Method for securing communications between a communication system of a vehicle and a server external to the vehicle - Patents.com

Abstract

The invention relates to a method for securing communications between a communication system (2) of a vehicle (1) and a vehicle external server (3) via a communication interface, the communication interface being secured in such a way that data can be transmitted to the communication system (2) in a confidential manner, if necessary, such that the integrity and authenticity of the data are protected. The method according to the invention is characterized in that a first security method for non-post-quantum-resistant security of exchanged data is implemented in the communication system (2) via the communication interface, a second security method for post-quantum-resistant security of exchanged data is implemented in the communication system (2) via the communication interface or can be implemented via an interface (S2) implemented in the communication system (2) or can be implemented via a software update, and key data for use in the second security method are initially introduced into the communication system and securely stored or can be introduced via another interface (S3) implemented in the communication system (2) or can be implemented via a software update, and are received encrypted in a cryptographic manner and securely stored for use exclusively in the second security method.

Description

[Technical field]

[0001] The invention relates to a method for securing communications between a communication system of a vehicle and a server external to the vehicle via a communication interface according to the type defined in more detail in the preamble of claim 1. [Background technology]

[0002] Generally, modern vehicles, here especially passenger cars and commercial vehicles, are part of a large vehicle ecosystem. The central part of this ecosystem is then the so-called backend, which is a vehicle external server operated mainly by the vehicle manufacturer. The vehicle is connected to this vehicle external server via the Internet. The communication between this backend and the vehicle is then usually protected by encryption methods, on the one hand to protect the privacy of the vehicle user and on the other hand to allow no external intervention in the data traffic, which data traffic, especially when transmitting data related to vehicle control, can be used by hackers to attack the vehicle and manipulate important functions.

[0003] A common method then is to use methods based on asymmetric cryptography, usually in the form of TLS (Transport Layer Security) and sometimes also in the form of IPSec (Internet Protocol Security), using traditional asymmetric methods such as, for example, RSA based on prime factorization or ECC (Elliptic Curve Cryptography).

[0004] Patent document 1 describes a communication system 2 and a method for performing such an asymmetric key exchange between the vehicle and a server external to the vehicle in order to operate the data connection in a correspondingly cryptographically secured manner, i.e. with encryption and / or authentication. [Patent Document 1] DE 10 2009 037 193 B4

[0005] The patent document 2 shows a communication device that allows two different cryptographic modes, between which it is possible to alternate via a unit for alternating between cryptographic modes. The present disclosure does not mention a vehicle ecosystem. [Patent Document 2] US 2012 / 0045055 A1

[0006] US Pat. No. 5,399,433 shows encrypted communication between a vehicle and a server external to the vehicle itself. Non-Patent Document 1 describes a system architecture for a network that enables secure authentication and encryption not only for the current quantum computer but also after it enters the market. For this purpose, a first protection method and a second protection method can be provided, and the second protection method can be implemented initially or can be introduced via a software update. In this case, the second protection method is a post-quantum resistant protection method, while the first protection method is not a post-quantum resistant protection method. The topic of post-quantum resistant protection for processes in vehicular communications (V2x) is also addressed in [2], where similar applications as in the abovementioned technical publication are relevant to the field of vehicular communications. Furthermore, patent document 4 describes a method for securing communications between a vehicle's communication system and a server, which method has essentially the features set out in the preamble of the corresponding independent claim. [Patent Document 3] US 2018 / 0217828 A1 [Patent Document 4] DE 10 2018 101 856 A1 [Non-Patent Document 1] VODAFONE.“pCR to TR 33.899:Quantum safe cryptography solutions”1-11,Vol.SA WG3,No.Tenerife(Spain);20161107-20161111,31 October 2016(2016-10-31),3GPP(registered trademark) DRAFT;S3-161893-PCR TO TR 33.899,QUANTUM SAFE SOLUTIONS,3RD GENERATION PARTNERSHIP PROJECT(3GPP(registered trademark)),MOBILE COMPETENCE CENTRE;650,ROUTE DES LUCIOLES;F-06921 SOPHIA-ANTIPOLIS CEDEX;FRANC,Bd.SA WG3,Nr.Tenerife(Spain);20161107-20161111,31.Oktober 2016(2016-10-31),(XP051170730) [Non-Patent Document 2] PAULOS LM BARRETO ET AL:“qSCMS:Post-quantum certificate provisioning process for V2X”,IACR,INTERNATIONAL ASSOCIATION FOR CRYPTOLOGIC RESEARCHBd.20190103:181623,31.Dezember 2018(2018-12-31),Page 1-18,(XP061027449)

[0007] In that case, the commonly used asymmetric encryption methods, such as, for example, ECC or RSA, have the advantage that they currently provide a relatively secure protection with a minimum of effort. However, all these methods are then based on encryption algorithms, the security of which is not considered robust against quantum computers. Quantum computers calculate in such a way that they can crack the asymmetric encryption methods and through which the protected data can be decrypted in the shortest possible time. The methods commonly used for encryption protection, i.e. in particular for encryption and / or authentication, for communication between the vehicle and the back-end, are then no longer secure. This so-called post-quantum threat was up until now a rather theoretical threat, since quantum computers were still considered purely research instruments and could only be realized with very high financial commitments. However, in recent years, the development of quantum computers has accelerated significantly. From today's point of view, it is therefore no longer possible to make a reliable prediction that sufficiently powerful quantum computers will not be available on the market within the next ten years.

[0008] Vehicles currently placed on the market will typically remain on the road for 10 to 15 years. This means that the post-quantum threat, i.e. the potential for easily cracking conventional asymmetric cryptography protections at a future time, easily or especially by commercially available quantum computers, is already relevant for vehicles delivered today. Therefore, the communication of the vehicle's communication device with external servers, which today is protected mainly via cryptography protocols based on RSA or ECC, appears no longer to be secure in the event of this post-quantum threat, so that from today's point of view a secure communication cannot be guaranteed over the entire expected operating period of the vehicle.

[0009] To address post-quantum threats, asymmetric algorithms resistant to post-quantum threats have been commonly studied for several years. These are approaches commonly referred to as post-quantum cryptography or PQC. However, they are not yet suitable today to replace traditional methods, since they are still not very mature. Therefore, today's vehicles cannot yet be designed with asymmetric cryptographic protection methods for post-quantum functions, since such technologies are not yet mature enough to allow a final evaluation of the expected safety in this context. Moreover, they have not been standardized so far, and the approach requires a lot of resources. Therefore, at the moment, it is not wise to switch to such quantum computer-resistant encryption methods too quickly, and they are not easily realizable. Even if there were already standardized PQC methods that were considered sufficiently secure, it would not be wise to implement such methods in the communication devices of today's vehicles, since the higher cost burden and high resource consumption are counter to economic efficiency in the current vehicle ecosystem.

[0010] Furthermore, depending on the current state of awareness of post-quantum threats, symmetric methods such as AES (Advanced Encryption Standard), hash methods such as SHA-512 (Secure Hash Algorithm), or symmetric authentication methods such as HMAC (Hashed Message Authentication Code) are essentially unaffected. Depending on the state of awareness, the security of this method will certainly be halved by the occurrence of post-quantum threats, so that a 128-bit key still provides 64-bit security even after quantum computers become available. However, such vulnerability can be relatively easily compensated for by increasing the key length.

[0011] The applicant's previous, non-prepublished German patent application 10 2020 001 199.3 describes a communication device and a method for cryptographically protecting communications. The patent application describes two explicit modes, a pre-quantum mode and a post-quantum mode, whereby in the pre-quantum mode conventional asymmetric encryption methods are used and in the post-quantum mode only post-quantum resistant encryption methods are used. The mode in which the system is located is indicated via a binary value, which is stored in an unalterable manner in a correspondingly protected memory, which can be formed, for example, as a Write-Once-Memory (WOM). Summary of the Invention [Problem to be solved by the invention]

[0012] The object of the present invention is to provide a method for securing communication between a communication system of a vehicle and a server external to the vehicle, which method ensures continued secure communication even in the event of a post-quantum threat. [Means for solving the problem]

[0013] According to the invention, this problem is solved by a method having the features of claim 1, and here in particular the features of the characterizing part of claim 1. Advantageous embodiments and developments of the method emerge from the dependent claims relating to claim 1.

[0014] Of course, the occurrence of a post-quantum threat is then itself an event that is not very substantial in reality. A post-quantum threat occurrence in the sense of the method of the invention should therefore be understood as an action that is triggered, for example, via a vehicle external server, if it is determined, for example, by the vehicle manufacturer, an authority, etc., that the pre-quantum resistant method may soon no longer be secure. In this case, via such an action, for example setting a flag, initiating a software update, etc., the post-quantum threat era may begin for all vehicles connected to the server.

[0015] The method of the invention uses a first protection method for non-post-quantum resistant protection of data exchanged via a communication interface, substantially similar to the above-mentioned previous unpublished German patent application, which method is implemented in a communication system, i.e. generally represents a real delivery state. To address the problem that currently there is not yet any reliable knowledge of post-quantum resistant protection, such a method does not necessarily have to be implemented in the communication system, although this is also possible, but there is also the possibility of implementing the functions and the necessary processes later via a corresponding interface. The interface itself can also in principle be implemented in the communication system, and can also be created initially on the interface side within the scope of a protected software update. This allows a great flexibility of possible methods. Indeed, it is currently known that currently common asymmetric methods for protecting data are not non-post-quantum resistant. This seems to be the case for symmetric methods, especially if the key length is sufficiently long. The problem is that symmetric methods are not flexible enough in terms of key distribution and key negotiation, and cannot currently be used efficiently to protect communications between a large number of heterogeneous participants, such as those required in the vehicle ecosystem. These symmetrical and almost certainly post-quantum-resistant methods can therefore only be used for individual, particularly important data and procedures. However, almost certainly in the future, suitable and sufficiently secure post-quantum-resistant methods and protocols will be provided, which in particular also fulfill all prerequisites for such efficient key distribution and key negotiation, and are also suitable for large-scale systems with a very large number of heterogeneous participants. For example, a kind of post-quantum-resistant asymmetric cryptography. Here, the method of the present invention creates the possibility of realizing in future developments already in communication systems currently installed in vehicles, by being able to switch to a second post-quantum-resistant protection method in a secure manner if necessary at a later time.

[0016] Furthermore, key data required for use only in the second protection method can in principle also be introduced first into the communication system and stored securely there. However, this is a particular advantage of the inventive method which is implemented later, for which a separate interface is used. In contrast to the aforementioned interfaces for implementing the methods and processes, this separate interface is used to implement key data required for post-quantum-resistant protection of the communication, if necessary, and is realized cryptographically encrypted. In the aforementioned other interface, the protection of the integrity protection and authenticity protection is sufficient. In the other interface, through which the key data required for the implemented method are transmitted, encryption is additionally required to ensure the confidentiality of the key data in any case.

[0017] In that case, in principle, the initially introduced key data becomes a kind of "base secret" for both protection methods that is kept appropriately, from which "specific secrets" required for each protection method can be derived as necessary and used exclusively in each case.

[0018] However, according to a highly preferred embodiment, the method may also be provided such that the initially introduced key data is provided for use only in the second protection method.

[0019] A further highly preferred embodiment of the method of the invention provides a further interface which is used to deactivate or remove the functions of the first non-post-quantum resistant protection method, which can thus correspondingly deactivate or switch off the functions and optionally remove them, whereby these functions are inactivated in each case.

[0020] The three interfaces described here then ultimately correspond to three different substates, which are practically necessary as prerequisites for a secure transition of a communication system to the post-quantum era. Via yet another interface, it is correspondingly ensured that conventional non-post-quantum resistant encryption methods used in the pre-quantum mode are no longer used by the communication system. Via the first-mentioned interface, the implementation of post-quantum resistant encryption methods is possible. Via another interface, which in the present list approximately forms a third interface, key data are transmitted to the communication system, which is supplied with the secret key data necessary for the integrated post-quantum resistant method via the second interface according to the list. Therefore, cryptographic protection and encryption of the data possibly transmitted via the third interface becomes very important in order that the secret key data also remain really secret.

[0021] After conventional non-post-quantum resistant methods and functions that are still used in pre-quantum mode have been deactivated and / or removed via a further interface from the above list, a second protection method, which is implemented via the second interface and is provided with the necessary private key data via a third interface, can be correspondingly activated via a further fourth interface.

[0022] In that case, all interfaces can and should be protected by cryptographic methods, and in that case, if the interfaces are used to realize the functionality of the communications system in a post-quantum mode, typically before the post-quantum threat arises, it is effectively irrelevant whether the methods are post-quantum safe, and therefore these interfaces can typically be adequately secured only via pre-quantum safe methods.

[0023] It is particularly advantageous for a further third interface, which may be used for the transmission of secret key data if necessary, that needs to be protected, to select in advance post-quantum resistant methods for the cryptographic protection and in particular for the encryption, e.g. symmetric encryption with sufficient key length as well. In this case the original secret must be stored reliably protected in the communication system.

[0024] In principle, such protection can be correspondingly used for other interfaces, since, considering the post-quantum threat, the above protection, which is in principle possible with non-post-quantum resistant methods, does not provide Perfect Forward Secrecy (PFS). This means an attacker, who can for example record communication data sent before the post-quantum threat occurs and protected using non-post-quantum resistant methods, and can decrypt said communication data after the post-quantum threat occurs. Therefore, in order to completely avoid this problem here, methods that are currently considered to be post-quantum resistant, such as symmetric authentication and / or encryption with a key of sufficient key length, can be used in advance for protection. Since the procedures and / or their implementation itself for modifying processes in the communication system via the mentioned interfaces, as well as the implementation of new functions via the interfaces, do not usually fall under the mass communication that is common in vehicles and are therefore very rare and usually only performed once, the communication system can be equipped with the key data necessary to protect these procedures at reasonable cost.

[0025] A further highly preferred embodiment of the method of the invention can furthermore be provided in that the deactivation and / or removal of the functionality of the first protection method is irreversible via a further interface. Such irreversible deactivation or removal ensures that the corresponding method cannot be reactivated at a later time, when a post-quantum threat has generally already occurred. This means in practice that the communication will be reprotected with a pre-quantum resistant method and therefore will no longer be secure in the post-quantum threat era.

[0026] As already mentioned, a communication system is equipped with the necessary key data if at least one of the interfaces is implemented. This can happen initially, but is not required. With respect to PFS, it is only important that the introduction of key data via another third interface, i.e. the introduction of private key data for post-quantum operations, is done exclusively using post-quantum resistant cryptography.

[0027] A highly preferred embodiment of the method of the invention now involves the secure marking of procedures for each of the interfaces. means can be further provided as the last possible step of this kind. means should be designed in such a way that any changes made up to that point, including this last marked step, are irreversible with respect to the respective interface. This also serves to prevent any functionality that has been changed through the respective interface, which will indeed eventually allow a switch from pre-quantum to post-quantum mode, but no longer reversible.

[0028] In order to particularly secure the inventive method, it can then be provided, according to a very advantageous development of the method, that an individually secured update interface is provided for each interface that can be implemented via a software update. This separate update interface for software updates, secured, for example, from the point of view of integrity and authenticity, again ensures that the corresponding functions are correspondingly secured if they are integrated into a communication system only in the course of its "life". In that case, according to a very preferred embodiment, the individual update interface for software updates secures the procedure and marks it as the last possible procedure, in order to ensure that the changes made up to that point in respect of the interface are again irreversible. means can be provided as well.

[0029] Further advantageous configurations of the method according to the invention also emerge from the exemplary embodiments which are described in detail below with reference to the drawings. [Brief description of the drawings]

[0030] [Figure 1] FIG. 2 is a diagram of a principle communication scenario between a vehicle and a vehicle-external server. [Diagram 2] FIG. 2 is a schematic diagram illustrating the transition from a non-post-quantum resistant mode to a post-quantum resistant mode of a vehicle's communication system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0031] As mentioned at the beginning, modern vehicles are typically part of a larger vehicle ecosystem, where the vehicle communicates with servers external to the vehicle, the so-called backend.

[0032] In the representation of FIG. 1, a vehicle 1 is shown with a diagrammatically illustrated communication system 2, which communicates with a vehicle-external server in the form of a back-end 3. This communication between the communication system 2 of the vehicle 1 and the back-end 3 then serves the exchange of various data, some of whose functionality is realized by software and stored in the back-end 3, for example for controlling the driving dynamics, for controlling the navigation system, for implementing software updates and / or for utilizing a large number of systems and devices in the vehicle 1. The data exchanged then have various requirements from a safety point of view. For example, they have to be reliably protected, since they are equally important for driving safety. This can be achieved by using encryption methods for authentication, encryption and / or identity protection. For other data, encryption is particularly important, for example to protect the privacy of the user of the vehicle 1, and for still other data, such as software updates, it is particularly important that a reliable authentication is provided, so that the systems in the vehicle 1 can rely on the fact that the software updates are made available from an authenticated and trusted location, such as, for example, the back-end 3.

[0033] In order to ensure that communication systems currently protected by non-post-quantum resistant methods are still secure and fully functional even after the emergence of the post-quantum threats mentioned at the beginning, they are required to be protected by post-quantum resistant methods at some future point in time. In order to operate a communication system 2 securely in such a post-quantum mode, four main prerequisites must then be met: 1. It is ensured that conventional non-post-quantum resistant encryption schemes used in the first protection method of the pre-quantum mode are no longer used in the communication system 2. 2. Communication system 2 implements a post-quantum resistant encryption method. 3. The key data required to use the implemented post-quantum resistant encryption scheme is present within the communication system 2. 4. The post-quantum resistant encryption scheme implemented in the communication system 2, together with associated key data, is used by the communication system 2 to secure the communication system 2, for example to protect communications with a back-end 3 outside the vehicle.

[0034] These four preconditions correspond to the four substates (TZ1 to TZ4) that the communication system 2 must be in in order to be protected with post-quantum resistance. In this case, the communication system 2 is considered to be in substate TZi when exactly precondition or condition i is satisfied.

[0035] 2 shows various states of the communication system 2 together with defined sub-states TZi therein and further parameters which will be explained further, whereby only in the states shown in the second row (TZ1, TZ2, TZ3, TZ4) the communication system 2 is post-quantum resistant.

[0036] The four substates TZi are not independent of each other. In particular, substates TZ2 (presence of an implementation of a post-quantum resistant method) and TZ3 (presence of associated (secret) key data) are prerequisites for substate TZ4 (use of a post-quantum resistant method). This means that before the communication system 2 can be moved to substate TZ4, it must first be moved to substates TZ2 and TZ3. Logically, it should be in substate TZ1 (non-use or deactivation of conventional non-post-quantum resistant methods) before it can be moved to substate TZ4. On the other hand, substates TZ1, TZ2, and TZ3 are independent of each other and the communication system 2 can move to these substates in any order.

[0037] The communication system 2 can then be in each of the four sub-states TZ1, TZ2, TZ3, TZ4 in two ways. On the one hand, the communication system 2 may already be in this sub-state when shipped. On the other hand, the communication system 2 may be moved to this sub-state TZ1, TZ2, TZ3, TZ4 in a secure manner during operation, for example by remote function or at the factory. For this, the communication system 2 must be equipped with suitable interfaces S1, S2, S3, S4 with which the state transitions can be achieved. To exclude misuse of these interfaces S1, S2, S3, S4, they must be appropriately protected or guarded.

[0038] If the communication system 2 is already in a certain substate TZ1, TZ2, TZ3, TZ4 at the time of delivery, the interfaces S1, S2, S3, S4 that allow the communication system 2 to transition to this substate TZ1, TZ2, TZ3, TZ4 are not required. For example, the implementation of post-quantum resistant methods in the communication system 2 has been done in advance, so that there is no need to introduce post-quantum resistant methods into the communication system 2 at a later time. If post-quantum resistant methods are not implemented, the corresponding interface S2 is required, which allows the secure introduction of these implementations in a communication system 2 that is already delivered and in the field. In the extreme case, the communication system 2 is not in any of the four substates TZ1, TZ2, TZ3, TZ4 at the time of delivery. This means that the interfaces S1, S2, S3, S4 are required to switch off non-post-quantum resistant methods in a secure manner, provide the communication system 2 with the implementation of post-quantum resistant methods and the associated key data, and subsequently switch on for using this implementation. In the other extreme case, all four substates TZ1, TZ2, TZ3, TZ4 are already fulfilled in the communication system 2 as shipped. As such, and subsequently, given all four preconditions above, the communication system 2 will be pre-protected with post-quantum resistance. Thus, none of the interfaces S1, S2, S3, S4 are needed, nor are any actions required to make them post-quantum resistant in the future.

[0039] Each of these four interfaces S1, S2, S3, S4 must be protected against misuse, as far as this is necessary and possible. The four interfaces S1, S2, S3, S4 then have different protection requirements. For the interfaces S1, S2 and S4, the integrity of the data or the authenticity of the users of these interfaces S1, S2 and S4, e.g. the integrity of the implementation of the post-quantum resistant method transmitted when using the interface S2, plays a central role. In contrast, the confidentiality of the data, e.g. the confidentiality of the post-quantum resistant method introduced into the communication system 2 via the interface S2, is less important. However, for the interface S3 for introducing key data for the post-quantum resistant method, not only the integrity / authenticity of the data, here i.e. the key data, but also the confidentiality is very important.

[0040] The interfaces S1, S2, S3, S4 can be protected not only using conventional non-post-quantum resistant methods, as already explained and exemplified above, but also using post-quantum resistant methods.

[0041] Compared to protection with post-quantum resistant methods, protection of one in four interfaces using non-post-quantum resistant methods is less secure for two reasons. 1. Interfaces that are protected with non-post-quantum resistant methods can no longer be safely used after the occurrence of a post-quantum threat. 2. Considering post-quantum threats, protection by non-post-quantum resistant methods does not provide Perfect Forward Secrecy (PFS). This means that if an attacker records a communication protected using a non-post-quantum resistant method, for example, that took place before the post-quantum threat occurred, the attacker can subsequently, i.e., after the post-quantum threat occurs, possibly authenticate any freely selected individual data that is indistinguishable to the recipient, and decrypt the encrypted content.

[0042] The effects of the first vulnerability can be avoided if the respective interfaces S1, S2, S3, S4 protected by a non-post-quantum resistant method are only used before the occurrence of a post-quantum threat, i.e. if the communication system 2 is safely transferred under its use in the corresponding sub-states TZ1, TZ2, TZ3, TZ4 before the occurrence of a post-quantum threat, thereby to the second protection method for the post-quantum mode. It is then necessary to ensure that none of the interfaces S1, S2, S3, S4 can be used to reverse this transition. This is particularly the case for the interface S1 which deactivates the non-post-quantum resistant method in the communication system 2, which can be ensured, for example, by a secure irreversible post-qubit implementation, i.e. for example by a write-once memory (WOM) arranged in a protected hardware security module (HSM), as described in the above-mentioned previous German patent application 10 2020 001 199.3.

[0043] The second vulnerability affects the individual interfaces S1, S2, S3, S4 differently. As already mentioned above, the interfaces S1, S2 and S4 have higher integrity and authenticity requirements but lower confidentiality requirements. This means that transitions made before the occurrence of a post-quantum threat to sub-states TZ1, TZ2 and / or TZ4 via interfaces S1, S2 and / or S4 protected by a non-post-quantum resistant method cannot be reversed after the occurrence of a post-quantum threat, e.g. by using the same interfaces S1, S2 and / or S4 protected by a non-post-quantum resistant method, and state transitions made before the occurrence of a post-quantum threat are protected even if they were protected by a non-post-quantum resistant method. This can be achieved, for example, by deactivating the interfaces S1, S2, S4 before the occurrence of a post-quantum threat. Therefore, switching of interfaces S1, S2 and / or S4 to post-quantum resistant protection is not necessary if these interfaces are only used before the occurrence of a post-quantum threat, i.e. if the irreversible transition to sub-states TZ1, TZ2 and / or TZ4 has already taken place before the occurrence of a post-quantum threat.

[0044] In contrast, the interface S3, which is used to introduce new key data into the communication system 2, has additionally high confidentiality requirements. This means that the transmission of encrypted data recorded "preliminarily" using non-post-quantum resistant methods can be decrypted by an attacker after the occurrence of the post-quantum threat. Even if the recording of encrypted exchanged messages, which cannot be decrypted at the time of recording, is complex and costly, the possibility of decryption cannot be excluded. Thus, the initial protection of the interface S3 only by post-quantum resistant methods results in an increase in security compared to the initial protection of the interface S3 by non-post-quantum resistant methods, even if the interface S3 should have been used only before the occurrence of the post-quantum threat. If the interfaces S1, S2, S3, S4 should be able to operate securely before and after the occurrence of the post-quantum threat, it is necessary to protect the interfaces from the beginning, i.e. at the time of shipment of the communication system 2, by post-quantum resistant methods, such as, for example, exclusively symmetric methods with a key of sufficient length.

[0045] In that case, the individual interfaces S1, S2, S3, S4 do not all need to be protected by non-post-quantum resistant methods or all need not be protected by post-quantum resistant methods. Rather, each interface is individually protected by non-post-quantum resistant methods or by post-quantum resistant methods. Thus, depending on the type of protection, the interfaces can be safely used only before the occurrence of a post-quantum threat or also after its occurrence.

[0046] Depending on the encryption method used, the communication system 2 must be equipped with the necessary encryption data to protect the interfaces S1, S2, S3, S4 at the time of each of their use.

[0047] Each of the four interfaces S1, S2, S3, S4 is implemented at least in large part in software, which therefore means that each of these interfaces S1, S2, S3, S4 may already be implemented in the communication system 2 before the start of operation of the communication system 2, or the interfaces may alternatively be uploaded after the fact, during operation, in the communication system 2, using a common software update interface, for example as a remote update via the backend 3, or also for example at the factory.

[0048] A prerequisite for using a software update interface SWU for introducing one or more interfaces S1, S2, S3, S4 into the communication system 2 is that the used software update interface SWU also supports the introduction of the respective interfaces S1, S2, S3, S4 which allow a relatively deep intervention into the communication system 2. The individual interfaces S1, S2, S3, S4 are then in particular hardware-related interfaces which generally change very little and which can be very closely related to the hardware configuration implemented in the communication system 2. For this reason alone it therefore makes sense to provide a specific software update interface SWU1, SWU2, SWU3, SWU4 for each interface S1, S2, S3, S4 which is to be implemented subsequently by means of a software update if necessary.

[0049] Such a software update interface SWU also needs to be protected against misuse, again not using non-post-quantum resistant or post-quantum resistant methods. Since the software update interface SWU has no special confidentiality requirements and it is clear that data integrity and authenticity take priority, a software update interface SWU protected by a non-post-quantum resistant method, similar to interfaces S1, S2 and S4, can be safely used to introduce implementations of interfaces S1, S2 and S4, provided that the introduction is performed before the occurrence of post-quantum threats and the respective software update interface SWU is still deactivated before the occurrence of post-quantum threats.

[0050] In that case, again the type of protection, i.e. non-post-quantum resistant or post-quantum resistant, is independent of each other for the software update interface SWU and the interfaces S1, S2, S3, S4 and can be combined in any way. That is, for example, the software update interface SWU cannot be protected with post-quantum resistance, and one of the interfaces S1, S2, S3, S4 can be protected with post-quantum resistance or vice versa. In that case, it is always wise to take into account that an interface protected in a non-post-quantum resistant manner can no longer be used safely after the occurrence of a post-quantum threat. Each of the interfaces S1, S2, S3, S4 that will be introduced via a software update preferably has a software update interface SWU1, SWU2, SWU3, SWU4 specially designed and protected for that interface, as shown in FIG. 2.

[0051] If the software update interface SWU or one of the interfaces S2, S3, S4 is protected in a non-post-quantum resistant manner and the communications system 2 is in substate TZ1 which prevents the use of non-post-quantum resistant methods, then this interface can no longer be used. This requires consideration of the order in which the software update interface SWU is used to introduce the interfaces S2, S3, S4 in the communications system 2, as well as the order in which the interfaces S1, S2, S3, S4 are invoked and the associated order in which the communications system 2 is brought into the substates TZ1, TZ2, TZ3, TZ4.

[0052] The encryption methods used to protect the software update interface SWU or the interfaces S1, S2, S3, S4 require appropriate key data. If the focus of the interfaces SWU, S1, S2, S4 is on the integrity and / or authenticity of the data introduced into the communication system 2, it is sufficient to use conventional asymmetric methods (digital signatures) to equip the communication system 2 with non-secret key data (public keys, certificates) to check them. These data can be securely introduced into the communication system 2 not only initially but also at any time afterwards via a non-secret protected interface, such as for example the software update interface SWU. However, the interface S3 is mandatory for confidentiality and for its establishment it is essential that the communication system 2 is initially equipped with secret key data G3.

[0053] 2, as already mentioned above, the communication system 2 is shown in a number of different states, connected by arrows indicating state transitions. The top three illustrations of the communication system 2 show the communication system 2 still in non-post-quantum resistant operation, while the bottom three illustrations show the communication system 2 in post-quantum resistant operation after it has reached that state.

[0054] In the top left diagram, various states and interfaces are correspondingly indicated within the communication system 2 in brackets. S1 indicates the first interface, TZ2 here means that the second substate has already been reached, i.e. the post-quantum-resistant method is in principle ready. Interface 3 is also available, but interface S4 for establishing substate TZ4 is missing. However, the communication system also implements a software update interface SWU4, i.e. an interface for interface S4, from the beginning. Furthermore, the communication system 2 includes a secret G3 that is initially stored in the communication system 2 tamper-proof and read-safe, i.e. for example stored in an HSM, which is required for communication via interface S3. The arrow from below here indicates the use of the software update interface SWU4 (S4) for implementing interface S4.

[0055] Thus, here, the existing software update interface SWU4 is actively used from the beginning. In the next state, which is then illustrated by the central illustration of the communication system 2, the interface S4 is correspondingly installed. Although the performed changes could now also be made irreversible by deactivating or deleting the software update interface SWU4, this is not done here, so that the current implementation S4 may further be overwritten in the future using SWU4. The software update interface SWU4 is therefore also illustrated in the following variants, respectively:

[0056] Using the initial secret G3, an additional secret, here denoted Gx, which is only necessary for the post-quantum mode, can be correspondingly downloaded via the existing interface S3 in this case, so that the interface S3 guarantees the conditions already mentioned several times regarding authenticity, integrity and especially confidentiality on the basis of the secret G3 and, for example, symmetric encryption using a sufficiently long key. After this step, the interfaces S1 and S4 and the substates TZ2 and TZ3 are now in the state of the communication system 2 shown in the upper right part. By switching off the previous non-post-quantum resistant method and protocol, i.e. the first protection method, using the interface S1 shown in this step, and switching to the second post-quantum resistant protection method using the interface S4, the substates TZ1 and TZ4 are now also correspondingly fulfilled. This state of the communication system 2, in which all substates TZ1, TZ2, TZ3 and TZ4 are fulfilled, can be seen in the lower part of the illustration in FIG. 2. In this state, the communication system 2 has been safely transferred to the post-quantum resistant mode of operation by the method of the invention.

Claims

1. A method for securing communications between a communication system (2) of a vehicle (1) and a vehicle external server (3) via a communication interface, the communication interface being secured to allow data to be transmitted to the communication system (2) such that the integrity and authenticity of the data are protected, A first protection method for non-post-quantum resistant protection of exchanged data is implemented in the communication system (2) via the communication interface, a second protection method for post-quantum resistant protection of exchanged data is implemented in the communication system (2) via the communication interface, or can be implemented via an interface (S2) implemented in the communication system (2), or can be implemented via a software update, The method, characterized in that key data for use in the second protection method can be introduced via another interface (S3) implemented in the communication system (2), is received encrypted in an encryption method and is securely stored for use only in the second protection method, the method being characterized in that the key data is introduced via the other interface (S3) using symmetric encryption.

2. 2. The method according to claim 1, characterized in that the functionality of the first protection method is deactivated and / or deleted by a further interface (S1) in the event of a post-quantum threat.

3. 3. The method according to claim 2, characterized in that in the event of the occurrence of the post-quantum threat, the second protection method is activated by a further fourth interface (S4) to protect only data exchanged via the communication interface.

4. 4. The method according to claim 2 or 3, characterized in that the deactivation and / or the removal of the functionality of the first protection method by the further interface (S1) is irreversible.

5. Method according to any one of claims 1 to 4, characterized in that the communication system (2) is equipped with necessary key data if at least one of the interfaces (S1, S2, S3, S4) is implemented.

6. 6. The method of claim 5, wherein the provision is initially generated.

7. 7. The method according to any one of claims 1 to 6, characterized in that for each of said interfaces (S1, S2, S3, S4) means are provided for the secure marking of a procedure as the last possible procedure, said means being designed in such a way that for each of said interfaces (S1, S2, S3, S4) any changes made up to that point are irreversible.

8. Method according to any one of claims 1 to 7, characterised in that for each of the interfaces (S1, S2, S3, S4) implementable via software update a separate secure software update interface (SWU1, SWU2, SWU3, SWU4) is provided.

9. 9. The method according to claim 8, characterized in that for each of the software update interfaces (SWU1, SWU2, SWU3, SWU4) means are provided for marking a procedure securely as the last possible procedure, said means being designed in such a way that changes made up to that point in time with respect to said software update interfaces (SWU1, SWU2, SWU3, SWU4) are irreversible.

Images