Vehicle, apparatus, computer-readable data carrier, computer program, and methods for updating software of a mobile device

Abstract

Embodiments of the present disclosure relate to a vehicle, an apparatus, a computer-readable data carrier, a computer program, and methods for updating software of a mobile device. Embodiments provide a method for updating software of a mobile device and for verifying a software update package. The method comprises receiving the software update package. The software update package includes multiple software update files. Further, the method comprises obtaining a cryptographic key. As well, the method comprises verifying the software update package based on a verification of a portion of the software update files using the cryptographic key.

Description

[0001] 202402996

[0002] 1

[0003] Description

[0004] Vehicle, apparatus, computer-readable data carrier, computer program, and methods for updating software of a mobile device

[0005] Embodiments of the present disclosure relate to a vehicle, an apparatus, a computer-readable data carrier, a computer program, and methods for updating software of a mobile device. In particular, but not exclusively, the concept proposed herein relates to a concept of verification of a software update package (also referred to herein as “software update bundle”) including multiple update files for updating software of a vehicle.

[0006] Updating software of vehicles is crucial for several reasons. Firstly, it ensures the vehicle's systems are running efficiently and securely. Modern vehicles are equipped with complex software that controls everything from engine performance and fuel efficiency to safety features like anti-lock brakes and airbags. Regular updates can fix bugs, improve functionality, and enhance overall performance. Additionally, software updates can introduce new features and capabilities, keeping the vehicle up-to-date with the latest technological advancements.

[0007] The types of software that may be updated in a vehicle include electronic control unit (ECU) software, infotainment system software, navigation system software, and advanced driver-assistance systems (ADAS) software. The ECU software may manage the vehicle’s operation, optimizing performance and emissions.

[0008] Infotainment system software updates can improve user interface, connectivity, and multimedia functions. Navigation system updates may ensure that maps and routing algorithms are current. ADAS software updates can enhance safety features such as adaptive cruise control, lane-keeping assist, and automatic emergency braking.

[0009] Over-the-air (OTA) updates are a convenient and efficient method for delivering software updates to vehicles. OTA updates are sent wirelessly, eliminating the need for a physical connection or a visit to a service center. This method saves time and resources for both manufacturers and vehicle owners. The process of OTA updates202402996

[0010] 2

[0011] may involve the vehicle's telematics system receiving an update file, e.g., from the manufacturer's server, verifying its integrity, and then installing it.

[0012] Verification of software update files is a critical step in the OTA update process. It ensures that the update file has not been tampered with and is free from corruption. This is important for maintaining the security and reliability of the vehicle's systems. Verification involves checking the digital signature of the update file against a known, trusted source. If the signature matches, the file is considered authentic and safe to install. This process helps prevent malicious software from being introduced into the vehicle's systems, which could compromise safety and performance.

[0013] Particularly in connection with software-defined vehicles (SDVs), software updates (over the air) become more and more important and, thus, software update verification. For this, software update files of a software update package may be signed. Once signed the signed software update package is transferred to the vehicle. In order to check the integrity, authenticity, and / or non-repudiation, the signed software update files are verified by the vehicle separately / individually. In doing so, each software update file, e.g., for each function or each sub-ECUs, may be verified separately.

[0014] The verification may consume / require a lot of computing resources and time. This may also negatively affect a user experience when a user may need to wait longer for a software update to be completed. The above also applies for other mobile devices, e.g., mobile phones, wearables, and the like.

[0015] Hence, there may be a demand for an improved concept for updating software of a mobile device.

[0016] Embodiments of the present disclosure are based on the finding that the verification of only a part of the signed software update files of a software update package may provide enough security. One idea is to apply a threshold verification scheme which, in practice, is only applied in distributed ledger systems or multiparty computation applications analogously to the verification of software update packages including202402996

[0017] 3

[0018] multiple software update files. For this, embodiments of the proposed approach suggest a key sharing approach for signing and verifying the software update packages using a respective share of a key / secret.

[0019] Embodiments provide a method for updating software of a mobile device and for verifying a software update package. The method comprises receiving the software update package. The software update package includes multiple software update files. Further, the method comprises obtaining a cryptographic key. As well, the method comprises verifying the software update package based on a verification of a portion of the software update files using the cryptographic key. That is, number of software update packages (“the portion”) which are verified is smaller than the total number of the software update files. Each of the software update files is signed using respective share of a secret sharing scheme and the portion of the software update files is smaller than the entirety of software update files of the software update packages and relates to a threshold of the secret sharing scheme.

[0020] In this way, computing resources (e.g., for verifying the remaining signed software update files) for the verification of the software update package can be reduced compared to other approaches where each software update file is verified. In doing so, also time for the verification may be saved which may lead to an improved user experience.

[0021] In some embodiments, the mobile device is a vehicle. In such embodiments, a first software update file of the software update package may be for updating software of a first component of the vehicle and a second software update file of the software update package may be for updating software of a second component of the vehicle.

[0022] In this way, multiple components may be updated using a single software update package.

[0023] In practice, receiving the software update package may comprise receiving the software update package over the air.202402996

[0024] 4

[0025] This may be much more convenient and safe further resources compared to updates via a wired network.

[0026] Further embodiments provide a method for updating software of a mobile device and providing a software update package including multiple software update files for a mobile device. The method comprises obtaining multiple shares of a secret sharing scheme and signing each software update file using one of the shares. Further, the method comprises providing the software update package including the signed software update files to the mobile device for verifying the software update package based on a verification of a portion of the software update files using the cryptographic key. The portion of the software update files is smaller than the entirety of software update files of the software update packages and relates to a threshold of the secret sharing scheme.

[0027] In doing so, a receiver can verify the (whole) software update package, e.g., prior to applying software updates for checking the authenticity, integrity, and / or

[0028] non-repudiation of the software update package, thereby saving resources compared to other approaches which require that each software update file is verified.

[0029] In some embodiments, the method further comprises providing the software update package including the signed software update files to the mobile device. As mentioned above, this may be done over-the-air, e.g., a (local or mobile) wireless network.

[0030] As mentioned in connection with the previous corresponding method, the mobile device may be a vehicle.

[0031] Further embodiments provide a computer program comprising instructions which, when the computer program is executed by a computer, cause the computer to carry out an embodiment of any of the proposed methods. In some embodiments, all steps of (any of) the proposed methods may be carried out by a computer or any202402996

[0032] 5

[0033] other kind of programmable hardware. Accordingly, embodiments of the proposed methods may be computer-implemented.

[0034] Further embodiments provide a computer-readable data carrier having stored thereon the proposed computer program.

[0035] Further embodiments provide an apparatus comprising one or more interfaces for communication and a data processing circuit configured to execute an embodiment of any of the proposed methods.

[0036] Further embodiments provide a vehicle or vehicle backend comprising an embodiment of the proposed apparatus.

[0037] Further, embodiments are now described with reference to the attached drawings. It should be noted that the embodiments illustrated by the referenced drawings show merely optional embodiments as an example and that the scope of the present disclosure is by no means limited to the embodiments presented:

[0038] Brief description of the drawings

[0039] Fig. 1 shows a flow chart schematically illustrating an embodiment of a method for updating software of a mobile device and for verifying a software update package;

[0040] Fig. 2 shows a flow chart schematically illustrating an embodiment of a method for updating software of a mobile device and providing a software update package including multiple software update files for a mobile device;

[0041] Fig. 3 shows an exemplary use case of the proposed approach;

[0042] Fig. 4 shows an example of a software update package; and

[0043] Fig. 5 shows a block diagram schematically illustrating an embodiment of an apparatus according to the proposed approach.202402996

[0044] 6

[0045] As mentioned above, software updates for vehicles and other mobile devices are crucial as they allow manufacturers to remotely update software, improving vehicle / device performance, adding new features, and fixing bugs or vulnerabilities without requiring a visit to the dealership. This enhances user experience, ensures vehicles / mobile devices stay up-to-date with the latest technology, and can even address safety recalls swiftly, reducing the risk of accidents or other technical problems.

[0046] OTA software updates may be subject to attacks. Attacks on OTA software updates can include spoofing and man-in-the-middle attacks. In spoofing, attackers impersonate a legitimate source, tricking the vehicle into downloading malicious updates. Man-in-the-middle attacks involve intercepting the communication between the vehicle and the update server, allowing attackers to alter the update content.

[0047] These attacks can be avoided through the use of digital signatures (also referred to herein as “signatures") for software update packages. When an update is signed with a private key, the vehicle uses the corresponding public key to verify the signature. If the signature is valid, it confirms the update's authenticity and integrity, ensuring it hasn't been tampered with. This cryptographic verification process effectively prevents unauthorized modifications and ensures that only legitimate updates are installed.

[0048] For software update packages including multiple software update files, said verification process may be very time and resource consuming. Accordingly, the user experience may suffer from long waiting times and mobile devices may need to provide large computing capacities.

[0049] Present disclosure provides a solution to those disadvantages, as laid out in more detail below with reference to the appended drawings.202402996

[0050] 7

[0051] As explained below, the proposed approach may be implemented as a method or multiple related methods. The proposed method / s may comprise multiple steps. It should be noted that the steps of the methods described herein do not necessarily need to be executed in the order presented. The sequence of steps may be varied, and certain steps may be omitted or combined, without departing from the scope of the invention. The described methods are intended to be illustrative and not restrictive, and it will be understood by those skilled in the art that various modifications and variations can be made without departing from the broader inventive concept.

[0052] Fig. 1 shows a flow chart schematically illustrating an embodiment of a method 100 for updating software of a mobile device and for verifying a software update package.

[0053] The method 100 comprises receiving 110 the software update package. In context of the present disclosure such software update package can be understood as a collection of data, instructions, and / or executable code. It may be designed to modify, enhance, or improve the functionality, performance, security, or user experience of a software application, system, or device. This package may include, but is not limited to, patches, bug fixes, new features, enhancements, security updates, and configuration changes. The software update package can be delivered through various means, such as over-the-air updates, downloadable files, or physical media, and can be applied automatically or manually by a user or system administrator. Preferably, the software update package may be received

[0054] over-the-air for the above-mentioned reasons. The scope of the software update package encompasses any method or mechanism by which software is updated, regardless of the specific technology or platform involved.

[0055] The software update package includes multiple software update files. The software update package, e.g., includes multiple software update files, each serving a distinct purpose to enhance or modify the software's functionality. For mobile devices, these update files can include operating system updates, application updates, security patches, firmware updates, and driver updates. Operating system updates may202402996

[0056] 8

[0057] bring new features, performance improvements, and bug fixes. Application updates may ensure that individual apps run smoothly and securely. Security patches address vulnerabilities to protect the device from potential threats. Firmware updates can improve hardware performance and compatibility, while driver updates ensure that the device's components work correctly with the operating system.

[0058] In the context of vehicles, software update packages can be even more diverse. They may include updates for the infotainment system, navigation system, one or more ECUs, ADAS, and telematics systems. Infotainment system updates can enhance the user interface, add new features, and improve connectivity options. Navigation system updates ensure that maps and routing algorithms are up-to-date. ECU updates can improve operation of the vehicle. ADAS updates can enhance safety features such as adaptive cruise control, lane-keeping assistance, and automatic emergency braking. Telematics system updates can improve vehicle diagnostics, remote monitoring, and communication capabilities.

[0059] Each of the software update files is signed, e.g., using a digital signature.

[0060] Digital signatures are a cryptographic method used to verify the authenticity and integrity of digital messages or documents. Examples work by using a pair of keys: a private key and a public key (see Rivest–Shamir–Adleman (RSA)). The private key is kept secret by the signer, while the public key is shared with recipients which may need to verify the signature. When a document or file is signed, the signer uses their private key to create a unique digital signature based on the content of the document and their private key. For signing the software update files, such signature may be attached to each software update file of the software update package.

[0061] To verify the signature of the software update files, the recipient can use a cryptographic key, e.g., a symmetric key or the signer's public key. The verification process involves checking that the digital signature matches the content of the software update files and the cryptographic key. If the signature is valid, it confirms202402996

[0062] 9

[0063] that the document has not been altered since it was signed and that it was indeed signed by the holder of the private key.

[0064] According to the proposed approach, a secret sharing scheme is applied for signing the software update files.

[0065] A secret sharing scheme is a cryptographic method, usually, applied to distribute a secret among a group of participants, each of whom is allocated a share of the secret. The secret can only be reconstructed when a sufficient number of shares are combined. This ensures that the secret remains secure even if some shares are compromised.

[0066] One common type of secret sharing scheme is Shamir's Secret Sharing. In this scheme, the secret is divided into parts, and each part is given to a participant. The secret can be reconstructed only when a predefined number of parts, known as the threshold, are combined. For example, if the threshold is set to three, any three shares can be used to reconstruct the secret, but two shares cannot.

[0067] In the proposed approach, the secret sharing scheme is transferred to the signature and verification process for software update files, as laid out in more detail below.

[0068] In practice, the software update files are signed using a respective share of a secret according to a secret sharing scheme. The secret, e.g., is a (predetermined) private key. The shares, therefore, may be understood as private key shares. For this, various signature techniques may be used, for example, RSA.

[0069] Accordingly, method 100 further comprises receiving 120 a cryptographic key. The cryptographic key, e.g., is a symmetric or asymmetric key (e.g., the signer’s public key), which is suitable for verifying the signed software update files.

[0070] Further, method 100 comprises verifying 130 the software update package based on a verification of a portion of the software update files using the cryptographic key.202402996

[0071] 10

[0072] In practice, the signed software update files, e.g., each have a digital signature which may be generated using an original cryptographic hash of the software update file. To verify the software update file, the mobile device uses the cryptographic key to decrypt the digital signature, revealing the original cryptographic hash of the software update file. The mobile device then computes “its own cryptographic hash” of the received update file using the same hash algorithm as a for the generation of the original cryptographic hash.

[0073] If the computed hash matches the decrypted hash, the update is verified as authentic and unaltered. The same may be applied in connection with the proposed approach and the proposed modifications.

[0074] According to embodiments of the proposed approach, each of the software update files is signed using respective share of a secret sharing scheme. For example, the share may be used as input for the generation of the digital signatures of the software update files. In practice, the shares are different from each other.

[0075] Accordingly, the signatures of the signed software update files may differ from each other.

[0076] The portion of the (signed) software update files is smaller than the entirety of software update files of the software update packages and relates to a threshold of the secret sharing scheme. In practice, the number of software files in the portion of software update files, i.e., the number of (signed) software update files (at least) required for the verification of the software update package may be equal to the threshold of the secret sharing scheme, wherein the threshold is lower than the total number of the (signed) software update files in the software update package.

[0077] Accordingly, the computing effort for the verification can be set or adapted based on the threshold of the secret sharing scheme.

[0078] In this way, not all software update files in the software update package need to be verified which reduces time in computing resources for the verification.202402996

[0079] 11

[0080] This may be particularly advantageous for mobile devices which may receive software update packages including a (large) number of software update files such as for vehicles where software update packages may include multiple software update files each of which for a respective component, e.g., for different functions and / or ECUs, sensors, and / or other devices (e.g., infotainment system, navigation system, etc.). So, in practice, e.g., a first software update file of the software update package is for updating software of a first component of the vehicle and a second software update file of the software update package is for updating software of a second component of the vehicle.

[0081] A skilled person will appreciate that the proposed approach may be applied for different secret sharing and verification schemes, and combinations thereof, even if further explanations may refer to specific examples or combinations thereof.

[0082] It is also noted that the proposed approach may be applied for different applications and, thus, various mobile devices. In particular, the proposed approach may be applied for vehicles. However, even if explanations herein may refer to applications for a vehicle, the skilled person will understand that features and aspects only disclosed in connection with such specific applications may be applied analogously for other applications as well, e.g., mobile phones or wearables.

[0083] Method 100, e.g., may be executed by the mobile device. In some embodiments, the execution of method 100 may be at least partly offloaded to a server configured to be communicatively coupled to the mobile device.

[0084] In practice, method 100 may be applied connection with the respective method for providing the software update package. Such a method for providing the software update package, e.g., may be executed by a transmitter and / or developer of the software update package.

[0085] However, it is noted that even if embodiments may refer to a combination of such method, the scope of the present disclosure is by no means limited to such combinations but also covers implementations of only one of said methods. Still,202402996

[0086] 12

[0087] where applicable, explanations of aspects related to both the transmitter and the recipient of the software update package may apply for both of them. Ergo, explanations made in connection with method 100 may analogously apply for a method for providing a software update package as outlined in more detail below with reference to Fig. 2.

[0088] Fig. 2 shows a flow chart schematically illustrating an embodiment of a method 200 for updating software of a mobile device and providing a software update package including multiple software update files for a mobile device.

[0089] Method 200 comprises obtaining 210 multiple shares of a secret. As mentioned above, and appropriate secret sharing scheme may be applied to this end.

[0090] As well, method 200 comprises 220 signing each software update file using one of the shares. For this, an appropriate signing algorithm or function may be used and a respective share as input to the algorithm or function, as laid out in more detail later. In doing so, e.g. share may be used once for a respective software update file. That is, a first share is used for a first software update file, a second share is used for a second software update file and so forth. Accordingly, the number of shares may be equal to the number of software update files of the software update package.

[0091] Further, method 200 comprises providing 230 the software update package including the signed software update files to the mobile device for verifying the software update package based on a verification of a portion of the software update files using the cryptographic key, wherein the portion of the software update files is smaller than the entirety of software update files of the software update packages and relates to a threshold of the secret sharing scheme.

[0092] This enables the mobile device to verify the software update package, thereby saving time and computing resources since not all software update files need to be verified separately, as laid out above.202402996

[0093] 13

[0094] In some embodiments, method 200 further comprises providing the software update package including the signed software update files to the mobile device, e.g., as an OTA update.

[0095] More details are now explained below with reference to Fig. 3 showing an exemplary use case of the proposed approach.

[0096] In the present use case, a backend server, referred to herein as “OTA Center”, obtains software update packages for a fleet of vehicles (including vehicle 1, vehicle2 and vehicle N). In practice, the software update packages for the vehicles may be tailored based on properties of the vehicles, e.g., based on an ECU configuration, a software version, and / or the like.

[0097] An exemplary (signed) software update package (for a high-performance computer (HPC) ECU), referred to herein as “Software Package in HPC ECU”, is illustrated in Fig. 4.

[0098] As can be seen, the software update package includes multiple software update files, referred to herein as “containers”. In practice, the software update package may include a container for each function or device of a vehicle. In the present example, e.g., the software update package includes 8 software update files / containers including software update files for different software applications APP1 and APP2 as well as for different virtual machines VM1 and VM2, for a hypervisor, for a switch, and other software or hardware components. As can be seen, a content of the software update files may vary for different software update files. For example, software update files may contain an executable, data, and a manifest (see signed container 1). Other software update files include a kernel update file (here: Linux kernel), an OS base update file (here: Linux base), and a Manifest as well as a Software Package Manifest (see signed container 4 or 5). It should be noted that the software update files, in practice, may include less or further content which may depend on a device, software application, and / or functionality related to the software update file. So, as the skilled person will202402996

[0099] 14

[0100] understand, the content of such software update files is not limited to the content disclosed herein.

[0101] As mentioned before, it may be time and resource-consuming to verify each software update file and, in some cases, it will affect the user experiences because the user may need to wait longer for software update to be completed.

[0102] To solve this problem, the proposed approach provides a reduction of time and resources required for a verification of each software container under the assumption that the software update package can be verified using a first layer of signature / verification and each software image of the containers are encrypted. The proposed secure signature / verification based on threshold signature does not require to verify each software container’s signature. In addition, it will only require verification of the subtotal of minimum number of signatures.

[0103] An exemplary update procedure may be as follows (see Fig. 3):

[0104] • A vehicle (e.g., vehicle 1 ) receives a software update package from the OTA center

[0105] • For the communication of the software update package TLS or any other secure communication may be used to transfer the software update package from the OTA center to the vehicle, e.g., to an update master of the vehicle. The update master can be a gateway ECU or telematic ECU. In this example, the gateway ECU may exhibit a HPC function.

[0106] • In the present example, the software update package includes 8 software update files (also referred to as “images”) to be verified to flash them into the vehicle, e.g., various ECUs thereof. The software update files, in the present example, include two application software, one Linux secure-enhanced software, two virtual machine software, one switch software, one hypervisor software and one vehicle software package.

[0107] • Each of above software update files is signed by the OTA center (for more details about the signature mechanism, see below).202402996

[0108] 15

[0109] • To reduce the verification time, it is proposed to verify maximum 7 out of the 8 software update files by the proposed method to verify the whole software update package.

[0110] 1. Advantage of the Proposed Solution:

[0111] • It makes use of the trust partial parties to verify all parties’ integrity

[0112] • Reduce the verification time of all software image for software updates or over-the-air updates

[0113] • Signature is performed at OTA server, which is more powerful computation compared to vehicle side.

[0114] The proposal includes signing each software container using corresponding or respective shares of private key d based on a threshold scheme. In-vehicle ECU only needs at least k out of n signature shares (i.e., signatures of k software update files) to verify the signature of n pieces of software (i.e., software update files), as laid out below with reference to an example of various applicable mathematical concepts for the proposed secret sharing and threshold verification.

[0115] Embodiments of the present proposal may include two algorithms: (1) secret sharing algorithm KeySharing(k,n, S,p) and (2) a threshold signature scheme Sharing_Sig_Ver(m, Sig,y1...yk).

[0116] Proposed secret sharing algorithm KeySharing(Jc,n, S,p), where k < n:

[0117] 1 ) A modular arithmetic is used. Suppose that the set of integer modulo a prime number p forms a field.

[0118] 2) For a given integer valued data S, it is proposed to pick a prime p which is larger than both S and n.

[0119] 3) Divide secret S into n sub secret. Any k secret can recover S, but any (k - 1) secret cannot recover S. Accordingly, k may be understood as the threshold of the secret sharing scheme, k - 1 is the degree of the defined polynomial equation for the secret sharing (see below).202402996

[0120] 16

[0121] 4) KeyS haring Enc k,n, S,py. Supposing any secret S. If alt■■■,ak-in / (x)| are randomly chosen from a uniform distribution over integers in [0, p]. If a0= S, it holds

[0122] I

[0123]

[0124] . f(x) = a0+ arx + a2x2H - 1- ak-1xfe-1modp

[0125] II. Computing (xi,f(xi) mod p),... (xn,f(xn mod p)), where xlf...,xnis an integer

[0126] 5) KeySharingDec(k,n, S,p) x1,y1),... (xk,yk) is computed

[0127] I. a0+ tiXi H - 1- flfc-iXi-1= y modp

[0128] II III. a0+ fliXfc H - 1- flfc-iXfc-1= ykmod p

[0129] IV. Computing the coefficients aQ, alta2... ak-1. If x = 0, one will get S.

[0130] Frequent updates the key shares instead of private key itself would reduce the window of opportunity for attacks and thereby further reduces the risk.

[0131] The present example refers to the RSA signature scheme as example to illustrate the proposed threshold signature scheme Sharing_Sig_Ver m, Sig,y1...yk).

[0132] 1) It is proposed to reuse the (key) shares generated in KeySharing(k,n, S,p), yi -yk- 2) Suppose private key of RSA signature is S, where y...ykare k shares of S.

[0133] Public (cryptographic) key of RSA signature is (N,e), wherein N is the modulus and e the public exponent.

[0134] 3) Signing the software update files may comprise the following step:

[0135] Sharing_Sig (m, Sig,y1...yk) Suppose that one has n pieces of software update files (container), where n is from (1,2,...,n). Compute signature of each software update file as: Sig(SWi) = myimod N, where i is from (1,2,...,n).

[0136] 4) Verifying the software update package may comprise the following step / s:

[0137] Sharing_Ver (m, Sig,y1...yk) The mobile device / vehicle (ECU) verifies the signature using public keys (N,e)

[0138] a. The mobile device / vehicle collects at least k shares of signed information (i.e., ksigned software update files (portion of software update files)): S

[0139]

[0140] ig(SW1+ W2+,.... +SWk) = myi +y2>-,+yk =msmodN.202402996

[0141] 17

[0142] b. So, the mobile device verifies the software update package using maximum k pieces of software instead of n pieces of software using Ver(SW1+ SW2+,.... +SWk) = (myi+y2-ykemod N = mSemod N

[0143] The algorithms, numerical values, and specific details mentioned in this patent application are provided as examples and are not intended to limit the scope of the invention. These values and methods may vary in different embodiments of the invention. The invention may be practiced or implemented in various ways without departing from the spirit and scope of the claims. For example, the threshold k and the number of software update files n may vary (as long as k < n). Also, equivalent algorithms for the digital signatures, the threshold verification, and / or the secret sharing may be used.

[0144] As indicated in Fig. 3, the approach may be not only applied for a single mobile device but also for multiple mobile devices, e.g., a vehicle fleet.

[0145] The proposed approach may be also implemented in an apparatus, as laid out in more detail below with reference to Fig. 5.

[0146] Fig. 5 shows a block diagram schematically illustrating an embodiment of such an apparatus 500. The apparatus comprises one or more interfaces 510 for communication and a data processing circuit 520 configured to execute the proposed method.

[0147] In embodiments, the one or more interfaces 510 may comprise wired and / or wireless interfaces for transmitting and / or receiving communication signals in connection with the execution of the proposed concept. In practice, the interfaces, e.g., comprise pins, wires, antennas, and / or the like. As well, the interfaces may comprise means for (analog and / or digital) signal or data processing in connection with the communication, e.g., filters, samples, analog-to-digital converters, signal acquisition and / or reconstruction means as well as signal amplifiers, compressors and / or any encryption / decryption means.202402996

[0148] 18

[0149] The data processing circuit 520 may correspond to or comprise any type of programable hardware. So, examples of the data processing circuit 520, e.g., comprise a memory, microcontroller, field programable gate arrays, one or more central, and / or graphical processing units. To execute the proposed method, the data processing circuit 520 may be configured to access or retrieve an appropriate computer program for the execution of the proposed method from a memory of the data processing circuit 520 or a separate memory which is communicatively coupled to the data processing circuit 520.

[0150] In practice, the proposed apparatus may be installed on a vehicle. So, embodiments may also provide a vehicle comprising the proposed apparatus.

[0151] However, in implementations, computing resources for the vehicle may be outsourced to an external server separate from the vehicle. In such implementations, the proposed approach may be also implemented outside of the vehicle.

[0152] In the foregoing description, it can be seen that various features are grouped together in examples for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed examples require more features than are expressly recited in each claim. Rather, as the following claims reflect, subject matter may lie in less than all features of a single disclosed example. Thus, the following claims are hereby incorporated into the description, where each claim may stand on its own as a separate example. While each claim may stand on its own as a separate example, it is to be noted that, although a dependent claim may refer in the claims to a specific combination with one or more other claims, other examples may also include a combination of the dependent claim with the subject matter of each other dependent claim or a combination of each feature with other dependent or independent claims. Such combinations are proposed herein unless it is stated that a specific combination is not intended. Furthermore, it is intended to include also features of a claim to any other independent claim even if this claim is not directly made dependent to the independent claim.202402996

[0153] 19

[0154] Although specific embodiments have been illustrated and described herein, it will be appreciated by those of ordinary skill in the art that a variety of alternate and / or equivalent implementations may be substituted for the specific embodiments shown and described without departing from the scope of the present embodiments. This application is intended to cover any adaptations or variations of the specific embodiments discussed herein. Therefore, it is intended that the embodiments be limited only by the claims and the equivalents thereof.

Claims

20240299620Patent claims1. A method (100) for updating software of a mobile device and for verifying a software update package, the method (100) comprising:receiving (110) the software update package, wherein the software update package includes multiple software update files;obtaining (120) a cryptographic key;verifying (130) the software update package based on a verification of a portion of the software update files using the cryptographic key,wherein each of the software update files is signed using a respective share of a secret sharing scheme, and wherein the portion of the software update files is smaller than the entirety of software update files of the software update packages and relates to a threshold of the secret sharing scheme.

2. The method (100) of claim 1, wherein the mobile device is a vehicle, and wherein a first software update file of the software update package is for updating software of a first component of the vehicle and a second software update file of the software update package is for updating software of a second component of the vehicle.

3. The method (100) of claim 1 or 2, wherein receiving the software update package comprises receiving the software update package over the air.

4. A method (200) for updating software of a mobile device and providing a software update package including multiple software update files for a mobile device, the method (200) comprising:obtaining (210) multiple shares of a secret sharing scheme;20240299621signing (220) each software update file using one of the shares; andproviding (230) the software update package including the signed software update files to the mobile device for verifying the software update package based on a verification of a portion of the software update files using the cryptographic key, wherein the portion of the software update files is smaller than the entirety of software update files of the software update packages and relates to a threshold of the secret sharing scheme.

5. The method (200) of claim 4, wherein the method (200) further comprises providing the software update package including the signed software update files to the mobile device.

6. The method (200) of claim 4 or 5, wherein the mobile device is a vehicle.

7. A computer program comprising instructions which, when the computer program is executed by a computer, cause the computer to carry out a method (100, 200) of any one of the claims 1 to 6.

8. A computer-readable data carrier having stored thereon the computer program of claim 6.

9. An apparatus (500) comprising:one or more interfaces (510) for communication; anda data processing circuit (520) configured to execute a method (100, 200) of any one of the claims 1 to 6.

10. A vehicle or vehicle backend / external server comprising the apparatus (500) of claim 9.

Images