Authorization process using a certificate

• US 20020023223A1
• Filed: 02/26/2001
• Published: 02/21/2002
• Est. Priority Date: 02/25/2000
• Status: Active Grant

• Current Assignee: Bayerische Motoren Werke AG
• Original Assignee: Bayerische Motoren Werke AG
• Inventors: Kuhls, Burkhard, Schmidt, Ernst
• Granted Patent: US 7,197,637 B2
• Time in Patent Office: Days
• US Class Current: 713/187
• CPC Class Codes: B60R 25/24 using electronic identifiers containing a code not memorised by the user
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

In a process for insuring data integrity of software for a control unit of a motor vehicle, a central system (trust center) can issue certificates to authorized parties, enabling them to properly sign software for the control unit and import it into a vehicle to enable operation of the vehicle. For this purpose, the trust center (or the vehicle itself) provides a pair of control unit keys having a first and second key. The first key is stored during production of the vehicle in such a manner that it is accessible to the control unit. By means of the second key of the trust center, a first certificate for an authorized party (certificate holder) is signed.

Claims

1. A process for assuring data integrity of software stored in a memory, for controlling operation of a control unit of a motor vehicle, said process comprising:

providing a pair of control unit keys, including first and second control unit keys;

providing a specific number n of pairs of certificate keys, each pair including first and second certificate keys respectively;

filing the first control unit key in or accessible to the control unit in the motor vehicle;

generating certificates corresponding to the specific number n, each certificate comprising a certificate information, certificate information of a last of said certificates including at least one certificate key for checking the software, and when several certificates are used, in other certificate information, at least one certificate key being filed for checking a certificate which follows;

signing certificate information of a first of said certificates using the second control unit key and when a plurality of certificates are used, signing other certificates by using the respective second certificate key of a pair of certificate keys of which the first certificate key is filed in certificate information of a next preceding certificate;

signing software to be newly imported by means of a second certificate key of a pair of certificate keys, of which the first certificate key is filed in certificate information of the last of said certificates;

importing all signed certificates into the control unit;

importing all signed software into the control unit;

checking the signature of the first certificate by means of the first key of the pair of control unit keys filed in or accessible to the control unit and, when a plurality of certificates are present, checking the signature of each additional certificate by means of a first certificate key contained in certificate information of a next preceding certificate;

accepting certificate information of a respective certificate if checking thereof has a positive result;

checking the signature of the software by means of the key included in the certificate information of the last certificate; and

accepting the imported software if said checking also has a positive result.

2. The process according to claim 1, wherein:

a public key is contained in a certificate as the one certificate information; and

the signature to be checked thereby is performed by means of a pertaining secret key.

3. The process according to claim 2, wherein:

the first control unit key which is filed in or accessible to the control unit, is a public key; and

signing of the first certificate is carried out by means of the pertaining secret key.

4. The process according to claim 2 wherein:

a control unit in the vehicle generates an asymmetric pair of keys with a public and a secret key;

the secret key is filed in a control unit in the vehicle; and

the public key can be read out of the vehicle for signing the first certificate.

5. The process according to claim 1, wherein the control unit key filed in or accessible to the control unit is filed in the boot sector of the control unit.

6. The process according to claim 5, wherein after input of the key, the boot sector is blocked and is thus protected against further access.

7. The process according to claim 1, wherein at least one of the software and the certificate information is imaged on an information of a defined length and said information is then signed.

8. The process according to claim 7, wherein a hash function is selected as the imaging function.

9. The process according to claim 1, wherein:

at least one vehicle-specific information for the vehicle containing the control unit is added to the software;

at least one vehicle-specific information is signed by means of the software;

in addition to checking the signatures of the certificates and of the software, the vehicle-specific information is also checked; and

the software is accepted in the control unit only when the vehicle-specific information of the software also corresponds to that of the vehicle.

10. The process according to claim 9, wherein:

for checking vehicle-specific information, a vehicle-specific pair of keys is generated in one of a vehicle security unit and the control unit, the vehicle-specific information and a key of the vehicle-specific pair of keys being present;

in addition to the vehicle-specific information, the additional key of the vehicle-specific pair of keys is filed in the software;

in a separate routine, a check is made whether the keys of the vehicle-specific pair of keys match; and

the imported software is accepted if the answer is affirmative.

11. The process according to claim 1, wherein the software is tested at least during a first start-up of the control unit, and is then correspondingly characterized.

12. The process according to claim 1, wherein in the event of an external access to the control unit, an access unit checks whether an authorization exists for the access.

13. The process according to claim 12, wherein a code is requested by a control unit and the code is checked for validity.

14. The process according to claim 13, wherein:

the control unit supplies a random number which is to be signed by the accessing party; and

the signature applied to the random number is checked in the control unit using an authentication key.

15. The process according to claim 12, wherein:

when access authorization is queried, an authorization stage is determined; and

access actions are accepted or not accepted as a function of the authorization stage.

16. The process according to claim 1, wherein a security device in the vehicle performs an authentication check of a control unit at least a periodically, and registers the control unit in the event of a negative result.

17. The process according to claim 16, wherein a control-unit-individual secret code is filed in the control unit.

18. The process according to claim 16, wherein the security device queries a control-unit-specific characteristic and checks the latter with respect to authenticity.

19. The process according to claim 16, wherein during the authentication check, a key is used which is stored in one of the security device and the control unit.