BATTERY SYSTEM AND METHOD OF CONFIGURING THE SAME

In accordance with a first aspect of the present disclosure, a battery system is provided for use in a vehicle, comprising: a plurality of battery modules; a controller operatively coupled to the battery modules; a plurality of secure elements, wherein each of said battery modules contains at least one of said secure elements and wherein the controller contains at least one of said secure elements, and wherein said secure elements are configured to perform one or more authentication operations by executing a cryptographic algorithm. In accordance with a second aspect of the present disclosure, a corresponding method of configuring a battery system is conceived.

TECHNICAL FIELD

The present disclosure relates to a battery system for use in a vehicle. Furthermore, the present disclosure relates to a corresponding method of configuring a battery system for use in a vehicle.

BACKGROUND

Electric vehicles typically contain battery packs containing multiple battery modules or battery cells. It may be necessary to prove the authenticity and verify the integrity of these battery modules, for example when they are installed or replaced in a battery pack. However, proving the authenticity and verifying the integrity of battery modules typically requires additional hardware and software. Furthermore, it may be difficult to implement this functionality. In addition, this functionality may introduce latency in the communication between the modules and a central controller within the vehicle. Therefore, there may be a need to facilitate proving the authenticity and verifying the integrity of battery modules within battery packs.

SUMMARY

In accordance with a first aspect of the present disclosure, a battery system is provided for use in a vehicle, comprising: a plurality of battery modules; a controller operatively coupled to the battery modules; a plurality of secure elements, wherein each of said battery modules contains at least one of said secure elements and wherein the controller contains at least one of said secure elements, and wherein said secure elements are configured to perform one or more authentication operations by executing a cryptographic algorithm.

In one or more embodiments, the controller is an electronic control unit (ECU) comprised in the vehicle, in particular a body control module (BCM) or a telematics control unit (TCU).

In one or more embodiments, the battery modules are placed in a series arrangement, wherein the first battery module in the series arrangement is configured to perform at least one authentication operation with the controller, and wherein each of the other battery modules in the series arrangement is configured to perform at least one authentication operation with a prior battery module in the series arrangement.

In one or more embodiments, the secure elements contained in the battery modules further contain data indicative of a charge state and/or a life state of said battery modules.

In one or more embodiments, the at least one secure element contained in the controller is configured to maintain a registry of the charge state and/or life state of the battery modules.

In one or more embodiments, the cryptographic algorithm is an asymmetric cryptographic algorithm or a symmetric cryptographic algorithm.

In one or more embodiments, the secure elements contained in the battery modules have been provisioned with cryptographic keys and/or cryptographic certificates in a trusted environment.

In one or more embodiments, the at least one secure element contained in the controller has been provisioned with cryptographic keys and/or cryptographic certificates in a trusted environment and by an over-the-air transmission.

In one or more embodiments, the battery system further comprises a battery management system (BMS) coupled between the controller and the plurality of battery modules.

In one or more embodiments, the authentication operations form part of a pairing process.

In accordance with a second aspect of the present disclosure, a method of configuring a battery system is conceived for use in a vehicle, comprising: providing the battery system with a plurality of battery modules; providing the battery system with a controller operatively coupled to the battery modules; providing the battery system with a plurality of secure elements, wherein each of said battery modules contains at least one of said secure elements and wherein the controller contains at least one of said secure elements, and wherein said secure elements are configured to perform one or more authentication operations by executing a cryptographic algorithm.

In one or more embodiments, the controller is an electronic control unit (ECU) comprised in the vehicle, in particular a body control module (BCM) or a telematics control unit (TCU).

In one or more embodiments, the battery modules are placed in a series arrangement, wherein the first battery module in the series arrangement is configured to perform at least one authentication operation with the controller, and wherein each of the other battery modules in the series arrangement is configured to perform at least one authentication operation with a prior battery module in the series arrangement.

In one or more embodiments, the secure elements contained in the battery modules further contain data indicative of a charge state and/or a life state of said battery modules.

In one or more embodiments, the at least one secure element contained in the controller is configured to maintain a registry of the charge state and/or life state of the battery modules.

DESCRIPTION OF EMBODIMENTS

FIG.1shows an example of a battery system100, in particular for use in a vehicle. The battery system100comprises a battery management system (BMS), which in turn contains a BMS microcontroller104. Furthermore, the battery system100comprises a battery pack106, which in turn includes a plurality of battery modules108,116. Each battery module108,116comprises one or more battery cells110,112,118,120, which may be controlled by a battery module controller114,122. As mentioned above, it may be necessary to prove the authenticity and verify the integrity of the battery modules108,116, for example when they are installed or replaced in the battery pack106. Since this functionality may be costly, difficult to implement and result in a performance reduction, there may be a need to facilitate it.

More specifically, various BMS architectures are available on the market, which may require a flexible security concept. It is noted that battery modules should be exchangeable due to damage or end-of-life. In case new battery modules are inserted into a battery pack, it should be possible to pair these modules to a vehicle. Such a pairing process typically involves the execution of authentication operations. This may require a flexible trust provisioning service, which allows to preconfigure the devices in a secure environment. Furthermore, the latency caused by the authentication operations should be kept to a minimum, to guarantee a satisfactory user experience.

Now discussed are a battery system for use in a vehicle, and a corresponding method of configuring a battery system for use in a vehicle, which facilitate proving the authenticity and verifying the integrity of battery modules within battery packs.

FIG.2shows an illustrative embodiment of a battery system200, in particular for use in a vehicle. The battery system200comprises a battery pack202, which in turn comprises a plurality of battery modules204,208. Furthermore, the battery system200comprises a controller212operatively coupled to the battery modules204,208. In addition, the battery system200comprises a plurality of secure elements206,210,214. In particular, each of the battery modules204,208contains a secure element204,210and the controller212contains a secure element214. In accordance with the present disclosure, the secure elements206,210,214are configured to perform one or more authentication operations by executing a cryptographic algorithm. In this way, proving the authenticity and verifying the integrity of the battery modules204,208within the battery pack202is facilitated. Furthermore, a flexible security concept may thereby be provided, which supports the use of multiple battery modules204,208, without compromising the performance of the battery system200in terms of latency. This, in turn, may prevent the unauthorized usage of battery modules204,208in a battery pack202of the kind set forth. For instance, it can be detected whether the battery modules204,208have been tampered with, or whether an attempt is made to insert counterfeit batteries into the battery system200.

In one or more embodiments, the controller is an electronic control unit (ECU) comprised in the vehicle. An example of a suitable ECU is a body control module (BCM). Another example of a suitable ECU is a telematics control unit (TCU). In this way, the security concept may easily be implemented in the vehicle, in particular by using a component which is typically already available in said vehicle. For example, a BCM is typically already used for executing car access operations. Furthermore, a BCM typically already has a secure element for securing these operations; this secure element may then also be used for the purpose of authenticating the battery modules. However, the skilled person will appreciate that, where reference is made to a BCM in the embodiments described herein, another type of ECU may equally be used instead of said BCM. In one or more embodiments, the battery modules are placed in a series arrangement, wherein the first battery module in the series arrangement is configured to perform at least one authentication operation with the controller, and wherein each of the other battery modules in the series arrangement is configured to perform at least one authentication operation with a prior battery module in the series arrangement. In this way, an efficient authentication process may be realized, according to which the controller only needs to perform authentication with the first battery module, while still ensuring that all battery modules can be authenticated.

In one or more embodiments, the secure elements contained in the battery modules further contain data indicative of a charge state and/or a life state of said battery modules. In this way, the charge state and/or a life state can be stored safely, while it can still easily be retrieved by the controller. Furthermore, in one or more embodiments, the at least one secure element contained in the controller is configured to maintain a registry of the charge state or life state of the battery modules. In this way, the battery system can easily be managed by the controller.

In one or more embodiments, the cryptographic algorithm is an asymmetric cryptographic algorithm or a symmetric cryptographic algorithm. An asymmetric cryptographic algorithm is typically slower than a symmetric cryptographic algorithm, but may be more practical in certain applications. Furthermore, in one or more embodiments, the secure elements contained in the battery modules have been provisioned with cryptographic keys and/or cryptographic certificates in a trusted environment. In this way, the security level of the battery system may be further increased. Furthermore, in one or more embodiments, the at least one secure element contained in the controller has been provisioned with cryptographic keys and/or cryptographic certificates in a trusted environment and by an over-the-air (OTA) transmission. This results in a practical implementation. For example, the secure element of the controller may be pre-provisioned by a manufacturer of said secure element in the trusted environment, and post-provisioned by a vehicle manufacturer using a secured OTA transmission.

In a practical implementation, the battery system further comprises a battery management system (BMS) coupled between the controller and the plurality of battery modules, to facilitate the control of the battery modules. Furthermore, in a practical implementation, the authentication operations form part of a pairing process. Thus, pairing the controller to the battery modules includes authentication operations, to increase the level of security of the battery system.

FIG.3shows an illustrative embodiment of a method300of configuring a battery system. The method300comprises the following steps. At302, the battery system is provided with a plurality of battery modules. At304, the battery system is provided with a controller operatively coupled to the battery modules. Furthermore, at306, the battery system is provided with a plurality of secure elements, wherein each of said battery modules contains at least one of said secure elements and wherein the controller contains at least one of said secure elements, and wherein said secure elements are configured to perform one or more authentication operations by executing a cryptographic algorithm. In this way, proving the authenticity and verifying the integrity of the battery modules is facilitated.

FIG.4shows an illustrative embodiment of a system400for use in a vehicle. The system400comprises a battery pack408that includes a plurality of battery modules410,420. Each battery module410,420contains a plurality of battery cells412,414,422,424coupled to a battery module controller416,426. Furthermore, in accordance with the present disclosure, the battery modules410,420contain a secure element418,428operatively coupled to the battery module controller416,426. Furthermore, the system400comprises a body control module402coupled to the battery modules410,420through a battery management system430. Both the body control module402and the battery management system430contain a microcontroller404,432and a secure element406,434. In particular, the battery management system430may be regarded as an example of a controller of the kind set forth, i.e. a controller containing a secure element434configured to perform authentication operations by executing a cryptographic algorithm. To this end, applets are provided in the secure elements418,428,434. Furthermore, in this example, the BCM402contains a secure element406that is used to perform typical authentication operations with an external mobile device, such as a mobile phone or a key fob. Thus, the BCM402is used in typical car access applications. Furthermore, the secure elements418,428,434have been provisioned with cryptographic keys and/or cryptographic certificates, which may be used as input to the cryptographic algorithms coded in the applets. Although the system400provides a high level of security, it may be difficult to implement it. Furthermore, multiple host drivers may be needed to manage the plurality of secure elements406,418,428,434, and a latency may be introduced into the system400.

FIG.5shows a further illustrative embodiment of a system500for use in a vehicle. The system500comprises a battery pack408that includes a plurality of battery modules510,520. Each battery module510,520contains a plurality of battery cells512,514,522,524coupled to a battery module controller516,526. Furthermore, in accordance with the present disclosure, the battery modules510,520contain a secure element518,528operatively coupled to the battery module controller516,526. Furthermore, the system500comprises a body control module502coupled to the battery modules510,520through a battery management system530. Both the body control module502and the battery management system530contain a microcontroller504,532. Furthermore, in accordance with the present disclosure, the body control module502contains a secure element506. Thus, the body control module402may be regarded as an example of a controller of the kind set forth, i.e. a controller containing a secure element506configured to perform authentication operations by executing a cryptographic algorithm. To this end, applets are provided in the secure elements506,518,528. Furthermore, the secure elements506,518,528have been provisioned with cryptographic keys and/or cryptographic certificates, which may be used as input to the cryptographic algorithms coded in the applets. Thus, in this example, the BCM502is not only used for car access applications, but also for the authentication of the battery modules510,520. Accordingly, the same authentication logic can be executed on a single secure element506within the BCM502, by running two applets on the secure element506.

It is noted that the system500is similar to the system shown inFIG.4. However, the battery management system530does not contain a secure element, and the body control module502is configured to act as a controller of the kind set forth on its own. That is to say, the body control module502is configured to perform authentication operations with at least the first battery module510of the battery pack510, wherein the battery management system530merely acts as a communication gateway. Furthermore, the secure elements518,520contained in the battery modules510,520may be configured to perform a first level of authentication. Compared to the system shown inFIG.4, the system500may have a higher performance, while still providing a high level of security. For instance, no significant latency is introduced, because a first level of authentication may be performed by the battery modules510,520. Furthermore, the multitasking capability of the secure element506contained in the body control module502is used to advantage, in the sense that the applet executed by said secure element506not only implements a conventional secure car access (SCA) function, but also authentication operations with at with at least the first battery module510of the battery pack510.

The presently disclosed battery system and corresponding configuration method may be exploited in various use cases. For example, during a battery pack preparation phase in an end-of-line scenario, the battery modules inserted into said battery pack may effectively be paired to each other. More specifically, if a battery pack consists to six battery modules, the second module may be paired by means of an authentication operation to the first module, the third module may be paired by means of an authentication operation to the second module, etc. This chain-like pairing may be performed up to and including the sixth module. Thus, a first authentication may be performed when a new battery pack is assembled. Then, when the battery pack is added to a vehicle, only the first module should authenticate with the BCM. In this way, the installation of the battery pack in the vehicle may be done more quickly. Furthermore, once the first battery module has been paired, it may share the confirmation with the other battery modules. In addition, the BCM may be made aware that six modules are available along with their state, which may include the charge state or life state (e.g., nearing end-of-life) of the modules.

In another example, when the engine of a vehicle is started, the BCM only needs to authenticate with the first battery module if the aforementioned chain-like pairing has been performed during installation. This authentication may use a symmetric algorithm, which is fast and does not add to the system latency. After starting the engine, the BCM may ask for a complete system check up from the first module. In this case, all the battery modules should be authenticated against each other, for instance using asymmetric algorithms, and/or against the BCM. In such a case, the battery life cycle information (i.e., the charge state or life state of the modules) may also be updated. It is noted that the life cycle information of the complete battery pack may be used for further actions, especially in case of a failure. Furthermore, during driving the life cycle information may continuously be updated in the secure element.

In a further example, when a battery module is replaced, the authentication may be performed as follows. If the first battery module is replaced, then the new module should be paired first with the BCM and then also with the second battery module. If the new module is a counterfeit, then the authentications will fail, and the attempt to insert the counterfeit module may be logged in the BCM. Furthermore, if the n-th battery module is replaced, then the new module should be paired with the (n−1)-th battery module and the (n+1)-th battery module. Once the replacement has been completed, the complete battery pack authentication may be performed and the life cycle information of the battery pack may be shared with the BCM.

It is noted that the embodiments above have been described with reference to different subject-matters. In particular, some embodiments may have been described with reference to method-type claims whereas other embodiments may have been described with reference to apparatus-type claims. However, a person skilled in the art will gather from the above that, unless otherwise indicated, in addition to any combination of features belonging to one type of subject-matter also any combination of features relating to different subject-matters, in particular a combination of features of the method-type claims and features of the apparatus-type claims, is considered to be disclosed with this document.

Furthermore, it is noted that the drawings are schematic. In different drawings, similar or identical elements are provided with the same reference signs. Furthermore, it is noted that in an effort to provide a concise description of the illustrative embodiments, implementation details which fall into the customary practice of the skilled person may not have been described. It should be appreciated that in the development of any such implementation, as in any engineering or design project, numerous implementation-specific decisions must be made in order to achieve the developers' specific goals, such as compliance with system-related and business-related constraints, which may vary from one implementation to another. Moreover, it should be appreciated that such a development effort might be complex and time consuming, but would nevertheless be a routine undertaking of design, fabrication, and manufacture for those of ordinary skill.

Finally, it is noted that the skilled person will be able to design many alternative embodiments without departing from the scope of the appended claims. In the claims, any reference sign placed between parentheses shall not be construed as limiting the claim. The word “comprise(s)” or “comprising” does not exclude the presence of elements or steps other than those listed in a claim. The word “a” or “an” preceding an element does not exclude the presence of a plurality of such elements. Measures recited in the claims may be implemented by means of hardware comprising several distinct elements and/or by means of a suitably programmed processor. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

LIST OF REFERENCE SIGNS

100battery system102battery management system104battery management system microcontroller106battery pack108battery module1110cell1112cell x114battery module controller116battery module x118cell1120cell x122battery module controller200battery system202battery pack204battery module1206secure element208battery module2210secure element212controller214secure element300method of configuring a battery system302providing a battery system with a plurality of battery modules304providing the battery system with a controller operatively coupled to the battery modules306providing the battery system with a plurality of secure elements, wherein each of said battery modules contains at least one of said secure elements and wherein the controller contains at least one of said secure elements, and wherein said secure elements are configured to perform one or more authentication operations by executing a cryptographic algorithm400system for use in a vehicle402body control module404body control module microcontroller406secure element408battery pack410battery module1412cell1414cell x416battery module controller418secure element420battery module x422cell1424cell x426battery module controller428secure element430battery management system432battery management system microcontroller434secure element500system for use in a vehicle502body control module504body control module microcontroller506secure element508battery pack510battery module1512cell1514cell x516battery module controller518secure element520battery module x522cell1524cell x526battery module controller528secure element530battery management system532battery management system microcontroller