MOTION SENSOR AND METHOD FOR OPERATING A MOTION SENSOR

Description

[0001] The invention relates to a motion sensor, in particular a motion sensor for analog and digital tachographs.

[0002] Tachographs, often also called trip recorders, are devices installed in motor vehicles to monitor various vehicle operating parameters. The vehicle operating parameters to be monitored are usually recorded by sensors, particularly motion sensors, and stored and further processed by the tachograph. Vehicle operating parameters can include, for example, driving times, distance traveled, or average and maximum speeds during the journey. Certain events, such as speeding or interrupted driving time, can also be recorded and stored by the tachograph. The recorded and stored data can then be read out.

[0003] To determine such vehicle operating parameters, motion sensors are used, among other things, which are required by law in many countries. These sensors can provide information about, for example, the vehicle speed and / or the distance traveled. Such motion sensors, like the tachographs themselves, are subject to safety requirements and must meet various legal specifications. One requirement that the tachograph must meet, for example, is that the safety requirements of the entire system—consisting of a vehicle unit, the motion sensor, the tachograph card, and, optionally, external GNSS devices—must be implemented in accordance with the Common Criteria Standard.For this purpose, the Joint Research Centre commissioned by the EU Commission has issued various specifications known as "Common Criteria Protection Profiles." These stipulate that various IT security requirements must be met at each life cycle of the system. For example, at the end of the life cycle ("end of life"), it must be ensured that access to cryptographic keys in the motion sensor is no longer possible. For example, cryptographic keys are used during the lifetime of the motion sensor to encrypt movement information transmitted to other units in the tachograph system. 2. The "Common Criteria Protection Profiles" for motion sensors are described, for example, in the following publication: "Common Criteria Protection Profile Digital Tachograph - Motion Sensor (MS PP)", May 19, 2017, XP055633529, found online: URL: https: / / www.bsi.bund.de / SharedDocs / Downloads / DE / BSI / Zertifizierung / Reporte / ReportePP / pp0093b_pdf.pdf;jsessionid=DA19428A38815FAE19F9ED9402936930.2_cid341? __blob=publicationFile&v=3.

[0004] The object of the invention is to provide a motion sensor and a method for operating a motion sensor which meet these requirements and do not allow access to cryptographic keys in the motion sensor at the end of the life cycle.

[0005] This object is achieved by a motion sensor according to claim 1 and a method according to claim 4. Embodiments and developments of the inventive concept are the subject of dependent claims.

[0006] A motion sensor is described with the features of claim 1.

[0007] This makes it possible to prevent further use of the cryptographic keys or the data encrypted by the cryptographic key once the motion sensor reaches its end of life.

[0008] The information can be stored in the motion sensor at the time when the end of the life of the motion sensor has been reached.

[0009] For this purpose, the motion sensor is designed to be connected to a control unit. The motion sensor can also be designed to store the information when a corresponding software command has been received from the control unit.

[0010] The control unit can, for example, manually trigger the corresponding software command. When the motion sensor reaches its end of life, a user can, for example, trigger the corresponding software command.

[0011] The information can, for example, include at least one of: proof that the motion sensor has reached its end of life; the current date at the time of saving; the current time at the time of saving; the current location at the time of saving; an identification number of the control unit from which the software command was received; and / or the identity of a workshop or user who initiated the saving. This makes it possible to verify at any later point in time that the motion sensor has reached its end of life and that the cryptographic keys are no longer accessible. Furthermore, it is possible to precisely trace when the end of life was reached, or when, where, and by whom the corresponding information was saved in the motion sensor.

[0012] The motion sensor may further be configured to delete the cryptographic key after storing the information.

[0013] This not only prevents access to the cryptographic key, but also ensures that there is no longer any possibility of circumventing the corresponding lock.

[0014] The motion sensor may further be configured to be connected to the control unit of a vehicle and to store the information when the motion sensor is disconnected from the control unit of the vehicle.

[0015] The information may contain an indication that the motion sensor was previously connected to another control unit of a vehicle.

[0016] For example, a motion sensor may only be able to be connected to a single control unit for its entire lifetime. Connecting it to additional control units may be prohibited. This prevents replaced motion sensors from being reused with other control units, which could potentially lead to tampering. By storing corresponding information in the motion sensor, it is clearly traceable that the motion sensor was previously connected to another control unit whenever an attempt is made to connect the motion sensor to additional control units.

[0017] The information can be read by an external diagnostic unit. This allows regulatory inspections to determine at any time whether the motion sensor has already reached its end of life.

[0018] A method for operating a motion sensor having the features of claim 4 is further described.

[0019] The invention is explained in more detail below with reference to the figures of the drawing, in which identical or similar elements are provided with the same reference numerals. It shows: Figure 1 shows a system with a motion sensor in a sketchy representation, Figure 2 shows an example of a motion sensor in a sketchy representation, Figure 3 shows various connections of the motion sensor in a sketchy representation Figure 2 , Figure 4 shows a block diagram of an example of a motion sensor and Figure 5 shows a flowchart of a method for operating a motion sensor according to an embodiment of the invention.

[0020] Figure 1shows, by way of example, a block diagram of a schematic representation of a motion sensor 1. The motion sensor 1 is connected to a control unit 2. The control unit 2 is the control unit of a vehicle. The control unit 2 can be part of a tachograph arrangement or can be connected to a tachograph arrangement. A tachograph arrangement is in Figure 1 not explicitly shown.

[0021] The motion sensor 1 is designed to record motion data. This can be, for example, motion data of a vehicle. For example, the motion sensor 1 can record the speed of the vehicle or the distance traveled by the vehicle. The motion sensor 1 can then transmit corresponding motion data, for example, to the control unit 2. The control unit 2 or other elements of a tachograph unit can then further process this motion data or store it for further processing.

[0022] Figure 2shows a schematic representation of an example of a motion sensor 1. The motion sensor 1 can, for example, have a sensor unit 12. Such a motion sensor 1 can, for example, be installed in the transmission of a vehicle. A pulse wheel 11 of the transmission rotates, for example, depending on the rotation of the vehicle wheels. The pulse wheel 11 has a large number of teeth and gaps. The sensor unit 12 is arranged in the immediate vicinity of the pulse wheel 11, but is separated from it by an air gap. Depending on whether the sensor unit 12 is opposite one of the teeth or a gap, this air gap is either smaller or larger. The sensor unit 12 usually has a magnetic core and a coil or a Hall sensor (not shown). A magnetic field generated by the sensor unit 12 extends into the pulse wheel 11.The magnetic flux through the coil depends on whether the sensor is facing a gap or a tooth of the pulse wheel 11. The operating principle of such motion sensors is well known and will therefore not be explained in further detail.

[0023] The sensor unit 12 may further comprise terminals A1, A2, A3, A4. Via these terminals A1, A2, A3, A4, for example, movement data can be transmitted to a control unit (in Figure 2 not shown). A schematic representation of the connections A1, A2, A3, A4 in the section plane BB is shown in Figure 3 shown. The connections A1, A2, A3, A4 can, for example, be brought out at one end of the sensor unit 12.

[0024] The above based on the Figures 2 and 3 However, the motion sensor 1 described is merely an example. In principle, any type of motion sensor can be used to determine a vehicle's movement data.

[0025] Referring to Figure 4 The basic structure of a motion sensor is described using a block diagram as an example. In addition to the sensor unit 12, which determines the motion data, the motion sensor 1 can have further elements. For example, the motion sensor 1 can have a supply unit 121. The supply unit 121 can be connected to a first and a second terminal A1, A2. A supply voltage can be provided to the motion sensor 1 via the first and second terminals A1, A2. For example, a first supply potential can be provided at the first terminal A1 (e.g. a positive supply potential +V b ) and a second supply potential can be provided at the second terminal A2 (e.g. ground, GND). The elements of the motion sensor 1 can thus be supplied with energy.

[0026] The sensor unit 12 can be connected to the fourth port A4 via an encryption unit 122. The encryption unit 122 is designed to encrypt movement data detected by the sensor unit 12 and transmit it to an external unit (e.g., control unit 2). An (optional) first amplifier unit 124 can be connected downstream of the encryption unit 122. In order to transmit the movement data in encrypted form, the encryption unit 122 can have a secret cryptographic key.

[0027] The motion signals can be encrypted, for example, using the standardized AES (Advanced Encryption Standard). However, other encryption methods are also possible. Encryption ensures that the encrypted data cannot be accessed and thus prevents unauthorized persons from gaining access to it.

[0028] The sensor unit 12 can be connected to the third port A3 via a real-time signal processing unit 123. The real-time signal processing unit 123 can transmit the movement data, for example, unencrypted, to an external unit in real time. An (optional) second amplifier unit 125 can be connected downstream of the real-time signal processing unit 123.

[0029] The encrypted data can be decrypted in an external device and compared with the unencrypted data. This allows the data to be verified for authenticity.

[0030] Such systems must usually meet very high security requirements. For example, it must be guaranteed that after the end of a motion sensor's life, access to the cryptographic keys stored therein and the data encrypted with the cryptographic key is no longer possible. In the simplest case, the motion sensor is scrapped at the end of its life, and in particular, all of its electronics are destroyed in the process to make access to the cryptographic keys stored therein impossible. However, there is no guarantee that a motion sensor, and in particular the cryptographic keys stored therein and the data encrypted with the cryptographic key, are actually functionally destroyed at the end of its life.

[0031] Therefore, according to the present invention, the motion sensor 1 is designed to store information. After this information has been stored, access to the cryptographic keys stored in the motion sensor 1 and / or the data encrypted with the cryptographic key is no longer possible. The information can be stored, for example, in an internal memory of the motion sensor 1. For example, the internal memory can be a memory of the encryption unit 122, in which the cryptographic keys themselves are also stored.

[0032] According to the present invention, the information is stored in the motion sensor 1 when the end of the life of the motion sensor 1 has been reached. The storage of the information can be initiated, for example, via a control unit 2, which can be connected to the motion sensor 1 (see Figure 1). The control unit 2 can, for example, issue a corresponding software command to the motion sensor 1, which initiates the saving of the information. For example, a user can cause the control unit 2 to issue the software command to the motion sensor 1. The stored information can, for example, contain proof of the end of the life of the motion sensor 1, the current date at the time of saving, the current time at the time of saving, the current location at the time of saving, an identification number of the control unit 2 from which the software command was received, and / or the identity of a workshop or a user who initiated the saving.

[0033] By storing the information in motion sensor 1, the cryptographic keys stored in motion sensor 1 and the data encrypted with the cryptographic key are clearly marked as invalid. The information can, for example, be read out by external devices. This makes it possible to check at any time later whether the end of life of motion sensor 1 has been reached (information stored) or not (no information stored). It is also possible, for example, to delete the security-relevant data, such as the cryptographic keys and the data encrypted with the cryptographic key, from motion sensor 1 using the corresponding software command. This means that it is then no longer possible to access the keys and the data encrypted with the cryptographic key.By storing the relevant information, it is possible to trace at a later point in time when, where and by whom the cryptographic keys and the data encrypted with the cryptographic key were rendered ineffective or deleted.

[0034] According to an alternative example, a motion sensor 1 can only be connected to a single control unit 2 during its lifetime. A control unit 2 is generally uniquely assigned to a vehicle. A motion sensor 1 can therefore, for example, only be used in a single vehicle. When the vehicle or a tachograph unit of the vehicle reaches the end of its life, the end of its life is automatically reached as well. If the motion sensor 1 is disconnected from a control unit 2, corresponding information about this can be stored in the motion sensor 1. Once this information is stored in the motion sensor 1, access to the cryptographic keys and the data of the motion sensor 1 encrypted with the cryptographic key is no longer possible.If an attempt is made to connect the motion sensor 1 to another control unit 2, access to the cryptographic key and the data encrypted with the cryptographic key fails, and data cannot be transmitted in encrypted form. It is therefore not possible to connect the motion sensor 1 to more than one control unit 2. Furthermore, the information that the motion sensor 1 was already paired with another control unit 2 can be clearly read out at any later time. Storing the information in the motion sensor 1 when it is disconnected from the control unit 2 is merely an example. In principle, it is also possible, but not according to the invention, to store corresponding information in the motion sensor 1 when it is connected to a control unit 2 for the first time. For example, a unique identification of the control unit 2 can be stored in the motion sensor 1.This information is retained after disconnection from control unit 2. This also makes it possible to clearly identify at a later time that motion sensor 1 was already connected to a control unit 2.

[0035] Referring to Figure 5 An exemplary method for operating a motion sensor 1 is schematically illustrated in a flowchart. The motion sensor 1 has a sensor unit 12, which is designed to detect motion data, and an encryption unit 122, which is designed to encrypt motion data using a cryptographic key stored in the encryption unit 122. The method comprises storing information in the motion sensor 1 (step 501), wherein after the information has been stored, access to the data encrypted by the cryptographic key is no longer possible.

[0036] Optionally, the method may further comprise deleting the cryptographic key after storing the information (step 502).

Claims

1. Motion sensor (1) having a sensor unit (12), which is designed to acquire motion data, and an encryption unit (122), which is designed to encrypt motion data acquired by the sensor unit (12) by means of a cryptographic key stored in the encryption unit (122), the motion sensor (1) being designed to be connected to a control unit (2) of a vehicle, characterized in that the motion sensor (1) is designed to store information when the end of life of the motion sensor (1) has been reached, wherein the storage of the information either clearly marks the cryptographic keys stored in the motion sensor (1) and the data encrypted with the cryptographic key as invalid or erases the cryptographic keys stored in the motion sensor (1) and the data encrypted with the cryptographic key from the motion sensor (1), with the result that, after the information has been stored, it is no longer possible to access the cryptographic keys and the data encrypted by the cryptographic keys, and in that the motion sensor (1) is designed to store the information either when a corresponding software command has been received from the control unit (2) or when the motion sensor (1) is disconnected from the control unit (2).

2. Motion sensor (1) according to Claim 1, wherein the information comprises at least one from: evidence of the end of life of the motion sensor (1) having been reached, the current date at the time of storage, the current time at the time of storage, the current location at the time of storage, an identification number of the control unit (2) from which the software command was received, and / or the identity of a workshop or user that / who initiated the storage.

3. Motion sensor according to either of Claims 1 to 2, wherein the information can be read by an external diagnostic unit.

4. Method for operating a motion sensor (1), the motion sensor (1) comprising a sensor unit (12), which is designed to acquire motion data, and an encryption unit (122), which is designed to encrypt motion data acquired by the sensor unit (12) by means of a cryptographic key stored in the encryption unit (122), and the motion sensor (1) being connected to a control unit (2) of a vehicle, characterized by: storage of information in the motion sensor (1), wherein the storage of the information either clearly marks the cryptographic keys stored in the motion sensor (1) and the data encrypted with the cryptographic key as invalid or erases the cryptographic keys stored in the motion sensor (1) and the data encrypted with the cryptographic key from the motion sensor (1), with the result that, after the information has been stored, it is no longer possible to access the cryptographic keys and the data encrypted by the cryptographic keys, and wherein the information is stored in the motion sensor (1) when the end of life of the motion sensor (1) has been reached, wherein the information is stored when a corresponding software command has been received from the control unit (2) or when the motion sensor (1) is disconnected from the control unit.