Updating a configuration of at least one software component of a controller

Abstract

The present invention relates to a method and to a computer program with instructions for updating a configuration of at least one software component of a controller. A configuration manager of the controller receives (11) a configuration packet from a backend, e.g. after a previous request (10) from the configuration manager or triggered by the backend. The configuration manager checks (12) a signature of the configuration package and provides (13) the associated configuration contained in the configuration package to the software component. The software component then reads in (15) the new configuration, e.g. in response to a request (14) from the configuration manager. The invention also relates to a controller in which a method according to the invention is implemented, and to a means of transport comprising a controller of this kind.

Description

[0001] Description

[0002] Updating a configuration of at least one software component of a control unit

[0003] The present invention relates to a method and a computer program with instructions for updating a configuration of at least one software component of a control unit. The invention also relates to a control unit in which a method according to the invention is implemented, as well as to a means of transportation with such a control unit.

[0004] Modern means of transportation utilize numerous control units, each of which implements software components. For example, CN 116588125 B describes an in-vehicle data processing system comprising an application monitoring module, a data acquisition module, and a dynamic configuration module. The application monitoring module is used to monitor dynamic application data of an in-vehicle application and to determine data requirement information of the in-vehicle application based on the dynamic application data. The data acquisition module is used to control a sensor array to acquire sensing data according to the corresponding configuration information. The dynamic configuration module is used to dynamically update the configuration information of the sensor array based on the data requirement information and the acquisition data.

[0005] To fix security vulnerabilities, expand functionality, or for other reasons, the software used by control units in vehicles may need to be updated. For older vehicles, this is often only possible during a workshop visit.

[0006] In newer vehicles, signed ECU software can sometimes be installed from a backend onto a vehicle's ECU using an over-the-air update. However, this always involves updating the entire ECU or a partition. This requires a relatively large data volume per ECU and vehicle and thus incurs considerable costs. Since the ECU software must first be released, this approach also involves a long response time.

[0007] It is an object of the invention to provide improved solutions for updating a configuration of at least one software component of a control unit.

[0008] This object is achieved by a method having the features of claim 1, by a computer program with instructions according to claim 13, by a control device according to claim 14, and by a means of transport according to claim 15. Preferred embodiments of the invention are the subject of the dependent claims.

[0009] According to a first aspect of the invention, a method for updating a configuration of at least one software component of a control unit comprises the steps:

[0010] - Receiving a configuration package from a backend by a configuration manager of the control unit;

[0011] - Verification of a signature of the configuration package by the configuration manager;

[0012] - Provision of the associated configuration contained in the configuration package to the software component by the configuration manager; and

[0013] - Reading in the new configuration by the software component.

[0014] According to a further aspect of the invention, a computer program contains instructions which, when executed by a computer, cause the computer to perform the following steps for updating a configuration of at least one software component of a control unit:

[0015] - Receiving a configuration package from a backend by a configuration manager of the control unit;

[0016] - Verification of a signature of the configuration package by the configuration manager;

[0017] - Provision of the associated configuration contained in the configuration package to the software component by the configuration manager; and

[0018] - Reading in the new configuration by the software component.

[0019] The term "computer" should be understood broadly. In particular, it also includes control units, embedded systems, and other processor-based data processing devices. The execution of the aforementioned steps can be performed directly by the computer or involve the computer controlling a component intended to execute a step. The computer program can, for example, be made available for electronic retrieval or stored on a computer-readable storage medium.

[0020] According to one aspect of the invention, a control unit has a configuration manager and is configured to perform the following steps to update a configuration of at least one software component of the control unit:

[0021] - Receiving a configuration package from a backend by the configuration manager;

[0022] - Verification of a signature of the configuration package by the configuration manager;

[0023] - Provision of the associated configuration contained in the configuration package to the software component by the configuration manager; and

[0024] - Reading in the new configuration by the software component.

[0025] In the solution according to the invention, a configuration manager serves as the central component of the system. The configuration manager manages the secure configurations of the software components and enables the downloading of signed configuration packages from a backend. The software components can, in particular, implement security measures. The solution according to the invention has the advantage of allowing targeted and secure updating of the configurations of security measures, enabling rapid response in the event of misconfigurations or known vulnerabilities. At the same time, only a small data volume is generated, since only the configurations themselves are transferred. This also results in low costs.

[0026] According to one aspect of the invention, the software component reads the new configuration in response to a request from the configuration manager. The request from the configuration manager is preferably made via an authenticated interface. After distributing the configurations to the associated software components, the configuration manager triggers a reread of the new configurations via a dedicated interface. This interface is authenticated to ensure the integrity of the software component.

[0027] According to one aspect of the invention, the configuration package can contain configurations for multiple software components. The configuration package can contain multiple configurations as a container format, e.g., one for each software component or none if the respective software component does not require any changes. Each configuration can contain multiple parameters for configuring the software component. Any combination of configurations within a configuration package is possible. Only conflicting configurations within a configuration package are preferably excluded.

[0028] According to one aspect of the invention, if the new configuration does not function properly, a previous configuration is used. In this case, a message is preferably sent to the backend that the new configuration is not functioning properly. A certain amount of historical configuration data can be stored in both the control unit and the backend. This enables easy switching to an earlier configuration in the event of a fault. Furthermore, the stored configuration data allows changes between configurations to be tracked during troubleshooting.

[0029] According to one aspect of the invention, the configuration manager requests a configuration package from the backend upon the first start of the control unit. In this scenario, a request is sent to the backend after the first start to obtain current configurations. This ensures that current configurations are available on the control unit after the first start. Preferably, the control unit is delivered with a basic configuration so that it is functional even if there is no online connection.

[0030] According to one aspect of the invention, the backend enforces a configuration update. In this scenario, a configuration update is enforced from the backend. This can be used, for example, in the event of a security vulnerability to fix a configuration error.

[0031] According to one aspect of the invention, the configuration manager requests a configuration package from the backend in response to a request from a software component. In this scenario, an update to the configuration of a software component is triggered by a trigger from another software component. For example, a new firewall configuration could be downloaded after installing an application.

[0032] According to one aspect of the invention, the backend requests a configuration package from the configuration manager. In this scenario, the backend can read the configurations of the software components in the control unit. This can be used for troubleshooting or to save settings before an update. According to one aspect of the invention, the transport path between the configuration manager and the backend is secured using transport-layer security for the connection. Transport-layer security ensures the correct identities of the control unit and the backend server via certificates. Furthermore, a confidential and authentic connection can be established between the participants.

[0033] Advantageously, a means of transportation comprises a control unit according to the invention. The means of transportation can be any type of transportation, e.g., a car, a bus, a motorcycle, a commercial vehicle, in particular a truck, an agricultural machine, a construction machine, a rail vehicle, an aircraft, etc.

[0034] Further features of the present invention will become apparent from the following description and the appended claims taken in conjunction with the figures.

[0035] Fig. 1 shows a block diagram of on-board electronics of a means of transport;

[0036] Fig. 2 shows schematically a method for updating a configuration of at least one software component of a control unit;

[0037] Fig. 3 shows an example of a control unit with a configuration manager;

[0038] Fig. 4 illustrates the request for a configuration package from the backend when the control unit is started for the first time;

[0039] Fig. 5 illustrates forcing a configuration update by the backend;

[0040] Fig. 6 illustrates the request for a configuration package from the backend in response to a request from a software component;

[0041] Fig. 7 illustrates the request of a configuration package from the configuration manager by the backend; and

[0042] Fig. 8 illustrates the transition to a previous configuration in the event of a fault. To better understand the principles of the present invention, embodiments of the invention are explained in more detail below with reference to the figures. It is understood that the invention is not limited to these embodiments and that the described features can also be combined or modified without departing from the scope of the invention as defined in the appended claims.

[0043] Fig. 1 shows a schematic block diagram of the on-board electronics of a means of transport, in this case a motor vehicle. Part of the on-board electronics is an infotainment system consisting of a touch-sensitive display unit 50, a computing unit 60, an input unit 70, and a memory 80. The display unit 50 is connected to the computing unit 60 via a data line 55 and includes both a display area for displaying variable graphic information and a user interface (touch-sensitive layer) arranged above the display area for inputting commands by a user. The input unit 70 is connected to the computing unit 60 via a data line 75.

[0044] The memory 80 is connected to the computing unit 60 via a data line 85. A pictogram and / or symbol directory containing pictograms and / or symbols for possible overlays of additional information is stored in the memory 80.

[0045] The other components of the infotainment system, such as the camera 150, radio 140, navigation device 130, telephone 120, and instrument cluster 110, are connected to the computing unit 60 via a data bus 100. The high-speed variant of the CAN (Controller Area Network) bus according to ISO standard 11898-2 can be used as the data bus 100. Alternatively, an Ethernet-based bus system such as IEEE 802.03cg can be used. Bus systems that implement data transmission via fiber optic cables can also be used. Examples are the MOST (Media Oriented System Transport) bus or the D2B (Domestic Digital Bus). The vehicle is equipped with an on-board connectivity module 160 for incoming and outgoing wireless communication. It can be used for mobile communication, e.g., for mobile communication according to the 5G standard.

[0046] Reference numeral 172 denotes an engine control unit. Reference numeral 174 denotes an ESC (electronic stability control) control unit, while reference numeral 176 denotes a transmission control unit. Such control units, all of which fall under the powertrain category, are typically networked using a CAN bus 104. Since various sensors are installed in the motor vehicle and are no longer connected to individual control units, the sensor data is also distributed to the individual control units via the bus system 104.

[0047] Modern vehicles may contain additional components, such as further sensors for scanning the environment, such as a LIDAR sensor 186 or a RADAR sensor 182, and additional video cameras 151, e.g., a front camera, a rearview camera, or side cameras. Such sensors are increasingly used in vehicles to observe the environment. Additional control devices, such as an ADC unit 184 (ADC: Automatic Driving Control), etc., may be provided in the vehicle. The RADAR and LIDAR sensors 182, 186 can have a scanning range of up to 250 m, while the cameras 150, 151 can cover a range of 30 m to 120 m. Due to their higher bandwidth for data transport, components 182 to 186 are connected to another communication bus 102, e.g., an Ethernet bus. An Ethernet bus adapted to the specific needs of vehicle communication is defined in IEEE 802.1Q specification. Furthermore, a wealth of information about the surroundings can be received from other vehicles via V2V communication. Especially for vehicles that are not within line of sight of the observing vehicle, it is very advantageous to receive information about their position and movement via V2V communication.

[0048] Reference numeral 190 denotes an on-board diagnostic interface connected to another communication bus 106.

[0049] A gateway 90 is provided for the purpose of transmitting vehicle-relevant sensor data via an on-board connectivity module 160 to another vehicle or to an edge system. This gateway 90 is connected to the various bus systems 100, 102, 104, and 106. The gateway 90 is designed to convert the data it receives via one bus into the transmission format of another bus so that it can be distributed with the packets specified for the other bus. To forward this data externally, i.e., to another vehicle or to the control center computer, the on-board on-board connectivity module 160 is equipped with a communication interface to receive these data packets and, in turn, convert them into the transmission format of the corresponding mobile radio standard. Fig. 2 schematically shows a method for updating a configuration of at least one software component of a control unit.For example, the software component can implement a security measure. A configuration package is received 11 from a backend by a configuration manager of the control unit, e.g., following an optional prior request 10 from the configuration manager or triggered by the backend. The configuration package can contain configurations for multiple software components. The transport path between the configuration manager and the backend is preferably secured by transport-layer security of the connection. The configuration manager then checks 12 a signature of the configuration package and provides 13 the associated configuration contained in the configuration package to the software component. The software component then reads 15 the new configuration, e.g., in response to a request 14 from the configuration manager.The request 14 by the configuration manager is preferably made via an authentically secured interface.

[0050] A preferred embodiment of the invention will be explained below with reference to Fig. 3 to Fig. 8.

[0051] Fig. 3 shows an example of an ECU with a configuration manager SCM. The configuration manager SCM is a central component of the system and manages the secure configurations CONFj of the software components SCj. It enables the downloading of signed configuration packages SCB from a backend B. The software components SCj can implement security measures in particular. The configuration package SCB can contain multiple configurations CONFj as a container format, e.g. one for each software component SCj or none if the respective software component SCj does not require any changes. Each configuration CONFj can contain multiple parameters for setting the software component SCj. The combinations of configurations CONFj within a configuration package SCB are arbitrary. Only contradictory configurations CONFj within a configuration package SCB are preferably excluded.

[0052] When the SCB configuration package arrives on the ECU after download, the SCM configuration manager checks the signature (step (1)), ensuring that only configurations with a correct signature are permitted. The SCM configuration manager then distributes the CONFj configurations to the associated SCj software components (step (2)) and triggers a re-read of the new CONFj configuration via an authenticated SCM-IF interface (step (3). If a CONFj configuration fails, the previous version is reinstalled, and a message is sent back to backend B.

[0053] The transport path between the SCM configuration manager on the ECU and backend B is preferably additionally secured via a TLS connection (TLS: Transport Layer Security). This ensures the correct identities of the ECU and backend B via certificates, as well as establishing a confidential and authentic connection between the participants. An additional freshness value in the SCB configuration package can prevent replay attacks and, for example, allow a maximum of one previous version to ensure the possibility of a fallback in the event of an error.

[0054] There are basically four scenarios that can lead to a configuration update.

[0055] Fig. 4 illustrates the request for a configuration package from backend B upon first start of the ECU. In this scenario, after the first start, the configuration manager SCM sends a request to backend B (step (1)) to obtain current configurations. Backend B then provides a configuration package with the requested configurations, which is received and verified by the configuration manager SCM (step (2). The configuration manager SCM then initiates the updating of the configurations of the respective software components SCj (step (3). This scenario ensures that current configurations are available on the ECU after the first start. Preferably, a basic configuration is delivered on the ECU so that it can function even if there is no online connection.

[0056] Fig. 5 illustrates the forced configuration update by backend B. In this so-called push scenario, a configuration update is forced from backend B. This can be used, for example, in the event of a security vulnerability to fix a configuration error. The configuration manager SCM receives and verifies the configuration package provided by backend B (step (1)) and then initiates the configuration update of the respective software components SCj (step (2).

[0057] Fig. 6 illustrates the request for a configuration package from backend B in response to a request from software component SC2. In this scenario, an update of the configuration of a software component SC1 is triggered by a trigger from another software component SC2. For example, after the installation of an application, a new firewall configuration could be downloaded. In this example, the configuration manager SCM initiates the update of the configurations of software component SC2, step (1). This software component SC2 then triggers an update of the configuration of software component SC1 at the configuration manager SCM, step (2). The configuration manager SCM now makes a request to backend B, step (3), to obtain the current configuration for software component SC1.Backend B then provides a configuration package with the requested configuration, which is received and verified by the configuration manager SCM (step 4). The configuration manager SCM then initiates the configuration update of software component SC1 (step 5).

[0058] Fig. 7 illustrates the request for a configuration package from the configuration manager SCM by backend B. In this so-called pull scenario, backend B can read the configurations of the software components SC; in the control unit ECU. This can be used for troubleshooting or to save settings before an update. Backend B first sends a request to provide the configurations to the configuration manager SCM, step (1). The respective configurations are then provided by the software components SC;, step (2), and transmitted by the configuration manager SCM to backend B in a configuration package, step (3).

[0059] A certain amount of historical configuration data can be stored both in the control unit and in the backend. This enables easy switching to an earlier configuration in the event of an error. In addition, the stored configuration data allows changes between configurations to be tracked during troubleshooting. Fig. 8 illustrates switching to a previous configuration in the event of an error. The left-hand side shows the regular case. The configuration is updated from the previous version V2 to the newer version V3, step (1). The asterisk indicates the configuration valid after the update. The right-hand side shows an error case. Version V2 of the configuration is not functioning correctly. Therefore, the previous version V1 of the configuration is used, step (2). The asterisk indicates the configuration valid after the fallback.Preferably, a corresponding message is then sent to the backend. The dashed box illustrates a grouping of configurations in different versions. For example, the configurations can be located next to each other in a file system or stored together in a database, allowing them to be accessed specifically to perform a rollback if necessary.

[0060] List of reference symbols

[0061] 10 requests for a configuration package at the backend

[0062] 11 Receiving a configuration package

[0063] 12 Verifying a signature of the configuration package

[0064] 13 Providing the associated configuration to the software component

[0065] 14 Request the software component to read the new configuration

[0066] 15 Reading the new configuration by the software component

[0067] 50 display units

[0068] 55 Data line to the display unit

[0069] 60 computing units

[0070] 70 input unit

[0071] 75 Data line to the input unit

[0072] 80 storage

[0073] 85 Data line to memory

[0074] 90 Gateway

[0075] 100 First data bus

[0076] 102 Second data bus

[0077] 104 Third data bus

[0078] 106 Fourth data bus

[0079] 110 instrument cluster

[0080] 120 Telephone

[0081] 130 navigation device

[0082] 140 Radio

[0083] 150 Camera

[0084] 151 Additional Cameras

[0085] 160 on-board connectivity module

[0086] 172 Engine control unit

[0087] 174 Electronic stability control control unit

[0088] 176 Transmission control unit

[0089] 182 RADAR sensor

[0090] 184 Automatic driving control

[0091] 186 LIDAR sensor

[0092] 190 on-board diagnostic interface

[0093] B Backend

[0094] CONFj Configuration ECU control unit

[0095] SCj software component

[0096] SCB configuration package

[0097] SCM Configuration Manager

[0098] SCM-IF Authentically Secured Interface

Claims

Patent claims 1. Method for updating a configuration (CONFj) of at least one software component (SCj) of a control unit (ECU), comprising the steps: - receiving (11) a configuration package (SCB) from a backend (B) by a configuration manager (SCM) of the control unit (ECU); - Verification (12) of a signature of the configuration package (SCB) by the configuration manager (SCM); - providing (13) the associated configuration (CONFj) contained in the configuration package (SCB) to the software component (SCj) by the configuration manager (SCM); and - Reading (15) of the new configuration (CONFj) by the software component (SCj).

2. The method according to claim 1, wherein the software component (SCj) implements a security measure.

3. Method according to claim 1 or 2, wherein the reading (15) of the new configuration (CONFj) by the software component (SCj) takes place in response to a request (14) by the configuration manager (SCM).

4. The method according to claim 3, wherein the request (14) is made by the configuration manager (SCM) via an authentically secured interface (SCM-IF).

5. Method according to one of the preceding claims, wherein the configuration package (SCB) can contain configurations (CONFj) for several software components (SCj).

6. Method according to one of the preceding claims, wherein in the event that the new configuration (CONFj) does not function properly, a previous configuration (CONFj) is used.

7. The method according to claim 6, wherein in the event that the new configuration (CONFj) does not function properly, a message is sent to the backend (B).

8. The method according to one of claims 1 to 7, wherein the configuration manager (SCM) requests a configuration package (SCB) from the backend (B) when the control unit (ECU) is started for the first time (10).

9. The method according to any one of claims 1 to 7, wherein the backend (B) forces an update of configurations (CONFj).

10. The method according to one of claims 1 to 7, wherein the configuration manager (SCM) requests (10) a configuration package (SCB) from the backend (B) in response to a request from a software component (SCj).

11. The method according to one of claims 1 to 7, wherein the backend (B) requests a configuration package (SCB) from the configuration manager (SCM).

12. Method according to one of the preceding claims, wherein the transport path between the configuration manager (SCM) and the backend (B) is secured via a transport layer security of the connection.

13. Computer program with instructions which, when executed by a computer, cause the computer to carry out the steps of a method according to one of the preceding claims for updating a configuration (CONFj) of at least one software component (SO) of a control unit (ECU).

14. Control unit (ECU) with a configuration manager (SCM), wherein the control unit (ECU) is configured to carry out a method according to one of the preceding claims for updating a configuration (CONFj) of at least one software component (SCj) of the control unit (ECU).

15. A means of transport (40), wherein the means of transport (40) comprises a control unit (ECU) according to claim 14.

Images