TELEPHONY CONTROL DEVICE, MEANS OF TRANSPORT AND METHOD FOR OPERATING A MOBILE RADIO MODULE FOR A MEANS OF TRANSPORT

Description

[0001] The present invention relates to a telephony control device, a means of transportation, and a method for operating a mobile radio module of a telephony control device for a means of transportation. In particular, the present invention relates to preventing unauthorized access to the on-board data network of the means of transportation.

[0002] Networked vehicles feature a telematics control unit with a mobile communications module. The mobile communications module can be used to maintain data communication connections for a wide variety of purposes. For example, the software of control units, their data coding ("coding"), and their firmware can be updated and modified via wireless communication connections. A mobile communications contract is typically in place for the duration of telecommunications services linked to a means of transportation. To close security gaps or implement functional updates, procedures exist for updating the control unit software via the mobile communications data interface with a mobile communications network.

[0003] The software of the telematics control unit / modem firmware of the mobile communications module must be continuously checked for known security vulnerabilities. These vulnerabilities can be closed via over-the-air hotfixes in the telematics control unit / mobile communications modem. Maintenance must be carried out throughout the entire life cycle of the vehicle to ensure the vehicle's security against external attacks (e.g., from the Internet). There is no guarantee that this requirement will be met throughout the entire

[0004] The vehicle's life cycle can be enabled (e.g., the performance of the installed hardware is insufficient for software updates / new security fixes (also "security algorithms"), subcontractors discontinue support for the installed components, or similar). Disabling the services and deactivating the SIM card is not sufficient. The cellular modem will continue to attempt to log into the cellular network and is thus still vulnerable to unauthorized data connections (also "man-in-the-middle" attacks) with mobile base stations. In summary, there is a security risk to the data infrastructure of the vehicle if security precautions are not properly maintained.

[0005] DE 10 2013 006 927 A1 discloses a communication system and a method for activating a communication channel to a means of transport. If, for example, access to a means of transport is detected using a radio key, a WLAN module can be awakened to be available for data communication as quickly as possible. After the transmission has been completed, a predefined time, depending on the position, is waited until the communication channel established for WLAN transmission is deactivated.

[0006] US 2015 / 0066287 A1 discloses a method for resetting a telephony control unit of a means of transport. In response to an undefined code, the deactivated control unit is reactivated by a reset trigger.

[0007] US 2005 / 0208933 A1 discloses a dual-SIM communication terminal which can be temporarily switched off via a wireless message to release a linked wireless communication terminal.

[0008] US 2015 / 0183386 A1 teaches a wirelessly controlled fuse for use in vehicle electrical systems. The fuse has a receiver and can thus be interrupted remotely.

[0009] It is an object of the present invention to satisfy the need for data security identified above.

[0010] The object identified above is achieved according to the invention by a method for operating a mobile radio module of a telephony control unit for a means of transport or for protecting the same against an unauthorized data connection. The telephony control unit can also be understood as a data communication control unit or data communication gateway. It is thus capable of operating at least the mobile radio module or of comprising the same. Furthermore, the telephony control unit can comprise an application processor (e.g. for an emergency call function) and a module for satellite-based positioning. The mobile radio module is configured to maintain a wireless communication connection for the data exchange between the means of transport and a telecommunications infrastructure (e.g. terrestrial mobile radio network, WLAN access point, or similar).The telephony control unit is the means of transport configured to handle data communication, for example, for updates to control units (e.g., navigation systems, access authorization verification systems, etc.). The means of transport itself can be configured, for example, as a car, van, truck, motorcycle, aircraft, and / or watercraft. In a first step, a predefined deactivation command is received via a wireless interface using the telephony control unit. The deactivation command can, for example, be sent at the end of a period within which security updates for the mobile communications module are provided. It can, for example, be initiated by the operator and / or manufacturer of the means of transport. In particular, the manufacturer of the mobile communications module and / or the telephony control unit can announce that maintenance in the sense of security-relevant update measures is being discontinued.In particular, the deactivation command is not merely a "power off" event, but rather triggers a predefined routine. To prevent authorized access to the data infrastructure of the vehicle despite the still functional communication hardware, the mobile radio module can be deactivated in response to receiving the deactivation command. This essentially permanently deactivates the mobile radio module. In other words, it is ensured that the possibility of unauthorized data access no longer exists. In particular, this can also include a step by which, through modification of hardware and / or software, a data communication connection via the mobile radio module in both directions ("uplink" or "downlink") is prevented from being possible.As a result, updates to the vehicle's security software are largely unnecessary, as unauthorized persons / entities can no longer establish a wireless data connection. As a result, the vehicle can continue to operate securely even after a period of regular security updates.

[0011] The subclaims show preferred developments of the invention.

[0012] To prevent the deactivation command from being generated by an unauthorized person (e.g., with the intent to cause damage) or accidentally generated and received by the vehicle, deactivation of the mobile radio module can be performed after a successful comparison between the received deactivation command and a predefined reference stored in the vehicle. It must be verified that the sender of the deactivation command is trustworthy and has been (individually) selected / designated by the vehicle as the recipient of the deactivation command. The predefined reference can also be received via a wired and / or wireless data communication connection and compared with the deactivation command in the vehicle.It will be understood by those skilled in the art that the deactivation command may be contained in a data packet whose integrity can be otherwise checked with the predefined reference to ensure that the deactivation command is actually intended for the means of transport in question.

[0013] According to the invention, deactivating the mobile radio module can involve permanently interrupting the electrical power supply to the mobile radio module. This permanently and reliably prevents (unauthorized) use of the mobile radio module.

[0014] In a corresponding manner, according to the invention, in response to the deactivation command, a permanent interruption of the electrical power supply to the telephony control unit, which in turn supplies electrical power to the mobile radio module, can additionally or alternatively occur. As a result, in this alternative according to the invention, the mobile radio module is also deactivated and secured against unauthorized use.

[0015] The wireless interface can, for example, be set up to maintain a terrestrial mobile data communication connection with a cell-based, terrestrial or satellite-based radio network / wireless data communication system. In certain cases, it may be necessary to restore the function of the telephony control unit and / or the mobile radio module. For example, a security update may become available unexpectedly, or other measures may be needed to ensure secure operation of the telephony control unit / mobile radio module. Furthermore, it may be possible that the deactivation command was given unintentionally despite all precautions, or that other circumstances contribute to the deactivation of the mobile radio module being reversed. For this purpose, in an embodiment not corresponding to the present invention, a predefined reactivation command can be sent from the means of transport orfrom the telephony control unit and / or the mobile communications module. This can be done, for example, via a diagnostic socket (e.g., OBD, OBD 2, or similar). In particular, a wired connection may be required to send and receive the reactivation command, and use it to reactivate the mobile communications module. Upon receipt of the predefined reactivation command, the mobile communications module can be reactivated. Following this, the software / data of the mobile communications module can be updated, and operation of the mobile communications module can be safely continued as before deactivation.

[0016] In an embodiment not according to the present invention, reactivation may also occur in response to a positive comparison of the predefined reactivation command with a predefined reference. This may occur essentially in accordance with the predefined reference described above in connection with the deactivation command.

[0017] The mobile communications module can be deactivated, for example, by the triggering of a fuse, which is part of a data connection between the mobile communications module and its peripherals. In other words, the fuse can be subjected to an electrical signal that causes the fuse to blow. This permanently and, in particular, irreversibly destroys a galvanic connection between the mobile communications module and / or the telephony control unit. To trigger the fuse, it can be subjected to a voltage, for example via a switch / transistor, which results in currents flowing through the fuse that exceed the trigger current.

[0018] According to a second aspect of the present invention, a telephony control device for a means of transport is proposed, which comprises a mobile radio module and a data input. The data input is configured to receive a predefined command via a wireless communication interface. The predefined command can be configured as a deactivation command, in response to the receipt of which the telephony control device is configured to deactivate the mobile radio module. In particular, the deactivation command is not to be understood as a command that is issued at the end of each operating cycle (e.g., after removing an ignition key or parking the means of transport), but is essentially received once at the end of the service life of the mobile radio module and used to deactivate it.In this way, the telephony control device according to the invention is configured to carry out a method according to the first aspect of the invention. Regarding the features, feature combinations, and the resulting advantages, reference is made to the above explanations to avoid repetition.

[0019] According to a third aspect of the present invention, a means of transportation is proposed, which can be configured, for example, as a car, van, truck, motorcycle, aircraft, and / or watercraft. The means of transportation comprises at least one telephony control device according to the second aspect of the invention. In this way, the means of transportation according to the invention is also configured to implement the features, feature combinations, and advantages of the aforementioned aspects of the invention in a corresponding manner, which is why, to avoid repetition, reference is made to the above explanations.

[0020] In addition, the advantages pursued by the present invention can also be achieved as follows: After the service offer has ended, a final shutdown command is sent from the backend of an operator and / or manufacturer of the means of transport to the means of transport. Receiving this command results in the power supply of the mobile radio module being permanently switched off. This means that the mobile radio module can no longer attempt to log into the mobile radio network. For example, the mobile radio module can be restarted using a protected diagnostic command. This can be protected, for example, by a signature. In particular, in an embodiment not corresponding to the present invention, the diagnostic command can reach the means of transport via a diagnostic interface to reactivate the mobile radio module.This can be done, for example, via a wired data connection in a commercial organization / branch of the vehicle manufacturer. For example, an erroneously sent deactivation / shutdown command may require reactivation of the cellular module.

[0021] The vehicle's security against external hacker attacks (i.e. via a mobile phone interface) is thus guaranteed by security "hotfixes" even after the CD services have been terminated and product support has ended.

[0022] Further details, features, and advantages of the invention will become apparent from the following description and the figures. They show: Figure 1 shows a schematic representation of an interaction of an embodiment of a means of transport according to the invention with an embodiment of a telephony control device according to the invention with a wireless infrastructure; and Figure 2 shows a flowchart illustrating steps of an embodiment of a method according to the invention for operating a mobile radio module.

[0023] Figure 1shows a passenger car 10 as an exemplary embodiment of a means of transport according to the invention with a telephony control unit 2, which comprises a data input 14, an evaluation unit 12, a data memory 11, and a mobile radio module 1. The data input 14 is configured to receive wireless communication signals received from an antenna 3 and diagnostic commands received from an OBD socket 8. The evaluation unit 12 is configured to execute the steps of a method according to the invention for deactivating the mobile radio module 1. For this purpose, corresponding steps are stored in data form in the data memory 11, as well as predefined references for identifying deactivation commands and reactivation commands. A fuse 13 is provided within the mobile radio module 1 to protect a power supply to the mobile radio module 1.The evaluation unit 12 is configured to trigger the fuse 13 as soon as a positively verified deactivation command is received from the manufacturer 7 of the passenger car 10 via a transmission mast 6 over an authorized wireless communication connection 5. This deactivates the mobile radio module 1. A hacker 9 is thus no longer able to establish an unauthorized wireless communication connection 4 with the passenger car 10. In the event that the deactivation command was erroneously sent to the passenger car 10, the manufacturer 7 of the passenger car 10 can, in an embodiment not corresponding to the present invention, establish an authorized wired communication connection to the passenger car 10 using a diagnostic command in order to send a reactivation command to the telephony control unit 2.In response to a positive comparison of the reactivation command with a reference value stored in the data memory 11, the telephony control unit 2, via the evaluation unit 12, puts the mobile radio module 1 back into operation by providing an alternative (not shown) power supply for the mobile radio module 1. Alternatively or additionally, the manufacturer 7 of the passenger vehicle 10 can send a message to the user of the passenger vehicle 10 via the authorized wireless communication connection 5 that, in order to reactivate the mobile radio module 1, a visit to a branch is required in order to establish a wired data connection using the OBD socket 8 and to issue the reactivation command to restart the mobile radio module 1.

[0024] Figure 2shows steps of an embodiment of a method according to the invention for protecting a mobile radio module of a telephony control unit of a means of transport against an unauthorized data connection. In step 100, a predefined deactivation command is received via a wireless interface by means of the telephony control unit. In response to this, the mobile radio module is permanently deactivated in step 200. In a step 300 not covered by the present invention, a predefined reactivation command is received via a diagnostic socket. This is due to the fact that the previously received deactivation command was not intended for the means of transport. Finally, in a step 400 not covered by the present invention, the mobile radio module is permanently reactivated, thus essentially undoing the previously received deactivation command. List of reference symbols:

[0025] 1Mobile radio module 2Telephony control unit 3Antenna 4Unauthorized wireless communication connection 5Authorized wireless communication connection 6Transmission mast 7Vehicle manufacturer 8OBD socket 9Hacker 10Car 11Data storage device 12Evaluation unit 13Fuse 14Data input 100 to 400Procedure steps

Claims

1. Method for operating a mobile radio module (1) of a telephony controller (2) for a means of transport (10), comprising the steps: - receiving (100) a predefined deactivation command by way of the telephony controller (2) via a wireless interface (3) and, in response thereto, - deactivating (200) the mobile radio module (1), characterized in that the deactivation comprises permanently interrupting a supply of electric power to the mobile radio module (1) and / or the telephony controller (2) and / or permanently shutting down a transceiver unit of the mobile radio module (1).

2. Method according to Claim 1, wherein the deactivation takes place in response to a positive comparison of the predefined deactivation command with a predefined reference.

3. Method according to either of the preceding claims, wherein the wireless interface (3) uses a terrestrial mobile data communication connection.

4. Method according to one of the preceding claims, further comprising - addressing a fuse (13) in response to the reception of the predefined deactivation command.

5. Telephony controller (2) for a means of transport (10), comprising - a mobile radio module (1) and - a data input (14): - wherein the data input (14) is configured so as to receive a predefined deactivation command via a wireless interface (3) and - the telephony controller (2) is configured so as to deactivate the mobile radio module (1) in response to the reception of the deactivation command, characterized in that the deactivation comprises permanently interrupting a supply of electric power to the mobile radio module (1) and / or the telephony controller (2) and / or permanently shutting down a transceiver unit of the mobile radio module (1).

6. Means of transport (10) comprising a telephony controller (2) according to Claim 5.