Control device and method for detecting a sensor exchange

Abstract

The invention relates to a control device for a vehicle, wherein the control device can be connected to at least one sensor, and wherein the control device is configured to store at least one characteristic feature relating to a sensor output of the sensor, in particular when the control device detects the sensor output from the sensor for the first time, and wherein the control device is configured, when at least one stored characteristic feature is already stored, to compare the at least one characteristic feature with the at least one stored characteristic feature, and to output a signal when the at least one characteristic feature and the at least one stored characteristic feature differ.

Description

[0001] Control unit and method for detecting a sensor replacement

[0002] The invention relates to a control unit and a method for detecting at least one characteristic feature of a sensor. In particular, the invention relates to a method that enables the detection of a unique characteristic feature of a sensor, and to a control unit capable of storing this at least one characteristic feature and detecting whether the stored characteristic feature corresponds to the characteristic feature of a sensor connected to the control unit.

[0003] Vehicles contain a multitude of control units, which can be replaced, especially during repairs. Special procedures are in place to ensure that control units installed in a vehicle can only communicate with other vehicle control units if they are also intended for installation in that vehicle. For example, cryptographic procedures are used to prevent a control unit not intended for that vehicle from being used in the vehicle. This is primarily intended to prevent illegally acquired or stolen control units from being installed in vehicles. Among other things, it is intended to make it more difficult to use stolen or illegally acquired control units.

[0004] A vehicle also includes a multitude of sensors that are essentially limited to outputting data and are essentially non-programmable. They lack sufficient computing power to execute cryptographic processes similar to those used by control units. These sensors are essentially pre-assembled sensors that are simply installed in a vehicle.

[0005] The problem is that stolen sensors can be removed from one vehicle with little effort and used in another. Since the sensors do not support complex security procedures, it is also easy to use stolen sensors in another vehicle. Examples of such sensors are optical sensors such as exterior cameras, for example, a vehicle's rearview camera. The invention aims to provide a solution that makes it difficult to use simple sensors, such as cameras from one vehicle, in another.

[0006] To this end, the invention therefore provides a control unit, a vehicle, and a method according to the independent claims. Further developments of the invention are the subject of the dependent claims.

[0007] In a first aspect, a control unit for a vehicle is provided, wherein the control unit is connectable to at least one sensor, and wherein the control unit is configured to store at least one characteristic feature relating to a sensor output of the sensor, in particular when the control unit detects the sensor output from the sensor for the first time, and wherein the control unit is configured, if at least one stored characteristic feature is already stored, to compare the at least one characteristic feature with the at least one stored characteristic feature, and to output a signal if the at least one characteristic feature and the at least one stored characteristic feature differ.

[0008] The at least one characteristic feature can be a digital fingerprint that is determined by the control unit for a specific property of the sensor, wherein the property is in particular a non-reproducible property of the sensor, preferably at least one sensor error.

[0009] The sensor may be a camera, in particular a camera of a driver assistance system, and wherein the at least one characteristic feature is a pixel error of the camera.

[0010] The control unit can store the at least one characteristic feature in a memory assigned to the control unit as a stored characteristic feature and / or transmit it to a memory remote from the vehicle by means of a communication unit of the vehicle.

[0011] The control unit can output the signal to an output device, wherein the output device can output a visual and / or acoustic output in or on the vehicle, which indicates, in particular, that the connected sensor is not intended for the vehicle. The control unit can receive a reset command. Upon receipt of the reset command, the control unit can delete the at least one stored characteristic feature or enable overwriting of the at least one stored characteristic feature.

[0012] In a further aspect, a vehicle is provided with a control unit as described herein, wherein the vehicle comprises an output device configured to output an indication based on the signal, in particular indicating that a connected sensor is not intended for the vehicle.

[0013] In yet another aspect, a method for detecting a sensor replacement on a vehicle is provided, wherein a control unit stores at least one characteristic feature relating to a sensor output of a sensor, in particular when the control unit detects the sensor output from the sensor for the first time, and wherein the control unit, if at least one stored characteristic feature is already stored, compares the at least one characteristic feature with the at least one stored characteristic feature and outputs a signal if the at least one characteristic feature and the at least one stored characteristic feature differ.

[0014] The invention will now be described with reference to the figures:

[0015] Fig. 1 shows a schematic overview of a vehicle with a control unit according to the invention.

[0016] Fig. 2 shows schematically a process flow of the method according to the invention.

[0017] The invention takes advantage of the fact that during the manufacturing process of a sensor, and in particular an optical sensor such as a camera, manufacturing tolerances or series variation lead to the sensor being provided with features during production that make the sensor uniquely identifiable, particularly within a certain batch size. These features are usually designed in such a way that they have little or no impact on the intended purpose or the task for which the sensor is to be used. In the case of an optical sensor, which may have a CMOS sensor, for example, these features may be so-called pixel errors, which may not be visible in the ultimately generated image due to further processing steps.

[0018] Pixel defects are, in particular, image points on the sensor whose color or brightness values ​​do not change even when different images or frames are recorded. For example, it is possible for the output of a pixel in at least one channel to have the same color value across multiple frames. Likewise, brightness values ​​can have the same brightness value across multiple frames (individual images of a video data stream). The sensor data is output, for example, in the form of a multi-dimensional field (array), so that a constant color or brightness value can be captured by constant values ​​at one point in the multi-dimensional field across at least two frames.

[0019] Since, as already mentioned, every sensor is manufactured with a certain characteristic or defect during production, a sensor can be identified based on this characteristic feature. Since the characteristic feature of another sensor is different, the sensors can be differentiated. For example, the number of defect pixels for an optical sensor can be determined, which, due to manufacturing tolerances, will likely differ from the number of defect pixels in another sensor.

[0020] If a sensor with a different number of error pixels is installed in a vehicle, a vehicle control unit that has recorded and stored the characteristic feature of the original sensor by evaluating the sensor output of the original sensor can detect that the characteristic feature of the new sensor differs from the stored one. Thus, upon detecting a deviation between the stored characteristic feature and the recorded characteristic feature, the control unit can output a signal, which is output, for example, in the form of a visual or acoustic output in or on the vehicle.

[0021] For example, a vehicle user can be informed that a sensor is installed on the vehicle that does not correspond to the original sensor or is not intended for the vehicle. This can then alert the vehicle user that an illegally obtained sensor may have been installed on the vehicle. Of course, in addition to the number of faulty pixels in an optical sensor, their position, for example, per color channel, can also be recorded, and / or checksums can be created for the characteristic features of a sensor to ensure better identification or greater entropy or differentiation between different sensors.

[0022] In other words, the control unit creates and stores a kind of fingerprint of the sensor, which is then compared with that of a possibly replaced sensor. If the fingerprints don't match, a message is issued.

[0023] Of course, the control unit can be put into a mode that allows the learning of a new sensor. This mode can be triggered by a reset signal to the control unit, but preferably only activated using an approved workshop device. The control unit can then delete the stored characteristic feature or overwrite it with a new characteristic feature.

[0024] The overall goal is to make it more difficult to install illegally acquired or stolen sensors in vehicles. To achieve this, it is sufficient to simply increase the effort required to find a suitable sensor for a vehicle. Even if the variation in sensor production results in the same characteristic feature being imprinted relatively frequently in sensors, it can still be assumed that a sensor cannot simply be replaced with another sensor. This would require the procurement of a larger number of sensors, which would be more complex, time-consuming, and increase the risk of detection for the potentially illegal perpetrator.

[0025] Fig. 1 shows a vehicle F which has a control unit G according to the invention. The control unit G is connected to a sensor S. The control unit G is configured to evaluate a signal output by the sensor or a sensor output of the sensor S and to determine at least one characteristic feature of the sensor S. The control unit G then stores the characteristic feature of the sensor S. In particular, the control unit G stores the at least one characteristic feature of the sensor S when the sensor S is connected to the control unit G for the first time or when the control unit G detects a sensor output of the sensor S for the first time. If the sensor S is now replaced with another sensor, the control unit G detects the output of the other sensor.The control unit G compares the at least one characteristic feature of the new sensor with the at least one stored characteristic feature of the sensor S. If the at least one stored characteristic feature of the sensor S does not match the characteristic feature of the new sensor, the control unit G can initiate an output to and / or in the vehicle F by means of an output device A by outputting a signal. The output device A can be, for example, a display unit or an acoustic output unit (speaker).

[0026] It is also possible for the control unit G to transmit the detected at least one characteristic feature of the sensor S to an external data storage device D by means of a communication unit K of the vehicle F. The data storage device D can in particular be part of a remote computer system, a server system, a cloud, or a backend system. When a new sensor is installed, the control unit G can then also transmit the at least one characteristic feature of the new sensor to the data storage device D. In the remote computer system, a database comparison can then be used to determine, for example, from which vehicle the new sensor may have been stolen or to which vehicle the new sensor originally belonged. Thus, the remote computer system and the storage device D can also be used to determine from which vehicle a possibly stolen sensor was transferred to another vehicle and to which vehicle.

[0027] Fig. 2 schematically shows a method sequence according to the invention. In a first step S11, the control unit G stores at least one characteristic feature relating to the sensor. In a second step S12, a check is made to determine whether a characteristic feature has already been stored. If this is not the case, the method returns to the first step S11. If a characteristic feature has already been stored, in a third step S13 the control unit G compares a characteristic feature supplied by a sensor with the at least one stored characteristic feature. If these features match (check in the fourth step S14), no signal is output (fifth step S15). However, if the detected at least one characteristic feature does not match the at least one stored characteristic feature, a signal is output by the control unit G in a sixth step S16.

Claims

Claims 1. Control unit (G) for a vehicle (F), wherein the control unit (G) is connectable to at least one sensor (S), and wherein the control unit (G) is configured to store at least one characteristic feature relating to a sensor output of the sensor (S), in particular when the control unit (G) detects the sensor output from the sensor (S) for the first time, and wherein the control unit (G) is configured, if at least one stored characteristic feature is already stored, to compare the at least one characteristic feature with the at least one stored characteristic feature, and to output a signal if the at least one characteristic feature and the at least one stored characteristic feature differ.

2. Control unit (G) according to claim 1, wherein the at least one characteristic feature is a digital fingerprint which is determined by the control unit (G) for a specific property of the sensor (S), wherein the property is in particular a non-reproducible property of the sensor (S), preferably at least one sensor error.

3. Control unit (G) according to claim 1 or 2, wherein the sensor (S) is a camera, in particular a camera of a driver assistance system, and wherein the at least one characteristic feature is a pixel error of the camera.

4. Control unit (G) according to one of the preceding claims, wherein the control unit (G) is configured to store the at least one characteristic feature in a data memory (D) assigned to the control unit (G) as a stored characteristic feature, and / or to transmit it by means of a communication unit (K) of the vehicle (F) to a data memory (D) remote from the vehicle (F).

5. Control unit (G) according to one of the preceding claims, wherein, if the control unit (G) is configured to output the signal to an output device (A), wherein the output device (A) is configured to output an optical and / or acoustic output in or on the vehicle (F), the in particular indicates that the connected sensor (S) is not intended for the vehicle (F).

6. Control unit (G) according to one of the preceding claims, wherein the control unit (G) is configured to receive a reset command, and wherein the control unit (G) deletes the at least one stored characteristic feature upon receipt of the reset command or enables the at least one stored characteristic feature to be overwritten.

7. Vehicle (F) with a control unit (G) according to one of the preceding claims, wherein the vehicle (F) comprises an output device which is configured to output an indication based on the signal, which indication in particular indicates that a connected sensor is not intended for the vehicle (F).

8. A method for detecting a sensor replacement on a vehicle (F), wherein a control unit (G) stores (S11) at least one characteristic feature relating to a sensor output of a sensor (S), in particular when the control unit (G) detects the sensor output from the sensor (S) for the first time, and wherein the control unit, if at least one stored characteristic feature is already stored, compares the at least one characteristic feature with the at least one stored characteristic feature (S13) and outputs a signal (S16) if the at least one characteristic feature and the at least one stored characteristic feature differ.

Images