WO2006089813A1

WO2006089813A1 - Method for authenticating a module

Info

Publication number: WO2006089813A1
Application number: PCT/EP2006/050114
Authority: WO
Inventors: Jochen Kiemes; Gerhard Rombach; Gunnar Schmidt; Karl Asperger
Original assignee: Siemens Vdo Automotive Ag
Priority date: 2005-02-24
Filing date: 2006-01-10
Publication date: 2006-08-31
Also published as: EP1851900A1; DE102005008928A1

Abstract

The invention relates to a method for authenticating a second module (2) during its allocation to a first module (1), in particular a microcontroller of a tachograph to a memory, the first module having a first logic unit (MC) and a first memory (KMF) and the second module (2) having a second memory (MEM). Previous solutions have been insufficient in addressing the risk of manipulation, especially in the tachograph field (DTCO). The solution provided by the invention is that the second module (2) stores encrypted data, which is accessed by the logic unit (MC) by means of a cryptologic key in order to execute the relevant function.

Description

description

Method for authenticating a module

The invention relates to a method for authenticating a second module when assigned to a first module, in particular a microcontroller of a tachograph to a memory, wherein the first module has a first logic unit and a first memory and the second module has a second memory.

In devices with high security requirements against manipulation are precautions that the manipulative

Prevent access to or replacement of individual components, especially important. These devices is one in particular ^¬ sondere a tachograph as he finds prescribed application in commercial vehicles to record the operating data and working hours. Tampering can take place at all thinking ^¬ compatible system components, with attacks on memory components and logic units are particularly attractive. Requirements for the modularity of the structure require that logic units, possibly with smaller, faster memories and larger memory elements are each separate Bau ^¬ parts that communicate with each other in data transmission. Such a modular structure particularly exposes the data transfer from the logic unit to the mass storage and the mass storage itself for attacks. Basically, the individual components or all components can be secured together against manipulative attacks by means of a so-called active hardware protection, which would, however, far exceed the reasonable effort from an economic point of view.

An arrangement of the aforementioned type of a driving cry ^¬ bers is already known from German Patent DE 41 35 700 C2. The problem of the correct assignment of individual modules of the tachograph, in particular a memory to a tachograph. A microcontroller or a logic unit is not eliminated there.

The invention has therefore set itself the task of developing a method that allows secure authentication of a second module by means of functional units of a first module to prevent manipulation.

The solution according to the invention provides a method of the aforementioned type with the features of claims 1 or 2. The subclaims contain advantageous developments of the invention.

A particular advantage of the method according to the invention lies in the security against manipulation integrated into the system, since the logic unit is part of the first module, which is as self-sufficient as possible with access to the first memory, the second module based on that in the second

Memory stored second data to authenticate. This method finds particularly advantageous application for the modular design of a tachograph, in particular in the combination of the microcontroller of the tachograph with a mass memory, since these components or modules naturally already have some of the functional elements required for the safety function according to the invention. The same time, particularly when used in the field of drive ^¬ scribe method of the invention a large synergy gieeffekt on the already taking place at the start of the tachograph function sequence, especially if it is at the second data from the first portion of the second memory by for The boot process of the logic unit required elements, such as a boot loader or a base operating system.

A maximum of security against manipulation is achieved according to the invention when the first logic unit at the Erstma ^¬ ligen start following the joining of the first Mo- duls generates a first key with the second module after the authentication of the second module and encrypted using the first key the first data in the two ^¬ th memory writes, on which first data, the first Lo gikeinheit accesses to perform certain functions. In the specific functions, there are functions for which the logic unit is determined, namely the proces ^¬ processing and analysis of incoming signals and generation of outgoing signals, sons- term in particular for controlling the operation of connected modules. In the specific case of the logic unit Fahrtschrei- bers example, interprets the incoming signals from the speed sensor and the control panel, and controls the data storage, the other Da ^¬ tenausgabe means outgoing signals the display.

The generation of the first key is performed especially before ^¬ part way by means of a preferably tegrated in the logic unit in ^¬ random number generator, so that outside the Lo ^¬ gikeinheit the first key system-related is unknown. During the second key is given from the outside and data forth for the operation of the implementation of the second key in the logic unit particular spatial Sicherheitsbe ^¬ conditions have to be met in order Ver ^¬ according to the invention take relevant safety standards (Common Criteria, ITSEC) is sufficient, due to the self-sufficient process for generating the second key the dispensability of such a security ^¬ cell. If it is possible to prevent the reading of the first key from the logic unit, a manipulation of the arrangement is therefore excluded. This is particularly the case because the first logic unit accesses the first data encrypted by means of the first key in the second memory in order to carry out its intended function. This also has the great advantage that the two modules from the moment of initial commissioning after assembly are as it were inseparable, to maintain their intended function. The first data stored in the second memory exploit Finally, the first logic unit or the first module and the logic unit or the first module located in the possession of the first key must access the second memory for the intended function, for example the recording and evaluation of operating data of a vehicle or working times of the driver.

In order for an authentication according to the invention to take place exclusively at the first commissioning and not a gege ^¬ possibly manipulated second module can be assembled and put into function with the first module, it is useful if at least a portion of the first portion of the second memory after reading this according to the invention encrypted data is deleted from the logic unit. In this way it is not possible to an individual, optionally held by the second key in manipulatory intention of a new combination to create a first module to a second module optionally having ge ^¬ änderter function, since the irreversibility on ^¬ due to the deletion of from the second portion of the second memory output is additionally increased. Particularly useful here is the overwriting of two ^¬ th data from the first section with a limp home system, which is loaded in case of malfunction after a restart of the logic unit. For this purpose, it is expedient if the logic unit has internal flags that correspond to the mode of the

Booting depending on the history of the previous operation. For example, in the case of registered tampering or system failure, setting a particular flag may cause the emergency drive system address to be accessed upon restart.

For initial start after the assignment of the second Mo ^¬ duls to the first module, it is useful if the Logikein ^¬ integrated on a computer connected to a first interface of the external memory, the first data read access. Since it makes sense to do this in a secure spatial environment gebung - so in a safety cell -. to do, provides access to the logic unit to an external interface ^¬ ask for reading first data no security risk Because assume that manipulation attempts are excluded in the secure environment, in need Since ^¬ tentransfer none encryption. Especially for the tachograph must be the performed by the logic unit Pro ^¬ gram be protected sufficiently specific criteria for the intended function. In this respect, the method according to the invention has a particular suitability for the transmission of an executable program, which is required for the intended function, since the security advantages according to the invention are used simultaneously for secure upload without additional effort.

Additional security is achieved when the first module comprises egg ^¬ NEN third erasable memory in which the first key is stored. The erasability of the third SpeI ^¬ Chers is particularly advantageous in combination with a ak ^¬ tive hardware protection, which is formed in such a manner that upon detection of a manipulation attempt, the third

Memory is preferably deleted by means of a suitably integrated or monitored external auxiliary power. It makes sense here, if the auxiliary energy storage is included in the active hardware protection, so that the deletion of security-relevant data is ensured due to the interruption of other energy supply. Similarly, functional and cost-effective is the arrangement of the auxiliary energy store outside of the active hardware protection in Kombina ^¬ tion with a monitoring sensor which may be as Spannungüberwa- deviation of the auxiliary energy accumulator formed. The auxiliary energy storage can be advantageously designed as a lithium battery and be changed out ^¬ due to such modularity. A combination of an internal and external solution is also conceivable. It makes sense to design the logic unit in such a way that it always accesses the first subarea of the second memory at the first restart, where If necessary, further instructions for booting are deposited. Advantageously, a base operating system and a bootloader can be located in the first subarea of the second memory, which effects the uploading of an instruction code for the intended function of the first module.

When integrating the arrangement produced by the method according to the invention into a motor vehicle, it makes sense if the arrangement is connected to a controller area network (CANBUS). Here, the logic unit can take on more, preferably all safety-related tasks and, for example, prevent manipulation of the Motorsteue ^¬ tion, in particular on the electronic immobilizer. In principle, it is conceivable that operationally necessary components of the motor vehicle, under the necessity of authentication by the logic unit, first undergo a kind of booting process before they can begin their intended function.

In particular, in the application of the invention for tachograph, it is useful if the second memory next to the ERS th and the second portion comprises further partial regions, to which the logic unit or in each case engages cher using differing ^¬ cryptological keys reading and / writing to ^¬. This particular because naturally gen on the tachograph, and in particular the second memory of the tachograph different unauthorized access SUC ^¬, for example through workshops, the driver, the commissioner or public control bodies. In this respect, it makes sense if a separate cryptological key is assigned to different subareas of the second memory and the associated security certificate is stored in the logic unit. In the sense of a modular structure here is useful if the logic unit includes a memory protection module ^¬ which access addresses of the second memory and users respectively a security certificate to-ordered and the logic unit for accessing a Zugriffsad- resse of the second memory of the memory protection module receives a corresponding key from the third or fourth memory is released for access or denied access.

As a result, the invention with reference to a specific Aus ^¬ management example with reference to a drawing for clarity is described in more detail. It shows:

Fig. 1: a schematic representation of a prepared by the inventive method arrangement for a trip writer.

In Fig. 1, a first module 1 as a logic unit MC and a second module 2 are formed as a second memory MEM. The logic unit MC is connected to the second memory MEM by means of a data bus BUS in combination. In addition, the logic unit MC with an external memory 3 and a

Controller Area Network CAN data transmitting connected, this connection is connected to an interface controller IFC the logic unit MC.

Central part of the logic unit MC is a central processing unit CPU by means of which the logic unit processes the MC a ^¬ individual processes. The central processing unit CPU is connected to other components of the logic unit MC in connection, namely in detail with the interface controller IFC, designed as a fixed memory first memory KMF and designed as an erasable memory third

Memory KME. In addition, the central processing unit CPU is in a data-transmitting connection with a random number generator RNG and an encryption module CU. The encryption module CU performs all encryption and decryption tasks, which are carried out in exchange with the second memory MEM by means of the data bus BUS. For this purpose, the encryption module CU accesses the first memory KMF and the third memory KME, where a second Key DKl or first key MKl-MKN are located. A memory protection module MPU is also in communication with the encryption module CU and maps for the United ^¬ encryption module CU to access addresses ADR Sicherheitszer- tifikate to CERT, on the one hand information on the

Key DKl, MKl-MKN and on the other hand on the access ^¬ rights included. Here, security certificates are assigned to CERT users who log in to the system in a manner not shown.

The second memory MEM is divided into several sub-regions, in particular ^¬ sondere a first portion Tl and the second portion of preparation ^¬ che T2-TN, divided, in which encrypted by various Keyring ^¬ sel DKL or MKL MKN data is stored. In the encrypted by DKl portion Tl are encrypted second data D2, namely encrypted boot instructions BC and a boot loader BL, which instructs the first time after joining the first module 1 with the second module 2, the logic unit MC, which memory at which address as to access next. The encrypted by means of the first key MKl-MKN

Subareas Tl-TN contain first data Dl, namely user-specific application data and / or application programs.

After the two modules 1, 2 have been combined, a restart is first carried out. Subsequent to the restart 0, a decryption I. of the boot instructions BC is carried out by means of the encryption module CU by the logic unit MC. Ver ^¬ runs the decryption I. by the second key DKL successful, the logic unit MC assigns the second Spei ^¬ cher MEM, the status of "Authenticated" and loads the boot loader BL also in the central processing unit CPU. An in-circuit ^¬ to the decryption I. central Re ^¬ unit area CPU generates a first key MKl using a random number II. From the random number generator RNG. The subsequent step following the sequence specified by the boot loader BL provides access to the external memory 3 for reading out an instruction code IC. Furthermore, the encryption of the instruction code IC by means of the encryption unit CU follows using the first key MK1 as well as the storage of the encrypted instruction code IC in the area of the second memory MEM whose addresses ADR are assigned to the coding by means of MK1. The instruction code is an executable program required by the logic unit or the first module to maintain the intended function. A loss of the first key therefore means that the functions from the instruction code are no longer available.

Subsequently, the area of the boot loader BL is stored encrypted with an emergency running system FS using the second key DK1, the original bootloader BL overwriting IV. The steps I. - IV. Take place in a security cell, so that manipulation is excluded.

The first module 1 and the second module 2 are in the specially ^¬ len embodiment of components of a digital drive ^¬ writer DTCO.

The logic unit MC is surrounded by an active hardware protection AH, which has an auxiliary power storage B, by means of which even if an external power supply EE, the content of the third memory KME can be deleted if a Manipula ^¬ tion is detected by means of the active hardware protection AH. The auxiliary energy storage B is monitored by means of a monitoring sensor, not shown, in terms of its voltage.

Claims

claims

1. A method for authenticating a second module (2) when assigned to a first module (1), in particular a microcontroller of a tachograph (DTCO) to a memory, wherein the first module, a first Lo ^¬ gikeinheit (MC) and a first memory (KMF) and the second module (2) has a second memory (MEM), characterized in that at a start of the first logic unit (MC) this enters the associated second memory (MEM) in a data-exchanging connection, in the first memory (KMF) a cryptological second key (MKl-MKN) is stored and in a first portion (Tl) of the second memory (MEM) encrypted second data (D2) are stored, wherein the first logic unit (MC) by means of The second key (MK1-MKN) decrypts the second data (D2) from the first subarea (T1) of the second memory (MEM), checks the success of the encryption, and upon successful decryption checks the second module (2) ) classifies as authenticated.

2. The method according to claim 1, characterized in that the first logic unit (MC) certain functions ^¬ leads and at a start riert a first key generated ^¬ and doubted by means of the first key (DKL) Locks ^¬ first data (Dl) in the second memory (MEM) writes to which first data (Dl) the first logic ^¬ unit (MC) accesses to perform the specific functions.

3. A method for authenticating a second module (2) and the assignment to a first module (1), in particular re ^¬ a microcontroller of a tachograph (DTCO) to a memory, wherein the first module, a first logic unit (MC) and the second module (2) a second

Having memory (MEM), wherein the logic unit (MC) be ^¬ agreed perform functions, in particular according to ^¬ claim 1., characterized in that the first logic unit (MC) at a start generates a first key (DKL) and by the first Keyring ^¬ sels (DKL) encrypted first data (Dl) writes in the two ^¬ th memory (MEM) on which first data (Dl), the first logic unit (MC) to perform the accesses th certain functions.

4. The method according to claim 2 or 3, characterized in that the logic unit (MC) at the first start following the joining of the first module (1) with the second module (2) after the authentication of the second module (2) the first Key (DKL) generated.

5. The method according to any one of the preceding claims 2-4, characterized in that by means of the first key (DKL) encrypted first data (Dl) are written in a second portion (T2) of the second memory (MEM).

6. The method according to claim 5, characterized in that at least a part of the first subregion (T1) of the second memory (MEM) is overwritten after the readout of the second data (D2) with a NotlaufSystem (FS).

7. The method according to any one of claims 2-6, characterized in that the logic unit (MC) on a connected to a first interface external Memory (3) the first data (Dl) read accesses and the first data (Dl) are an executable program.

8. The method according to any one of the preceding claims, characterized in that the first logic unit (MC) comprises a separate encryption module (CU), wel ^¬ ches by means of each assigned key (DKL, MKLKN) performs encryption and decryption.

9. The method according to any one of claims 1-8, characterized in that the first module (1) comprises an erasable third memory (KME), in which the second key (MKl-MKN) is stored.

10. The method according to claim 9, characterized in that the first logic unit (MC) and the third SpeI ^¬ cher (KME) from an active hardware protection (AH) are surrounded.

11. The method as claimed in claim 10, characterized in that the active hardware protection (AH) comprises an auxiliary energy store (B) by means of which the content of the third memory (KME) can be erased even if other energy supply (EE) is interrupted.

12. The method according to any one of the preceding claims, characterized in that the logic unit (MC) is designed such that it always accesses the first portion (Tl) of the second memory (MEM) at a restart.

13. The method according to claim 7 and 12, characterized in that in the first partial area (Tl) of the second memory (MEM) at the first start after joining the first module (1) with the second module (2) a program is stored that the statement for the logic unit (MC), to access the first interface ^¬ .

14. The method according to at least one of the preceding claims, characterized in that the logic unit (MC) is in communication with a controller area network (CAN).

15. The method according to any one of the preceding claims, characterized in that the logic unit (MC) comprises a random number generator (RNG), which generates a random number using which the first key (MKl-MKN) is generated.

16. The method according to any one of the preceding claims, characterized in that the second memory (MEM) ne ^¬ ben the first and second partial area (Tl, T2) comprises further sub-areas, to which the logic unit (MC) depending Weil ^¬ using different kryptografi - scher key (MKl-MKN) read and / or write access to ^¬ .

17. The method according to claim 16, characterized in that different users of the arrangement different subregions (Tl, T2) of the second memory (MEM) are assigned, each of which a separate cryptological key (MKl-MKN) is assigned.

18. The method according to claim 17, characterized in that the logic unit (MC), a memory protection module (MPU) to ^¬ summarizes which access addresses (ADR) of the second memory (MEM) and users respectively a Sicherheitszerti ^¬ fikat (CERT) allocates and the memory protection module (MPU) of the logic unit (MC) with access to a Zugriffsad- ress (ADR) of the second memory (MEM) of the SpeI ^¬ cherschutzmodul (MPU) a corresponding Keyring ^¬ sel (DKL, MKL MKN) from the first or third SpeI - rather (KMF, KME) for access or denied access.

19. The method according to any one of the preceding claims, characterized in that in the first Teilbe ^¬ rich (Tl) of the second memory (MEM) boot instructions are stored, which reads the first logic unit (MC) at start and executes.