Method for operating a vehicle, data processing device, vehicle component and vehicle

Abstract

The invention relates to a method for operating a vehicle having a combination of at least two vehicle components. Each of the components comprises at least one component-specific authenticity key pair, comprising an authenticity private key and an authenticity public key corresponding to the authenticity private key, and a manufacturer signature of at least one authenticity public key. The vehicle component comprises an owner certificate having an owner public key and an owner signature. The vehicle component also comprises a rule set. The method comprises establishing an authenticity of a vehicle component of the at least two vehicle components on the basis of the manufacturer signature and the authenticity key pair, and establishing an authorisation of a vehicle component of the at least two vehicle components on the basis of the rule set.

Description

[0001] METHOD FOR OPERATING A VEHICLE, DATA PROCESSING EQUIPMENT, VEHICLE COMPONENT, AND VEHICLE

[0002] TECHNICAL AREA

[0003] The invention relates to vehicle components for a single- or multi-track vehicle, in particular a bicycle, pedelec, e-bike or bicycle with auxiliary drive, as well as a single- or multi-track vehicle, in particular a bicycle, pedelec, e-bike or bicycle with auxiliary drive. In particular, the invention relates to methods for establishing authenticity and authorization of vehicle components in a vehicle assembly, as well as the setup of the vehicle component, for example, for setting up the vehicle component to establish authorization and / or to prove ownership of the component.

[0004] STATE OF THE ART

[0005] Vehicles of this type include, for example, single-track or multi-track vehicles such as bicycles, in particular electric bicycles, e-bikes or pedelecs. Specifically, vehicles of this type are part of vehicle categories L1e, L2e, L3e, L4e, L5e, L6e and L7e according to Article 4 of EU Regulation 2013 / 168 / EU of 15 January 2013.Furthermore, this includes, in particular, vehicles with a design-related maximum speed of up to 6 km / h, vehicles intended exclusively for use in sporting competitions, pedal-powered bicycles with pedal assist, especially those equipped with an electric auxiliary motor with a maximum continuous rated power of up to 250 W, the assistance of which is interrupted when the rider stops pedaling, and whose assistance progressively decreases with increasing vehicle speed and is interrupted before the vehicle reaches 25 km / h, self-balancing vehicles with electric drive, pedal-powered sports vehicles, pedal-powered vehicles that do not have at least one seat, and pedal-powered vehicles with an R-point (according to ECE-R 17) <400 mm. Cargo bikes are also included.They often have a front wheel and at least one rear wheel connected by a frame. However, they can also have multiple rear wheels, for example, two rear wheels, and / or multiple front wheels, for example, two front wheels, especially in any combination. These can be arranged side-by-side, transversely to the direction of travel, as in a tricycle or a vehicle with a sidecar, or one behind the other in the direction of travel, as in a tandem bicycle. The front wheel is typically mounted to rotate around a front axle, and the rear wheel around a rear axle. Such vehicles are becoming increasingly common.

[0006] 34719P-WO - 18.08.2025 equipped with at least one electric motor designed to assist the user in propelling the vehicle. Typically, they are not powered solely by this electric motor; rather, the electric motor assists the user in propelling the vehicle using their own human muscle power. The level of assistance is usually selectable. In this way, a user can contribute precisely as much power as they are able or willing to while traveling at a comfortable and practical speed. Furthermore, vehicles of this type can also be autonomous vehicles, meaning vehicles that can operate without active driver input.

[0007] Such vehicles are often modular in design. For example, individual vehicle components, such as a battery, a navigation system, a measuring device, components of a transmission or gearbox, or other known components, can be easily replaced or added by a mechanic or even the user, which advantageously simplifies the maintenance and / or operation of the vehicles and advantageously increases the user's design freedom when configuring the vehicle.

[0008] However, a disadvantage of this is that as the functionality of vehicles or individual vehicle components increases, the vehicle or even individual vehicle components are more likely to be stolen by unauthorized persons, for example, to use or resell them illegally as used parts or equipment, or even as an entire vehicle or vehicle component assembly. Similarly, there is an increasing number of counterfeit vehicle components, which, due to inferior quality, can lead to reduced driving comfort for the user, or can be particularly detrimental due to an increased probability of failure or even an increased safety risk.

[0009] There is therefore a need for procedures for operating a vehicle and vehicle components that ensure that the components used in the vehicle are authentic and intended for use in that vehicle by the component's owner.

[0010] The methods, devices and products proposed here solve the aforementioned problem at least partially.

[0011] REVELATION OF THE INVENTION

[0012] The invention is defined by the independent claims. Advantageous embodiments are described in the dependent claims, the description, and the drawings.

[0013] 34719P-WO - 18.08.2025 According to one aspect, a method for operating a vehicle with a system of at least two vehicle components is described. Each component includes at least one component-specific authentication key pair, comprising an authentication private key and an authentication public key corresponding to the authentication private key, as well as a manufacturer signature of at least one authentication public key. The manufacturer signature is based on a manufacturer private key. The vehicle component includes an owner certificate with an owner public key and an owner signature. The owner signature is based on an owner private key. The vehicle component also includes a rule set.The process comprises the communicative linking of at least two vehicle components for data exchange between them, the establishment of authenticity for one of the two vehicle components based on the manufacturer's signature and the authenticity key pair, and the establishment of authorization for one of the two vehicle components based on the rule set. Provided that the establishment of authenticity for the first vehicle component is successful, the process includes activating the second of the two vehicle components. Provided that the establishment of authorization for the first vehicle component is successful, the process includes activating the first vehicle component.

[0014] According to one aspect, a procedure for setting up a vehicle component for a modular vehicle is described. The procedure includes storing an initial owner private key in a memory of a data processing device, creating instructions to change a release and / or ownership property of the vehicle component, signing the instructions using the initial owner private key, transmitting the signed instructions to the vehicle component, verifying the signature of the signed instructions by the vehicle component, and storing the release and / or ownership property in a memory of the vehicle component.

[0015] According to one aspect, a data processing device is described. The data processing device includes a memory containing a first owner private key. The data processing device is configured to execute a procedure described herein for setting up a vehicle component, in particular creating instructions to change a release and / or ownership property of the vehicle component, and to transmit the instructions directly or indirectly to the vehicle component.

[0016] According to one aspect, a vehicle component for a modular vehicle is described. The vehicle component comprises a primary functional module and a controller. The controller includes a processor and an interface to

[0017] 34719P-WO - 18.08.2025 Communication with other vehicle components of the modular vehicle, and a memory accessible by the processor. The memory contains a component-specific authentication key pair, comprising an authentication private key and an authentication public key corresponding to the authentication private key, and a manufacturer signature of at least the authentication public key. The manufacturer signature is based on a manufacturer private key. The memory also includes a component-specific owner certificate, comprising an owner public key corresponding to an owner-specific owner private key, and an owner signature of the owner certificate. The owner signature is based on the owner private key. The memory also includes a rule set and a computer program tool readable by the processor.The computer program comprises instructions which, when executed by the processor, cause the controller to perform the following steps: establishing a communicative connection with at least one other vehicle component of the modular vehicle via the interface, establishing the authenticity of the other vehicle component based on the manufacturer's signature and the authenticity key pair, and establishing authorization for the vehicle component based on the rule set. Provided that the mutual establishment of authenticity and authorization is successful, the controller is configured to activate the primary functional module for use in the vehicle.

[0018] A vehicle is described according to one aspect. The vehicle is, in particular, a single- or multi-track vehicle of the type bicycle, pedelec, e-bike, or bicycle with auxiliary drive, comprising a multitude of vehicle components according to one of the aspects and / or embodiments described herein. The multitude of vehicle components is configured to execute a method described herein according to the aspects and / or embodiments. The vehicle may, in particular, be a further development of a vehicle according to the prior art described in the introduction.

[0019] According to one aspect of the present invention, key pairs are described. In particular, an authentication key pair comprising an authentication private key and an authentication public key, as well as an ownership key pair comprising an ownership private key and an ownership public key, are described. The keys and key pairs described herein are data constructs suitable for use in an asymmetric cryptosystem. Such cryptosystems are known to those skilled in the art and include, for example, RSA, Merkle-Hellman, McEliece, Rabin, Chor-Rivest, Elgamal, and elliptic curve cryptography (ECC). The aforementioned systems are not intended to be an exhaustive list, and in particular, other systems and / or combinations thereof are also possible.

[0020] 34719P-WO - 18.08.2025 According to one aspect, a data packet can be encrypted with a public key, such that the encrypted data packet can only be decrypted with the corresponding private key. According to another aspect, a data packet can be encrypted with a private key, such that it can be decrypted with the corresponding public key. According to another aspect, a public key can be created based on the private key if the private key is known, but a private key cannot be created based on the public key. According to another aspect, a (digital) signature of a data packet can include the encryption of the data packet with a private key, so that verification of the signature or the data packet is possible if the public key corresponding to the private key is known.According to one aspect, challenge-response authentication can involve encrypting a data packet with a public key, so that decrypting the encrypted data packet with the corresponding private key ensures that the decrypting device is in possession of the private key. Further properties and uses of an asymmetric cryptosystem are known to those skilled in the art.

[0021] According to one aspect of the present invention, ownership and / or ownership of vehicle components are described. In the context of this disclosure, an owner of the vehicle component is the person who possesses an owner's private key and whose corresponding owner's public key is stored in a memory location of the vehicle component. The owner may have more rights to configure the vehicle component compared to a non-owner. Typically, the owner corresponds to the legal owner of the vehicle component; however, this is not necessarily the case, so the owner stored in the vehicle component may, at least temporarily, also be a non-owner, possessor, or even someone who does not possess the vehicle component.

[0022] DESCRIPTION OF THE DRAWINGS

[0023] The invention is explained in more detail below with reference to the embodiments shown in the figures. The figures schematically show:

[0024] Fig. 1 shows a vehicle with a plurality of vehicle components according to one embodiment;

[0025] Fig. 2 shows a vehicle component according to one embodiment;

[0026] Fig. 3 is a diagram illustrating the data stored in a memory of a vehicle component according to one embodiment;

[0027] Fig. 4 shows a method for establishing the authenticity of a vehicle component according to embodiments;

[0028] 34719P-WO - 18.08.2025 Fig. 5 a method for establishing authorization of a vehicle component according to embodiments;

[0029] Fig. 6 shows a method for changing ownership according to a

[0030] Design;

[0031] Fig. 7 shows a method for changing ownership according to a

[0032] embodiment; and

[0033] Fig. 8 shows a method for changing ownership according to a

[0034] Design.

[0035] DESCRIPTION OF EXAMPLES OF EXECUTION

[0036] Fig. 1 shows a means of transport F, specifically a bicycle, and in particular a pedelec. The means of transport can be driven simultaneously by an electric motor and by human muscle power, in particular in such a way that the drive from human muscle power is supported by an electric motor. The means of transport F comprises, in a known manner, a vehicle frame 100T and two drive units 102, specifically a front wheel and a rear wheel. The pedal axle is located in the middle and at the lower end of the frame 100T. The wheel axle is located at the connection point of the frame 100T with the rear wheel. Figure 1 shows an embodiment in which a drive unit 1003 is designed as a central drive unit and is located on the pedal axle. Human muscle power is introduced directly into the drive unit 1003 via the crankshaft.The drive unit 1003 is connected to the rear wheel for power transmission via a traction element, for example a chain or a belt.

[0037] The means of transport F comprises several vehicle components 100^6 (collectively 100) which are integrated into the vehicle F in a vehicle component network. In particular, the vehicle components interact with each other through the exchange of data, signals, electrical and / or mechanical power, and / or mechanical fastening, such that the functionality of the vehicle F is ensured.

[0038] For example, the vehicle frame 100T can be configured to fix other vehicle components and can also include means for transmitting electrical power and / or signals between other components, for example, between the drive unit 1003 and the battery 1006. For example, the frame can be configured for transmitting data in a bus, for example, a CAN bus, between interfaces of the vehicle components 100, for example, in data lines provided therein. For example, a gearbox 1002 and / or a circuit 1004 can be electrically controllable and / or include sensors for detecting an operating state and / or telemetry data. For example, a battery 1006 can be inserted into the frame 100T in a particularly replaceable manner.

[0039] 34719P-WO - 18.08.2025 For example, a data processing unit 1005 can be configured for acquiring and / or displaying telemetry data, as a control unit, as a human-machine interface, and / or as a navigation device. Several or even all of the vehicle components 100 of the vehicle F can be designed to be interchangeable and / or even optional. Accordingly, the vehicle F is a modular vehicle.

[0040] An exemplary vehicle component 100 is shown in Fig. 2. The vehicle component 100 comprises a primary functional module 110, which provides the primary function of the vehicle component. For example, in the case of a battery-powered vehicle component, this module may be the battery's energy storage device, and in particular, control and / or converter modules of the battery. For example, in the case of a motor-powered vehicle component, this module may be the electric machine, and in particular, the associated control electronics. Further examples of primary functional modules, such as those of the vehicle components shown in Fig. 1, are obvious to those skilled in the art. For some vehicle components, such as the vehicle frame 100^, it may occur that no primary functional module is present in certain embodiments.Nevertheless, the invention described herein can also be applied to such vehicle components, since, for example, the functionality of other vehicle components with a primary functional module may depend on the controller 120 of the vehicle component without a primary functional module.

[0041] Vehicle component 100 includes a controller 120. The controller is configured to selectively activate or deactivate the primary function module 110. Specifically, the controller 120 is configured to activate the primary function module 110 (exclusively) on the condition that both the authenticity of other components 100 in the vehicle network and the authorization of component 100 have been confirmed. In particular, the controller 120 may be configured to execute a procedure described herein to establish and / or verify authenticity and authorization.

[0042] The controller 130 comprises a processor 130. The processor 130 is connected to a memory 150 in such a way that the processor can access data, programs, instructions, software, and / or other data constructs stored therein. In particular, the processor 130 is configured to access a computer program resource, such as software, stored in the memory 150. The computer program resource comprises instructions which, when executed by the processor 130, cause the controller 120 to execute one of the procedures described herein.

[0043] The controller includes an interface 140 for communication with other vehicle components of the modular vehicle F. The interface can also be configured to establish a communicative connection with an external

[0044] 34719P-WO - 18.08.2025 To manufacture a data processing device, for example a portable device such as a smartphone, a tablet or a (laptop) computer.

[0045] Interface 140 can be a wired interface and / or include wired components. In preferred embodiments, interface 140 is a wireless interface. In particular, interface 140 can be an interface for data transmission in a Wireless Personal Area Network (WPAN), for example, via radio. Interface 140 can be configured for data transmission according to a radio standard and / or wireless network standard, such as IEEE 802.15. Interface 140 can be a Bluetooth interface, for example, a Bluetooth Low Energy interface, or a Bluetooth 4.0, 4.1, 4.2, 5, 5.1, 5.2, 5.3, or 5.4 interface.In some embodiments, the interface can be configured to transmit data within a vehicle component network via a dedicated protocol, such as CAN and / or ISOTP, where the protocol may be a protocol layer superimposed on the network layer. In some embodiments, the interface 140 can be configured for communication in multiple network types. For example, the interface 140 can be configured for communication with, for instance, a data processing unit via a WPAN. Additionally, the interface 140 can be configured for wireless or wired communication with other vehicle components, for example, via CAN.

[0046] In Fig. 2, the controller 120, the processor 130, the interface 140, and the memory 150 are shown as discrete components. In further embodiments, two or more of these components can be combined in the form of one or fewer components, for example, in the form of system-on-a-chip architectures. Likewise, the primary functional module 110, for example, control units of the primary functional module 110, can be combined with the controller 120. For example, the controller 120 can be provided on the same circuit board as components of the primary functional module 110. For example, in addition to the functions described herein, the controller 120 can also include partial or even complete control of the primary functional module 110.

[0047] Figure 3 schematically shows a diagram 300 to illustrate the data or data constructs stored in the memory 150. It should be noted that Figure 3 is not intended to be restrictive regarding the underlying memory structure or the manner in which the data is stored therein. In particular, the memory 150 can be composed of several storage devices, for example, a combination of volatile and non-volatile memory. Specifically, the data constructs described below can be stored in various ways, i.e., in the form of numerous known data formats, or in derived formats, for example,

[0048] 34719P-WO - 18.08.2025 in a compressed and / or encrypted manner in memory 150.

[0049] Fig. 3 shows, in addition to the memory 150, the data processing units 324 and 344, which contain, for example, data in a memory of the respective data processing unit, in particular the private keys 320, 340, on the basis of which, for example, the signatures 322, 343 shown in Fig. 3 were created.

[0050] Memory 150 contains a component-specific authentication key pair 310, 312, unique to the vehicle component. This key pair comprises an authentication private key 310 and an authentication public key 312 corresponding to the authentication private key 310. The authentication public key 312 is provided with the digital signature 322 and, together with the manufacturer's digital signature 322, forms the authentication package 360. The authentication package 360 ​​may be an authentication certificate. In addition to the authentication public key, the authentication package 360 ​​may contain further data 330, such as information about the vehicle component, an identifier of the vehicle component, information about the entity that created the manufacturer's signature 322, and / or other information.In some embodiments, the authentication public key 312 can be understood as a unique identifier, such as a unique serial number, of the vehicle component 100. In some embodiments, an additional vehicle component identifier can be provided alongside the authentication public key 312. The authentication package 360 ​​can be individualized for each vehicle component. For example, a manufacturer signature 322 can include the unique identifier and / or the authentication public key 312, in particular so that the authentication package 360 ​​refers uniquely and exclusively to only one vehicle component 100. Advantageously, an individualized authentication package 360 ​​can create an individualized, component-specific chain of trust and / or guarantee the authenticity of each component in a vehicle assembly.

[0051] The manufacturer signature 322 of the authentication package 360 ​​was created by the data processing unit 324 based on the manufacturer's private key 320. The data processing unit 324 could be, for example, a computer, such as a server, belonging to the manufacturer of the vehicle component 100, where the data processing unit 324 is configured as a certification authority. In some embodiments, the data processing unit can also be a certification authority that, for example, within the framework of a chain of trust, has been authorized by a data processing unit 324, starting from a base manufacturer certificate, to create the signature 322. During the manufacturing of the vehicle component, for example, during firmware programming, the authentication package 360, as well as the authentication private key 310, can be installed in the memory 150.In particular, this can affect authenticity.

[0052] 34719P-WO - 18.08.2025 Package 360 ​​and the authentication private key 310 are installed in a part of memory 150 that allows only read access, especially since a change to the authentication package 360 ​​by the vehicle component 100 is not intended.

[0053] In some embodiments, the memory may contain a manufacturer public key 380 corresponding to the manufacturer private key 320. The manufacturer public key 380 may, for example, constitute part of the additional data 330. As shown in Fig. 3, the manufacturer public key may also be stored in an unsigned part of the memory 150. The manufacturer public key 380 may be used to verify the manufacturer signature 322 of the authentication package of the vehicle component 100 or other vehicle components. If multiple Certification Authorities or a dynamic chain of trust are expected, multiple manufacturer public keys may be stored in the memory 150.In some embodiments, for example when a user connects to the vehicle component 100 via the data processing device 344, current manufacturer public keys can be transferred from the data processing device 344 to the vehicle component 100.

[0054] The dotted line between the authentication private key 310 and the authentication public key 312 illustrates the relationship between the authentication key pair 310 and 312. For example, a second

[0055] Upon receiving the authentication public key 312, vehicle component 100 creates a challenge by encrypting a message with the authentication public key 312. Vehicle component 100 can then prove its possession of the authentication private key 312 by decrypting the message with the authentication private key 312. In some embodiments, the authentication private key 312 can be stored in a secure memory area, making access to it, e.g., by reading the memory, impossible or at least significantly more difficult.

[0056] Memory 150 contains an owner certificate 370. The owner certificate 370 includes an owner public key 342. The owner certificate 370 may contain further data 350, such as information about the vehicle component, an identifier of the vehicle component, an authenticity public key 312 of the vehicle component, information about the owner and / or the data processing device 344 by which the owner signature 343 was created, and / or other information, which may be component-specific. In some embodiments, the owner certificate 370 or part of the data contained therein, in particular the owner public key 342, may be understood as a unique identifier by which the owner of the component can be uniquely identified.The owner certificate 370 can be specific to the vehicle component 100, for example, by including a component identifier, such as the authenticity public key 312 of the vehicle component 100, in the further data 350.

[0057] 34719P-WO - 18.08.2025 Owner certificate 370 can contain information, such as the owner public key 342, which enables the verification of an electronic signature, in particular the verification of whether an electronic signature on a message was issued by the same owner who also created the electronic signature 343. Owner certificate 370 can enable vehicle component 100 to uniquely identify a potential user as the owner or as a user with owner privileges and to assign this user, in their owner identity, different privileges, such as the ability to change settings, permissions, rule sets, or other configurations, than, for example, a non-owner. Owner certificate 370 can also enable the vehicle component to identify itself to other vehicle components as being owned by a specific user.In particular, in embodiments it may be possible for the further vehicle component to verify the owner certificate 370, after it has been received by the further component, on the basis of the owner signature 343.

[0058] The owner signature 343 of the owner certificate 370 was created by the data processing device 344 based on an owner private key 340. The data processing device 344 may be, for example, a computer, such as a portable device like a smartphone, tablet, or laptop. The data processing device 344 is owned by the owner, preferably in such a way that the owner has sole control over it. Software, such as an app, may run on the data processing device 344, enabling the owner to set up, configure, transfer ownership of, create, or modify shares, particularly according to the procedures described herein.

[0059] The dotted line between the owner's private key 340 and the owner's public key 342 illustrates the relationship between the owner key pair 340 and 342. It is important to note that possession of the owner's private key 340 serves as proof of ownership to the vehicle component 100, or rather, the authorization necessary to obtain owner-specific functions. Advantageously, the owner retains sole control over the vehicle component simply by possessing the owner's private key 340 and is therefore independent of other infrastructure, such as a cloud system.

[0060] Memory 150 contains a rule set 390. The rule set 390 contains one or more rules based on which the behavior of the vehicle component 100 in a vehicle component assembly in the vehicle F can be defined. In the example shown in Fig. 3, the rule set 390 includes the permissions 392, 394. A permission 392, 394 can contain data that is indicative of authorization, disauthorization, or even a prohibition of the vehicle component. For example, the permission 392, 394 can contain data

[0061] 34719P-WO - 18.08.2025 contains a provision that allows the vehicle component to determine whether it is authorized or not authorized to provide the function of the primary function module 110 in a specific context, for example as a component in a specific vehicle component assembly and / or as a counterpart to a specific second vehicle component.

[0062] In particular, releases 392, 394 may include one or more vehicle identifiers, one or more owner identifiers of second vehicle components, and / or one or more component identifiers of a second vehicle component (collectively ‘identifier’), wherein the vehicle identifier, owner identifier and component identifier each represent the authorization (or non-authorization) for the vehicle, owner or component corresponding to the identifier.

[0063] The owner identifier of a second vehicle component can contain or be derived from the owner certificate of that second vehicle component or data contained therein. For example, the owner identifier can be representative of an owner, who may own multiple vehicle components and be identifiable for each of them by the owner identifier. For instance, the owner identifier could be the owner public key 342 of a second vehicle component.

[0064] The component identifier of a second vehicle component can contain or be derived from the authentication package 360 ​​of a second vehicle component or data contained therein. For example, the component identifier can be representative of a specific second component, where the component identifier is unique for the component and the component is uniquely identifiable by the component identifier. For example, the component identifier can be an authentication public key 312 of a second vehicle component.

[0065] The vehicle identifier can contain or be derived from the Authenticity Package 360 ​​of a second vehicle component, or from data contained therein. The second vehicle component can be a master component in a vehicle component assembly, and the component identifier of the master component simultaneously serves as the vehicle identifier for vehicle F and the vehicle component assembly present in vehicle F. A second vehicle component that is not a master component can thus simultaneously have a component identifier and a vehicle identifier that differs from the component identifier within a vehicle component assembly.

[0066] Once the vehicle component 100 is integrated into the vehicle component network, the vehicle component can determine, based on the identifier and the release 392, 394, whether it is required for this vehicle, this owner and / or this second

[0067] 34719P-WO - 18.08.2025 Component releases are available and activate or not activate the primary functional module 110 according to the release.

[0068] A release 392, 394 can also include further rules. For example, a release can be time-limited, such as defining an expiration date and / or a limited validity period; it can be spatially limited, such as defining geofencing; it can define further rights, such as restricting whether a user of the vehicle may change settings; and / or it can define permissible operating modes, such as specifying that only limited power should be available for a drive unit 1003. The further rules described here are examples and not exhaustive. In some embodiments, a release 392, 394 can contain the further rules without being limited to a specific identifier. For example, a release can define that unrestricted authorization should be granted for each additional vehicle component and / or within any vehicle component group.

[0069] Advantageously, rule-based activation of a vehicle component allows for fine-grained and / or customizable configuration and / or use of the vehicle components. In particular, multiple permissions or owner- or user-specific approvals can be mapped.

[0070] As shown in Fig. 3, the rule set originates from the data processing unit 344 and is usually defined by the owner of the vehicle component 100. A procedure for setting up the vehicle component 100 may include the following steps:

[0071] Storing an owner's private key (340) in a storage location of the data processing unit (DPU) (344). The owner's private key (340) can be generated by the DPU (344) during the initial installation and / or setup of software, such as an app. For example, the DPU (344) can create a self-signed certificate, where the self-signed certificate may correspond to the owner's certificate (370) and / or the owner's certificate may be created based on the self-signed certificate. The owner's private key typically remains in the owner's possession, i.e., in the DPU (344) and / or optionally as an (encrypted) backup in a cloud environment.

[0072] - Creating instructions to modify a release for vehicle component 100. The owner can, for example, using the app running on the data processing unit 344, enter commands that cause one or more releases to be created or modified. The created release can be configured to create a new release for vehicle component 100, or to modify existing releases 392, 394, for example, by deleting, modifying, or overwriting them. The data processing unit 344

[0073] 34719P-WO - 18.08.2025 can be communicatively connected to vehicle component 100, for example, to retrieve existing authorizations. Data processing unit 344 can also be connected to other vehicle components and / or data processing units, for example, to obtain one or more identifiers for which an authorization is to be set up. For example, the owner of a battery as a vehicle component can connect a data processing unit 344 to the interface 140 of another vehicle component via an interface of the data processing unit and retrieve a component identifier, owner identifier, or vehicle identifier of the other component in order to specify, as an authorization, that the battery is entitled to provide power to the other vehicle component.The example given is not exhaustive and can be applied equally to other types of vehicle components.

[0074] - Signing the instructions using the first owner private key 340. The instructions can contain the release and be structured, for example, as described for releases 392 and 394. Additionally, the instructions are digitally signed by the data processing unit 344, enabling the vehicle component 100 to verify the signature using the owner public key 342 stored in the vehicle component 100. In embodiments, the instructions generated and signed in this way can be an authorization certificate, multiple authorization certificates, or even an authorization certificate bundle. The signed instructions are transmitted to the vehicle component 100 and verified by it using the owner public key 342.If the verification reveals that the signed instructions were created by the owner of the owner's private key 340, the one or more releases contained in the instructions are extracted and stored, for example, as described for releases 392 and 394, in a memory of the vehicle component, in particular rule set 390. In some embodiments, one or more authorization certificates can be stored. The instructions can cause a new or modified rule set 390 to be created in component 100. Likewise, the instructions can also cause existing releases and / or other data contained in rule set 390 to be modified and / or deleted.

[0075] Alternatively, or additionally, a procedure for operating a vehicle F may include the following steps: Creating an authorization certificate, wherein the authorization certificate includes at least one release 392, 394. Signing the authorization certificate based on the owner's private key 340. Transferring the authorization certificate to the first vehicle component. Verifying the signed authorization certificate based on the owner's certificate 370. Provided that the authorization certificate is valid, storing the release 392, 394 in a rule set 390 in a memory 150 of the vehicle component 100.

[0076] 34719P-WO - 18.08.2025 Advantageously, an owner can create numerous releases and / or instructions for rule sets and store them, for example, in the form of authorization certificates in the data processing unit 344. Advantageously, often only a selection of these releases is stored in rule set 390 or required for the operation of vehicle component 100, so the storage space allocated for rule set 390 can be small. If the vehicle component assembly changes, for example, by adding or replacing vehicle components, the owner can connect to vehicle component 100 and / or the vehicle component assembly via data processing unit 344 when commissioning the vehicle and, if necessary, transfer the required releases to the respective vehicle components.

[0077] The rule set 390 is typically stored in a freely accessible memory area and can be modified at will during operation, for example, according to a procedure described herein. However, only the owner identified by the owner certificate 370 can modify the rule set, meaning that only the owner of component 100 is able to change the existing rule set 390. Advantageously, this allows an owner to prevent a vehicle component obtained unlawfully, e.g., as a result of theft, from being used by third parties in an unauthorized vehicle or vehicle component assembly, thereby creating a deterrent to stealing the vehicle component.

[0078] The following describes a method for operating a vehicle, for example the vehicle F shown in Fig. 1, with reference to Fig. 4 and Fig. 5.

[0079] Fig. 4 describes a method 400 for establishing the authenticity of a first vehicle component 100T with respect to a second vehicle component 1002. Fig. 5 describes a method 500 for establishing the authorization of a first vehicle component 100T with respect to a second vehicle component 1002. The vehicle components shown in Fig. 4 and Fig. 5 can be any of the vehicle components 100 shown in Fig. 1, for example, but not limited to, a battery and a drive unit.

[0080] Methods 400 and 500 are described herein as methods that are performed between two vehicle components 100. In some embodiments, the methods can also be performed between a vehicle component 100 and a data processing device 344, for example, to establish the authenticity of the vehicle component 100 using the data processing device 344. This ensures, for example, that the data processing device 344 communicates only with genuine vehicle components authorized by the manufacturer.

[0081] 34719P-WO - 18.08.2025 Both methods 400 and 500 involve the communicative connection 410, 510 of the vehicle components 100^ 1002 for data exchange between the vehicle components 100^ 1002. In some embodiments, the steps of method 500 are executed after method 400 has been completed, so that a communicative connection already exists between the vehicle components 100^ 1002. In these embodiments, steps 510 may be optional.

[0082] In particular, the communicative connection can be established via the interface 140 of the vehicle components 100^ 1002, for example by the

[0083] Vehicle components integrate into a common network and / or an existing network assigned to vehicle F.

[0084] In advantageous embodiments, the communicative connection 410, 510 comprises the establishment of a secure communication channel between the vehicle components 100T, 1002. A secure communication channel can be defined, for example, by the fact that data exchanged via the secure communication channel is not visible to third parties, for example, by encrypting the data transmission via the secure communication channel. In embodiments, the communicative connection 410, 510 can include a secure key agreement. In particular, the communicative connection 410, 510 can include a Diffie-Hellman key exchange, for example, based on the authentication key pair 310, 312 stored in the vehicle components 100T, 1002. As a result of the secure key agreement, further communication between the vehicle components 100T, 1002 can be encrypted based on the exchanged key.

[0085] In step 420, vehicle component 100T transmits the authentication public key 312 together with the manufacturer signature 322 to vehicle component 1002. For example, the first vehicle component 100T can transmit the authentication package 360 ​​to vehicle component 1002 for this purpose.

[0086] In step 422, the vehicle component 1002 verifies the manufacturer signature 322, for example, based on a manufacturer public key 380 stored in the vehicle component 1002. If the verification fails, 499 the vehicle component 1002 terminates the process and remains in or enters a locked state. If the verification 422 is successful, 430 the vehicle component 1002 generates a challenge based on the authenticity public key 312, which was previously received from the vehicle component 100T, and transmits this challenge to the vehicle component 100^. For example, a message with arbitrary, for example randomly generated, content can be encrypted with the authenticity public key 312.

[0087] In step 432, the vehicle component 100T receives the challenge and decrypts it using the authenticity stored in the vehicle component 100T.

[0088] 34719P-WO - 18.08.2025 private-keys 310 and transmits the response thus created to the vehicle component 1002.

[0089] In step 440, vehicle component 1002 receives the response and verifies it, for example, by comparing the response with the message on which the challenge was based. If the verification fails, vehicle component 1002 terminates the procedure and remains in its current state or enters a locked state. If the verification is successful, vehicle component 100T is successfully authenticated to vehicle component 1002, and further procedure steps 450 can be executed. For example, procedure 400 can be modified to authenticate vehicle component 1002 to vehicle component 100T. For example, procedure 500 can then be executed following procedure 400.

[0090] Fig. 5 shows the method 500 for establishing authorization of the vehicle component 100-. In particular, the method 500 determines whether the vehicle component 100T, after connection with the vehicle component 1002, for example in a vehicle F and / or a vehicle component assembly, is authorized to provide the function of the primary functional module 110 of the vehicle component 100T or the vehicle component assembly.

[0091] Step 510 involves the communicative connection of vehicle component 100T with vehicle component 1002 and is carried out as already described for procedure 400. If vehicle components 100T and 1002 are already connected, step 510 can be optional.

[0092] In step 520, vehicle component 1002 retrieves an owner identifier, a vehicle identifier, and / or a component identifier from memory 150 of vehicle component 1002. The owner identifier could be, for example, the owner certificate 370 or parts thereof. The component identifier could be, for example, the authentication package 360T or parts thereof. The vehicle identifier could be an authentication package 3602, for example, of a master component that forms a vehicle component assembly together with vehicle component 1002. The vehicle identifier could be any identifier generated by a master component that does not have cryptographic properties.

[0093] In step 520, vehicle component 1002 transmits the owner identifier, the component identifier and / or the vehicle identifier to vehicle component 100^. The transmission can occur as a result of a request from vehicle component 100T.

[0094] 34719P-WO - 18.08.2025 In step 530, the vehicle component 100-, checks whether a corresponding release exists for the received owner identifier, component identifier and / or vehicle identifier. For example, the vehicle component 100T can access a rule set 390, which may contain one or more releases 392, 394, for example.

[0095] Step 530 can include a verification of the received identifiers. For example, a verification of a component identifier and / or a vehicle identifier can be performed similarly to the establishment of authenticity based on an Authenticity Packet 360 in Method 400. For example, component 100T can contact the master component to verify a vehicle identifier and perform the authentication of the master component as described for Method 400. For example, an owner identifier can be verified based on an owner certificate 370 by component 100T verifying a signature of the owner certificate 370 of vehicle component 100T against the owner public key contained in the owner certificate 370.

[0096] In some embodiments, the transmission of (further) identifiers in step 520 can be omitted, for example, if the rule set 390 includes a universal release that enables the activation of the vehicle component 100T with respect to any component. However, even in such embodiments, it can be advantageous if the vehicle component 1002 is authenticated with respect to the vehicle component 100T, for which, for example, the authenticity package 360 ​​may have been transmitted previously in a process 400.

[0097] If check 530 fails, vehicle component 100T terminates procedure 500 and remains in or enters a locked state. If the check is successful, vehicle component 1002 is successfully authorized over vehicle component 100T, and further procedure steps 540 can be executed. For example, procedure 500 can be modified to establish authorization for vehicle component 100T over vehicle component 1002. Following procedure 500, vehicle component 100T can be activated, or even the vehicle F can be moved into a partially or fully operational state.

[0098] The method for operating a vehicle, in particular methods 400 and 500, has been described by way of example for a vehicle component assembly consisting of two vehicle components. As shown in Fig. 1, a vehicle component assembly can comprise further vehicle components, in particular a number greater than two. In such a vehicle component assembly with numerous vehicle components, the method for authentication and / or authorization between each vehicle component can, in principle, be used.

[0099] 34719P-WO - 18.08.2025 Vehicle component. However, this can be disadvantageous with a very large number of vehicle components.

[0100] In some embodiments, the vehicle components described herein may be configured to designate a master component for a vehicle component group. For example, each vehicle component may be assigned a serial number, which may be a value stored in the Authenticity Package 360 ​​or even the Authenticity Public Key 312. Once individual vehicle components connect to form a vehicle component group, for example, to establish the authenticity of the vehicle components, the vehicle components may be configured to designate the vehicle component with, for example, the lowest serial number as the master component.Once the vehicle component is designated as the master component, a vehicle identifier can be generated based on the component identifier of the master component and / or the vehicle identifier can be defined as identical to the component identifier of the master component.

[0101] The master component can then simplify the vehicle operation process, particularly the establishment of authentication and / or authorization, by eliminating the need for each vehicle component to authenticate and / or authorize itself to every other vehicle component. Instead, the master component authenticates itself to the other vehicle components, and the other vehicle components authenticate themselves to the master component. If authorization based on the vehicle identifier is not possible, the other vehicle components can subsequently establish direct communication. This simplifies the process, particularly by reducing the number of repetitions required for complete vehicle activation.

[0102] In some cases, it may be advantageous to change the ownership of a vehicle component. In a vehicle component according to embodiments, the owner of the vehicle component is defined by the Ownership Certificate 370. For example, if a vehicle component is sold and / or transferred, the new owner should normally be able to use the vehicle component in its entirety and, in particular, be able to modify the rule set 390 and / or the approvals 392 and 394 contained therein.

[0103] The following describes various procedures for changing the ownership of a vehicle component 100. In the first procedure, a method for changing ownership comprises the following steps:

[0104] - Storing an initial owner-private key 340 in a memory of a data processing unit 344. The owner-private key 340 can, for example,

[0105] 34719P-WO - 18.08.2025 is generated during the initial installation and / or setup of software, such as an app. For example, the data processing facility 344 can create a self-signed certificate, where the self-signed certificate can correspond to the owner certificate 370 and / or the owner certificate is based on the self-signed certificate. The owner's private key typically remains in the owner's possession, i.e., in the data processing facility 344 and / or optionally as an (encrypted) backup, for example, in a cloud environment.

[0106] - Creating instructions to change an ownership property of vehicle component 100. The owner can, for example, using the app running on data processing equipment 344, enter commands that cause vehicle component 100 to install a new owner certificate or change an existing owner certificate. In particular, the new owner certificate can contain a different owner public key 342, so that the new owner certificate identifies a different owner than the previously installed owner certificate.

[0107] Creating the instructions may involve retrieving a token from the vehicle component. For example, the data processing unit 344 may communicate with the vehicle component 100 and instruct it to generate an ownership transfer token and / or to enter an operating state intended for the transfer of ownership. The token may, for example, include a unique random number and / or a timestamp. The token may also include a component identifier of the vehicle component 100.

[0108] In some implementations, token signing and verification may include and / or implement a challenge-response mechanism. Advantageously, this mechanism can reduce the effectiveness of replay or multiple transmission attacks.

[0109] Creating the instructions may involve generating a second owner certificate based on a second owner private key. For example, a second owner certificate containing an owner public key and a digital signature from a data processing unit of the new owner may be transferred to the data processing unit 344 of the existing owner. Alternatively, the second owner certificate may be transferred by the data processing unit of the second owner, together with or separately from a signed token, directly or indirectly to the vehicle component. In particular, the procedure may include signing the second owner certificate with the second owner private key.

[0110] In some embodiments, the transfer of the second owner certificate, for example to ensure the integrity of the received data, may include a challenge-response procedure, so that the data processing facility 344

[0111] 34719P-WO - 18.08.2025 of the existing owner and / or the vehicle component 100 verifies the received second owner certificate based on the owner's private key of the new owner. Alternatively, or additionally, a verification of the second owner certificate can be performed based on signature 343 of the second owner certificate.

[0112] - Sign the instructions using the first owner's private key 340. The instructions include the token. Once the token is signed using the first owner's private key 340, the ownership transfer can be considered approved by the previous owner. It is important to note that the token signature does not need to specify the new owner to whom the vehicle component is to be transferred. In particular, the instructions can be supplemented after the transfer to the new owner's data processing facility, for example, by adding a new owner certificate to the signed token. The new owner's certificate can also be transferred in a separate step.

[0113] In some embodiments, the instructions may contain the second owner certificate, so that signing the instructions includes signing the second owner certificate with the owner's private key 340 of the previous owner. The vehicle component 100 is able to verify the signature by using the owner's public key 342 stored in the vehicle component 100.

[0114] - Transfer of the signed instructions to vehicle component 100. The transfer of the signed instructions can be performed by the data processing unit 344 of the previous owner. The transfer can also be performed by the data processing unit of the new owner. For example, the data processing unit 344 of the previous owner can transfer instructions to the data processing unit of the new owner, where the signed instructions include a signed token but not yet a second owner certificate. The data processing unit of the new owner can then connect directly to vehicle component 100 and prove, by means of the token contained in the signed instructions, that it is authorized to transfer ownership.

[0115] - Verification of the signature of the signed instructions by vehicle component 100. Verification of the signature of the signed instructions specifically includes verifying the signature of the token contained in the instructions. The verification may include verifying the signature using the owner public key 342 stored in vehicle component 100, determining whether the signature was created by the corresponding owner private key 340. The signature verification may also include verifying the token contained within.

[0116] 34719P-WO - 18.08.2025 Data includes, for example, whether the random number and / or timestamp corresponds to the values ​​of the originally created token. In some embodiments, the vehicle component may be configured to accept only the most recently created and / or most recent token, advantageously preventing multiple sales and "retransfers" of the same component.

[0117] - Storing ownership information in memory 150 of vehicle component 100. If the signature verification of the instructions, particularly the token, is successful, data identifying the new owner is stored in memory 150. Specifically, the first owner certificate of the previous owner of vehicle component 100 can be replaced by the second owner certificate of the new owner. In some embodiments, the second owner certificate of the new owner can be included in the instructions, allowing the owner certificate to be replaced immediately.In some embodiments, for example, when the signed instructions contain the signed token but not a new owner certificate, the vehicle component can remain in an owner-transfer state, which allows, for example, any new owner to register their ownership in the vehicle component. In some embodiments, the data processing device used to transfer the signed instructions can be configured to create and / or transfer to the vehicle component a second owner certificate, for example, of the owner stored in the data processing device.

[0118] The following describes further developments of the procedure for changing the ownership of a vehicle component 100. The procedures for changing ownership can also be applied, in a modified form, to changing approvals and / or rule sets.

[0119] Fig. 6 shows a method 600 in which an open token for the transfer of ownership is transferred from a previous owner 610 to a new owner 620.

[0120] In step 650, the previous owner 610 connects to the vehicle component 100 and sends it instructions that bring the vehicle component 100 into an operating state intended for the transfer of ownership. Following the received instructions, the vehicle component 652 creates and sends a token to the previous owner 610, specifically an unfinalized token. The unfinalized token may be signed by the vehicle component 100, for example, based on the authentication private key 310, but is not signed by the previous owner 610.

[0121] 34719P-WO - 18.08.2025 In step 654, the previous owner 610 stores the unfinalized token, for example in a storage location of the data processing facility 344, a database, a sales system, cloud storage, or the like.

[0122] After the transfer of the non-finalized token in step 652, the vehicle component 100 can be stored, for example in a designated warehouse 630, or handed over to a shipping company.

[0123] In step 656, the previous owner 610 signs the unfinalized token with their own private key, thus creating a signed token. This signed token can then be referred to as a finalized token. In step 658, the previous owner 610 transfers the signed token to the new owner 620. For example, the previous owner 610 can transfer the signed token directly to the new owner 620's data processing equipment. Alternatively, the signed token can be transferred via other communication channels, such as an electronic message or even a printed or graphically transmitted QR code. Advantageously, the new owner 620 is not required to have a dedicated data processing equipment to receive the signed token.Method 600 can be used, for example, in particular when a vehicle component is transferred to the new user 620, but the new user does not yet have an established data processing facility.

[0124] In step 660, the new owner 620 receives the vehicle component 100. In step 662, the new owner 620 connects to the vehicle component 100, for example using a data processing device, and sends instructions to change an ownership property to the vehicle component. The instructions contain the signed token.

[0125] In step 664, the vehicle component 100 verifies the instructions, in particular the signed token, and receives an ownership certificate of the new owner 620 from the new owner's data processing facility 620.

[0126] In step 666, the vehicle component 100 stores the ownership certificate of the new owner 620 in a memory, for example by replacing the ownership certificate of the previous owner 610. In step 668, the ownership transfer is confirmed.

[0127] Figure 7 shows a process 700 in which a personalized token is transferred from a previous owner 710 to a new owner 720 to transfer ownership. Process 700 is similar to process 600 in some steps, so the differences between the processes will be described first.

[0128] 34719P-WO - 18.08.2025 In step 750, the previous owner 710 connects to the vehicle component 100 and sends it instructions that put the vehicle component into an operating state intended for the transfer of ownership. As a result of the received instructions, the vehicle component 752 creates and sends a token to the previous owner 710, specifically an unfinalized token. The unfinalized token may be signed by the vehicle component 100, but is not signed by the previous owner 710.

[0129] In step 754, the previous owner 710 stores the unfinalized token, for example in a storage facility of the data processing unit 344, a database, a sales system, a cloud storage facility, or the like.

[0130] After the transfer of the non-finalized token in step 752, the vehicle component 100 can be stored, for example in a designated warehouse 730, or handed over to a shipping company.

[0131] In step 756, the data processing facilities of the previous owner 710 and the new owner 720 communicate. For example, through communication, such as in dedicated software or an app, the previous owner 710 can declare that the vehicle component 100 is to be sold and / or transferred to the new owner 720, and the new owner 720 can declare that he agrees to the sale and / or transfer.

[0132] In step 758, the data processing unit of the previous owner 710 transmits a declaration of consent to the sale and / or transfer of ownership to the data processing unit of the new owner 720. For example, step 758 may be executed after a contract has been concluded, after payment of a purchase price, and / or after further confirmation by the previous owner 710. The declaration may be an offer to the new user 720 to accept ownership of the vehicle component 100. In some embodiments, the unfinalized token may be transferred to the new owner 720 along with the declaration in step 758.

[0133] In step 760, the new owner's data processing system transmits a declaration of consent to the sale and / or transfer to the previous owner's data processing system (710). This declaration may include information about the new owner (720), such as their public key or certificate. The declaration may also include the unfinalized token.

[0134] In step 762, the data processing facility of the previous owner 710 finalizes the unfinalized token, for example, based on the declaration received in step 760, with the owner's private key of the previous owner 710. In particular, the previous owner can then use the token together with the owner's private key.

[0135] 34719P-WO - 18.08.2025 Sign the new owner's public key and / or ownership certificate. This allows the finalized token to be personalized for the new owner.

[0136] In step 764, the previous owner 710 transfers the signed token to the new owner 720. In step 766, the new owner 720 receives the vehicle component 100. In step 768, the new owner 720 connects to the vehicle component 100, for example, using the data processing device, and sends instructions to change an ownership property to the vehicle component 100. The instructions include the signed token, as well as the new owner's signed public key and / or signed ownership certificate.

[0137] In step 770, the vehicle component 100 verifies the instructions, in particular the signed token. In some embodiments, the vehicle component 100 can verify the owner certificate or the owner public key of the new owner 720 contained in the instructions, in particular the signed token.

[0138] In step 772, vehicle component 100 stores the new owner's certificate 720 in a memory location, for example, by replacing the previous owner's certificate 710. If only the new owner's public key was signed in step 762, vehicle component 100 can request the new owner's data processing unit to sign the new owner's public key in order to create a new owner's certificate. In step 774, the ownership transfer is confirmed.

[0139] Unlike method 600, for steps 770 and 772, according to embodiments, the ownership certificate contained in the signed token, as specified in the instructions, in particular in step 762, is used, so that steps 768, 770, 772, and 774 can be performed by any

[0140] The data processing equipment can be used, which in particular does not need to be in possession of the owner's private key of the new owner 720. Accordingly, in some embodiments, for example, steps 768, 770, 772, 774 can be performed by the data processing equipment of the previous owner 710.

[0141] Fig. 8 shows a method 800 in which, for the first time, an owner certificate of an end user is stored as owner 830 in a vehicle component 100, for example in the course of the distribution of new vehicle components by a dealer.

[0142] In step 860, a manufacturer 810, for example a factory, flashes the vehicle component 100 with firmware. The firmware contains information that identifies a first owner 820, for example an ownership certificate of the first owner 820. The first owner 820 can

[0143] 34719P-WO - 18.08.2025 This could be, for example, a distributor, such as a dealer. The firmware may also contain further information, such as settings that put vehicle component 100 into a test state, pre-delivery state, "production state" or the like.

[0144] In step 862, manufacturer 810 performs tests on the vehicle component, for example, for functional testing and / or quality assurance. In step 864, the vehicle component 100, for example, as a result of an order from manufacturer 810, or independently, for example, after passing the functional testing and / or quality assurance, enters a (locked) delivery state and transmits an unfinalized token to manufacturer 810. The delivery state can be a state in which the vehicle component 100 is not operational and is waiting for a change in ownership and / or release. After the transmission of the unfinalized token, the vehicle component 100 can, for example, be transferred to warehouse 850 or delivered.

[0145] In step 866, the unfinalized token is stored in a database 840. Database 840 can be viewed by the first owner 820.

[0146] In step 868, the data processing facilities of the first owner 820 and the new owner 830 communicate. For example, the new owner could be a customer who accesses a dealer's webshop system and purchases the vehicle component 100 there. The data processing facility of the first owner 820 could be, for example, a webshop system, an in-store sales system, or a central, for example, web-based application of the manufacturer or distributor.

[0147] In step 870, the first owner 820, for example as a result of a purchase made by the new owner 830, retrieves the unfinalized token from the database 840.

[0148] In step 872, the data processing unit of the first owner 820 transmits a declaration of consent to the sale and / or transfer of ownership to the data processing unit of the new owner 830. For example, step 872 may be executed after a contract has been concluded, after payment of a purchase price, and / or after further confirmation by the first owner 820. The declaration may be an offer to the new user 830 to accept ownership of the vehicle component 100. In some embodiments, the unfinalized token may be transferred to the new owner 830 along with the declaration in step 872.

[0149] In step 874, the new owner's data processing unit 830 transmits a declaration of consent to the sale and / or transfer to the first owner's data processing unit 820. The declaration may contain information about the new owner 830, such as the owner's name, address, and telephone number.

[0150] 34719P-WO - 18.08.2025 public key of the new owner 830, for example, the owner's certificate. The declaration may include the unfinalized token.

[0151] In step 876, the data processing facility of the first owner 820 finalizes the unfinalized token, for example, based on the declaration received in step 874, using the owner's private key of the first owner 820. Specifically, the first owner can sign the token together with the owner's public key and / or owner's certificate of the new owner 830. This allows the finalized token to be personalized for the new owner 830.

[0152] The further steps 878, 880, 882, 884, 886, 888 correspond essentially to steps 764, 766, 768, 770, 772, 774 of the previously described procedure 700.

[0153] In step 878, the first owner 820 transfers the signed token to the new owner 830. In step 880, the new owner 830 receives the vehicle component 100. In step 882, the new owner 830 connects to the vehicle component 100 and sends instructions to change an ownership property to the vehicle component 100. The instructions contain the signed token.

[0154] In step 884, vehicle component 100 verifies the instructions, in particular the signed token. In step 886, vehicle component 100 stores the ownership certificate of the new owner 830 in memory. In step 888, the ownership transfer is confirmed.

[0155] Method 800 has the advantage that ownership of vehicle component 100 is established shortly after its manufacture, and this ownership cannot be changed by the manufacturer 810. Thus, even the initial transport of vehicle component 100, for example to warehouse 840, can be secured to the extent that a vehicle component stolen "at the factory gate" is already unusable or unlockable.

[0156] In embodiments, a data processing device 344 is described. The data processing device comprises a memory containing a first owner private key 340, and the data processing device 344 is configured to act as the data processing device in one of the methods described herein. In particular, the data processing device 344 can be configured to create and sign instructions for changing a release and / or an ownership property. For example, the data processing device can be configured to sign the instructions with the owner private key 340, so that a vehicle component 100 is able to verify the instruction by means of the signature using an owner public key 342 stored therein. The data processing device can be configured to transmit the instructions directly or indirectly to the vehicle component.

[0157] 34719P-WO - 18.08.2025 100 to transmit. In particular, the data processing device may include an interface that can communicate with interface 140 of the vehicle component. For example, the interface of the data processing device may be configured for data transmission according to a radio standard and / or radio network standard, such as IEEE 802.15. The interface may be a Bluetooth interface, for example, a Bluetooth Low Energy interface, or a Bluetooth 4.0, 4.1, 4.2, 5, 5.1, 5.2, 5.3, or 5.4 interface. Software, for example, an app, may run on the data processing device, enabling the owner to set up, configure, transfer ownership, and create shares, in particular according to the procedures described herein.

[0158] In embodiments, a vehicle is described, for example, the vehicle F shown in Fig. 1. The vehicle comprises a plurality of vehicle components according to the embodiments described herein. The vehicle components are configured to execute a method according to the embodiments described herein, in particular to communicate with other vehicle components and / or data processing devices in order to perform the steps described for the respective method, which are executed by the vehicle component.

[0159] Advantageously, the methods and components described herein are typically usable by the end user even without a connection to a central rights and ownership management system, meaning they can also be used offline. Advantageously, the granting of permissions and the transfer of rights can be carried out solely based on the owner's private key stored for the owner, without requiring confirmation from, for example, a manufacturer, dealer, or other third party. Advantageously, the cryptographic methods described herein offer a way to prove the authenticity, authorization, and ownership of a vehicle component. Advantageously, the methods and components described herein increase the owner's control over the vehicle component.Advantageously, the methods and components described herein increase the theft protection of the vehicle component.

[0160] 34719P-WO - 18.08.2025

Claims

PATENT CLAIMS 1. Method for operating a vehicle (F) with a system of at least two vehicle components (100), each of the components (100) comprising at least: a component-specific authentication key pair (310, 312) comprising an authentication private key (310) and an authentication public key (312) corresponding to the authentication private key (310); a manufacturer signature (322) of at least one authentication public key (312), wherein the manufacturer signature (322) is based on a manufacturer private key (320); an owner certificate (370) comprising an owner public key (342) and an owner signature (343), wherein the owner signature (343) is based on an owner private key (340); a rule set (390); the method comprising: - communicative connection (410, 510) of the at least two vehicle components (100) for data exchange between the at least two vehicle components (100); - Establishing authenticity (400) of a vehicle component (100) of at least two vehicle components (100) based on the manufacturer's signature (322) and the authenticity key pair (310, 312); - Establishing an entitlement (500) of a vehicle component of at least two vehicle components (100) on the basis of the standard rate (390); - provided that the establishment of authenticity (400) of a first vehicle component (100) is successful, activation of a second vehicle component (100) of at least two vehicle components (100); - provided that the establishment of the authorization (500) of the first vehicle component (100) is successful, activate the first vehicle component (100) 34719P-WO - 18.08.2025 2. The method according to claim 1, wherein the communicative linking (410, 510) comprises the establishment of a secure communication channel between the at least two vehicle components (100), in particular a key agreement.

3. The method according to one of claims 1 or 2, wherein establishing the authenticity (400) of the first vehicle component (100) comprises the following steps: - Transfer (420) the authentication public key (312) and the manufacturer signature (322) from the first vehicle component (100) to the second vehicle component (100); - Verification (422) of the manufacturer's signature (322) by the second vehicle component (100); - Creating (430) a challenge based on the authenticity public key (312) by the second vehicle component (100) and transferring the challenge to the first vehicle component (100); - The first vehicle component (100) creates (432) a response based on the challenge and the authenticity private key (310) and transmits the response to the second vehicle component (100).

4. The method according to any one of claims 1 to 3, wherein establishing the authorization (500) of the first vehicle component (100) comprises the following steps: - Creating an authorization certificate, where the authorization certificate includes at least one release; - Signing the authorization certificate based on the owner's private key (340); - Transfer of the authorization certificate to the first vehicle component; - Verification of the signed authorization certificate based on the owner's certificate; - Provided that the authorization certificate is valid, store the release (392, 394) in a rule set (390) in a memory of the first vehicle component. 34719P-WO - 18.08.2025 5. The method according to any one of claims 1 to 4, wherein establishing the authorization of the first vehicle component (100) comprises the following steps: - Transferring an owner identifier and / or a component identifier of the second vehicle component to the first vehicle component; and / or - Transferring a vehicle identifier of the vehicle (F) to the first vehicle component; - Check that the first component includes an authorization corresponding to the owner identifier, component identifier or vehicle identifier (392, 394).

6. Method (600) for setting up a vehicle component (100) for a modular vehicle, comprising: - Storing an initial owner private key (340) in a memory of a data processing facility (344); - Creating instructions to change a release (392, 394) and / or ownership of the vehicle component (100); - Signing the instructions using the first owner's private key (340); - Transferring the signed instructions to the vehicle component (100); - Verification of a signature of the signed instructions by the vehicle component (100) using an owner public key (342) stored in the vehicle component (100); - Storing the release (392, 394) and / or ownership in a memory (150) of the vehicle component (100).

7. The method according to claim 6, comprising: - Generating a token for ownership transfer by the vehicle component, wherein the signed instructions include the token; - Create a second owner certificate based on a second owner private key (340); 34719P-WO - 18.08.2025 - Signing the second owner certificate with the second owner private key (340); - Replacing the first owner certificate of the vehicle component (100) with the second owner certificate.

8. The method according to claim 6 or 7, comprising: Creating a rule set (390) comprising at least one release (392, 394), wherein the release (392, 394) comprises one or more of the following: - at least one owner identifier of a vehicle component (100), wherein the owner identifier is contained in or derived from the owner certificate of the vehicle component (100); - at least one component identifier of a vehicle component (100), wherein the component identifier is contained in or derived from an authenticity package of the vehicle component (100); - at least a vehicle identifier, wherein the vehicle identifier is distinct from an owner identifier of the component and is suitable for establishing an authorization of the vehicle component (100) in a vehicle (F) with the vehicle identifier.

9. The method according to claim 8, wherein the release (392, 394) has a limited validity period.

10. Data processing device (344) comprising a memory with a first owner private key (340) stored therein, wherein the data processing device (344) is configured to execute the method according to any one of claims 6 to 9 and to transmit the instructions directly or indirectly to the vehicle component (100).

11. Vehicle component (100) for a modular vehicle (F), comprising: a primary functional module (110); a controller (120), comprising: 34719P-WO - 18.08.2025 a processor (130); an interface (140) for communication with other vehicle components (100) of the modular vehicle (F); a memory (150) accessible by the processor (130); wherein the memory (150) includes: a component-specific authentication key pair (310, 312), comprising an authentication private key (310) and an authentication public key (312) corresponding to the authentication private key (310); a manufacturer signature (322) of at least the authentication public key (312), wherein the manufacturer signature (322) is based on a manufacturer private key (320); a component-specific owner certificate (370), comprising an owner public key (342) corresponding to an owner-specific owner private key (340); an owner signature (343) of the owner certificate (370), wherein the owner signature (343) is created on the basis of the owner private key (340); a rule set (390);a computer program means readable by the processor (130), wherein the computer program means comprises instructions which, when executed by the processor (130), cause the controller (120) to perform the following steps:; - communicative connection (410, 510) with at least one other vehicle component (100) of the modular vehicle (F) via the interface (140); - Establishing authenticity (400) of the other vehicle component (100) based on the manufacturer's signature (322) and the authenticity key pair (310, 312); - Establishing an entitlement (500) of the vehicle component (100) based on the standard rate (390); - provided that the mutual establishment of authenticity and authorization is successful, the primary function module (110) is activated by the controller (120) for use in the vehicle.

12. The vehicle component (100) according to claim 11, wherein the vehicle component (100) is configured as one of the following: 34719P-WO - 18.08.2025 - a motor (1003) for providing electrically supplied drive energy simultaneously with human muscle power; - one battery (1006); - a vehicle frame (100^; - a circuit (1004) and / or a gearbox (1002); - a data processing device (1005), in particular a telemetry and / or navigation device.

13. The vehicle component (100) according to one of claims 11 or 12, wherein the interface (140) comprises an interface for data transmission in a Wireless Personal Area Network, in particular according to IEEE 802.15, in particular a Bluetooth interface.

14. Vehicle (F), in particular a single- or multi-track vehicle of the type bicycle, pedelec, e-bike or bicycle with auxiliary drive, comprising a plurality of vehicle components (100) according to any one of claims 11 to 13, wherein the plurality of vehicle components (100) are configured to carry out the method according to any one of claims 1 to 9.

15. The vehicle (F) according to claim 14, wherein the plurality of vehicle components (100) are communicatively integrated in a vehicle component network, and wherein the vehicle component network includes a vehicle identifier assigned to the vehicle. 34719P-WO - 18.08.2025

Images