Message security method, associated device and vehicle

Abstract

A method for securing first messages, implemented in a motor vehicle (100), comprising the following steps: First, determination of a first reception frequency for first messages from an electronic module (120) of the motor vehicle (100), by authenticated communication; Second, determination of whether the first reception frequency is sufficiently low for a first condition to be met, by comparing the first reception frequency with a first reference frequency; Implementation of a countermeasure, the implementation of the countermeasure being conditional upon the first reception frequency being sufficiently low for the first condition to be met. Figure for the abstract: Figure 1

Description

Title of the invention: Method for securing messages, associated device and vehicle. Technical field

[0001] The present invention relates to motor vehicles, and in particular to safety and the fight against fraud in motor vehicles. Previous technique

[0002] A known fraud scheme involves concealing wear and tear on a motor vehicle based on its mileage by placing a fraud device between the vehicle's odometer and a central processor that controls the display of the vehicle's mileage. The fraud device blocks the transmission of messages to the processor and then stores these messages, including the mileage recorded by the odometer, when the vehicle is in the possession of a fraudster.

[0003] When the motor vehicle is subsequently sold to a buyer, the fraudulent device sends the previously blocked and stored messages to this processor, giving the appearance of a normal mileage display and showing mileage values ​​lower than the actual mileage of the motor vehicle. The wear and tear on the motor vehicle then appears less than it actually is, which can allow for the fraudulent resale of the motor vehicle above its actual value.

[0004] This method of fraud is not limited to the mileage of motor vehicles and the odometer. It can also be implemented for other data and quantities and for other electronic devices.

[0005] There are anti-replay mechanisms based on dynamic cryptographic keys that are robust to this type of fraud device that retains messages and plays them at the opportune moment, but the implementation and deployment of such mechanisms is complex because of the dynamic renewal of the cryptographic keys to be put in place.

[0006] Other simpler anti-replay mechanisms known to those skilled in the art, particularly those based on static cryptographic keys and a monotonic counter, are not, however, robust to this type of fraudulent device. Description of the invention

[0007] The invention aims to remedy this drawback and relates, according to one of its aspects, to a method for securing initial messages, implemented in a motor vehicle, comprising the following steps: - Initial determination of a first reception frequency for the first messages from an electronic module of the motor vehicle, via authenticated communication, - Second determination of whether the first reception frequency is sufficiently low for a first condition to be met, by comparing the first reception frequency with a first reference frequency, - Implementation of a countermeasure, the implementation of the countermeasure being conditional on (the first determination indicates or determines that) the first reception frequency being sufficiently low for the first condition to be verified (in other words: the countermeasure being implemented if the first reception frequency is sufficiently low for the first condition to be verified).

[0008] Thus, the invention makes it possible to reveal the fraud described above, by detecting that the first reception frequency is abnormally low, and by implementing the countermeasure accordingly.

[0009] For example, the first condition is verified if a ratio equal to the first reception frequency divided by the first reference frequency is less than a threshold.

[0010] Alternatively, for example, the first condition is verified if the first reception frequency is lower than the first reference frequency.

[0011] The first reception frequency is measured over an arbitrary duration which can be predetermined (in other words: which can be stored in memory).

[0012] In a conventional manner, when it comes to determining a frequency, the first determination step includes counting the first messages during the duration.

[0013] According to one embodiment, authenticated communication means that the process includes a step of verifying the authenticity and integrity of the first messages from a cryptographic key (in memory), and for example, by implementing an algorithm for verifying a signature (for example of the type known as "RSA", EL GAMAL, or DSA) or an algorithm for verifying a message authentication code (in English known as "MAC") included in the first messages.

[0014] In the event that this step of verifying the authenticity and integrity of the first messages indicates that a first message among the first messages is not authentic or intact, the process may include a step of implementing a countermeasure (for example, an implementation of the countermeasure).

[0015] According to one embodiment, the first determination includes an anti-replay check of the first messages (for example based on a monotonic counter) without necessarily prior retention of the first messages by the fraud device when it receives these first messages from the electronic module.

[0016] For example, checking the order of receipt of the first messages includes checking that a counter included in the first messages is equal to a counter in memory (incremented on receipt of each new message from the first messages).

[0017] In the case where this verification step indicates a replay of the first messages (for example, in an anti-replay system based on a monotonic counter, an anomaly in the order of reception of the first messages) the method may include a step of implementing a countermeasure (for example, of the countermeasure).

[0018] Alternatively, a person skilled in the art is aware of other methods for verifying the order of receipt. For example, verification of the order of receipt can be implemented by timestamping the first messages, or, in the case where the first messages include the mileage of the motor vehicle, by using the fact that the mileage never decreases over time.

[0019] According to one embodiment, the first messages include data representative of wear on the motor vehicle (obtained or measured by the electronic module).

[0020] The invention thus makes it possible to protect data which is important because it determines the value of the motor vehicle.

[0021] Alternatively, the first messages include data to be protected against retention attacks in accordance with the various regulations. Examples include all data circulating on the vehicle's communication buses and related to battery wear or pollution levels.

[0022] According to one embodiment, the first messages include a mileage of the motor vehicle (since its manufacture) and the electronic module is an odometer.

[0023] Mileage is indeed an important factor in the value of the vehicle.

[0024] Alternatively, the first messages include the certified energy state of a battery of an electric propulsion motor of the motor vehicle, when the motor vehicle is an electrically powered vehicle.

[0025] According to one embodiment, the second determination step includes obtaining the first reference frequency from an activation mode (in other words: from an activation state) in which the motor vehicle is located.

[0026] For example, without limitation, the activation mode (or activation state) in which the motor vehicle is found is one of the following modes (or states) (and / or may be successively one of the following modes or states): - A parking mode (where the motor vehicle's engine is off, the motor vehicle's parking brake is activated, and the motor vehicle's ignition is not on), - A mode with the ignition on (where the ignition of the motor vehicle is switched on, but the propulsion engine of the motor vehicle is not running), - A traction mode (where a propulsion engine of the motor vehicle is in operation and propels the motor vehicle), - A lifestyle on board, - and / or a software update method (for the motor vehicle).

[0027] For example, the first reference frequency is higher when the motor vehicle is in traction mode than when the motor vehicle is in the other modes above.

[0028] The first reference frequency can be stored in memory, for example in association with an activation mode identifier, for example in a table associating an activation mode identifier with the first reference frequency (and in this case, obtaining the first reference frequency may include a step of reading from memory and / or the table).

[0029] Alternatively, the first reference frequency does not vary depending on the activation mode of the motor vehicle.

[0030] According to one embodiment, the security method includes sending each message from the first messages to an electronic component of the motor vehicle (for example to a screen or any microprocessor).

[0031] According to one embodiment, the method includes (a sending step) a command to display at least part of each message of the first messages (for example, mileage) to a screen of the motor vehicle (for example, located in a passenger compartment of the motor vehicle).

[0032] Alternatively, the first messages are exploited in another way.

[0033] According to one embodiment, the implementation of the countermeasure comprises: - A (step of sending a) command to block a function of the motor vehicle (for example, the countermeasure may prevent the motor vehicle from moving), - A (step involving sending a) command to display an alert message, - A storage in a vehicle computer that the condition the activation threshold for the countermeasure has been reached, and / or - A command to send an alert message to a remote server (for example, via a mobile phone network).

[0034] For example, the countermeasure, for example in the case of the block command or the display command, can be persistent, that is to say that it can remain active for a certain time, for example predetermined or for example until a step of receiving an authenticated deactivation command (for example cryptographically and / or by password).

[0035] According to one embodiment, the method further comprises the following steps: - Third determination of a second reception frequency for second messages from the electronic module of the motor vehicle, - Fourth determination if the second reception frequency is high enough for a second condition to be verified, by comparison of the second reception frequency with a second reference frequency, the implementation of the countermeasure being conditioned, furthermore, on the second reception frequency being high enough for the second condition to be verified.

[0036] In the same way as for the first reference frequency, the fourth determination step may include obtaining the second reference frequency from an activation mode of the motor vehicle, as above

[0037] The second messages may include one of the following pieces of information: - The information necessary to display the vehicle's speed, - Commands from the braking system to the engine control contribute to the vehicle controllability, and / or - Information about ABS malfunction in case of failure, which does not allow the driver to be alerted and, above all, to ensure the vehicle's safe operation.

[0038] The second messages can be selected such that these second messages have an operational impact deterring the attacker from retaining them in order not to activate the second condition.

[0039] The invention also relates to a computer program comprising instructions executable by a microprocessor or a microcontroller or a computer, to implement the steps of the process according to the invention, when executed by the microprocessor or the microcontroller or the computer.

[0040] The invention also relates to an electronic device (or a motor vehicle) configured to implement the steps of the process according to the invention, as well as a motor vehicle comprising the electronic device.

[0041] Although they are not repeated here, the advantages and characteristics of the device and the vehicle are identical (mutatis mutandis) to those of the above method. Brief description of the drawings

[0042] The invention will be better understood upon reading the detailed description that follows, the non-limiting examples of its implementation, and upon examination of the accompanying drawings, in which:

[0043] [Fig-1] represents an electronic device and a motor vehicle, according to a method of embodiment of the invention.

[0044] [Fig.2] represents a method, according to an embodiment of the invention, implemented by the electronic device of [Fig.1]. Detailed description

[0045] Fig. 1 represents a vehicle 100 which is a motor vehicle.

[0046] The vehicle 100 includes an odometer 120, a microprocessor 110 and a screen The display 130 is a display screen that may be touch-sensitive. The odometer 120 and the display screen 130 are connected to the microprocessor 110 via a data bus.

[0047] With reference to [Fig.2], at step S00, while the vehicle 100 is moving, and is therefore in traction mode, the microprocessor 110 receives first messages and second messages from the odometer 120.

[0048] At step S10, while the reception of the first and second messages is still in progress, the microprocessor 110 calculates the reception frequency of the first messages, denoted flrecep.

[0049] At step S20, while the reception of the first and second messages is still in progress, the microprocessor 110 calculates the reception frequency of the second messages, denoted f2recep.

[0050] At step S30, the microprocessor 110 reads from its memory two reference frequencies, noted f lref and f2ref, associated with the traction mode.

[0051] At step S40, the microprocessor 110 checks whether the following first condition is met: flreœp / flref <seuill, où seuill est une valeur numérique prédéterminée.

[0052] At step S50, the microprocessor 110 checks if the following second condition is met: f2reCep / f2ref> threshold2, where threshold2 is a predetermined numerical value.

[0053] Suppose that the first condition and the second condition are met, then, at step S60, the microprocessor 110 commands the display on screen 130 of an alert message indicating an anomaly or fraud.

[0054] Otherwise (i.e., if the first or second condition is not verified / met), at step S60, no alert message command is sent to screen 130.

[0055] For example, the first messages include the mileage of vehicle 100, since its manufacture, measured by odometer 120.

[0056] For example, in a manner known to those skilled in the art, to ensure their authenticity and integrity, the first messages include a message authentication code (known in English as a "MAC") verified by the microprocessor 110, for example in step S40 above, using a symmetric cryptographic key that it stores in its non-volatile memory. If this verification step indicates that a first message among the first messages is not authentic or intact, the microprocessor 110 implements step S60.

[0057] For example, in a manner known to those skilled in the art, the first messages also include a message counter, and in step S40, the microprocessor 110 further checks that this message counter is equal to a counter in memory of the microprocessor 110 incremented upon receipt of each message among the first messages by the microprocessor 110. Thus, in the event of detection of an anomaly in the order of reception of the first messages, the method implements step S60.

[0058] At step S70, the microprocessor 110 controls the display of the mileage included in the first messages, whether the warning message is displayed or not.

[0059] The display of the warning message is persistent. At step S80, the display of the warning message can be interrupted by entering a security PIN code on screen 130 by the vehicle owner or a maintenance personnel.

[0060] According to a variant of step S60, the microprocessor 110 can control: - A blocking of the movement of the motor vehicle (for example, the starting of the propulsion engine of the vehicle 100 is inhibited), and / or - A sending of an alert message to a remote server (for example, via a mobile telephone network).

[0061] The second reference messages may be: - The information necessary to display the vehicle's speed, - Commands from the braking system to the engine control contribute to the vehicle controllability, and / or - Information about ABS malfunction in case of failure, which does not allow the driver to be alerted and, above all, to ensure the vehicle's safe operation.

[0062] Steps S00 to S80 can be implemented by a computer program, in memory of microprocessor 110, executed by microprocessor 110.

Claims

Demands

1. A method for securing first messages, implemented in a motor vehicle (100), comprising the following steps: - First determination (S10) of a first reception frequency of the first messages from an electronic module (120) of the motor vehicle (100), by authenticated communication, - Second determination (S40) whether the first reception frequency is sufficiently low for a first condition to be verified, by comparison of the first reception frequency with a first reference frequency, - Implementation of a countermeasure (S60), the implementation of the countermeasure being conditioned on the first reception frequency being sufficiently low for the first condition to be verified.

2. A security method according to the preceding claim in which the first determination (S 10) includes an anti-replay check of the first messages.

3. A security method according to any one of the preceding claims wherein the first messages include data representative of wear and tear on the motor vehicle (100).

4. A security method according to any one of the preceding claims wherein the first messages include a mileage of the motor vehicle (100) and the electronic module (120) is an odometer.

5. A security method according to any one of the preceding claims wherein the second determination step includes obtaining (S30) the first reference frequency from an activation mode in which the motor vehicle (100) is located.

6. A security method according to any one of the preceding claims comprising sending each message of the first messages to an electronic component (130) of the motor vehicle (100).

7. A security method according to any one of the preceding claims, wherein the implementation of the countermeasure (S60) comprises: - A command to block a function of the motor vehicle (100), and / or - A command to display an alert message, and / or - A storage in a vehicle computer that the activation condition of the countermeasure has been reached, and / or - A command to send an alert message to a remote server.

8. A security method according to any one of the preceding claims, further comprising the following steps: - Third determination (S20) of a second reception frequency of second messages from the electronic module (120) of the motor vehicle (100), - Fourth determination (S50) whether the second reception frequency is sufficiently high for a second condition to be met, by comparison of the second reception frequency with a second reference frequency, the implementation of the countermeasure (S60) being further conditioned on the second reception frequency being sufficiently high for the second condition to be met.

9. Electronic device (110) configured to carry out the steps of the process according to any one of claims 1 to 8.

10. Motor vehicle (100) comprising the electronic device (110) according to the preceding claim.

Images