Motor vehicle with a driving behavior which can be modified at a later stage using an application program

• US 9,560,061 B2
• Filed: 02/14/2014
• Issued: 01/31/2017
• Est. Priority Date: 02/22/2013
• Status: Active Grant

• Current Assignee: Audi AG (Volkswagen AG)
• Original Assignee: Audi AG (Volkswagen AG)
• Inventors: Landgraf, Johannes, Wilding, Werner, Kraeuter, Thomas, Schmidt, Walter, Michael, Joerg, Schuessler, Martin, Stahlmann, Rainer, Moeller, Malte
• Primary Examiner(s): Kan, Yuri
• Application Number:
  US14/768,571
• Publication Number:
  US 20160006752A1
• Time in Patent Office: 1,082 Days
• Field of Search: 709/224, 705/3, 705/4, 703/8, 701/29.1, 701/41.5, 701/33.4, 701/26, 340/521, 340/439, 702/188, 726/6
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 4/40 for vehicles, e.g. vehicle-to-pedestrians [V2P]
• CPC Class Codes: H04W 4/44 for communication between vehicles and infrastructures, e.g. vehicle-to-cloud [V2C] or vehicle-to-home [V2H]
• CPC Class Codes: H04W 4/46 for vehicle-to-vehicle communication [V2V]

Abstract

A motor vehicle has a processor device to run application programs in a first communication zone and a storage device for vehicle control data, by which a driving behavior of the motor vehicle is determined. The storage device is arranged in a second communication zone of the motor vehicle. In order to allow a modification of the vehicle control data at a later stage using an application program and thus provide protection against an undesired manipulation of the vehicle control data, the first and the second communication zones are coupled by a monitoring device that forwards new data, which an application program is attempting to transmit from the first communication zone into the second communication zone, to the second communication zone only if the monitoring device has detected that the new data leads to a safe motor vehicle driving behavior defined by a specified safety criterion.

Claims

1. A motor vehicle comprising:

a communication device to perform wireless data communication with a device outside the motor vehicle, the device outside the motor vehicle being at least one of a vehicle-external appliance and another motor vehicle;

a processor device to execute application programs in a first communication zone, to perform data interchange between the application programs and the device outside the motor vehicle using the communication device;

a memory device for vehicle control data that stipulate a driving behavior for the motor vehicle, the memory device being arranged in a second communication zone of the motor vehicle; and

a monitoring device to couple the first and second communication zones to monitor new data, which one of the application programs attempts to transmit from the first communication zone to the second communication zone, to recognize whether the new data result in a safe driving behavior for the motor vehicle that is defined by a prescribed safety criterion, and to forward the new data to the second communication zone only if the new data result in the safe driving behavior, wherein the motor vehicle has at least one property selected from a group consisting of;

the motor vehicle stores a plurality of preinstalled, selectable characteristic maps and the monitoring device takes the new data as a basis for enabling and activating at least one of the preinstalled characteristic maps for use as vehicle control data in the motor vehicle,

the monitoring device performs a simulation for a driving behavior that results from the new data and forwards the new data only if the simulation shows that an admissible driving behavior is obtained in accordance with a predetermined plausibility criterion, and

the motor vehicle contains a third communication zone, which is coupled to the first communication zone via the monitoring device, the third communication zone having a memory to store secret data, the secret data being at least one of vehicle-related secret data and person-related secret data, the secret data being for at least one of an online payment and an online service, the monitoring device permitting data access from the first communication zone to the third communication zone only with a valid authentication code.

2. The motor vehicle according to claim 1, wherein

the monitoring device compares the new data with at least one framework characteristic map stored in the motor vehicle, and

the monitoring device blocks transmission of the new data if the new data, when used as vehicle control data, would result in a control value outside an admissible range defined by the at least one framework characteristic map.

3. The motor vehicle according to claim 1, wherein the second communication zone comprises a component that is coupled to the memory device and that controls a driving mode of the motor vehicle.

4. The motor vehicle according to claim 3, wherein the component is at least one component selected from a group consisting of:

a driving-safety-relevant controller, a controller for driving dynamics control, a map memory for the driving-safety-relevant controller, a sensor, an onboard power supply system for supplying power, a drive-by-wire controller, and a controller that controls automatic driving properties.

5. The motor vehicle according to claim 1, wherein

the motor vehicle contains the third communication zone, which is coupled to the first communication zone via the monitoring device, the third communication zone having the memory to store secret data, the monitoring device permitting data access from the first communication zone to the third communication zone only with a valid authentication code, and

the monitoring device receives the valid authentication code from an operator via one of the application programs executed in the first communication zone.

6. The motor vehicle according to claim 1, wherein

the motor vehicle contains the third communication zone, which is coupled to the first communication zone via the monitoring device, the third communication zone having the memory to store secret data, the monitoring device permitting data access from the first communication zone to the third communication zone only with a valid authentication code, and

the monitoring device receives the valid authentication code from the vehicle-external appliance via the communication device.

7. The motor vehicle according to claim 1, wherein

the motor vehicle contains the third communication zone, which is coupled to the first communication zone via the monitoring device, the third communication zone having the memory to store secret data, the monitoring device permitting data access from the first communication zone to the third communication zone only with a valid authentication code, and

the monitoring device stipulates the valid authentication code using a transaction number (TAN) method.

8. The motor vehicle according to claim 1, wherein

the motor vehicle contains the third communication zone, which is coupled to the first communication zone via the monitoring device, the third communication zone having the memory to store secret data, the monitoring device permitting data access from the first communication zone to the third communication zone only with a valid authentication code, and

the monitoring device changes the valid authentication code after each use or after a particular period of time has elapsed.

9. The motor vehicle according to claim 1, wherein the motor vehicle stores the plurality of preinstalled, selectable characteristic maps and the monitoring device takes the new data as a basis for enabling and activating at least one of the preinstalled characteristic maps for use as vehicle control data in the motor vehicle.

10. The motor vehicle according to claim 1, wherein the monitoring device performs the simulation for the driving behavior that results from the new data and forwards the new data only if the simulation shows that the admissible driving behavior is obtained in accordance with the predetermined plausibility criterion.

11. The motor vehicle according to claim 1, wherein the motor vehicle contains the third communication zone, which is coupled to the first communication zone via the monitoring device, the third communication zone having the memory to store secret data, the monitoring device permitting data access from the first communication zone to the third communication zone only with a valid authentication code.

12. The motor vehicle according to claim 1, wherein

the application program which attempts to transmit the new data is an application program that is authorized to operate in the first communication zone, and

even though the application program is authorized to operate in the first communication zone, the monitoring device monitors the new data to recognize whether the new data result in the safe driving behavior.

13. A method for monitoring action in vehicle control data that stipulate a driving behavior for a motor vehicle, comprising:

monitoring, using a monitoring device, a connection between a first communication zone, in which an application program that provides new data for altering the vehicle control data is executed, and a second communication zone, in which the vehicle control data are stored in a memory device;

after recognizing an attempt to transmit the new data from the first communication zone to the second communication zone, checking the new data by the monitoring device for whether use of the new data as vehicle control data will result in a safe driving behavior for the motor vehicle that is defined by a safety criterion; and

permitting, by the monitoring device, transmission of the new data to the second communication zone only if the new data will result in the safe driving behavior, wherein the method has at least one property selected from a group consisting of;

the motor vehicle stores a plurality of preinstalled, selectable characteristic maps and the monitoring device takes the new data as a basis for enabling and activating at least one of the preinstalled characteristic maps for use as vehicle control data in the motor vehicle,

the monitoring device performs a simulation for a driving behavior that results from the new data and forwards the new data only if the simulation shows that an admissible driving behavior is obtained in accordance with a predetermined plausibility criterion, and

the motor vehicle contains a third communication zone, which is coupled to the first communication zone via the monitoring device, the third communication zone having a memory to store secret data, the secret data being at least one of vehicle-related secret data and person-related secret data, the secret data being for at least one of an online payment and an online service, the monitoring device permitting data access from the first communication zone to the third communication zone only with a valid authentication code.

14. The method for monitoring action in vehicle control data according to claim 13, wherein

the monitoring device compares the new data with at least one framework characteristic map stored in the motor vehicle, and

the monitoring device blocks transmission of the new data if the new data, when used as vehicle control data, would result in a control value outside an admissible range defined by the at least one framework characteristic map.