Method for configuring infotainment applications in a motor vehicle

p0001The invention relates to a method for configuring infotainment applications in a motor vehicle.

p0002From the <patcit id="pcit0001" dnum="DE10044917A1"><text>DE 100 44 917 A1</text></patcit> The invention relates to a method for utilizing functions and performance features in a motor vehicle, in which the motor vehicle is constructed in the form of hardware for utilizing all functions with maximum performance features, wherein functions can be blocked and / or performance characteristics can be throttled Performance features, which are then temporarily or permanently enabled by software.

p0003From the <patcit id="pcit0002" dnum="WO0217184A1"><text>WO 02/17184 A1</text></patcit> A Total Fleet Logistics "system is known, which enables the vehicle to be diagnosed, vehicle monitoring, vehicle configuration and vehicle programming by, for example, a fleet operator via the Internet.

p0004From the <patcit id="pcit0003" dnum="US2006036356A"><text>US 2006/036356</text></patcit> A method for changing the configuration data of a vehicle is disclosed.

p0005However, no satisfactory solutions for the configuration of infotainment applications in motor vehicles of a fleet composite are known from the prior art. The methods known for this purpose are generally limited to written instructions from the fleet operator to the users of the individual fleets.

p0006It is an object of the invention to provide an improved method for configuring infotainment applications in the motor vehicles of a vehicle fleet.

p0007This object is achieved by a method according to claim 1. Advantageous embodiments and further developments of the invention result from the dependent claims.

p0008The vehicle is operated from a motor vehicle with at least one infotainment application and with a control unit which is involved in at least one infotainment application. The term "infotainment" is to be understood in the context of a motor vehicle as the concept of information, communication and entertainment (entertainment). Thus, an infotainment application of a motor vehicle is to be understood as meaning applications in connection with navigation, telephone, telematics, radio, audio, video, email, internet and further future developments, supplements and / or substitutions of such applications.

p0009The control unit, which is involved in at least one infotainment application, has a configuration interface, via which it can be configured in such a way that the functional scope and / or a basic setting of the infotainment application is changed. A change in the functional scope of the infotainment application can, for example, consist in the activation of a navigation function, in the unblocking of an intranet service or in the release of a TV function even when the vehicle is driving. A change in a basic setting of the infotainment application may, for example, consist in the setting of a home address for a navigation system, in the parameterization of an e-mail account or in the configuration of an intranet access.

p0010On the vehicle side, there is also provided a first configuration data server, which is separate from the control device, with a corresponding first configuration database for storing vehicle-related configuration data.

p0011Remotely from the motor vehicle, a second configuration data server is provided stationarily at a service center, with an associated second configuration database for the central storage of configuration data. A wireless communication link exists between the first and second configuration data servers.

p0012The service center can, for example, be operated and / or spatially arranged by a vehicle manufacturer or OEM.

p0013The configuration data of the second configuration database can be configured via at least two different modification interfaces. A major difference between the at least two modification interfaces is the access rights which are granted to a user accessing the second configuration database via the respective modification interface. The configuration data of the second configuration database can be modified with first access rights via a first modification interface, the configuration data of the second configuration database can be modified with second access rights, which differ from the first access rights, via a second modification interface.

p0014The first modification interface is preferably not Internet-based. It is preferably implemented in a line-bound manner, and the second configuration database can preferably only be accessed via a first modification interface from a very specific computing unit and / or from a limited number of computing units, for example from all computing units in a local circuit-bound network. Preferably, the first modification interface is accessible alternatively or additionally only with the availability and use of corresponding first access data. The first modification interface is thus particularly suitable for modifications of the second configuration database by a vehicle manufacturer or OEM.

p0015For the sake of completeness, it should be noted that the first modification interface may in principle also be implemented on the Internet-even if it is primarily provided for modifications of the second configuration database by a vehicle manufacturer or OEM and if the service center is arranged spatially with the vehicle manufacturer or OEM Is.

p0016The second modification interface is Internet-based. Preferably, it is implemented on the basis of known web and / or client / server technologies. According to a preferred embodiment of the invention, the second modification interface can be accessed if a corresponding second access data is available from a conventional PC connected to the Internet. The second modification interface is thus particularly suitable for modifications of the second configuration database by a fleet operator.

p0017The first access rights and the second access rights can be defined in a disjoint manner, that is to say that accesses which are accessible via the first modification interface are completely different accesses than those accessed via the second modification interface. However, there may also be a certain intersection or a certain overlap of the access rights.

p0018According to a preferred embodiment of the invention, a third, also Internet-based modification interface of the second configuration database is additionally provided, via which configuration data of the second configuration database can be modified with third access rights, which differ from the first and second access rights. The third modification interface is thus suitable for modifications of the second configuration database by users of fleet vehicles and / or service providers and / or application providers. Such a modification interface can, however, also be reserved for one of the user groups mentioned, while the other user groups provide their own Internet-based modification interfaces with their own access rights. The third modification interface and possibly further modification interfaces is preferably secured by corresponding access data.

p0019Possible modifications of the configuration data of the second configuration database are recognized either by the service center and / or by the vehicle communicating with the service center. It is, for example, possible to implement recognition of modifications of the configuration data of the second configuration database in such a way that the configuration data are considered changed after access via one of the modification interfaces. However, for example, it is also possible to check whether actually changing accesses have been made and / or the data stand can be reconciled with changes to an earlier data stand.

p0020(Ie, "in response" to the detection), the configuration data of the first and the second configuration data server are transmitted via the wireless communication link between the first configuration data server and the second configuration data server First configuration database. This is done by means of configuration data from the second configuration database, preferably only on previously modified configuration data from the second configuration database. Accordingly, preferably not all but only selected configuration data of the first configuration database are changed, in particular those configuration data of the first configuration database which are related in substance to previously changed configuration data of the second configuration database.

p0021On the basis of the configuration data thus changed from the first configuration database, the functional scope and / or a basic setting of the infotainment application is finally changed via the configuration interface of the control unit. This can also be done either regularly (eg cyclically), at defined time points and / or on the recognition of a change in the data level of the configuration data of the first configuration database (ie, "in response" to the recognition).

p0022Preferably, a basic setting of the infotainment application is changed and the basic setting is a basic setting related to the management of personnel information management data. Accordingly, the infotainment application is preferably an application which - at least inter alia - manages personnel information management data, eg an e-mail client.

p0023The term "personal information management data", which has meanwhile been established in specialist circles, is understood to mean electronically available personal data such as contacts, appointments, tasks, notes, documents such as letters, faxes, SMSs, emails, RSS feeds, as well as today's correspondences , Future developments, supplements and / or substitutions of such data.

p0024Preferably, such changes in the functional scope and / or the basic setting of the infotainment application are performed in the manner described, which are not controlled by means of operating means available in the motor vehicle, in particular not the "conventional operating means" (push buttons, touchpad, keyboard, pressure / rotation controller, etc .) Of the motor vehicle.

p0025If desired, the defined scope of the functional scope and / or the basic setting can, however, be displayed with the aid of operating means available in the motor vehicle. If, for example, an e-mail client is configured in the manner described, the settings (e-mail server, account name, ...) can be displayed for a vehicle occupant on a display unit, but not changeable.

p0026According to a preferred embodiment of the invention, data are stored or stored in the second configuration data server by the first configuration data server via the wireless communication link between the motor vehicle and service center data, in particular so-called certificate signing requests or other configuration- and authentication-relevant data.

p0027Such certificate signing requests to a locally generated, secret key are preferably stored by a control device at "its", ie, the configuration interface assigned to it, and / or at the configuration data server.

p0028In certain cases, the secret access key is generated in the vehicle and never leaves it. The vehicle generates a "Certificate Signing Request", which contains the associated public key. This Certificate Signing Request must be signed by the "Certificate Authority" relevant for a specific access authorization and transferred back into the vehicle as a certificate. With this certificate and the secret key, the vehicle application is then given access to, for example, company data.

p0029A preferred exemplary embodiment of the invention is described below with reference to the single appended drawing. Further details, preferred embodiments and further developments of the invention are given. Here, schematically and exemplarily shows<ul><li><figref idrefs="f0001">FIG</figref> The architecture of a device for implementing the method according to the invention.</li></ul>

p0030According to the state of the art, functions in the area of ​​information, communication and entertainment (overbearing: infotainment) are generally unrestricted and exclusively configurable by the respective end user in modern motor vehicles. One of a few exceptions to this is a blocking of certain functions by the vehicle manufacturer, for example, in the form that the end user must first enter a release code before he can use the respective function.

p0031A configuration of infotainment applications is known, for example, in the form that the end user is given the option of configuring an e-mail client or an access to an e-mail server via operating means in the vehicle or from a distance via an online portal.

p0032A satisfactory central management for the configuration of infotainment systems, for example by a vehicle fleet manager, is not possible with the devices and methods. Furthermore, functions of the infotainment systems in the vehicle can as a rule not be limited by third parties. Relevant configuration parameters are now generally only changeable via coding, disconnection or provisioning of the vehicle. Such processes can normally be used today only by the vehicle manufacturer and are also very much dependent on the respective market or country from the viewpoint of the vehicle configuration.

p0033The prior art or the above-mentioned known methods and devices lead to the following disadvantageous aspects.

p0034A first aspect 1 relates to the configuration by the customer or end user:<ul><li>The end user is confronted with the task of correctly configuring the infotainment systems. As a result, a "correct" or uniform configuration across all vehicles of a vehicle fleet can hardly be ensured. In addition, access to company resources, for example in the case of company cars and carts, should also be provided via the vehicle. In this case, the vehicle or a backend operated by the vehicle manufacturer, as a matter of principle, acts as a stand-alone device and is thus not part of the IT infrastructure of the customer (the vehicle using the vehicle fleet). In order to ensure a functioning configuration in all or as many vehicles of the vehicle fleet as possible, the IT management of the customer's company must instruct all end users (eg employees of the customer's company) to the correct configuration. If necessary, secrets should also be exchanged (eg user identifications, passwords, secret keys and certificates), which could also be misused. The customer-side company thus loses control over such secrets according to the state of the art. Furthermore, the customer has no control over the configuration of the IT systems used in the vehicle and in the back end.</li></ul>

p0035With the increasing spread and expansion of so-called personnel information management (PIM) functions in the infotainment systems of modern motor vehicles, increasingly personal data are processed, which are generally confidential. If these PIM data are company-specific, eg business emails or appointments, processing in company-specific devices is generally not permitted. This may lead to the paradoxical situation that the vehicle infotainment systems provide technically perfect PIM functions, but that they can not be used by the end user because of the lack of control by the customer.

p0036A second aspect relates to the possibility (often lacking in the prior art) of restricting functions:<ul><li>With regard to information technology systems in companies (and outside of motor vehicles), it is now common for the IT management of the enterprise to make specifications regarding the use and configuration of these devices, and to implement them technically in the form of safety guidelines and policies.</li><li>Satisfactory possibilities to do the same in vehicle infotainment systems have so far not existed. This means that a customer or vehicle rental company can not impose restrictions or restrictions on the configuration and use of the information, communication and entertainment functions of the vehicle.</li><li>It is true that customer-oriented companies often meet the requirements of a vehicle manufacturer and impose restrictions on the functions, eg, the functions that can be used during the journey. The vehicle manufacturer can, however, react to this only at a comparatively high cost, namely by either setting up a corresponding restriction individually for individual or all vehicles which are delivered to the respective customer-side company, or a corresponding restriction even applies to all customers. On the other hand, it would be much more advantageous if, instead, a vehicle fleet manager or the IT management of the customer's own company could configure restrictions in the vehicle itself.</li><li>Business models could also be adapted to suit their needs. Car rental companies can not currently calculate additional functions, eg using a navigation system. The customer is therefore offered either a vehicle with or without a navigation system. On the basis of the presented procedure, a navigation application by the car rental company could be released if necessary.</li></ul>

p0037A third aspect 3 concerns a policy-based software sale or policy-based software rental for vehicle functions:<ul><li>Because of the very limited possibilities according to the state of the art to activate or deactivate software-based vehicle functions, it is generally not possible today to provide an end user with a specific function or application only for a limited time. On the basis of the presented procedure it would be possible to rent a navigation application for the period of a holiday or business trip (from the point of view of the customer) or to switch it off (from the point of view of the customer company and / or from the viewpoint of the vehicle manufacturer).</li></ul>

p0038The above-described method makes possible a remotely centralized configuration of the information, communication and entertainment systems of the motor vehicle, for example by the IT management of a company, by a service provider, by a vehicle operator, by a car rental provider or by a vehicle manufacturer or its dealer network . The end user of the vehicle is relieved of this task.

p0039The described method also allows limitation of the functionality or configuration settings in the information, communication and entertainment systems in the vehicle by the use of policies and policies by an authorized authority, eg the IT management of a company, by a service provider, by a fleet manager, By a car rental company or by a vehicle manufacturer. A car rental company and / or a vehicle manufacturer can provide certain functions for an extra charge or otherwise restrict them.

p0040On the basis of the presented procedure, customer-based companies will be able to handle the information, communication and entertainment systems of the motor vehicle as part of the IT infrastructure of the customer's company. Access to confidential company resources, such as e-mail servers, intranet, deadline calendar, VPN, etc., can therefore be configured and limited by the company itself.

p0041A preferred technical device or architecture for realizing the invention is schematically constructed as follows: (cf. <figref idrefs="f0001">FIG</figref>) "

p0042In the vehicle electrical system of the motor vehicle 10, at least one electronic control unit, if appropriate also several electronic control units (in <figref idrefs="f0001">FIG</figref> Are precisely three control units) is equipped with a configuration and policy client 11, 12, 13, via which the functions provided by the respective control unit are configured or limited. Thus, for example, the navigation can be set such that a destination can only be entered in the stand, or the e-mail application can be configured correctly.

p0043The configuration and policy / policies refer to the "Configuration and Policy client" from a "vehicle-in-vehicle configuration and policy server and database" 14, in which all configurations and policies / policies Centrally.

p0044According to an optional, but preferred, embodiment of the method described, one or more control devices can store a "Certificate Signing Request" in the on-board network of the motor vehicle 10 in a locally generated, secret key in the "Configuration and Policy Client" 11, 12, 13. The following use case is therefore based on the<figref idrefs="f0001">FIG</figref> The secret key is generated in the vehicle. For this purpose, a Certificate Signing Request is generated, which must be transmitted to a Certificate Authority (CA) located outside the vehicle, which in particular the CA of the vehicle manufacturer, be signed there and then transferred back into the vehicle as a signed certificate.

p0045The configuration and policy client 11, 12, 13 periodically updates the relevant configuration and policy data from this "in-vehicle configuration and policy server and database." 14 In reverse, the data can be updated in the "in-vehicle configuration And policy server and database "14, the clients 11, 12, 13 can also be notified of the change. This can be referred to as a "Configuration and Policy Push".

p0046According to a further optional, but preferred, embodiment of the presented method, the configuration and policy client 11, 12, 13 can store information in the "in-vehicle configuration and policy server and database" 14, eg, "certificate signing requests" Configuration and authentication-relevant data.

p0047By means of current cryptographic methods, it is optionally ensured that the configuration and directive data are confidential, authentic and / or free of manipulations.

p0048Via a communication device (eg GSM, GPRS, UMTS, Wimax, WLAN or LTE module) 15 installed in the vehicle or via a consumer electronics device (connected via a corresponding interface "CE device interface" 16) by the end user (CE) device (or portable communication device) 17 communicates the "in-vehicle configuration and policy server and database" 14 with a backend, the "configuration and policy backend" 20. The core component of the backend 20 is the "backend configuration and policy Server and database "22, in which all relevant configuration and policy data are stored. Communication takes place via a wireless communication link between the communication device 15 or the CE device 17 and a communication device 21 connected to the "back end configuration and policy server and database" 22.

p0049In contrast to the vehicle system 10, the back end 20 is constantly available and can serve several vehicles. In the "backend configuration and policy server and database" 22, the configuration and policy data, which are retrieved in regular cycles by the "in-vehicle configuration and policy server and database" 14, are transferred centrally by means of changes to the vehicle 10 .

p0050According to a further optional, but preferred, embodiment of the method described, the data stored there, eg, "Certificate Signing Requests" or other configuration- and authentification-relevant data, can be stored in the "in-vehicle configuration and policy server and database" "Backend configuration and policy server and database".

p0051By means of current cryptographic methods, it is optionally ensured that the configuration and directive data are confidential, authentic and / or free of manipulations.

p0052The data stored in the "Backend configuration and policy server and database" 22 can include:<ul><li>Settings, eg configuration of email accounts, user information such as email addresses, favorites, lists, navigation targets, screen backgrounds, personalizations, channel lists, message channels, etc.</li><li>Authentication data, eg user names and passwords, secret keys, certificates (eg for Certificate Based Authentication, eg when retrieving company emails), etc.</li><li>"Certificate Signing Requests" generated by participants in the vehicle electrical system of the motor vehicle and transmitted to a Certificate Authority (CA) of the vehicle manufacturer and / or an authorized third party.</li><li>Policies and policies, such as restrictions on specific functions in specific situations, restrictions on parameters such as speed or location or time or frequency of use, restrictions on communication partners, restrictions on import / export interfaces, password quality requirements, frequency of changing the password for accessing information (Eg company emails), specifications regarding auto deletion of data records in the vehicle after incorrect password input etc., specifications regarding binding to a specific vehicle key, etc.</li><li>Permissions, eg unlocking vehicle keys for a vehicle, or replacing the function of the vehicle key with other access keys, eg user name and password.</li><li>Commands to be executed by the vehicle to protect the company's IT infrastructure when misuse, eg after the theft of the vehicle, eg deletion of data stored in the vehicle such as e-mails, telephone books, etc., and access rights / secrets.</li></ul>

p0053The data stored in the "backend configuration and policy server and database" 22 can be edited by the vehicle manufacturer 30 and / or by an authorized third party 40, 50, 60 via a "Policy Configuration User Interface" 23, 24.

p0054A separate first "Policy Configuration User Interface" 23 for vendor configurable policies ( "vendor configurable policies") can be provided for accesses by the vehicle manufacturer 30. In the present case, the interface 23 is not implemented on an Internet-based basis. Access may, in particular, be based on web or client / server technologies. A "Policy Configuration User Interface Client" 32 is executed for the vehicle manufacturer.

p0055A separate second "policy configuration user interface" 24 may be provided for the preferably Internet-based, access-authorized third party for specifically configurable policies ( "user configurable policies"), which are specifically configured by authorized third parties 40, 50, 60, in particular end customers. Web or client / server technologies can be used. A "Policy Configuration User Interface Client" 42, 52, 62 is executed for each authorized third party 40, 50, 60. For the data connection between the back end 20 and the authorized third parties 40, 50, 60, a communication device 25 is provided on the one hand for the back end 20, on the other hand a communication device 41, 51, 61 is provided for each authorized third party 40, 50, For access, common authentication and encryption techniques can be used.

p0056Authorized third parties may be, in particular, a customer company 40, in particular its fleet management or IT management, and / or a car rental provider.

p005750. End users may themselves themselves be vehicle owners (and are therefore not subject to instructions or policies of a customer-owned company), or are tenants of a rental car or employees of a customer-owned company (the directives or policies Of a customer-based company).

p0058In the case of authorized third parties, other so-called "3rd parties" 60, eg service providers (service providers) or application providers (application providers), may also be involved.

p0059In the present example, the access of the different groups 40, 50, 60 authorized third parties is based on the same technology and comparable hardware. However, the different groups 40, 50, 60 are entitled to different access rights.

p0060Finally, significant advantages of the presented method are summarized and explained at exemplary application scenarios.

p0061The presented procedure allows a company to retain control over the information communication and entertainment functions of the vehicle. In the prior art methods, the inspection is as a rule subject to the vehicle user. This check is a prerequisite for the vehicle to be integrated into the information infrastructure of the company, eg by accessing e-mails, appointments or the intranet. Furthermore, the presented method allows the "correct" configuration to be carried out centrally by a department for a large number of vehicles, so that in the course of growing complexity, each end user no longer has to deal completely with all functions and their correct configuration.

p0062The presented procedure supports, among other things, the following, exemplary selected cases and application scenarios:

p0063A first application scenario relates to the configuration of the functions by the fleet manager or the IT management of a customer's company:<ul><li>The described procedure makes it possible to configure the infotainment functions in the vehicle centrally, ie company-wide, through a fleet management or IT management. This ensures a uniform configuration across all vehicles in the vehicle fleet. If necessary, the administrator can also block the configuration against modifications.</li></ul>

p0064A second application scenario concerns the configuration by a service provider:<ul><li>The presented method allows a third service provider to create a configuration that the end user can then activate in the vehicle. For example, an e-mail provider (such as GOOGLE MAIL) could offer a function that automatically configures the vehicle so that the e-mails can also be retrieved in the vehicle. The vehicle user can then simply import the correct configuration into his vehicle.</li></ul>

p0065A third application scenario concerns the blocking of individual functions:<ul><li>A customer-oriented company or a car rental company can block functions in the infotainment area for its own vehicles. Thus, for example, the maximum volume of the music can be limited, the destination input during the trip can be prevented or a navigation to the foreign country can be prevented. The functions can be restricted individually via policies and policies. The car rental company can, for example, navigate the navigation or television individually, depending on the tariff of the car rental company has booked. This possibility exists analogously also for the vehicle manufacturer (eg navigation of the navigation for a certain period of time).</li></ul>

p0066A fourth application scenario concerns the use of safety guidelines:<ul><li>Since the infotainment system of the vehicle can be used for business information, eg emails or address book, and this information is normally subject to company safety guidelines, it may be useful to enforce these safety guidelines technically in the vehicle. The presented method allows this, for example, by blocking certain functions such as data exports, or by setting specifications for use, eg in the form of a password protection of sufficient quality or the binding to a particular vehicle key. If necessary, for example, all data stored in the vehicle can be automatically deleted if a safety guideline is violated. The security guidelines may include, for example, the restriction of websites that the end user may access.</li></ul>

p0067A fifth application scenario concerns so-called "configuration roaming":<ul><li>In addition, the method described above makes it possible to bind the configuration not to a specific vehicle, but to a specific vehicle key or a specific person who has authenticated himself / herself via a user name / password, a CE device or other means of authentication. For example, an individual configuration could always follow the end user into the vehicle he is currently using.</li></ul>