Method for updating software of a control device of a vehicle

• US 10,423,401 B2
• Filed: 10/26/2017
• Issued: 09/24/2019
• Est. Priority Date: 10/26/2016
• Status: Active Grant

• Current Assignee: Volkswagen AG
• Original Assignee: Volkswagen AG
• Inventors: Tschache, Alexander
• Primary Examiner(s): Lyons, Andrew M.
• Application Number:
  US15/794,124
• Publication Number:
  US 20180113703A1
• Time in Patent Office: 698 Days
• Field of Search: 717168-178
• CPC Class Codes: G05B 19/0426 Programming the control sequence
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/44536 Selecting among different versions
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method for updating software of a control unit of a vehicle which includes exchanging individual data blocks of the software in a memory of the control unit and generating cryptographic material for each exchanged data block by processing each exchanged data block with a cryptographic function. The method includes storing the generated cryptographic material in a test data block which contains cryptographic material for each data block and includes verifying the consistency of the cryptographic material, stored in the test data block, of all data blocks of the software by matching the cryptographic material stored in the test data block with consistency test data. The disclosed embodiments reduce the necessary cryptographic operations during a partial updating of the software of a control unit of a vehicle.

Claims

1. A method for updating software of a control unit of a vehicle, the method comprising:

providing data blocks and consistency test data to the control unit at the same time;

exchanging a number of individual data blocks of the software in a memory of the control unit, wherein the number of exchanged data blocks is fewer than the total number of data blocks of the software to provide partial software update;

processing each one of the exchanged data blocks with a stored cryptographic function to generate respective cryptographic material for each exchanged data block;

storing the generated cryptographic material for each exchanged data block in a test data block including replacing previously stored cryptographic material for the exchanged data block, wherein the test data block includes cryptographic material for each individual data block; and

verifying consistency of the cryptographic material stored in the test data block for all data blocks of the software by matching the cryptographic material stored in the test data block with the consistency test data, wherein the consistency test data comprise a cryptographic signature about the cryptographic material to be expected in the test data block for each data block of the software after the storing of the generated cryptographic material for each exchanged data block.

2. The method of claim 1, further comprising deleting the cryptographic material from the exchanged individual data blocks or from the individual data blocks to be exchanged.

3. The method of claim 1, further comprising providing the data blocks to be exchanged and/or the consistency test data for the control unit by an external software updating entity, wherein the external software updating entity is a back end of a vehicle manufacturer or of a third-party provider.

4. The method of claim 1, wherein the test data block is stored in a secure memory of the control unit.

5. The method of claim 1, wherein the cryptographic function used for generating the cryptographic material for each exchanged data block is a hash function and/or the cryptographic material generated by the cryptographic function comprises, for each data block, a hash value about the content of the respective data block.

6. The method of claim 5, wherein the cryptographic material generated by the cryptographic function comprises, for each data block, a cryptographic key in addition to the hash value.

7. The method of claim 1, wherein the cryptographic function used for generating the cryptographic material for each exchanged data block is a signing function and/or the cryptographic material generated by the cryptographic function comprises a digital signature of the respective data block for each data block.

8. The method of claim 1, wherein the cryptographic material generated by the cryptographic function comprises, for each data block, a symmetric signature of the respective data block.

9. The method of claim 1, wherein the cryptographic material generated by the cryptographic function comprises, for each data block, a message authentication code of the respective data block.

10. The method of claim 1, wherein generating the cryptographic material for each exchanged data block is effected by the control unit and/or by the external software updating entity.

11. A control unit of a vehicle, wherein the control unit carries out a method for updating software of a control unit of a vehicle, the method comprising:

exchanging individual data blocks of the software in a memory of the control unit, wherein the number of exchanged data blocks is fewer than the total number of data blocks of the software to provide partial software update;

processing each of the exchanged data blocks with a stored cryptographic function to generate respective cryptographic material for each exchanged data block;

storing the generated cryptographic material for each exchanged data block in a test data block including replacing previously stored cryptographic material for the exchanged data blocks; and

verifying consistency of the cryptographic material stored in the test data block for all data blocks of the software by matching the cryptographic material stored in the test data block with consistency test data, wherein the consistency test data comprise a cryptographic signature about the cryptographic material to be expected in the test data block for each data block of the software after the updating of the software,

wherein the data blocks to be exchanged and the consistency test data are provided to the control unit at the same time.

12. The control unit of claim 11, wherein the method further comprises deleting the cryptographic material from the individual data blocks to be exchanged or exchanged, from the test data block.

13. The control unit of claim 11, wherein the method further comprises providing the data blocks to be exchanged and/or the consistency test data for the control unit by an external software updating entity, wherein the external software updating entity is a back end of a vehicle manufacturer or of a third-party provider.

14. The control unit of claim 11, wherein the test data block is stored in a secure memory of the control unit.

15. The control unit of claim 11, wherein the cryptographic function used for generating the cryptographic material for each exchanged data block is a hash function and/or the cryptographic material generated by the cryptographic function comprises, for each data block, a hash value about the content of the respective data block.

16. The control unit of claim 15, wherein the cryptographic material generated by the cryptographic function comprises, for each data block, a cryptographic key in addition to the hash value.

17. The control unit of claim 11, wherein the cryptographic function used for generating the cryptographic material for each exchanged data block is a signing function and/or the cryptographic material generated by the cryptographic function comprises a digital signature of the respective data block for each data block.

18. The control unit of claim 11, wherein the cryptographic material generated by the cryptographic function comprises, for each data block, a symmetric signature of the respective data block.

19. The control unit of claim 11, wherein the cryptographic material generated by the cryptographic function comprises, for each data block, a message authentication code of the respective data block.

20. The control unit of claim 11, wherein generating the cryptographic material for each exchanged data block is effected by the control unit and/or by the external software updating entity.

21. A vehicle, comprising:

a control unit, wherein the control unit carries out a method for updating software of a control unit of a vehicle, the method comprising;

exchanging individual data blocks of the software in a memory of the control unit, wherein the number of exchanged data blocks is fewer than the total number of data blocks of the software to provide partial software update;

processing each of the exchanged data blocks with a cryptographic function to generate respective cryptographic material for each exchanged data block;

storing the generated cryptographic material in a test data block including replacing previously stored cryptographic material for the exchanged data blocks; and

verifying consistency of the cryptographic material stored in the test data block for all data blocks of the software by matching the cryptographic material stored in the test data block with consistency test data, wherein the consistency test data comprise a cryptographic signature about the cryptographic material to be expected in the test data block for each data block of the software after the updating of the software,

wherein the data blocks to be exchanged and the consistency test data are provided to the control unit at the same time.