by the electronic sensor units. Additionally or alternatively, the transmitted tire information can also contain information about which tires they originate from, for example, via an identification of the sensor units, and / or the position of the system vehicle tires in the tire plan of the vehicle. Preferably, a method according to the invention is provided, wherein the one or more transmitted tire information items are selected from the group consisting of the tire pressure, the tire deformation, the acceleration experienced by the sensor unit and the tire temperature. In addition or alternatively, a method according to the invention is preferred, wherein the one or more transmitted tire information items comprise assignment information items about the assignment of the transmitted tire information items to the tire positions of the vehicle.Up to this point, the vehicle-side components of the vehicle system have been defined. In addition, however, the vehicle system also comprises an electronic data processing system which is not arranged in or on the vehicle but rather is separate therefrom. This external data processing system can be used in the method according to the invention both in the course of verifying the integrity via the reference information, as is described below, and contribute to the processing of the transmitted tire information. The clarification that this is a "system" expresses that the different contributions of the data processing system can in principle also be made by different data processing devices, so that the corresponding verification does not have to be carried out by the same computing units as a possible processing of tire information. A method according to the invention is preferred, wherein the electronic data processing system comprises a server and / or a cloud. In addition or alternatively, a method according to the invention is preferred, wherein the electronic data processing system is part of a fleet management system, preferably of a tire pressure monitoring system of a fleet management system. In addition or alternatively, a method according to the invention is also preferred, wherein the electronic data processing system comprises two or more electronic data processing devices connected to one another in a network.The method according to the invention presupposes that the vehicle-side data processing device can communicate with the external data processing system, which is carried out according to the invention by a wireless data transmission method. This is thus a method according to the invention, wherein the electronic data processing device comprises an electronic transmission device for transmitting signals in the wireless data transmission method.Even if it would theoretically be conceivable for the methods according to the invention to be carried out only with short-range data transmission methods, the inventors consider as preferred for essentially all embodiments if the communication between the data processing device and the data processing system takes place with long-range communication methods, in particular such radio methods which rely on transmission towers and / or satellites. A method according to the invention is accordingly preferred, wherein the wireless data transmission method is a radio method, preferably a mast-based radio method and / or a satellite-based radio method, particularly preferably a mobile radio method.From the cybersecure aspect, wireless communication between the data processing device and the data processing system is a potential weakness. For this reason, the inventors propose that, in order to increase the security for the data transmission method, recourse should be made to an encrypted method, for example an encrypted mobile radio method, which cannot be read out and / or manipulated easily by third parties. A method according to the invention is thus preferred, wherein the wireless data transmission method is an encrypted data transmission method, preferably an encrypted mobile radio method.Since the method according to the invention already performs a communication capability between the vehicle-side data processing device and the data processing system, the transmitted tire information can be processed at least partially by the data processing system, i.e. centrally, for example, in the cloud or within the scope of a tire management system. For this purpose, the power requirements on the vehicle-side data processing device are advantageously reduced and the fleet managers are enabled to understand the recorded data as much as possible in real time. In this case, it is possible in principle for the tire information provided from the system vehicle tires to be preprocessed in the vehicle-side data processing device, for example by changing the file format or the data structure, so that values derived therefrom are obtained, which, in the context of the present invention, does not change anything that is the tire information in accordance with the expert understanding. In other words, the term "tire information" also includes information which is generated therefrom within the scope of the data processing. A method according to the invention is thus basically conceivable, wherein the transmitted tire information is processed with the data processing device. However, a method according to the invention is preferred, wherein the transmitted tire information is processed using the data processing system. In addition or alternatively, a method according to the invention is preferred, wherein the one or more items of tire information transmitted to the data processing device are transmitted further to the data processing system by means of a wireless data transmission method.The above explanations are concerned in particular with the vehicle system to be used and the transmission of the tire information recorded in the system vehicle tires by the sensor units between the various components of the vehicle system. The integrity of the electronic data processing device is verified in the method according to the invention, in particular in method steps c) and d).The starting point of this part of the method is configuration information which is stored on a first memory unit which is assigned to the electronic data processing device. The configuration information is information correlated with the current configuration state of the data processing device. This configuration information can in principle be of any desired detail, it also being conceivable, at least in theory, to use the complete software and data status of the data processing device as configuration information. Since the corresponding configuration information or a reference information complementary thereto has to be transmitted at least once in the method according to the invention by means of a wireless data transmission method, it is, however, particularly preferred in substantially all embodiments to abstract the configuration information in a certain manner in order to keep the amount of data to be exchanged as small as possible.In principle, it is conceivable to focus on the integrity of the software of the data processing device and to specify as configuration information a "checksum", which can be calculated using an algorithm from the entirety of the software configuration. However, this focus on the operating software leads to the possibility that a manipulation which only exists in the stored data could remain unnoticed. In particular, changes to the tire assignment stored in the data processing device represent a risk for an undesired manipulation, for which reason it is preferred to include this information in the configuration information additionally or alternatively. Thus, a method according to the invention is preferred first, wherein the configuration information comprises information about the version of the operating software of the data processing device. In addition or alternatively, a method according to the invention is preferred, wherein the configuration information comprises or consists of information about the layout of the vehicle system stored in the data processing device, wherein the configuration information preferably comprises or consists of information about the assignment of the system vehicle tires or the sensor units to the tire locations of the vehicle stored in the data processing device, preferably in the form of the assignment of identification information of the system vehicle tires or the sensor units to the tire locations of the vehicle.A particularly advantageous and energy-efficient configuration of the configuration information can be obtained after the inventors have estimated that the configuration information is acquired in the form of a change counter whose numerical value is incremented upon each change, for example on the software or else on the stored data, for example on the tire assignment, in order in this way to acquire the mere number of change processes. A method according to the invention is therefore preferred, wherein the configuration information comprises or consists of information about the number of changes to the configuration of the data processing device that have previously taken place, preferably in the form of a counter, wherein the counter is preferably incremented upon each change.The electronic data processing system separate from the vehicle comprises a second storage unit on which reference information is stored. This reference information also correlates with the configuration of the data processing device of the vehicle and corresponds in particular to the configuration information at a previous point in time at which the configuration was last defined as correct, preferably to the most recent configuration of the data processing device which was defined as correct. The person skilled in the art understands in this respect that the reference information correlates with the configuration information, in particular in that it relates to the same aspects which are also contained in the configuration information, wherein it is expedient for avoiding conversions if the reference information is stored in the same data format as the configuration information.The reference information stored in the second storage unit serves as an evaluation scale as to whether an unauthorized manipulation has occurred. For this reason, the inventors have considered that it is particularly preferable in view of maximizing cybersecurity if the reference information on the second storage unit is comprehensively protected against an unauthorized change. A method according to the invention is namely preferred, wherein the second storage unit is a storage unit secured against unauthorized access, wherein the second storage unit is preferably secured against unauthorized access by a password and / or a digital key and / or a multi-factor authentication.In method step c), the configuration information or the reference information is now exchanged in such a way that either the data processing device or the data processing system has both information available in order to carry out the following step d). The inventors have recognized that it is particularly preferred to implement the method according to the invention in a resource-saving manner, in particular in a data-saving manner, and propose for this purpose that the length of the transmission signal used for the data exchange should be kept as short as possible, which is advantageously possible by the above-described configurations of the configuration information or reference information. A method according to the invention is thus preferred, wherein the transmission signal consists of 1 to 8 bytes, preferably 4 to 8 bytes.Preference is given in principle to a method according to the invention, wherein at least the method steps c) and d) are repeated at time intervals.In order to carry out the method according to the invention in a manner as resource-saving as possible and at the same time ensure high security against manipulation, the inventors propose that a mean path should be found between a frequent execution of the method, by means of which high security against manipulation is ensured, and a rare execution of the method, by means of which the required resources are minimized. A particularly good solution to the conflict of goals in this respect can be achieved according to the inventors' judgment if the corresponding data transmission is coupled to a predetermined triggering criterion. A method according to the invention is preferably accordingly provided, wherein the transmission in method step c) takes place when the vehicle system establishes the occurrence of a predetermined triggering criterion.In a particularly simple embodiment, the method according to the invention can be carried out at predetermined time intervals, for example daily. In this case, a method according to the invention is thus preferred, wherein the predetermined triggering criterion is a time-based triggering criterion, preferably the elapse of a predetermined time since the transmission of the last status signal and / or the reaching of a predetermined time.As particularly preferred, the inventors contemplate that the triggering criterion is selected such that a verification of the vehicle-side data processing device takes place for predetermined states of the vehicle, in particular when the ignition is actuated and / or the vehicle starts, wherein the latter can also take place in a particularly efficient manner by observing the acceleration values detected by acceleration sensors arranged in the vehicle tires. A method according to the invention is thus preferred, wherein the predetermined triggering criterion is a change of state on the vehicle, preferably the activation of the vehicle. In addition or alternatively, a method according to the invention is preferred, wherein the predetermined triggering criterion is dependent on at least one of the detected items of tire information, preferably at least on the acceleration, wherein the predetermined triggering criterion preferably indicates or correlates with the starting of the vehicle.A further advantageous embodiment, which can be set additionally or alternatively to the other triggering criteria, is to implement a request-based verification in which method steps c) and d) according to the invention are carried out as a result of a request signal, which can be triggered manually, for example, by the fleet manager, in order to verify the authenticity of the data processing device if necessary. In this case, a method according to the invention is preferred, wherein the predetermined triggering criterion is the reception of a request signal by the data processing device, wherein the request signal is preferably transmitted by the data processing system.In method step d), the configuration information is matched to the reference information, either in the data processing device or, preferably, in the external data processing system. Within the scope of the present invention, the matching of the two items of information can also be carried out partially indirectly by comparing the configuration information or the reference information with a value which was derived from the respective other information. In accordance with the expert's understanding, this may be necessary, for example, if the configuration information and the reference information still have to be brought into the same data format first, even if such a design is less preferred. In addition, it is clear to the person skilled in the art to convert the configuration information and or the reference information by further data processing operations before the comparison. Accordingly, the above defined feature is to be broadly construed to the effect that the matching is performed in a suitable form in such a way that the performed matching allows an assessment as to whether or not the configuration information currently present on the data processing device matches the reference information stored in the data processing system.Depending on whether or not the comparison indicates a match between the configuration information and the reference information, one or more reaction measures are triggered in the method according to the invention. In principle, it is conceivable in this case to trigger a reaction measure if the comparison produces a match and accordingly no manipulation is present. In such cases, it can be indicated, for example, by a green light in a display device that everything is in order. In particular, as a reaction measure, it can be provided that the transmitted tire information is identified as being trusted, for example for the purpose of storage, so that it can be maintained that there is no risk of the control unit being manipulated for the latter. A corresponding identification can be made, for example, for all tire information recorded since the last execution of the method according to the invention. A method according to the invention is thus conceivable, wherein the one or more reaction measures are triggered if the comparison results in a match. A method according to the invention is preferred, wherein the one or more reaction measures comprise the marking of the previously transmitted and / or future transmitted tire information as trusted.Even if, as explained above, it is conceivable in principle to trigger a reaction measure even in the case of successful comparison, it will be particularly relevant in practice to trigger reaction measures when the comparison shows that a manipulation is likely, for example because the "checksum" does not match and / or an incremental counter is at the wrong value, with a view to a method management which is as unnecessary as possible, which the vehicle drivers and fleet managers wish to provide only relevant information. A method according to the invention is accordingly preferred, wherein the one or more reaction measures are triggered if the comparison does not result in a match.The inventors propose that in this case in particular information about the possible manipulation state should be output, in particular by means of a suitable warning. A method according to the invention is preferred, wherein the one or more reaction measures comprise the output of a warning signal, preferably an acoustic warning signal and / or optical warning signal, particularly preferably an optical warning signal, very particularly preferably via a display device of the data processing device. In addition or alternatively, a method according to the invention is preferred, wherein the one or more reaction measures comprise sending a warning message to one or more recipients by means of electronic communication, preferably by means of e-mail or a short message service, in particular by means of SMS.Additionally or alternatively to outputting a warning, the reaction measure can consist in the data processing device being put into a fault state. In such a fault state, the data processing device can be suitably prevented from the recorded tire data being able to be used easily and / or at least identified as unreliable, wherein in principle complete blocking of the processing and / or transmission is also conceivable. This configuration about the initiation of a fault condition is, as contemplated by the inventors, in many cases preferable to the use of automatic corrective action that attempts to restore the original configuration condition. This is because in practice it is a non-unlikely scenario that the configuration change made and detected has actually been intentionally made and should be authorized, but the necessary adaptation of the reference information is preferred. The triggering of an error state makes it possible to check whether the detected manipulation was not actually authorized, in order to adjust the reference information subsequently, if necessary. A method according to the invention is thus preferred, wherein the one or more reaction measures comprise putting the data processing device into a fault state, wherein the data processing device in the fault state is prevented from processing the tire information in the provided manner, in particular is prevented from displaying and / or evaluating and / or transmitting the tire information.The above-described configuration with the fault state is advantageous in particular when it is to be assumed in practice that changes to the configuration will occur from and to planned changes. In particular in cases in which changes to the configuration are rather rare, however, and / or are to be installed globally via the data processing system, as disclosed below, it is also considered preferable, however, to provide an automatic reverting of the configuration state to the last verified configuration stored in the data processing system, in order to implement a very reliable and largely automated method. For many configurations, a method according to the invention is correspondingly preferred, wherein the one or more reaction measures comprise at least partially, preferably completely, resetting the configuration of the data processing device to a reference configuration, wherein the information used for the resetting is preferably stored on the second memory unit.The inventors have recognized that, in particular in fleet management systems with many vehicles, a time offset can occur between the change in the configuration of the data processing device and thus the configuration information on the one hand and the adaptation of the stored reference information on the other hand, for example when the various working steps are carried out by different workers or when individual workers are required to both carry out a change directly on the vehicle and also to carry out a change on a separate computer. In order to overcome this problem, the inventors propose that the triggering of reaction measures can be linked to the fact that, after a detected deviation between the information items, authorization does not occur within a predefined time window, for example within 12 hours, preferably via the data processing system. In this case, it can expediently be provided that the method according to the invention is carried out again after the release of the change in the configuration and corresponding adaptation of the reference information in order to verify the now suitable state. The corresponding configuration also allows to overcome common practice problems, such as a short-term failure of the wireless communication with the data processing system. A method according to the invention is thus preferred, wherein the one or more reaction measures are triggered if the comparison does not result in a match, and the reaction measures are not prevented within a predefined time window, preferably with adaptation of the reference information.As explained above, in later practice, it will be necessary from time to time to make configuration changes on the data processing device. In order that a corresponding authorized configuration change does not result in undesired reaction measures being triggered, it is necessary to adapt the reference information.The invention accordingly also relates to a method for changing the configuration of the electronic data processing device in a vehicle system, comprising the method steps of the method according to the invention for verifying the integrity of an electronic data processing device, and the steps:changing the configuration of the data processing apparatus and the configuration information stored in the first storage unit; andf) changing the reference information stored in the second storage unit.According to the inventors' judgment, two embodiments of this method are possible above all, which differ from which change is effected first.In a particularly preferred embodiment, the reference information is first adapted before the configuration of the data processing device and accordingly the configuration information are changed. In particularly preferred embodiments, the corresponding change can be effected via the data processing system, for example by making a corresponding change on the data processing devices via the wireless data transmission method, in order to bring them into agreement with the reference information. A method according to the invention is preferred accordingly, wherein the reference information stored in the second memory unit is changed before the configuration of the data processing device and the configuration information stored in the first memory unit are changed. A method according to the invention is particularly preferred, wherein the change of the configuration of the data processing device and the configuration information stored in the first memory unit is initiated or effected by a change signal transmitted from the data processing system to the data processing device.Alternatively, it is conceivable to first change the configuration of the data processing device and to trace it with regard to the reference information. In this embodiment, the change made can be transmitted to the data processing system, i.e. the backend, in order to request an adaptation of the reference information, wherein the corresponding adaptation is expediently coupled to an additional release, for example by the fleet manager verifying the corresponding change and consequently adapting the reference information. A method according to the invention is thus preferred, wherein the configuration of the data processing device and the configuration information stored in the first memory unit are changed before the reference information stored in the second memory unit is changed. Particularly preferred is a method according to the invention, wherein the change of the reference information is initiated or effected as a result of a change signal transmitted from the data processing device to the data processing system. A method according to the invention is very particularly preferred, wherein the change of the reference information as a result of the change signal transmitted from the data processing device to the data processing system takes place only if the change is confirmed as permitted changes, preferably within a predefined time window.In the light of the above, the skilled person understands that the invention also relates to a vehicle system which is designed for use in a method according to the invention. The invention thus also relates to a vehicle system, in particular for use in a method according to the invention, comprising:i) a vehicle,ii) one or more system vehicle tires arranged on the vehicle, each comprising one or more electronic sensor units for detecting tire information of the system vehicle tires,iii) an electronic data processing device arranged in or on the vehicle, having a first memory unit and configuration information stored thereon about the configuration of the data processing device, andiv) an electronic data processing system separate from the vehicle, having a second storage unit and a reference information item stored thereon about the configuration of the data processing device, iv, wherein the vehicle system is configured to transmit the tire information recorded by the electronic sensor units to the electronic data processing device, wherein the vehicle system is configured to evaluate the transmitted tire information with the data processing device and / or the data processing system, wherein the vehicle system is configured to transmit the configuration information from the data processing device to the data processing system and / or the reference information from the data processing system to the data processing device by means of a transmission signal with a wireless data transmission method, wherein the vehicle system is configured to match the configuration information with the reference information, wherein the data processing system is configured to trigger one or more reaction measures depending on whether the matching results in a match or not.The invention and preferred embodiments of the invention are explained and described in more detail below with reference to the accompanying figure. The following shows: FIG. 1 shows a schematic illustration of a preferred vehicle system according to the invention for use in a method according to the invention.FIG. 1 shows a schematic illustration of a vehicle system 12 according to the invention for use in a method according to the invention.The vehicle system 12 shown in FIG. 1 comprises, as vehicle 14, a truck on which a total of six system vehicle tires 16 a, 16 b, 16 c, 16 d, 16 e, 16 fare arranged, which each comprise an electronic sensor unit 18 a, 18 b, 18 c, 18 d, 18 e, 18 f, which are each designed as pressure sensors for measuring the tire pressure and are arranged on the inside of the tire inner layer of the system vehicle tires 16 a- f.During operation of the vehicle system 12, the tire information recorded by the sensor units 18 a- fare transmitted to the electronic data processing device 10 using a wireless communication method, for example by means of Bluetooth, which in the example shown in FIG. 1 is arranged on the vehicle 14 in such a way that it is accessible from the outside. This is illustrated in FIG. 1 by a dashed arrow as an example for the communication between the electronic data processing device 10 and one of the electronic sensor units 18 a.In the preferred vehicle system 12 shown, the electronic data processing device 10 is configured to transmit the tire information about the respective tire pressure received from the system vehicle tires 16 a- fin a wireless communication method, namely by means of mobile radio, to the data processing system 20, which forms the "backend" of a tire management system and is embodied as a cloud-based data processing system 20.The transmitted tire information is processed and in particular stored in the external data processing system 20 in the example of FIG. 1.The method described above for detecting and processing tire information according to method steps a) and b) is now supplemented by method steps c) and d) for verifying the integrity of the electronic data processing device 10, which method steps are carried out multiple times during the use of the vehicle 14 in the example shown, namely whenever a predetermined triggering criterion is established. In the example shown in FIG. 1, the predetermined triggering criterion is coupled to the ignition of the vehicle 14, so that the method steps c) and d) for verifying the integrity are carried out whenever the vehicle 14 is started.The electronic data processing device 10 includes a first storage unit (not shown) on which configuration information about the configuration of the electronic data processing device 10 is stored.In the example shown in FIG. 1, this configuration information is formed by the "checksum" of the operating software of the data processing device 10 and the information about the configuration of the vehicle system stored in the data processing device 10, in particular about the assignment of the system vehicle tires 16 a- fto the tire locations of the vehicle 14. In an alternative embodiment, however, the configuration information can also be implemented as an incremental counter which also counts the number of changes previously made to the configuration of the data processing device 10.The electronic data processing system 20 comprises, on a second storage unit (not shown), reference information which is complementary to the configuration information and which, in the example shown, comprises the "checksum" of the most recently authorized operating software and the last authorized assignment of the system vehicle tires 16 a- fto the tire locations of the vehicle 14.The reference information is protected on the second storage unit by means of two-factor authentication against unauthorized changes.To carry out the verification, either the configuration information is now transmitted to the data processing system 20 or the reference information is transmitted to the data processing device 10, wherein the transmission takes place by means of encrypted data transmission in the example shown in FIG. 1.In the example shown in FIG. 1, the configuration information is matched to the reference information in the data processing system 20, and the vehicle system 12 is designed in this case such that a successful matching which shows the correspondence of the corresponding information does not trigger an immediate reaction measure. Only if a deviation is detected between the configuration information and the reference information are reaction measures triggered. In the example shown in FIG. 1, the responsible persons, in particular the vehicle driver and the fleet manager, receive a warning message to their mobile telephone in the event of a deviation via a short message service. In the meantime, the data processing device 10 is placed in an error state in which it no longer transmits the acquired tire information to the data processing system 20 in order to avoid subsequent damage from a possible manipulation of the data.In the example shown in FIG. 1, the vehicle system 12 is designed such that the discrepancy between the configuration information and the reference information automatically initiates the method according to the invention for changing the configuration of the electronic data processing device 10 in the vehicle system 12, namely to the effect that the deviating configuration information, which is based on a configuration of the data processing device 10 that has been changed with respect to the reference information, is not discarded but rather is understood as a change signal with which the change of the reference information in the data processing system 20 is to be initiated or effected, which initiates a corresponding request to the responsible persons to authorize the detected change, so that only after the authorization has taken place is the reference information in the data processing system 20 adapted. As a result of the adaptation, the renewed performance of the method according to the invention for verifying the integrity of the data processing device 10 leads to a match of the corresponding information, as a result of which the error state is resolved.However, the vehicle system 12 shown in FIG. 1 is also designed such that a change in the configuration of the data processing device can be initiated by the data processing system 20 such that a change in the reference information in the data processing system 20 entails the transmission of a change signal to the data processing device 10, with which the configuration and the corresponding configuration information are adapted to the change made in the "backend".List of reference characters10 Electronic Data Processing Device 12 Vehicle System 14 Vehicle 16 a- f System Vehicle Tires 18 a- f Electronic Sensor Unit 20 Electronic Data Processing System

Claims

Method for verifying the integrity of an electronic data processing device (10) in a vehicle system (12), comprising: i) a vehicle (14), ii) one or more system vehicle tyres (16a-f) arranged on the vehicle (14), each comprising one or more electronic sensor units (18a-f) for detecting tyre information of the system vehicle tyres (16a-f), iii) an electronic data processing device (10) arranged in or on the vehicle (14), having a first memory unit and configuration information stored thereon about the configuration of the data processing device (10), and iv) an electronic data processing system (20) separate from the vehicle (14), having a second memory unit and reference information stored thereon about the configuration of the data processing device (10), comprising the method steps: a) transmitting the tyre information detected by the sensor units (18a-f) to the data processing device, b) processing the transmitted tire information with the data processing device (10) and / or the data processing system (20), as well as the method steps: c) transmitting the configuration information from the data processing device (10) to the data processing system (20) and / or the reference information from the data processing system (20) to the data processing device (10) by means of a transmission signal with a wireless data transmission method, and d) matching the configuration information with the reference information by the data processing system (20) or the data processing device, wherein one or more reaction measures are triggered depending on this whether the matching results in a match or not.The method of claim 1, wherein the electronic sensor units (18a-f) are selected from the group consisting of temperature sensors for sensing tire temperature, acceleration sensors for sensing experienced acceleration, pressure sensors for sensing tire pressure, and deformation sensors for sensing tire deformation.Method according to either of Claims 1 and 2, wherein the configuration information comprises information about the version of the operating software of the data processing device (10), and / or wherein the configuration information comprises or consists of information about the configuration of the vehicle system (12) stored in the data processing device (10).Method according to one of Claims 1 to 3, wherein the configuration information comprises or consists of information about the number of changes to the configuration of the data processing device (10) that have previously taken place.The method of any of claims 1 to 4, wherein the second storage unit is an unauthorized access secure storage unit.Method according to one of Claims 1 to 5, wherein the transmission takes place in method step c) if the vehicle system (12) establishes that a predetermined triggering criterion has occurred.The method of claim 6, wherein the predetermined triggering criterion is a time-based triggering criterion.Method according to one of claims 6 or 7, wherein the predetermined triggering criterion is a change of state on the vehicle (14), and / or wherein the predetermined triggering criterion is dependent on at least one of the detected tire information, and / or wherein the predetermined triggering criterion is the reception of a request signal by the data processing device (10).The method of any of claims 1 to 8, wherein the one or more response actions comprise outputting a warning signal, and / or wherein the one or more response actions comprise sending a warning message to one or more receivers via electronic communication.The method of any of claims 1 to 9, wherein the one or more responsive actions comprise placing the computing device (10) in a fault condition, wherein the computing device (10) is prevented from processing the tire information in the designated manner in the fault condition, or wherein the one or more responsive actions comprise at least partially resetting the configuration of the computing device (10) to a reference configuration.A method of changing the configuration of the electronic data processing device (10) in a vehicle system (12) comprising the method steps of the method of verifying the integrity of an electronic data processing device (10) according to any one of claims 1 to 10, and the steps of: e) changing the configuration of the data processing device (10) and the configuration information stored in the first storage unit, and f) changing the reference information stored in the second storage unit.The method according to claim 11, wherein the changing of the reference information stored in the second storage unit is performed before changing the configuration of the data processing device (10) and the configuration information stored in the first storage unit.The method according to any one of claims 11 or 12, wherein changing the configuration of the data processing device (10) and the configuration information stored in the first storage unit is performed before changing the reference information stored in the second storage unit.Method according to claim 13, wherein the change of the reference information is initiated or effected as a result of a change signal transmitted from the data processing device (10) to the data processing system (20), wherein the change of the reference information as a result of the change signal transmitted from the data processing device (10) to the data processing system (20) takes place only if the change is confirmed as permitted changes.Vehicle system (12), in particular for use in a method according to the invention, comprising: i) a vehicle (14), ii) one or more system vehicle tyres (16a-f) arranged on the vehicle (14), comprising in each case one or more electronic sensor units (18a-f) for detecting tyre information of the system vehicle tyres (16a-f), iii) an electronic data processing device arranged in or on the vehicle (14), having a first memory unit and configuration information stored thereon about the configuration of the data processing device, and iv) an electronic data processing system (20) separate from the vehicle (14), having a second memory unit and reference information stored thereon about the configuration of the data processing device, wherein the vehicle system (12) is configured to transmit the tyre information detected by the electronic sensor units (18a-f) to the electronic data processing device (10), wherein the vehicle system (12) is configured to evaluate the transmitted tire information with the data processing device (10) and / or the data processing system (20), wherein the vehicle system (12) is configured to transmit the configuration information from the data processing device (10) to the data processing system (20) and / or the reference information from the data processing system (20) to the data processing device (10) by means of a transmission signal with a wireless data transmission method, wherein the vehicle system (12) is configured to match the configuration information with the reference information, wherein the data processing system (20) is configured to trigger one or more reaction measures depending on whether the matching results in a match or not.

Images