METHOD FOR OPERATING A VEHICLE SPEED SENSOR DEVICE, VEHICLE SPEED SENSOR DEVICE AND VEHICLE WITH A VEHICLE SPEED SENSOR DEVICE

Description

[0001] The invention relates to a method for operating a motor vehicle speed sensor device, a motor vehicle speed sensor device and a motor vehicle with a motor vehicle speed sensor device.

[0002] To monitor compliance with legal regulations regarding permitted speeds and rest periods for motor vehicles, it is common practice to install digital tachographs in motor vehicles. These digital tachographs are connected to vehicle speed sensor devices for recording the speed of the vehicle. The speed values ​​are received by the digital tachographs and logged by them. These vehicle speed sensor devices are usually Hall sensors or optical sensors arranged in a gearbox of the vehicle for detecting the rotation of an incremental wheel. Magnets or optical markers are usually attached to the incremental wheel, which can be detected by the vehicle speed sensor device at a predetermined position.When the vehicle is in motion, the incremental wheel rotates depending on the current speed of the vehicle. Thus, the vehicle speed sensor device periodically records a physical quantity. By detecting the periodic signal, it is possible to determine the vehicle's speed based on the rotation of the incremental wheel and transmit this value to the digital tachograph.

[0003] Digital tachographs and vehicle speed sensor devices are the target of unauthorized manipulation carried out to circumvent violations of legal regulations regarding rest periods. Such manipulation occurs, for example, by altering a message sent from a sensor unit to an evaluation unit of the vehicle speed sensor device or by replacing the sensor unit of the vehicle speed sensor device with an unauthorized sensor unit. This results in deviating speed data being transmitted to the digital tachograph device, thereby concealing violations of the law.

[0004] In order to prevent manipulation, devices and methods are common that are intended to detect or prevent manipulation of a signal during transmission from a motor vehicle speed sensor device to a digital tachograph.

[0005] EP 0 829 069 B1 discloses a data transmission device in a vehicle, consisting of a pulse generator and a control device. The pulse generator is connected to the control device via a signal line and a data line. The signal line is provided for unencrypted transmission of a signal, while the data line is provided for encrypted transmission of the signal. The control device is configured to compare the encrypted signal with the unencrypted signal to verify the integrity of the signal.

[0006] However, manipulation of the vehicle speed sensor device cannot be detected.

[0007] DE 10 2018 132 506 A1 relates generally to tire pressure monitoring systems and, more particularly, to a method and apparatus for facilitating tire pressure monitoring system transmission mode selection. A method is disclosed comprising the steps of receiving an unencrypted signal indicating abnormal tire pressure using a processor, switching to an encrypted mode with sensors using the processor, receiving an encrypted follow-up tire pressure status from the sensors using the processor, and determining whether the unencrypted signal is authentic based on the encrypted follow-up tire pressure status using the processor.

[0008] It is an object of the invention to prevent manipulation of a motor vehicle speed sensor device. The invention comprises a method according to claim 1 for operating a motor vehicle speed sensor device having a sensor unit and an evaluation unit. An identification feature of the sensor unit is stored in each of the sensor unit and the evaluation unit. The identification feature makes it possible to uniquely identify the sensor unit. This can be, for example, a serial number of the sensor unit. The identification feature for identifying the sensor unit is stored both in the sensor unit and in the evaluation unit. The storage can have taken place, for example, during production of the sensor unit and / or the evaluation unit.

[0009] The sensor unit can be a sensor with a circuit configured to detect a physical quantity associated with a motor vehicle speed. The method provides for the sensor unit to detect this physical quantity and to generate a measurement signal depending on the physical quantity. In other words, the physical quantity is measured by the sensor unit, and the measurement signal is generated by the sensor unit. The sensor unit generates a check value in a predetermined security process, at least depending on the measurement signal and the identification feature of the sensor unit. The check value is also generated depending on a counter value of the message.

[0010] In other words, the sensor unit performs the predetermined security procedure to create the check value assigned to the identification feature and the measurement signal. The check value can be assigned to the individual measurement signal and the identification feature of the sensor unit. For example, it can be a checksum. This means that the check value is only valid for the respective identification feature in combination with the respective measurement signal. This makes it possible to detect manipulation or alteration of the measurement signal and / or the identification feature based on an invalid check value.

[0011] The sensor unit generates a message containing the measurement signal and the test value. The message is transmitted from the sensor unit to the evaluation unit. In other words, the message, which includes the measurement signal and the associated test value, is sent by the sensor unit and received by the evaluation unit. The evaluation unit checks the test value in a predetermined test procedure, at least depending on the measurement signal, the identification feature of the sensor unit, and the counter value of the message. In other words, the predetermined test procedure is carried out by the evaluation unit to verify the received measurement signal and the authorship of the sensor unit. This makes it possible to check whether the measurement signal was altered during transmission and / or whether the measurement signal was sent by another sensor unit.If the test value verification procedure is successful, the measurement signal is released by the evaluation unit. In other words, the measurement signal is recognized as valid and from an authorized location and released for further processing or forwarding.

[0012] The invention provides the advantage that manipulation of a motor vehicle speed sensor device can be detected by replacing a sensor unit.

[0013] The invention also includes optional developments which result in further advantages.

[0014] A further development of the invention provides that the sensor unit is a digital Hall sensor. In other words, the sensor unit is a Hall probe configured to detect a magnetic field using the Hall effect and output the detected magnetic field as a digital measurement signal. The digital Hall sensor can comprise an integrated circuit configured to generate the measurement signal and the message. This provides the advantage of enabling the vehicle speed to be determined by detecting a periodic magnetic field generated by a magnet of a rotating incremental wheel.

[0015] A further development of the invention provides that the sensor unit is a digital optical sensor. In other words, the sensor unit is configured to detect an optical signal. For example, it can be provided that an optical marking is arranged on an incremental wheel in order to be able to determine the vehicle speed based on a detection frequency of the marking.

[0016] A further development of the invention provides that the measurement signal is transmitted from the evaluation unit to a digital tachograph if the test procedure is passed. In other words, if the test value is valid, the measurement signal is sent from the evaluation unit to the digital tachograph. This offers the advantage that the digital tachograph only receives measurement signals that are guaranteed to originate from the permissible sensor unit. For example, it can be provided that the measurement signal contained in the message is checked during the test procedure, and the measurement signal is only transmitted to the digital tachograph if the test value is valid.

[0017] The invention provides that the check value is generated in the predetermined security method depending on a counter value of the message, and the check value is checked in the predetermined security method depending on the counter value of the message. In other words, the check value is generated depending on a value that is created individually for the respective message. The counter value can, for example, be a counter value that can increase with each message sent in the sensor unit and with each message received by the evaluation unit. This results in the advantage that a duplicate message can be identified by the evaluation unit via the check value.This ensures that it is not possible to carry out manipulation by intercepting a message on its way from the sensor unit to the evaluation unit and sending it to the evaluation unit multiple times. This makes it possible to detect so-called replay attacks, which describe the retransmission of an intercepted message. For example, it can be provided that forwarding of the measurement signal is prevented if the test value matches a previously received test value.

[0018] A further development of the invention provides that the counter value of the message includes a timestamp. In other words, the check value is generated based on a timestamp, which can be, for example, a time and / or a date. This has the advantage of ensuring that the message is up-to-date.

[0019] A further development of the invention provides that the identification feature of the sensor unit is stored in a respective non-rewritable memory of the sensor unit and the evaluation unit. In other words, the identification feature is stored in the sensor unit and the evaluation unit in such a way that it cannot be subsequently changed, i.e., after a single write. This provides the advantage that manipulation by exceeding the identification feature is prevented.

[0020] A further development of the invention provides for the message to be transmitted in encrypted form from the sensor unit to the evaluation unit. In other words, the message is encrypted by the sensor unit before being sent to the evaluation unit and decrypted again by the evaluation unit upon receipt. This has the advantage of making it more difficult to analyze an intercepted message. Encryption can be performed, for example, using a symmetric method with a key stored in the sensor unit and the evaluation unit, or using an asymmetric method with a key pair, with one key of the key pair being stored in the sensor unit and a corresponding key being stored in the evaluation unit.

[0021] The invention also encompasses a motor vehicle speed sensor device according to claim 8. The motor vehicle speed sensor device has a sensor unit and an evaluation unit, each of which stores an identification feature of the sensor unit. The sensor unit is configured to detect a physical quantity and generate a measurement signal depending on the physical quantity. The sensor unit is configured to generate a test value in a predetermined security method, at least depending on the measurement signal and the identification feature of the sensor unit. The sensor unit is configured to send a message comprising the measurement signal and the test value to the evaluation unit.The evaluation unit is configured to receive the message and, in a predetermined test procedure, to check the test value at least as a function of the measurement signal and the identification feature of the sensor unit. The evaluation unit is configured to release the measurement signal if the test procedure is passed.

[0022] The invention also includes a motor vehicle according to claim 9, comprising a motor vehicle speed sensor device. The motor vehicle can, in particular, be a truck or a passenger car. The motor vehicle speed sensor device can, for example, be arranged in a transmission of the motor vehicle and detect rotation of an element of the transmission. The motor vehicle can have a digital tachograph.

[0023] The invention also includes further developments of the motor vehicle speed sensor device according to the invention and the motor vehicle according to the invention, which have features as already described in connection with the further developments of the method according to the invention. For this reason, the corresponding further developments of the motor vehicle speed sensor device according to the invention and the motor vehicle according to the invention are not described again here.

[0024] The invention also includes combinations of the features of the described embodiments.

[0025] An exemplary embodiment of the invention is described below. This is shown in a schematic diagram: Fig. 1 a motor vehicle having a motor vehicle speed sensor device; Fig. 2 a sequence of a method for operating a motor vehicle speed sensor device; and Fig. 3 a further sequence of a method for operating a motor vehicle speed sensor device.

[0026] The exemplary embodiment explained below is a preferred embodiment of the invention. In the exemplary embodiment, the described components of the embodiment each represent individual, independently considered features of the invention, which also further develop the invention independently of one another.

[0027] Furthermore, the described embodiment can also be supplemented by further features of the invention already described.

[0028] In the figures, functionally identical elements are provided with the same reference numerals.

[0029] Fig. 1 shows a motor vehicle with a motor vehicle speed sensor device. The motor vehicle 1 can, for example, be a truck or a passenger car and have a motor vehicle speed sensor device 2 for detecting a driving speed. The motor vehicle speed sensor device 2 can, for example, be arranged on a transmission of the motor vehicle 1 and be configured to detect physical quantities associated with a motor vehicle speed. The motor vehicle speed sensor device 2 can, for example, be arranged opposite an incremental gear 3, wherein the incremental gear 3 can have a respective rotational speed depending on a vehicle speed.The speed of the incremental wheel 3 can be detected, for example, by detecting increments 4 of the incremental wheel 3 by a sensor unit 5 of the motor vehicle speed sensor device 2. The sensor unit 5 can, for example, be an optical sensor or a Hall sensor that can detect the increments 4. The increments 4 can, for example, have a magnetic element or an optical marking.

[0030] The sensor unit 5 can be configured to generate a measurement signal 7 depending on the physical quantity 6, for example a detected magnetic field. The measurement signal 7 can be digital, for example. To identify the sensor unit 5, an identification feature 8 of the respective sensor unit 5 is stored in the sensor unit 5, wherein the identification feature 8 can be a non-rewritable value. A circuit can be present in the sensor unit 5 which is configured to generate a test value 9 from the measurement signal 7 according to a predetermined security method, which makes it possible to check the integrity of the measurement signal 7 and the identification feature 8 in a predetermined test method. The test value 9 is generated at least depending on the measurement signal 7 and the identification feature 8 of the sensor unit 5, for example after a cyclic redundancy check.

[0031] This enables a receiver to check the integrity of the identification feature 8 and the measurement signal 7 using the check value 9.

[0032] The sensor unit 5 sends the measurement signal 7 together with the test value 9 in a message 10 to an evaluation unit 11. The evaluation unit 11 receives the message 10 and checks the test value 9 according to a predetermined test method at least depending on the measurement signal 7 and the identification feature 8.

[0033] The test method makes it possible to check whether the measurement signal 7 received by the evaluation unit 11 matches the measurement signal 7 sent by the sensor unit 5. Using the test value 9 and the identification feature 8, it is also possible to check whether the message 10 comes from the sensor unit 5 of the motor vehicle speed sensor device 2.

[0034] It is provided that a count value 12 is stored in both the sensor unit 5 and the evaluation unit 11. The count value 12 can be a sequence number of the message 10. The counter value 12 can have the number of sent messages 10 in the sensor unit 5 and the number of received messages 10 in the evaluation unit 11. It is provided that the check value 9 is generated in the sensor unit 5 depending on the count value 12. Thus, the check value 9 depends on the counter value in the sensor unit 5. It is provided that during the test procedure, the check value 9 is generated depending on the counter value 12 stored in the evaluation unit 11. Thus, the evaluation unit 11 can check whether an intercepted and duplicated message 10 was sent to the evaluation unit 11 by an unauthorized user in order to manipulate the logging.

[0035] It can be provided that the counter value 12 includes, for example, a time stamp 13 containing a current date or time. It can be provided that the transmission of the message 10 from the sensor unit 5 to the evaluation unit 11 is encrypted. It can be provided that, upon successful execution of the test method, the received measurement signal 7 is released by the evaluation unit 11. This can mean that the measurement signal 7 is further processed by the evaluation unit 11 and / or sent to a tachograph device 14 of the motor vehicle 1.

[0036] Fig. 2 shows the sequence of a method for operating a motor vehicle speed sensor device. In a first step S1, the physical quantity 6 is detected by the sensor unit 5. Depending on the detected physical quantity 6, the sensor unit 5 generates the measurement signal 7.

[0037] In a step S2, the sensor unit 5 generates a test value 9 according to a predetermined security method, at least as a function of the measurement signal 7 and the identification feature 8 stored in the sensor unit 5, which enables a unique identification of the sensor unit 5.

[0038] In a step S3, the sensor unit 5 generates the message 10, which includes both the measurement signal 7 and the test value 9.

[0039] This message 10 is transmitted from the sensor unit 5 to the evaluation unit 11.

[0040] In a step S4, the evaluation unit 11 verifies the received message 10, wherein in the predetermined test method the test value 9 is checked as a function of the measurement signal 7 of the message 10 as well as with the identification feature 8 stored in the evaluation unit 11.

[0041] In a step S5, if the verification of the test value 9 according to the predetermined test procedure is successful, the measurement signal 7 is released or further processed by the evaluation unit 11. If the test value 9 is evaluated as invalid in the predetermined test procedure, it can be provided that the received measurement signal 7 is discarded.

[0042] Fig. 3shows a sequence of a method. It is provided that the test value 9 is generated in the sensor unit 5 from the identification feature 8, the counter value 12 and the measurement signal 7. The message 10, which has the test value 9 and the measurement signal 7, is encrypted by the sensor unit 5 and sent to the evaluation unit 11. When the message 10 is received by the evaluation unit 11, the evaluation unit 11 decrypts the message 10 and carries out the predetermined test procedure. The check is carried out by checking the test value 9 with the measurement signal 7, the identification feature 8 and the counter value 12. If one of the values ​​has been manipulated, the test value 9 is evaluated as invalid in the test procedure.

[0043] A Hall IC is used as sensor unit 5 to detect the movement of a motor vehicle 1 in a motor vehicle speed sensor device 2. This Hall IC is connected to the evaluation unit 11 (application controller) via an analog signal line. In the security architecture, this connection can represent a vulnerability with potential for manipulation.

[0044] According to the current state of the art, an evaluation unit 11 cannot verify whether a measurement signal 7 in a received message 10 actually originates from the Hall IC sensor unit 5 installed in the motor vehicle speed sensor device 2. Therefore, it cannot be authenticated.

[0045] The sensor unit 5 can have a digital interface for transmitting the measurement signal 7 in a message 10. The protocol can provide a check value 9 for the message 10 in the form of a checksum for detecting random errors in the measurement signal 7. To authenticate the installed sensor unit 5, a secret can be included in this checksum. The secret can be a device-specific identification feature 8 that can be uniquely assigned to the sensor unit 5. The identification feature 8 can be incorporated into the sensor unit 5 and the evaluation unit 11 during production with a function that offers exclusively a write function and no read function. The identification feature 8 can also be implemented using a cryptographic algorithm (cryptographic checksum or encryption of the message).

[0046] In addition, a counter value 12 is used to consider so-called freshness information when generating the check value 9 in order to detect the replay of old messages 10. This can, for example, be a counter that is incremented with each new message 10. As an alternative to linking the checksum to the identification feature and using an additional, even randomly generated key to protect against tampering, it can be provided to use the key itself as the identification feature or to derive it from the identification feature using a predetermined procedure. The checksum in the message can then be generated as usual using a cyclic redundancy check (CRC) to detect transmission errors. The entire message can be encrypted with this shared secret ("identification key") to detect attacks.

[0047] The device-specific checksum allows a manipulated measurement signal to be detected. This solution makes it more difficult to carry out a manipulation attack.

[0048] Overall, the example shows how the invention can provide individualized communication with a sensor unit.

Claims

1. Method for operating a motor vehicle speed sensor device (2) having a sensor unit (5) and an evaluation unit (11), in each of which an identification feature (8) of the sensor unit (5) is stored, wherein - a physical variable (6) is recorded by the sensor unit (5) and a measurement signal (7) is generated as a function of the physical variable (6), - a test value (9) is generated by the sensor unit (5) at least as a function of the measurement signal (7) and the identification feature (8) of the sensor unit (5) in a predetermined security method, - a message (10) comprising the measurement signal (7) and the test value (9) is transmitted from the sensor unit (5) to the evaluation unit (11), - the test value (9) is checked by the evaluation unit (11) in a predetermined test method at least as a function of the measurement signal (7) and the identification feature (8) of the sensor unit (5), and - the measurement signal (7) is released by the evaluation unit (11) when a test method is successfully completed, wherein - the test value (9) is generated in the predetermined security method as a function of a counter value (12) of the message (10), and - the test value (9) is checked in the predetermined security method as a function of the counter value (12) of the message (10).

2. Method according to Claim 1, characterized in that the sensor unit (2) is a digital Hall sensor.

3. Method according to Claim 1, characterized in that the sensor unit (2) is a digital optical sensor.

4. Method according to one of the preceding claims, characterized in that the measurement signal (7) is transmitted from the evaluation unit (11) to a digital tachograph (14) when a test method is successfully completed.

5. Method according to one of the preceding claims, characterized in that the counter value (12) of the message (10) comprises a timestamp (13).

6. Method according to one of the preceding claims, characterized in that the identification feature (8) of the sensor unit (5) is stored in a respective non-rewritable memory of the sensor unit (5) and of the evaluation unit (11).

7. Method according to one of the preceding claims, characterized in that the message (10) is transmitted in encrypted form from the sensor unit (5) to the evaluation unit (11).

8. Motor vehicle speed sensor device (2), configured to carry out a method according to one of Claims 1 to 7, wherein the motor vehicle speed sensor device (2) has a sensor unit (5) and an evaluation unit (11), in each of which an identification feature (8) of the sensor unit (5) is stored, wherein - the sensor unit (5) is configured to record a physical variable (6) and to generate a measurement signal (7) as a function of the physical variable (6), - the sensor unit (5) is configured to generate a test value (9) at least as a function of the measurement signal (7) and the identification feature (8) of the sensor unit (5) in a predetermined security method, - the sensor unit (5) is configured to send a message (10) comprising the measurement signal (7) and the test value (9) to the evaluation unit (11), - the evaluation unit (11) is configured to receive the message (10), to check the test value (9) in a predetermined test method at least as a function of the measurement signal (7) and the identification feature (8) of the sensor unit (5), and to release the measurement signal (7) when a test method is successfully completed, wherein - the test value (9) is generated in the predetermined security method as a function of a counter value (12) of the message (10), and - the test value (9) is checked in the predetermined security method as a function of the counter value (12) of the message (10).

9. Motor vehicle (1) having a motor vehicle speed sensor device (2) according to Claim 8.