Motor vehicle display device, motor vehicle electronic system, motor vehicle, method for displaying data and a computer program product

The invention relates to a motor vehicle display apparatus having an electronic appliance containing:

FIELD OF DISCLOSURE

The invention relates to a motor vehicle display apparatus, a motor vehicle electronics system, a motor vehicle, a method for displaying data and a computer program product.

BACKGROUND

U.S. Pat. No. 5,657,008 discloses an electronic motor vehicle license plate which stores a vehicle identification number. The vehicle identification number is used for checking whether the electronic motor vehicle license plate actually belongs to the motor vehicle to which it is fitted.

WO 2007/137555 A2 discloses an electronically configurable motor vehicle license plate with a display. In order to configure the motor vehicle license plate, data are compiled and encrypted in an external configuration unit. The encrypted data are transmitted as infrared signals by an infrared transmitter integrated in the configuration unit. The display electronics for the motor vehicle license plate are used to decrypt the signals, for which purpose appropriate decryption software is stored in the display electronics.

US 2007/0285361 A1 discloses a system for wireless electronic motor vehicle license plates. Data can be input into the electronic motor vehicle license plate only by persons who are authorized to do so, specifically using a secret code.

The patent application DE 102008042259.2 (BUND.208.12 DE), without prior publication at the time of filing, from the same applicant discloses a motor vehicle electronics appliance which is designed to receive data from an ID token and to actuate a motor vehicle display apparatus to display said data. Further motor vehicle display apparatuses are known from the patent applications BUND.208.14de and BUND.208.12 de (official file numbers: DE 102008043123.0 and DE 102008042259.2), likewise without prior publication at the time of filing, from the same applicant.

DETAILED DESCRIPTION

By contrast, the invention is based on the object of providing an improved motor vehicle display apparatus, a motor vehicle electronic system, a motor vehicle and a method for visual output and an appropriate computer program product.

The objects on which the invention is based are each achieved by means of the features of the independent patent claims. Embodiments of the invention are specified in the dependent patent claims.

In accordance with embodiments of the invention, the motor vehicle display apparatus has an electronic appliance and a display apparatus which form a physical unit. By way of example, the format of the motor vehicle display apparatus may roughly correspond to the dimensions of a motor vehicle license plate hitherto customary in the prior art. A motor vehicle display apparatus of this kind is also called an electronic motor vehicle license plate.

The electronic appliance has a first memory area for storing data and a second memory area for storing at least one first certificate. In addition, the electronic appliance has a first interface for receiving a first signal and a signature for the first signal from a transmitter. The first interface may also be used to receive the data and a signature for the data and also at least the first certificate. The first signal, the data and the respective signatures thereof and the first certificate can be received from the same or different transmitters.

The electronic appliance has means for checking the validity of the signature of the first signal using the first certificate; these means for checking the validity can also be used for checking the validity of the signature of the data using the first certificate.

In addition, the electronic appliance has means for generating a second signal using the first signal and means for actuating the display apparatus to reproduce the data stored in the first memory area and to visually output the second signal.

A necessary prerequisite for the generation and/or visual output of the second signal is that the signature of the first signal is valid. Only if said prerequisite is met is the second signal visually output using means for actuating the display apparatus.

A necessary prerequisite for storing the data in the first memory area is that the signature is valid. Only then are these data reproduced using means for actuating the display apparatus.

A corresponding situation applies to the reproduction of the data when they are received from a transmitter: a necessary prerequisite for storing the data in the first memory area is that the signature of the data is valid. Only then are these data reproduced using means for actuating the display apparatus.

Embodiments of the invention are particularly advantageous, since the motor vehicle display apparatus provides an electronic motor vehicle license plate which is used not only for reproducing the motor vehicle license number but also for visually outputting a further signal, i.e. the second signal. The second signal is generated and/or visually output via the display apparatus only if the first signal and the signature thereof have been received beforehand via the first interface of the electronic appliance and if said signature of the first signal is valid.

In accordance with one embodiment of the invention, the first signal is used to receive a piece of information from the transmitter. This piece of information can be used in unaltered form for generating the second signal, so that the piece of information is output visually via the display apparatus. Before the second signal is generated, the piece of information can also be processed further by adding to or modifying the piece of information, for example. In this case, the second signal is generated in order to output the result of the further processing of the information via the display apparatus.

In accordance with one embodiment of the invention, the first signal is a test signal which is sent by a police patrol vehicle which is close by the motor vehicle, for example, in order to check the authenticity of the motor vehicle display apparatus. On the basis of the reception of the test signal and the valid signature thereof, the motor vehicle display apparatus generates the second signal and outputs it visually, for example. This visual output is picked up by a reader in the patrol vehicle, for example, and compared with a reference signal. If the second signal and the reference signal match, a condition for the authenticity of the motor vehicle display apparatus is satisfied.

In accordance with one embodiment of the invention, the first signal contains a command, such as a request command for requesting a particular piece of information from the motor vehicle display apparatus. By way of example, this information may be a vehicle parameter and/or a charge status for the motor vehicle.

By way of example, the vehicle parameter may be the speed of the motor vehicle, a noise level or an exhaust value. In particular, the first signal may request what class of pollutant the motor vehicle meets, particularly on the basis of the applicable fine particulates regulation.

As an alternative or in addition, a charge status can be requested from the motor vehicle display apparatus by virtue of the reception of the first signal and the valid signature thereof. This allows a check to determine whether the prescribed charges, taxes and/or contributions, particularly toll charges, motor vehicle taxes and/or exhaust charges, have been paid for the motor vehicle.

In accordance with one embodiment of the invention, the motor vehicle display apparatus takes reception of the request command as a basis for accessing a memory area which stores the requested information item. The content of this memory area is then read in order to generate the second signal, which carries the requested information. By way of example, the information stored in the memory area of the motor vehicle display apparatus is updated at regular or irregular intervals of time.

As an alternative or in addition, the motor vehicle display apparatus requests the information, for its part, from a motor vehicle electronics appliance, such as what is known as an electronic control unit (ECU), or a sensor in the motor vehicle, for example by virtue of the motor vehicle display apparatus sending an appropriate request command via a motor vehicle bus to the ECU or the sensor.

In accordance with one embodiment of the invention, the data are reproduced on the display apparatus such that the reproduction can be picked up visually and cognitively by a user. Preferably, the reproduction is effected such that the reproduction corresponds roughly to the visual impression of a license number imprinted on a standard motor vehicle license plate. By contrast, the second signal can be output such that, depending on the embodiment, it can be picked up visually and cognitively by a user, can be picked up only visually but not cognitively by a user or can be picked up neither visually nor cognitively by a user.

By way of example, the second signal can be output via the display apparatus by actuating a single pixel or a group of pixels on the display apparatus with the second signal, the second signal being modulated with the information item which is to be visually output. By way of example, the pixel or the group of pixels can have their brightness modulated in order to output the second signal, the modulation being able to be chosen such that it is visually imperceptible to a user, for example because the brightness fluctuations are so small that they are imperceptible to the naked eye.

Embodiments of the invention are particularly advantageous, since the first interface can be used to receive the first certificate, which allows the certificate(s) stored in the electronic appliance to be updated. The reason is that the certificates of a public key infrastructure (PKI) usually have a limited validity of between two and three years, for example. When this validity period has expired, it is thus necessary to update the certificate(s), which, in line with the invention, can be done via the interface of the electronic appliance.

In accordance with one embodiment of the invention, the first certificate is what is known as a root certificate, which can be used to perform a certificate chain check for checking the validity of the signature of the data.

In accordance with one embodiment of the invention, the electronic appliance is an integrated electronic circuit, such as what is known as an RFID chip.

The first interface of the electronic appliance may be designed for wireless reception of the first signal, the signature of the first signal, the data, the signature of the data and/or the first certificate from an external transmitter. As an alternative or in addition, the first interface may also be designed such that the first signal, the signature of the first signal, the data, the signature of the first signal and/or the first certificate can be received from an internal transmitter which is part of the motor vehicle, such as from a motor vehicle electronics appliance, particularly what is known as an electronic control unit (ECU).

In accordance with one embodiment of the invention, the electronic appliance and the display apparatus are inseparably connected to one another, so that nondestructive separation of the electronic appliance and the display apparatus is not possible. By way of example, this is achieved by virtue of the electronic appliance and the display apparatus being connected to one another by a potting compound to such a profound extent that the attempt at separation inevitably results in destruction of the electronic appliance and/or the display apparatus.

In accordance with one embodiment of the invention, the electronic appliance contains means for cryptographically authenticating the transmitter, for example on the basis of what is known as a challenge-response protocol. The data received from the transmitter are stored in the first memory area only if such cryptographic authentication has been performed successfully.

In accordance with one embodiment of the invention, the electronic appliance contains means for reciprocal cryptographic authentication of the electronic appliance and the transmitter. This ensures that the transmitter sends the data only to a valid electronic appliance.

In accordance with a further embodiment of the invention, the electronic appliance has a memory area for storing a motor vehicle identifier. The motor vehicle identifier is an identifier which explicitly identifies a motor vehicle, such as the chassis number of the motor vehicle. The motor vehicle identifier stored in the memory area explicitly associates the motor vehicle display apparatus with the motor vehicle having the same motor vehicle identifier. This association may be designed to be unalterable. A further prerequisite for the generation and/or output of the second signal and/or the storage of the data in the first memory area for display thereof on the display apparatus may then be that the first interface is used to receive a tag which is identical to the motor vehicle identifier stored in the memory area.

In accordance with a further embodiment of the invention, the motor vehicle display apparatus may be an electronic motor vehicle license plate, i.e. a motor vehicle license plate which is equipped with a display on which the license number of the motor vehicle is reproduced.

In a further aspect, the invention relates to a motor vehicle electronic system having an embodiment of the motor vehicle display apparatus according to the invention and having a motor vehicle electronics appliance.

In accordance with embodiments of the invention, the motor vehicle electronics appliance has a second interface for setting up a first connection to an external transmitter, such as a first ID token, in order to read data from the first ID token. The first ID token may be a document, particularly a value or security document, which incorporates an electronic memory and an interface for setting up the connection to the second interface of the motor vehicle electronics appliance. In particular, the document may incorporate an RFID chip which stores the data.

In accordance with the invention, a “document” is understood to mean paper-based and/or plastic-based documents, such as identity documents, particularly passports, identity cards, visas and drivers' licenses, vehicle registration certificates, vehicle registration documents, corporate identity cards, health cards or other ID documents, such as official identity cards, and also chip cards, means of payment, particularly bankers' cards and credit cards, waybills or other credentials, which incorporate a data memory for storing at least one attribute.

The document may preferably be an electronic vehicle registration certificate or vehicle registration document or another motor vehicle document.

The motor vehicle electronics appliance has a memory for storing a certificate from a public key infrastructure (PKI). By way of example, the certificate may comply with the X.509 standard. The same or another memory in the motor vehicle electronics appliance may also store what is known as a root certificate from said PKI. The certificate and the root certificate typically have a limited validity period which is specified in the certificate or the root certificate.

The motor vehicle electronics appliance also has means for authentication to the first ID token using the certificate. By way of example, the authentication is effected using a challenge-response method. To this end, the motor vehicle electronics appliance transmits its certificate via the first connection to the first ID token. The latter generates a challenge, for example in the form of a random number, which the first ID token encrypts using the public key from the certificate and transmits the cipher via the first connection to the motor vehicle electronics appliance. The motor vehicle electronics appliance then needs to have the private key associated with the certificate in order to be able to correctly decrypt said cipher.

Optionally, provision may be made for the first ID token also to have to authenticate itself to the motor vehicle electronics appliance before the data are read from the first ID token. This can be done in similar fashion to the authentication of the motor vehicle electronics appliance to the ID token. By way of example, the procedure is thus that the ID token transmits its certificate to the motor vehicle electronics appliance via the first connection and then the challenge-response method is performed. For the check on the validity of the certificate from the first ID token, the motor vehicle electronics appliance can use the root certificate.

The external transmitter may also be a fixed or mobile transmitter, e.g. from an authority or from the police, which transmits the first signal. The second interface is then used to receive the first signal from an external transmitter of this kind.

In order to receive the first signal from the external transmitter, the first connection is thus first of all set up between the motor vehicle electronics appliance and the first transmitter. The certificate from the motor vehicle electronics appliance is used to perform unilateral or reciprocal cryptographical authentication of the motor vehicle electronics appliance and the external transmitter. When the authentication has been performed successfully, the external transmitter sends the first signal and the signature of the first signal via the first connection to the motor vehicle electronics appliance. The check on the validity of the signature of the first signal and/or the generation of the second signal when the signature of the first signal is valid can be effected by the motor vehicle electronics appliance. In this case, the motor vehicle electronics appliance sends the second signal to the motor vehicle display apparatus, so that the second signal is visually output by the motor vehicle display apparatus. Alternatively, the motor vehicle electronics appliance forwards the first signal and the signature thereof to the motor vehicle display apparatus, so that the latter checks the signature of the first signal and, where appropriate, generates the second signal.

In accordance with the one embodiment of the invention, the second signal is signed by the motor vehicle display apparatus and/or by the motor vehicle electronics appliance. In addition to the second signal, the signature of the second signal is then also visually output by means of the display apparatus. This provides further protection against illegal falsification or readjustment of the second signal.

In accordance with one embodiment of the invention, the motor vehicle electronics appliance has means for actuating at least one motor vehicle display apparatus according to the invention to reproduce the data. By way of example, two display apparatuses are present which are arranged at the front and at the back of a motor vehicle instead of the customary license plates. The display apparatuses have at least one display each, with various display technologies being able to be used.

By way of example, the displays are designed such that the data can be reproduced even without continual supply of power. Such displays require electric power only when the data to be reproduced change.

By way of example, these are bistable displays, such as electrophoretic displays, electrochromic displays, rotating element displays, ferroelectric displays, displays based on the electrowetting effect and bistable LCD displays, for example twisted nematic, super twisted nematic, cholesteric or nematic LCD displays. They may also be hybrid displays which combine various forms of these display technologies.

In addition, the prior art discloses flexible bistable displays which are commercially available from the Citala company. Such displays are also known from US 2006/0250534 A1. Further bistable electrophoretic displays are known from WO 99/53371 and EP 1 715 374 A1, for example.

Bistable displays are also called “Electronic Paper Displays” (EPDs).

Bistable displays of this kind generally have the advantage that they are very easy to read under bright lighting and that no supply of power is required in order to reproduce image data which are constant over a long time.

It is also possible to use emissive displays, which require a supply of power in order to reproduce the data. By way of example, these may be LED displays, particularly inorganic, organic or hybrid LED displays. The display apparatus may also be implemented on the basis of an electroluminescent medium, as is known per se from US 2002/0079494 A1 and U.S. Pat. No. 6,091,194, for example.

The display apparatus may also be wholly or partially provided typographically and thus form a profound and unbreakable connection to the motor vehicle or to portions of the motor vehicle. The production of TFTs, for example, by directly applying them using printing technology is known per se from WO 03/098696 A1.

The motor vehicle electronics appliance also has a third interface for storing the certification in the memory. The third interface can thus be used to access the memory of the motor vehicle electronics appliance in order to transmit and store the certificate therein, for example in order to put the certificate into the memory for the first time in a new motor vehicle or in order to update the certificate.

In accordance with one embodiment of the invention, the data which are read from the first ID token via the second interface contain the motor vehicle license number for the motor vehicle. By way of example, the motor vehicle license number has changed on account of notification of a change of ownership at a motor vehicle registration office. The amended motor vehicle license number is stored in the first ID token by the registration office. This can be done online by virtue of a secure connection being set up between the first ID token and a server computer, which connection is used to write the data with the new motor vehicle license number to the first ID token. A secure connection of this kind can be implemented by means of end-end encryption via a client computer to which a reader for the first ID token is connected, for example. The data with the new motor vehicle license number may have been signed by the motor vehicle registration office.

Embodiments of the present invention are particularly advantageous, since complete electronic handling of the updating of the motor vehicle license number becomes possible. In particular, it is no longer necessary to produce and fit new license plates. This allows significant amounts of resources to be saved and trash to be avoided. In addition, there is also no need for the visits to the authorities that were previously associated with the issuing of new motor vehicle license plates.

Embodiments of the present invention are particularly advantageous, since the motor vehicle license number is updated in a particularly secure manner with maximum convenience for the user by transmitting the data from the first ID token to the motor vehicle electronics appliance. This is achieved by using cryptographical methods based on a PKI, for example for the unilateral or reciprocal authentication of the motor vehicle electronics appliance and the first ID token, and/or by virtue of the signature of the data received from the first ID token being checked by the motor vehicle electronics appliance and/or by means of cryptographical protection of the first connection, which the motor vehicle electronics appliance uses to receive the data from the first ID token.

In accordance with one embodiment of the invention, the second interface of the motor vehicle electronics appliance is of contactless design, for example in the form of a radio interface, particularly in the form of a contactless interface operating on the basis of an RFID method. In particular, the second interface may be designed such that it is also used to address an electronic key for the motor vehicle. By way of example, the electronic key may be a chip card, such as an RFID chip card. Alternatively, a further interface may also be provided for communication with the electronic key, particularly an RFID interface.

In accordance with one embodiment of the invention, the third interface of the motor vehicle electronics appliance is of contact-based design. By way of example, the third interface is provided for the purpose of connecting a cable. In particular, the motor vehicle electronics appliance may be in the form of what is known as an electronic control unit (ECU) in the motor vehicle. For diagnostic and/or servicing purposes, the ECU is connected to an external appliance, for example a terminal, in a motor vehicle workshop or a technical test center. This cable can then be used to set up a connection between the external appliance and the ECU, which connection can be used to store the certificate in the memory in order to update it, for example. This can be done when the motor vehicle is being serviced or on the occasion of what is known as a general inspection of the motor vehicle, for example.

In accordance with one embodiment of the invention, the third interface is provided for the purpose of producing a network connection, which can be done in contact-based or contactless fashion. By way of example, the third interface is in the form of a mobile radio interface based on a mobile radio standard, as a result of which the certificate can be received via mobile radio.

In accordance with one embodiment of the invention, the third interface is first of all used to request an explicit motor vehicle identifier which is stored in the motor vehicle electronics appliance. By way of example, the motor vehicle identifier may be the chassis number of the motor vehicle. This motor vehicle identifier is then used to generate or retrieve a certificate which is associated with the relevant motor vehicle or the display apparatus thereof.

In accordance with one embodiment of the invention, the second interface is designed for communication with a second ID token. The second ID token is used for access control for the motor vehicle. Possession of the second ID token is a prerequisite for the motor vehicle being able to be opened and/or started by the user. By way of example, the second ID token is an RFID chip card which is used as an electronic key (“E-key”).

The second ID token stores a key identifier. Said key identifier is requested from the second ID token by the motor vehicle electronics appliance via the second interface thereof. If the key identifier received from the second ID token via the second interface matches a reference value, stored in the motor vehicle electronics appliance, for the key identifier then the motor vehicle electronics appliance generates a signal in order to unlock the central locking of the motor vehicle and/or to enable the engine of the motor vehicle to be started, for example.

Instead of the second interface, there may also be a further interface provided for the communication between the motor vehicle electronics appliance and the second ID token, e.g. a further RFID interface which has a greater range than the second interface. The range of the further interface is chosen such that the second ID token is picked up by the motor vehicle electronics appliance when the second ID token is still outside of the motor vehicle, whereas the range of the second interface is chosen such that the first ID token must be inside the motor vehicle interior in order for the first connection to be able to be set up. Thus, a prerequisite for update of the motor vehicle license number is then that the user must first of all unlock and get into the motor vehicle.

Preferably, the key identifier chosen is not the motor vehicle identifier. This has the advantage that in the event of the second ID token being lost, said second ID token can be replaced by another by virtue of another key identifier having been stored. The second interface of the motor vehicle electronics appliance is preferably designed such that it can be used to access the memory area of the motor vehicle electronics appliance which stores the key identifier in order to replace the key identifier stored therein for the lost second ID token with the new key identifier of the new second ID token. By way of example, the new key identifier has been signed, with the motor vehicle electronics appliance checking the validity of the signature before the old key identifier is replaced by the new key identifier.

In accordance with one embodiment of the invention, the motor vehicle electronics appliance has means for setting up a protected data transmission channel for actuating the at least one motor vehicle display apparatus. By way of example, the data transmission via this data transmission channel is effected in encrypted form in order to prevent the actuation of the at least one display apparatus from being manipulated.

In a further aspect, the invention relates to a motor vehicle having at least one externally visible motor vehicle display apparatus arranged on the motor vehicle.

In accordance with one embodiment of the invention, the motor vehicle contains an embodiment of the motor vehicle electronic system according to the invention. Such a motor vehicle is particularly advantageous, since the license number can be updated in simultaneously convenient and secure fashion. In particular, it is particularly advantageous that the previously required interchange of the license plates when the license number of the motor vehicle is changed can be avoided in accordance with the invention, which means that the costs of manufacture for the new license plates, the logistical involvement for the provision thereof and also the costs for disposing of the old license plates can be dispensed with.

In a further aspect, the invention relates to a method for displaying data on an embodiment of a motor vehicle display apparatus according to the invention. A necessary prerequisite for the display of the data is that the data are received in signed form from a transmitter and that this signature is valid. In order to check the validity of the signature, a certificate stored in a memory area of the motor vehicle display apparatus, particularly what is known as a root certificate, is used. The root certificate is updated via the interface of the motor vehicle display apparatus, for example on the occasion of regular servicing and/or on the occasion of what is known as a general inspection.

In a further aspect, the invention relates to a computer program product with executable instructions for performing an embodiment of a method according to the invention. By way of example, the computer program is designed for execution by a microprocessor in the electronic appliance of the motor vehicle display apparatus.

Corresponding elements in the embodiments below are respectively denoted by the same reference symbols.

FIG. 1shows an embodiment of a motor vehicle display apparatus101according to the invention. The motor vehicle display apparatus101has a display136, which may have the format of a standard motor vehicle license plate, for example. The display136is used for reproducing the license number, such as the license number B-YX 696.

The motor vehicle display apparatus101has an interface103for receiving a message105from a transmitter107, for example. The message105may contain the data109to be reproduced on the display136, i.e. the license number data, a cipher111and a certificate113, for example. The cipher111and the certificate113form a digital signature for the data109. By way of example, the cipher111is produced by encrypting the license number data using a private cryptographic key, said private cryptographic key needing to be associated with the public key indicated in the certificate113.

The interface103can also be used to receive what is known as a root certificate178.

The motor vehicle display apparatus101has an electronic memory115with a memory area117for storing the license number data and a memory area119for storing the root certificate178.

The motor vehicle display apparatus101also has a processor121for executing a program module123for performing a signature check, a program module125for updating the root certificate178which is stored in the memory area119, and a program module127for actuating the display136. The functionality of the actuation of the display136can be implemented using a driver, which may be part of the processor121, in the form of a separate component or in the form of an integrated component of the display136.

The root certificate178has a defined validity period of three years, for example. The current root certificate178can initially be stored in the memory area119by the manufacturer, for example, so that a motor vehicle equipped with the motor vehicle display apparatus101is already provided with a valid root certificate when it is delivered to the customer.

The motor vehicle is allocated a license number by a motor vehicle registration authority, for example. The relevant data109are encrypted using the private key, for example of the motor vehicle registration office, so that the cipher111is obtained as a result. The message105with the data109, the cipher111and the certificate113from the motor vehicle registration office is then sent by the transmitter107to the interface103of the motor vehicle display apparatus101. Next, the program module123is started in order to check the signature of the message105. To this end, the following checks are specifically performed:1. The cipher111is decrypted using the public key indicated in the certificate113. The result of the decryption of the cipher111must match the data109in order for the signature to be able to be valid.2. The certificate113is subjected to a certificate chain check using the root certificate178stored in the memory area119. A successful certificate chain check is a further prerequisite for validity of the signature.

If the signature of the message105is valid, the data109are written to the memory area117, this sometimes involving previously stored license number data being overwritten in the memory area117.

The program module127is executed continuously and accesses the memory area117in which the respective current data109is stored. The updating of the license number data in the memory area117thus accordingly changes the license number of the motor vehicle which is reproduced on the display136.

Since the root certificate stored in the memory area119has only a limited validity period, it is updated from time to time. This is done as follows: when the interface103receives a root certificate178, execution of the program module125replaces the root certificate stored in the memory area119with the newly received root certificate178by overwriting it.

The message105and the root certificate178can be received from the same transmitter107or from different transmitters107. By way of example, the transmitter107is associated with the motor vehicle registration authority; in particular, the transmitter107may be in the form of a ID token134(cf.FIGS. 4 and 5below).

A transmitter107for sending the root certificate178may, by way of example, be in the form of a motor vehicle electronics appliance102(cf. the embodiment inFIGS. 4 and 5) or in the form of a terminal162, for example in a motor vehicle workshop or in a motor vehicle testing institute, such as the German Association for Technical Inspection (TOV), so that the root certificate178is sent to the interface103on the occasion of servicing or a general inspection.

The interface103is also designed to receive a message105′. The message105′ can be received from the transmitter107or from another transmitter107′. By way of example, the transmitter107′ may be a sensor in the motor vehicle, a motor vehicle electronics appliance, such as an ECU in the motor vehicle, or a mobile or fixed transmitter, the mobile or fixed transmitter being operated by an authority, the police or another institution authorized to do so, for example.

The message105′ contains data109′ which form the first signal. In addition, the message105′ contains a cipher111′ and a certificate113′. The cipher111′ and the certificate113′ form a digital signature for the data109′. By way of example, the cipher111′ is produced by encrypting the data109′ using a private cryptographic key, said private cryptographic key needing to be associated with the public key indicated in the certificate113′.

By way of example, the data109′ may contain a piece of information, such as a vehicle parameter. By way of example, a sensor is used to pick up a current exhaust value for the motor vehicle. The sensor delivers this information to the transmitter107′, which sends this information in the form of the data109′ as part of the message105′ to the motor vehicle display apparatus101. As an alternative or in addition, the information may contain other vehicle parameters, such as the speed of the motor vehicle, the noise level currently being produced by the motor vehicle or other environmental-related and/or safety-related vehicle parameters.

As an alternative or in addition, the data109′ may contain a piece of charge-related information, such as a charge status. In this embodiment, the transmitter107′ is in the form of a motor vehicle electronics appliance, for example. The motor vehicle electronics appliance establishes whether a required charge, such as a toll charge, a tax or an exhaust charge, has been paid or needs to be paid for the motor vehicle. An appropriate piece of information indicating the charge status is sent by the motor vehicle electronics appliance as message105′ to the motor vehicle display apparatus101.

When the message105′ has been received by the motor vehicle display apparatus101, the program module123is started in order to perform a signature check on the signature formed by the cipher111′ and the certificate113′. If the signature is valid, the information contained in the data109′ is stored in a memory area131of the electronic memory115. The execution of a program module139is then started by the processor121.

The program module139is used for generating the second signal. By way of example, the second signal is input into the program module127in order to actuate the display136to visually output the second signal. By way of example, the second signal is meant to be used to output the piece of information stored in the memory area131: to this end, the program module139accesses the information stored in the memory area131and generates the second signal, for example using a modulation method, the second signal being modulated with the information.

The program module139may also be designed such that the information is subjected to a data processing operation and the result of said data processing operation is used for modulating the second signal in order to visually output said result of the data processing operation via the display136.

The data109′ may also be a command, such as a request command. By way of example, the request command is used to request the information stored in the memory area131. In this case, the validity of the signature data109′ is again checked first of all. If the signature is valid, the memory area131is then accessed in order to read the information therefrom. This information is then used to generate the second signal by executing the program module139, and is visually output via the display136.

By way of example, the motor vehicle display apparatus101first of all receives a first message105′ from a transmitter107′ in the motor vehicle, i.e. from a sensor or from an ECU, for example. The first message105′ contains a vehicle parameter. This vehicle parameter is written to the memory area131as a piece of information if the signature of the first message105′ is valid.

At a subsequent time, the motor vehicle display apparatus101receives a second message105′ from an external transmitter, the data109′ in this case containing a request command for requesting the information. If the signature of the second message105′ is valid, the information is then read from the memory area131, the second signal is generated and is visually output via the display136.

FIG. 2shows a flowchart for an embodiment of a method according to the invention. In step10, the motor vehicle display apparatus receives a signed message with license number data and a signature for the license number data, the signature being formed from a cipher for the license number data and an associated certificate.

In step12, a check is performed to determine whether the cipher is valid. To this end, the cipher is decrypted using the public key indicated in the certificate of the message, for example. If the result of the decryption matches the license number data in the message, the cipher is considered to be valid and the flow control passes to step14; in the opposite case, the flow is terminated in step16.

In step14, the root certificate stored in the memory of the motor vehicle display apparatus is accessed in order to check, in step18, whether the certificate received with the message for the signature is valid. To this end, the root certificate is used to perform a certificate chain check. If the certificate is not valid, the flow is terminated in step20.

If the certificate is valid, the license number data received with a message are processed further in step22. This can done such that the license number data are stored in the memory of the motor vehicle display apparatus so as to actuate a display of the motor vehicle display apparatus in step24, so that the updated license number data are reproduced by the display.

If, on the other hand, a signed message is received by the motor vehicle display apparatus in step10which, instead of the license number data, contains a piece of information, such as a vehicle parameter or a charge status, or a command, such as a request command, then steps12to20are likewise performed for this message. In step22, the data are processed further, for example by virtue of the information contained in the data being stored in a memory in the motor vehicle display apparatus or by virtue of the information being requested from the memory so as subsequently to visually output it in step24.

FIG. 3shows a block diagram for an embodiment of a motor vehicle display apparatus101according to the invention which has an associated certificate133. The electronic memory115of the motor vehicle display apparatus101has a memory area135for storing the certificate133. Like the root certificate178(cf.FIG. 1), the certificate133thus also has a limited validity period. Preferably, the validity periods of the root certificate178and the certificate133are chosen such that they expire at the same time. This allows the frequency of updates to be minimized.

The electronic memory115of the motor vehicle display apparatus101stores a private key for the motor vehicle display apparatus101in a protected memory area137. The certificate133is associated with this private key, since the certificate133contains a public key, with the private and the public key forming an asymmetric key pair.

In addition to the embodiment inFIG. 1, the processor121is used for executing a program module129which implements the steps of a cryptographical protocol which relate to the motor vehicle display apparatus101. Execution of the cryptographical protocol allows unilateral or reciprocal authentication of the motor vehicle display apparatus101and the transmitter107or107′ to be performed, for example on the basis of what is known as a challenge-response method.

The certificate133can initially be stored in the memory area135by the manufacturer, with the result that the certificate133is already stored in the memory115when the new motor vehicle is delivered to the customer.

If the embodiment under consideration in the present case is intended to involve the license number data being initialized or updated, it is first of all necessary for unilateral or reciprocal authentication to be performed between the motor vehicle display apparatus101and the transmitter107. This is done as follows, for example: The program module129accesses the certificate133stored in the memory area135in order to send it from the interface103to the transmitter107. The transmitter107then generates what is known as a challenge, i.e. a random number, for example. This random number is encrypted using the public key contained in the certificate133.

The resulting cipher is sent from the transmitter107to the interface103. The program module129decrypts the cipher using the private key stored in the memory area137and in this way obtains the random number. This random number is returned to the transmitter107by the program module129via the interface103. At the transmitter end, a check is then performed to determine whether the random number received from the motor vehicle display apparatus matches the originally generated random number, i.e. the challenge. If this is the case, then the motor vehicle display apparatus101is deemed to have been authenticated to the transmitter107. The transmitter107can be authenticated to the motor vehicle display apparatus101in a similar fashion.

Only when the unilateral or reciprocal authentication has been performed is the interface103ready to receive the message105.

The certificate133is updated as follows:

The transmitter107sends the updated certificate133to the interface103. By executing the program module125, the updated certificate133is then written to the memory area135, with the previous certificate being overwritten. The public key of the certificate133remains unchanged in this case, since the private key stored in the memory area137is also meant to remain unchanged.

In addition, the message105may contain a tag which may likewise have been signed. This tag may be the motor vehicle identifier stored in the memory area194of a motor vehicle electronics appliance102(cf. the embodiment inFIGS. 4 and 5). In addition to the validity of the signature, the motor vehicle display apparatus101then checks whether the tag received with the message105matches the motor vehicle identifier stored in the memory area194of the motor vehicle display apparatus101. This may be a further necessary prerequisite for the license number data being written to the memory area117.

If the embodiment considered in the present case is intended to involve reception of the message105′ being taken as a basis for output of a visual signal by the display136, it is first of all necessary to perform unilateral or reciprocal authentication between the display apparatus101and the transmitter107′. This is done as follows, for example:

The program module129accesses the certificate133stored in the memory area135in order to send it from the interface103to the transmitter107′. The transmitter107′ then generates what is known as a challenge, i.e. a random number, for example. This random number is encrypted using the public key contained in the certificate133′.

The resulting cipher is sent from the transmitter107′ to the interface103. The program module129decrypts the cipher using the private key stored in the memory area137and thus obtains the random number. This random number is returned to the transmitter107′ by the program module129via the interface103. At the transmitter end, a check is then performed to determine whether the random number received from the motor vehicle display apparatus matches the originally generated random number, i.e. the challenge. If this is the case then the motor vehicle display apparatus101is deemed to have been authenticated to the transmitter107′. The transmitter107′ can be authenticated to the motor vehicle display apparatus101in a similar fashion.

Only when the unilateral or reciprocal authentication has been performed is the interface103ready to receive the message105′.

FIG. 4schematically shows a motor vehicle100, such as an automobile. The motor vehicle100has at least one motor vehicle electronics appliance102, which may be in the form of what is known as an electronic control unit (ECU), for example.

The motor vehicle electronics appliance102has an electronic memory104with at least the memory areas106,108,110,112, and114. The memory area106is used for storing a motor vehicle identifier, i.e. what is known as a unique identifier, such as the chassis number of the motor vehicle100. Preferably, the memory area106is designed such that the motor vehicle identifier stored therein cannot be changed, as a result of which the motor vehicle electronics appliance102is thus permanently associated with the motor vehicle100.

The memory area108is used for storing data which contain the motor vehicle license number of the motor vehicle100, i.e. the data109(cf.FIGS. 1 and 3). These data can be updated via an interface116of the motor vehicle electronics appliance102. In the embodiment considered in the present case, the interface116is of contactless design as a radio interface operating on the basis of an RFID method.

The memory area110is used for storing a certificate113for the motor vehicle100, the certificate being able to be a standardized certificate for a PKI, for example. The memory area112is used for storing the root certificate178of the PKI.

The memory area114of the memory104stores the private key of the motor vehicle100, which private key is associated with the certificate113. This memory area114cannot be accessed externally, in principle, via the interface116or via a further interface118of the motor vehicle electronics appliance102.

The interface118is of contact-based design for the connection of a cable, for example. The interface118can be used to effect external access to the memory areas110and112in order to update the certificate113, the certificate133and/or the root certificate178.

The motor vehicle electronics appliance102also has at least one processor120for executing program modules122,124,126,128,130and132.

The program module122is used for executing those steps of a cryptographical protocol which relate to the motor vehicle electronics appliance102for the purpose of authenticating the motor vehicle electronics appliance102to an ID token134. Preferably, the program module122is designed such that the ID token134is also authenticated to the motor vehicle electronics appliance102.

The program module124is used to encrypt data which are interchanged between the motor vehicle electronics appliance102and the ID token134. In this case, encryption can be effected using a symmetric key or an asymmetric key.

The program module126is used for performing a signature check on an electronic signature received from the ID token134. To this end, the program module126accesses the memory area112in order to retrieve the root certificate178therefrom.

The program module128is started to update the data stored in the memory area108, which contain the motor vehicle license number. The program module130is used to actuate the motor vehicle display apparatuses101and101′ of the motor vehicle100. The motor vehicle display apparatuses101and101′ may be arranged on the motor vehicle100at the locations at which the license plates are normally arranged. The motor vehicle display apparatuses101and101′ are connected to the motor vehicle electronics appliance102by means of protected data transmission channels. By way of example, the data transmission channels can be implemented by means of a network140, for example by means of a bus system in the motor vehicle100. To this end, the motor vehicle electronics appliance102has an end face143which can be used to set up the data transmission channels to the motor vehicle display apparatuses101and101′.

The program module132is started in order to update the certificate113stored in the memory area110and/or the root certificate stored in the memory area112and/or the certificate133via the interface118.

The motor vehicle electronics appliance102may be implemented as a system comprising a plurality of physically separate electronic components which are connected to one another by means of a bus system in the motor vehicle100, for example. Accordingly, the memory104may also be implemented in a form distributed over various such components which collectively form the motor vehicle electronics appliance102. A corresponding situation applies to the processor120.

The ID token134has an electronic memory144with protected memory areas146,148,150and152. The memory area146is used for storing the motor vehicle identifier, which is also stored in the memory area106of the memory104in the motor vehicle electronics appliance102. This explicitly associates the ID token134with the motor vehicle100. The memory area146may additionally store a signature for the motor vehicle identifier.

The memory area148stores the data109which contain the current motor vehicle license number of the motor vehicle100. In addition, the memory area148may store a digital signature for said data109. These data109may have been written to the memory area148by a server computer in the motor vehicle registration office.

The memory area150is used for storing a certificate for the ID token134. The memory area152is used for storing a private key with which the certificate stored in the memory area150is associated.

The ID token134also has a processor154for executing program modules156and158, which correspond to the program modules122and124. The program module156is used for executing those steps of the cryptographical protocol which relate to the ID token134. The program module158is used for setting up the encrypted connection to the motor vehicle electronics appliance102, particularly a connection with end-end encryption using a symmetric or asymmetric key.

The ID token134also has an interface160which corresponds to the interface116of the motor vehicle electronics appliance102and, for example, is in the form of a radio interface operating on the basis of an RFID method.

The ID token134may be a document, such as an electronic motor vehicle registration certificate or an electronic motor vehicle registration document, as shown inFIG. 1. The document may be in card form, for example.

The motor vehicle electronics appliance102can be connected by means of its interface118to a terminal162. The terminal162has an interface164which corresponds to the interface118of the motor vehicle electronics appliance102. By way of example, the interfaces164and118can be connected using a cable, to which end the engine hood of the motor vehicle100typically needs to be opened.

The terminal162has at least one processor166for executing a program168and also a network interface170for communicating with a server computer172via a network174.

The server computer172provides a certificate provider, for example in the form of a database176which stores current certificates for various motor vehicles and the motor vehicle display apparatuses thereof. In this case, the access key used for the certificates stored in the database176is the respective motor vehicle identifier. In addition, the server computer172can also provide an updated root certificate178.

The motor vehicle license number is updated as follows:1. First of all, the user, i.e. the keeper of the motor vehicle100, for example, calls up an online service on a server computer, for example a motor vehicle registration authority. This can be done using a personal computer of the keeper via the Internet. The personal computer has a reader for communicating with the ID token134. The personal computer and the reader thereof are used to set up a protected connection to the server of the motor vehicle registration office, which connection is used to write the data109with the updated motor vehicle license number and possibly the signature thereof to the memory area146of the ID token134.2. When the user with the ID token134is in reception range of the interface116, the program module128is started in order to update the motor vehicle license number. This can be done manually by virtue of the user operating an operator control element on the motor vehicle100, which may be arranged on the dashboard of the motor vehicle100, for example. Alternatively, the program module128can be executed continuously. Execution of the program module128then transmits signals cyclically from the interface116within certain intervals of time in order to check whether the ID token134is in the reception range of the interface116.The motor vehicle license number is then updated by setting up a connection between the interfaces116and160. By way of example, the program module128accesses the certificate113stored in the memory area110in order to send it from the interface116to the ID token134. The program module156of the ID token134then generates what is known as a challenge, i.e. a random number, for example. This random number is encrypted with the public key of the motor vehicle100which is contained in the certificate113.The resulting cipher is sent from the ID token134via the connection to the interface116of the motor vehicle electronics appliance102. The program module122decrypts the cipher using the private key of the motor vehicle100which is stored in the memory area114and thus obtains the random number. This random number is returned to the ID token134by the program module122via the interface116.Execution of the program module156performs a check therein to determine whether the random number received from the motor vehicle electronics appliance102matches the originally generated random number, i.e. the challenge. If this is the case, the motor vehicle electronics appliance102is deemed to have been authenticated to the ID token134. The random number can be used as a symmetric key for the end-end encryption which is performed by the program modules124and158.Optionally, the ID token134can be authenticated to the motor vehicle electronics appliance102in a similar fashion.The unilateral or reciprocal authentication may also involve the use of the motor vehicle identifier which is stored in the memory areas106and146. By way of example, the ID token134sends the motor vehicle identifier signed by the ID token134to the motor vehicle electronics appliance102. The motor vehicle electronics appliance102then checks the signature and compares the motor vehicle identifier received from the ID token134with the motor vehicle identifier stored in the memory area106. If the signature is valid and the motor vehicle identifiers match, the ID token134is deemed to be authentic.3. When the unilateral or reciprocal authentication of the motor vehicle electronics appliance102and the ID token134has taken place, the motor vehicle electronics appliance102is provided with read authorization for accessing the memory area148of the ID token134. The program module128then sends an appropriate read command from the interface116to the ID token134. The ID token134then reads the license number data109, possibly including the signature, from the memory area148and sends them to the interface116via the connection with end-end encryption. The program module128then starts the program module126in order to check the signature of the data109using the root certificate112. If the signature is valid, the data are stored in the memory area108, with the data previously stored therein being able to be overwritten.Execution of the program module130then generates the message105(cf.FIG. 1andFIG. 3). This can be done such that the data109are encrypted with the private key stored in the memory area114so as to produce the cipher111. This message105is then sent via the data transmission channels to the motor vehicle display apparatuses101and101′, where the license number data, i.e. the data109, are updated accordingly, so that the updated license number data are reproduced on the displays of the motor vehicle display apparatuses101and101′.

The certificates113and178stored in the memory areas110and112are updated as follows:

A connection is set up between the interfaces118and164, for example using a cable. Execution of the program168reads the motor vehicle identifier from the memory area106of the motor vehicle electronics appliance102. The program168then generates a request for the server computer172, said request containing this motor vehicle identifier.

This request is sent by the terminal162from its network interface170via the network174to the server computer172. On the basis of said request, the server computer accesses the database176in order to use the motor vehicle identifier to read the current certificate113associated with the motor vehicle identifier. The certificate113and the current root certificate178are sent by the server computer172via the network174to the terminal162, and from there execution of the program168transmits them via the connection between the interface164and the interface118to the motor vehicle electronics appliance102, where the current certificate113is stored in the memory area110and the current root certificate178is stored in the memory area112by virtue of the respective certificates previously stored therein being overwritten.

By way of example, the terminal may be part of a workshop which updates the certificates in this manner on the occasion of regular servicing of the motor vehicle100. The terminal may also be part of a test center, such as the German Association for Technical Inspection (TOV), which updates the certificates on the occasion of what is known as a general inspection.

In one alternative embodiment, the interface118is designed such that it can communicate directly with the server computer172, for example via a mobile radio link.

The database176may store not only the current certificates113but also the current certificates133of the motor vehicle display apparatuses in the motor vehicles. In that case, not only the current certificate113and the current root certificate178but also the current certificates133and133′ of the motor vehicle display apparatuses101and101′ in the motor vehicle100are received using the interface118. The motor vehicle electronics appliance102then forwards the root certificate178via the data transmission channels to the motor vehicle display apparatuses101and101′ in order to update the root certificates stored therein (cf. embodiment inFIG. 1).

In addition, the motor vehicle electronics appliance102also forwards the updated certificates133and133′ via the data transmission channels to the motor vehicle display apparatuses101and101′, so that the certificates stored therein are respectively updated (cf. embodiment inFIG. 3).

The interface116of the motor vehicle electronics appliance102may be designed such that it can receive the message105′ from the external transmitter107′ (cf. the embodiments inFIGS. 1 and 3). In the embodiment considered in the present case, the transmitter107′ has an electronic memory144′ with protected memory areas150′ and152′. The memory area150′ is used for storing a certificate for the transmitter107′. The memory area152′ is used for storing a private key with which the certificate stored in the memory area150′ is associated.

The transmitter107′ also has a processor154′ for executing program modules156′ and158′, which correspond to the program modules122and124. The program module156′ is used for executing those steps of the cryptographical protocol which relate to the transmitter107′. The program module158′ is used for setting up an encrypted connection to the motor vehicle electronics appliance102, particularly a connection with end-to-end encryption using a symmetric or asymmetric key.

The processor154is also used for executing an application program142.

The transmitter107′ also has an interface160′ which corresponds to the interface116of the motor vehicle electronics appliance102and, by way of example, is in the form of a radio interface operating on the basis of an RFID method.

The transmitter107′ may be a mobile or fixed external transmitter. By way of example, the transmitter107′ may be arranged at the edge of or above a carriageway, so that the encrypted connection can be set up to a passing motor vehicle. The transmitter107′ may also be fitted in a police vehicle, for example, in order to inspect a passing motor vehicle from the police vehicle by setting up the encrypted connection.

When the motor vehicle100is close to the transmitter107′, a connection is set up between the interfaces116and160′. By way of example, the program module128accesses the certificate113stored in the memory area110in order to send it from the interface116to the transmitter107′ after an appropriate request has been received from the transmitter107′. The program module156′ of the transmitter107′ then generates what is known as a challenge, i.e. a random number, for example. This random number is encrypted using the public key of the motor vehicle100which is contained in the certificate113.

The resulting cipher is sent from the transmitter107′ via the connection to the interface116of the motor vehicle electronics appliance102. The program module122decrypts the cipher using the private key of the motor vehicle100which is stored in the memory area114and thus obtains the random number. The random number is returned by the program module122to the transmitter107′ via the interface116.

Execution of the program module156′ performs a check therein to determine whether the random number received from the motor vehicle electronics appliance102matches the originally generated random number, i.e. the challenge. If this is the case, the motor vehicle electronics appliance102is deemed to have been authenticated to the transmitter107′. The random number can be used as a symmetric key for the end-to-end encryption which is performed by the program modules124and158′.

Optionally, the transmitter107can be authenticated to the motor vehicle electronics appliance102in a similar fashion.

The unilateral or reciprocal authentication may also involve the use of the motor vehicle identifier which is stored in the memory area106. By way of example, the transmitter107′ has access to a copy of the motor vehicle identifier. The transmitter107′ signs the motor vehicle identifier and sends the signed motor vehicle identifier to the motor vehicle electronics appliance102. The motor vehicle electronics appliance102then checks the signature and compares the motor vehicle identifier received from the transmitter107with the motor vehicle identifier stored in the memory area106. If the signature is valid and the motor vehicle identifiers match, an authentication condition is thus deemed to have been met.

When the unilateral or reciprocal authentication of the motor vehicle electronics appliance102and the transmitter107′ has been performed, the transmitter107′ sends the message105′ to the interface116via the protected connection with end-to-end encryption. The motor vehicle electronics appliance102forwards the message105′ via its interface143and the network140to the motor vehicle display apparatuses101and101′, where the message105′ is processed further in accordance with the embodiments inFIGS. 1 and 2, for example.

Alternatively, the motor vehicle electronics appliance102may also be designed such that reception of the message105′ is followed by the signature being checked by means of execution of the program module126. If the signature is valid, the data109′ in the message105′ are forwarded via the interface143and the network140to the motor vehicle display apparatuses101and101′.

Alternatively, the motor vehicle electronics appliance102may also be designed such that in addition to the check on the signature of the message105′, the second signal is also generated by the motor vehicle electronics appliance102. If the result of the signature check is that the signature of the message105′ is valid, the motor vehicle electronics appliance102thus generates the second signal and sends it via the interface143and the network140to the motor vehicle display apparatuses101and101′, so that the second signal is visually output by the motor vehicle display apparatuses101and101′.

The network140may have a sensor196connected to it. The sensor196may be designed to pick up a vehicle parameter, such as an environment-related or safety-related vehicle parameter, such as a noise or exhaust emission value. The sensor196provides a sensor signal which contains the relevant information. By way of example, the sensor signal is sent by the sensor196via the network140to the motor vehicle electronics appliance102, which then generates a message105′ which contains the information provided by the sensor196and a signature generated using the private key114. Alternatively, the message105′ is generated by the sensor196itself. This message105′ is then sent by the motor vehicle electronics appliance102or by the sensor196to the motor vehicle display apparatuses101and101′ via the network140.

FIG. 5shows a further embodiment of the invention. In addition to the embodiment inFIG. 4, the interface116of the motor vehicle electronics appliance102is designed to communicate with an appropriate interface160of an ID token180. By way of example, the ID token180may be in the form of an electronic key. The ID token180has a memory182for storing a key identifier184for the ID token180. The key identifier is an identifier which explicitly or almost explicitly identifies the ID token180.

A reference value for this key identifier184is stored in a memory area186of the motor vehicle electronics appliance102.

The processor120of the motor vehicle electronics appliance102is in this case additionally used for executing a control program188.

Execution of the control program188outputs signals cyclically from the interface116. When the ID token180is in range of the interface116, the ID token180responds to such a signal by transmitting the key identifier184to the interface116, which is done by virtue of the program190being executed by the processor192. The control program188then checks the key identifier184received via the interface116with the reference value stored in the memory area186. If there is a match, the control program188actuates central locking for the motor vehicle100in order to enable the doors to be opened. As an alternative or in addition, the control program188can enable the starter motor of the motor vehicle100to be operated.

When not only the ID token180but also the ID token134are within range of the interface116, the control program188starts the program module128for updating the license number.

LIST OF REFERENCE SYMBOLS