Method for protecting a motor vehicle component against manipulations in a control device, and control device

Translation of description of equivalent WO 2004026641 A1

IP 4537b Th / Sc

Method for protecting against manipulations in a control device for a vehicle component and control unit Description

The present invention relates to a method for protecting against manipulations in a control device for at least one motor vehicle component, as well as a control unit.

In motor vehicles Components ECUs are used today to control individual motor vehicle, such as the engine control unit or the transmission control unit. The necessary for the operation of such control devices information such as programs and data are encrypted or unencrypted in memory modules (E²PROM, Flash and stored like). The encryption method is stored independent of a fixed hardware combination of modules and usually in a rewritable storage medium.

The disadvantage of such control units and the programs used is that individual memory modules can be replaced, or the data can be overwritten on the memory devices via a diagnostic interface or via direct access to the memory module. The replacement of a memory module or overwriting the data stored on this memory module data and programs can lead to the automotive component works with other data. This is done for example in the so-called chip tuning, wherein the memory blocks that are associated with the engine control unit, replaced or are changed the data stored in these memory devices programs and data, such as identification data. This can be achieved for example an increase in power or torque of the motor. If this manipulation performed without the other automotive components such as oil cooler, turbocharger or brakes adapt, so there may be damage to these vehicle components and safety-critical states.

Object of the present invention is therefore a control unit for automotive components, and a method for protection against manipulation of a to create control unit in which a replacement of a memory chip, and the change of the data on the memory chip is not possible without the operability of the control unit to influence or at least diagnose the modification and if necessary to bring these to the display.

The invention is based on the finding that this object can be achieved, the necessary for the operation of the controller data and programs are stored in different memories.

The object underlying the invention is therefore achieved by a method of protection against manipulation in a control unit for at least one vehicle component, the necessary for the operation of the controller code in at least one master code, which is essential for the function of the controller information includes, and at least one subCode which includes more information on the operation of the controller, is divided, at least the master code is stored in the micro computer and the master code monitors the manipulation of the subcode.

By dividing the code which is necessary for the operation of the control device, on the one hand, a part that needs to be reprogrammed and updated, for example for repairs to be made accessible without that the part which is essential for the operation of the control device information contains, must be accessible. Furthermore, by dividing the code a drop of the code in different stores possible, which will result in increased security against tampering with it. The master code can, for example, the actual control program which includes the calculation of engine load and speed and the manipulated variables and manipulated variables Accessing maps and the control signal generation for the connected actuators of the control unit represent. In the sub-code, the program can then to exhaust emissions for example, and comfort-enhancing measures as may be contained. Both codes may additionally or alternatively contain data.

Preferably, the master code in a read-only, write-once only OTP (one-time-programmable) range of the microcomputer is stored. This is on the one hand an unauthorized change in the master code impossible and secondly, a duplication of the software that is necessary for operating the control unit, are avoided. The subcode may be stored in a rewritable area of ​​the microcomputer or in a rewritable area of ​​an external memory device. Thus, the subcode updated or reprogrammed. By contained in the master code monitoring function against manipulation in the subcode but an unauthorized change of the subcode can be avoided.

Furthermore, the task underlying the invention, achieved by a control device for a vehicle component, comprising at least one micro computer (.mu.C) and at least one memory module, the necessary for the operation of the controller code in at least one master code, includes the essential for the function of the control device information, and at least one sub-code, which includes further information on the operation of the controller, is divided, and at least the master code is stored in the micro computer and the master code a software function module for manipulation detection contains within the sub-codes.

The software function module, for example, comprise a linear or CRC checksum calculation, a hash value formation or an encryption method.

Preferably, a part of the subcode is at least encrypted on a rewritable area and the master code stored is used for generating a key for decryption. The portion of the sub-code, which is stored in encrypted form, for example, can be a fingerprint.

Features and details, which are described in connection with the process of the invention apply mutatis mutandis for the control device according to the invention and vice versa.

The invention is described below with reference to the accompanying drawings, which relate to possible embodiments of the invention. Show it:

1 shows a schematic block diagram of an embodiment of the inventive control device; and Figure 2 is a schematic block diagram of another embodiment of the inventive control device.

1 shows an embodiment of an inventive control device is shown. The structure of control devices such as motor control devices, well out of the known prior art, so that is then received only insofar as is necessary for understanding the invention. The control device 1 comprises in the illustrated embodiment a microcomputer .mu.C, a flash memory 2, and an EEPROM (E²PROM) 3. The flash memory 2 and the E²PROM 3 each have an OTP area 21, 31st These are preferably not designed read-only. Also in .mu.C an OTP area 11 is provided.

The memory modules flash 2, E²PROM 3 are provided in the illustrated embodiment, with block individual identification numbers ID. These are usually written by the manufacturer of the module and stored in the OTP area 21, 31 of the individual blocks.

In the manufacturing process of the control device of the individual memory blocks 2, 3 are read and stored in a write-once OTP area 11 of the microcontroller during the initial commissioning of the controller of the micro computer .mu.C the ID's. From this point, the function of the control unit 1 only in conjunction with the .mu.C known IDs of external memory devices 2, 3 is possible.

At each start-up of the control unit 1 of .mu.C the ID is all read out again with this associated memory devices 2; 3. In a comparison unit then the current ID's can be compared to the original identifiers that are stored in the OTP area 11 of the microcontroller. If it is determined in this comparison that one of the ID's do not match with one of the original's ID, so the controller is prevented from its function, or at least the change diagnosed and this is optionally displayed.

The code to operate the control device is in a master code (MC) and a sub-code (SC) divided. The master code MC contains elementary, essential functionalities for operating the control device, for example, the program for signal generation for the connected actuators (not shown) of the controller or the program for calculating the correcting variable KISSING and manipulated variables. The master code MC may further comprise data. In the sub-code SC additional programs and data are included. The control unit only functions using both codes MC and SC. In the illustrated embodiment, the sub-code SC is included in a rewritable area of ​​the flash memory 2nd The master code MC is contained in an OTP area 11 of the microcomputer .mu.C. The master code is preferably protected from reading about contacting. This can be achieved for example by physically Breakdown of one transistor route or circuitry. The sub-code SC can be modified or overwritten in contrast to the master code MC. This allows updating the subcode or reprogramming.

The / C further includes an identification number .mu.C ID. This is also stored in a read-protected OTP area of ​​the microcontroller. In the E²PROM is more data for the operation of the control device in a rewritable area stored. This data may, for example, adaptation values ​​and idle speeds to be with an engine control unit.

During initialization of the control unit of the micro computer .mu.C learns the data stored in the OTP area 21, 31 of the memory devices 2, 3 and thus unalterable identification numbers and stores them in an OTP area of ​​the microcomputer .mu.C, which can optionally be configured and read-only, from ,

From then on, the micro computer .mu.C are associated with this memory devices 2, 3 is known about their ID.

In addition, the data stored in the micro computer ID's of the memory devices can also be used to encrypt data or programs. Thus, the on the E²PROM stored data is encoded for example by a symmetric encryption method, in which the key comprises at least one part of the ID of at least one of the memory chips 2; 3. In a motor control device can be used in the E²PROM for example be learned values, manufacturing data and adjustment values ​​are stored. To encrypt all symmetric encryption methods are suitable in principle, allow the inclusion of a control apparatus: individual identifier. Preferably, the data of the E are²PROM encrypted by a key, in addition to or alternatively to the ID includes the external memory devices, the ID of the microcomputer .mu.C. In this way, a control device-specific encryption is achieved, the replacement of the E²PROM or overwriting the data stored on it makes it impossible or prevents the operation of the control device after such manipulation. The key is preferably stored in the RAM of the microcomputer .mu.C. This (as the ID of the microcontroller and possibly the ID's of the memory chips) is the key at every startup of the control unit including a control apparatus: individual identifier formed and thus to the control device.

Furthermore, the sub-code SC can be stored wholly or partially encrypted on the flash memory. 2 For this encryption, the ID of the individual memory blocks or of the microcomputer or a part of this ID will be integrated in the key. The decryption of the data in the sub-code is performed by the master code. Since this is stored in a read-protected area of ​​the microcomputer, a read-out of the program and a reproduction of the software can be prevented.

The monitoring of the sub-code against tampering, which is ensured by the .mu.C in the master code can also be done through methods other than encryption. So linear / CRC checksum formation or hash value formation can be used additionally or alternatively. To detect manipulation made of the data and, where appropriate, of parts of the subcode as are formed on selected areas of linear checksums and the result is encrypted gerprint as fingers in the sub-code introduced. The master code is calculated in the control unit operating for example with a signal at terminal 15 over the same predefined range the comparison value (for example, linear checksum) and checks it against the decrypted in the sub-code stored encrypted reference value. The type of the tamper detection can be arbitrarily selected.

After detection of tampering measures are initiated by the master code, which may lead to control device failure.

In figure 2 a further embodiment of the control device according to the invention is shown. In this embodiment, the memory elements 2 and 3 are integrated in the micro computer .mu.C. .mu.C Here has an embed- ded flash memory, wherein the E²PROM is emulated. Although this embodiment of the control device has the advantage that an exchange of the memory chips can be reliably prevented, but the data is in the emulation of the E²PROM only blocks overwritten.

The procedure to protect against manipulation takes place at this control unit with internal memory essentially as described above for control units with external memories. Here, too, can in particular data of the emulated E²PROM are stored in encrypted form and are decrypted by a key, which includes at least an individual identification of the control device, such as the c-ID and / or the flash ID. Likewise the encrypted data or fingerprints in the subcode, which is stored in the flash memory of the microcontroller, contained can be decrypted by the master code. Here, too, a control apparatus: individual identifier is preferably integrated in the key.

The invention is not limited to the embodiments illustrated. So can be considered as an identifier of the individual memory chips, for example, the manufacturing date of the controller. This allows manipulation during the warranty period can be prevented.

The control unit can represent, for example, an engine control unit, a transmission control unit or an instrument cluster for the purposes of this invention.

With a method according to the invention and the control device according to the invention a large number of advantages can be achieved compared with conventional control devices.

With the control device according to the invention can be prevented in a reliable manner, an exchange of one or more blocks, because the function of the controller can be prevented by such exchanges. The reading an absolutely necessary for the function of the control portion of the program or the data is not possible, if this part is stored in the read-protected OTP area. Thus, a reproduction or a modification of the software can be prevented. Also the access to confidential data on the contact of the block is not possible if they are stored in the read-protected OTP area of ​​the microcontroller. Particularly sure the controller can be protected against manipulation are, by being able to run only in the combination of the main and sub-code. A change in the reprogrammable, optionally external memory, such as Flash, stored sub-codes without first adapting the master code to a control device failure. Furthermore, data which, for example on an E²PROM are stored, is encrypted to the control device. The decryption of such data can be made dependent on an identifier of the controller. Additional security can be provided by the encryption and decryption of the composite of the individual modules with the .mu.C known ID's will be made dependent.

In summary it can be determined that the manipulation of control devices, such as chip tuning in engine control units, can be reliably avoided by dividing the code into a master and a sub-code.