Method for verifying the integrity of a data-processing device of a vehicle system

Abstract

The invention relates to a method for verifying the integrity of an electronic data-processing device (10) in a vehicle system (12), comprising: i) a vehicle (14), ii) one or more system vehicle tyres (16a-f) which are arranged on the vehicle (14) and each comprise one or more electronic sensor units (18a-f), iii) a data-processing device (10) which is arranged in or on the vehicle (14) and has stored configuration information, and iv) a data-processing system (20) which is separate from the vehicle (14) and has stored reference information, the method comprising the following method steps: a) transmitting tyre information to the data-processing device, b) processing the tyre information, and d) comparing the configuration information with the reference information by means of the data-processing system (20) or the data-processing device, wherein one or more response measures are triggered depending on whether or not the comparison yields a match.

Description

[0001] Method for verifying the integrity of a data processing device of a vehicle system

[0002] Description

[0003] The invention relates to a method for verifying the integrity of an electronic data processing device in a vehicle system, a related method for changing the configuration of the electronic data processing device in a vehicle system, and a vehicle system designed for use in such methods.

[0004] Ongoing technological development and increasing digitalization are particularly affecting the field of automotive engineering and vehicle tires. There is a continued interest in continuously collecting performance data from vehicle components in order to, for example, constantly monitor performance and operational safety. Information that can be monitored for vehicle tires includes, for example, tire pressure, tire temperature, and the acceleration experienced by the tires during operation.

[0005] In most cases, such information is obtained through sensors installed in the vehicle tire, for example through the use of acceleration sensors, pressure sensors or temperature sensors, whereby the data obtained in this way can be used, for example, to predict or calculate the physical condition of the vehicle tire, such as the wear that has already occurred or the subsequent retreadability.

[0006] The tire pressure sensors installed in vehicle tires must be configured for their specific application and for communication with other vehicle components. This requires, for example, suitable software that controls the operation of the individual components of the sensor unit, the processing of the sensor data, and communication with external transmitters and receivers. These external receivers, sometimes also referred to as control units, which collect and process the sensor data transmitted by the tire pressure sensors, are typically located on or inside the vehicle.

[0007] With growing awareness of the importance of cybersecurity, the risk of unauthorized manipulation of tire pressure sensors and the measurement data they store, as well as manipulation of data transmission and processing, is increasingly coming into focus. Given the growing relevance of tire sensor data for controlling and optimizing vehicle operation, and the increasing importance of documenting the stresses experienced by vehicle tires, such manipulation can cause significant damage. It is particularly crucial for tire pressure monitoring systems (TPMS) to reliably detect any significant pressure drop.

[0008] In this process, different parts of the data acquisition and transmission are susceptible to manipulation attempts in different ways, whereby targeted security measures can be taken in each case, for example by encrypting the communication between the tire sensors and the control unit.

[0009] Especially in many commercial vehicles, such as trucks, the control units are relatively easily accessible from the outside or at least responsive via wireless communication at close range. Tampering with the control unit can lead to pressure warnings no longer being detected. Therefore, it is important to detect such tampering and, if necessary, prevent it. The solutions known from the prior art are, in many cases, considered disadvantageous in this respect.

[0010] The primary objective of the present invention was to eliminate or at least reduce the disadvantages of the prior art.

[0011] In particular, the object of the present invention was to provide a method for verifying the integrity of an electronic data processing device, which is part of a tire monitoring system, in a vehicle system, with which the integrity of the corresponding electronic data processing device can be reliably verified in order to ensure the trustworthiness of the tire information processed therein.

[0012] It was an objective of the present invention to ensure that the specified method should be as easy to implement as possible, particularly using components that are already in use in modern vehicles.

[0013] A further objective of the present invention was to ensure that the method could be implemented in the most energy-efficient manner possible, so that the energy consumption of the data processing devices involved would be as low as possible. Furthermore, it was an objective of the present invention that the method should ideally also be as data-efficient as possible, so that any data transmission costs could be minimized.

[0014] Furthermore, it was an object of the present invention that the specified method should preferably be able to prevent unauthorized manipulation of the electronic data processing device, and it was particularly desirable that the specified method should enable automatic restoration of the correct state.

[0015] A further objective of the present invention was to provide, based on the specified method for verifying the integrity of the electronic data processing device, a method for changing the configuration of the electronic data processing device in a corresponding vehicle system, with which the configuration of the electronic data processing device can be changed in a controlled manner by an authorized user, so that the corresponding security mechanisms can be circumvented.

[0016] Furthermore, it was an object of the present invention to provide a vehicle system optimized for use in the specified method. The inventors of the present invention have now found that the aforementioned problems can be solved if, in addition to the configuration information of the vehicle-side data processing device, reference information about the configuration of the vehicle-side data processing device is also stored in an electronic data processing system separate from the vehicle, and the corresponding configuration information or...Reference information is exchanged between the vehicle-side data processing device and the separate data processing system in such a way that it can be compared with each other, so that one or more suitable reaction measures can be triggered in the vehicle system depending on whether this comparison results in a match or not, as defined in the claims.

[0017] The aforementioned problems are thus solved by the subject matter of the invention as defined in the claims. Preferred embodiments of the invention are described in the dependent claims and the following descriptions.

[0018] Such embodiments, which are hereinafter referred to as preferred, are combined in particularly preferred embodiments with features of other embodiments referred to as preferred. Combinations of two or more of the embodiments referred to below as particularly preferred are therefore especially preferred. Also preferred are embodiments in which a feature of one embodiment, referred to as preferred to any extent, is combined with one or more further features of other embodiments, which are referred to as preferred to any extent. Features of preferred vehicle systems result from the features of preferred methods.

[0019] Particularly preferred embodiments of the invention are disclosed in the exemplary embodiments. Particularly preferred embodiments of the invention have two or more, preferably three or more, and most preferably four or more, of the preferred features of the invention disclosed below, which are also implemented in the exemplary embodiments.

[0020] The invention relates to a method for verifying the integrity of an electronic data processing device in a vehicle system, comprising: i) a vehicle, ii) one or more system vehicle tires arranged on the vehicle, each comprising one or more electronic sensor units for acquiring tire information from the system vehicle tires, iii) an electronic data processing device arranged in or on the vehicle, with a first storage unit and configuration information stored thereon concerning the configuration of the

[0021] data processing device, and iv) an electronic data processing system separate from the vehicle, comprising a second storage unit and reference information stored thereon concerning the configuration of the data processing device, comprising the following steps: a) transmitting the tire information acquired by the sensor units to the data processing device, b) processing the transmitted tire information with the data processing device and / or the data processing system, and the following steps: c) transmitting the configuration information from the

[0022] data processing device to the data processing system and / or the reference information from the data processing system to the

[0023] a) data processing device by means of a transmission signal using a wireless data transmission method, and d) comparison of the configuration information with the reference information by the data processing system or data processing device, triggering one or more response actions depending on whether the comparison results in a match or not.

[0024] The method according to the invention serves to verify the integrity of an electronic data processing device in a vehicle system, i.e., to check whether the corresponding data processing device and the software running on it are free from manipulation.

[0025] The method is carried out on a vehicle system, which initially comprises a vehicle. An advantage of the method according to the invention is that it can be efficiently adapted to all possible types of vehicles. An exemplary method according to the invention is given, wherein the vehicle is a commercial vehicle or a bus, preferably a commercial vehicle, and particularly preferably a truck.

[0026] According to the invention, the vehicle comprises one or more system vehicle tires arranged on the vehicle. The term "system vehicle tires" indicates that these are vehicle tires whose specific design makes them suitable for interaction within the vehicle system or in the method according to the invention. In principle, advantages can be achieved with the method according to the invention even if only one of the vehicle's tires is designed as a system vehicle tire. However, it is readily understood by those skilled in the art that for the vast majority of practical applications, it will be preferable to equip the vehicle as comprehensively as possible with such system vehicle tires that can be used in the method according to the invention.A preferred method according to the invention comprises two or more, preferably four or more, system vehicle tires arranged on the vehicle, wherein all vehicle tires of the vehicle are particularly preferably system vehicle tires. A preferred method according to the invention is generally one in which the system vehicle tires are pneumatic tires. A preferred method according to the invention is additionally or alternatively one in which the sensor units are arranged at least partially, preferably predominantly, and particularly preferably entirely, inside the vehicle tire, preferably on the inner layer of a pneumatic tire, and particularly preferably in the radial direction below the tread.

[0027] The suitability of the system vehicle tires for use in the method according to the invention arises in particular from the fact that they each comprise one or more electronic sensor units with which sensor data can be acquired. Within the scope of the present invention, this sensor data is referred to as "tire information". It can be seen as an advantage of the present invention that a wide range of electronic sensor units, already used in the prior art, can be used for equipping the system vehicle tires. Of particular importance here, in addition to acceleration and deformation sensors, are temperature sensors and pressure sensors.Among the possible sensor units, pressure sensors are of particular importance due to their high relevance to driving safety, so that the inventive method offers particularly pronounced advantages, especially when the system vehicle tires include pressure sensors.A preferred method according to the invention is one in which the electronic sensor units are selected from the group consisting of temperature sensors for detecting tire temperature, acceleration sensors for detecting acceleration, pressure sensors for detecting tire pressure, and deformation sensors for detecting tire deformation. Preferably selected are sensors from the group consisting of temperature sensors for detecting tire temperature, acceleration sensors for detecting acceleration, and pressure sensors for detecting tire pressure. Particularly preferred are sensors from the group consisting of acceleration sensors for detecting acceleration and pressure sensors for detecting tire pressure. Most particularly preferred are sensors from the group consisting of pressure sensors for detecting tire pressure.

[0028] By using multiple sensor units per system vehicle tire, it is advantageously possible to acquire very comprehensive data about the system vehicle tires. This makes it particularly possible to create a broad data foundation on which, for example, the vehicle control can be optimized or the condition of the vehicle tires can be assessed. A preferred method according to the invention is therefore one in which the system vehicle tires each comprise two or more, preferably three or more, electronic sensor units. A particularly preferred method according to the invention is one in which the sensor units of the system vehicle tires are each integrated into a single component.

[0029] A combination of sensor units that has proven particularly advantageous for use in the method according to the invention is the combination of an acceleration sensor with a pressure sensor. While the pressure sensor serves to detect the tire pressure, which is particularly relevant for safety, the acceleration sensor can be used, for example, to register the vehicle starting up. This makes it possible to identify reference points in the vehicle's movement behavior, depending on which the execution of process steps c) and d) can be carried out. A preferred method according to the invention therefore includes at least one acceleration sensor for detecting the experienced acceleration and at least one pressure sensor for detecting the tire pressure.

[0030] In addition to the specifically equipped system vehicle tires, the vehicle system also includes an electronic data processing device, which is often referred to by those skilled in the art as a "control unit." According to the invention, this control unit is arranged in or on the vehicle and moves with it. The method according to the invention offers particularly significant advantages in cases where the vehicle-side data processing device is arranged externally in such a way that it is relatively easily accessible from the outside. Such an arrangement offers particular advantages in the management of commercial vehicle fleets, as the control units are comparatively easy for fleet operators to access.At the same time, however, this type of arrangement also increases the risk of unintentional manipulation, for example at a motorway service area, so that the advantages of the method according to the invention become particularly pronounced. A method according to the invention is therefore conceivable in which the electronic data processing device is arranged inside the vehicle. However, a method according to the invention in which the electronic data processing device is arranged on the vehicle is preferred, and preferably the electronic data processing device is accessible from outside the vehicle.

[0031] In the method according to the invention, the tire information acquired by the sensor units is transmitted to the data processing device, as is known in principle from the prior art for corresponding systems. Even if it would theoretically be possible to transmit the corresponding tire information to the data processing device via appropriate cabling, the establishment and long-term reliability of such a signal-conducting connection to the sensor units arranged in the vehicle tire is very challenging in many cases. Therefore, for the vast majority of applications, it is preferred that the system vehicle tires include means for wireless communication, in particular as part of the electronic sensor units or a sensor system formed by the electronic transmitter units.A preferred method according to the invention is one in which the system vehicle tires comprise an electronic transmitter for sending signals in the wireless communication method. A particularly preferred method according to the invention is one in which the wireless communication method is a radio method, preferably using a frequency of 433 MHz or Bluetooth. Similarly, a preferred method according to the invention is one in which the electronic data processing device comprises an electronic receiver for receiving signals in the wireless communication method.

[0032] The tire information transmitted in process step a) corresponds to the measurement parameters that can be acquired by the electronic sensor units. Additionally or alternatively, the transmitted tire information can also include information about which tire it originates from, for example, via an identification of the sensor units, and / or the position of the system vehicle tires in the vehicle's tire layout. A preferred method according to the invention is one or more in which the one or more transmitted tire information components are selected from the group consisting of tire pressure, tire deformation, acceleration experienced by the sensor unit, and tire temperature.Preferably, or alternatively, a method according to the invention is used, wherein the one or more transmitted tire information pieces include assignment information about the assignment of the transmitted tire information to the tire positions of the vehicle.

[0033] Up to this point, the vehicle-side components of the vehicle system have been defined. However, the vehicle system also includes an electronic data processing system, which is not located in or on the vehicle, but is separate from it. In the inventive method, this external data processing system can be used both for verifying integrity via the reference information, as described below, and for processing the transmitted tire information. The clarification that it is a "system" expresses that the different contributions of the data processing system can, in principle, be made by different data processing units, so that the corresponding verification does not have to be performed by the same computing units as the potential processing of tire information.A preferred method according to the invention comprises a server and / or a cloud. A preferred method according to the invention further or alternatively comprises a component of a fleet management system, preferably a tire pressure monitoring system of a fleet management system. A preferred method according to the invention further or alternatively comprises two or more electronic data processing devices interconnected in a network.

[0034] The method according to the invention requires that the vehicle-side data processing device can communicate with the external data processing system, which is achieved according to the invention by means of a wireless data transmission method. It is therefore a method according to the invention, wherein the electronic data processing device comprises an electronic transmitter for sending signals in the wireless data transmission method.

[0035] Although it would theoretically be conceivable to carry out the methods according to the invention solely with short-range data transmission methods, the inventors consider it preferable for essentially all embodiments if the communication between the data processing device and the data processing system takes place using long-range communication methods, in particular radio methods that rely on transmission towers and / or satellites. Accordingly, a method according to the invention is preferred in which the wireless data transmission method is a radio method, preferably a tower-based radio method and / or a satellite-based radio method, most preferably a mobile communication method.

[0036] From a cybersecurity perspective, wireless communication between the data processing device and the data processing system represents a potential vulnerability. Therefore, the inventors propose that, to increase the security of the data transmission method, an encrypted method should be used, for example, an encrypted mobile communication method, which cannot be easily read and / or manipulated by third parties. A method according to the invention is thus preferred, wherein the wireless data transmission method is an encrypted data transmission method, preferably an encrypted mobile communication method.

[0037] Since the inventive method already establishes communication between the vehicle-side data processing device and the data processing system, the processing of the transmitted tire information can be carried out, at least partially, by the data processing system, i.e., centrally, for example, in the cloud or within the framework of a tire management system. Advantageously, this reduces the performance requirements of the vehicle-side data processing device and enables fleet managers to track the recorded data in near real-time.It is fundamentally possible for the tire information provided by the system vehicle tires to be preprocessed in the vehicle's data processing device, for example, by modifying the file format or data structure, so that derived values ​​are obtained. Within the scope of the present invention, and in accordance with the understanding of those skilled in the art, this does not alter the fact that it is tire information. In other words, the term "tire information" also includes information generated from it during data processing. Thus, a method according to the invention is conceivable in which the processing of the transmitted tire information is carried out by the data processing device. However, a method according to the invention in which the processing of the transmitted tire information is carried out by the data processing system is preferred.A preferred method is additionally or alternatively a method according to the invention in which the one or more tire information pieces transmitted to the data processing device are further transmitted to the data processing system by means of a wireless data transmission method.

[0038] The foregoing explanations deal in particular with the vehicle system to be used and the transmission of the tire information acquired by the sensor units in the system vehicle tires between the various components of the vehicle system. The verification of the integrity of the electronic data processing device is carried out in the method according to the invention, in particular in process steps c) and d).

[0039] The starting point of this part of the procedure is configuration information stored on a first storage unit assigned to the electronic data processing device. This configuration information correlates with the current configuration state of the data processing device. In principle, this configuration information can be arbitrarily detailed; at least theoretically, it would even be conceivable to consider the complete software and data state of the data processing device as configuration information. Since the corresponding configuration information, or...Since a complementary reference information must be transmitted at least once in the inventive method by means of a wireless data transmission method, it is particularly preferred in essentially all embodiments to abstract the configuration information in a certain way in order to keep the amount of data to be exchanged as small as possible.

[0040] In principle, it is conceivable to focus on the integrity of the data processing device's software and to specify a "checksum" as configuration information, which can be calculated from the entire software configuration using an algorithm. However, this focus on the operating software means that manipulations consisting solely of the stored data could go undetected. In particular, changes to the tire assignment stored in the data processing device pose a risk of unwanted manipulation, which is why it is preferable to additionally or alternatively include this information in the configuration information. A method according to the invention is therefore preferred, wherein the configuration information includes information about the version of the data processing device's operating software.A preferred method according to the invention is additionally or alternatively a method wherein the configuration information includes or consists of information about the design of the vehicle system stored in the data processing device, wherein the configuration information preferably includes or consists of information about the assignment of the system vehicle tires or the sensor units to the tire positions of the vehicle stored in the data processing device, preferably in the form of the assignment of identification information of the system vehicle tires or the sensor units to the tire positions of the vehicle.

[0041] According to the inventors, a particularly advantageous and energy-efficient design of the configuration information can be achieved by recording the configuration information in the form of a change counter, the numerical value of which is incremented with each change, for example, to the software or the stored data, such as tire assignment, in order to record the sheer number of change processes. A preferred method according to the invention is therefore one in which the configuration information includes or consists of information about the number of previous changes to the configuration of the data processing device, preferably in the form of a counter, wherein the counter is preferably incremented with each change.

[0042] The electronic data processing system, separate from the vehicle, comprises a second storage unit on which reference information is stored. This reference information also correlates with the configuration of the vehicle's data processing device and corresponds, in particular, to the configuration information at a previous point in time when the configuration was last defined as correct, preferably the most recent configuration of the data processing device that was defined as correct. Those skilled in the art understand that the reference information correlates with the configuration information, in particular in that it relates to the same aspects that are also contained in the configuration information, and that, to avoid conversions, it is advantageous for the reference information to be stored in the same data format as the configuration information.The reference information stored in the second storage unit serves as a benchmark for determining whether unauthorized manipulation has occurred. For this reason, the inventors consider it particularly advantageous, with a view to maximizing cybersecurity, if the reference information on the second storage unit is comprehensively protected against unauthorized modification. Specifically, a method according to the invention is preferred in which the second storage unit is secured against unauthorized access, preferably by a password and / or a digital key and / or multi-factor authentication.

[0043] In process step c), the configuration information or the reference information is exchanged such that either the data processing device or the data processing system has both pieces of information available in order to execute the subsequent step d). The inventors have recognized that it is particularly advantageous to execute the method according to the invention in a resource-efficient manner, especially in a data-efficient manner, and propose for this purpose that the length of the transmission signal used for data exchange should be kept as short as possible, which is advantageously achieved by the configuration information described above.

[0044] Reference information becomes possible. A preferred method according to the invention is therefore one in which the transmission signal consists of 1 to 8 bytes, preferably 4 to 8 bytes.

[0045] A method according to the invention is generally preferred, wherein at least the process steps c) and d) are repeated at time intervals.

[0046] To carry out the inventive method in the most resource-efficient way possible while simultaneously ensuring a high level of security against manipulation, the inventors propose that a middle ground should be found between frequent execution of the method, which ensures a high level of security against manipulation, and infrequent execution of the method, which minimizes the resources required. In the inventors' opinion, a particularly good solution to this conflict of objectives can be achieved if the corresponding data transmission is linked to a predetermined trigger criterion. A preferred method according to the invention is one in which the transmission in process step c) occurs when the vehicle system detects the occurrence of a predetermined trigger criterion.

[0047] In a particularly simple embodiment, the method according to the invention can be carried out at predetermined time intervals, for example daily. In this case, a method according to the invention is preferred in which the predetermined trigger criterion is a time-based trigger criterion, preferably the elapsed time since the transmission of the last status signal and / or the reaching of a predetermined time.

[0048] The inventors consider it particularly preferable if the trigger criterion is selected such that verification of the vehicle's data processing device takes place at predetermined vehicle states, especially when the ignition is switched on and / or the vehicle starts moving, the latter being particularly efficient if it is also achieved by observing the acceleration values ​​detected by acceleration sensors arranged in the vehicle tires. A preferred method according to the invention is thus one in which the predetermined trigger criterion is a change in the vehicle's state, preferably the vehicle being switched on. An additionally or alternatively preferred method according to the invention is one in which the predetermined trigger criterion depends on at least one of the detected tire information, preferably at least on the acceleration, wherein the predetermined trigger criterion preferably indicates or correlates with the vehicle starting moving.

[0049] Another advantageous embodiment, which can be set in addition to or as an alternative to the other trigger criteria, is to implement a request-based verification, in which the inventive process steps c) and d) are carried out as a result of a request signal, which can be triggered manually, for example by the fleet manager, to verify the authenticity of the data processing device if necessary. In this case, a method according to the invention is preferred, wherein the predetermined trigger criterion is the receipt of a request signal by the data processing device, and the request signal is preferably transmitted by the data processing system.

[0050] In process step d), the configuration information is compared with the reference information, either in the data processing device or, preferably, in the external data processing system. Within the scope of the present invention, the comparison of the two pieces of information can also be partially indirect, by comparing the configuration information or the reference information with a value derived from the other piece of information. In accordance with the understanding of those skilled in the art, this may be necessary, for example, if the configuration information and the reference information first need to be converted into the same data format, although such an approach is less preferred. Furthermore, it is possible for those skilled in the art to convert the configuration information and / or the reference information by means of further data processing operations before the comparison.Accordingly, the aforementioned defined characteristic is to be interpreted broadly to mean that the comparison is carried out in a suitable form such that the comparison performed allows an assessment as to whether the configuration information currently present on the data processing device matches the reference information stored in the data processing system or not.

[0051] Depending on whether the comparison shows a match between the configuration information and the reference information, one or more reaction measures are triggered in the inventive method. In principle, it is conceivable to trigger a reaction measure if the comparison shows a match and therefore no manipulation has occurred. In such cases, for example, a green light in a display function can indicate that everything is OK. In particular, a reaction measure could be implemented to mark the transmitted tire information as trustworthy, for example, for storage purposes, so that it can be verified that no manipulation of the control unit was to be expected.A corresponding marking can, for example, be applied retroactively to all tire information acquired since the last execution of the inventive method. Thus, an inventive method is conceivable in which one or more reaction measures are triggered when the comparison reveals a match. A preferred method in which the one or more reaction measures include marking the previously transmitted and / or subsequently transmitted tire information as trustworthy is particularly advantageous.

[0052] Even though, as explained above, it is theoretically conceivable to trigger a reaction measure even after a successful reconciliation, in practice, with a view to ensuring the most unobtrusive process possible, which aims to provide drivers and fleet managers with only relevant information, it will be particularly important to trigger reaction measures only when the reconciliation indicates that manipulation is likely, for example, because the checksum does not match and / or an incremental counter is at the wrong value. Accordingly, a method according to the invention is preferred in which one or more reaction measures are triggered when the reconciliation does not yield a match.

[0053] The inventors propose that, in this case, information about the possible state of manipulation should be output, in particular via a suitable warning message. A preferred method according to the invention includes one or more response measures comprising the output of a warning signal, preferably an acoustic and / or visual warning signal, most preferably a visual warning signal, most preferably via a display device of the data processing device. An additionally or alternatively preferred method according to the invention includes one or more response measures comprising sending a warning message to one or more recipients via electronic communication, preferably via email or a short message service, in particular via SMS.

[0054] In addition to or as an alternative to issuing a warning, the response measure can consist of putting the data processing device into an error state. In such an error state, the data processing device can be appropriately prevented from readily using the recorded tire data and / or at least marked as unreliable, whereby, in principle, a complete blocking of processing and / or transmission is also conceivable. According to the inventors, this design, which involves initiating an error state, is preferable in many cases to the use of automatic corrective measures that attempt to restore the original configuration state.This is because, in practice, it is a not unlikely scenario that the detected configuration change was indeed intentional and should have been authorized, but the necessary adjustment of the reference information was omitted. Triggering an error state makes it possible to check whether the detected manipulation was in fact authorized, in order to subsequently adjust the reference information if necessary. A preferred method according to the invention therefore includes one or more reaction measures comprising placing the data processing device into an error state, wherein the data processing device in the error state is prevented from processing the tire information in the intended manner, in particular from displaying, evaluating, and / or transmitting the tire information.

[0055] The above-described design with the error state is particularly advantageous when, in practice, it can be assumed that planned changes to the configuration will occur from time to time. However, especially in cases where changes to the configuration are rather infrequent and / or are to be applied globally via the data processing system, as disclosed below, it is also considered preferable, for the implementation of a highly reliable and largely automated procedure, to provide for an automatic reversion of the configuration state to the last verified configuration stored in the data processing system.For many embodiments, a method according to the invention is preferred, wherein one or more reaction measures comprise at least partially, preferably completely, resetting the configuration of the data processing device to a reference configuration, wherein the information used for the reset is preferably stored on the second storage unit.

[0056] The inventors recognized that, particularly in fleet management systems with many vehicles, there can be a time lag between changing the configuration of the data processing device and thus the configuration information on the one hand, and adjusting the stored reference information on the other, for example, when the different work steps are carried out by different workers or when individual workers are required to make a change directly on the vehicle as well as a change on a separate computer.To circumvent this problem, the inventors propose that the triggering of response measures can be linked to the failure to authorize the data processing system within a predetermined time window, for example, within 12 hours, after a detected discrepancy between the information. Advantageously, the inventive method can be repeated after the configuration change has been approved and the reference information has been adjusted accordingly, in order to verify the now correct state. This design also allows for bridging everyday practical problems, such as a short-term failure of wireless communication with the data processing system.A preferred method according to the invention is therefore one in which one or more reaction measures are triggered if the comparison does not yield a match, and the reaction measures are not prevented within a predetermined time window, preferably by adjusting the reference information. As explained above, it will be necessary from time to time in later practice to make configuration changes to the data processing device. To prevent such authorized configuration changes from triggering unintended reaction measures, it is necessary to adjust the reference information.

[0057] The invention also relates to a method for changing the configuration of the electronic data processing device in a vehicle system, comprising the method steps of the inventive method for verifying the integrity of an electronic data processing device, as well as the steps: e) changing the configuration of the data processing device and the configuration information stored in the first storage unit, and f) changing the reference information stored in the second storage unit.

[0058] According to the inventors, two main versions of this process are possible, differing in which change is effected first.

[0059] In a particularly preferred embodiment, the reference information is adjusted first, before the configuration of the data processing device and, consequently, the configuration information are changed. In particularly preferred embodiments, the corresponding change can be effected via the data processing system, for example, by the system making a corresponding change to the data processing devices via the wireless data transmission method in order to bring them into line with the reference information. A preferred method according to the invention is one in which the change to the reference information stored in the second storage unit takes place before the change to the configuration of the data processing device and the configuration information stored in the first storage unit.Particularly preferred is a method according to the invention in which the change in the configuration of the data processing device and the configuration information stored in the first storage unit is initiated or caused by a change signal transmitted from the data processing system to the data processing device.

[0060] Alternatively, it is conceivable to first change the configuration of the data processing device and then adjust the reference information accordingly. In this embodiment, the change made can be transmitted to the data processing system, i.e., the "backend," to request an adjustment of the reference information. The corresponding adjustment is expediently linked to an additional approval, for example, by the fleet manager verifying the change and consequently adjusting the reference information. A preferred method according to the invention is therefore one in which the change to the configuration of the data processing device and the configuration information stored in the first storage unit occurs before the change to the reference information stored in the second storage unit.A particularly preferred method according to the invention is one in which the change to the reference information is initiated or effected as a result of a change signal transmitted from the data processing device to the data processing system. A particularly preferred method according to the invention is one in which the change to the reference information as a result of the change signal transmitted from the data processing device to the data processing system only occurs if the change is confirmed as a permitted change, preferably within a predetermined time window.

[0061] In light of the foregoing, the person skilled in the art understands that the invention also relates to a vehicle system designed for use in a method according to the invention. The invention thus also relates to a vehicle system, in particular for use in a method according to the invention, comprising: i) a vehicle, ii) one or more system vehicle tires arranged on the vehicle, each comprising one or more electronic sensor units for acquiring tire information from the system vehicle tires, iii) an electronic data processing device arranged in or on the vehicle, with a first storage unit and configuration information about the configuration of the data processing device stored thereon, and iv) an electronic data processing system separate from the vehicle, with a second storage unit and reference information about the configuration of the data processing device stored thereon.wherein the vehicle system is configured to transmit the tire information acquired by the electronic sensor units to the electronic data processing device, wherein the vehicle system is configured to evaluate the transmitted tire information with the data processing device and / or the data processing system, wherein the vehicle system is configured to transmit the configuration information from the data processing device to the data processing system and / or the reference information from the data processing system to the data processing device by means of a transmission signal using a wireless data transmission method, wherein the vehicle system is configured to compare the configuration information with the reference information, and wherein the data processing system is configured to trigger one or more reaction measures depending on this.whether the comparison yields a match or not. The invention and preferred embodiments of the invention are explained and described in more detail below with reference to the accompanying figure. The figure shows:

[0062] Fig. 1 shows a schematic representation of a preferred vehicle system according to the invention for use in a method according to the invention.

[0063] Fig. 1 shows a schematic representation of a vehicle system 12 according to the invention for use in a method according to the invention.

[0064] The vehicle system 12 shown in Fig. 1 comprises a truck as vehicle 14, on which a total of six system vehicle tires 16a, 16b, 16c, 16d, 16e, 16f are arranged, each of which includes an electronic sensor unit 18a, 18b, 18c, 18d, 18e, 18f, each designed as a pressure sensor for measuring the tire pressure and arranged inside on the inner layer of the system vehicle tires 16a-f.

[0065] During operation of the vehicle system 12, the tire information acquired by the sensor units 18a-f is transmitted to the electronic data processing device 10 via a wireless communication method, for example, using Bluetooth. In the example shown in Fig. 1, the electronic data processing device 10 is arranged on the vehicle 14 in such a way that it is accessible from the outside. This communication between the electronic data processing device 10 and one of the electronic sensor units 18a is illustrated in Fig. 1 by a dashed arrow.

[0066] The electronic data processing device 10 in the preferred vehicle system 12 shown is configured to transmit the tire information received from the system vehicle tires 16a-f about the respective tire pressure in a wireless communication method, namely by means of mobile communication, to the data processing system 20, which forms the “backend” of a tire management system and is implemented as a cloud-based data processing system 20.

[0067] In the example shown in Fig. 1, the processing and, in particular, the storage of the transmitted tire information takes place in the external data processing system 20. The method described above for acquiring and processing tire information according to process steps a) and b) is now supplemented by process steps c) and d) to verify the integrity of the electronic data processing device 10. These process steps are executed multiple times during the operation of the vehicle 14 in the example shown, namely whenever a predetermined trigger criterion is detected. In the example shown in Fig. 1, the predetermined trigger criterion is linked to the ignition of the vehicle 14, so that process steps c) and d) are always carried out to verify integrity when the vehicle 14 is started.

[0068] The electronic data processing device 10 comprises a first storage unit (not shown) on which configuration information about the configuration of the electronic data processing device 10 is stored.

[0069] In the example shown in Fig. 1, this configuration information is formed by the "checksum" of the operating software of the data processing device 10 and the information about the design of the vehicle system stored in the data processing device 10, in particular about the assignment of the system vehicle tires 16a-f to the tire positions of the vehicle 14. In an alternative embodiment, however, the configuration information can also be implemented as an incremental counter, which counts the number of previous changes to the configuration of the data processing device 10.

[0070] The electronic data processing system 20 includes, on a second storage unit (not shown), reference information complementary to the configuration information. In the example shown, this reference information includes the "checksum" of the most recent authorized operating software and the last authorized assignment of the system vehicle tires 16a-f to the tire positions of the vehicle 14. The reference information is protected against unauthorized changes on the second storage unit by means of two-factor authentication.

[0071] To carry out the verification, either the configuration information is transmitted to the data processing system 20 or the reference information is transmitted to the data processing device 10, whereby the transmission in the example shown in Fig. 1 is carried out by means of encrypted data transmission.

[0072] In the example shown in Fig. 1, the configuration information is compared with the reference information in the data processing system 20. The vehicle system 12 is designed such that a successful comparison, indicating a match of the corresponding information, does not trigger any immediate action. Action is only taken if a discrepancy between the configuration information and the reference information is detected. In the example shown in Fig. 1, the responsible persons, in particular the driver and the fleet manager, receive a warning message on their mobile phones via a text message service in the event of a discrepancy. Meanwhile, the data processing device 10 is put into an error state in which it no longer transmits the recorded tire information to the data processing system 20, in order to prevent consequential damage from potential data manipulation.

[0073] In the example shown in Fig. 1, the vehicle system 12 is designed such that the discrepancy between the configuration information and the reference information automatically triggers the inventive method for changing the configuration of the electronic data processing device 10 in the vehicle system 12, namely in that the differing configuration information, which is based on a configuration of the data processing device 10 that has changed compared to the reference information, is not discarded but is interpreted as a change signal with which the change of the reference information in the data processing system 20 is to be initiated or effected, which triggers a corresponding request to the responsible persons to authorize the detected change, so that only after authorization has been granted is an adjustment of the reference information in the data processing system 20 made.As a result of the adjustment, the repeated execution of the inventive method for verifying the integrity of the data processing device 10 leads to a match of the corresponding information, thereby resolving the error state.

[0074] The vehicle system 12 shown in Fig. 1 is also designed such that a change in the configuration of the data processing device can be initiated by the data processing system 20, so that a change in the reference information in the data processing system 20 necessitates the transmission of a change signal to the data processing device 10, with which the configuration and the corresponding configuration information are adapted to the change made in the "backend". List of reference symbols

[0075] 10 electronic data processing devices

[0076] 12 Vehicle systems

[0077] 14 Vehicle 16a-f System vehicle tires

[0078] 18a-f electronic sensor unit

[0079] 20 electronic data processing system

Claims

Claims 1. Method for verifying the integrity of an electronic data processing device (10) in a vehicle system (12), comprising: i) a vehicle (14), ii) one or more system vehicle tires arranged on the vehicle (14) (16a-f), each comprising one or more electronic sensor units (18a-f) for acquiring tire information from the system vehicle tires (16a-f), iii) an electronic data processing device (10) arranged in or on the vehicle (14), comprising a first storage unit and configuration information stored thereon about the configuration of the data processing device (10), and iv) an electronic device separate from the vehicle (14) Data processing system (20), with a second storage unit and a reference information about the configuration stored thereon. Data processing device (10), comprising the process steps of: a) transmitting the tire information acquired by the sensor units (18a-f) to the data processing device, b) processing the transmitted tire information with the data processing device (10) and / or the data processing system (20), and the process steps of: c) transmitting the configuration information from the Data processing device (10) to the data processing system (20) and / or the reference information from the data processing system (20) to the data processing device (10) by means of a transmission signal using a wireless data transmission method, and d) Comparison of the configuration information with the reference information by the data processing system (20) or data processing device, triggering one or more response actions depending on whether the comparison results in a match or not.

2. Method according to claim 1, wherein the electronic sensor units (18a-f) are selected from the group consisting of temperature sensors for detecting tire temperature, acceleration sensors for detecting experienced acceleration, pressure sensors for detecting tire pressure and deformation sensors for detecting tire deformation.

3. Method according to one of claims 1 or 2, wherein the configuration information includes information about the version of the operating software of the data processing device (10), and / or wherein the configuration information includes or consists of information about the design of the vehicle system (12) stored in the data processing device (10).

4. Method according to any one of claims 1 to 3, wherein the configuration information comprises or consists of information about the number of previous changes to the configuration of the data processing device (10).

5. Method according to any one of claims 1 to 4, wherein the second storage unit is a storage unit secured against unauthorized access.

6. Method according to any one of claims 1 to 5, wherein the transmission in method step c) takes place when the vehicle system (12) detects the occurrence of a predetermined trigger criterion.

7. The method of claim 6, wherein the predetermined trigger criterion is a time-based trigger criterion.

8. Method according to one of claims 6 or 7, wherein the predetermined trigger criterion is a change of state on the vehicle (14), and / or wherein the predetermined trigger criterion depends on at least one of the detected tire information, and / or wherein the predetermined trigger criterion is the receipt of a request signal by the data processing device (10).

9. Method according to any one of claims 1 to 8, wherein one or more reaction measures comprise issuing a warning signal, and / or wherein one or more reaction measures comprise sending a warning message to one or more recipients by means of electronic communication.

10. Method according to any one of claims 1 to 9, wherein one or more of the reaction measures comprises placing the data processing device (10) into an error state, wherein the data processing device (10) in the error state is prevented from processing the tire information in the intended manner, or wherein one or more of the reaction measures comprises at least partially resetting the configuration of the data processing device (10) to a reference configuration.

11. Method for changing the configuration of the electronic data processing device (10) in a vehicle system (12), comprising the method steps of the method for verifying the integrity of an electronic data processing device (10) according to any one of claims 1 to 10, and the steps: e) changing the configuration of the data processing device (10) and the configuration information stored in the first storage unit, and f) changing the reference information stored in the second storage unit.

12. Method according to claim 11, wherein the modification of the reference information stored in the second storage unit is performed before the modification of the configuration of the data processing device (10) and the configuration information stored in the first storage unit.

13. Method according to one of claims 11 or 12, wherein the changing of the configuration of the data processing device (10) and the configuration information stored in the first storage unit takes place before the changing of the reference information stored in the second storage unit.

14. Method according to claim 13, wherein the change of the reference information is initiated or effected as a result of a change signal transmitted from the data processing device (10) to the data processing system (20), wherein the change of the reference information as a result of the change signal transmitted from the data processing device (10) to the data processing system (20) only takes place if the change is confirmed as permitted changes.

15. Vehicle system (12), in particular for use in a method according to the invention, comprising: i) a vehicle (14), ii) one or more system vehicle tires (16a-f) arranged on the vehicle (14), each comprising one or more electronic sensor units (18a-f) for acquiring tire information from the system vehicle tires (16a-f), iii) an electronic data processing device arranged in or on the vehicle (14), comprising a first storage unit and configuration information about the configuration of the data processing device stored thereon, and iv) an electronic data processing system (20) separate from the vehicle (14), comprising a second storage unit and reference information about the configuration of the data processing device stored thereon, wherein the vehicle system (12) is configured toto transmit the tire information acquired by the electronic sensor units (18a-f) to the electronic data processing device (10), wherein the vehicle system (12) is configured to evaluate the transmitted tire information with the data processing device (10) and / or the data processing system (20), wherein the vehicle system (12) is configured to transmit the configuration information from the data processing device (10) to the data processing system (20) and / or the reference information from the data processing system (20) to the data processing device (10) by means of a transmission signal using a wireless data transmission method, wherein the vehicle system (12) is configured to compare the configuration information with the reference information, wherein the data processing system (20) is configured to trigger one or more response actions depending on whether the comparison yields a match or not.

Images