Computing unit, vehicle and method for using development tools and / or development functions

Abstract

The invention relates to a computing unit (ECU) comprising - a computer-readable storage medium (1) containing software components for the formation of development tools and development functions executable on the processing unit (ECU); - a cryptographic module (2) configured to encrypt and decrypt a storage content of the storage medium (1) using a secret (3) based cryptographic encryption mechanism. The computing unit according to the invention is characterized in that - all software components for the development tools and development functions are stored cryptographically encrypted in the storage medium (1) and the secret (3) required to decrypt these software components is missing; - the processing unit (ECU) further comprises an interface (4) for receiving secrets (3); and - the cryptography module (2) is configured to obtain the secret (3) required to decrypt the software components via the interface (4) and to apply it to decrypt the software components.

Description

[0001] The invention relates to a computing unit of the type defined in more detail in the preamble of claim 1, a vehicle with such a computing unit and a method for using development tools and / or development functions on the computing unit.

[0002] Development tools are programs or systems that support developers in designing, implementing, testing, analyzing, or optimizing software or hardware. In English, they are often referred to as "development tools" or "software development tools." These tools are essential for an efficient development process and are used in various phases of the Software Development Life Cycle (SDLC). For example, there are dedicated development tools for source code editing, version control for debugging, program automation, and the like. In a broader sense, compilers, interpreters, assemblers, profilers, and build tools can all be considered development tools. Programming tools represent a subcategory of development tools. Often, development tools are embedded in an integrated development environment (IDE).Integrated development environments allow software development tasks to be handled with minimal media breaks. Since modern vehicles manage a multitude of tasks using computer systems, such as engine control, infotainment functions, or sensor data processing in the context of driver assistance systems, development tools also play a significant role for vehicle manufacturers.

[0003] During vehicle development, development tools are implemented in a computing unit designed for use in a vehicle, such as a car or truck. This enables the testing, development, and improvement of specific hardware and software functions within the automotive context. Various types of computing units are installed in the vehicle, including control units, a central on-board computer, a telematics unit, and similar components.

[0004] Development tools can be relevant beyond the development phase of a vehicle or its functions. For example, they may be needed during a vehicle's operational phase, such as for identifying and troubleshooting errors encountered in the field. Furthermore, the certification of vehicle components requires the use of hardware and software components identical to those used in series production. During the certification process, development tools allow for the setting of defined states for the underlying information technology systems. Therefore, the usability of development tools on the computing units within a vehicle should be possible both during development and in subsequent field use.

[0005] As with any information technology system, there is a general risk of a cyberattack. For example, an attacker could gain access to the vehicle's information technology systems, allowing them to steal critical data, perform unauthorized manipulations, and introduce malicious code. Since development tools typically enable particularly deep manipulations of the underlying information technology system, it is essential to prevent access to development tools in the vehicle when they are not currently needed. To address this problem, measures are currently being taken to make it more difficult for potential attackers to access the respective information technology systems in the vehicle.However, should an attacker succeed in compromising such a vehicle-integrated information technology system, the use of said development tools is usually also possible.

[0006] A method for operating a control unit is known from DE 10 2014 208 838 A1. The method provides for detecting manipulation of a main processing unit of the control unit using a hardware security module and, if possible, reprogramming the control unit upon detection of manipulation.

[0007] Furthermore, US patent 2008 / 0298581 A1 discloses an application-specific secret generation method. The patent describes the generation of cryptographic keys from an existing secret and a portion of a computer program. Specifically, this involves a hash value calculated from the computer program's code. The method serves to protect the program code stored in a data storage device from unauthorized access when the program is not currently being executed by the underlying information technology system.

[0008] The present invention is based on the objective of providing means by which the cybersecurity of vehicles can be further increased.

[0009] According to the invention, this problem is solved by a computing unit with the features of claim 1, a vehicle with the features of claim 5, and a method for using development tools and / or development functions with the features of claim 8. Advantageous embodiments and further developments are described in the dependent claims.

[0010] A generic unit of calculation, comprising - a computer-readable storage medium containing software components for the creation of development tools and functions executable on the computing unit; - a cryptographic module configured to encrypt and decrypt the contents of a storage medium using a secret-based cryptographic encryption mechanism; is further developed according to the invention in that - all software components for the development tools and development functions are stored cryptographically encrypted in the storage medium and the secret required to decrypt these software components is missing; - the computing unit also includes an interface for receiving secrets; and - the cryptography module is set up to obtain the secret required to decrypt the software components via the interface and to apply it to decrypt the software components.

[0011] The idea according to the invention is to cryptographically encrypt the software components implemented in a computing unit for the development of development tools and functions, so that these cannot be used without further ado. Even if an attacker corrupts the computing unit, it is made impossible for them to cause significant damage by using said development tools or functions. Since the secret required to decrypt said software components is missing, i.e., not present in the computing unit itself, the software components cannot be easily decrypted.

[0012] An advantageous further development of the computing unit according to the invention provides that the computing unit is implemented as a vehicle control unit. Such a control unit is often also referred to as an "Electronic Control Unit" (ECU). Control units perform safety-critical tasks in vehicles, so their respective cyber integrity must be ensured. If a control unit is corrupted by an attacker, the safe operation of the vehicle can be jeopardized. By designing the respective control units as a computing unit according to the invention, this risk can be reduced. In general, however, the computing unit could be any computer system, which, for example, could also be used as a central on-board computer in a vehicle. Any embodiment is possible, such as a microcontroller or a system-on-a-chip (SoC).

[0013] According to a further advantageous embodiment of the computing unit according to the invention, the interface is designed as an on-board diagnostics interface. On-board diagnostics (OBD) is a vehicle diagnostic system. Due to its established presence in the market, OBD can be found in a wide variety of vehicles. The use of an OBD interface thus enables simple and reliable implementation of the computing unit according to the invention in vehicles from various manufacturers. In this case, the data can be transmitted as a message from a so-called diagnostic service.

[0014] A further advantageous embodiment of the computing unit according to the invention further provides that the software components are encrypted by a symmetric encryption method and the secret represents a symmetric cryptographic key; or The software components are encrypted using an asymmetric encryption method, and the secret represents an asymmetric cryptographic key. Therefore, all common symmetric and asymmetric encryption methods are suitable within the context of the invention. Corresponding encryption and decryption algorithms are implemented in the cryptography module.

[0015] A vehicle of this type is further processed by a computing unit as described above. The vehicle can be any road vehicle, such as a car, truck, van, bus, construction machine, or the like. Generally, it could also be a watercraft, rail vehicle, or aircraft.

[0016] An advantageous further development of the vehicle according to the invention provides that at least two computing units as described above are installed, wherein the software components of each computing unit are cryptographically encrypted by an individual secret. This further enhances cybersecurity. Should an attacker, contrary to expectations, gain knowledge of the secret required to decrypt the software components of a first computing unit, he cannot use this secret to also decrypt the memory contents of the other computing units of the vehicle.

[0017] Generally, it is conceivable to use the same secret for multiple vehicles. For example, a vehicle manufacturer could use the same secret for all vehicles of a specific model series, with the same equipment, or similar. It is also conceivable to use a vehicle-specific secret that can be used to decrypt the respective software components of all computing units in the vehicle. This simplifies the effort required by the vehicle manufacturer to encrypt the respective data. However, this does not fully improve cybersecurity. Therefore, it is particularly preferable to use a separate secret for each computing unit in the vehicle. While this involves the greatest effort, it ensures the highest level of cybersecurity. Ideally, the computing unit-specific secrets should also differ across individual vehicles.

[0018] According to a further advantageous embodiment of the vehicle according to the invention, it is further provided that it is characterized by standard equipment and a standard configuration. With standard equipment, the vehicle includes those hardware and software components that are also subsequently sold to or offered to the customer. The software components are configured according to the standard configuration. The vehicle according to the invention is thus designed as a vehicle in the operational phase or as a vehicle in the field. Particularly for a vehicle in the field, it is essential to reliably restrict or prevent access to said development tools and functions.

[0019] A method according to the invention for using development tools and / or development functions on a computing unit described above comprises the following steps: A: Booting the computing unit; B: Obtaining the secret from an external source via the interface; C: Forwarding the secret to the cryptography module; D: Decrypting at least one of the software components using the cryptography module with the secret; and E: Execution of the at least one decrypted development tool and / or the at least one decrypted development function by a processor of the computing unit.

[0020] Using the secret, all software components for the development of development tools and functions can be decrypted at once. However, it is also conceivable that individual secrets are necessary for specific development tools and / or functions, or that they can be decrypted individually using the same secret. This allows individual development tools and functions to be decrypted selectively, further enhancing cybersecurity. Once the respective software component has been decrypted, it can be used on the processing unit as intended in step E.

[0021] Preferably, the secret in step B is obtained directly or indirectly from a central computing facility accessible via the internet. This further enhances cybersecurity. The respective secret is stored on a computing facility that is particularly difficult for the computing unit to access, thus reducing the risk of the secret being illicitly introduced into the computing unit. Furthermore, using the central computing facility, for example, a cloud server, enables centralized management of secrets. This allows secrets to be made available to third parties as needed, when they require the use of the aforementioned development tools and / or functions. For example, the vehicle manufacturer could have control over these secrets or the central computing facility.

[0022] Preferably, the method according to the invention provides for its implementation in a vehicle described above.

[0023] According to a further advantageous embodiment of the method according to the invention, it is provided that the method is carried out in the context of a certification, a development process, or a failure analysis. The failure analysis can be performed, in particular, on a field return. As already mentioned at the outset, access to development tools and development functions is not only necessary in the actual development of said vehicle components, but can also be required when carrying out said certifications and failure analyses. This is thus taken into account. The use of development tools and development functions is therefore enabled, while maintaining cybersecurity, even for vehicles already in the field.

[0024] Further advantageous embodiments of the computing unit, the vehicle according to the invention, and the method according to the invention for using development tools and / or development functions on the computing unit also result from the exemplary embodiment, which is described in more detail below with reference to the figure.

[0025] This shows Fig. 1 A schematic view of a vehicle according to the invention.

[0026] In Fig. Figure 1 shows a vehicle 5 according to the invention, here in an exemplary embodiment as a passenger car. The vehicle 5 comprises several computing units (ECUs), one of which is shown. The computing unit (ECU) comprises a computer-readable storage medium 1, a cryptographic module 2, and an interface 4 for transmitting information. In the Fig.In the embodiment shown in Figure 1, the ECU (Electronic Control Unit) is connected to a TCU (Telecommunications Control Unit) via interface 4. The TCU enables a wireless connection of the vehicle 5 to a central computing facility 6 accessible via the internet, here represented as a cloud server. For example, the communication link can be established via mobile network, Wi-Fi, or similar technology.

[0027] Software components used to create development tools and functions executable on the ECU are stored in the computer-readable storage medium 1. According to the invention, these components are present in cryptographically encrypted form, but the secret 3 required for decryption is missing. Therefore, if an attacker were to compromise the information technology systems present in the vehicle 5, the attacker would be unable to use the development tools and functions, even if they had access to the respective ECU.

[0028] However, access to said development tools and functions may be required even after the actual development, particularly in the case of a production vehicle, for example, during certification, a subsequent development process, or a fault analysis. According to the invention, the secret 3 required to decrypt the software components is subsequently provided by the central computing unit 6. Corresponding secrets 3 are stored, for example, in a key memory 7 on the central computing unit 6. Central management of the secrets 3 is possible via the central computing unit 6. It is particularly preferred that an individual secret 3 be provided for each ECU of each vehicle 5 of a vehicle manufacturer.

[0029] When required by an authorized person, secret 3 is transmitted via the telecommunications unit TCU and interface 4 to the computer unit ECU, where it can be used by the cryptography module 2 to decrypt the aforementioned software components. Authentication of the respective persons can be carried out in a proven manner, for example, by logging into the vehicle manufacturer's IT infrastructure with a username and password. After the respective development tools and / or functions have been used, they are re-encrypted, and the secret is deleted from the computer unit ECU.

[0030] An example of a particularly security-relevant development tool is a so-called ECU flash tool. This is a component used to update the firmware of the electronic control unit (ECU). Typically, a flash tool has privileged access to the entire contents of the ECU's computer-readable storage media. Should an attacker gain access to the flash tool, they can misuse it to modify or replace the ECU's firmware. This allows the attacker to manipulate functions such as engine management, brakes, or airbag control. The flash tool can be used not only to load basic software components but also to modify calibration-relevant parameters processed by safety-critical algorithms.Changing these parameters could cause the vehicle 5 to malfunction in critical situations. To enhance cybersecurity, it is common practice to implement cryptographic integrity protection mechanisms in the vehicle 5's ECU (Electronic Control Unit), which specifically support signature verification and security protocol authentication. A successful attack using the flash tool could allow the attacker to circumvent such integrity protection mechanisms. However, the flash tool should remain in the vehicle, as flashing the ECU may be necessary for installing software updates. According to the invention, the flash tool itself is encrypted, so even if the attacker gains access to the ECU, the flash tool cannot be used.

[0031] As previously described, decryption only occurs in specific situations, such as during certification, further development, or subsequent error analysis of a returned unit. During user authentication at the central computing unit 6, the authorized person can transmit a characteristic, such as a vehicle identification number (VIN) and / or a serial number of the electronic control unit (ECU), to the vehicle manufacturer, i.e., the central computing unit 6. The key memory 7 can store the respective secrets 3 in a sorted manner, for example, including an assignment to specific vehicles 5 or ECUs. Thus, the central computing unit 6 can locate the appropriate cryptographic key, i.e., the secret 3, and transmit it to the vehicle 5 for use. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] DE 10 2014 208 838 A1

[0006] US 2008 / 0298581 A1

[0007]

Claims

[1] Electronic processing unit (ECU), comprising - a computer-readable storage medium (1) containing software components for the formation of development tools and development functions executable on the processing unit (ECU); - a cryptographic module (2) configured to encrypt and decrypt the contents of the storage medium (1) using a secret (3) based cryptographic encryption mechanism; characterized by , that - all software components for the development tools and development functions are stored cryptographically encrypted in the storage medium (1) and the secret (3) required to decrypt these software components is missing; - the processing unit (ECU) further comprises an interface (4) for receiving secrets (3); and - the cryptography module (2) is configured to obtain the secret (3) required to decrypt the software components via the interface (4) and to apply it to decrypt the software components. [2] Electronic computing unit (ECU) according to claim 1, characterized by a version as a control unit of a vehicle (5). [3] Electronic computing unit (ECU) according to claim 1 or 2, characterized by , that the interface (4) is designed as an on-board diagnostics interface. [4] Electronic computing unit (ECU) according to any one of claims 1 to 3, characterized by , that the software components are encrypted by a symmetric encryption method and the secret (3) represents a symmetric cryptographic key; or that the software components are encrypted by an asymmetric encryption method and the secret (3) represents an asymmetric cryptographic key. [5] vehicle (5), characterized byat least one computing unit (ECU) according to any one of claims 1 to 4. [6] Vehicle (5) according to claim 5, characterized by at least two computing units (ECUs) according to one of claims 1 to 4, wherein the software components of each computing unit (ECU) are cryptographically encrypted by an individual secret (3). [7] Vehicle (5) according to claim 5 or 6, characterized by a standard equipment package and a standard configuration. [8] Method for using development tools and / or development functions on a computing unit (ECU) according to any one of claims 1 to 4, characterized by the following steps: A: Booting the Electronic Control Unit (ECU); B: Obtaining the secret (3) from an external source via the interface (4); C: Forwarding the secret (3) to the cryptography module (2); D: Decrypting at least one of the software components using the cryptography module with the secret (3); and E: Execution of the at least one decrypted development tool and / or the at least one decrypted development function by a processor of the processing unit (ECU). [9] Method according to claim 8, characterized by , that the secret (3) in step B is obtained directly or indirectly from a central computing facility (6) accessible via the Internet. [10] Method according to claim 8 or 9, characterized by an embodiment in a vehicle (5) according to one of claims 5 to 7. [11] Method according to claim 10, characterized by an execution in the context of a certification, a development process or a failure analysis.

Images