Method for generating secrets by a vehicle and vehicle

Abstract

The invention relates to a method for generating a secret (l) using a vehicle. A computing device reads input data and processes the input data to generate at least one secret (l) using a rule (2). The invention is characterized in that at least behavioral data (3) is used as input data, said behavioral data (3) being generated by the vehicle after performing at least one behavior. The computing device calculates a unique pseudorandom byte sequence (4) from the behavioral data (3) using the rule (2), and the pseudorandom byte sequence (4) is used as a secret (L). Or the pseudorandom byte sequence (4) is further processed by a function to derive the secret (L).

Description

[Technical field]

[0001] The invention relates to a method for generating a secret in a vehicle of the kind defined in more detail in the preamble of claim 1, and to a vehicle for implementing said method. [Background technology]

[0002] Modern vehicles are equipped with various interfaces for data transmission and data communication. These interfaces may be used for communication between purely technical systems, such as between a vehicle and a cloud server, between several vehicles or between a vehicle and infrastructure, between different control units in a vehicle, between a control unit installed in a vehicle and an external third party device, such as a smartphone. Data may be transmitted in various ways, for example via mobile radio, WiFi, Ethernet, CAN bus, USB, Bluetooth, NFC, etc. Communication is also possible between technical systems and humans, such as the driver of the vehicle. To prevent the intrusion of communications made via such interfaces, such interfaces are usually cryptographically protected. Communications via such interfaces are protected, for example, by encryption and / or authentication, such that a suitable cryptographic key in the form of a byte sequence stored on a storage medium and / or in the form of a password is required for decryption of the transmitted data and for the generation of the authentication stamp. Such a cryptographic key represents a secret and is therefore referred to as such in the following for simplicity.

[0003] To increase security against intrusion, such cryptographic keys should ideally have sufficient entropy, i.e., they, among other things, consist of a sufficiently long sequence of random or pseudorandom numbers, numbers or bytes. This makes it difficult to determine the secret, such as a key or password, for example by so-called brute force methods. If one is only protecting purely the interfaces between several technical systems, the handling of relatively long and complex cryptographic keys does not pose any problems. On the other hand, people often have problems remembering long and complex passwords.

[0004] There are various methods to make complex encryption keys easy for people to use. For example, a password manager that can manage many different passwords is known. A person who uses the password manager can access the passwords managed by the password manager by inputting a centralized and easy-to-remember password. Thus, the person does not need to remember many complex passwords by himself.

[0005] The secret, in this case the encryption key, may also be stored in a hardware system, for example a USB memory stick. Such a USB memory stick is also called a dongle. When a user needs to authenticate himself to a technical system, he connects the dongle to the technical system, which then reads the encryption key from the dongle. However, for added security, the user usually has to connect the dongle to the technical system and also enter a password, thus again requiring the user to remember the password. Also, the dongle can be lost or damaged and therefore no longer work.

[0006] Therefore, users have no choice but to remember passwords that are as long and complex as possible, i.e., as secure as possible. In particular, when using different services, users should select separate passwords for each service, so that even if an attacker obtains a password, he or she will not be able to access all of the services.

[0007] Because it is often difficult for humans to remember many different, long, and complex passwords, there is a need for an easy, reproducible way to generate different secrets with high entropy.

[0008] A method for performing cryptographic operations with a location-dependent cryptographic key is known from patent document 1. In this method, the IC card determines its current location using a localization unit and uses this location and the data stored on the IC card to generate a location-dependent cryptographic key using a so-called key derivation function. The location-dependent cryptographic key thus created is used to perform a cryptographic operation. This cryptographic operation may for example be the generation or verification of a signature, the encryption or decryption of an attribute, etc. The current location of the IC card is input to a key derivation function for generating the location-dependent cryptographic key, which is generated in the manner disclosed in the document. As a result, the cryptographic keys are created differently, which makes it possible to perform particularly secure cryptographic operations, since the cryptographic operations cannot be authorized even if the IC card is misused in an unauthorized location. The data stored on the IC card may for example include a vehicle identifier. The method disclosed in the document may therefore be used in connection with vehicles for toll collection.

[0009] A similar authentication technique is known from US Pat. No. 5,399,633, which allows location-based authentication. [Prior art documents] [Patent documents]

[0010] [Patent Document 1] German Patent Application Publication No. 102013201245(B4) [Patent Document 2] DE 102005061281 A1 Summary of the Invention [Problem to be solved by the invention]

[0011] It is an object of the invention to provide a vehicle-based secret generation method, which allows a user to initially generate and reproduce a particularly secure secret in a particularly simple and reliable manner. [Means for solving the problem]

[0012] According to the invention, this problem is solved by a method for generating a secret with a vehicle having the features of claim 1 and by a vehicle having the features of claim 12. Advantageous embodiments and further developments result from the dependent claims.

[0013] A method for generating a secret using a vehicle of the above kind, In-vehicle The computing device reads input data and further processes the input data to generate at least one secret using a rule. According to the invention, at least behavioral data is used as input data, the behavioral data being generated by the vehicle after at least one behavior is performed. The computing device then uses the rule to calculate a unique pseudo-random byte sequence from the behavioral data. The pseudo-random byte sequence may be used as the secret directly. Alternatively, the pseudo-random byte sequence may be further processed with a function to derive a corresponding secret from the pseudo-random byte sequence. The behavioral data is generated by performing at least one of the following actions: performing at least one specified operation with the vehicle and / or inputting a human operating action into a control device of the vehicle.

[0014] Using the method of the invention, secrets such as passwords and / or cryptographic keys can be generated particularly simply and reliably. The use of a computing device for generating the secrets makes it possible to generate secrets with relatively high entropy, in particular relatively long byte sequences or high password lengths, preferably using not only lower and upper case letters but also numbers and special characters.

[0015] If the same deterministic rules are used to generate the secret, the same secret can be reliably generated again given the same behavioral data. This allows a person to create a secret in the manner according to the invention, and then create it again if they forget or delete it along the way. To do this, the person only needs to remember the execution of the actions they performed with the vehicle. This is a much more intuitive method than having to remember a complex password or where the corresponding person stores a digital secret in the form of a cryptographic key.

[0016] The secret generated by the method of the invention can be used in various ways. For example, the secret in the form of a password can be output via a display device of the vehicle. This allows the person performing the operation to know and remember the password. The password can be displayed as plain text or in an optoelectronic code, for example a QR code. For example, when a person photographs the QR code with a smartphone, the password is transmitted to the smartphone. The secret can also be stored on a storage medium. Thus, the secret in the form of a cryptographic key can be transmitted, for example via USB, Bluetooth, NFC, etc., from the computing device of the vehicle to a corresponding storage medium, such as a USB memory stick, or to a mobile terminal, such as a smartphone, a laptop, a tablet computer, a wearable, etc. This allows the user to easily carry the secret with him and continue to use it in another place, for example on his home computer.

[0017] Additionally, secrets generated with the vehicle can be reused to perform secure functions directly on the vehicle, for example, secrets generated with the vehicle can be used to authenticate an administrator to log in to a service or change advanced settings in a vehicle submenu.

[0018] Using the method of the invention, so-called recovery phrases can also be generated. With such a recovery phrase, for example, the private key of a Bitcoin hardware wallet can be regenerated even if the private key is lost. This can happen if the user misplaces the hardware wallet or if it is broken. To use a recovery phrase created outside the vehicle, this can be used as an input variable of the method of the invention. The recovery phrase can be read in different method steps. For example, the recovery phrase can be linked to the behavioral data and used to create a pseudorandom byte sequence or a command prompt for the recovery phrase can be issued after the secret has been created, so that the recovery phrase directly forms the secret. The recovery phrase can also be generated by the vehicle itself. By performing at least one of the listed actions, the user can memorize the process for generating the secret in a particularly intuitive manner. The user therefore only has to remember which driving maneuvers and / or inputs to the vehicle's controls. Only one action may be sufficient to create the secret. A maneuver may be a specific value of the longitudinal and / or lateral guidance of the vehicle, as well as a combination thereof. For example, it may be a specific steering angle, but also a steering direction and / or a specific acceleration or speed. For example, a maneuver may be a left turn, a figure eight turn, a turning maneuver, etc. Also, the acceleration and speed may be negative, i.e. the vehicle brakes or reverses. The control behavior can be any sequence of operation of vehicle control elements, such as actuation of the vehicle light switch, the vehicle wiper system, infotainment system such as volume control and station selection control, climate control device control elements such as a selector switch for setting a particular ventilation level or temperature, etc. The position of the corresponding selector switch, e.g. a ventilation intensity controller moving from zero ventilation intensity to maximum ventilation intensity, as well as the speed at which the corresponding controller or switch is moved may be recorded. For example, if the attacker turns a controller too slowly or too quickly, the control behavior will be recorded as incorrect.

[0019] An advantageous further development of the method provides for the use of a key derivation function as a function. A key derivation function is also called KDF (Key Derivation Function). Such a key derivation function is a cryptographic hash function that allows the derivation of one or more secret keys from a secret value by means of a pseudorandom function. This makes it possible to generate a more secure secret using the method of the invention, since the secret is derived from a pseudorandom byte sequence. A potential attacker therefore needs to know the key derivation function used in order to be able to reproduce the secret if he captures the pseudorandom byte sequence.

[0020] According to a further advantageous embodiment of the method, at least one action is actually performed in the vehicle or the execution of at least one action is simulated in the vehicle. The execution of the action in reality is particularly advantageous for the user to remember the actions to be performed in order to generate the secret. However, it may be the case that under certain conditions the execution of the action in the vehicle is impossible and / or takes a lot of time. To be able to generate the secret in such cases, the actions that have to be actually performed in the vehicle may also be simulated in the vehicle. It may be necessary to first actually perform a certain action the first time and only when the secret is regenerated, it may be simulated. On the other hand, it may be necessary to first simulate a certain action and then actually perform it. It may be necessary to perform one or more actions in order to generate the secret. All the actions performed may be real or they may be simulated. It is also possible that some actions are real and some actions are simulated.

[0021] Preferably, the user can specify for at least one action whether it is performed real or virtual, in which case the secret is generated only if the corresponding action is performed in a manner specified by the user. This makes the secret generation more secure. In particular, it becomes more difficult for an attacker to reproduce the secret if he does not know which actions are real and which are virtual.

[0022] To simulate an action, a user may input corresponding steps describing the action into an input device of the vehicle. Using the steps describing the action, a computing device may simulate the action. For example, if the sequence of actions to generate a secret is a drive that involves a perfect left turn followed by acceleration to 50 km / h, the user may select different vehicle actions from a list such as turn left, brake to a constant speed, drive at a constant speed for X meters, etc. If the user selects the correct action(s), the secret is generated.

[0023] According to a further advantageous embodiment of the method, in addition to the behavioral data, at least one of the following data types is used to calculate the pseudorandom byte sequence by means of a function and / or to derive the secret from the pseudorandom byte sequence: Vehicle and / or vehicle subsystem status data ,car Both specific data and / or location data .

[0024] In addition to behavioral data, state data 、 Vehicle-specific data and / or location data By considering the above, in order for an attacker to generate a secret, the state data available at the time of secret generation must be 、 Vehicle-specific data or location data This makes it much harder for an attacker to recreate the secret, since they must know and input 。

[0025] A further advantageous embodiment of the method comprises performing at least one of the following actions: position It is further provided that the data is generated: Driving a vehicle along a designated route; and / or Visit at least one designated location by vehicle and.

[0026] At least one of the listed actions Additionally By implementing this, the user can memorize the process for generating the secret in a particularly intuitive way. and / or Places visited Place Just remember . Interest A user may need to perform several actions. In particular, the user may specify how many and what actions are required to generate the secret. This increases the user's comfort when implementing the method according to the invention. In addition, the user may set a security level when generating the secret. For example, if the user has a limited ability to remember things, he may specify that relatively few actions are required to generate the secret. On the other hand, if the user has a good memory, he may specify that more actions are to be performed to generate the secret. The more actions that are performed, the more difficult it is for an attacker to reproduce the secret.

[0027] In particular, even if generating the secret requires performing many relatively long actions, such as actually driving a route from Munich to Hamburg, potential attacks can be detected and prevented in good time.

[0028] A route is a link between a starting point and a destination. It can be driven by a real vehicle or transmitted to the computing device via a control device for simulation. For this purpose, the corresponding waypoints on the route need to be transmitted to the computing device. Such waypoints or places visited by the vehicle can be, for example, gas stations, parking lots, landmarks, the user's residence, etc.

[0031] According to a further advantageous embodiment of the method, at least one of the following state variables is used as state data: Current vehicle location, the vehicle's relative position to stationary surrounding objects; At a certain point in time or for a certain period of time, Radio stations currently selected on the car radio, At least one identifier of a third-party device registered to the vehicle; At least one identifier of a third-party device currently connected to the vehicle; an identifier of an audio piece to be output at a given time via the audio output means of the vehicle; Adjusting at least one vehicle seat; The gear selected by the transmission, the opening of at least one vehicle window; the state of charge of at least one vehicle battery, and / or The current fuel level in the vehicle's fuel tank.

[0032] Using the enumerated state variables, a user may specifically create a large number of different conditions for generating individual secrets.

[0033] To determine the vehicle's position, the vehicle may have a device for determining the geographical position. The determination of the geographical position may be performed using a global navigation satellite system. This may be done, for example, by using a GPS to determine the location of the vehicle. However, the location of the vehicle may also be determined in other ways. For example, this may be done by triangulation using the positions of several mobile phone towers, radio transmitters, etc. as reference variables.

[0034] To determine the relative position of the vehicle with respect to surrounding stationary objects, the vehicle includes a corresponding environment detection sensor, which may be, for example, a camera. For example, the stationary environmental object may be a house, a garage, or a specific object located in the garage. In this way, the environmental object is recognized by detecting the corresponding stationary environmental object with the camera and performing image analysis on the camera image generated by the camera. Then, if the specific stationary environmental object has a specific orientation in the camera image to be evaluated, it is determined that the relative position of the vehicle to be maintained with respect to the stationary environmental object is fulfilled.

[0035] A time or period of time is also considered to generate a secret. The time may be, for example, a specific time of day, a time of day, a day of the week, a specific month, or a season. A specific period of time may be used to generate a secret, for example, from 8:00 a.m. to 12:00 p.m. or from April 13 to May 20. In this way, the generation of a specific secret is only possible at a specific time. The time may also be linked to an action. This means, for example, that the user needs to input a specific part of the driving operation or an operation action according to a set time interval. For example, to generate a specific secret, the user needs to accelerate for 3 seconds and turn the steering wheel to the right after 2 seconds. It may also be necessary for the user to hold down a specific operation part of the vehicle for, for example, 10 seconds.

[0036] The third party device registered or connected to the vehicle may be, for example, a mobile device such as a smartphone, a laptop, a tablet, a wearable, etc. The connection between the vehicle and the third party device may be, for example, via Bluetooth, NFC, WIFI, or may be wired, for example, via a USB cable or an Ethernet cable. Connected means that the third party device is currently in communication with the vehicle. Registered means that the third party device has communicated with the vehicle at least once, and thus the identification information of the third party device is stored in the vehicle. The identifier may be, for example, a Mac address, an IP address, a Bluetooth identifier, etc.

[0037] The vehicle's audio output means may for example be an infotainment system with associated speakers. The audio track may for example be a particular piece of music. For example, a particular secret may be initially generated or played only when a user plays a particular song through the infotainment system. It may be sufficient that only the piece of music is played to generate the secret, or that a particular section of the music must be played, for example the section being between 1 minute 10 seconds and 1 minute 20 seconds. It may also be necessary for the user to pause the music being output via the infotainment system at some point.

[0038] The vehicle may be designed as a hybrid or pure battery electric vehicle. It therefore has at least one tank and / or vehicle battery, such as a traction battery. The generation of a particular secret may require that at least one vehicle battery, such as a traction or starting battery, is in a certain state of charge and / or that the fuel tank is filled to a certain level. The tank may also be a storage tank, such as, for example, a urea tank, a coolant tank, a storage tank for a windscreen wiper device, etc.

[0039] A further advantageous embodiment of the method further provides that at least one of the following variables is used as vehicle-specific data: Vehicle Identification Number, The vehicle's computing device serial number, Vehicle registration number, Vehicle specific number, Car radio radio code, The encryption key for the vehicle lock system, and / or A secret generated by a computing device.

[0040] Using the vehicle specific data, a specific secret can only be reproduced in the same vehicle, which allows for a particularly secure secret generation method, since an attacker would need to run the method according to the invention in the same vehicle as the user in order to generate or reproduce the specific secret. In this way, using the vehicle specific data, it is possible to uniquely identify a specific vehicle.

[0041] The computing device may be, for example, a computing device or other hardware security module that uses rules to calculate a pseudo-random byte sequence from the behavioral data. The hardware security module may thus generate and store a cryptographic key that is unique to the vehicle. However, if the hardware security module is defective, the secret or a copy of the secret is irretrievably lost. The secret generated with the method of the invention may also be used as an input variable for generating another secret. This procedure may thus be repeated any number of times to generate a particularly secure secret. For example, a secret may be generated in the form of a cryptographic key that may be stored on the dongle, with further secret generation only possible if the dongle is connected to the vehicle again.

[0042] The encryption key of the vehicle lock system can be, for example, a wireless key transmitted from a wireless vehicle key, so that the vehicle key of the vehicle must be provided in close proximity communication with the vehicle to generate the specific secret.

[0043] According to a further advantageous embodiment of the method, at least two different vehicles use the same rules and / or functions to generate the secret. This allows the same secret to be reconstructed in different vehicles from the same behavioral, status and / or vehicle-specific data. If the user also changes vehicles, for example by replacing an old leased vehicle with a new one, he can also reconstruct the secret in the new vehicle. The provision of the rules, i.e. the functions, in the vehicle can be done in different ways. For example, the vehicle can include a set of specific rules and the user can select which rules to apply from the set of existing rules. The rules and / or functions can also be transmitted from the vehicle manufacturer to the vehicle, for example wirelessly. The transmission of the rules and / or functions can also take place during maintenance intervals of the vehicle, in particular by wire.

[0044] A further advantageous embodiment of the method comprises the step of: 、 State Data and location data may differ by a type-dependent difference value in order to be perceived as individual values. , location data and / or to improve the reproducibility of the actions performed to generate the status data. For example, if the action performed consists of driving a left curve, the question arises as to how much the driver should steer, i.e. which steering angle should be selected to distinguish between left curves with different radii. For this purpose, a type-dependent difference value defines a valid steering angle range, allowing the generation of a specific secret. The steering angle range can be any size angle. For example, this can simply involve steering the steering wheel to the left at any steering angle, or it can require a specific steering angle, for example 25 to 35 degrees, 30 to 32 degrees, etc. This applies analogously to the status data. For example, a specific radio station can be considered to be tuned if the original frequency of the station is not exceeded by more than 1 MHz. This can be used to ensure that a specific radio station can be tuned in if the reception strength changes. Using a type-dependent difference value, such inaccuracies in the performance of the method of the invention can be compensated for, which improves the reproducibility of the secret.

[0045] To verify whether an action has been performed correctly, a value of the corresponding action and / or state data detected by the vehicle may be output. Based on the output value, the user may quickly and easily verify whether he / she has correctly performed the actions required to generate the secret. Also, the detected action and / or state data may need to be first confirmed by the user before further processing. In this way, the user may be sure that the vehicle registers the actions performed as indeed the user wishes.

[0046] Preferably, a recovery notice is issued to instruct the person to generate the secret. In general, a user may forget at least some of the actions to be performed to generate a particular secret, the state data used in doing so, and / or the manner in which the actions are to be performed, i.e., the performance of the actions in a real or simulated run. When creating a secret, one may specify that a recovery notice may be issued as needed, using which a user may recall forgotten actions or states, if necessary. This provides a security mechanism by which a secret can be reconstructed with particular certainty.

[0047] According to the invention, in a vehicle having at least one computing device, the computing device is configured to execute the aforementioned method. The vehicle may be any vehicle, such as a car, truck, van, bus, etc. The computing device may be any computing device of the vehicle, such as an on-board central computer, a telematics unit, a control unit of a vehicle subsystem, etc. The computing device may record or simulate actions performed in the vehicle to generate behavioral data or to receive behavioral data from other computing devices, and may calculate a unique pseudorandom byte sequence from the behavioral data and / or status data and vehicle specific data by applying defined rules. This byte sequence may be used directly as a secret or may be further processed to derive a secret from the pseudorandom byte sequence using a function, such as a key derivation function. The computing device thus has at least one storage medium and a processor for storing and executing a program code suitable for implementing the method according to the invention. Similarly, the vehicle includes input means for inputting operational actions and output means for outputting a secret.

[0048] Further advantageous embodiments of the method according to the invention result from the embodiments that are explained in more detail below with reference to the figures. [Brief description of the drawings]

[0049] [Figure 1] 2 is a flow chart of a method according to the present invention; [Diagram 2] 4 is a flow chart of an exemplary initial generation of a secret according to a method according to the invention; [Diagram 3] 3 is a flow chart of an exemplary reproduction of the secret generated in FIG. 2. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0050] Figure 1 is a flow chart of the process according to the invention. In method step 101, a user decides to use a vehicle to generate a secret 1. According to the path 101.U extending downwards in Figure 1, the actions to be performed are actually performed, according to the path 101.O extending upwards, the actions to be performed are simulated.

[0051] The execution of the actual actions provides a method step 102 in which the user specifies how many and which actions to execute and whether state variables and / or vehicle specific variables are to be used to generate the secret 1. In a subsequent method step 103, the user executes the action to be executed. In a subsequent method step 104, the action data 3, the state data 5 and the vehicle specific variables are generated. , location data And / or relevant data in the form of vehicle specific data 6 is recorded after the action(s) have been performed.

[0052] If an action is being simulated, process step 105 is executed. In method step 105, the user selects the action to be performed, as well as any condition and vehicle specific variables. In method step 106, the user then inputs relevant information for performing the simulation, for example waypoints of the route to be traveled by the vehicle.

[0053] child This is Location Data Generate behavioral data 3 and, if necessary, state data 5 , location data and / or vehicle specific data 6, in method step 107, using rules 2, behavior data 3, status data 5 , location data and / or read by a computing device which calculates a unique pseudo-random byte sequence 4 from vehicle specific data 6. The pseudo-random byte sequence 4 can be used as secret 1, already indicated by the dashed arrow.

[0054] However, it is also possible to derive the secret 1 from the pseudorandom byte sequence 4 according to method step 108. For this purpose, the pseudorandom byte sequence 4 is further processed by a function, for example a key derivation function. In addition to the pseudorandom byte sequence 4, the behavior data 3, the state data 5 and the like are also stored. , location data The pseudorandom byte sequence 4, the behavior data 3, the state data 5, and / or the vehicle specific data 6 may also be used in method step 108 by a function or key derivation function to derive the secret 1, symbolized by the dashed arrow leading to method step 107. , location data The connection with the vehicle specific data 6 is made, for example, according to a concatenation. , location data and / or vehicle specific data 6 may be selected to generate a specific secret 1. , location data And / or the vehicle specific data 6 may also be understood as secret specific data.

[0055] After secret 1 is created, processing ends at method step 109 .

[0056] The following embodiments explain how the method according to the invention can be used to generate and store a recovery phrase for a bitcoin hardware wallet, and the recovery of this recovery phrase. Figure 2 shows the initial generation of a vehicle-generated recovery phrase for recovering the hardware wallet recovery phrase, and Figure 3 shows the retrieval of the recovery phrase for recovering the hardware wallet recovery phrase.

[0057] In method step 201, a user inputs a route via an input device. addition By entering, you inform the vehicle that you would like to use it to generate secret 1.

[0058] In method step 202, the user informs the vehicle that he / she wishes to encrypt the hardware wallet recovery phrase using the generated secret1. That is, secret1 itself forms the recovery phrase for recovering the hardware wallet recovery phrase. In the following, to avoid confusion, the hardware wallet recovery phrase will be referred to as the recovery phrase, and the recovery phrase that the vehicle creates to restore the hardware wallet recovery phrase will be referred to as secret1. In general, it is also conceivable that the hardware wallet recovery phrase directly forms secret1.

[0059] In method step 203, the user: performing at least one action to generate action data 3; Via the input device, the user inputs the route to be traveled by the vehicle that will be used to generate secret 1. Here, the user selects a route that he or she remembers particularly well and that is difficult for a third party to guess.

[0060] In method step 204, the user indicates that in order to generate Secret1, the action to be performed, ie, traveling the route, must actually occur.

[0061] In method step 205, the user travels a route in a vehicle, where the vehicle, or a computing device configured by the vehicle, generates a 256-bit long secret 1. Here, the activity data 3 and location data Only the state data 5 and the vehicle specific data 6 are used to generate secret 1. The use of state data 5 and vehicle specific data 6 has been omitted, although this is also possible in general.

[0062] In method step 206, the user inputs, via an input device, a recovery phrase generated by the hardware wallet. The recovery phrase may be digitally read or may be manually entered into the input device.

[0063] In method step 207, the recovery phrase is concatenated with an indicator that indicates that an action must actually be performed in order to replicate Secret 1. The concatenation of the recovery phrase and the indicator is then encrypted with the 256-bit length of Secret 1. In general, it is contemplated that the second element of the concatenation, in this case the requirement that an action must actually be performed, may also be encrypted or may remain unencrypted.

[0064] In method step 208, the user selects how to output the thus encrypted recovery phrase and index concatenation 1-200. For example, the encrypted concatenation 1-200 can be saved to a USB memory stick or emailed to a destination email address.

[0065] In method step 209, the vehicle executes the selected output action.

[0066] To recover, i.e. to view or create a digital copy of the recovery phrase, the user needs to transmit the encrypted concatenation 1-200 issued in method step 209 to the vehicle from which the user wants to recover the recovery phrase. This can be done, for example, by connecting a USB memory containing the encrypted concatenation 1-200 to the vehicle. In general, if the user recovers the recovery phrase using the same vehicle that was used to create the encrypted concatenation 1-200, the encrypted concatenation 1-200 can also be stored in the storage device of the vehicle's computing device after creation. To view or create a digital copy of the recovery phrase, the user only needs to drive the corresponding route. Since the user has omitted the use of vehicle-specific data 6, the user can use any vehicle for this purpose. This minimizes the risk of a complete loss of the recovery phrase and therefore the bitcoins stored in the hardware wallet.

[0067] The procedure for recovering a recovery phrase is shown in FIG. 3. In method step 301, the user additionBy inputting, one informs the vehicle via the input device that one wishes to use the vehicle to generate secret1.

[0068] In method step 302, the user informs the vehicle that he wishes to decrypt the encrypted concatenation 1-200 using the just-generated secret 1.

[0069] In method step 303, the user connects to the vehicle the USB memory on which the encrypted linkage 1-200 output in method step 209 is stored. If the user uses the same vehicle in which method step 209 was also performed, the reading of the stored encrypted linkage 1-200 may be omitted, since the encrypted linkage 1-200 may also be stored in the vehicle itself.

[0070] In case of a non-encrypted indicator at the same time, in method step 304, the vehicle verifies the second element of the encrypted concatenation 1-200 generated in method step 209 and outputs information that the action(s) to be performed to decrypt the encrypted concatenation 1-200 must actually be performed. Method step 304, which reduces the risk of compromise, can be optional. Thus, the attacker must know in advance whether he must actually perform the actions required for decryption or whether a simulation of the actions will suffice.

[0071] In method step 305, the user: Input the corresponding action to generate action data 3, and Drive the vehicle along the route.

[0072] In method step 306, the vehicle travels along a route generated by the vehicle. Location Data which is used to generate pseudorandom byte sequence 4. Finally, pseudorandom byte sequence 4 is used to derive secret 1 for decrypting the encrypted concatenation 1-200.

[0073] In method step 307, the vehicle uses Secret 1 to decrypt the first element of the encrypted concatenation 1-200 stored on the USB memory or on the vehicle's computing device. It is now verified whether the second two elements of the two sets, i.e. Secret 1 generated in method steps 205 and 306, match, i.e. whether the correct actions have been performed on the vehicle.

[0074] If so, in method step 308, the now decrypted first element of the previously encrypted concatenation 1-200, i.e., the recovery phrase, is provided to the user for output. If not, output or direct use of the encrypted concatenation 1-200 is prevented, and the path traveled is blocked. or the action entered The user is notified that the information was incorrect.

[0075] In general, it is also possible that the first tuple element of the encrypted concatenation 1-200, i.e., the recovery phrase, is not decrypted until the two second tuple elements of the secret 1 generated in method steps 205 and 306 match, i.e., when an action is performed on the vehicle. This may further reduce the risk of a data breach. Thus, the secret 1 pairs are encrypted and decrypted separately.

Claims

1. 1. A method for generating secrets (1) using a vehicle, the method comprising: an on-board computing device reading and processing input data to generate at least one secret (1) using rules (2), the method comprising: At least behavioral data (3) is used as input data, said behavioral data (3) being generated by said vehicle after at least one behavior has been performed; The computing device calculates a unique pseudo-random byte sequence (4) from the behavioral data (3) using the rule (2); said pseudorandom byte sequence (4) is used as said secret (1), or said pseudorandom byte sequence (4) is further processed by a function to derive said secret (1); The behavioral data (3) is A method, characterized in that the method is generated by inputting a human operating action into a control device of the vehicle.

2. 2. The method according to claim 1, characterized in that as the function a key derivation function is used.

3. 3. A method according to claim 1 or 2, characterized in that at least one action is actually performed on the vehicle or the performance of at least one action is simulated on the vehicle.

4. 4. The method according to claim 3, characterized in that a user specifies for at least one action whether said at least one action is performed in real or virtual form, and said secret (1) is generated only if the corresponding action is performed according to the manner specified by said user.

5. In addition to the behavioral data (3), the following data types: status data (5), vehicle specific data (6) and / or location data of the vehicle and / or vehicle subsystems, 5. The method according to claim 1, wherein at least one of the following functions is used to calculate the pseudorandom byte sequence (4) and / or to derive the secret (1) from the pseudorandom byte sequence (4) using the function.

6. The location data (3) may include the following actions: Driving said vehicle along a designated route; and / or visiting at least one designated location with said vehicle; 6. The method of claim 5, wherein the method is generated by performing at least one of the following:

7. The following state variables: the current location of the vehicle, and / or the relative position of the vehicle with respect to stationary surrounding objects; 7. The method according to claim 5 or 6, characterized in that at least one of the following is used as status data (5).

8. The following variables: Vehicle Identification Number, The serial number of the computing device of the vehicle; the registration number of said vehicle, and / or Vehicle specific number, 8. The method according to claim 5, wherein at least one of the following is used as vehicle-specific data (6).

9. 9. The method according to any one of claims 1 to 8, characterized in that at least two different vehicles use the same said rule (2) and / or the same said function for generating secrets (1).

10. 10. The method according to claim 1, characterized in that behavioral data (3), status data (5) and position data of the same type acquired at successive times differ by a type-dependent difference value in order to be perceived as individual values.

11. 11. The method according to claim 1, characterized in that a recovery notice is issued to induce the person to generate the secret (1).

12. A vehicle comprising at least one computing device, characterized in that said computing device is designed to carry out the method according to any one of claims 1 to 11.

Images