Method for verifying the origin of an electronic unit for a control device using a verification system, computer program product, and verification system

Abstract

The invention relates to a method for verifying the origin of an electronic unit (1) for a control device (2) using a verification system (3), having the steps of: receiving a certificate signing request (7) for digitally certifying the control device (2) with the electronic unit (1) from a query entity by means of a receiving device (4) of the verification system (3), wherein the certificate signing request (7) is signed with a wrapper signature (8) of the electronic unit (1); generating a verification query (9) for a manufacturer of the electronic unit (1) on the basis of the received wrapper signature (8) by means of an electronic computing device (6) of the verification system (3); transmitting the verification query (9) to the manufacturer by means of a transmitting device (5) of the verification system (3); receiving a verification message (11) for verifying the electronic unit (1) from the manufacturer by means of the receiving device (4); and verifying the origin of the electronic unit (1) on the basis of the verification message (11) by means of the electronic computing device (6). The invention also relates to a computer program product and to a verification system (3).

Description

[0001] - 1 - Description

[0002] Method for verifying the origin of an electronic unit for a control device using a verification system, computer program product and verification system

[0003] The following invention relates to a method for verifying the origin of an electronic unit for a control device by means of a verification system according to claim 1. The invention further relates to a corresponding computer program product and a corresponding verification system.

[0004] The problem of verifying electronic units in control units, particularly in motor vehicles manufactured by suppliers, is a complex, multifaceted issue in the state of the art. Control units in motor vehicles often monitor critical systems such as brakes, airbags, and powertrains. If, for example, a chip within a control unit is compromised, this can pose significant safety risks to vehicle occupants and other road users.

[0005] Therefore, it is crucial to ensure that the control units and the electronic components they contain are verified and authenticated to prevent tampering or attacks. Furthermore, control unit suppliers may be located globally, which can complicate monitoring and compliance with quality standards. Without effective verification of the electronic components used in the control units, quality degradation or malfunctions can occur, potentially compromising vehicle safety and reliability. Additionally, chip and electronic component manufacturers may hold patents or licenses for specific technologies used in control units. If a supplier uses unlicensed chips or infringes patent rights, this can lead to legal disputes and additional costs for the vehicle manufacturer.

[0006] Furthermore, proper verification of electronic units in control units enables better traceability of individual components during the production process and throughout the life cycle of a vehicle. This allows a manufacturer to react more quickly to problems, identify faulty chips and electronic units, and initiate recalls if necessary.

[0007] To address these issues, vehicle manufacturers have typically established strict specifications and verification processes to ensure the integrity and security of electronic units within control units. These can include specialized hardware security mechanisms, encryption techniques, and authentication procedures. Furthermore, independent tests and audits are often conducted to ensure that suppliers comply with the specified standards.

[0008] In particular, the solutions from the state of the art are therefore based exclusively on the key materials present in the electronic component or electronic unit; issuing certificates on this basis is currently only considered in certain projects and is only known for specific consortia.

[0009] The object of the present invention is to create a method, a computer program product and a verification system by means of which the origin of an electronic unit for a control device can be reliably verified.

[0010] This problem is solved by a method, a computer program product, a computer-readable storage medium, and a verification system according to the independent claims. Advantageous embodiments are specified in the dependent claims.

[0011] One aspect of the invention relates to a method for verifying the origin of an electronic unit for a control device using a verification system. A certificate signing request for digitally certifying the control device with the electronic unit is received from a requesting instance via a receiving device of the verification system, wherein the certificate signing request is signed with a wrapper signature of the electronic unit. A verification request is generated with the manufacturer of the electronic unit based on the received wrapper signature by an electronic computing device of the verification system, and the verification request is transmitted to the manufacturer via a sending device of the verification system. A verification message for verifying the electronic unit is received from the manufacturer via a receiving device.The origin of the electronic unit is verified by means of the electronic computing device, depending on the verification message.

[0012] In particular, the verification message can, for example, include confirmation of the origin from the manufacturer, thus confirming that it is a "certified" component. If, for example, the verification message does not contain confirmation of authenticity, then the origin cannot be confirmed or verified.

[0013] In particular, this allows for additional safeguards to be implemented for issuing certificates, for example, which significantly simplifies the protective measures to be taken by the supplier, leading to increased security and cost savings. At the same time, it enhances security against manipulation during the authentication of communication within the vehicle and also protects against counterfeiting.

[0014] In particular, since existing solutions require significant protective measures on the part of the supplier of the control unit to establish a digital basis of trust, the approach according to the invention is correspondingly advantageous. According to the prior art, only trusted suppliers with appropriate contractual agreements to prevent fake data can be used. This, in turn, necessitates a significantly increased quality control process for the supplier as a company. According to the invention, this can now be considerably reduced, as the verification is carried out by the verification system itself. In particular, the electronic unit of the control unit can, for example, be uniquely and identifiably assigned to a specific brand, supplier, region, etc., and, unless explicitly intended, cannot be used functionally in vehicles of other brands.

[0015] In particular, the invention thus offers a solution for ensuring the confidentiality of the external initial secret generation during the exchange, as this is no longer necessary. This reduces the effort required, for example, by a supplier, and ensures authenticity and confidentiality.

[0016] A wrapper signature is, in particular, a type of function or method that encloses another function and provides a new interface or functionality without modifying the underlying code. Essentially, a wrapper is code that encloses existing functionality and provides a new interface or additional function. The wrapper function "wraps" the original function, offering the user an easier or enhanced way to access it. Wrapper signatures can be used in various programming languages ​​and contexts, such as with libraries, APIs (application programming interfaces), or modules. They allow developers to reuse code and leverage existing functionality in new contexts without having to modify the underlying code.

[0017] The certificate signing request is specifically a Certificate Signing Request (CSR). Digital certificates are electronic documents used for authentication, proof of origin, and encryption in digital environments. They often contain information about the identity of a person, organization, or device and are issued by trusted Certification Authorities (CAs). Digital certificates typically consist of two keys: a public key and a private key. The public key is distributed along with the certificate, while the private key must be kept secret. The Certificate Signing Request is a crucial component of digital certificates.A CSR (Certification Signing Request) is a digitally signed data packet sent by an entity, such as an organization, to a certificate authority (CA) to request a digital certificate. The CSR contains essential information, including the entity's name, domain, public key, and other details that should be included in the certificate. The CSR is created using the entity's private key and digitally signed. The CA uses the information contained in the CSR to issue the digital certificate and then returns it to the entity. The recipient can use the received certificate to identify the authorized sender or to conduct encrypted communication. This CSR method is used in existing code-signing certificate solutions.In the solution presented here, for example, the manufacturer of the control unit can request a corresponding "code-signing certificate" from the CA to use it in the control unit and to sign information from the control unit and / or to authenticate the control unit to information recipients / communication partners. For this purpose, the CSR is created and submitted to the CA. Creating a CSR is usually done using special software or a tool, which is provided by the CA, for example. The process involves specifying information such as name, organization, and domain, as well as generating the public / private key pair. The data in the CSR is then signed with a private key to ensure that it is protected during transmission to the certification authority. - 5 -

[0018] According to an advantageous embodiment, a digital certificate for the control unit is generated depending on the verification of the electronic unit. Specifically, the digital certificate is created by the electronic computing unit itself, which acts as a Certificate Authority (CA). After the digital certificate is created, it can then be transmitted to the requesting authority, in particular the manufacturer of the control unit. Thus, after the verification of the electronic unit, the digital certificate can be created and transmitted to the manufacturer of the control unit, enabling secure communication between the manufacturer and the verification system.

[0019] It has also proven advantageous to provide the electronic unit as a chip for the control device. In particular, the chip can, for example, include at least one memory module on which the wrapper signature is stored. This makes it possible to verify the authenticity or origin of the chip for the control device, thereby ensuring the secure operation of the control device.

[0020] It has proven advantageous to generate the certificate signing request using an asymmetric cryptography method and to validate and authenticate it by the electronic computing device. Asymmetric cryptography, also known as public-key cryptography, is a cryptographic method that uses two different, interconnected keys: a public key and a private key. This contrasts with symmetric cryptography, which uses only one secret key to encrypt and decrypt data. The principle of asymmetric cryptography is based on mathematical functions that are easy to compute if the corresponding key is known, but very difficult without it.The two most commonly used methods of asymmetric cryptography are, for example, the RSA cryptosystem and the Diffie-Hellman key exchange method, also known as elliptic curve cryptography (ECO). The public key is accessible to everyone and is published, for example, on servers or in certificates. It is used to encrypt data that is to be sent to the owner of the corresponding private key. The private key is secret and is managed only by its owner. It is used to decrypt data encrypted with the public key. For example, if instance A wants to send a message to instance B, which has a public key, it encrypts the message with instance B's public key. The message encrypted in this way can only be decrypted with instance B's private key.Asymmetric cryptography can also be used to create digital signatures to ensure the integrity and authenticity of data. In this process, the content of a message is signed using the private key. Anyone who possesses the public key can verify the signature and thus confirm the integrity of the data.

[0021] It is also advantageous if the wrapper signature is generated using a symmetric cryptography method and decrypted by the electronic computing device. Symmetric cryptography is a cryptography method in which a single secret key is used for both encrypting and decrypting data, as well as for signing and signature validation. This means that both communication partners must possess the same secret key to maintain secure and confidential communication. The most important component of symmetric cryptography is the secret key, which is the same for both communication partners, sender and receiver, and which is usually exchanged and agreed upon beforehand. It serves for both encrypting and decrypting data. To send a message, the sender encrypts the message using the secret key.The encrypted message can only be decrypted with the same key. The recipient decrypts the encrypted message by also using the secret key. There are two main categories of symmetric cryptography: stream ciphers and block ciphers. Stream ciphers encrypt data continuously, bit by bit and byte by byte, while block ciphers divide data into blocks and then encrypt these blocks individually. Symmetric cryptography offers efficient encryption with relatively low computational overhead. This allows for the simple provision of a wrapper signature.

[0022] It is further advantageous if the wrapper signature is generated using an asymmetric cryptography method and verified by the electronic computing device. This allows the wrapper signature to be protected using the same asymmetric cryptography method, thus ensuring secure delivery of the wrapper signature.

[0023] It has also proven advantageous to determine the manufacturer of the electronic unit based on the received wrapper signature and a database of the verification system. For example, the electronic computing device can maintain such a database. This database may list multiple manufacturers of different components. The wrapper signature can then be uniquely assigned to a specific manufacturer. Thus, upon receipt of the wrapper signature, the manufacturer can be automatically identified, and the verification request can be automatically forwarded to the correct manufacturer. This ensures that the origin of the electronic unit can be reliably verified.

[0024] In a further advantageous embodiment, the generation of a release by the control unit is suppressed if the electronic unit cannot be verified. In particular, the generation of a digital certificate for the control unit can be suppressed accordingly. Thus, if the manufacturer is unable to verify the chip or, for example, no wrapper signature can be found, the release can be suppressed. This prevents undetectable manipulation of the control unit.

[0025] The presented method is, in particular, a computer-implemented method. Therefore, a further aspect of the invention relates to a computer program product with program code means which, when the program code means are executed by the electronic computing device, cause a method according to the preceding aspect to be carried out.

[0026] Furthermore, the invention also relates to a computer-readable storage medium containing at least the computer program product according to the preceding aspect.

[0027] A further aspect of the invention relates to a verification system for verifying the origin of an electronic unit for a control device, comprising at least one receiving device, one transmitting device, and one electronic computing device, wherein the verification system is configured to carry out a method according to the preceding aspect. In particular, the method is carried out by means of the verification system.

[0028] Advantageous embodiments of the process are to be regarded as advantageous embodiments of the computer program product, the computer-readable storage medium, and the verification system. The verification system possesses tangible features to enable the execution of the corresponding process steps.

[0029] In the present disclosure, a computing unit / electronic computing device can be understood, for example, as a data processing device with processing circuits. A computing unit can thus perform arithmetic operations to process data. These arithmetic operations can also include indexed access to a data structure, such as a lookup table (LUT).

[0030] A computing unit may, in particular, comprise one or more computers, one or more microcontrollers, and / or one or more integrated circuits, for example, one or more application-specific integrated circuits (ASICs), one or more field-programmable gate arrays (FPGAs), and / or one or more systems on a chip (SoCs). The computing unit may also include one or more processors, for example, one or more microprocessors, one or more central processing units (CPUs), one or more graphics processing units (GPUs), and / or one or more signal processors, in particular one or more digital signal processors (DSPs). The computing unit may also comprise a physical or virtual cluster of computers or other units of the aforementioned type.

[0031] A processing unit can also include one or more hardware and / or software interfaces and / or one or more memory units. A memory unit can be implemented as volatile data storage, for example as dynamic random access memory (DRAM) or static random access memory (SRAM), or as non-volatile data storage, for example as read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or flash EEPROM, or ferromagnetic random access memory (FRAM).a magnetoresistive random access memory, MRAM, or a phase-change random access memory, PCRAM. - 9 - The invention also includes further developments of the verification system according to the invention, which have features as already described in connection with the further developments of the method according to the invention. For this reason, the corresponding further developments of the verification system according to the invention are not described again here.

[0032] The invention also includes the combination of the features of the described embodiments.

[0033] An embodiment of the invention is described below. The single figure illustrates this:

[0034] Fig. 1 shows a schematic flowchart according to one embodiment of the method.

[0035] The embodiment described below is a preferred embodiment of the invention. In this embodiment, the described components each represent individual features of the invention that can be considered independently of one another. Each of these features further develops the invention independently and can therefore be considered part of the invention individually or in a combination other than that shown. Furthermore, the described embodiment can also be supplemented by other features of the invention already described.

[0036] In the figures, functionally identical elements are each provided with the same reference symbols.

[0037] Fig. 1 shows a schematic flowchart according to one embodiment of a method. In particular, Fig. 1 shows a method for verifying the origin of an electronic unit 1 for a control unit 2 by means of a verification system 3. In particular, the control unit 2 is designed, for example, for a motor vehicle (not shown). In the present embodiment, the verification system 3, shown purely schematically, comprises at least a receiving unit 4, a transmitting unit 5, and an electronic computing unit 6.

[0038] In particular, in the following embodiment, the electronic unit 1 can be considered a chip for the control device 2. - 10 - In particular, a certificate signing request 7 for digitally certifying the control device 2 with the electronic unit 1 is received by a requesting entity, in this case, for example, by a manufacturer of the control device 2, by means of the receiving device 4, wherein the certificate signing request 7 is signed with a wrapper signature 8 of the electronic unit 1. A verification request 9 is generated at the manufacturer of the electronic unit 1, depending on the received wrapper signature 8, by means of the electronic computing device 6, and the verification request 9 is transmitted to the manufacturer by means of the sending device 5.

[0039] In this case, the chip manufacturer is essentially represented by a backend 10 assigned to the chip manufacturer. A verification message 11 for verifying the electronic unit 1 is received from the chip manufacturer by means of the receiving device 4. The origin of the electronic unit 1 is then verified based on the verification message 11 by means of the electronic computing device 6.

[0040] In the present embodiment, it is further shown in particular that, depending on the verification of the electronic unit 1, a digital certificate 12 is generated for the control unit 2, wherein, in the present embodiment, a certification authority 13 is shown in particular. The certification authority 13 is in turn communicatively connected to a request point 14, the request point 14 being configured essentially to receive the certificate signing request 7, to send the verification request 9, and to receive the verification message 11. From the request point 14, confirmation information 15 can then be transmitted to the certification authority 13 after successful verification of the electronic unit 10.

[0041] It is of course possible that before the CSR is transmitted to requesting office 14, it undergoes a formal review by another computing facility. This review can generally check whether the CSR meets the formal requirements; if not, the CSR is not forwarded to requesting office 14 but is filtered out at this stage.

[0042] Furthermore, it is specifically provided that the certificate signing request 7 is generated using an asymmetric cryptography method and decrypted by the electronic computing device 6. For this purpose, a public key 16 and a private key 17 can be stored in the control device 2, whereby only the public key 16 is transmitted with the certificate signing request 7.

[0043] The wrapper signature 8, which can be generated based on an endorsement key, can be generated using a symmetric cryptography method and decrypted by the electronic computing device 6. Alternatively, the wrapper signature 8 can be generated using an asymmetric cryptography method and decrypted by the electronic computing device 6, in which case the chip manufacturer may possess a key pair consisting of a private and a public key. Furthermore, it can be provided that the manufacturer of the electronic unit 1 is determined based on the received wrapper signature 8 using a database 18 of the verification system 3.

[0044] Furthermore, if no verification of the electronic unit 1 is carried out, the generation of a release by the control unit 2, in particular the certificate 12, can be suppressed.

[0045] In particular, Fig. 1 describes in a first step S1 that the endorsement key is inserted into the electronic unit 1 by its manufacturer. In a second step S2, an asymmetric key pair 16, 17 is generated by the manufacturer of the control unit 2. In the third step S3, the certificate signing request 7, which can also be referred to as a Certificate Signing Request (CSR), is transmitted with the wrapper signature 8 to the verification system 3. In the fourth step S4, the wrapper signature 8 is verified, in particular by the backend 10. Depending on the corresponding verification result, a verifiable and signed certificate 12 is then issued in a fifth step S5.

[0046] In particular, it is thus provided that a manufacturer of the control unit 2 generates an asymmetric key pair 16, 17 in the control unit 2 using the existing functions of the chip and, based on this, creates the certificate signing request 7. This certificate signing request 7 is signed with the cryptographic key, in particular the endorsement key, of the electronic unit 1, which has already been incorporated by the chip manufacturer in a production process, and sends the complete package, i.e., the certificate signing request 7 with the wrapper signature 8, to the registration authority, in particular to the requesting authority 14. The requesting authority 14 uses the wrapper signature 8 to have the authenticity of the chip confirmed by the chip manufacturer. If confirmation is successful, the certification authority 13 then generates a corresponding certificate 12, which is sent back to the control unit 2 for incorporation into the chip.- 13 - List of reference symbols.

[0047] 1 electronic unit

[0048] 2 Control unit

[0049] 3 Verification system

[0050] 4 Receiving equipment

[0051] 5 Transmitter

[0052] 6 electronic computing equipment

[0053] 7 Certificate signing request

[0054] 8 Wrapper Signature

[0055] 9 Verification request

[0056] 10 Backend

[0057] 11 Verification message

[0058] 12 Certificate

[0059] 13 Certification Body

[0060] 14 Inquiry point

[0061] 15 Confirmation

[0062] 16 public keys

[0063] 17 private keys

[0064] 18 database

[0065] S1 - S5 Steps of the procedure

Claims

- 14 - Patent claims 1. Method for verifying the origin of an electronic unit (1) for a control device (2) using a verification system (3), comprising the steps: Receiving a certificate signing request (7) for digitally certifying the control device (2) with the electronic unit (1) from a requesting instance by means of a receiving device (4) of the verification system (3), wherein the certificate signing request (7) is signed with a wrapper signature (8) of the electronic unit (1); Generating a verification request (9) with a manufacturer of the electronic unit (1) depending on the received wrapper signature (8) by means of an electronic computing device (6) of the verification system (3); Transmitting the verification request (9) to the manufacturer using a transmitting device (5) of the verification system (3); Receiving a verification message (11) for the verification of the electronic unit (1) from the manufacturer using the receiving device (4); and verifying the origin of the electronic unit (1) depending on the verification message (11) using the electronic computing device (6).

2. Method according to claim 1, characterized by the fact that Depending on the verification of the electronic unit (1), a digital certificate (12) is generated for the control device (2).

3. Method according to claim 1 or 2, characterized by the fact that the electronic unit (1) is provided as a chip for the control device (2).

4. Method according to any one of the preceding claims, characterized by the fact that the certificate signing request (7) is generated on the basis of an asymmetric cryptography procedure and is validated and authenticated by the electronic computing device (6).

5. Method according to any one of the preceding claims, characterized by the fact that - 15 - the wrapper signature (8) is generated on the basis of a symmetric cryptography method and is decrypted by the electronic computing device (6).

6. Method according to any one of claims 1 to 4, characterized by the fact that the wrapper signature (8) is generated on the basis of an asymmetric cryptography method and is decrypted by the electronic computing device (6).

7. Method according to any of the preceding claims, characterized by the fact that The manufacturer of the electronic unit (1) is determined on the basis of the received wrapper signature (8) on the basis of a database (18) of the verification system (3).

8. Method according to any one of the preceding claims, characterized by the fact that Without verification of the electronic unit (1) a generation of a release of the control device (2) is suppressed.

9. Computer program product comprising program code means which cause an electronic computing device (6) to perform a method according to one of claims 1 to 8 when the program code means are executed by the electronic computing device (6).

10. Verification system (3) for verifying the origin of an electronic unit (1) for a control device (2), comprising at least one receiving device (4), one transmitting device (5) and one electronic computing device (6), wherein the verification system (3) is configured to perform a method according to any one of claims 1 to 8.

Images