Protection against cybersecurity attacks on transmission control units

Abstract

The present invention relates to a vehicle control unit (12) for controlling an actuator (19) of a vehicle (18), said unit comprising: an input interface (24) for receiving, from an authentication device (14), a training authentication signal and an initialisation authentication signal in a training phase and an operation authentication signal in an operating phase after completion of the training phase; a discriminator (26) for comparing the training authentication signal with the initialisation authentication signal in the training phase using an artificial neural network having randomly initialised weights, the discriminator being designed to adapt the weights of the artificial neural network if the training authentication signal is recognised as corresponding to the initialisation authentication signal, the discriminator being designed to detect whether the operation authentication signal is a permissible signal in the operating phase using an artificial neural network having the weights adapted in the training phase; a feedback unit (28) for transmitting an error signal to the authentication device in the training phase, the error signal indicating whether the training authentication signal is recognised as corresponding to the initialisation authentication signal; and an output interface (30) for controlling the actuator (19) in the operating phase if the operation authentication signal is a permissible signal. The present invention also relates to an authentication device (14), an initialisation device (16), a system (10), a plurality of methods, and a computer programme product.

Description

[0001] Protection against cybersecurity attacks on transmission control units

[0002] The present invention relates to a vehicle control unit for controlling an actuator of a vehicle. The present invention further relates to an authentication device for transmitting authentication signals to a vehicle control unit. Furthermore, the present invention relates to an initialization device for initializing a vehicle control unit. Furthermore, the present invention relates to a system for protecting a vehicle control unit from attack, as well as methods for controlling an actuator, transmitting authentication signals, and initializing a vehicle control unit. Finally, the present invention relates to a computer program product.

[0003] The term cybersecurity or IT security refers to the protection of networks, computer systems, or cyber-physical systems from theft or damage, especially of processed or stored data, as well as from interruption or misuse of the services or functions offered. Cybersecurity is playing an increasingly important role in the context of vehicles. As more and more services and functions in vehicles are digital, and safety-critical functions are often largely executed by software, corresponding attacks can lead to damage or dangerous situations.

[0004] To protect a vehicle control unit from potential cybersecurity attacks, current approaches often involve storing a security key in a protected processor or in a specially protected processor component or memory. This security key is then exchanged and compared between the vehicle control unit and the protected processor. For example, access to firmware or a function of the vehicle control unit can only be permitted if it is determined that a corresponding security key is present and the accessing party is authorized to access it. To compare the key, existing approaches often require it to be sent via an interface (e.g., via a CAN bus), i.e., exchanged between different processors.This means that a potential attacker could potentially intercept the transmitted authentication information by eavesdropping on the communication and thereby gain access to the firmware or functions of the vehicle control unit. It may then be possible for the attacker to secretly replace the vehicle control unit's firmware or to control a function without authorization.

[0005] In this context, US2021 / 0114606 A1 discloses a system and method for detecting an intrusion into a vehicle system. A vehicle control system for a vehicle may include an in-vehicle bus and an attack detection system. The attack detection system is configured to calculate a planned output of the vehicle based on a message from a message stream received by at least one electronic control unit coupled to the in-vehicle bus. Furthermore, the attack detection device is configured to calculate a achievable set based on an uncertainty metric and to identify an intrusion based on a comparison of the planned output and the achievable set.

[0006] One challenge in this context is to further improve security against attacks. Based on this, the present invention aims to provide authentication that cannot easily be faked or manipulated. The aim is to ensure that safety-critical actuators of a vehicle can only be controlled if it is certain that the control is permitted or is being carried out by an authorized device. In particular, an attack based on eavesdropping on communication should be prevented or made more difficult.

[0007] To achieve this object, the present invention relates, in a first aspect, to a vehicle control unit for controlling an actuator of a vehicle, comprising: an input interface for receiving a training authentication signal and an initialization authentication signal in a training phase and an operation authentication signal in an operation phase after completion of the training phase from an authentication device;a discriminator for comparing the training authentication signal with the initialization authentication signal in the training phase using an artificial neural network with randomly initialized weights, wherein the discriminator is configured to adjust the weights of the artificial neural network when the training authentication signal is detected as corresponding to the initialization authentication signal, wherein the discriminator is configured to detect whether the operational authentication signal is a permissible signal in the operational phase using an artificial neural network with the weights adjusted in the training phase; a feedback unit for transmitting an error signal to the authentication device in the training phase, wherein the error signal indicates whether the training authentication signal is detected as corresponding to the initialization authentication signal;and an output interface for controlling the actuator in the operating phase when the operating authentication signal is a valid signal.;

[0008] In another aspect, the present invention relates to an authentication device for transmitting authentication signals to a vehicle control unit, comprising: an input interface for receiving a random noise signal; a feedback interface for receiving an error signal from the vehicle control unit;an authentication signal generator for generating a training authentication signal in a training phase based on the noise signal using an artificial neural network with randomly initialized weights, wherein the authentication signal generator is configured to adjust the weights based on the error signal, wherein the authentication signal generator is configured to generate an operational authentication signal in an operational phase after completion of the training phase based on the noise signal using an artificial neural network with the weights adjusted in the training phase;and an output interface for transmitting the training authentication signal to the vehicle control unit in the training phase and for transmitting the operation authentication signal to the vehicle control unit in the operation phase. Furthermore, one aspect of the present invention relates to an initialization device for initializing a vehicle control unit, comprising: an input interface for receiving a predefined periodic input signal; an initialization signal generator for generating an initialization authentication signal based on the input signal using an artificial neural network with weights determined based on a predefined security key; and an output interface for transmitting the initialization authentication signal to the vehicle control unit in a training phase.

[0009] In addition, one aspect of the invention relates to a system for protecting a vehicle control unit against an attack, comprising a vehicle control unit as described above, an authentication device as described above and an initialization device as described above.

[0010] Further aspects of the invention relate to methods configured according to the vehicle control unit or the authentication device and the initialization device, as well as to a computer program product with program code for performing the steps of the methods when the program code is executed on a computer. Furthermore, one aspect of the invention relates to a storage medium on which a computer program is stored that, when executed on a computer, causes the methods described herein to be executed.

[0011] Preferred embodiments of the invention are described in the dependent claims. It is understood that the features mentioned above and those to be explained below can be used not only in the respective combinations specified, but also in other combinations or on their own, without departing from the scope of the present invention. In particular, the vehicle control unit, the authentication device, the initialization device, the system, the methods, and the computer program product can be designed according to the embodiments defined for the vehicle control unit, the authentication device, the initialization device, and the system in the dependent claims.

[0012] According to the invention, a generative adversarial network (GAN) architecture is used to secure communication between different components in a vehicle. During a training phase, a signal based on a predefined security key is generated in an initialization device. The predefined security key is used to initialize weights of an artificial neural network. By applying a well-defined and preferably temporally periodic input signal to this artificial neural network with known weights, an output signal can be generated that does not change over time. This initialization authentication signal is transmitted to the vehicle control unit as a true signal (ground truth).

[0013] At the same time, during the training phase, another signal is generated in the authentication device, which is also generated based on a noise signal using an artificial neural network. The weights of the artificial neural network in the authentication device are initially randomly initialized. During the training phase, the weights are adjusted to change the characteristics of the generated training authentication signal.

[0014] A discriminator in the vehicle control unit checks whether a difference can be detected between the initialization authentication signal and the training authentication signal. Based on this decision, an error signal is transmitted back to the authentication device. Based on this error signal, the artificial neural network in the authentication device can be adapted to change the characteristics of the generated training authentication signal. In this process, the artificial neural network in the authentication device essentially learns how to generate an authentication signal whose characteristics correspond to the initialization authentication signal. Also during the training phase, the discriminator in the vehicle control unit is trained to distinguish between the initialization authentication signal and the training authentication signal.In this respect, the artificial neural networks in the authentication device and the discriminator of the vehicle control unit compete with each other. On the one hand, they attempt to generate a signal that is as close as possible to a predefined initialization authentication signal and is indistinguishable from it. On the other hand, the vehicle control unit attempts to detect precisely this difference.

[0015] After the training phase is completed, the authentication device then uses an artificial neural network in an operating phase to generate an operational authentication signal. This artificial neural network is initialized based on the weights previously adjusted in the training phase. The operational authentication signal corresponds to the training authentication signal after the training phase has been completed. This signal is transmitted to the vehicle control unit. There, the discriminator is able to decide whether the received operational authentication signal is a true signal whose characteristics correspond to the initialization authentication signal.In other words, it can be determined whether the operational authentication signal generated based on a random input was generated by an artificial neural network in the authentication device operated with appropriate weights. Only if it is determined that the received operational authentication signal is a true or permissible signal will a corresponding actuator, in particular a safety-critical actuator of the vehicle, be triggered.

[0016] In contrast to previous approaches, which required the transmission of the security key itself, according to the invention, only an operational authentication signal generated based on a random input is transmitted during the operating phase. The authentication device comprises a previously trained artificial neural network for generating this signal. Therefore, it is not necessary to transmit the security key itself, meaning that an attacker cannot extract it from the communication between the protected processor and the vehicle control unit. On the one hand, this ensures that authentication cannot be easily faked or manipulated. On the other hand, it becomes possible for an actuator to be controlled only if secure authentication is present.

[0017] In a preferred embodiment of the vehicle control unit, the output interface of the vehicle control unit is configured to control the actuator during the operating phase if the operating authentication signal does not correspond to a previously received operating authentication signal. In other words, this ensures that a permissible signal cannot be obtained by simply intercepting the communication and retransmitting the same signal. To obtain a permissible signal, the operating authentication signal must be unique, i.e., it must not correspond to a previously transmitted operating authentication signal. For this purpose, all previously received operating authentication signals are stored to enable appropriate verification. Security is further improved.

[0018] In a preferred embodiment of the vehicle control unit, the discriminator is configured to use a fully connected convolutional neural network during the training and operation phases. The use of such neural networks in a GAN architecture enables efficient implementation. The requirements for the required computing power and performance remain manageable.

[0019] In a preferred embodiment of the authentication device, the input interface of the authentication device is configured to receive white noise. White noise is received as a random noise signal. This white noise can be generated, for example, by a suitable noise generator.

[0020] In a preferred embodiment of the authentication device, the authentication signal generator is designed to use a fully connected convolutional neural network. This enables efficient implementation of the GAN architecture provided by the invention. The hardware requirements remain manageable.

[0021] In a preferred embodiment of the authentication device according to the invention, the authentication signal generator is configured to terminate the training phase when the error signal indicates that the vehicle control unit recognizes the training authentication signal as corresponding to the initialization authentication signal. In other words, the training phase continues until the authentication signal generator succeeds in generating a signal that is no longer distinguishable from the initialization signal generated based on the predefined security key. In other words, the training continues until the desired functionality can be provided in the operating phase.

[0022] In a preferred embodiment of the initialization device, the input point of the initialization device is configured to receive a sinusoidal signal. Using a sinusoidal signal allows for the generation of a repeating periodic initialization authentication signal. Furthermore, efficient and simple signal generation is achieved.

[0023] In a preferred embodiment of the system according to the invention, the output interface of the vehicle control unit is configured to generate the random noise signal during the operating phase. The input interface of the authentication device is configured to receive the random noise signal from the vehicle control unit during the operating phase. The discriminator of the vehicle control unit is configured to detect, based on the random noise signal, whether the operational authentication signal is a permissible signal during the operating phase. During the operating phase, the random noise signal, which represents the input signal for the authentication device, is thus generated in the vehicle control unit. This provides the vehicle control unit with information about which noise was used to generate the authentication signal. Based on this, it can be ensured that a coordinated response has been received.In this respect, it can be prevented that an attack can be carried out by eavesdropping on the communication or by repeatedly sending an authentication signal that has already been transmitted.

[0024] Herein, a vehicle control unit is understood to mean, in particular, an ECU (Electronic Control Unit) in a vehicle. In particular, a vehicle control unit controls various actuators of a vehicle, such as an engine, a brake, a steering system, a window lift, etc. Different sensors and different interfaces for receiving signals from a driver or an autonomous control system of a vehicle are usually also connected to the vehicle control unit. A permissible signal is understood to be a signal transmitted by a correspondingly authorized location. A permissible signal is therefore a signal transmitted by a location authorized to control an actuator. The aim of the inventive approach is, in particular, to detect whether a signal is permissible and, to that extent, whether a control command should be executed.In the comparison of signals carried out according to the invention, in particular characteristics of signals are compared. Using artificial neural networks, it is possible to perform a comparison between signals in order to determine whether these signals were generated based on the same rule. In this respect, a comparison of signals is preferably not about determining a possible identity, but about identifying a comparable characteristic or a comparable generation based on a comparable rule. In the present case, a vehicle is understood to mean in particular a passenger car, a truck, a motorcycle or another motor vehicle. It is understood, however, that a vehicle can also be understood to mean a bicycle or any other type of vehicle. A predefined or predetermined input signal is a signal that is determined by a previously known setting.

[0025] The invention is described and explained in more detail below using selected exemplary embodiments in conjunction with the accompanying drawings. Figure 1 shows a schematic representation of a system according to the invention for protecting a vehicle control unit from attack;

[0026] Fig. 2 a schematic representation of the implemented GAN approach;

[0027] Fig. 3 is a schematic representation of a vehicle control unit according to the invention;

[0028] Fig. 4 is a schematic representation of an authentication device according to the invention;

[0029] Fig. 5 is a schematic representation of an initialization device according to the invention;

[0030] Fig. 6 is a schematic representation of the operation of the inventive approach in the training phase;

[0031] Fig. 7 is a schematic representation of the operation of the inventive approach in the operating phase;

[0032] Fig. 8 is a schematic representation of an alternative mode of operation of the inventive approach;

[0033] Fig. 9 is a schematic representation of a method according to the invention for controlling an actuator;

[0034] Fig. 10 is a schematic representation of a method according to the invention for transmitting authentication signals to a vehicle control unit; and

[0035] Fig. 11 is a schematic representation of a method according to the invention for initializing a vehicle control unit. Fig. 1 schematically shows a system 10 according to the invention for protecting a vehicle control unit 12 from attack. The system comprises a vehicle control unit 12 as well as an authentication device 14 and an initialization device 16. The representation is to be understood as a schematic representation, wherein the vehicle control unit 12 and the authentication device 14 are integrated into a vehicle 18. The initialization device 16, in contrast, is arranged outside the vehicle 18 and can, for example, be in communication with the vehicle control unit and / or the authentication device 14 during manufacture of the vehicle. It is understood, however, that other arrangements are also possible; for example, the initialization device 16 can also be integrated into the vehicle 18.

[0036] According to the invention, a GAN architecture is used to protect an ECU from a cybersecurity attack. In particular, the vehicle control unit 12 is to be protected from an attack based on interception of a communication through which a transmitted key is read by the attacker.

[0037] In the illustrated embodiment, the vehicle 18 includes an actuator 19, which can, for example, actuate a brake on the rear wheel of the vehicle. It is understood that a different actuator may also be provided. According to the invention, the actuator 19 is controlled via the vehicle control unit 12. It is relevant here that the actuator 19 can only be controlled if the signal triggering the control comes from an authorized source. This is intended to prevent an attack, for example.

[0038] Fig. 2 schematically illustrates the approach of a GAN. The architecture is typically used to generate synthetic images that are often almost indistinguishable from real images. Essentially, a GAN consists of a generator 20 and a discriminator 22. Based on a random input, the generator 20 generates a synthetic signal, which is fed to the discriminator 22. At the end of a training phase, this signal should have the same characteristics as a real (specified or predefined) signal. The goal of the generator 20 is to learn to generate results according to a specific distribution. In contrast, the discriminator 22 is trained to distinguish the generator's results from the data from the real, specified distribution. At the output of the discriminator 22, a distinction is made between a true and a false synthetic signal from the generator.The training in the training phase works via a backpropagation approach, as indicated by the thick arrow.

[0039] Fig. 3 schematically illustrates a vehicle control unit 12 according to the invention, which implements part of the GAN architecture. The vehicle control unit 12 comprises an input interface 24, a discriminator 26, a feedback unit 28, and an output interface 30. Both the vehicle control unit 12 and the authentication device and initialization device described below allow the various units and interfaces to be implemented either selectively or entirely in software and / or hardware. In particular, the units can be embodied as processors, processor modules, or even as software for a processor. The vehicle control unit 12 can, in particular, be a central computer of a vehicle.

[0040] In a training phase, a training authentication signal and an initialization authentication signal are initially received in the vehicle control unit 12 via the input interface 24. In an operating phase following completion of the training phase, an operating authentication signal is received. For this purpose, the input interface 24 communicates with the initialization device (during the training phase) and with the authentication device (during the training phase and the operating phase). Communication can be wireless or wired. For example, communication can take place via a vehicle bus system, such as a CAN bus.

[0041] During the training phase, the training authentication signal is compared with the initialization authentication signal in the discriminator 26. For this purpose, an artificial neural network with randomly initialized weights is used. It is particularly advantageous to use a fully connected convolutional neural network. The network weights should be adjusted to distinguish between the two signals as reliably as possible. In other words, the discriminator 26 is trained to distinguish between the two signals. In this respect, the discriminator 26 corresponds to a discriminator of a GAN. Once the training phase is complete, the discriminator 26 detects whether the operational authentication signal is a valid signal.In other words, it is checked whether the operational authentication signal has a distribution or characteristic corresponding to the initialization authentication signal. For this purpose, the artificial neural network previously trained in the training phase is used.

[0042] A previously determined error signal is transmitted back to the authentication device via the feedback unit 28. During the training phase, feedback is provided to the generator in the authentication device using the output of the discriminator. Therefore, an error signal must be fed back in order to train the artificial neural network in the generator through backpropagation in the sense of a GAN architecture. The error signal represents the result of the comparison between the training authentication signal and the initialization authentication signal, thereby enabling an improvement in the generation of the training authentication signal.

[0043] During the operating phase, an actuator of the vehicle is controlled via the output interface 30, provided the operating authentication signal has been identified and recognized as a valid signal. In other words, the actuator is only controlled if it is ensured that the operating authentication signal is received by an authorized location. For this purpose, the output interface 30 can be connected to a vehicle actuator, for example, via a vehicle bus system. For example, a brake, a control system, or another actuator can be controlled.

[0044] Fig. 4 schematically illustrates an authentication device 14 according to the invention. The authentication device 14 comprises an input interface 32, a feedback interface 34, an authentication signal generator 36, and an output interface 38. As previously described, the various units and interfaces can be implemented partially or entirely in software and / or hardware. The authentication device 14 can, for example, be integrated into a control unit or into a reading device for reading a vehicle configuration (diagnostic device). The authentication device 14 corresponds in particular to an authorized body that is authorized to control or use vehicle actuators.

[0045] A random noise signal is received via input interface 32. The noise signal can, for example, be white noise generated by a corresponding signal generator.

[0046] The feedback interface 34 is configured to receive an error signal from the vehicle control unit. The feedback interface 34 can also be connected, for example, to a vehicle bus system in order to communicate with the vehicle control unit via the bus system. The error signal can, in particular, comprise binary information indicating whether a training authentication signal is recognized as true or as corresponding to an initialization authentication signal during the training phase.

[0047] The authentication signal generator 36 serves to generate a training authentication signal in a training phase based on the noise signal. For this purpose, an artificial neural network, in particular a fully connected convolutional neural network, is used. In the training phase, this artificial neural network is initialized with random weights. The weights are adjusted using a backpropagation approach using the error signal. Thus, the error signal provides feedback indicating whether the training authentication signal was recognized as corresponding to a predetermined distribution or not. If the training authentication signal is not recognized as a true signal, the weights are adjusted.

[0048] During the operation phase, an operational authentication signal is generated using the authentication signal generator 36. This operational authentication signal is generated using the artificial neural network trained in the training phase. In other words, the adjusted weights are used to generate a corresponding operational authentication signal whose distribution corresponds to the initialization authentication signal.

[0049] The training authentication signal during the training phase and the operation authentication signal during the operation phase are transmitted to the vehicle control unit via the output interface 38. Transmission can occur, as previously described, for example, via a vehicle bus system or via another method.

[0050] Fig. 5 schematically shows an initialization device 16 according to the invention. The initialization device 16 comprises an input interface 40, an initialization signal generator 42, and an output interface 44. The various units and interfaces can again be implemented partially or completely in software and / or hardware.

[0051] A predefined periodic input signal is received via the input interface 40. The input interface can be configured, for example, to receive a sinusoidal signal. The predefined periodic input signal is received by a correspondingly configured signal generator, which can also be integrated, for example, into the initialization device 16. It is also possible for the input interface 40 to be connected to a vehicle bus system in order to receive the input signal via it.

[0052] An initialization authentication signal is generated by the initialization signal generator 42. For this purpose, the input signal is used and modified by an artificial neural network. The artificial neural network comprises fixed weights based on a predefined security key. The predefined security key is used as a predefined secret for configuring the artificial neural network. The security key can, for example, be specified by the manufacturer.

[0053] The initialization authentication signal is transmitted to the vehicle control unit during the training phase via output interface 44. The authentication signal thus represents a type of ground truth information. The artificial neural network used in the initialization signal generator is configured identically to the artificial neural network used in the authentication device. This ensures that an operational authentication signal can be generated whose distribution corresponds to the initialization authentication signal.

[0054] During the training phase, the initialization authentication signal is transmitted to the vehicle control unit via the output interface. Communication can also take place via a vehicle bus system, for example.

[0055] Fig. 6 schematically illustrates the interaction of the vehicle control unit 12 with the authentication device 14 and the initialization device 16. The initialization signal generator 42, which can be arranged, for example, in a flash memory 46 of the initialization device 16, always generates a temporally defined signal with a predetermined characteristic. A predefined input signal (predefined periodic input signal) is used for this purpose. The initialization signal generator 42 can, for example, consist of a fully connected neural network (FC-NN) with several hidden layers. The number of hidden layers and thus the number of necessary matrix multiplications depends on the available performance of the corresponding processors. The initialization of the weights contained therein of this FC-NN is fixed to a value determined at the beginning.Together, the numerical values ​​of the weights of the initialization signal generator 42 represent a security key (anti-theft master key). During the training phase, the FC-NN always behaves the same. It always generates true initialization authentication signals in response to a given input signal, which are transmitted to the vehicle control unit 12.

[0056] The authentication signal generator 36 in the authentication device 14 can also be arranged, for example, in a flash memory 48 of the authentication device 14. This authentication signal generator 36 is preferably also based on an FC-NN, but is operated based on a random initialization of the weights. In the training phase (backpropagation), this authentication signal generator 36 generates as output a training authentication signal based on a random stochastic input signal (noise signal). For example, a white noise signal can be used for this purpose.

[0057] The discriminator 26, which can be arranged, for example, in a specially protected memory area 50 within a flash memory 52 of the vehicle control unit 12, receives as input, on the one hand, the initialization authentication signal from the initialization device 16 and, on the other hand, the training authentication signal from the authentication device 14. The discriminator 26 now has the task of distinguishing between the signals. In the training phase (with the aid of the backpropagation algorithm), the authentication signal generator 36 attempts to generate an increasingly similar signal characteristic that corresponds to the signal characteristic of the initialization authentication signal or the initialization signal generator 42.This is achieved by optimizing the weights in the artificial neural network of the authentication signal generator 36 (backpropagation) until the generated training authentication signal exhibits the desired characteristics. Training is therefore complete when the discriminator 26 recognizes the training authentication signal as true or similar to the signal from the initialization signal generator 42.

[0058] In this way, the authentication signal generator 36 is now able to generate a signal based on a random input (e.g., white noise) that corresponds to the characteristics of the signal from the initialization device. This signal can thus serve as a replacement for an anti-theft master key. The security key therefore no longer needs to be transmitted directly. The weights originally used when initializing the initialization signal generator 42, and thus the previously defined security key, no longer need to be exchanged. Reproducing the initialization device 16 is very difficult. In this way, the system can be protected from potential attackers, such as unauthorized access or code exchange. In the illustrated embodiment, for example, an actuator 19 connected via a COM interface or access to this actuator 19 is protected.Access can be established, for example, from a diagnostic device 54 via a corresponding diagnostic interface 56. In the illustrated embodiment, communication takes place via a CAN bus. It is understood that a different communication interface may also be used.

[0059] Fig. 7 schematically illustrates the use of the inventive approach in the operating phase. For example, if the vehicle control unit 12 is used in vehicle operation, authentication may be required for authentication when starting the vehicle using a corresponding actuator 19. Therefore, in the operating phase, the authentication signal generator 36 in the authentication device 14, which was trained before delivery of the vehicle or the vehicle control unit, generates a synthetic signal (operational authentication signal) based on a random noise signal and communicates this to the discriminator 26 of the vehicle control unit 12, which was trained before delivery. Based on the configuration of the discriminator 26 achieved in the training phase, the operational authentication signal can now be classified as true or false.If the signal is classified as true, access to actuator 19 is granted and compromise is denied. It is also possible that access is initiated from a diagnostic device 54 via a corresponding diagnostic interface 56.

[0060] To prevent a potential attacker from reusing a previously transmitted operational authentication signal, the vehicle control unit 12 to be protected can optionally be configured, as indicated by the return arrow 58, to generate the random input of the authentication signal generator 36. Furthermore, it is possible for the vehicle control unit 12 to require that the authentication signal generator transmit the signal used for generation and use a new random noise signal for each generation of a new operational authentication signal. This could alternatively also be ensured by using a hash value or a checksum. Furthermore, it is conceivable for the vehicle control unit 12 to repeatedly generate a randomly regenerated synthetic signal, to which the authentication signal generator 36 must provide a true response.In this way, the information exchanged for authentication can no longer be reused for compromise. The vehicle control unit to be protected only functions in conjunction with the authentication device 14 trained for it and can therefore no longer be exchanged unnoticed.

[0061] Fig. 8 schematically illustrates a variant of the inventive approach. In particular, it is shown that, for authentication within the vehicle control unit 12 to be protected, a direct comparison is also made between an operational authentication signal from the authentication signal generator 36 in the authentication device 14 and an initialization signal generator 42, which in the illustrated embodiment is implemented in the protected memory area 50 of a flash memory 52 of the vehicle control unit. In other words, the initialization signal generator 42 used in the initialization device is implemented directly in the vehicle control unit 12. It is then sufficient to compare the received operational authentication signal with the initialization authentication signal generated within the vehicle control unit by the initialization signal generator 42 in a corresponding comparator 60.Such a signal comparison is conceivable, for example, in the case of limited computing power, i.e., when only insufficient resources are available. Fig. 8 also shows, by way of example, that an actuator 19 is to be controlled, with access to it being initiated from a diagnostic device 54 via a corresponding diagnostic interface 56.

[0062] The advantage of this approach lies in the fact that, while a potential attacker can eavesdrop on communication via the vehicle bus system, no security key is transmitted directly. Only a randomly generated operational authentication signal is transmitted. Thus, despite potential access to the vehicle control unit, the firmware of a vehicle control unit could not simply be replaced, as the attacker lacks the initialization or initialization signal generator needed to reproduce the synthetic signals.

[0063] Figure 9 schematically illustrates a method according to the invention for controlling an actuator of a vehicle. The method comprises steps of receiving (S10) a training authentication signal and an initialization authentication signal, as well as an operational authentication signal, comparing (S12) the signals, detecting (S14) whether a valid signal is present, transmitting (S16) an error signal, and controlling (S18) an actuator.

[0064] Figure 10 schematically illustrates a method according to the invention for transmitting authentication signals. The method comprises the steps of receiving S20 a random noise signal, receiving S22 an error signal, generating S24 a training authentication signal, generating S26 an operational authentication signal, and transmitting S28 the authentication signals.

[0065] Finally, Fig. 11 schematically illustrates a method for initializing a vehicle control unit. The method comprises steps of receiving (S30) a predefined periodic input signal, generating (S32) an initialization authentication signal, and transmitting (S34) the initialization authentication signal.

[0066] Referring to Figs. 9, 10, and 11, the methods can be implemented, in particular, in the form of software that is executed on a processor of a vehicle or a vehicle control unit, a central computer of a vehicle, or a corresponding diagnostic device. It is understood that the methods can also be implemented in other ways.

[0067] The invention has been comprehensively described and explained with reference to the drawings and the description. The description and explanation are to be understood as exemplary and not restrictive. The invention is not limited to the disclosed embodiments. Other embodiments or variations will become apparent to those skilled in the art upon use of the present invention and upon careful analysis of the drawings, the disclosure, and the following claims.

[0068] In the patent claims, the words "comprising" and "having" do not exclude the presence of further elements or steps. The undefined article "a" or "an" does not exclude the presence of a plurality. A single element or unit can perform the functions of several of the units recited in the patent claims. An element, unit, interface, device, and system can be partially or completely implemented in hardware and / or software. The mere mention of some measures in several different dependent patent claims should not be understood to mean that a combination of these measures cannot also be used advantageously. A computer program can be stored / distributed on a non-volatile data carrier, for example on an optical memory or on a solid-state drive (SSD).A computer program may be distributed together with hardware and / or as part of hardware, for example, via the Internet or via wired or wireless communication systems. Reference signs in the patent claims are not to be construed as limiting.

[0069] Reference symbol

[0070] system

[0071] Vehicle control unit

[0072] Authentication device

[0073] Initialization device

[0074] vehicle

[0075] Actuator

[0076] generator

[0077] discriminator

[0078] Input interface of the vehicle control unit

[0079] Discriminator of the vehicle control unit

[0080] Feedback unit

[0081] Output interface

[0082] Input interface of the authentication device

[0083] Feedback interface

[0084] Authentication signal generator

[0085] Authentication device output interface

[0086] Input interface of the initialization device

[0087] Initialization signal generator

[0088] Output interface of the initialization device

[0089] Flash memory of the initialization device

[0090] Authentication device flash memory

[0091] Protected storage area

[0092] Flash memory of the vehicle control unit

[0093] diagnostic device

[0094] Diagnostic interface

[0095] Repatriation

[0096] Comparator

Claims

Patent claims 1. Vehicle control unit (12) for controlling an actuator (19) of a vehicle (18), comprising: an input interface (24) for receiving a training authentication signal and an initialization authentication signal in a training phase and an operating authentication signal in an operating phase after completion of the training phase from an authentication device (14);a discriminator (26) for comparing the training authentication signal with the initialization authentication signal in the training phase using an artificial neural network with randomly initialized weights, wherein the discriminator is trained to adjust the weights of the artificial neural network when the training authentication signal is recognized as corresponding to the initialization authentication signal, wherein the discriminator is trained to recognize whether the operational authentication signal is a valid signal in the operational phase using an artificial neural network with the weights adjusted in the training phase;a feedback unit (28) for transmitting an error signal to the authentication device during the training phase, wherein the error signal indicates whether the training authentication signal is recognized as corresponding to the initialization authentication signal; and an output interface (30) for controlling the actuator (19) during the operating phase if the operating authentication signal is a valid signal.

2. Vehicle control unit (12) according to claim 1, wherein the output interface (30) is configured to control the actuator (19) in the operating phase when the operating authentication signal does not correspond to a previously received operating authentication signal.

3. Vehicle control unit (12) according to one of the preceding claims, wherein the discriminator (26) is configured to use a fully-connected convolutional neural network in the training phase and in the operating phase.

4. Authentication device (14) for transmitting authentication signals to a vehicle control unit (12), comprising: an input interface (32) for receiving a random noise signal; a feedback interface (34) for receiving an error signal from the vehicle control unit; an authentication signal generator (36) for generating a training authentication signal in a training phase based on the noise signal using an artificial neural network with randomly initialized weights, wherein the authentication signal generator is configured to adjust the weights based on the error signal, and wherein the authentication signal generator is configured to generate an operating authentication signal in an operating phase after completion of the training phase based on the noise signal using an artificial neural network with the weights adjusted in the training phase;and an output interface (38) for transmitting the training authentication signal to the vehicle control unit during the training phase and for transmitting the operating authentication signal to the vehicle control unit during the operating phase.; 5. Authentication device (14) according to claim 4, wherein the input interface (32) is configured to receive white noise.

6. Authentication device (14) according to one of claims 4 and 5, wherein the authentication signal generator (36) is configured to use a fully-connected convolutional neural network.

7. Authentication device (14) according to one of claims 4 to 6, wherein the authentication signal generator (36) is configured to terminate the training phase when the error signal indicates that the vehicle control unit (12) recognizes the training authentication signal as corresponding to the initialization authentication signal.

8. Initialization device (16) for initializing a vehicle control unit (12), comprising: an input interface (40) for receiving a predefined periodic input signal; an initialization signal generator (42) for generating an initialization authentication signal based on the input signal using an artificial neural network with weights defined based on a predefined security key; and an output interface (44) for transmitting the initialization authentication signal to the vehicle control unit in a training phase.

9. Initialization device (16) according to claim 8, wherein the input interface (40) is configured to receive a sine wave signal.

10. System (10) for protecting a vehicle control unit (12) from an attack, comprising: a vehicle control unit according to one of claims 1 to 3, an authentication device (14) according to one of claims 4 to 7 and an initialization device (16) according to one of claims 8 to 9.

11. System (10) according to claim 10, wherein the output interface (30) of the vehicle control unit (12) is configured to generate the random noise signal during the operating phase; the input interface (32) of the authentication device (14) is configured to receive the random noise signal from the vehicle control unit during the operating phase; and the discriminator (26) of the vehicle control unit is configured to detect whether the operating authentication signal is a valid signal based on the random noise signal during the operating phase.

12. Method for controlling an actuator (19) of a vehicle (18), comprising the steps: Receiving (S10) a training authentication signal and an initialization authentication signal in a training phase and an operational authentication signal in an operational phase after completion of the training phase by an authentication device (14); Comparing (S12) the training authentication signal with the initialization authentication signal during the training phase using an artificial neural network with randomly initialized weights and adjusting the weights of the artificial neural network when the training authentication signal is recognized as corresponding to the initialization authentication signal, Detect (S14) whether the operational authentication signal is a valid signal in the operational phase using an artificial neural network with the weights adjusted in the training phase; Transmitting (S16) an error signal to the authentication device during the training phase, wherein the error signal indicates whether the training authentication signal is recognized as corresponding to the initialization authentication signal; and Control (S18) of the actuator (19) in the operating phase, if the operating authentication signal is a valid signal.

13. Method for transmitting authentication signals to a vehicle control unit (12), comprising the steps: Receiving (S20) a random noise signal; Receiving (S22) an error signal from the vehicle control unit; Generating (S24) a training authentication signal in a training phase based on the noise signal using an artificial neural network with randomly initialized weights and adjusting the weights based on the error signal, Generating (S26) an operational authentication signal in an operational phase after completion of the training phase based on the noise signal using an artificial neural network with the weights adjusted in the training phase; and Transmission (S28) of the training authentication signal to the vehicle control unit during the training phase and transmission of the operating authentication signal to the vehicle control unit during the operating phase.

14. Procedure for initializing a vehicle control unit (12), comprising the steps: Receiving (S30) a predefined periodic input signal; Generating (S32) an initialization authentication signal based on the input signal using an artificial neural network with weights defined based on a predefined security key; and Transmitting (S34) the initialization authentication signal to the vehicle control unit during a training phase.

15. Computer program product comprising program code for performing the steps of the methods according to any one of claims 12 to 14, when the program code is executed on a computer.

Images