METHOD FOR DETECTING MANIPULATED OPERATION OF A VEHICLE COMPONENT

Description

[0001] The present invention relates to a method for detecting a manipulated operation of a component of a vehicle, as well as a computing unit and a computer program for carrying it out. State of the art

[0002] Attempts to manipulate vehicle components are known. This involves, for example, altering program code data or sensor or target values ​​to achieve performance improvements. This can lead to component damage and environmental pollution, and even personal injury, as the entire vehicle design (drive system, braking system) can be affected.

[0003] Manipulations of the exhaust system are also becoming increasingly common. Selective catalytic reduction (SCR) is a technique for reducing nitrogen oxides in the exhaust gases of internal combustion engines in vehicles. This process reduces nitrogen oxides (NO and NO₂) while largely suppressing undesirable side reactions such as the oxidation of sulfur dioxide to sulfur trioxide. The reaction requires ammonia (NH₃), which is added to the exhaust gas. The products of the reaction are water and nitrogen (N₂). A urea solution is used for this purpose, which is injected into the exhaust stream upstream of a suitable SCR injector. Through a hydrolysis reaction, the required ammonia and CO₂ are produced from the urea solution. The amount of injected urea depends on the engine's nitrogen oxide emissions and thus on the engine's current speed and torque.

[0004] To save on the consumption of such urea solutions, an attacker attempts to manipulate the urea dosing system so that no urea is injected into the exhaust gas. To prevent the control unit from detecting this manipulation, so-called "urea manipulators" are used, which simulate sensor signals from a correctly functioning dosing system and SCR catalyst and transmit them to the control unit.

[0005] Such manipulations can lead to a significant environmental burden, so it is important to be able to detect manipulation of vehicle components.

[0006] German patent DE 10 2011 103 699 A1 discloses an evaluation of system errors in a diagnostic unit with regard to possible manipulations, e.g., in an SCR catalytic converter system, by examining, for example, the frequency of an error over several driving cycles. US patent 10 060 323 B1 discloses a diagnostic method for a diesel exhaust pump and compares a calculated pressure drop based on a mean initial and final pressure after diesel injection with an expected pressure drop based on a typical operating cycle of the pump. EP 2 778 361 A1 tests for blockages in the reducing agent supply system by measuring and evaluating different pressure differentials under various operating conditions. US patent 2013 / 024 066 A1 describes a method for detecting manipulations of engine control units, in which test signals or test sequences with specific properties are introduced and the signal responses are evaluated.In DE102014209551A1 a method for processing sensor-acquired values ​​of a motor vehicle which has an exhaust system with which selective catalytic reduction is carried out. Disclosure of the invention

[0007] According to the invention, a method for detecting a manipulated operation of a vehicle component, as well as a computing unit and a

[0008] A computer program for its execution is proposed, comprising the features of the independent patent claims. Advantageous embodiments are the subject of the dependent claims and the following description.

[0009] During the process, component-specific data originating from the vehicle is received in an external computing unit. This external unit then performs a plausibility check of the received component-specific data using data already present in the unit. A plausibility criterion is derived from this data. Based on the result of this plausibility check, an assessment is made to determine whether the vehicle component has been manipulated. It is understood that the data present in the external computing unit and the received component-specific data are not the same, but rather different data.

[0010] An external computing unit is understood to be a computing unit that is not located in the vehicle and with which the vehicle or a control unit of the vehicle can communicate via a wireless connection, e.g. via a mobile network (e.g. 3G, 4G, etc.), WLAN or Bluetooth, etc. Advantageously, the external computing unit can be part of a system of distributed computing units.

[0011] In this context, component-specific data refers specifically to data that characterizes the component or its operation and is present within the vehicle itself, particularly in the vehicle's control units. This includes, in particular, current data that is acquired or determined within the vehicle during the current operation of the vehicle or the component. Specifically, component-specific data can include sensor values ​​acquired by sensors for the operation of the component. Alternatively or additionally, component-specific data can include actuator values ​​for controlling actuators required for the component's operation. For example, component-specific data might include temperature values, exhaust gas values, or pressure values ​​(e.g., an expected pressure drop when a valve in the urea dosing system is opened).

[0012] In this context, the data available in the external computing unit should be understood to mean, in particular, data that is not present in the vehicle or component during its current operation. The external computing unit can obtain this data from other sources, for example. Specifically, the data available in the external computing unit consists of reference or comparison data that characterizes the component or its error-free operation, but which cannot be captured during the component's current operation and is not stored in the vehicle itself. By deriving a plausibility criterion from the data available in the external computing unit, it is useful to deduce whether the received component-specific data is plausible and originates from an unmanipulated or a manipulated component.

[0013] The vehicle component could be, for example, a particulate filter, an exhaust gas recirculation system, an exhaust aftertreatment system, or a metering system. In the case of an exhaust gas recirculation system or an exhaust aftertreatment system, the component-specific data could be, for example, exhaust system-specific data that describe the exhaust gas, such as its composition and / or its temperature.

[0014] Within the framework of the present procedure, the received component-specific data and the data available in the external computing unit can be used to verify whether manipulation has occurred. During the plausibility check, it is specifically verified whether it is plausible, possible, probable, or realistic that the component-specific data were actually determined during the current operation of the component, or whether they are manipulated data or data resulting from a manipulated component. In particular, the data available in the external computing unit are used as comparative or reference values ​​for this purpose. These values ​​appropriately characterize error-free operation of the component or data that can be determined during error-free operation. In this sense, the plausibility criterion therefore includes a not excessively high, e.g.,deviations between the data that do not exceed a threshold value.

[0015] If the plausibility check determines that the component-specific data is plausible, it is specifically assessed whether the component's operation has been manipulated. Conversely, if the plausibility check determines that the component-specific data is implausible, it is specifically assessed whether the component's operation has been manipulated or could at least have been manipulated.

[0016] While an attacker might gain unrestricted direct physical access to the vehicle, its control units, and the data stored on them for manipulation purposes, they cannot easily gain access to an external computing unit (such as a cloud) with which the vehicle or its control units communicate via a wireless connection. At most, an attacker can manipulate the data transmitted from the vehicle to the external computing unit. However, once such data has been transmitted to the external computing unit, an attacker typically cannot access it again. Therefore, an attacker logically has no access to the data contained within the external computing unit.The invention therefore proposes to outsource the check for manipulation of the component to a computing unit external to the vehicle and to carry it out there using data available there, since an attacker cannot gain access to this and cannot influence a check for manipulation carried out there.

[0017] This method reliably verifies whether or not manipulation has occurred, particularly without the possibility of an attacker influencing the verification. Specifically, the plausibility check can be performed continuously or at regular intervals. For this purpose, the vehicle conveniently transmits the relevant component-specific data to the external computing unit continuously or at regular intervals.

[0018] By outsourcing manipulation monitoring to a separate computing unit, experts can conduct a more thorough review and verification of suspected manipulation, regardless of the vehicle's location. Furthermore, this prevents manipulation from going undetected by clearing the vehicle's fault memory. For example, manipulation during vehicle or engine start can clear a fault memory in a control unit. Often, a fault is only confirmed when a fault counter reaches a predefined threshold, such as when a specific fault occurs during several different journeys. However, clearing the fault memory resets the counter before each journey. Therefore, the counter cannot reach the threshold, and the manipulation remains undetected.Since the external processing unit and the data it contains are independent of the vehicle, such manipulation of the fault memory can be detected. In particular, the external processing unit can access the vehicle's current location, for example, via GPS. If fault memory deletion frequently occurs in conspicuous locations, especially outside of workshops, vehicle manipulation can be detected. In this sense, the plausibility criterion includes whether the fault memory deletion takes place in a permissible location, particularly in a workshop.

[0019] The data stored in the external computing unit originates from at least one other vehicle. In particular, these other vehicles can be operated in the vicinity of the vehicle and, for example, travel on the same road. Furthermore, the vehicle and the other vehicles can be of the same type or at least use identical or similar components.

[0020] According to the invention, the data stored in the external computing unit originates from at least one source relating to the vehicle's environment. These sources are, in particular, permanently installed measuring devices that measure the environment through which the vehicle is currently moving. For example, such a source could be an environmental measuring device that records, for instance, noise levels, air pollution, or similar factors in the vehicle's surroundings. In this case, for example, the data stored in the external computing unit could relate to a nitrogen oxide (NOx) level in the vehicle's environment and be compared with the vehicle's internal NOx levels as component-specific data. In this sense, the plausibility criterion therefore includes a deviation between the data that is not too large, e.g., not exceeding a threshold value.

[0021] Such a source could be, for example, an infrastructure monitoring system, such as a toll collection system. In this case, the data stored in the external computing unit could be used to create a theoretical model of the vehicle, enabling a realistic simulation of its current operation. Specifically, the data would characterize the environment in which the vehicle is currently moving, such as the road it is traveling on. Furthermore, the data could also include information about other road users currently in the vicinity of the vehicle.

[0022] In an unclaimed example, the data present in the external computing unit can also be historical data of the vehicle itself collected in the external computing unit. Specifically, this data consists of data received from the vehicle in the past, which is archived in the external computing unit and is no longer stored in the vehicle itself. Preferably, the plausibility criterion can include a deviation of the component-specific data from a trend derived from the historical data that is not too large, e.g., not exceeding a threshold value.

[0023] In particular, vehicle data can be stored securely in the external computing unit, preventing manipulation. The data can, for example, be time-stamped to allow for the tracking of its history and development.

[0024] Preferably, the component-specific data contained in the external computing unit originates from at least one other vehicle. In particular, the component-specific data originating from the vehicle and the data contained in the external computing unit are of the same type. For example, the component-specific data and the data contained in the external computing unit can be measured values ​​from the same or identical sensor, such as a NOx sensor. The data from the external vehicle constitutes representative reference data or comparative values, since it can be assumed that the other vehicles are at least largely unmodified and, in particular, are operated similarly to the vehicle being tested.Provided the vehicle has not been manipulated, its component-specific data should at least substantially correspond to the data of the other vehicles present in the external computing unit. In this sense, the plausibility criterion therefore encompasses a deviation between the data that is not too large, e.g., not exceeding a threshold value.

[0025] According to a particularly preferred embodiment, the component-specific data includes a specific component-specific parameter that is determined based on sensor values ​​from the vehicle. Advantageously, the external computing unit can instruct the vehicle to determine and transmit this parameter. Attackers often overcome existing methods for detecting manipulation, rendering it undetectable by conventional methods. Vehicle manufacturers must therefore constantly seek new ways to effectively detect manipulation. In particular, new parameters can be developed to detect manipulation. For example, such parameters could be sensor values ​​that are correlated and linked in a specific way.If a new such parameter has been developed, the external computing unit can inform the vehicle, which then determines this new parameter and transmits it to the external computing unit.

[0026] Preferably, the component-specific parameter is determined based on exhaust gas sensor readings from the vehicle. In this context, exhaust gas sensor readings are understood to mean, in particular, measured values ​​from one or more sensors in the vehicle's exhaust gas stream. For example, these exhaust gas sensor readings can relate to the proportion of nitrogen oxides in the exhaust gas or the exhaust gas temperature. A parameter determined from such exhaust gas sensor readings represents a particularly effective way to conveniently check components such as an exhaust gas recirculation system or an exhaust aftertreatment system for tampering. Such an exhaust gas sensor-dependent parameter is especially suitable for a urea dosing system for the proper operation of a catalyst for selective catalytic reduction.

[0027] Preferably, the component-specific parameter is determined as a function of the mean values ​​of a large number of sensor readings. This large number of sensor readings can, for example, be acquired within a specific time interval in the vehicle. The parameter is therefore advantageously a statistical value, which in particular compensates for fluctuations and irregularities in sensor readings, thus preventing false detection of manipulation due to short-term statistical fluctuations in sensor readings, even though none has occurred.

[0028] Preferably, the component-specific parameter is determined based on the current values ​​of the vehicle's internal combustion engine. This allows the sensor values ​​to be correlated with the current operation of the internal combustion engine, thereby improving and refining the plausibility assessment of the sensor values. Current values ​​of the internal combustion engine include, in particular, current values ​​for speed, engine speed, power, torque, etc.

[0029] According to a particularly preferred embodiment, the component-specific parameter comprises mean values ​​of a multitude of sensor readings as a function of current values ​​of the internal combustion engine, particularly preferably as a function of the current rotational speed and / or the current torque. These mean values ​​are determined, in particular, as a function of the current values ​​of the internal combustion engine, preferably in the form of the current rotational speed and the current torque. For example, the component-specific parameter can be presented in the form of tables or as functions or function graphs. Such a component-specific parameter represents a particularly effective means of detecting manipulation of the component.

[0030] Preferably, the component-specific parameter comprises mean values ​​from a multitude of exhaust gas sensor readings as a function of current values ​​from the internal combustion engine. This multitude of exhaust gas sensor readings includes, in particular, measured values ​​from exhaust gas sensors located in an exhaust gas stream both upstream and downstream of an injector for injecting a urea solution. Such a component-specific parameter is particularly advantageous for monitoring manipulation of a urea dosing system of a catalyst for selective catalytic reduction.

[0031] If, based on the plausibility check, it is determined that the component has been manipulated, a predefined action is taken. Specifically, this action verifies whether the component has indeed been manipulated. At least one further check is then performed to determine if manipulation has occurred. The final assessment can be based on the individual results. For example, if the final assessment exceeds a certain threshold, manipulation can be detected.

[0032] In particular, it is also conceivable that, as a first step, a counter is incremented and that a further check is carried out when this counter reaches a predefined threshold. Such a further check could, in particular, be an active test in which a search is actively conducted for whether the component has been tampered with. This further check could, for example, also be carried out in the external computing unit or, more specifically, directly in the vehicle by a control unit. Since signals can hardly be manipulated by an attacker during such an active test, these tests are an effective method to verify whether the component has actually been tampered with.

[0033] According to the invention, the component is a catalyst for selective catalytic reduction (SCR) or a dosing system or urea dosing system for such a catalyst. As explained above, during the operation of such a catalyst, a urea solution is injected into the exhaust gas stream. A hydrolysis reaction produces ammonia and CO₂ from the urea solution. This ammonia reacts with nitrogen oxides (NO, NO₂) in the exhaust gas stream and reduces them. The amount of injected urea depends on the engine's nitrogen oxide emissions and thus on the current engine speed and torque. A manipulated operation of such a catalyst or...In this context, the manipulation of a corresponding dosing system should be understood to mean, in particular, that the dosing system is manipulated in such a way that no or at least hardly any urea is injected into the exhaust gas, for example, by completely deactivating the dosing system. Furthermore, during such manipulation, sensor values ​​from a correctly functioning dosing or SCR system are simulated and transmitted to a control unit of the vehicle in order to prevent the manipulation from being detected. This method is particularly advantageous for detecting the manipulated operation of such a catalyst for selective catalytic reduction or of a corresponding urea dosing system for the proper operation of such a catalyst.

[0034] A computing unit according to the invention is, in particular in terms of programming, equipped to carry out a method according to the invention.

[0035] Implementing the process as a computer program is also advantageous, as this incurs particularly low costs, especially if the executing control unit is already used for other tasks and is therefore already present. Suitable data carriers for providing the computer program include magnetic, optical, and electrical storage devices, such as hard drives, flash memory, EEPROMs, DVDs, etc. Downloading the program via computer networks (Internet, intranet, etc.) is also possible.

[0036] Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawing.

[0037] The invention is schematically illustrated in the drawing using exemplary embodiments and is described below with reference to the drawing. Brief description of the drawings

[0038] Figure 1 schematically shows a system consisting of a vehicle and an external computing unit configured to perform a preferred embodiment of a method according to the invention for detecting vehicle tampering. Figure 2 schematically shows a preferred embodiment of a method according to the invention as a block diagram. Figure 3 schematically shows a system consisting of a vehicle and an external computing unit configured to perform a preferred embodiment of a method according to the invention. embodiment(s) of the invention

[0039] Figure 1Figure 1 schematically shows a vehicle 110, which is to be examined to determine whether a component of the vehicle 110 has been manipulated, for example, a urea dosing system for a catalyst for selective catalytic reduction. For this purpose, the vehicle 110 transmits component-specific or catalyst-specific data during its operation via a radio connection 130, for example, via a mobile network such as 3G, 4G, etc., and possibly the internet, to an external computing unit 120 or to an external computing unit system 120 (in particular to a so-called cloud).

[0040] The vehicle-external computing unit 120 can also receive further data via the radio link 130, in particular from other vehicles 150 that are, for example, in the vicinity of vehicle 110 or that use the same type of catalytic converter as the vehicle 110 under investigation. Although in Figure 1For the sake of clarity, only one other vehicle 150 is shown; it is understood that the vehicle-external computing unit 120 can receive data from a large number of other vehicles 150.

[0041] Furthermore, the vehicle-external computing unit 120 can receive additional data from sources 140 permanently installed in the vicinity of the vehicle 110, e.g. from an environmental measuring device 141, for example to determine air pollution in the vicinity of the vehicle 110, or from an infrastructure monitoring device 142, for example in the form of a toll monitoring device.

[0042] It should also be noted here that in Figure 1 For the sake of clarity, only two such sources 140 are shown, but the vehicle-external computing unit 120 can receive data from a large number of such sources 140.

[0043] In order to detect whether manipulation of the catalyst or the dosing system of the vehicle 110 has occurred, the vehicle-external computing unit 120 is configured, particularly by means of software, to carry out a preferred embodiment of a method according to the invention, as described in Figure 2 schematically represented as a block diagram and subsequently in relation to the Figures 1 and 2 will be explained.

[0044] In block 210, the vehicle-external computing unit 120 receives data relating to both the vehicle 110 and its surroundings.

[0045] In step 211, the external computing unit 120 receives component-specific or catalyst-specific data from the vehicle 110, in particular a specific parameter for SCR system verification. This parameter is, in particular, an average value of exhaust gas sensor readings as a function of the current values ​​of the internal combustion engine of the vehicle 110. These exhaust gas sensor readings are, for example, measurements from exhaust gas sensors, such as NOx sensors, which are arranged in an exhaust gas stream both upstream and downstream of an injector for injecting the urea solution. The average values ​​of these exhaust gas sensor readings are determined and stored, in particular as a function of the current values ​​of the internal combustion engine in the form of the current engine speed and torque, over a predefined period.

[0046] In step 212, the external computing unit 120 also receives further data from additional vehicles 150. This additional data consists of a corresponding characteristic value from each of the additional vehicles 150, calculated as the average of the respective exhaust gas sensor values ​​depending on the respective current values ​​of the internal combustion engine.

[0047] In block 220, a plausibility check of the received data is performed in the external computing unit 120, whereby a plausibility criterion is derived from the data available in the external computing unit 120.

[0048] In step 221, the additional data received in step 212 can, for example, be statistically evaluated, e.g., to determine an expected value for the characteristic parameter in an unmanipulated vehicle. Preferably, the mean values ​​determined from the downstream exhaust gas sensor during ongoing vehicle operation at the respective characteristic operating points (engine speed, torque) are compared with the values ​​typically expected for the vehicle at these respective operating points in order to calculate the deviation as a residual at each operating point. The operating-point-dependent residuals obtained in this way are normalized to the respective operating-point-dependent expected value to obtain an operating-point-dependent percentage deviation. The expected values ​​can be stored in the vehicle-specific computing unit 120 based on the vehicle-specific 'Vehicle Identification Number' (VIN) transmitted.

[0049] In step 222, the component- or catalyst-specific data received from vehicle 110 in step 211 are compared with the data received in step 212 and, if applicable, statistically evaluated in step 221, which is available in the external computing unit. In this sense, the plausibility criterion therefore includes a deviation of the component-specific data from the expected value that is not too large, e.g., not exceeding a threshold value.

[0050] If the characteristic value of vehicle 110 and the characteristic values ​​of the other vehicles 150 are at least essentially the same and do not differ from each other by more than a predetermined value of, for example, 5%, step 223 assesses that there is no manipulation of the dosing system of the SCR catalyst.

[0051] However, if the characteristic value of vehicle 110 and the characteristic values ​​of the other vehicles 150 differ from each other by more than the specified value of, for example, 5%, step 224 assesses whether manipulation of the dosing system has occurred or could have occurred.

[0052] In the latter case, a predefined action is carried out in step 230; for example, an error counter can be incremented. If this error counter reaches a threshold, an additional predefined action can be taken to actively check whether manipulation has actually occurred. The external computing unit 120 can instruct the vehicle 110 to perform such an active check for this purpose.

[0053] As an active test of the dosing system, for example, the rigidity of the urea dosing system and the expected pressure drop when a valve of the urea dosing system is opened can be determined using a theoretical model. The rigidity specifically describes the pressure drop after a reduction in pump output with the dosing valve closed. The urea dosing system can then be activated for testing purposes; in particular, the valve can be opened, and the measured values ​​can be compared with the theoretical values ​​of the model.

[0054] The detection of manipulated operation can be further improved by implementing one or more predefined measures when, based on the plausibility check, it is assessed that the component has been manipulated. In particular, these measures can then be used to verify whether the component has actually been manipulated.

[0055] For example, one such measure could be a system test as a further check to determine whether manipulation has occurred.

[0056] For example, one such measure could be to check whether sufficient urea has been replenished in light of the distances traveled and / or operating times; in particular, the ratio of fuel consumption to urea consumption is plausible.

[0057] For example, one such measure could be to check whether, as shown above, a frequent clearing of the error memory takes place.

[0058] The final score can be composed of weighted individual results. For example, if the final score exceeds a certain threshold, manipulation can be detected.

[0059] In Figure 3a The system consisting of the vehicle 110 and the vehicle-external computing unit 120 is shown schematically according to a preferred embodiment of the method according to the invention.

[0060] The vehicle 110 has a first control unit 310, for example, an engine control unit. Furthermore, the vehicle 110 has a second control unit 320, which is configured as a connection control unit for the connection and communication between the vehicle 110 and the external computing unit 120. For example, this connection control unit 320 can be configured as a so-called "Connectivity Control Unit" (CCU). The control unit 310 and the connection control unit 320 can communicate with each other, particularly in encrypted form, via a communication system of the vehicle, e.g., via a fieldbus such as CAN.

[0061] The control unit 310 determines, in particular, the component-specific / catalyst-specific data or the component-specific / catalyst-specific parameter, which are to be transmitted to the external computing unit 120 for manipulation testing. A corresponding module of the control unit 310 for determining this data is designated 311.

[0062] The control unit 310 transmits this data via the communication system to the connection control unit 320, which in turn transmits this data to the external computing unit 120. A corresponding transmitter module of the connection control unit 320 is designated 321.

[0063] The vehicle-integrated computing unit 120 includes a receiver module 331 to receive this data and, if necessary, further data from other vehicles 150 or other sources 140. Furthermore, a plausibility module 332 is included, which performs the plausibility check of the received data, as described above. Figure 2 explained.

[0064] If, during the plausibility check 332, it is assessed that manipulation of the urea dosing system of the catalyst of vehicle 110 has occurred or could at least occur, this result is transmitted to a coordination module 335.

[0065] Furthermore, the control unit 310 can perform additional on-board checks for manipulations using corresponding modules 312, 313, and 314 located in the vehicle 110 itself. The results of these checks are transmitted from the control unit 310 to the connection control unit 320 and then by corresponding transmitter modules 322, 323, and 324 to the external computing unit 120, in particular to the coordination module 335.

[0066] In particular, the coordination module 335 increments a counter each time, during one of these checks 331, 312, 313, 314, it is assessed that manipulation of the urea dosing system of the catalytic converter of vehicle 110 has occurred or could have occurred. When this counter reaches a threshold, the coordination module 335 instructs vehicle 110, specifically control unit 310, to perform an active check for manipulation.

[0067] For example, if a new component-specific parameter has been developed by a vehicle manufacturer that can reliably detect manipulation, the coordination module 335 can instruct the control unit 310, in particular module 311, to determine and transmit this component-specific parameter in the future.

[0068] It should be noted here that the coordination module 335 for coordinating the results of various checks for manipulation can also be implemented in the connection control unit 320, as shown in Figure 3b This is shown. In this case, the transmitter modules 322, 323, and 324 can be omitted. The result of the plausibility check 332 is transmitted in this case from the external computing unit 120 to the coordination module 335 in the connection control unit 320.

Claims

1. Method for detecting manipulated operation of a component of a vehicle (110), wherein component-specific data originating from the vehicle (110) are received (211) in an extravehicular computing unit (120), wherein a plausibility check (220) of the component-specific data relating to the vehicle (110) is carried out in the extravehicular computing unit (120) using data available in the extravehicular computing unit (120), wherein a plausibility criterion is derived (222) from the data available in the extravehicular computing unit (120), wherein the data available in the extravehicular computing unit are component-specific data from a plurality of further vehicles and from at least one permanently installed source (140) concerning an environment of the vehicle (110), and wherein the plausibility criterion comprises a deviation not exceeding a predefined threshold value between the component-specific data relating to the vehicle and the component-specific data relating to the further vehicles, wherein, on the basis of a result of the plausibility check (220), it is assessed whether there is manipulated operation of the component of the vehicle (110), and wherein, if it is assessed on the basis of the result of the plausibility check (220) that there is (224) manipulated operation of the component, at least one further check of whether there is manipulation is carried out (230), for which purpose the vehicle (110) is instructed by the extravehicular computing unit (120) to carry out an active check of the component, wherein the component is a catalytic converter for the selective catalytic reduction of a vehicle (110) or a urea metering system for such a catalytic converter.

2. Method according to Claim 1, wherein the component-specific data comprise a certain component-specific characteristic variable which is determined (211) on the basis of sensor values of the vehicle (110).

3. Method according to Claim 2, wherein the component-specific characteristic variable is determined (211) on the basis of exhaust gas sensor values of the vehicle (110).

4. Method according to Claim 2 or 3, wherein the component-specific characteristic variable is determined (211) on the basis of mean values of a multiplicity of sensor values.

5. Method according to one of Claims 2 to 4, wherein the component-specific characteristic variable is determined (211) on the basis of current values of an internal combustion engine of the vehicle (110).

6. Method according to one of Claims 2 to 5, wherein the component-specific characteristic variable comprises (211) mean values of a multiplicity of sensor values on the basis of current values of the internal combustion engine of the vehicle (110).

7. Device consisting of a vehicle (110) and an extravehicular computing unit (120), which is designed to carry out a method according to one of the preceding claims.

8. Computer program which causes a computing unit (120) to carry out a method according to one of Claims 1 to 6 when executed on the computing unit according to Claim 7.

9. Machine-readable storage medium with a computer program according to Claim 8 stored thereon.