Sending a message to the holder of a digital vehicle key

Abstract

A method (200) for controlling a securely protected vehicle (105) using a digital vehicle key (110) includes the steps of: determining a message to be transmitted to a holder (120) of the digital vehicle key (110); determining a holder (120) of the digital vehicle key (110) that served as the basis when the sub-vehicle key (110) was created; and recursively transmitting a message from the holder (120) of the vehicle key (110) to another holder (120) of the vehicle key (110).

Description

Technology Field

[0001] The present invention relates to a vehicle that is securely protected using a digital vehicle key. In particular, the present invention relates to transmitting messages between holders of different digital vehicle keys for the same vehicle. Background Technology

[0002] Automobiles are securely protected using the concept of digital vehicle keys. In particular, vehicles can be securely protected using digital keys proposed by the Car Connectivity Consortium, the technical specifications of which are continuously being developed. The vehicle owner possesses a vehicle key, and based on this key, multiple additional vehicle keys can be generated at will. The generated vehicle keys may have exclusive rights regarding the use of the vehicle, and the owner can control these exclusive rights when generating the vehicle keys.

[0003] With regard to a vehicle used by multiple people, each holding a separate key, there may occasionally be a need to exchange information related to the vehicle. For example, the owner may inform all other key holders that the vehicle will be unavailable at a predetermined time, for instance, because the owner is using the vehicle or because maintenance is required.

[0004] Starting with the 4th revision of the Digital Key Technical Specification, vehicle keys can be generated that grant the user the authority to generate another vehicle key. The concept corresponding to this technology is referred to as "Sharing in a Chain." Access rights related to the vehicle can only decrease along the chain and can never increase. This allows for the creation of complex structures for digital vehicle keys associated with the vehicle. Regarding the generation of digital vehicle keys, the keys can be organized in the form of a tree, in which case the owner can form the root of the tree.

[0005] However, the owner does not have the direct ability to send messages to all vehicle key holders. Typically, the owner knows only the holder of the vehicle key that they themselves created. However, the holders of vehicle keys created in subsequent generations based on previously created keys may be hidden from the owner.

[0006] The problem underlying the present invention is to provide an improved technology for transmitting a message to the owner of a vehicle key.

[0007] The present invention solves the above problem by utilizing the subject of an independent claim. A sub-claim reproduces a preferred embodiment.

[0008] According to a first aspect of the present invention, a method for controlling a vehicle that is securely protected using a digital vehicle key comprises: determining a message to be transmitted to a holder of the digital vehicle key; determining a holder of the digital vehicle key that served as the basis when a sub-vehicle key was generated; and recursively transmitting a message from the holder of the vehicle key to another holder of the vehicle key.

[0009] This method is particularly suitable for distributing messages to holders of vehicle keys where the owner's authority is tracked in a chain or tree format. Each holder can check whether another vehicle key has been generated based on their own vehicle key, and the corresponding message can then be forwarded to another vehicle key holder. In this way, the message can also reach holders who are not directly known to the original sender of the message.

[0010] The vehicle key may exist in the form of an encrypted structure, typically stored on the device. The device may be equipped with a secure storage device for storing the vehicle key, and access to said storage device may require a procedure for a predetermined user to authenticate themselves to the device. The device may specifically include a smartphone, and the user may authenticate themselves by entering a predetermined secret key or by presenting biometric features. The holder of the vehicle key is typically the person assigned to the vehicle key or the device. Because a person can use or manage the vehicle key only by using this device, the device may also be regarded as an agent for the holder, as a part of the holder, or even as the holder themselves. The reception and transmission of messages are typically executed by the device in an automated manner.

[0011] In a preferred embodiment, the message is sent from the owner of the vehicle. In this case, it is assumed that the vehicle key on which the owner's vehicle key was generated does not exist. However, the owner's vehicle key may be generated based on a digital key from an external location controlled, for example, by the vehicle manufacturer. Once the message is sent from the owner, it can be sequentially transmitted to all digital vehicle key owners for the vehicle. Thus, all potential users of the vehicle can receive the message.

[0012] The step of generating a sub-vehicle key based on a vehicle key preferably includes the step of transmitting an invitation from the driver of the vehicle key to the holder of the sub-vehicle key. Preferably, a message is transmitted from the holder of the vehicle key to the holder of the sub-vehicle key via the same path as the invitation.

[0013] The invitation can be transmitted in different ways, for example, via SMS, email, or by placing it in a mailbox, in which case a notification regarding the mailbox is sent to the holder of the subordinate vehicle key. The communication channel can preferably be used to transmit a message to the holder of the subordinate vehicle key at a later date.

[0014] In a corresponding manner, the step of generating a sub-vehicle key based on a vehicle key may include the step of transmitting a notification from the holder of the vehicle key to the holder of the sub-vehicle key. This message may be transmitted via the same path as the notification.

[0015] The notification may include, in particular, a Personal Identification Number (PIN) or a One-Time Password (OTP). To prevent misuse, the notification is typically transmitted over a different physical channel from the invitation. The communication channel of the notification may also preferably be used for the transmission of messages.

[0016] In one embodiment, the message may also be transmitted over multiple channels. This ensures that the message also reaches its recipient in an improved state. At the recipient side, the message already received may be discarded.

[0017] The holder of a vehicle key can store the address of a subordinate vehicle key holder. Such storage can be applied not only to the address for sending invitations but also to the address for sending notifications. Subsequently, a message can be sent to the stored address.

[0018] If the holder of a vehicle key becomes aware that a sub-vehicle key has become invalid, the vehicle key holder may revoke the address of the sub-vehicle key holder. This prevents a situation where a message is sent to a holder who no longer possesses a vehicle key valid for the vehicle. A sub-vehicle key may become invalid, for example, because its validity period for use has expired. A sub-vehicle key may also be revoked or declared invalid by the holder of the upper vehicle key.

[0019] It should be noted that invalidating a vehicle key also invalidates all vehicle keys generated based on that key. Since this relationship is also recursive, as a result, many vehicle keys may be invalidated depending on the situation. A sub-vehicle key can also be returned by its holder. Return may be made, for example, to an external branch managing vehicle keys for a vehicle. In effect, in this case, the external branch may declare the sub-vehicle key invalid. In another embodiment, a sub-vehicle key may be declared invalid based on a parent vehicle key; in this case, the sub-vehicle key may be returned to the holder of the parent vehicle key.

[0020] If multiple sub-vehicle keys are generated based on a vehicle key, the message is preferably transmitted from the holder of the vehicle key to the holders of the sub-vehicle keys. Preferably, the message is transmitted to all holders of the sub-vehicle keys. Depending on the configuration, such a situation may involve multiple sub-vehicle keys.

[0021] In one improved example, a message may be generated at any one of the holders of a vehicle key for a vehicle. To ensure that as many vehicle key holders of the vehicle as possible receive the message, the message may first be transmitted to one of the holders of the parent vehicle key that served as the basis when the vehicle key was generated.

[0022] The message may also be continuously transmitted toward the upper vehicle key holder. One vehicle key holder may receive a message from one lower vehicle key holder, and this message may be transmitted or transmitted to one upper vehicle key holder who served as the basis when the vehicle key was created. Thus, the message may be transmitted step-by-step toward the vehicle key holder who served as the basis, either indirectly or directly, when a maximum number of vehicle keys are created.

[0023] In one embodiment, the message is distributed to the holder of the lower vehicle key only when the holder of a vehicle key, for which no upper vehicle key exists at all, receives a message from the lower vehicle key. This message distribution method corresponds to the message distribution method described above transmitted from the owner of the vehicle.

[0024] Generally, it is desirable for the message to be related to the technical features of the vehicle. Technical features may be related particularly to the condition or availability of the vehicle. The message may take any format depending on the communication channel used. However, it is desirable for the message to exist in text form so that, as a result, the message can be transmitted over as many communication channels as possible.

[0025] According to another aspect of the present invention, a first device for controlling a vehicle that is securely protected using a digital vehicle key comprises: a storage device for storing a vehicle key; a wireless interface; and a processing device. The processing device is designed to receive a message from the holder of a higher vehicle key that served as the basis when the stored vehicle key was generated; and to transmit a message to the holder of a lower vehicle key generated based on the stored vehicle key. The received message may be output using an output device of the device.

[0026] The storage device is preferably specially secured to prevent direct reading output of the vehicle key. Access to the storage device may require authorization or authentication. More preferably, the device includes an output device, in which case the processing device is designed to provide the received message to the user using the output device. The device may be a device specifically assigned to a person. For example, the device may include a smartphone, a smart ring, a smart band, a smart watch, a tablet computer, a laptop computer, or a wearable computer.

[0027] According to yet another aspect of the present invention, a second device for controlling a securely protected vehicle using a digital vehicle key is proposed. In this case, the second device includes a storage device for storing a vehicle key; a wireless interface; and a processing device. In this case, the processing device is designed to receive a message from the holder of a lower vehicle key generated based on the stored vehicle key; and to transmit a message to the holder of a higher vehicle key that served as the basis when the stored vehicle key was generated. The received message may be output using an output device of the device.

[0028] For embodiments of the first device, statements made in relation to the first device apply. Additionally, it is possible to integrate the two mentioned devices together, in which case a single processing device is designed to transmit or receive and / or transmit messages in both directions.

[0029] The processing device is preferably designed to partially or completely implement the method described herein. For this purpose, the processing device may be implemented electronically and may include, for example, an integrated circuit, a programmable logic module, or a programmable microcomputer. The method may be realized in the form of a configuration or as a computer program product having means of program code for the processing device. The configuration or the computer program product may be stored on a computer-readable data carrier. Features or advantages of the method may be applied to the device, or vice versa.

[0030] Furthermore, a system is proposed comprising a vehicle that is securely protected using a digital vehicle key and one or more first and / or second devices described herein. The vehicle generally preferably includes a passenger car. In another embodiment, the vehicle may also include, for example, a motorcycle, a truck, or a van. Brief explanation of the drawing

[0031] The present invention will now be described in more detail with reference to the attached drawings, in which: Figure 1 illustrates the system. Figure 2 illustrates a flowchart of the method. Specific details for implementing the invention

[0032] FIG. 1 shows a system (100) including a vehicle (105) that is safely protected using a digital vehicle key (110).

[0033] The vehicle (105) includes a control unit (115), which is preferably designed to communicate wirelessly with a device (120) in which a digital vehicle key (110) is stored. The digital vehicle key (110) preferably exists in the form of an encryption structure. The control unit (115) and the vehicle (105) may execute a predetermined encryption method to mutually authenticate each other and to check the validity of the presented digital vehicle key (110). If the check process proceeds positively, a predetermined security function of the vehicle (105) may be controlled by a user (125) of the device (120). Such security functions may include, in particular, unlocking a vehicle door or vehicle flap or starting a vehicle (105) drive motor.

[0034] A user (125) may assume different roles with respect to the vehicle (105) or the control unit (115). One role may be associated with a predetermined authority of the vehicle key (110). Exemplary roles include owner, manager, and friend. The highest authority regarding the vehicle (105) is assigned to one of the users (125) or one of the roles. Such a user (125) is also considered the owner. The owner has the authority to, for example, declare all existing vehicle keys (110) invalid and make the vehicle (105) accessible to a new owner. The concept of a digital vehicle key that forms the basis of this specification is based on the proposal of the Vehicle Connectivity Consortium (CCC). Regarding another component that may be used to generate a digital vehicle key (110), to transmit encryption data corresponding to the digital vehicle key (110), or to track the generated vehicle key (110), the relevant CCC technical specifications valid for digital keys are referenced. The technology described in this specification is based on the methodology of 'Sharing in a Chain,' and such technology is described in the technical specification of Release 4.

[0035] FIG. 2 shows a flowchart of an exemplary method (200) for transmitting a message to a holder of a digital vehicle key (110) of a vehicle (105). It should be noted that the recipient of such a message is typically associated with a human user (125), but the method steps illustrated in the drawing are performed using a device (120) assigned to the user (125). In this regard, the holder of the digital vehicle key (110) referred to herein is not distinguished between the device (120) in which the digital vehicle key (110) is stored and the person (125) who operates the device (120) or is assigned to the digital vehicle key (110).

[0036] The illustration in FIG. 2 is based on an exemplary structure of a vehicle key (110) that specifies which vehicle key (110) was created based on another vehicle key (110). In FIG. 2, the vehicle key (110) is indicated in uppercase. A vehicle key (110) created based on another vehicle key (110) has the name of the original vehicle key (110) and another additional character assigned in ascending order in the creation sequence associated with that one vehicle key (110). Another vehicle key (110) created directly based on a vehicle key (110) may also be referred to as a derived key or child key of the vehicle key (110); conversely, it may also be referred to as a parent key.

[0037] A vehicle key (A) is assigned to the owner of the vehicle (105). The vehicle key (A) is not dependent on any other vehicle key (110) and is typically signed cryptographically by an external point that manages vehicle keys (110) for multiple vehicles (105). This point may be operated or managed, for example, by the manufacturer of the vehicle (105).

[0038] Based on vehicle key (A), vehicle keys (AA and AB) are generated. AA and AB are sub-keys of A; A is the parent key of AA and AB. Based on AA, sub-vehicle keys (AAA and AAB) dependent on this key are generated. Correspondingly, vehicle key (ABA) is generated based on AB, so that consequently, ABA becomes a sub-vehicle key for AB. ABA was used to generate another sub-vehicle key (ABAA).

[0039] The dependency relationship between vehicle keys (110) is in the form of a tree, as can be seen in FIG. 2, where A forms the root of the tree and is shown at the top as is customary in informatics. By convention, one vehicle key (110) in the tree having one or more parent vehicle keys (110) can be prevented from having a "diamond sharing", so that consequently the tree can be reduced to at most one list, but not to a single network organization.

[0040] Regarding the tree city, the linear transmission of messages upward (toward the root) and subsequently downward (away from the root) is described below. It should be noted that the two parts of the city content related to any one vehicle key (110) may also be merged with each other at multiple nodes of the tree as needed. Optionally, the first part of the method may also be omitted so that only downward message distribution occurs, or the second part of the method may also be omitted so that only upward message distribution occurs.

[0041] In the exemplary illustration of FIG. 2, various constellations that serve as the basis between vehicle keys (110) are illustrated. The linear generation exists on a single chain extending, for example, from A to AB, to ABA, and to ABAA. For example, vehicle keys (AA, AB, and ABA) are subordinate to one vehicle key (110) but also superior to another vehicle key (110). For example, based on vehicle keys (A and AA), one or more direct subordinate vehicle keys (110) are formed. For example, some vehicle keys (110), such as AAA, AAB, and ABAA, have a superior vehicle key (110) but do not have a subordinate vehicle key (110). The elements of the selected structure can be flexibly used in other constellations between vehicle keys (110).

[0042] The method (200) may begin at step “205,” in which a message is determined to be transmitted, for example, from the vehicle key (ABA) side to, preferably, all vehicle key holders (120) (A to ABAA). This message may, for example, be related to a defect in the vehicle (105), and, if possible, may notify the vehicle key holders (120) (A to ABAA) that the vehicle cannot be used until the vehicle (105) is repaired.

[0043] In step "210", the message may be transmitted to the holder (120) of the upper vehicle key (AB). In step "215", the holder (120) of the vehicle key (AB) determines that he / she has another upper vehicle key (110), and in step "220", the received message is transmitted to the holder (120) of the upper vehicle key (110), that is, in this example, to the holder (120) of the vehicle key (A). Optionally, the received message may also be transmitted to the holder (120). The transmission of the message upward may be performed recursively. For example, if the holder (120) receiving the message determines that there is no upper vehicle key at all for his / her vehicle key (110), the recursive transmission may be stopped.

[0044] In step "225", the holder (120) of the vehicle key (A) determines that there is no upper vehicle key (110) at all. Now, the transmission direction of the message is reversed, so that the message is transmitted downward from the root of the tree shown in FIG. 2.

[0045] In step "230", a message may be transmitted to the holders (120) of all vehicle keys (AA, AB) generated based on the direct vehicle key (A). Such transmission is preferably performed recursively. Additionally, in the distribution downwards, the received message may optionally be output to the holders (120).

[0046] In step "235", a message is transmitted directly from the holder (120) of vehicle key (AA) to the holder (120) of vehicle key (AAA, AAB) generated based on vehicle key (AA). Correspondingly, the message is transmitted from the holder (120) of vehicle key (AB) to all holders (120) of sub-vehicle keys, where the holder of sub-vehicle key is only the holder (120) of vehicle key (ABA). In step "240", this approach is repeated, and the holder (120) of vehicle key (ABA) transmits a message to the holder (120) of sub-vehicle key (ABAA).

[0047] Using the technology introduced in this specification, it is possible to transmit messages in a cascade form from the holder (120) of the vehicle key (110) directly or indirectly to the holder (120) of the vehicle key (110) generated based on the holder (120s) of the vehicle key (110). In this case, it is advantageous to utilize the fact that the communication channel extending from the holder (120) of the vehicle key (110) to the holder (120) of the vehicle key (110) below it was already used when generating or issuing the lower vehicle key (110). This channel can be used to transmit messages.

[0048] Since the vehicle key holder (120) is aware of the communication channel traversed when receiving the vehicle key from the superior vehicle key holder (120) in the opposite direction, the transmission may also be reversed. Thus, in a chain of dependencies, a message can be transmitted first in the direction of the root or in the direction of the vehicle key (110) to which the highest priority is given, and then transmitted in the opposite direction. With this approach, not only can all holders (120) of the vehicle key of the vehicle (105) receive the message, but a message can also be transmitted from any one of the vehicle key holders (120).

[0049] It should be noted that in another embodiment, before the message is transmitted retroactively to as many holders (110) of the vehicle key (110) as possible within the waterfall described above, the message may also be transmitted to the owner of the vehicle (105) in another way. Explanation of the symbols

[0050] 100: System 105: Cars 110: Digital Car Key 115: Control unit 120: Device 125: User A, AA, AB, AAA, AAB, ABA, ABAA: Digital vehicle key 200: Method 205: Determine message 210: Send message to superior holder 215: Determines the higher vehicle key 220: Send message to superior holder 225: Decision: Higher vehicle key does not exist at all 230: Send message to the holder of the subordinate vehicle key 235: Send message to holder of subordinate vehicle key 240: Send message to the holder of the subordinate vehicle key

Claims

Claim 1 A method (200) for controlling a safely protected automobile (105) using a digital vehicle key (110), comprising: a step (205) of determining a message to be transmitted to a holder (120) of the digital vehicle key (110); a step of determining a holder (120) of the digital vehicle key (110) that served as the basis when the sub-vehicle key (110) was generated; and a step (230, 235, 240) of recursively transmitting a message from the holder (120) of the vehicle key (110) to another holder (120) of the vehicle key (110). Claim 2 In paragraph 1, the above message is transmitted from the owner (1250) of the vehicle (105), method (200). Claim 3 In claim 1, the step of generating a sub-vehicle key (110) based on the vehicle key (110) includes the step of transmitting an invitation from the holder (120) of the vehicle key (110) to the holder (120) of the sub-vehicle key (110); the message is transmitted along the same path as the invitation, method (200). Claim 4 In claim 1, the step of generating a sub-vehicle key (110) based on the vehicle key (110) includes the step of transmitting a notification from the holder (120) of the vehicle key (110) to the holder (120) of the sub-vehicle key (110); the message is transmitted along the same path as the notification, method (200). Claim 5 In paragraph 3, the holder (120) of the vehicle key (100) stores the address of the holder (120) of the lower vehicle key (110); and the message is transmitted to the stored address, method (200). Claim 6 In paragraph 5, if the lower vehicle key (110) becomes invalid, the holder (120) of the vehicle key (110) discards the address of the holder (120) of the lower vehicle key (110), method (200). Claim 7 In claim 1, a plurality of sub-vehicle keys (110) are generated based on the vehicle key (110); and a message is transmitted from the holder (120) of the vehicle key (110) to the holder (120) of the sub-vehicle key (110), method (200). Claim 8 A method (200) in which the message is generated by the holder (120) of the vehicle key (110) and transmitted to the holder (120) of the upper vehicle key (110) that served as the basis when the vehicle key (110) was generated. Claim 9 In claim 8, a method (200) in which a holder (120) of one vehicle key (110) receives a message from a holder (120) of one lower vehicle key (110), and the message is transmitted to a holder (120) of one upper vehicle key (110) that served as the basis when the vehicle key (110) was created. Claim 10 In claim 9, the above holder (120) transmits a message to one holder (120) of one lower vehicle key (110) only when the upper vehicle key (110) does not exist at all, a method (200). Claim 11 In any one of claims 1 to 10, the method (200) is related to the state or availability of the vehicle (105). Claim 12 A device (120) for controlling a vehicle (105) that is securely protected using a digital vehicle key (110), comprising: a storage device for storing the vehicle key (110); a wireless interface; and a processing device configured to receive a message from the holder (120) of the upper vehicle key (110) that served as the basis when the stored vehicle key (110) was created; and to transmit a message to the holder (120) of the lower vehicle key (110) created based on the stored vehicle key (110). Claim 13 A device (120) for controlling a vehicle (105) that is securely protected using a digital vehicle key (110), comprising: a storage device for storing the vehicle key (110); a wireless interface; and a processing device configured to receive a message from a holder (120) of a lower vehicle key (110) generated based on the stored vehicle key (110); and to transmit a message to a holder (120) of a higher vehicle key that served as the basis when the stored vehicle key (110) was generated. Claim 14 A system (100) comprising a vehicle (105) that is securely protected using a digital vehicle key (110), and one or more devices (120) according to claim 12 and / or one or more devices (120) according to claim 13.

Images