Method for operating a control device that runs multiple applications - Patents.com

Abstract

A method (100) for operating a control device (1) for executing a plurality of applications (2, 3, 4), comprising the steps of: obtaining (110) a first code block (21) of a first application (2) containing executable program code of the first application (2) based on a reference indication (1a) permanently stored in the control device (1); checking (120) based on verification information (1b) permanently stored in the control device (1) whether the first code block (21) is in a state corresponding to said verification information (1b); in response to a positive result of said checking, enabling (130) for execution of the program code contained in the first code block (21); the step of obtaining (140) a transition block (23) including a reference to another code block (31, 41) of another application (3, 4) including executable program code of the other application (3, 4) based on a reference indication (21a) included in at least a first code block (21); the step of checking (150) based on verification information (21b) stored in at least a first code block (21) whether the transition block (23) is in a state corresponding to the verification information (21b) and, in response to a positive result of the checking, the step of obtaining (160) the other code block (31, 41) of the other application (3, 4) based on the reference indication (23a) included in the transition block (23).

Description

[Technical field]

[0001] The invention concerns the operation of a controller under boundary conditions where correct functioning of the controller can only be guaranteed by the legitimate interaction of multiple applications. [Background technology]

[0002] Background technology In vehicle control devices, functional sections are no longer defined by static arrangement on fixed integrated circuits, but are increasingly defined by software running on a control device configured as a computer.

[0003] The functions of such control devices are also becoming more and more relevant to aspects of vehicle operation related to the vehicle's operation authorization. This means that unauthorized changes in the software by the vehicle's user can cause the operation authorization to be removed and therefore must be technically difficult. One example of such a change is "chip tuning", which increases the engine power of the vehicle but can cause deviations from the accepted values ​​for exhaust gas or noise characteristics.

[0004] This type of manipulation can, for example, expose the vehicle to increased wear and tear. In the event of a vehicle breakdown, this manipulation can possibly go unnoticed if the user restores the software to its initial state before repairing the vehicle, allowing the user to obtain compensation or a service repair even though the manipulation would have otherwise forfeited the right to compensation.

[0005] The documents DE 102012110559 A1, DE 102012109619 A1, DE 102014208385 A1 and DE 102012109617 A1 disclose general prior art techniques for protecting control devices against software manipulation. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] DE 102012110559 [Patent Document 2] DE 102012109619 [Patent Document 3] DE 102014208385 A1 [Patent Document 4] DE 102012109617 Summary of the Invention [Means for solving the problem]

[0007] Disclosure of the Invention Within the scope of the invention, a method is developed for operating a control device running multiple applications, which may in particular be a control device for a vehicle and / or for the drive mechanism of a vehicle. Examples of such control devices include engine control devices, control devices for driving dynamics systems (e.g. electronic stabilization program ESP, known driving dynamics control) and control devices for at least partially automated control of a vehicle in traffic.

[0008] An application is understood to be a program that, when executed in particular on the hardware of the control device, realizes at least a part of the nominal functionality of the control device. An application comprises at least one code block that comprises an executable program code. In addition, the application may also comprise at least one data block that the program code requires to perform its function. The data block may comprise, for example, a characteristic map or other parameters for the controller. For example, the controller may be implemented as a program code in general and adapted to a specific vehicle by the characteristic map or other parameters mentioned above. The program code may, for example, implement a trained machine learning module, for example a neural network. In this case, the data block may comprise, for example, parameters that characterize the behavior of the trainable module. In a neural network, these parameters comprise, for example, weights for calculating inputs that are supplied to neurons or other processing units to operate them.

[0009] In the method, a first code block of a first application is obtained, the first code block containing executable program code of the first application, based on a reference indication stored permanently in the control device. Similarly, based on verification information stored permanently in the control device, it is checked whether the first code block is in a state corresponding to the verification information. In response to a positive result of the check, the program code contained in the first code block is enabled for execution.

[0010] Permanently stored in the control device is understood to mean a form of storage that cannot be freely changed by the end user of the control device, at least without the knowledge and will of the manufacturer of the control device or without the knowledge and will of other departments authorized to organize changes in the control device. For this purpose, for example, memory modules or storage media can be used in which individual bits, bytes or blocks of bytes can be set to new values ​​by an irreversible physical writing process starting from a new state. An example of this is a number of memory modules in which individual bits are switched by burnout or other destruction of conductive structures.

[0011] It should be noted that fixed storage in a control device is also understood to mean storage, for example in a Trusted Platform Module TPM or a Hardware Security Module HSM, which, from a physical point of view, can be subsequently changed but which may be tied to the possession of a particular cryptographic key or other authorization feature.

[0012] Obtaining a code block based on a reference, or generally obtaining any information block, is to be understood in particular as calling said block using the memory address given by the reference, for example from a programmable memory of the control device. However, this is not the only possible means. The reference can also be used, for example, to load the block from the Internet. If a sufficiently fast Internet connection is available (for example via 5G mobile radio), then the control device itself only needs to assume minimal functionality, similar to the PXE network boot previously implemented in local networks, and the application can then be reloaded in each case always with the latest version.

[0013] A transition block including a reference to another code block of another application is obtained based on at least the reference included in the first code block, the other code block including executable program code of the other application. Based on the verification information stored in the first code block, it is checked whether the transition block is in a state corresponding to the verification information. In response to a positive result of the check, the other code block of the other application is obtained based on the reference included in the transition block.

[0014] In this case, the code block of the other application may likewise contain a reference indication, which allows to obtain the next transition block and ultimately the next code block of the next application.

[0015] According to the method, the boot process of the controller can be protected by a simple requirement that only authorized code be executed, such that a forced path is established for the sequence of applications executed, so that the end user of the controller cannot independently change such a sequence or independently suppress the execution of certain applications.

[0016] Conversely, this means that the decomposition of the functions of the control unit into individual applications that run in succession no longer represents a particular safety risk. A monolithic application that covers the entire functions of the control unit can be particularly well protected against manipulation (for example by cryptographic methods), but in return is relatively complex to update or expand. In particular in control units for vehicles that cover a wide range of different tasks, several manufacturers often cooperate in the respective applications. If a monolithic application is to be finally formed, the manufacturer must integrate the contributions of all other manufacturers and repeat this integration every time the individual components are updated. In contrast, if the functions implemented by several manufacturers are contained in several applications, these applications can be updated independently of each other. However, this may result in the necessity to intervene in the boot process of the control unit without the additional protection measures described in this document.

[0017] The motivation for such intervention by the end user may be, for example, that many vehicles, such as electric mini vehicles (also known as “E-scooters”) or electrically assisted bicycles (“Pedelecs” or “E-bikes”), are produced for use in many countries, but are subject to different legal regulations in each country. In this case, from a purely technical point of view, these vehicles are equipped with all the functions to be used in one of the countries envisaged and are designed for the maximum power and maximum speed required in one of these countries. For example, the pedaling assistance of E-bikes in Germany is only active up to a speed of 25 km / h and the operation of the engine must be by pedaling, not by the accelerator grip or other manual operating elements, which is set only by the software on the control unit. Compliance with the regulations is an essential prerequisite for E-bikes to be legally valid as bicycles and allowed for use in public road traffic without the obligation to have a driving license and insurance. Correspondingly, at some point during the boot process of the e-bike, an application is provided that defines the authorization framework in accordance with the country of use, after which, for example, an application for the drive system can actually drive the e-bike according to the parameters thus set. If the end user were to successfully reverse the boot sequence, it would then be possible to drive the e-bike at the maximum technically possible speed with unpermitted functions. If such an intervention could occur with only a slight hand grip and without special knowledge or tools, this abstract possibility could even have serious consequences for the user, even if the user did not intend such an intervention at all. That is to say, the user would have to deal with an investigation procedure for driving an unlicensed, unpaid taxed and uncertified (possibly without a driving permit) vehicle right from the start and have to defend against such accusations.

[0018] Advantageously, based on the verification information contained in the transition block, it is checked whether another code block is in a state corresponding to said verification information. In response to a positive result of said check, the program code contained in said another code block is enabled for execution. In this way, a chain of trust can be built that spans any number of applications to be executed in succession based on a single reference, which is permanently stored in the control device, and a single data set, which includes the verification information (trust anchor "Root of Trust"), which is permanently stored in the control device.

[0019] In a particularly advantageous embodiment, the transition block is not directly obtained based on the reference designation contained in the first code block, but first the reference designation block is obtained. Then, based on the verification information stored in the first code block, it is checked whether the reference designation block is in a state corresponding to the verification information. In response to a positive result of the check, the transition block is obtained based on the reference designation contained in the reference designation block. In this case, the reference designation block may further optionally contain unique verification information that can be used in the first code block instead of the verification information to verify the transition block. Since there is a chain of trust of the verification information in the first code block to the verification information in the reference designation block, it is not important for the security level which verification information the transition block is verified by. If the reference designation block contains unique verification information, this provides even greater granularity as to how and by which entity the boot sequence of the control device can be modified.

[0020] The inclusion of the reference block facilitates task division, particularly in the scenario described at the beginning, where applications from different manufacturers interact, so that, for example, the reference block can select which application is to be executed next, and furthermore the maintenance and updates of this application can be left to the respective external manufacturer.

[0021] In the above-mentioned example of an e-bike, for example for each country of use, a localization team may be responsible for translating legal provisions regarding the use of e-bikes in road traffic (e.g. regarding speed or availability of features) into corresponding operating parameters of the e-bike, whereas the manufacturer of the e-bike is responsible for adapting its behavior to the respective country of use in the first place.

[0022] This scenario can be implemented, for example, by creating a transition block for each intended country of use that contains a reference (e.g. a URL) to a localized application for that country and the public cryptographic key of the corresponding localization team. The manufacturer of the e-bike can then approve, via the reference block, which of the transition blocks is selected for a concrete sample depending on the intended country of use. Thus, each sample of the e-bike is provided with a similar entry in the transition block, and only the reference block for the sample can be changed. An update or other change of the localized application does not require a change in the transition block or the reference block, respectively. It is sufficient to store a new version under the URL stored in the transition block, with a digital signature that can be verified by the public key stored in the transition block.

[0023] The verification information may include, for example, a hash value, and in response to the hash value matching the hash value formed by the code block, the transition block, or the reference block, it can be confirmed that the code block, the transition block, or the reference block here is in a state corresponding to the verification information.

[0024] In a particularly advantageous configuration, the verification information comprises at least one public key of the asymmetric cryptosystem. In response to the code block, the transition block or the reference block being validly signed by a private key belonging to said public key, it can then be verified that the code block, the transition block or the reference block here is in a state corresponding to the verification information. The use of a public key as verification information has the particular advantage that the key here can remain the same even if the code block, the transition block or the reference block to be verified is modified. Verification of the signature ensures that the signature was made by the appropriate private key. This ensures that the code block, the transition block or the reference block was modified by an entity authorized therefor.

[0025] The public key as verification information allows a particularly simple ranking and management of who is authorized to modify certain flows and settings, so that, for example, certain modifications are reserved only for the vehicle manufacturer, whereas other modifications, such as the additional initialization of an electronic trailer clutch, can be entrusted to the Road Traffic Authority or the Technical Inspection Foundation (TUEV), which inspects the retrofit of the trailer clutch and enters it in the vehicle inspection and registration document.

[0026] In a particularly advantageous configuration, the first code block, the transition block and / or the reference block additionally contain a description of the authorizations for access to the system resources of the control device and / or the execution of actions in or by the control device. The access to the system resources by the other applications and / or the execution of actions by the other applications are restricted according to the authorizations here. In this way, the above-mentioned task division between the manufacturers of the various applications can be improved so that mutual interference and incompatibilities of the applications are reduced. At the same time, it is easier to increase safety, especially when the control device is used in a vehicle, if an application can always only do things that correspond to its intended purpose of use.

[0027] Here, for example, in the interior of a vehicle, a CAN bus is widely installed in a networked state, so that essentially all sensors, actuators and control devices can be connected to one another. Before the introduction of such networks, large cable harnesses were used to create dedicated point-to-point connections for the exact intended communication relationships desired in the vehicle. In this case, the above-mentioned networking allows for a great deal of flexibility, and in particular makes it much easier to retrofit functions. However, this does not only have advantages, for example, if the entertainment system is essentially able to communicate with the driving dynamics system. Although the entertainment system is not able to carry out such a communication within the framework of its normal operation, it could very easily do so after the attacker's capability. If the implementation of a codec for decoding, for example, DAB digital radio, is not sufficiently protected, an attacker can, for example, use a specially created, non-compliant data stream to put the codec into a situation that was not at all planned for at the time of development. If, for example, the size of the following block of audio data is predicted according to the specifications by a data field, an attacker can send 5000 bytes instead of the predicted 1000 bytes. If the codec only reserved 1000 bytes of memory for the 1000 byte advance notice, the excess 4000 bytes would potentially overwrite information in memory related to the codec's control flow. In this case, the codec would no longer perform the task it intended, but rather the task that the attacker packaged in the excess 4000 bytes. Such an attack could be applied to many vehicles simultaneously with a sufficiently powerful VHF transmitter in an exposed location.

[0028] However, if the application responsible for the entertainment system only receives access to the driver's in-car speakers and combination device, and does not receive access to the driving dynamics system, the threat of compromise in the attack scenario described in the example above can be significantly mitigated.

[0029] Particularly advantageously, the description of the authorizations in the context of the preceding application allows the subsequent application to be executed to be granted authorizations only to the maximum extent to which the preceding application also has said authorizations, thus making it difficult to circumvent the authorization restrictions by executing another existing application, possibly one that is validly signed.

[0030] Advantageously, the further or subsequent application is excluded by the description of the privileges from special access to system resources or special execution of actions that may conflict with the vehicle's driving safety and / or the granted operating permissions, i.e. in these cases the owner of the vehicle himself can, for example, prevent the use of the gap in the entertainment system of the vehicle described in the above example or the use of any other safety gap, thus "liberating" the vehicle from the restrictions prescribed for technical and legal reasons, in a manner similar to the "jailbreak" or "root" common in smartphones, and thus obtaining a higher engine power, at the expense of the public, for example by having to accept a deterioration in exhaust gas and noise characteristics.

[0031] In a further particularly advantageous configuration, at least one application causes the control device to provide one or more services which remain active even after the execution of another application has been replaced, in which case the method can be used, for example, to force a certain sequence for the start of these services, so that the vehicle with the control device always reaches a defined state after the start of the service.

[0032] In the example of the e-bike mentioned at the beginning, such a service can for example monitor the current travel speed and the pressure on the pedal. From the ratio between the travel speed on the one hand and the pedal pressure on the other hand, for example a request to activate the engine assist can then be derived, provided that the maximum permitted speed in this case is not exceeded. A forced path in the boot sequence therefore ensures that the above-mentioned country-specific limits are set before the engine assist is activated.

[0033] In another particularly advantageous embodiment, in addition to checking whether a code block is in a state corresponding to the verification information, it is also checked whether a data block required during the execution of the code block is in a state corresponding to the verification information. The program code contained in the code block is enabled for execution only if the result of the check is also positive. As mentioned at the beginning, the specific behavior of an application is often characterized by a data block, which may contain, for example, a characteristic map or weights of a neural network controller. Correspondingly, by manipulating the data block, the function of the control device can be interfered with to the same extent as by manipulating the executable program code. In this case, for example, a targeted manipulation of the data block by the user of the vehicle can be made much easier than with program code that cannot be understood by the user without special knowledge. The "reverse engineering" of an application that exists only as binary object code is an extremely demanding task as to what effect a change in the program code can have. In contrast, it is clear that in a data block with an engine characteristic map, for example, an increase in a value that is already high in any case can cause an increase in engine power.

[0034] The functional parts of the described methods can be fully or partly implemented as software. The invention therefore also relates to a computer program comprising machine-readable instructions, which when executed in one or more computers, cause said one or more computers to carry out any of the above-mentioned methods. In this sense, control devices for vehicles and embedded systems for technical devices, which can also execute machine-readable instructions, can also be considered as computers.

[0035] The invention likewise relates to a machine-readable data medium containing a computer program and / or a download product, which is a digital product that can be transmitted over a data network, i.e. downloaded by a user of the data network, such digital product being available for example by instant download in an online shop.

[0036] Furthermore, the computer may comprise a computer program, a machine-readable data medium or a downloadable product. The computer may in particular be a control device for a vehicle and / or for a drive mechanism of the vehicle.

[0037] In a particularly advantageous configuration, the control device comprises a Hardware Security Module HSM and / or a Trusted Platform Module TPM, which HSM or TPM contains a reference to a first code block of a first application, which is permanently stored in the control device, and verification information for said first code block, which is permanently stored. The aforementioned modules are a particularly secure repository for trust anchors, with which all subsequent code blocks, transition blocks and reference blocks can be verified.

[0038] Other measures for improving the present invention will be described in detail below with reference to the accompanying drawings, together with a description of preferred embodiments of the present invention. [Brief description of the drawings]

[0039] [Figure 1] FIG. 1 illustrates an embodiment of a method 100 for operating a control device 1. [Diagram 2] FIG. 1 shows an embodiment of a control device 1 on which three applications 2, 3, 4 are installed. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0040] Working Example FIG. 1 is a schematic flow chart of one embodiment of a method 100 for operating the controller 1, and FIG. 2 illustrates the contents of the controller 1 in more detail.

[0041] In step 110, based on a reference 1a permanently stored in the control device 1, a first code block 21 of the first application 2 is obtained, which contains an executable program code of the first application 2. In step 120, based on verification information 1b, also permanently stored in the control device 1, it is checked whether this first code block 21 is in a state corresponding to this verification information 1b. Optionally, it can now be checked according to block 121 whether data blocks required during the execution of the first code block 21 are also in a state corresponding to the verification information 1b. If the check on the code block 21 and possibly also on the data blocks delivers a positive result (truth value 1), in step 130 the program code contained in the first code block 21 is enabled for execution.

[0042] Here, the reference indicator 21a contained in the code block 21 may directly point to the transition block 23 which can then be obtained in step 140. Alternatively, however, the reference indicator 21a may point to a reference indicator block 22. In this case, the reference indicator block 22 is obtained in step 132 and in step 134 it is checked whether the reference indicator block 22 is in a state corresponding to the verification information 21b from the first code block 21. If so, the transition block 23 is obtained on the basis of the reference indicator 22a contained in the reference indicator block 22 according to block 141.

[0043] In step 150, it is checked whether the transition block 23 is in a state corresponding to the verification information 21b based on the verification information 21b stored in at least the first code block 21. Instead of directly using the verification information 21b, it is also possible to use the verification information 22b from the reference instruction block 22 verified by the verification information 21b of the first code block 21. If the result of the check is positive (truth value 1), in step 160, another code block 31, 41 of another application 3, 4 is obtained based on the reference instruction 23a included in the transition block 23.

[0044] It can then be checked in step 170 on the basis of the verification information 23b contained in the transition block 23 whether the further code block 31, 41 is in a state corresponding to said verification information 23b. Analogous to step 120, it can be checked according to block 171 whether said verification information 23b also allows checking of data blocks required during the execution of the code block 31, 41. If the result of the check on the code block 31, 41 and possibly also on the data blocks required in each case is positive (truth value 1), then in step 180 the program code contained in the further code block 31, 41 is enabled for execution.

[0045] The execution of the program code can be set in step 190 under boundary conditions regarding the authority for access to the system resources of the control device 1 and / or the authority for the execution of actions in or by the control device 1. The boundary conditions here can be set by corresponding descriptions in the first code block 21, in the transition block 23 and / or in the reference block 22. Here, in particular, the description of the authority in the context of the preceding application 2, for example according to block 191, ensures that authority can be granted in each case for a subsequent application 3, 4 to be executed only to the maximum extent that the preceding application 2 also has said authority.

[0046] According to block 192, another application or subsequent application 3, 4 may be excluded by the description of permissions from having special access to system resources or from performing actions that may, in particular, conflict with, for example, the driving safety of the vehicle and / or the operating permissions granted.

[0047] 2 illustrates the contents of a control device 1 operable according to the above-described method 100. The control device 1 comprises a Hardware Security Module HSM 11 and / or a Trusted Platform Module TPM 12 in which a reference designation 1a and validation information 1b are permanently stored.

[0048] Based on the reference designator 1a, a first code block 21 of the first application 2 can be obtained. The first code block 21 can then be verified based on the verification information 1b. In the embodiment shown in FIG. 2, the reference designator 21a can selectively point to the first reference designator block 22 or the second reference designator block 22' in the first code block 21. If the reference designator 21a points to the first reference designator block 22, the first reference designator block 22 can be obtained and verified by the verification information 21b in the first code block 21. On the other hand, if the reference designator 21a points to the second reference designator block 22', the second reference designator block 22' can be obtained and verified by the verification information 21b.

[0049] The first reference block 22 points to the first transition block 23 by its reference 22a, and this first transition block 23 can be confirmed by the verification information 22b of the first reference block 22 (or also by the verification information 21b of the first code block 21). The first transition block 23 points to the code block 31 of the second application 3 by its reference 23a, and further includes verification information 23b, and this verification information 23b can be used to confirm the code block 31. Like the code block 21, the code block 31 includes a reference 31a and verification information 31b.

[0050] The second reference block 22' points to a second transition block 23' by its reference 22a', and this second transition block 23' can be verified by the verification information 22b' of the second reference block 22' (or also by the verification information 21b of the first code block 21). The second transition block 23' points to a code block 41 of the third application 4 by its reference 23a' and further includes verification information 23b', which can verify the code block 41. The code block 41 includes a reference 41a and verification information 41b, similar to the code block 21.

[0051] In this way, by simply replacing the first reference block 22 with the second reference block 22', which requires a significantly smaller amount of data, it is possible to set up the third application 4 to be executed instead of the second application 3 after the first application 2.

[0052] The change from the second application 3 to the third application 4 as the next application to be executed can alternatively also be effected by a direct exchange of the first transition block 23 with the second transition block 23'.

[0053] The third application 4 does not necessarily have to be completely different from the second application 3, and may be, for example, an updated version of the second application 3.

[0054] Optionally, the reference block 22, 22' can be a reference to a data block required by the application 2. However, the reference block 22, 22' can also be a reference to a key block which contains a reference to the data block and verification information for its verification, similar to the transition block 23. This allows each data block to have its own unique signature source, which can be used to freely define who has the authority to update the data block.

Claims

1. A method (100) for operating a control device (1) executing a plurality of applications (2, 3, 4), comprising the steps of: - obtaining (110) a first code block (21) of a first application (2) containing executable program code of said first application (2) based on a reference (1a) permanently stored in said control device (1); a step (120) of checking whether the first code block (21) is in a state corresponding to verification information (1b) stored permanently in the control device (1); - enabling (130) for execution of the program code contained in said first code block (21) in response to a positive result of said check; - obtaining (140) a transition block (23) containing a reference (23a) to another code block (31, 41) of another application (3, 4) containing executable program code of said another application (3, 4) based on a reference (21a) contained in at least said first code block (21); a step (150) of checking, based on verification information (21b) stored in at least the first code block (21), whether the transition block (23) is in a state corresponding to said verification information (21b); - in response to a positive result of the check, obtaining (160) another code block (31, 41) of said another application (3, 4) based on a reference indication (23a) contained in said transition block (23); The method (100) comprising:

2. - checking (170) whether the further code block (31, 41) is in a state corresponding to the verification information (23b) contained in the transition block (23); In response to a positive result of the check, the program code contained in the further code block (31, 41) is enabled for execution (180); 2. The method of claim 1 (100).

3. A reference indication block (22) is obtained (132) based on a reference indication (21a) contained in said first code block (21), - checking (134) whether the reference indication block (22) is in a state corresponding to the verification information (21b) stored in the first code block (21); in response to a positive result of the check, the transition block (23) is obtained (141) based on the reference indications (22a) contained in the reference indication block (22); 3. The method (100) of claim 1 or 2.

4. the verification information (1b, 21b, 22b, 23b) includes at least one hash value, In response to the hash value matching the hash value formed via the code block (21, 31, 41), the transition block (23), or the reference block (22), it is confirmed (120, 134, 150, 170) that the code block (21), the transition block (23), or the reference block (22) is in a state corresponding to the verification information (1b, 21b, 22b, 23b).

4. The method (100) of claim 3.

5. said verification information (1b, 21b, 22b, 23b) comprising at least one public key of an asymmetric cryptosystem, In response to the code block (21, 31, 41), the transition block (23) or the reference block (22) being validly signed by a private key belonging to the public key, it is confirmed (120, 134, 150, 170) that the code block (21, 31, 41), the transition block (23) or the reference block (22) is in a state corresponding to the verification information (1b, 21b, 22b, 23b).

5. The method (100) of claim 3 or 4.

6. the first code block (21), the transition block (23) and / or the reference block (22) additionally contain a description of authorizations for access to system resources of the control device (1) and / or a description of authorizations for the execution of actions in or by the control device (1), access to system resources by said other application and / or execution of said action by said other application (3, 4) is restricted (190) in accordance with said privileges; The method (100) of any one of claims 3 to 5.

7. 7. The method (100) according to claim 6, in which, due to a description of rights in the context of a preceding application (2), rights are granted (191) for a subsequent application (3, 4) to be executed only up to the extent that said preceding application (2) also has said rights.

8. The method (100) according to claim 7, wherein the other application (3, 4) or the subsequent application (3, 4) is excluded (192) from special access to system resources or special execution of actions that may conflict with the driving safety of the vehicle and / or the operating permissions granted, by a description of the permissions.

9. 9. The method (100) according to any one of claims 1 to 8, wherein at least one application (2) causes the control device (1) to provide one or more services which remain active after a changeover to the execution of another application (3, 4).

10. In addition to the step (120, 170) of checking whether the code block (21, 31, 41) is in a state corresponding to the verification information, it is also checked (121, 171) whether the data blocks required during the execution of the code block (21, 31, 41) are in a state corresponding to the verification information (1b, 23b), the program code contained in said code blocks (21, 31, 41) is enabled for execution only if the result of said check is also positive, The method (100) of any one of claims 1 to 9.

11. A computer program comprising machine-readable instructions which, when executed on one or more computers, cause said one or more computers to perform the method (100) of any one of claims 1 to 10.

12. 12. A machine-readable data medium comprising a computer program according to claim 11.

13. A computer containing a computer program according to claim 11 and / or comprising a machine-readable data medium according to claim 12.

14. Control device (1) for a vehicle and / or for a drive mechanism of a vehicle as a computer according to claim 13.

15. The device comprises a Hardware Security Module (HSM) (11) and / or a Trusted Platform Module (TPM) (12), a reference (1a) to a first code block (21) of a first application (2), stored in said reference (1a) and verification information (1b) for said first code block (21), stored in said reference (1a) and A control device (1) according to claim 14.

Images