Securing the connection between a vehicle and a remote management server for managing said vehicle

Abstract

The invention relates to a vehicle (V) equipped with a communication module (MC) capable of using two telecommunication identity cards, one (VCA) relating to a subscription of the manufacturer of the vehicle (V) and the other (UCA) relating to a subscription of the user, the vehicle (V) including a trusted execution environment (TEE) hosting security functions and a multimedia system execution environment (EESM) hosting part of the communication module (MC), the trusted execution environment (TEE) comprising a monitoring module (MS) for monitoring the connection between the vehicle (V) and a remote management server (SG) for managing the vehicle (V).

Description

[Technical field]

[0001] The present invention relates generally to telecommunications and automobiles, and more particularly to securing telematics services provided to vehicles and the software of the vehicles. [Background technology]

[0002] The telematics services offered by the manufacturer on the vehicle elaborate and use sensitive data and functions. These services are generally executed, on the one hand, by an embedded logic resident in the vehicle, and, on the other hand, by an external logic resident on at least one remote server of the manufacturer or a third party. One fundamental problem in securing the telematics services and of the car's software generally revolves around the communication link between these two logics. In effect, to achieve a good level of security, the manufacturer sets up a secure communication mechanism between the embedded and external parts of the software of these telematics services. The manufacturer also sets up a management center for its vehicle stock. These management tools allow the manufacturer to detect anomalies in the vehicle and trigger preventive or corrective actions to respond to malfunctions or to potential cyber attacks, for example by updating the vehicle's software.

[0003] However, this security protection strategy proves to be ineffective when the vehicle does not have network coverage and is unable to interact with the manufacturer's remote server, or when the communication between the vehicle and the remote server is no longer considered reliable and trustworthy. One means to enhance the security of the connection between the embedded part of the telematics service software in the vehicle and its external part is to have additional protection and additional safeguard features implemented by the telecommunication operator to which the vehicle's manufacturer subscribes.

[0004] However, alongside the setup of these telematics services there is an emerging and growing need to bring the Internet to vehicle users, and there is a strong demand for car users to be able to use their own cellular telephone subscription for this Internet usage.

[0005] Currently, the Internet connection brings back a set of threats and potential breaches that can allow hackers to take control of the electronic components that use this connection. Not only that, but the use of a telecommunications operator for this Internet connection that is different from the telecommunications operator of the manufacturer of the vehicle involved, with a subscription specific to the user, prevents the benefit of the protections and corrective measures that the manufacturer's telecommunications operator can provide to secure the telematics services used by the vehicle.

[0006] Therefore, there is a need to secure communications between a vehicle and a remote management center for the vehicle while still allowing the vehicle user to connect to the Internet via the user's cellular telephone subscription.

[0007] One solution is to separate the connections and systems for the Internet on the one hand and the telematics services on the other. Since the user uses his own cellular telephone subscription, that means that the physical cellular communication system must be duplicated, either by using two cellular modems instead of just one, or by using one cellular modem that can operate with two SIM (Subscriber Identity Module) cards that are active at the same time, a feature called "active dual SIM". In both of these cases, this duplication represents a very large cost expense (tens of dollars per vehicle).

[0008] One of the objectives of the present invention is to ameliorate at least some of the shortcomings of the prior art by providing at a lower cost a vehicle, a system and a method that ensures reliable communication between the vehicle and a management center that manages the cybersecurity of the vehicle, while allowing the vehicle user to access the Internet via the user's own cellular telephone subscription. Summary of the Invention

[0009] To this end, the invention proposes a vehicle equipped with a communication module capable of using two telecommunication identifier cards, one for a subscription between the manufacturer of the vehicle and a telecommunication operator and the other for a subscription between a user of the vehicle and a telecommunication operator, the vehicle comprising a trusted execution environment hosting vehicle security functions and a multimedia system execution environment hosting at least part of the communication module, the vehicle being characterized in that the trusted execution environment comprises a supervisory module monitoring the connection between the vehicle and a remote management server of the vehicle.

[0010] According to the invention, a single modem uses either the connection using the vehicle subscription or the connection using the user subscription, but the connection between the vehicle and the remote server is monitored. Thus, as soon as the connection using the user subscription is no longer considered reliable or trustworthy, the modem can switch to the SIM card of the vehicle's manufacturer, for example, to benefit from cyber-attack prevention and correction measures, which are provided by the operator linked to the manufacturer, without the need for expensive "active dual SIM" modems.

[0011] Advantageously, the supervisory module is capable of testing the connection at regular intervals by sending and receiving respectively signed, uniquely predetermined messages to and from the remote administration server, this implementation notably providing replay protection.

[0012] In a variant of the invention, the supervision module is capable of testing the connection at regular intervals by receiving a signed and uniquely predetermined message from the remote administration server. In this variant, the supervision module therefore does not send a test message, but monitors its correct reception.

[0013] Advantageously again, said supervisory module comprises: - the communication module indicates that the vehicle's cellular connection is operational while the communication module does not acknowledge transmission of one of the messages to the remote management server or while the communication module does not transmit one of the messages transmitted by the remote management server; or the communications module indicates that the vehicle's cellular connection is unavailable for a time period greater than a first predetermined time interval. Sometimes it is possible to detect a connection anomaly.

[0014] This implementation makes it possible to easily detect anomalies in the communication module that are suspected to not be caused by a short and limited loss of radio coverage. In this application, a "cellular connection" of a vehicle is understood to mean the ability to receive or send messages wirelessly, in particular with adequate cellular telephone network coverage.

[0015] Advantageously again, the message sent by the supervisory module includes information representative of the detection of a connection anomaly between the vehicle and the remote management server, or of the absence of such detection, which allows the remote management server to intervene, when possible, to rule out or confirm an anomaly and to implement corrective action, such as a remote vehicle software update.

[0016] According to another advantageous feature, the vehicle according to the invention comprises: - first means for transmitting an instruction to a communication module, the instruction triggering the disablement of external communications for unsecured applications of the vehicle; - second means for transmitting to the communication module an instruction triggering the selection by the communication module of a telecommunication identifier card for the vehicle's manufacturer subscription as the sole connection means and the disabling by the communication module of communications other than communications with the remote management server; - third means for transmitting to a communication module an instruction to trigger a restart of said communication module and an instruction to induce a restart of said multimedia system execution environment while imposing a secure configuration on said restart; - fourth means for transmitting an instruction to trigger a restart of the at least part of the other execution environment or other software of the vehicle while imposing a secured configuration on the at least part of the other execution environment or other software of the vehicle; at least one of the transmitting means selected from the list including The vehicle further includes an activation means configured to activate all or a portion of the selected transmission means when a connection anomaly between the vehicle and the remote management server is detected.

[0017] By incorporating one or more of these four transmission means, a vehicle according to the invention benefits from a remediation solution that is independent of a remote management server.

[0018] Advantageously, the vehicle according to the invention comprises at least said first transmission means, and said activation means are configured to activate said first transmission means only when said communication module indicates that the vehicle's cellular connection is unavailable for a time period greater than said first predetermined time interval, in this way avoiding excessive degradation of the user experience in case of false anomaly detection due to loss of radio coverage.

[0019] Advantageously again, the vehicle according to the invention comprises at least the second transmission means, the activation means being configured to activate the second transmission means, except for a transmission means selected from the third transmission means or the fourth transmission means, when the communication module indicates that the cellular connection is unavailable for a time period greater than a second predetermined time interval, which is greater than the first predetermined time interval. In this way, even if the vehicle according to the invention incorporates a third transmission means and / or a fourth transmission means, the latter is not initially implemented, unless the vehicle is specifically stopped. The remote management server SG thus has time to intervene to avoid the implementation of the third and fourth transmission means in the case of a false positive. Thus, there is little degradation of the user experience, while securing the vehicle when the probability of a suspected anomaly becomes large.

[0020] Advantageously again, the vehicle according to the invention comprises at least the third or fourth transmission means, and the activation means are configured to activate the third or fourth transmission means only when the vehicle is stopped, thereby making it possible to compromise the user experience in order to secure the vehicle only at the most appropriate moments, in particular outside the vehicle travel phase.

[0021] The present invention also provides a system comprising the vehicle according to the present invention and the remote management server, the remote management server comprising: - means for receiving a message sent by said supervisory module and including information representative of the detection of a connection anomaly between said vehicle and said remote management server; - means for detecting that the anomaly detection is not due to a cyber attack by correlation between the vehicle's location and wireless coverage data; - means for transmitting a message indicating that the anomaly is not due to a cyber-attack on the vehicle and reporting the anomaly detection in response to the message from the supervisory module; The present invention relates to a system comprising:

[0022] In this way, the remote management server prevents the vehicle from taking corrective actions that would detract from the user experience upon false detection due to momentary or prolonged loss of wireless coverage.

[0023] Advantageously, said remote management server comprises: - means for detecting a cyber attack as soon as an anomaly is reported by a number of vehicles greater than a predefined threshold; - means for transmitting to the vehicle a message activating a procedure for a secure restart of the communication module and the multimedia execution environment and / or for updating the multimedia execution environment as soon as a cyber attack is detected by the detection means; This additional feature makes it possible to protect the vehicle against predefined future cyber attacks.

[0024] The invention finally relates to a method for securing a connection between a vehicle according to the invention and said remote management server of said vehicle, comprising: - sending a uniquely predetermined signed message to and / or receiving a uniquely predetermined message from said remote administration server, - detecting an anomaly in said connection; - sending to the communication module an instruction capable of switching the communication between the vehicle and the remote management server to a connection using a telecommunication identifier card related to a subscription of the configuration of the vehicle; The present invention relates to a method comprising the steps of:

[0025] The system and method according to the present invention provide advantages similar to those of the vehicle according to the present invention.

[0026] Other features and advantages will become apparent upon reading the description of the preferred embodiments and upon reference to the drawings. [Brief description of the drawings]

[0027] [Figure 1] 1 is a diagram illustrating a vehicle and system according to the present invention in this preferred embodiment of the invention; [Diagram 2] FIG. 2 represents the corrective measures of the vehicle according to the invention in this preferred embodiment of the invention. [Diagram 3] 2 is a diagram representing the steps of the method according to the invention in this preferred embodiment of the invention; [Figure 4] FIG. 2 illustrates a state diagram of the corrective logic implemented in a vehicle according to the present invention in this preferred embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0028] According to a preferred embodiment of the invention represented in Fig. 1, a vehicle V according to the invention comprises different execution environments hosting different software. In particular, the security software of the vehicle V, such as engine control software or driving assistance software, is hosted on a secured computer, which is accessible only through a secured gateway incorporating a trusted execution environment TEE, for example. In this exemplary embodiment of the invention, the trusted environment TEE hosts the security functions SF of the vehicle V, a module MR hosting corrective functions triggered in case of detection of a cyber attack, and a module MS for supervising the connection between the vehicle V and a remote management server SG of the vehicle V. The trusted environment TEE is hosted in a secured gateway, which creates a link between a secured software zone of the vehicle, which gives access to the secured computer of the vehicle, and a software zone containing the multimedia communication functions communicating with the outside of the vehicle.

[0029] The vehicle V also includes at least one non-secure execution environment, here the execution environment EESM of a multimedia system that hosts the so-called "infotainment" information and entertainment part of the vehicle V. The execution environment EESM thus hosts applications AC that are intended for use by a user of the vehicle and are exposed to data streams from or to the Internet, such as geolocation services, an embedded browser, etc. The execution environment EESM also hosts non-secure functions BF of the vehicle, such as audio output configuration functions or a graphical interface of the vehicle V.

[0030] Finally, the execution environment EESM hosts a communication module MC. The communication module MC incorporates a cellular radio modem capable of converting Ethernet network signals into GSM ("Global System for Mobile Communications"), 3G, 4G, 5G (G stands for mobile telephony technology generation) or Wi-Fi (according to the IEEE 802.11 standard) radio signals and vice versa. In a variant embodiment, the communication module MC converts other types of wired protocols into other types of wireless protocols, in particular depending on the country of use of the vehicle and the electrical / electronic architecture of that country. For example, in one variant, a modem is used to convert CAN (Controller Area Network) signals into CDMA2000 signals.

[0031] The communication module MC is incorporated in the execution environment EESM, in particular to allow unsecured applications to communicate externally, although some of the functions of the communication module MC are secured. These secured functions are implemented by secured electronic circuits or in a secured computer, such as a microcontroller. The execution environment EESM therefore incorporates not only unsecured software, but also secured software and / or hardware circuits. These functions, as will be explained later, in particular enable the trusted execution environment TEE to switch the communication module MC to a telecommunications identifier card specific to the manufacturer of the vehicle V. In a variant, it is of course also possible to consider that the secured part of the communication module MC forms part of the trusted execution environment TEE.

[0032] The modem of the communication module MC has a “dual SIM” function that allows the communication module MC to use two SIM cards, which in this embodiment are - a telecommunications identifier SIM card, called UCA, relating to a subscription between the user of the vehicle V and a telecommunications operator, - a telecommunications identifier SIM card, called VCA, relating to a subscription between the manufacturer of the vehicle V and a telecommunications operator that may be different from the telecommunications operator that supplied the UCA card It is.

[0033] The UCA card used by the communication module MC is for example a virtual SIM, i.e. a virtual SIM for which the user does not have to place his SIM card in a specific slot of the modem of the vehicle V, but only has to enter data in the vehicle that authenticates his personal SIM card in order for the vehicle to generate this virtual SIM card. In a variant, the communication module MC has a physical slot that allows the user to insert his personal SIM card into it.

[0034] In this embodiment of the invention, the modem of the communication module MC does not have the capability to use both the UCA card and the VCA card, but simply to use one or the other of these cards at a time, by switching from one card to the other depending on the context to set up a communication with the outside world. The modem of the communication module MC therefore does not have the so-called "active dual SIM" capability. For example, when a user of the vehicle V uses the execution environment EESM to connect to the Internet, the communication module uses the UCA card to set up a communication session LSU with the Internet network INT. This communication session is set up with a standard level of security specific to the individual cellular telephone subscription and may also be used to communicate with the remote management server SG. When the vehicle V is stopped without a user inside, with the engine switched off and the doors closed, and communicates with the remote management server SG for maintenance reasons, the other communication module MC uses the VCA card to set up a communication session LSV with the remote management server SG. This communication session LSV benefits from a security level that is possibly higher than that of the communication session LSU, for example using a secured APN ("Access Point Name").

[0035] The communication module MC is also capable of reporting the status of the cellular connection to the execution environment TEE: in particular, the communication module MC indicates whether the wireless network coverage is too weak or absent to set up a communication session outside.

[0036] The remote management server SG comprises logic VAL for the general management of the manufacturer's vehicles and a supervisory module SMM for monitoring the communication link between the vehicles V and the remote management server SG.

[0037] The main risk when using UCA cards is that of attacks coming from the Internet that allow a hacker to take control of the vehicle's computer and the unsecured execution environment, which may allow him to cut off the communication between the remote administration server SG and the trusted execution environment TEE, thus preventing the trusted execution environment TEE from receiving commands to trigger corrective actions and return to normal. To remedy this problem, the supervision module MS monitors the connection between the vehicle V and the remote administration server SG, in particular by testing this connection at regular intervals, when the vehicle V is in use. The supervision module is thus able to detect an abnormal interruption of the communication between the vehicle V and the remote administration server SG. When such a connection abnormality is detected, the supervision module MS activates the security functions SF implemented in the modules M1 to M4, as represented in FIG. 2. It is therefore to be understood that in the present application, the supervision module MS establishes supervision of the connection between the vehicle and the remote administration server SG separately from the standardized supervision mechanisms implemented by the communication module MC, in particular separately from the message encryption mechanisms mandated by the GSM, 3G, 4G, 5G or Wi-Fi communication standards used by the communication module MC. Indeed, this supervision module is capable of detecting abnormal interruptions of the communication between the vehicle V and the remote administration server SG, i.e. abnormal interruptions due to a violation of the software integrity of the communication module MC.

[0038] More specifically, the supervisory module MS comprises an activation module MA which receives as input the fault code, the state of the cellular connection and the state of the vehicle V. Based on these input parameters, the activation module MA activates one or more of the modules M1 to M4.

[0039] Module M1 is a software means for sending to the secured microcontroller of the communication module MC a command to trigger the disabling of external communications for unsecured applications of the vehicle, i.e. a command to cut off any communication going out from the execution environment EESM to the Internet.

[0040] Module M2 is a software means for sending instructions to the secured microcontroller of the communication module MC that trigger the selection by the communication module MC of the VCA card for communicating externally and the disabling by the communication module MC of any communication other than communication with the remote management server SG.

[0041] The module M3 is a software means for sending to the secured microcontroller of the communication module MC an instruction to trigger a restart of the communication module MC and for sending to the secured part MB1 of the execution environment EESM an instruction to restart the execution environment EESM. In one variant, only one instruction is necessary, especially when the microcontroller is linked to the secured part MB1. These secured restarts trigger the erasure of the random access memory of these systems and force the selection of the VCA card to communicate with the remote management server SG without a connection to the Internet.

[0042] Module M4 is a software means for sending an instruction to trigger a secure restart of all or part of the other execution environments or other software MB2 to MBn of the vehicle V. This secure restart triggers the erasure of the random access memories of these other environments and software, if necessary, blocking the use of some software parts that are more sensitive to attacks than others.

[0043] An example of the use of one of these means by the supervision module MS is represented in the form of a method for securing a connection between a vehicle V and a remote management server SG according to the invention in figure 3. In this example, the communication module MC first uses the UCA card to communicate externally.

[0044] Step E1 is the transmission of a signed and uniquely predetermined message to the remote administration server SG, and the reception by the supervision module MS from the vehicle V, respectively. For that purpose, the supervision module MS periodically transmits to the remote administration server SG a message that enables the remote administration server SG to authenticate the supervision module MS. This message is signed, for example, by using an asymmetric encryption algorithm, such as RSA (Rivest, Shamir and Adleman) encryption. In a variant, the supervision module MS uses a signature obtained by a hashing algorithm of the HMAC ("keyed-hash message authentication code") type, using an encryption key known only to the manufacturer (and securely contained in the vehicle V and in the remote administration server SG). Of course, other symmetric or asymmetric encryption algorithms can be used for the signature of the messages sent by the supervision module MS. These messages also contain anti-replay data, such as a timestamp, a count or a predetermined number, generated by an algorithm known only to the vehicle V and the remote administration server SG. The messages sent by the supervision module MS also contain an abnormality code, the value and meaning of which can be determined, for example, by the following algorithm: - 0: No abnormality detected by supervisory module MS 1: interruption in the connection, accompanied by an indication by the communication module MC of a lack of network coverage for a time period greater than a first predefined time threshold T1 2: an interruption in the connection, accompanied by an indication by the communication module MC of a lack of network coverage for a time period greater than a first predefined time threshold T1 and greater than a second predefined time threshold T2 - 3: Unexplained interruptions in connection It is.

[0045] The first predetermined time threshold T1 is set, for example, to 30 minutes, and the second predetermined time threshold T2 is set, for example, to 60 minutes.

[0046] It should be noted that in this embodiment of the invention, for simplicity, the anomaly codes are specifically directed to interruptions in connectivity due to true or false network coverage outages. In practice, the anomaly codes may be more nuanced. For example, in one variant, the anomaly codes may be directed to the following situations: - the situation where the supervisory module MS has sent a test message and received an immediate protocol reply, but has not received a response from the remote management server SG, - the situation where the supervision module MS has sent a test message but has not received an immediate protocol reply, although the communication module MC indicates that a connection with the remote management server SG has been set up, - the situation where the cellular connection is working in data transfer mode, but the supervision module MS is not able to send a test message and the communication module MC indicates that there is no longer a connection set up with the remote management server SG, - a situation in which the communication module MC indicates that network coverage is available but that there is no longer a cellular connection available in data transfer mode, - a situation in which the communications module MC indicates that there is no longer network coverage Different codes apply to:

[0047] In this variant, a time counter is applied to activate modules M1 and M2, respectively, for example corresponding to times T1 and T2, and more broadly when the communication module MC indicates that there is no longer a connection set up with the remote server SG.

[0048] The messages sent by the remote administration server SG in response to messages it receives from the supervision module MS are signed in a similar manner as the messages sent by the supervision module MS and contain anti-replay data. Furthermore, the response messages from the remote administration server SG may contain information confirming or excluding the existence of a lack of network coverage previously reported by the supervision module MS, or may contain instructions to trigger corrective actions regarding the vehicle V, such as a software update or a secure restart instruction as soon as the vehicle V is stopped.

[0049] Step E2 of the method is the detection of the connection anomaly by the supervisory module MS. when the supervision module MS does not receive a response to one of its sent messages, although the communication module MC indicates that network coverage is available, or when the communication module MC indicates that it was not possible to send one of the messages from the supervision module MS to the remote management server SG, detect such an anomaly, possibly after several retransmission tests or upon expiry of a time counter set to a predefined response time, e.g. set to 15 minutes, which corresponds to anomaly code 3 defined above; when the communication module MC indicates that network coverage is unavailable for a time greater than a predetermined time threshold T1 or T2, this detection corresponds to an anomaly code 1 or 2 as defined above depending on the corresponding threshold.

[0050] Step E3 is the activation of corrective measures by the supervision module MS, which make it possible to re-establish reliable communication between the vehicle V and the remote management server SG even if the execution environment EESM is compromised by an attack. These measures are chosen to best preserve the user experience, in particular when the detected anomaly does not correspond to a cyber attack, but to a genuine loss of network coverage. To that end, the impact on the possibility of connection of the user and the vehicle V increases gradually depending on the state of the vehicle V and the real risk of a cyber attack. For example, when the communication module MC indicates a lack of network coverage, the supervision module MS attempts to resend the message more times than when the communication module MC indicates available network coverage. Similarly, the predefined time thresholds T1 or T2 are set, for example, based on geolocation data. Thus, if the vehicle detects the entry into a white zone, these thresholds are adapted, for example, to the estimated driving time in this zone. Depending on the detected anomaly code, the corrective actions also have more or less impact. In this use example of the invention, it is assumed that the vehicle V is in use and that the reported anomaly code is 3. In this case, step E3 consists in the activation of the module M2, which triggers the switching of the communication between the vehicle V and the remote management server SG to a connection using the VCA card. In other words, the module M2 sends a command to the communication module MC to temporarily disconnect the communication between the vehicle V and the remote management server SG and to re-establish the connection between these two entities by using the subscription of the manufacturer of the vehicle V.

[0051] When communication is re-established between the vehicle V and the remote management server SG, the supervisory module MS sends an error code 3 in a message to the remote management server SG. The supervisory module SMM of the remote management server SG then sends, in a corresponding response message or separately, a command enabling the security functions SF of the vehicle to carry out a corrective action, for example a software update carried out preferentially with the engine switched off or a secure restart of the environment EESM as soon as the vehicle is stopped. In case of non-response from the remote management server SG, the vehicle V itself carries out this corrective action.

[0052] It is noted that when the abnormality code reported by the supervision module after the communication between the vehicle V and the remote management server SG is 1 or 2, the remote management server SG can check whether the vehicle V is in a zone where the network coverage is substantially insufficient or non-existent. If the vehicle V is in a zone, the supervision module SMM of the remote management server SG notifies the vehicle V that it was in such a zone as soon as communication with the vehicle V is reestablished, thereby making it possible to avoid a meaningless secure restart of the execution environment EESM the next time the vehicle V is stopped. On the other hand, when the vehicle V is not in a zone, the supervision module SMM of the remote management server SG notifies the vehicle V as soon as communication with the vehicle V is reestablished and sends a secure restart command, or a command to update the execution environment EESM, to the vehicle V as soon as the vehicle is stopped, preferentially with the engine switched off. It is noted that preferentially, the secure restart of the communication module MC and the environment EESM is delayed for several tens of seconds after the vehicle is stopped, so as not to interrupt the mission end processing operations. Additionally, when the vehicle is stopped, the sending and receiving of test messages is stopped to conserve the vehicle's battery.

[0053] Furthermore, since the remote management server SG manages the entire stock of vehicles, it is possible to detect a cyber attack by correlation of anomalies reported by the vehicles of this stock. In particular, if this stock of vehicles reports a number of anomalies higher than a predefined threshold, for example 1000, over a short period of time and over a geographical zone with acceptable network coverage, the supervisory module SMM detects the cyber attack and programs a software update on its vehicles with a secure restart.

[0054] With reference to FIG. 4, an example of logic implemented in the supervision module MS that allows minimizing the impact of the security protection method according to the invention on the user experience includes states S0 to S5.

[0055] In state S0, the vehicle V is stopped with the engine turned off and the ignition off, i.e. the ignition switch is not set. In this state, the vehicle V communicates only with the remote management server SG using the VCA card, no internet communication is established. When the user switches the vehicle V on using the ignition switch, the logic switches to state S1.

[0056] In state S1, the user can enter the data of his personal SIM card into the vehicle and access the Internet through the execution environment EESM via the UCA card. If these data have already been entered into the vehicle V during a previous use of the vehicle V, the communication module MC switches to the UCA card as soon as the vehicle is switched on. The supervision module MS then supervises the connection between the vehicle V and the remote management server SG. In this state S1, when the user switches the vehicle off, the logic returns to state S0.

[0057] If, in state S1, the supervision module MS receives from the remote management server SG a command to perform a secure restart of the communication module MC and the execution environment EESM with possible updates of these entities, the logic switches to state S2 for a secure restart (with possible updates) of these entities. After this secure restart in state S2, the logic switches to a secure communication state S4, which will be described later.

[0058] If in state S1 the supervision module MS detects a code 1 or 3 anomaly, it activates module M1 and the logic switches to state S3, in which the communication module MC continues to use the UCA card but prohibits any internet communication other than the internet communication with the remote management server SG.

[0059] In this state S3, if the supervisory module MS detects a code 2 or 3 anomaly, i.e. if the communication module MC indicates that there has been no network coverage for one hour and that the communication module MC has no longer sent or received messages for 15 minutes without an indication of loss of network coverage, the logic switches to the secured communication state S4.

[0060] If, in state S3, the vehicle V is switched off by the user without the remote management server SG being able to eliminate the code 1 or 3 anomaly that triggered the switch to state S3 and to inform the vehicle V about it, the logic switches to state S5 of secure restart of the communication module MC, forcing the communication module to use only the VCA card. After this restart, the logic switches to state S4 of secure communication.

[0061] If, in state S3, the remote management server SG eliminates the code 1 or 3 fault that triggered the switch to state S3, the logic switches to state S1.

[0062] In the secure communication state S4, the communication module MC is allowed to use only the VCA card to communicate with the remote management server SG, whether the vehicle V is switched on or off. If in this state S4 the vehicle V is switched on and the user switches his vehicle off without the remote management server SG being able to eliminate the code 1, 2 or 3 fault that led to the switch to state S4 and to inform the vehicle V about it, the logic returns to state S4. Conversely, if in this state S4 the remote management server SG eliminates the code 1, 2 or 3 fault that led to the switch to state S4 and informs the vehicle V about it, the logic returns to state S0 if the vehicle is switched off or to state S1 if the vehicle is switched on.

[0063] Obviously, this logic is only an exemplary embodiment of the invention. Other logics can be implemented in other variants of the vehicle, system or method according to the invention. For example, in a variant in which the vehicle implements only modules M2 and M3, state S3 and state S4 are merged. Furthermore, in another variant of the invention, the remote administration server SG is held by a third party. In this variant, the exchange of the secret key for the signing of the messages exchanged between the supervision module MS and the remote administration server SG is performed by a first encrypted exchange, for example using the RSA asymmetric encryption algorithm. Many other variants are of course possible. In particular, in another variant of the invention, the supervision module MS supervises the correct operation of the connection between the communication module MC and the remote administration server SG by monitoring the correct reception of the signed and uniquely predetermined messages sent by the remote administration server SG, but the supervision module MS does not itself send test messages to the remote administration server SG. This variant, however, only covers the supervision of the connection in one direction. In another variant, the supervision module sends test messages to the remote supervision server SG, these test messages containing no abnormality code or only one abnormality code when an abnormality is detected. Finally, in another variant, the management server SG sends a message alerting the vehicle V just before it enters the white zone to deactivate the time counters linked to the thresholds T1 and T2 until it leaves the white zone.

Claims

1. A vehicle (V) equipped with a communication module (MC) capable of using two telecommunication identification cards, one (VCA) for a subscription between the manufacturer of the vehicle (V) and a telecommunication operator and the other (UCA) for a subscription between a user of the vehicle (V) and a telecommunication operator, the vehicle (V) comprising a trusted execution environment (TEE) hosting security functions of the vehicle (V) and a multimedia system execution environment (EESM) hosting at least a part of the communication module (MC), The vehicle (V) is characterized in that the trusted execution environment (TEE) comprises a supervisory module (MS) that monitors a connection between the vehicle (V) and a remote management server (SG) of the vehicle (V).

2. 2. The vehicle (V) according to claim 1, characterized in that the supervisory module (MS) is capable of testing the connection at regular intervals by sending and receiving respectively signed and uniquely predetermined messages to and from the remote management server (SG).

3. 2. A vehicle (V) according to claim 1, characterized in that said supervisory module (MS) is capable of testing said connection at regular intervals by receiving a signed, uniquely predetermined message from said remote management server (SG).

4. The supervisory module (MS) the communication module (MC) indicates that the cellular connection of the vehicle is operational while the communication module (MC) does not confirm the transmission of one of the messages to the remote management server (SG) or does not transmit one of the messages sent by the remote management server (SG), or the communication module (MC) indicates that the vehicle's cellular connection is unavailable for a time period greater than a first predetermined time interval.

4. A vehicle (V) according to claim 2 or 3, characterized in that it is possible to detect a connection anomaly when the vehicle (V) is in a state where the connection anomaly is detected.

5. 5. A vehicle (V) according to claim 2 or 4, characterized in that the message sent by the supervisory module (MS) contains information representative of the detection of a connection anomaly between the vehicle (V) and the remote management server (SG) or representative of the absence of such detection.

6. The vehicle (V), first transmission means (M1) for transmitting to said communication module (MC) a command triggering the deactivation of external communications for unsecured applications of said vehicle (V); second transmission means (M2) for transmitting to the communication module (MC) a command triggering the selection by the communication module (MC) of the telecommunication identifier card (VCA) for the subscription of the manufacturer of the vehicle (V) as a single connection means and the deactivation by the communication module (MC) of communications other than those with the remote management server (SG); third sending means (M3) for sending to said communication module (MC) a command to trigger a restart of said communication module (MC) and a command to induce a restart of said multimedia system execution environment (EESM) while imposing a secure configuration of the restart; fourth transmission means (M4) for transmitting a command triggering a restart of said at least part of the other execution environment or said other software of said vehicle (V) while imposing a secured configuration on said at least part of said other execution environment or other software of said vehicle (V); at least one of the transmitting means selected from the list including: the vehicle (V) further comprises an activation means (MA) configured to activate all or part of the selected transmission means (M1, M2, M3, M4) when a connection abnormality between the vehicle (V) and the remote management server (SG) is detected; 6. A vehicle (V) according to any one of claims 1 to 5, characterized in that

7. 7. The vehicle (V) according to claim 6, characterized in that the vehicle (V) includes at least the first transmitting means (M1), and the activating means (MA) is configured to activate only the first transmitting means (M1) when the communication module (MC) indicates that a cellular connection of the vehicle (V) is unavailable for a time period greater than a first predetermined time interval.

8. 8. The vehicle (V) according to claim 6 or 7, characterized in that the vehicle (V) comprises at least the second transmitting means (M2), and the activating means (MA) is configured to activate the second transmitting means (M2), except for the transmitting means selected from among the third transmitting means (M3) or the fourth transmitting means (M4), when the communication module (MC) indicates that a cellular connection of the vehicle (V) is unavailable for a time period greater than a second predetermined time interval that is greater than the first predetermined time interval.

9. 9. The vehicle (V) according to any one of claims 6 to 8, characterized in that the vehicle (V) comprises at least the third transmitting means (M3) or the fourth transmitting means (M4), and the activation means (MA) is configured to activate the third transmitting means (M3) or the fourth transmitting means (M4) only when the vehicle (V) is stopped.

10. A system comprising a vehicle (V) according to any one of claims 1 to 9 and the remote management server (SG), wherein the remote management server (SG) receiving means (SMM) for receiving a message sent by said supervisor module (MS) and containing information representative of the detection of a connection anomaly between said vehicle (V) and said remote management server (SG); detection means (SMM) for detecting that the detection of said anomaly is not the result of a cyber attack by correlation between the position of said vehicle (V) and radio coverage data; sending means (SMM) for sending a message in response to said message from said supervisory module (MS) indicating that said anomaly is not due to a cyber-attack on said vehicle (V) and for reporting the detection of said anomaly; A system comprising:

11. The remote management server (SG) detection means (SMM) for detecting a cyber attack as soon as an anomaly is reported by a number of vehicles greater than a predefined threshold; means for sending a message to the vehicle activating a procedure for a secure restart of the communication module (MC) and the multimedia execution environment (EESM) and / or for updating the multimedia execution environment (EESM) as soon as a cyber-attack is detected by the detection means (SMM); The system of claim 10 further comprising:

12. A method for securing a connection between a vehicle (V) according to any one of claims 1 to 6 and the remote management server (SG) of said vehicle, comprising: a step (E1) of sending and / or receiving, respectively, a signed and uniquely predetermined message to said remote management server (SG) and / or from said remote management server (SG), a step (E2) of detecting an anomaly on said connection, - sending (E3) to said communication module (MC) a command capable of switching the communication between said vehicle (V) and said remote management server (SG) to a connection using said telecommunications identification card (VCA) related to said subscription of said manufacturer of said vehicle (V); A method comprising:

Images