Information technology system for executing a computer-implemented method for authorisation management

Abstract

The invention relates to an information technology system (7) comprising a computing unit (1) designed to execute a computer-implemented method for authorisation management. In the computer-implemented method, a computing unit (1) receives an authorisation token (2) of a token-based authorisation protocol, the authorisation token (2) comprising authorisation information for using a service. The computing unit (1) extracts the authorisation information from the authorisation token (2) and generates therefrom an authorisation certificate (3) of a certificate-based authentication protocol; or the computing unit (1) receives an authorisation certificate (3) of a certificate-based authentication protocol. The authorisation certificate (3) comprises authorisation information for using a service, the computing unit (1) extracting the authorisation information from the authorisation certificate (3) and generating therefrom an authorisation token (2) of a token-based authorisation protocol, the computing unit (1) being integrated into a vehicle (8).

Description

[0001] Information technology system for executing a computer-implemented

[0002] Authorization management procedure

[0003] The invention relates to an information technology system suitable for carrying out a computer-implemented method for authorization management according to the type defined in more detail in the preamble of claim 1.

[0004] With increasing digitalization, more and more computing units are being installed in vehicles to perform a wide variety of tasks. These computing units can communicate with each other and with other electronic components, such as sensors. A fieldbus, such as a CAN bus or an Ethernet data line, is typically used as the communication line in a vehicle. Unified Diagnostic Services (UDS) is typically used as the communication protocol for diagnosing ECUs. UDS is specified by ISO 14229. A computing unit, also referred to as a client or tester in this context, can be connected to the vehicle's bus system via a diagnostic interface. This makes it possible to read the ECU's error memory or to upload new firmware to the ECU.However, this process requires physical access to the vehicle to connect the tester to the diagnostic interface. Remote maintenance is therefore not possible, and it also places a significant burden on the person performing the diagnosis.

[0005] Information technology systems are generally vulnerable to cyberattacks and should be secured accordingly. This is particularly important for vehicle-integrated systems, as manipulation of vehicle-integrated computing systems can compromise the vehicle's safe operation and result in the theft of sensitive data, such as personal data. This includes, in particular, data that allows the vehicle's movement profile to be reconstructed. A wide variety of cryptographic security measures are known to secure communication between computing systems. Asymmetric encryption methods, which allow the transmission of digitally signed and encrypted messages, are particularly mentioned in this context. Digital certificates are used to confirm the authenticity of a public key as well as its permissible areas of application and validity.The digital certificate itself is protected by a digital signature. The certificate signature can be verified using the public key of the certificate issuer. The information technology infrastructure used to generate and manage digital certificates is also known as a public key infrastructure (PKI). Relevant components of a PKI include the certification authority (CA), which provides the certificate and signs certificate applications; the registration authority (RA), where entities such as people or machines can request certificates; and the validation service (VA), which enables real-time certificate verification. A common standard for creating digital certificates is X.509. X.509 certificates are used, for example, in TLS-encrypted data transmission, such as when accessing websites via an https connection.Bidirectional certificate-based authentication is possible in the vehicle context using the UDS service $29 "Authentication." X.509 certificates can also be used for this.

[0006] To increase cybersecurity, protocols are also known to enable standardized and secure API authorization for computer-based applications. OAuth 1.0 and OAuth 2.0 are mentioned in this context. With the help of OAuth, in particular OAuth 2.0 with the inclusion of OpenID Connect, end users are able to grant applications, also referred to as "clients," access to a service or data provided by another entity, usually referred to as a "resource server." The end user does not have to share user credentials, such as a user name and a personal password. This prevents the application that wishes to access the end user's data from using the service or data provided by the other entity without restrictions. The application can therefore only use the service or access the data within the scope of the authorization granted by the end user.The permissions granted by the end user are stored and transmitted in the form of a token. The scope of the permissions stored in such a token is also referred to as the "scope." This relationship defines which permissions authorize the token owner to access which end user data. This relationship is also referred to as "mapping." An application, for example a first service for printing photos, can present a corresponding authorization token to a second service or the resource server, for example a cloud service for storing photos, which then grants the application access to a specific photo album of the end user. This means that the end user does not have to share their login data for the cloud service with the application in order to, for example, print vacation photos stored in the photo album. This prevents the application from misusing the second service.

[0007] The OAuth framework is disclosed in patent form by WO 2013 / 049461 A2.

[0008] Furthermore, DE 102007 033615 A1 discloses a method and a device for converting authentication tokens to enable interactions between applications. Authorization information for using a service contained in a token of a token-based authorization protocol can be extracted and an authorization certificate of a certificate-based authentication protocol can be generated from it, and vice versa.

[0009] A similar device and method are also known from US 2020 / 0076794 A1. OAuth can be used as the token-based authorization protocol. The certificate can be an X.509 certificate.

[0010] For a vehicle manufacturer, it would be desirable to be able to perform vehicle diagnostics remotely. This would eliminate the need for a vehicle to first visit a workshop. However, this raises the question of how cybersecurity can be seamlessly maintained in the communication between a user, such as a vehicle developer or service employee, and the vehicle's control units.

[0011] The present invention is based on the object of providing means that enable such seamless maintenance of secure communication.

[0012] According to the invention, this object is achieved by an information technology system having the features of claim 1. Advantageous embodiments and further developments emerge from the dependent claims. A computer-implemented method for authorization management provides that

[0013] - a computing unit receives a validation token of a token-based authorization protocol, wherein the authorization token comprises authorization information for using a service, and wherein the computing unit extracts the authorization information from the authorization token and generates an authorization certificate of a certificate-based authentication protocol therefrom; or

[0014] - the computing unit receives an authorization certificate of a certificate-based authentication protocol, wherein the authorization certificate comprises authorization information for using a service, and wherein the computing unit extracts the authorization information from the authorization certificate and generates an authorization token of a token-based authorization protocol therefrom.

[0015] According to the invention, a computing unit configured to carry out the method is integrated into a vehicle.

[0016] The computer-implemented method for authorization management thus enables seamless translation between token-based authorization protocols and certificate-based authentication protocols. Translation is possible in both directions. This makes it possible to seamlessly secure a communication path from a first entity to a second entity against cyberattacks, with the first entity connected via a communication network based on token-based communication and the second entity connected to a communication network based on a certificate-based communication protocol. The processing unit serves as an intermediary between the two entities and is connected to both communication networks.This can involve physically separate communication networks or a purely logical separation, with corresponding data packets then being sent over the same physical data line.

[0017] The service to be used can be provided by the first entity or the second entity, depending on the direction of communication. In a broader sense, "service" means the use of a functionality provided by a computing system and / or access to computer-readable data stored by the computing system. To translate between the token-based communication protocol and the certificate-based communication protocol, the computing unit executes a computer program product specifically designed for this purpose. The computer program product is stored on a computer-readable storage medium to which the computing unit has at least read access. Corresponding code modules are executed by an execution unit of the computing unit, for example, a processor such as a CPU.

[0018] The computing unit may have dedicated hardware components that can be used to provide the computer-implemented method according to the invention. However, shared resources that are also used to provide other functions may also be used. Furthermore, additional security measures, such as a firewall, an intrusion detection and prevention system (IDPS), and the like, may be implemented in the computing unit.

[0019] The processing unit is configured to "translate" between the respective communication protocols. For this purpose, the processing unit can have a corresponding translation database. This translation database then contains rules that specify which structures or contents of the respective communication protocol must be converted and in what way in order to be usable by the other communication protocol. This translation database can preferably be part of the computer program product used to execute the method according to the invention. The translation database can also be stored in a separate memory. The term "translation database" can also be interpreted abstractly, so that no database actually exists, but rather corresponding rules or relationships are implemented differently.

[0020] The information technology system according to the invention, using the method, allows seamless, secure end-to-end communication between a first and a second entity. Preferably, the first entity is part of the IT infrastructure superordinate to the computing unit or is in communication with the superordinate IT infrastructure. The second entity can also be part of the vehicle or external to it. In a particularly advantageous embodiment, which will be discussed in more detail later, the second entity is formed by a control unit of the vehicle. In this context, the second entity is also referred to as the IT infrastructure unit subordinate to the computing unit.

[0021] An advantageous development of the information technology system provides for the use of the token-based authorization protocol OAuth 2.0, particularly with the inclusion of OpenID Connect, and / or the authorization certificate being implemented as an X.509 certificate. These are particularly frequently used communication protocols, ensuring broad application and implementation of the method according to the invention.

[0022] According to a further advantageous embodiment of the information technology system, authorization tokens are exchanged between the computing unit and a higher-level IT infrastructure via an https connection and / or authorization certificates are exchanged between the computing unit and a lower-level IT infrastructure unit via a Unified Diagnostic Services connection according to ISO 14229. The https protocol is used in a variety of ways to exchange messages between web-based applications. The IT infrastructure higher-level than the computing unit is preferably a cloud environment. The cloud environment can comprise one or more servers or server clusters. The cloud environment can also be contacted via an end device such as a desktop computer or a mobile device such as a smartphone, tablet computer, or laptop computer.A corresponding server and / or a device connected to the cloud environment can form an entity.

[0023] As mentioned at the beginning, the UDS protocol is used to transmit diagnostic messages via a vehicle's fieldbus system. The IT infrastructure unit subordinate to the computing unit is therefore typically a vehicle-integrated computing unit, such as a control unit. The computing unit for translating between the two communication protocols can then be located externally or internally in the vehicle, as long as a connection to both communication networks is ensured.

[0024] This means that authorization tokens transmitted via an https connection can be converted into authorization certificates transmitted via a UDS data line and vice versa.

[0025] Preferably, the authorization certificate is used to authenticate an entity to use the service using the UDS service $29 Authentication. This is a special routine or service of the UDS communication protocol. The "Authentication" or "Authentication" service with the SID $29 or 0x29 offers modern methods for bidirectional authentication using a PKI or a certificate transfer based on challenge-response authentication. Particularly preferably, at least parts of the PKI are implemented in the IT infrastructure superordinate to the computing unit. At least parts of the PKI can also be integrated into the vehicle.

[0026] The computing unit is preferably embodied as a telecommunications unit. A telecommunications unit, also referred to as a telecommunications unit (TCU), allows the vehicle to be connected to the internet. For this purpose, wireless communication can be based, for example, on mobile communications or Wi-Fi. The program routine used for authorization management within the meaning of the computer-implemented method according to the invention, i.e., an application provided by executing the computer program product described above, is thus executed on the telecommunications unit itself. The information exchanged during communication between the first and second entities is thus translated within the direct communication path, which further improves cybersecurity.If the computing unit were implemented externally to the telecommunications unit, the corresponding authorization information would first have to be forwarded from the telecommunications unit to the computing unit, translated there, and then passed on to the respective downstream second entity. The more components the vehicle-integrated computer system has, for example in the form of computing units and interfaces, the more attack opportunities there are for a potential attacker. This risk can thus be mitigated. Furthermore, the integration of the functionalities provided by the computing unit into the telecommunications unit increases the efficiency of the method according to the invention. Since no authorization information needs to be transmitted from the telecommunications unit to an external computing unit, latencies in data transmission can be reduced.

[0027] According to a further advantageous embodiment of the information technology system according to the invention, an IT infrastructure unit subordinate to the computing unit is embodied by a vehicle control unit. This makes it possible for the first time to remotely maintain vehicle-implemented computing units such as vehicle control units using UDS. An end user, such as a vehicle developer or service employee, can exchange information with the vehicle control units via the vehicle manufacturer's cloud portal. This makes it possible, for example, to read an error memory, execute a diagnostic routine on a vehicle control unit, and / or flash a vehicle control unit with new firmware. The vehicle then no longer needs to visit a workshop for this purpose, which improves convenience for the vehicle owner, shortens maintenance times, and thus reduces costs.A further advantageous embodiment of the information technology system according to the invention further provides that the computing unit is configured to issue a request for use of the service itself, to receive it from a subordinate IT infrastructure unit, and / or to receive it from a higher-level IT infrastructure. This allows for particularly reliable execution of the computer-implemented method for authorization management according to the invention. An end user who wishes to use the service can thus be located inside the vehicle or externally. The advantages of the information technology system according to the invention and the computer-implemented method for authorization management for access outside the vehicle have already been explained.However, there are cases where the end user is also in the vehicle and wishes to perform corresponding diagnostics, for example during regular vehicle maintenance such as an inspection. By implementing the method according to the invention, the computing unit, in particular in the form of the telecommunications unit, itself functions as a diagnostic tester. The end user therefore does not need to connect a separate diagnostic tester to the vehicle's bus system via a corresponding diagnostic interface, but only needs to log in to the vehicle manufacturer's cloud service with their user information, which can be possible via a human-machine interface in the vehicle. This allows for fast, reliable, and convenient vehicle maintenance. The respective command to submit the request can be issued manually by an end user or automated by a program.

[0028] Preferably, the computing unit is configured to receive an authorization token from the IT infrastructure in response to the request, convert the authorization information contained therein into an authorization certificate, and transmit this to the IT infrastructure unit for use of the service. The end user, for example, the vehicle developer or service employee, can have a personal user account in the vehicle manufacturer's cloud infrastructure. Access rights for various in-vehicle services are linked to the user account, which authorize the end user to perform corresponding diagnostic routines.The end user can, for example, log in to the vehicle manufacturer's cloud infrastructure via the vehicle's infotainment system or via a device such as a desktop computer, a smartphone, a tablet or the like and thus, via a corresponding input mask via API, request to use the corresponding service in the vehicle, for example to initiate a diagnostic routine of a vehicle control unit, read out an error memory, update firmware or the like.

[0029] To date, the end user's corresponding access rights have not yet been available in the vehicle itself. However, using OAuth 2.0 in conjunction with OpenID Connect, after the request to use the service is submitted, corresponding authorization tokens for the end user are generated or retrieved by the vehicle manufacturer's cloud infrastructure and transmitted via an https connection to the computing unit in the vehicle or the telecommunications unit. The computing unit then translates the authorization information contained in the authorization token into a corresponding authorization certificate, which is used for the UDS service $29 Authentication. This enables the corresponding access rights of the end user to be transferred from the cloud to the vehicle and used there to provide the requested service.This ensures seamless, secure end-to-end communication between an external and an internal vehicle entity. This approach is also highly flexible and allows end users to easily use various services in a wide variety of vehicles, as the appropriate authorizations for each use case are reliably retrieved from the cloud.

[0030] Further advantageous embodiments of the information technology system according to the invention also emerge from the exemplary embodiment which is described in more detail below with reference to the figure.

[0031] Figure 1 shows a highly schematic representation of an information technology system according to the invention.

[0032] Figure 1 shows an information technology system 7 according to the invention, which allows secure end-to-end communication between a higher-level IT infrastructure 4 and a lower-level IT infrastructure unit 5. It depicts a vehicle 8 comprising several vehicle control units 10 connected to a computing unit 1 via a fieldbus 11. Computing unit 1 is particularly preferably formed by a telecommunications unit 9, which executes a computer-implemented method for authorization management according to the invention. Telecommunications unit 9 is in communication with IT infrastructure 4 in the form of a cloud or a backend of a vehicle manufacturer. Also part of higher-level IT infrastructure 4 are an identity provider 12, also referred to as an identity provider (IDP), and an authorization service 13 for the UDS service $29 Authentication.The identity provider 12 maintains the authorization information of an end user for using a service. The identity provider 12 is capable of providing the authorization information in the form of an authorization token 2. The authorization information is stored in the authorization service 13 in a form that can be interpreted to generate an authentication token for the UDS service $29.

[0033] To use a UDS service of a vehicle control unit 10, it may be necessary to present corresponding usage rights in the form of an authorization certificate 3. Communication in the vehicle 8 between the computing unit 1 or the telecommunications unit 9 and the respective vehicle control units 10 is thus based on a certificate-based authentication protocol. This is indicated by the authorization certificate 3 shown to the left of the vehicle 8 in the figure and a dashed line running above it. To verify the certificate or authorization, a respective vehicle control unit 10 can maintain a so-called access control list.

[0034] The prior art procedure involves manually connecting a so-called diagnostic tester to a diagnostic interface in vehicle 8. The corresponding authorizations are stored in the diagnostic tester in the form of certificates. However, this requires the use of a corresponding diagnostic tester, and physical access to vehicle 8 is also required.

[0035] Authorization information is transmitted between the computing unit 1 or the telecommunications unit 9 and the higher-level IT infrastructure 4, as well as between the respective components of the IT infrastructure 4 itself, via a token-based authorization protocol. This is indicated by the authorization token 2 shown in Figure 1 and the dashed line below it.

[0036] An end user can communicate with the higher-level IT infrastructure 4 using a desktop computer 14, a mobile device in the form of a smartphone 15, a laptop 16, or the like. This enables the end user, for example a vehicle developer, a service employee, or generally also a vehicle owner, to remotely execute a corresponding diagnostic routine for a vehicle control unit 10. Thus, the desktop computer 14, the smartphone 15, and the laptop 16 form an entity 6, whose authorization to use the service must be verified by means of authentication. A corresponding end user can also be in the vehicle 8 and initiate the diagnostic service, for example, via the infotainment system of the vehicle 8. In this context, the computing unit 1 or a vehicle control unit 10 can also form such an entity 6. It is also conceivable to execute corresponding diagnostic routines automatically.The method according to the invention can thus run completely automatically, so that corresponding authorization information for using the service is automatically requested from the higher-level IT infrastructure 4. In this case, the IT infrastructure 4 as well as said computing unit 1 and vehicle control units 10 can also form such an entity 6.

[0037] The processing unit 1 maintains a computer program product whose execution by an execution unit such as a processor allows the provision of an authorization management application 17. The authorization management application 17 allows the provision of a computer-implemented method for authorization management according to the invention. The following example illustrates the functionality:

[0038] An end user or an application of the higher-level IT infrastructure 4 or an application running in the vehicle 8 obtains an authorization token 2 containing UDS diagnostic authorizations in the form of scopes using existing token-based authorization protocols such as OAuth 2.0 in combination with OpenID Connect 1.0. These diagnostic authorizations can be considered or referred to as authorization information. The respective application running on the IT infrastructure 4 or in the vehicle 8 submits a so-called API request in the vehicle to the telecommunications unit 9 and authorizes itself there with the authorization token 2.

[0039] The authorization management application 17 then checks the authorization information contained in the authorization token 2 and uses it to issue a new authorization for the use of the corresponding UDS services. Communication in the vehicle 8 takes place using a certificate-based communication protocol. Accordingly, the processing unit 1 creates an authorization certificate 3 containing the authorization information. This is then used for the UDS service $29 Authentication. In particular, it is an X.509 certificate. Using the authorization certificate 3, the respective end user, or in the case of an automated routine, an application, can authenticate themselves on the respective vehicle control unit 10, which is to be used to provide the service.

[0040] This allows the identity provider 12 and the authorization service 13 to be transferred to the vehicle 8, as indicated by a dashed line representing identity provider 12* and authorization service 13*. A trust relationship exists between these certification authorities, once for issuing or signing the corresponding authorization tokens 2 and once for issuing or signing the corresponding authorization certificates 3.

[0041] After successful authentication of the end user in the vehicle control unit 10, the respective vehicle control unit 10 considers the end user or the application to be authorized to use the service.

[0042] This enables the vehicle control unit 10 to execute a command received from the cloud or the IT infrastructure 4 with sufficient authorization.

[0043] A possible use case is as follows: An end user with the required authorization wants to execute an exhaust aftertreatment diagnostic routine via UDS on a specific vehicle from the cloud. The end user is registered in the cloud and has the corresponding diagnostic authorizations. The corresponding information is stored in the identity provider 12. The end user then starts executing the service. For this purpose, the end user can use, for example, the aforementioned desktop computer 14, smartphone 15, or laptop 16. The end user's authorization is converted by the computing unit 1 into a UDS Service $29 authorization in the form of the authorization certificate 3. For this purpose, the IT infrastructure 4 first transmits a corresponding authorization token 2 to the computing unit 1. The authorization is then checked in the vehicle control unit 10, and the exhaust aftertreatment diagnostic routine is executed.

Claims

Patent claims 1. Information technology system (7) comprising a computing unit (1) configured to execute a computer-implemented method for authorization management, the method providing that: - a computing unit (1) receives an authorization token (2) of a token-based authorization protocol, wherein the authorization token (2) comprises authorization information for using a service, and wherein the computing unit (1) extracts the authorization information from the authorization token (2) and generates therefrom an authorization certificate (3) of a certificate-based authentication protocol; or - the computing unit (1) receives an authorization certificate (3) of a certificate-based authentication protocol, wherein the authorization certificate (3) comprises authorization information for using a service, and wherein the computing unit (1) extracts the authorization information from the authorization certificate (3) and generates therefrom an authorization token (2) of a token-based authorization protocol, characterized in that the computing unit (1) is integrated into a vehicle (8).

2. Information technology system (7) according to claim 1, characterized in that the method further provides that OAuth 2.0 is used as the token-based authorization protocol, in particular including OpenID Connect, and / or the authorization certificate (3) is designed as an X.509 certificate.

3. Information technology system (7) according to claim 1 or 2, characterized in that the method further provides that authorization tokens (2) are exchanged between the computing unit (1) and a higher-level IT infrastructure (4) via an https connection and / or authorization certificates (3) between the computing unit (1) and a subordinate IT infrastructure unit (5) via a Unified Diagnostic Services connection according to ISO 14229.

4. Information technology system (7) according to claim 3, characterized in that the method further provides that the authorization certificate (3) is used to authenticate an entity (6) for using the service by means of the UDS service $29 Authentication.

5. Information technology system (7) according to one of claims 1 to 4, characterized in that the computing unit (1) is designed as a telecommunications unit (9).

6. Information technology system (7) according to one of claims 1 to 5, characterized in that an IT infrastructure unit (5) subordinate to the computing unit (1) is formed by a vehicle control unit (10).

7. Information technology system (7) according to one of claims 1 to 6, characterized in that the computing unit (1) is configured to issue a request for use of the service itself, to receive it from a subordinate IT infrastructure unit (5) and / or to receive it from a higher-level IT infrastructure (4).

8. Information technology system (7) according to claim 7, characterized in that the computing unit (1) is configured to receive an authorization token (2) from the IT infrastructure (4) in response to the request, to convert the authorization information contained therein into an authorization certificate (3) and to transmit this to the IT infrastructure unit (5) for use of the service.

Images