Method and device for checking the integrity of data stored in a non-volatile memory of an electronic control unit of a vehicle - Patents.com

Abstract

An apparatus and method are provided that are adapted to overcome the shortcomings of the prior art. A method for checking the integrity of data stored in an electronic control unit (1) of a vehicle, the method comprising: - determining a first hash value #2_1 based on the stored data using a hash function F(x) in the electronic control unit 1 (S5), which is initiated by a request from the boot loader of the electronic control unit 1 (S3); - determining (S5) a second hash value #2_2 on the basis of the stored data using a hash function F(x) in the electronic control unit 1, triggered by a request (S9) of an external computing device 2 connected to the electronic control unit 1; and Checking the integrity of the stored data by comparing the identified first hash value #2_1 with the identified second hash value #2_2 (S11). Includes.

Description

[Technical field]

[0001] The present invention is directed to a method for checking the integrity of data stored in an electronic control unit of a vehicle, a data processing system configured to at least partially perform the method, a computer program comprising instructions (commands) which cause a computer to perform at least partially the method when the program is executed by a computer, a computer readable medium comprising instructions (commands) which cause a computer to perform at least partially the method when the program is executed by a computer, and a vehicle (optionally a car or automobile) which at least partially comprises the data processing system. [Background technology]

[0002] The background of the present application is the creation of a particularly safe and secure bootload and / or flash process for electronic control units (ECUs) of automated vehicles in order to ensure a certain ASIL integrity, such as ASIL B integrity, for ECUs used in autonomous driving.

[0003] More specifically, in automated driving, and particularly in highly automated and autonomous driving, hardware and software components of an automated vehicle used in automated driving, e.g., by directly and / or indirectly controlling the movement of the automated vehicle, are required to have a certain Automotive Safety Level (ASIL).

[0004] ISO 26262 Part 9 specifies Automotive Safety Integrity Levels (ASILs) which relate to an abstract classification of inherent safety risks in an automotive system or an element of such a system. ASIL classification is used within ISO 26262 to describe the level of risk reduction required to avoid a particular hazard, with ASIL D representing the highest level of hazard and ASIL A representing the lowest level of hazard. The ASIL assessed for a hazard is then assigned to a safety goal set to address that hazard and is inherited by the safety requirements resulting from that goal. ASIL levels below A are the lowest level of QM. QM refers to the standard considerations below ASIL A, which are not safety related and only require standard quality management processes.

[0005] Currently, the process of bootloading data from an ECU's non-volatile memory (NVM) to a read-only memory (ROM) or flash memory (e.g. EEPROM-Flash) and into the ECU's random access memory (RAM) and processing unit (e.g. central processing unit (CPU)) (i.e. the "application") respectively, does not have safety integrity but is classified as QM.

[0006] This inherent shortcoming can lead to corruption of data stored or transmitted from NVM to ROM / Flash and from RAM to the processing unit. Summary of the Invention [Problem to be solved by the invention]

[0007] Against the background of the prior art, it is an object of the present invention to provide an apparatus and method particularly adapted to overcome at least some of the above-mentioned shortcomings of the prior art, respectively. [Means for solving the problem]

[0008] The object is solved by the features of the independent claims. The dependent claims have as their subject matter further preferred embodiments of the invention.

[0009] More specifically, the object is solved by a method for checking the integrity of data stored in an electronic control unit of a vehicle.

[0010] Data integrity can be defined as maintaining and ensuring the accuracy and consistency of data throughout its lifecycle. Data integrity is the opposite of data corruption. The overall intent of any data integrity technique is the same: to ensure that data is recorded exactly as intended. Furthermore, to ensure that when retrieved later, the data is identical to what was originally recorded / stored. In essence, data integrity aims to prevent unintended changes to information. Any unintended change to data as a result of storage, retrieval or processing operations, including malice, unexpected hardware failure and human error, is a data integrity flaw. If the change is the result of unauthorized access, it can also be a data security flaw.

[0011] The method includes determining, using a hash function in the electronic control unit initiated by a request of a boot loader of the electronic control unit, a first hash value based on the stored data.

[0012] A boot loader, also spelled bootloader or called boot manager and bootstrap loader, is a computer program responsible for booting a computer, here an electronic control unit. When the electronic control unit is turned off (e.g. the vehicle is turned off) and after flashing, its data (including software and information such as the operating system and application code) is stored in the non-volatile memory (NVM) of the electronic control unit. When the electronic control unit is turned on (e.g. after flashing or after being turned off), typically the electronic control unit does not have the operating system or its loader in its random access memory (RAM). Therefore, to initialize the RAM and access the NVM (e.g. NAND flash, also called non-volatile device) or a device that can load the operating system program and data into the RAM, the electronic control unit first executes the boot loader, which is a relatively small program stored in the read-only memory (ROM) / flash memory with the necessary data.

[0013] Flashing may include overwriting existing data, such as firmware, software or information optionally contained in a ROM or flash memory module present in the electronic control unit, with new data. This can be done to upgrade the electronic control unit or during production of the vehicle.

[0014] As used herein, the term "data" may include, but is not limited to, application software executable by the electronic control unit, parameters and other information used by the application software and / or the operating system of the electronic control unit.

[0015] The method includes determining a second hash value based on the stored data using a hash function in the electronic control unit initiated by a request of an external computing device connected to the electronic control unit.

[0016] A hash function is any function that can be used to map data of any size to a value of a fixed size. The value that a hash function returns is called a hash value, hash code, digest, or simply hash.

[0017] The hash function used by the method is preferably a cryptographic hash function (CHF), which is a mathematical algorithm that maps data of any size (often called a "message") to a fixed-sized string of bits (a "hash value," "hash," or "message digest"). It is a one-way function, i.e., it is practically infeasible to invert or reverse the calculation. Ideally, the only way to find the message that produces the resulting hash is to attempt a brute force search to see if possible inputs produce a match, or to use a rainbow table of matched hashes. Furthermore, cryptographic hash functions are deterministic, which means that the same message will always result in the same hash.

[0018] The method includes checking the integrity of the stored data by comparing the determined first hash value to the determined second hash value.

[0019] That is to say, the two hashes determined at the request of the boot loader and an external computing device, such as a flash tool of the electronic control unit, are determined using the same (cryptographic) hash function for which the data stored in the electronic control unit is used as input, and are therefore identical to the case where no data corruption occurs between the determination of the first hash value and the determination of the second hash value.

[0020] A preferred embodiment of the method is described in detail below.

[0021] The first and / or second hash values ​​may be determined by a hardware security module of the electronic control unit.

[0022] A Hardware Security Module (HSM) is a physical computing device that can be configured to protect and manage digital keys and can perform encryption and decryption functions for digital signatures and perform hash algorithms for the (cryptographic) hash functions used by the method. A Hardware Security Module can include one or more secure crypto-processor chips. A Hardware Security Module can be implemented as a System-on-Chip (SoC), which is an integrated circuit (also known as a "chip") that integrates all or most of the components of a Hardware Security Module. These components can include a Central Processing Unit (CPU), memory, input / output ports, and secondary storage, all on a single substrate or microchip. They can include digital, analog, and / or mixed-signal processing functions.

[0023] The determined first hash value can be output by the boot loader of the electronic control unit to the external computing device, i.e., the electronic control unit can include an output interface / port accessible (directly or indirectly) by the boot loader for transmitting the first hash value to the external computing device.

[0024] The determined second hash value can be output by the hardware security module of the electronic control unit to an external computing device, i.e., the electronic control unit or the hardware security module itself can include an output interface / port accessible (directly or indirectly) by the hardware security module for transmitting the second hash value to the external computing device.

[0025] The external computing device can check the integrity of the stored data by comparing the determined first hash value with the determined second hash value, i.e., the check of the data integrity can be performed by the external computing device.

[0026] The method may include storing data in a memory of the electronic control unit using an external computing device. More specifically, the method may include flashing the electronic control unit, whereby data whose integrity is to be checked by the method is stored in the electronic control unit. The data may be stored in the memory (system) of the electronic control unit, which may include non-volatile memory, random access memory and / or read-only memory or flash memory.

[0027] The method may include, prior to storing the data in the memory of the electronic control unit, determining, using a hash function in the external computing device, a third hash value based on the data to be stored in the memory of the electronic control unit.

[0028] The third hash value may be determined by a hardware security module of the external computing device.

[0029] The method may include checking the integrity of the stored data by comparing the determined first hash value to the determined third hash value.

[0030] More specifically, the external computing device can check the integrity of the stored data by comparing the determined first hash value with the determined third hash value.

[0031] That is, since the first hash determined at the request of the boot loader and the third hash determined in the external computing device before flashing of the electronic control unit are determined using the same (cryptographic) hash function (which takes as input the data stored in the electronic control unit and the data to be stored / flashed in the electronic control unit), this check makes it possible to ensure the data integrity of the flashed data, i.e. that no data corruption occurs during flashing of the electronic control unit.

[0032] The method may include storing the determined first hash value in the electronic control unit, optionally by a boot loader and / or a hardware security module of the electronic control unit. The method may include determining a fourth hash value based on the stored data using a hash function in the electronic control unit triggered by a request of an application running on the electronic control unit, and checking the integrity of the stored data by comparing the determined first hash value with the determined fourth hash value.

[0033] The application may optionally receive as input sensor data from a sensor connected to the electronic control unit and check the integrity of the stored data by comparing the determined first hash value with the determined third hash value.

[0034] Determining the fourth hash value and checking the integrity of the stored data by comparing the determined first hash value to the determined third hash value occurs once upon start of the application and / or periodically during runtime of the application.

[0035] That is, since the first hash determined at the request of the boot loader and the fourth hash value determined during the runtime of the application are determined using the same (cryptographic) hash function (with the data stored in the electronic control unit as input), this check makes it possible to guarantee the data integrity of the data used by the application, i.e. that no data corruption occurs after flashing and booting the electronic control unit.

[0036] An error correcting code (ECC) and / or error detecting code (EDC) memory system may be used in the electronic control unit to store data.

[0037] ECC and EDC memories include additional memory bits and a controller for encryption to control operation and memory leaks. ECC / EDC memories use additional bits to store encrypted code / data when writing data to the ECC / EDC, which is stored at the same time. When data is read from the ECC / EDC memory, another ECC / EDC is generated based on the read data, and the stored ECC / EDC is compared with the ECC / EDC generated when the data was read. If the ECC / EDC generated during data reading does not match the stored ECC / EDC, the data is corrupted and can be repaired / decoded, optionally, in case of ECC, by so-called parity bits stored together with the data in the ECC to identify which bits are corrupted, and the corrupted bits can be (optionally quickly) corrected. That is, errors are detected using the EDC, and errors can be detected using the ECC and corrected in certain cases, such as single bit flips. If the error cannot be corrected, it is propagated (e.g. in case of a multi-bit failure). More specifically, the stored data can be read from ROM / Flash using the bootloader and from RAM to the application (software). The read and save operations can be protected using ECC / EDC. In case of any data leakage or data bit flip, the ECC / EDC created during writing to each memory and the ECC / EDC created during reading from each memory will not match, which leads to error detection (EDC) or error correction (ECC). This ensures the integrity of the data during normal operation of the electronic control unit, e.g. during and after booting of the electronic control unit.

[0038] Symmetric and / or asymmetric encryption using private and / or public keys may be used for data transmission in the electronic control unit and / or between the electronic control unit and an external computing device.

[0039] Symmetric encryption algorithms, or asymmetric encryption algorithms, are methods that use encryption algorithms that use the same encryption key to both encrypt and decrypt plaintext and to decrypt ciphertext. The key can be the same or it can be a simple transformation back and forth between the two keys. In practice, the key represents a secret shared between two or more parties that can be used to maintain a private information link. Asymmetric encryption, public key encryption, or asymmetric encryption, is an encryption method that uses a pair of keys. Each pair consists of a public key (which can be known by others) and a private key (which cannot be known by anyone but its owner). The generation of such key pairs relies on encryption algorithms that are based on mathematical problems called one-way functions. Effective security requires that the private key be kept secret, while the public key can be distributed openly without compromising security. A combination of these two methods is possible and allows for digital signing of communication data. That is, at the sender, the public key is used to encrypt the data and the private key is used to generate the signature (e.g., hash) together with a hash function. At the receiver, the private key is used to decrypt the received data, and the public key and the same hash function are used to check the signature. This not only ensures data security (a third party cannot corrupt the data), but also ensures data integrity, because the receiver can check if the data comes from the genuine / expected sender.

[0040] The above method can be summarized in other words as follows:

[0041] The method can be divided into two parts, the first part being an integrity check performed after flashing the electronic control unit, e.g. during production of the vehicle, and the second part being an integrity check performed during normal operation of the vehicle.

[0042] More specifically, the first part can be performed during the production of the vehicle after all electronic control units as hardware are fixed to the vehicle. Each electronic control unit can receive its required software through a flashing process. In the flashing process, a flash tool is used to flash each software with a given version and patch to the hardware of the electronic control unit. The required software can be downloaded from the flash tool in a first step. In a second step, once the bootload is completed, the flash tool can perform a hash check and a signature check for the secure bootloader. These checks may not have the integrity of security, but can ensure that no data corruption occurs according to the QM checks.

[0043] In the second part of the method, checks are made at the electronic control unit level, including the secure / trusted bootload. The electronic control unit may have a special hardware module, i.e., a hardware security module (HSM), to perform the hash definition / calculation. There may be two different types of checks at the electronic control unit level. The first type of check may be made during each start-up of the electronic control unit, i.e., every time the vehicle starts and the electronic control unit wakes up from sleep mode. The electronic control unit may check the hash file during the secure / trusted bootload process to ensure, using the private and public keys, that no data mismatch occurs during the start-up test. The second type of check may be periodic in nature and may be triggered by an application (software) executed by the electronic control unit. In addition to this, functional safety mechanisms such as ECC (Error Correcting Code) and / or EDC (Error Detecting Code) may be used to monitor and correct (fix) data corruption during bootload from the ROM / Flash and RAM of the electronic control unit. By combining both measures, i.e. the security measures on the hash file as a QM check and an ECC / EDC check for data corruption, it is possible to ensure the integrity of ASIL B.

[0044] Furthermore, a data processing system may be provided that includes means for at least partially performing the above-described method.

[0045] The data processing system may be or include a control unit for the vehicle, optionally an electronic control unit (ECU). The (electronic) control unit may be an intelligent processor control unit that can communicate with other modules, optionally via a central gateway (CGW). The control unit, optionally together with a telematics control unit, may form part of the vehicle's in-vehicle network via field buses such as CAN bus, LIN bus, MOST bus, FlexRay, or via automotive Ethernet. The electronic control unit may be configured to control functions related to the driving behavior of the vehicle, such as the engine control system, the power transmission, the braking system, and / or the tire pressure control system. In addition, some or all of the driver assist systems, such as parking assist, adaptive cruise control, lane departure warning, lane change assist, traffic sign recognition, signal light recognition, approach assist, night vision assist, intersection assist, and / or many others, may be controlled by the control unit.

[0046] Furthermore, the above description of the method applies mutatis mutandis to the data processing system and vice versa.

[0047] Further, an automated vehicle may be provided that includes the above-described data processing system.

[0048] The automated vehicle may be a car, which can be designed to take over lateral and / or longitudinal guidance (driving) at least partially and / or temporarily during automated driving of the automated vehicle.

[0049] Automated driving can be such that the driving of a vehicle is (nearly) autonomous.

[0050] The vehicle may be an autonomous level 1 vehicle, i.e. it may have certain driver assistance systems, such as adaptive cruise control (ACC), that support the driver in operating the vehicle.

[0051] The vehicle may be an autonomous level 2 vehicle, i.e. capable of being partially automated such that functions such as automatic parking, lane keeping or lateral guidance, general longitudinal guidance, acceleration and / or braking are performed by driver assistance systems.

[0052] The vehicle may be an autonomous level 3 vehicle, i.e., capable of being automated such that the driver does not need to continually monitor the system vehicle. The motor vehicle automatically performs functions such as turn signal activation, lane changing and / or lane keeping. The driver can attend to other matters but is instructed by the system to take over control within a warning period if necessary.

[0053] The vehicle may be an autonomous level 4 motor vehicle, i.e., the driving of the vehicle may be so highly automated that the driver is permanently taken over by the system vehicle may be requested to take over control when the driving task is no longer handled by the system.

[0054] The vehicle may be an autonomous level 5 vehicle, i.e., fully automated such that a driver is not required to complete the driving task. No human intervention is required other than setting the destination and activating the system. The vehicle can operate without a steering wheel or pedals.

[0055] Furthermore, the above description of the method and data processing system applies mutatis mutandis to the vehicle and vice versa.

[0056] Furthermore, a computer program may be provided, the computer program comprising instructions (commands) which, when the program is executed by a computer, cause the computer to carry out at least part of the method described above.

[0057] The program may comprise program code, in particular code suitable for a control system of a vehicle. The above descriptions for the method, the data processing system and the vehicle apply mutatis mutandis to the computer program and vice versa.

[0058] Additionally, a computer readable medium may be provided that contains instructions (commands) that, when executed by a computer, cause the computer to perform at least part of the above-described method.

[0059] The computer readable medium may be any digital data storage device, such as a USB flash drive, a hard disk, a CD-ROM, an SD card, or an SSD card. The above-mentioned computer program can be stored in a computer readable medium. However, the computer program does not necessarily have to be stored in such a computer readable medium, and can also be obtained via the Internet.

[0060] An embodiment will now be described with reference to FIGS. [Brief description of the drawings]

[0061] [Figure 1] FIG. 2 shows a schematic diagram of a system including a flash tool connected to an electronic control unit for checking the integrity of data stored in the electronic control unit after flashing the electronic control unit. [Diagram 2] FIG. 2 shows a schematic diagram of an electronic control unit executing / operating an application for checking the integrity of data stored in the electronic control unit. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0062] An embodiment is described below with reference to Figures 1 and 2, in which the same reference numerals are used for the same objects throughout the description of the figures, and the embodiment is merely one example for implementing the present invention, and does not limit the scope of the present invention as defined by the claims.

[0063] In figure 1 a data processing system is shown which comprises an electronic control unit 1 and a flash tool 2 which is connected to the electronic control unit 1 wirelessly or by wire, for example by a vehicle bus. The electronic control unit 1 may be part of a vehicle, not shown. In figure 2 the same electronic control unit 1 is shown. In figure 1 a first state of the data processing system is shown at the production side of the vehicle, and in figure 2 a second state of the data processing system is shown after production of the vehicle, i.e. during normal operation of the vehicle.

[0064] The data processing system is configured to execute a method for checking the integrity of data stored in the electronic control unit. Both the electronic control unit 1 and the flash tool 2 include hardware security modules 11, 21. Furthermore, the electronic control unit 1 includes a processor 13 that executes one or more applications (software) and activates a boot loader during start-up of the electronic control unit, and a memory system 12 with a non-volatile memory, a ROM or flash memory and a RAM.

[0065] 1 and 2, the method for checking data integrity of data stored in an electronic control unit 1 substantially comprises 17 steps S1 to S17, which may be performed in this numerical order or in any other order suitable for carrying out the method.

[0066] In a first step S1 of the method, a hash value #1 is determined based on the data to be stored in the memory 12 of the electronic control unit 1 using a hash function F(x) in the flash tool 2. To generate the hash value #1, the data is at least partially input to a hardware security module 21 of the external computing device 2 which calculates the hash value #1 using the hash function F(x), where the data is input for the hash function F(x).

[0067] After the generation of the hash value #1 in the first step S1 of the method, therefore in the second step S2 of the method, the flash tool 2 transmits the data to the memory 12 of the electronic control unit 1, whereby the data is stored in the memory 12 of the electronic control unit 1. The flashing itself takes place after the second step S2.

[0068] In a third step S3 of the method, the electronic control unit 1 is turned on and the boot loader is started, which sends a request to the hardware security module 11 of the electronic control unit 1 for a hash value.

[0069] In a fourth step S4 of the method, the hardware security module 11 of the electronic control unit 1, which was started at the request of the boot loader in the third step S3, loads at least partially the data received in step S2 and stored in the memory 12 of the electronic control unit 1 into the hardware security module 11 of the electronic control unit 1.

[0070] The data loaded into the hardware security module 11 of the electronic control unit 1 is used by the hardware security module 11 of the electronic control unit 1 in a fifth step S5 to identify a hash value #2_1 using a hash function F(x).

[0071] In a sixth step S6 of the method, the hash value #2_1 identified in the fifth step S5 is output from the hardware security module 11 of the electronic control unit 1 to the boot loader, and in a seventh step S7 of the method, the hash value #2_1 is provided by the boot loader of the electronic control unit 1 to the flash tool 2.

[0072] Furthermore, in an eighth step S8 of the method, the hash value #2_1 can be stored in the memory 12 of the electronic control unit 1 using a boot loader or directly in the memory 11 using a hardware security module 11 of the electronic control unit 1 (a second option shown by a second dotted line in FIG. 1).

[0073] In a ninth step S9 of the method, the flash tool 2 sends a request to the hardware security module 11 of the electronic control unit 1 to determine another hash value #2_2 based on the data stored in the memory 12 of the electronic control unit 1, for example using the same hash function F(x), in order to execute the fifth step S5 of the method again. Thus, the other hash value #2_2 is initiated and determined by the request in the ninth step S9 issued by the flash tool 2 using the hardware security module 11 of the electronic control unit 1.

[0074] This other hash value #2_2 is output by the hardware security module 11 of the electronic control unit 1 to the flash tool 2 in a tenth step S10.

[0075] In an eleventh step S11, two data integrity checks are performed in the flash tool 2. In a first check, the flash tool 2 checks the integrity of the stored data by comparing the hash value #2_1 determined in the fifth step S5 initiated by the boot loader with another hash value #2_2 requested and determined by the flash tool 2 in the ninth step S9. In a second check, the flash tool 2 checks the integrity of the stored data by comparing the hash value #2_1 determined in the fifth step S5 initiated by the boot loader with the hash value #2_1 determined in the first step S1 of the method. If both checks are positive, i.e. if all three hash values ​​#1, #2_1, #2_2 are identical, data integrity is obtained. Otherwise, the flash tool 2 flags an error due to data corruption. The flashing checks are performed after the eleventh step S11 of the method.

[0076] During normal operation of the vehicle, the following filed checks are performed:

[0077] In a twelfth step S12 of the method, the application running on the electronic control unit 1 sends a request to the hardware security module 11 of the electronic control unit 1 to determine in a fourteenth step S14 a hash value #3 that is based on the data stored in the memory 12 and that was loaded into the hardware security module 11 of the electronic control unit 1 during a thirteenth step S13 of the method. That is, similar to the third to fifth steps S3 to S5 described above and initiated / activated by the application's request, the hardware security module 11 of the electronic control unit 1 determines the hash value #3 using the same hash function F(x).

[0078] The hash value #3 determined in a fourteenth step S14 of the method is output by the hardware security module 11 of the electronic control unit 1 to the application.

[0079] In a sixteenth step S16 of the method, the application loads the hash value #2_1 saved in the eighth step S8 of the method from the memory 12.

[0080] In a seventeenth step S17 of the method, the application checks the integrity of the stored data by comparing the hash value #3 determined in the fourteenth step S14 with the hash value stored in the memory 11 in the eighth step S8 of the method. If the check is positive, i.e. if the two hash values ​​#2_1, #3 are identical, the data integrity is obtained. If not, the application flags an error due to data corruption.

[0081] The twelfth to seventeenth steps S12 to S17 may be performed once at the start of the application and / or periodically during the runtime of the application.

[0082] The memory 11 used in the above method is an error correcting code memory system which further improves the reliability of the method. In addition, symmetric and / or asymmetric encryption using private and / or public keys is used for data transmission in the electronic control unit and / or between the electronic control unit 1 and the external computing device 2.

Claims

1. A method for checking the integrity of data stored in an electronic control unit (1) of a vehicle, the method comprising the steps of: - Identifying a first hash value (#2_1) based on the stored data using a hash function (F(x)) in the electronic control unit (1) that is activated by a request from the boot loader of the electronic control unit (1) (S3); - determining (S5) a second hash value (#2_2) based on the stored data using the hash function (F(x)) in the electronic control unit (1), which is initiated by a request (S9) from an external computing device (2) connected to the electronic control unit (1); and - Checking the integrity of the stored data by comparing the identified first hash value (#2_1) with the identified second hash value (#2_2) (S11). A method comprising:

2. 2. The method according to claim 1, wherein the first and / or second hash values ​​(#2_1, #2_2) are determined (S5) by a hardware security module (11) of the electronic control unit (1).

3. 3. The method according to claim 1 or 2, characterized in that the identified first hash value (#2_1) is output (S7) to the external computing device (2) by the boot loader of the electronic control unit (1).

4. The method according to claim 3, which cites claim 2, characterized in that the identified second hash value (#2_2) is output (S10) to the external computing device (2) by the hardware security module (11) of the electronic control unit (1).

5. 3. The method according to claim 1 or 2, characterized in that the external computing device (2) checks (S11) the integrity of the stored data by comparing the identified first hash value (#2_1) with the identified second hash value (#2_2).

6. The method comprises: - storing (S2) data in the memory (11) of the electronic control unit (1) using the external computing device (2); and - before storing (S2) the data in the memory (11) of the electronic control unit (1), using a hash function (F(x)) in the external computing device (2) to identify (S1) a third hash value (#1) based on the data to be stored in the memory (11) of the electronic control unit (1); 3. The method according to claim 1, further comprising:

7. 7. The method of claim 6, wherein the third hash value (#1) is determined by a hardware security module (21) of the external computing device (2).

8. 7. The method of claim 6, further comprising checking the integrity of the stored data by comparing the identified first hash value (#2_1) with the identified third hash value (#1) (S11).

9. 9. The method of claim 8, wherein the external computing device (2) checks (S11) the integrity of the stored data by comparing the identified first hash value (#2_1) with the identified third hash value (#1).

10. The method comprises: - storing the identified first hash value (#2_1) in the electronic control unit (1) (S8); - Identifying a fourth hash value (#3) based on the stored data using a hash function (F(x)) in the electronic control unit (1), which is activated by a request from an application running in the electronic control unit (1) (S14); and - Checking the integrity of the stored data by comparing the identified first hash value (#2_1) with the identified fourth hash value (#3) (S17).

3. The method according to claim 1, further comprising:

11. 11. The method of claim 10, further comprising the application checking (S11) the integrity of the stored data by comparing the identified first hash value (#2_1) with the identified fourth hash value (#3).

12. 11. The method of claim 10, wherein identifying the fourth hash value (#3) (S14) and checking the integrity of the stored data by comparing the identified first hash value (#2_1) with the identified third hash value (#1) (S11) are performed once at the start of the application and / or periodically during the runtime of the application.

13. 3. A method according to claim 1 or 2, characterized in that an error correction code memory (11) is used in the electronic control unit to store data.

14. 3. The method according to claim 1, wherein symmetric and / or asymmetric encryption using private and / or public keys is used for data transmission in the electronic control unit (1) and / or between the electronic control unit (1) and the external computing device (2).

15. A data processing system (1, 2) comprising means for carrying out the method according to claim 1 or 2.

Images