Vehicle ECU Integrity Manager Using Data Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic closed-loop control systems in vehicles face challenges in maintaining functional safety and availability, particularly in preventing destabilization due to malfunctions or failures, which can lead to unsafe torque conditions and risk to persons, especially in high-safety requirement levels like ASIL D.
Innovation Solution
A method that enhances functional safety and availability by using data encryption and signatures to protect communication channels between hardware and software components, with an integrity manager to check data integrity and a degradation manager for selective disconnections, ensuring a safe state is achieved without external hardware influence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data encryption and signatures are used to protect communication channels, then reliability is improved, but device complexity increases
Solution Approach 1:
The system is divided into multiple software levels (first software level for control functions, second software level for function monitoring) and hardware components, with encryption applied selectively to specific communication channels between them. This segmentation allows reliability improvement in critical paths without encrypting the entire system, thus managing complexity.
Solution Approach 2:
An integrity manager is introduced as an intermediary component that handles data encryption, decryption, and integrity verification. This mediator centralizes the complex cryptographic operations, making them manageable and reusable across different communication channels without duplicating encryption logic throughout the system.
2Reliability
If integrity checking is performed on all data communication, then reliability is improved, but productivity decreases
Solution Approach 1:
Encryption and integrity checking are applied selectively to specific communication channels based on their safety-criticality. Not all communication channels require the same level of protection - only those where data corruption would lead to unsafe states undergo encryption and integrity verification, while less critical channels maintain faster, unencrypted communication.
Solution Approach 2:
Data is encrypted and signed before transmission, and the receiving end has pre-configured verification mechanisms ready. This preliminary preparation of cryptographic materials and verification routines allows integrity checking to occur efficiently without ad-hoc processing delays during critical operations.
3Reliability
If selective disconnection is implemented for error conditions, then reliability is improved, but device complexity increases
Solution Approach 1:
The integrity manager continuously monitors the integrity of data received from hardware components and provides feedback to the degradation manager. When integrity violations are detected, this feedback triggers automatic disconnection of affected communication channels or functions, enabling the system to transition to a safe state without complex manual intervention or analysis.
Solution Approach 2:
The system implements self-diagnosis and self-protection through automated integrity monitoring and automatic disconnection mechanisms. When errors are detected, the system automatically isolates affected components without requiring external intervention, reducing the complexity of external safety management while maintaining high reliability.
Data Source
AI summary
A method for improving the functional security and increasing the availability of an electronic control system, particularly a motor vehicle control system, including hardware components and software components, wherein the hardware components are abstracted by at least one basis software component and/or a runtime environment, and in which an implemented security concept describes two or more software levels, wherein a first software level includes control functions of an application software and a second software level is designed as functional monitoring, for safeguarding against control function faults, wherein a data encryption, provided by at least one hardware component, and/or a data signature for securing the data of at least one communication channel of the hardware component is used with at least one first software component. The invention additionally describes an electronic control system for performing the method.