DE102017203190A1 - Control unit for a motor vehicle, comprising a protective device for the protection against theft of digital data, and motor vehicle - Google Patents

Abstract

The invention relates to a control unit (11) for a motor vehicle (10), comprising a protection device (24) for securing theft of digital data (21) stored within the control unit (11) in a data memory (22), wherein the protection device ( 24) is set up to irrevocably delete the digital data (21) without the intervention of a user by means of a predetermined deletion routine (30), if a detection device (25) of the control device (11) by means of an erasure signal (27) at least a predetermined mechanical change of at least one component of the control unit (11) and / or electrical separation of the control unit (11) from a voltage source (15) signals.

Description

The invention relates to a protective device for a control unit of a motor vehicle, which prevents unauthorized reading of digital data contained on a control unit. This is to ensure that unauthorized access to the motor vehicle is prevented. The invention also includes a motor vehicle with the control device according to the invention.

From the publication DE 103 32 533 A1 It is apparent that in the case of unauthorized removal of a control device, a pyrotechnic ignition device connecting means, which connect the controller to the electronic board network, be brought into a state that makes it impossible to connect another controller. This igniter does not affect the data contained on the stolen controller. A reading of those from the stolen control unit and fraudulent re-use can not be prevented. Thus, another motor vehicle can be influenced again by the control unit.

From the DE 195 27 504 C1 a device for protecting a motor vehicle control unit prior to replacement is known. A function-inhibiting device interrupts an electrical connection, via which the control unit can be supplied with electrical energy. The electronic components of the control unit, in particular a data memory, are thus not affected in their functionality and can still be used if electrical energy is supplied again.

From the DE 10 2014 006 389 B3 It is known to make a radio key useless by generating a high-voltage pulse. If certain states are detected on the radio key, it is provided that a single pulse is emitted by a motor vehicle in the resonant frequency of the passive transponder of the radio key, so that its passive transponder destroys itself by the resonance effect. The so-called key secret stored in the radio key can then nevertheless be procured by stealing the corresponding data memory and used in a simulated radio key.

The invention is based on the object in a motor vehicle of a control unit sensitive digital data that could be used for a manipulation of the motor vehicle to protect.

The object is solved by the subject matters of the independent claims. Advantageous developments of the invention are described by the dependent claims, the following description and the figure.

The invention provides a control unit that can be installed in a motor vehicle. Within the controller are stored in a data memory digital data, based on which the motor vehicle, e.g. unlock and thus put into operation. The control unit therefore has a protective device for stealing these digital data. The said protective device is adapted to irrevocably delete the digital data without the intervention of a user, that is, automatically or automatically, by means of a predetermined deletion routine. The protective device carries out the deletion routine if a detection device of the control unit detects by means of an erasure signal that at least one predetermined mechanical change has been detected on at least one component of the control device and / or electrical separation of the control device from a voltage source. The detection device thus detects a so-called tampering or manipulation of the control device, which is to be understood as the mechanical change of the at least one component, for example of the housing, and / or an electrical disconnection or interruption of the external power supply. The external voltage source for the power supply can be for example a vehicle battery or an electrical system of the motor vehicle, to which the control unit can be connected. The protective device and / or the detection device can each be provided on the basis of an electronic circuit, for example on a circuit board.

The invention provides the advantage that in the said manipulation of the control device, the digital data itself destroyed or irrevocably deleted, and not only electrical access lines. Thus, the data can not be read or reconstructed after a stealing or a theft of the controller from this, then to equip it, for example, another control device and thereby generate control signals that could be unlocked the motor vehicle or another motor vehicle.

The invention also includes optional developments, by the characteristics of which additional benefits.

The control unit is in particular configured to enhance a motor vehicle for a mobility service, such as car sharing. The control unit can in this case be set up to be retrofitted as a retrofit solution in the motor vehicle to this retool and make it suitable for the mobility service. It can therefore be used as a mass-produced motor vehicle. The control unit can be set up via a mobile radio connection, eg by means of a mobile telephone, and / or via an NFC communication (NFC - Near Field Communication) and / or Bluetooth (eg BLE - Bluetooth Low Energy) and / or WLAN (Wireless Local Area Network) and / or another communication interface to unlock and / or close the motor vehicle and / or to issue a start release for a traction drive of the motor vehicle, which releases or deactivates a motor lock of the motor vehicle. To be able to provide such a radio-based control system, it must be possible to activate the motor vehicle without its own remote control key. For this purpose, the so-called key secret of a radio key, that is to say a cryptographic key, can be installed in the control unit. But if someone steals the control unit, he can read out this key secret and thus also unlock the motor vehicle. According to the invention, this can be prevented by the control unit according to the invention being set up to control a locking system and / or a motor lock of the motor vehicle by means of the digital data, which is the key secret. This key secret comprises or includes the cryptographic key needed to generate a control signal for the locking system and / or engine lock of the motor vehicle so that the motor vehicle will release. The control unit according to the invention has the advantage that the key secret is deleted or destroyed in the form of the digital data if someone manipulates the control unit in such a way that the detection unit generates the clear signal. Thus, the key secret can then no longer be reconstructed.

In order to erase the digital data, the erase routine may include erasing the data in the data memory by means of an erase command. In a so-called flash memory, this leads to the fact that instead of the data bits 0 Bits are stored. In order to make reconstructing the data more difficult, it may additionally or alternatively be provided that the digital data is overwritten by means of a bit pattern. It can be a predetermined bit pattern or a random bit pattern.

The deletion routine may additionally or alternatively include an overvoltage and / or an overcurrent being applied to the data memory so that the data memory is mechanically damaged or destroyed in each case. In particular, the memory cells, in each of which 1 bit of the digital data is stored, are electrically destroyed. Additionally or alternatively, a chemical destruction (for example, by an acid) and / or a pyrotechnic destruction of the data memory can be provided by way of example.

It can also be a combination of the deletion measures described (delete command, overwrite, overvoltage / overcurrent) may be provided. In general, it is preferably provided that the protective device is set up to carry out the deletion routine several times in succession upon receipt of the deletion signal, in each case with the same or a different one of the deletion measures. Thus, in the case of overvoltage and / or overcurrent, it is preferable that a smaller amount of energy is obtained for each erase routine in order to achieve a predetermined degree of destruction, since this amount of energy is applied several times.

In order to be able to independently carry out the provision of protection against loss of the digital data without an external power supply, it is preferably provided that the control unit has its own energy source provided exclusively for operating the protective device and the detection device. Thus, a dedicated energy source, for example an electric accumulator or a battery or a capacitor, is provided, by means of which the protective device and the detection device can be operated for a predetermined minimum period of time, for example in a range of 10 seconds to one week. In this case, it may be provided that a remaining energy content and / or a remaining supply voltage of the energy source is detected and the erasure signal is triggered when the threshold falls below a respective threshold value. This ensures that after the controller is stolen the digital data is erased before the energy of the power source is exhausted.

So far, it has only been described that generally a mechanical change of at least one component of the control unit is detected by the detection device and then the clear signal is generated. Which component is sensibly or expediently monitored here can be determined by a person skilled in the art depending on the design of the control device.

Advantageously, a housing of the control unit is monitored as a component. In the housing of the data storage is arranged. Of course, other elements of the control device, such as the protective device and / or the detection device and / or a circuit board of the controller may be arranged in the housing. The detection device then has at least one electrical switch whose switching state is dependent on an opening state of the housing. When the housing is open creates the at least one electrical switch then the clear signal. The at least one electrical switch serves in each case as a sensor which detects the unauthorized opening of the housing. For example, such a switch as a push-button or push-button or micro switch (micro switch) can be configured, which is held by a housing cover or a housing shell in a first switching state. If the housing cover or the housing shell removed or moved, the switch changes to a second switching state, which then the clear signal can be generated.

As an additional or alternative component, a light-tight or light-insulating enveloping element can be provided, in which at least the data memory can be arranged together with a photodetector. Such an enveloping element can be formed, for example, by a plastic film and / or by the said housing. The photodetector may be configured to detect visible light and / or infrared light and / or ultraviolet light or generally electromagnetic radiation so that it adjusts a sensor signal or detector signal in response to a luminous flux or radiation power. The detection device is in this case configured to generate the erase signal in response to the detector signal of the photodetector. This results in the advantage that even when bypassing an opening mechanism of the housing, for example by sawing or drilling or breaking of the housing, the mechanical change detected by the then incident light or the incident brightness and then the clear signal can be generated.

As an additional alternative component of the control device, a light-guiding device can be provided which covers or surrounds at least the data memory. For example, a network or a matrix of light-conducting fibers can be provided. The detection device is set up to illuminate a receiving sensor with a light signal by means of a light source, for example a light-emitting diode, through the light-conducting device. Such a reception sensor may for example be a photodetector of the type described. Conducting the light generated by the light source or generally the electromagnetic light signal to the receiving sensor is thus dependent on a state of the light guide. If the light-conducting device is destroyed or broken or removed, the reception detector no longer receives the light signal of the light source. The detection device is set up to generate the clear signal if the light signal fails in the receiver sensor. To prevent emulation or emulation of the flare signal after a removal or destruction of the light-guiding device, the flare signal is preferably generated as a sporadic or random or according to a pseudo-random time pattern by the light source. Thus, the light signal at the receiving sensor can not be imitated by a simulated light source. Since the detection device knows a time profile of the light signal, it can distinguish a "real" light signal generated by its own light source from a trailing light signal.

The invention also provides a motor vehicle, which has a locking system and / or a motor lock, which are each configured by means of a control signal controllable or unlockable. By the control signal so the locking system can be actuated or switched, so unlocked in the motor vehicle, at least one vehicle door and / or closed. The engine lock can also be unlocked by means of the control signal in particular. The locking system and / or the motor lock is coupled to an embodiment of the control device according to the invention. A single control unit is enough to control both the locking system and the engine block. The motor vehicle according to the invention can be used advantageously as a car-sharing vehicle. For this purpose, a mobile radio module and / or an NFC radio module and / or a Bluetooth radio module and / or a WLAN radio module and / or a further radio module may optionally be provided in the control device in order to receive a request signal for generating the respective control signal.

In the following an embodiment of the invention is described. For this purpose, the single FIGURE (FIG.) Shows a schematic representation of an embodiment of the motor vehicle according to the invention.

The exemplary embodiments explained below are preferred embodiments of the invention. In the exemplary embodiments, the described components of the embodiments each represent individual features of the invention, which are to be considered independently of one another, which each further develop the invention independently of one another and thus also individually or in a different combination than the one shown as part of the invention. Furthermore, the described embodiments can also be supplemented by further features of the invention already described.

The figure shows a motor vehicle 10 which may be, for example, a motor vehicle, in particular a passenger car. Shown are a control unit 11 for generating a respective control signal 12 for at least one vehicle component 13 . 14 of the motor vehicle 10 , In the vehicle component 13 it can be For example, to act a locking system for example, at least one vehicle door of the motor vehicle. The component 14 may for example be a motor lock, by which an operation of a drive motor of the motor vehicle 10 can be blocked.

To power the controller 11 can be an external power source 15 be provided, for example, an electrical system of the motor vehicle 10 with a vehicle battery.

Thus the control unit 11 the control signals 12 for example, to unlock the motor vehicle 10 and / or generates the engine lock, it can be provided that, for example via a mobile radio connection 16 a request signal 17 must be received. The control unit 11 may be to receive the request signal 17 for example, a mobile module 18 have, for example, a GSM radio module or UMTS radio module or LTE radio module, and / or an NFC radio module and / or a Bluetooth radio module and / or a WLAN radio module and / or another radio module. The request signal 17 can be connected to a control device 19 of the control unit 11 to get redirected. The control device 19 can then be dependent on the request signal 17 the control signals 12 produce. The control device 19 For this purpose, it may be formed in a manner known per se, for example on the basis of a microprocessor or microcontroller.

To the control signal 12 in response to the request signal 17 can be provided that the reception of a key signal of a radio key in the control unit 11 readjusted or simulated. Crucial for this is that a key signal is adjusted, as it would produce a radio key. For this is a so-called key secret 20 necessary that normally is stored in a radio key. At the control unit 11 can be the key secret 20 in the control unit 11 be provided so that a radio key is needed. It can instead be a simulated key signal 17 on the basis of the key secret 20 be generated. The key secret 20 includes digital data 21 in a data store 22 of the control unit 11 can be stored. The data store 22 For example, on a circuit board 23 be arranged.

But now if someone the key secret 20 ie the digital data 21 , from the data store 22 or reads out, it can also control signals based on a remote key or other control device 12 produce. In other words, someone can drive the car 10 also unlock if it comes out of the controller 11 the digital data 21 of the key secret 20 reads out.

At the control unit 11 this reading is prevented, however. For this purpose, the control unit 11 a protective device 24 comprising the digital data 21 deletes or destroys if someone tries to get into the controller 11 penetrate or the control unit 11 to steal.

The protective device 24 can do this with a detection device 25 be coupled, which said the penetration into the control unit 11 and / or decoupling the controller 11 from the voltage source 15 can detect. The detection device 25 and the protective device 24 can do this, for example, together with the data store 22 on the board 23 or on a motherboard 26 may be additionally provided, for example, with a protective cover, for example made of an epoxy resin, to be inseparably connected to said components. The detection device 25 generates a clear signal 27 in case of intrusion or decoupling from the voltage source 15 is detected.

Upon receiving the clear signal 27 can the protection device 24 for example, a delete command 28 generate the data store 22 instructs the digital data 21 to delete. Additionally or alternatively, it is also possible to provide a bit pattern 29 in the data store 22 instead of the digital data 21 save. This will be the digital data 21 overwritten. This process is performed by a deletion routine 30 controlled. The deletion routine 30 may be based on a program code for a processor device of the controller 11 be provided. The deletion routine 30 can also be performed several times, that is, there is a control loop 31 (control loop) when executing the routine 30 , The bow 31 Thus, it is preferred that the digital data be destroyed by the deletion routine 30 more than once, in particular more than three times, for example ten times.

Additionally or alternatively to generate the delete command 28 and / or storing the bit pattern 29 can be provided that by means of an overcurrent 32 or an overvoltage 32 the data store 22 is destroyed, so that the memory cells of the digital data 21 and / or a control circuit of the data memory 22 are mechanically destroyed.

To generate the erase signal 27 can in the event that a housing 33 screwed or opened, so for example, a lid is removed, so by opening 34 of the housing Access to the data storage 22 exists, with a button 35 or more buttons 35 the housing opening 34 are detected (for the sake of clarity, only one button 35 shown). The switching of the at least one button 35 When opening 34 triggers the generation of the clear signal 27 out.

The housing 11 but can also be opened elsewhere to the at least one button 35 to get around. For this purpose, a photosensor or photodetector 36 be provided, which is a light 37 using the photodetector 36 detected. This also solves in the detection device 25 generating the erase signal 27 out.

If the housing is otherwise opened in a dark room, thereby also the photodetector 36 To circumvent, so may further a light guide 38 For example, in the form of a light guide, be provided by a light source 39 is acted upon by a light signal, which by the light guide 38 to a sensitive to the light signal receiving sensor 40 arrives. If over the sensor 40 by the detection device 25 the light signal is no longer detected, it can be assumed that the light guide 38 was interrupted and someone broke open the envelope described, for example. This also triggers the generation of the erase signal 27 out.

The control unit 11 is in the manner described by the voltage source 15 provided. Will the controller 11 from the voltage source 15 separated, this can also be done by the detection device 25 be detected. This can also be the generation of the erase signal 27 trigger.

Then even without external power supply the detection device 25 and the protective device 24 continue to operate, can be a separate source of energy 41 exclusively for operating the detection device 25 and the protective device 24 be provided, for example, also on the motherboard 26 can be arranged.

Is through the deletion routine 30 an overvoltage 32 or an overcurrent 32 provided, this means that, for example, a voltage of 40 V is applied to a capacitor and then the capacitor via the data memory 22 unloaded. In this case, for example by means of a capacitor capacitance of 200 uF an initial current of greater than 50 A can be achieved, which in the data memory 22 flows and destroys this.

Once the controller 11 mechanically opens to the circuit board 23 to steal, for example, as a component with the data storage 22 on the motherboard 26 Being soldered becomes the key secret 20 , for example, by the overcurrent 32 or generally by the deleting routine 30 destroyed. This theft protection or this elimination safeguard for the digital data 21 protects against the key secret that is in the board 23 is located, can be stolen. It is irretrievably destroyed. The car 10 thus remains protected against theft.

Overall, the examples show how the invention can provide anti-theft protection for a car sharing control device as a retrofit solution.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 10332533 A1 [0002]
• DE 19527504 C1 [0003]
• DE 102014006389 B3 [0004]

Claims (10)

Control unit (11) for a motor vehicle (10), comprising a protection device (24) for protection against theft of digital data (21) which are stored within the control unit (11) in a data memory (22), wherein the protection device (24) is set up is irrevocably deleting the digital data (21) by means of a predetermined erasure routine (30) if a detection device (25) of the control device (11) uses at least one predetermined mechanical change of at least one component of the control device (11) by means of an erasure signal (27). and / or electrical separation of the control unit (11) from a voltage source (15). Control unit (11) to Claim 1 wherein the control unit (11) is configured to control a locking system (13) and / or a motor lock (14) of the motor vehicle (10) by means of a key secret (20) containing a cryptographic key, and wherein the digital data ( 21) represent the key secret (20). Control unit (11) according to one of the preceding claims, wherein the deleting routine (30) comprises erasing the digital data (21) in the data memory (22) by means of an erase command (28) and / or overwriting it by means of a bit pattern (29). Control unit (11) according to one of the preceding claims, wherein the deleting routine (30) comprises applying to the data memory (22) an overvoltage and / or an overcurrent (32) through which the data memory (22) is mechanically damaged or destroyed becomes. Control unit (11) according to one of the preceding claims, wherein the protective device (24) is adapted to perform the deletion routine (30) several times (31) when receiving the deletion signal (27). Control unit (11) according to one of the preceding claims, wherein the control unit (11) has its own energy source (41) provided exclusively for operating the detection device (25) and the protective device (24). Control unit (11) according to one of the preceding claims, wherein as component a housing (33) is provided, in which the data memory (22) is arranged, and the detection device (25) at least one electrical switch (35) whose switching state of a Opening state of the housing (33) is dependent and in an open housing (33) generates the clear signal (27). Control unit (11) according to one of the preceding claims, wherein a light-tight or light-insulating enveloping element (33) is provided as component, in which at least the data memory (22) is arranged together with a photodetector (36), and the detection device (25) arranged is to generate the cancellation signal (27) in response to a detection signal of the photodetector (36). Control unit (11) according to one of the preceding claims, wherein as component a light-conducting device (38) is provided, by which at least the data memory (22) is covered or surrounded, and the detection device (25) is adapted to operate by means of a light source (39). through the light guide (38) through a receiving sensor (40) to illuminate with a light signal and to generate the clear signal (27), if in the receiving sensor (40), the light signal is absent. Motor vehicle (10) having a locking system (13) and / or a motor lock (14) which is in each case coupled to a control device (11) according to one of the preceding claims and is adapted to generate a control signal (11) from the control device (11). 12) for unlocking.

Images