Patent ID: 12244735

DESCRIPTION OF THE EXEMPLARY EMBODIMENTS

FIG.1shows an electronic system10which is implemented as an injection molding machine40, for example. The electronic system10as an electronic unit12embodied as a central controller and/or an electronic control device. The electronic system10has components14,36. One component14of the components14,36of the electronic system10implemented as an injection molding machine40is implemented as a valve. The component14that is implemented as a valve is provided for the purpose of controlling a flow through a shut-off nozzle (not shown in detail) of the injection molding machine40. A further component36of the components14,36of the electronic system10that is implemented as an injection molding machine40is embodied as an electric motor (not shown in detail). The component36that is embodied as an electric motor is provided for the purpose of controlling a rotational movement of a worm shaft of the injection molding machine40. The components14,36comprise an ASIC, an FPGA and/or a μC. The components14,36interact with the electronic unit12. The components14,36are connected to the electronic unit12via a data line38. Alternatively, a radio connection is also conceivable (cf. alsoFIG.6). The electronic unit12is provided for the purpose of controlling the functions of the components14,36, for example for the purpose of controlling the open position of the valve or the rotational movement of the worm shaft. The electronic unit12of the electronic system10forms an ECU or a PLC.

FIG.2shows an alternative electronic system10′ which is implemented as a vehicle42, for example, in particular implemented as a vehicle driving in an at least partially autonomous manner. The alternative electronic system10′ has an electronic unit12that is embodied as a central controller and/or an electronic control device. The alternative electronic system10′ has components14,36. One component14of the components14,36of the alternative electronic system10′ that is implemented as a vehicle42is embodied as a distance sensor (for example a radar sensor or a lidar sensor) of the vehicle42. The component14that is embodied as a distance sensor is provided for the purpose of topographically identifying an environment of the vehicle42. A further component36of the components14,36of the alternative electronic system10′ that is implemented as a vehicle42is embodied as an electric motor (not shown in detail). The component36that is embodied as an electric motor is provided for the purpose of controlling a part of the vehicle42, for example a steering system or a speed of the vehicle42. The components14,36interact with the electronic unit12. The components14,36comprise an ASIC, an FPGA and/or a μC. The components14,36are connected to the electronic unit12via a data line38. Alternatively, a radio connection is also conceivable (cf.FIG.6). The electronic unit12is provided for the purpose of controlling the functions of the components14,36. The electronic unit12of the alternative electronic system10′ forms an ECU or a PLC.

FIG.3shows a second alternative electronic system10″ which is implemented as a computer system44, for example, in particular implemented as a portable computer system. The second alternative electronic system10″ has an electronic unit12that is embodied as a portable computer, in particular a laptop. The electronic unit12of the second alternative electronic system10″ is embodied as a central electronic unit of the second alternative electronic system10″. The second alternative electronic system10″ has components14,36. One component14of the components14,36of the second alternative electronic system10″ that is implemented as a computer system44is realized as a charging cable of the portable computer. The component14that is realized as a charging cable is provided for the purpose of supplying an energy store of the portable computer with electrical charging energy. A further component36of the components14,36of the second alternative electronic system10″ that is implemented as a computer system44is realized as earphones. The component36realized as earphones is provided for the purpose of outputting acoustic signals generated by the portable computer. The components14,36interact with the electronic unit12. The components14,36are connected to the electronic unit12via a cable connection. The components14,36each have an integrated cryptographic module46. The cryptographic module46is provided for the purpose of transmitting encrypted data to the electronic unit12or receiving encrypted data from the electronic unit12. The components14,36, in particular the cryptographic modules46of the components14,36, are connected to the electronic unit12via a data line38. Alternatively, a radio connection is also conceivable. The cryptographic module46of the components14,36comprises an ASIC, an FPGA and/or a μC.

The electronic units12of the electronic systems10,10′,10″ are superordinate to the components14,36of the electronic systems10,10′,10″. The electronic units12of the electronic systems10,10′,10″ each have pre-installed software and/or programming provided at least for the purpose of carrying out a copy protection method (described herein). Alternatively, a software patch can be loaded onto the electronic units12of the electronic systems10,10′,10″, which software patch is provided for the purpose of making it possible to carry out the copy protection method described herein. Alternatively, a hardware element112(seeFIG.6) can be installed on the electronic unit12of the electronic systems10,10′,10″, which hardware element has software or programming provided for the purpose of making it possible to carry out the copy protection method described herein. The components14,36of the electronic systems10,10′,10″ are subordinate to the electronic units12of the electronic systems10,10′,10″. The components14,36of the electronic systems10,10′,10″ have pre-installed software and/or programming provided at least for the purpose of carrying out the copy protection method (described herein).

The electronic unit12is provided for the purpose of checking authenticity of the components14,36. The electronic unit12is provided for the purpose of checking the authenticity of the components14,36by mutually checking certificates20,22of a public-key infrastructure16which are respectively associated with the electronic unit12and the components14,36(cf.FIG.4).

The electronic systems10,10′,10″ form copy-protected electronic systems10,10′,10″. The copy-protected electronic systems10;10′;10″ make it possible to check the authenticity of the respectively associated components14,36offline.

For this purpose, the electronic units12of the electronic systems10,10′,10″ have the first certificate20which is already loaded when producing the electronic unit12and/or when configuring the electronic units12. The first certificate20has been premade offline before being loaded onto the electronic unit12. The electronic units12of the electronic systems10,10′,10″ also have a specific public key24of the public-key infrastructure16which is already loaded when producing the electronic units12and/or when configuring the electronic units12. The electronic units12of the electronic systems10,10′,10″ also have a specific private key26of the public-key infrastructure16which is already loaded when producing the electronic units12and/or when configuring the electronic units12. The specific public key24of one of the electronic units12and the specific private key26of the same electronic unit12form a unique key pair.

For this purpose, the components14,36of the electronic systems10,10′,10″ also have the second certificate22which is already loaded when producing the components14,36and/or when configuring the components14,36. The second certificate22has been premade offline before being loaded onto the components14,36. The components14,36of the electronic systems10,10′,10″ also each have a further specific public key28of the public-key infrastructure16which is loaded when producing the components14,36and/or when configuring the components14,36. The components14,36of the electronic systems10,10′,10″ also have a further specific private key30of the public-key infrastructure16which is already loaded when producing the components14,36and/or when configuring the components14,36.

FIG.4shows a schematic illustration of a public-key infrastructure16of the copy protection method. The copy protection method has offline capability. In the copy protection method, in order to check authenticity of components14,36of the electronic system10by means of the electronic unit12of the electronic system10, the certificates20,22respectively associated with the components14,36and the electronic unit12are mutually checked within the electronic system10. The public-key infrastructure16has a cryptographic generator50. The cryptographic generator50is provided for the purpose of creating associated key pairs of public keys24,28and private keys26,30. The cryptographic generator50itself is protected by means of a master key pair54. The key pairs created by the cryptographic generator50are transmitted to a manufacturer of components14,36and/or to a manufacturer of electronic units12. The key pairs are transmitted on a secure path which cannot be intercepted or at least can be intercepted with difficulty, preferably on a transmission path which is independent from electronic data connections of the electronic unit12, for example via a physical data storage medium. Each electronic unit12has a unique identification feature48, for example a serial number of the electronic unit12. Each component14,36has a unique identification feature52, for example a serial number of the component14,36.

The public-key infrastructure16has a certification authority18. The cryptographic generator50may be formed separately from the certification authority18together with the certification authority18. The certification authority18is provided for the purpose of issuing the first certificate20for the electronic unit12. The certification authority18is provided for the purpose of issuing the second certificate22for the respective components14,36. The manufacturer of the component14,36and/or of the electronic unit12assigns a key pair to each component14,36and/or to each electronic unit12. The manufacturer of the component14,36and/or of the electronic unit12respectively transmits the public key24,28of the assigned key pairs, together with the respectively associated assigned identification features48,52, in a manner packaged in packets, to the certification authority18via a secure transmission path which is independent from electronic data connections of the electronic unit12and/or of the components14,36. Alternatively, it is conceivable for the manufacturer to transmit the identification features48,52to the cryptographic generator50which assigns a key pair to each identification feature48,52associated with a component14,36or with an electronic unit12and forwards the public keys24,28of the assigned key pairs, together with the respectively associated assigned identification features48,52, in a manner packaged in packets, to the certification authority18via a secure transmission path which is independent from electronic data connections of the electronic unit12and/or of the components14,36.

The first certificate20is then respectively issued on the basis of the transmitted identification feature48of the electronic unit12and the associated public key24,28of the electronic unit12. The second certificate22is then respectively issued on the basis of the transmitted identification feature52of the components14,36and the associated public key24,28of the components14,36. The first certificate20is premade. The first certificate20is premade offline. The second certificate22is premade. The second certificate22is premade offline. The premade certificates20,22are returned from the certification authority18to the respective manufacturer of the electronic unit12and/or of the component14,36via a secure transmission path which is independent from electronic data connections of the electronic unit12and/or of the components14,36.

When producing the electronic unit12, the first certificate20associated with the electronic unit12is loaded onto the electronic unit12(offline). Alternatively or additionally, the first certificate20associated with the electronic unit12is loaded onto the electronic unit12when configuring the electronic unit12(offline). The first certificate20associated with the electronic unit12is stored in a rewritable memory of the electronic unit12. When producing the component14,36, the second certificate22associated with the component14,36is loaded onto the component14,36(offline). Alternatively or additionally, the second certificate22associated with the component14,36is loaded onto the component14,36when configuring the component14,36(offline). The second certificate22associated with the component14,36is stored in a rewritable memory of the component14,36.

When producing the electronic unit12, the specific public key24of the public-key infrastructure16that is associated with the electronic unit12is loaded onto the electronic unit12(offline). Alternatively or additionally, the specific public key24of the public-key infrastructure16that is associated with the electronic unit12is loaded onto the electronic unit12when configuring the electronic unit12(offline). The public key24assigned to the electronic unit12is stored in a write-once memory of the electronic unit12. When producing the electronic unit12, the specific private key26of the public-key infrastructure16that is associated with the electronic unit12is loaded onto the electronic unit12(offline). Alternatively or additionally, the specific private key26of the public-key infrastructure16that is associated with the electronic unit12is loaded onto the electronic unit12when configuring the electronic unit12(offline). The private key26assigned to the electronic unit12is stored in a write-once memory of the electronic unit12such that it cannot be read (in an encrypted form).

The manufacturer of the electronic unit12or the operator of the certification authority18creates a list of identifiers56of components14,36that are compatible with the electronic unit12and/or of component groups that are compatible with the electronic unit12. When producing the electronic unit12, the list of identifiers56of components14,36and/or component groups that are compatible with the electronic unit12is loaded onto the electronic unit12(offline). Alternatively or additionally, the list of identifiers56of components14,36and/or component groups that are compatible with the electronic unit12is loaded onto the electronic unit12when configuring the electronic unit12(offline). The list of identifiers56of components14,36and/or component groups that are compatible with the electronic unit12is stored in the write-once memory of the electronic unit12or in a rewritable memory of the electronic unit12. It is conceivable for the list of identifiers56of components14,36and/or component groups that are compatible with the electronic unit12to be stored in the memory of the electronic unit12such that it cannot be read (in an encrypted form).

When producing the component14,36, the specific public key28of the public-key infrastructure16that is associated with the component14,36is loaded onto the component14,36(offline). Alternatively or additionally, the specific public key28of the public-key infrastructure16that is associated with the component14,36is loaded onto the component14,36when configuring the component14,36(offline). The public key28assigned to the component14,36is stored in a write-once memory of the component14,36. When producing the component14,36, the specific private key30of the public-key infrastructure16that is associated with the component14,36is loaded onto the component14,36(offline). Alternatively or additionally, the specific private key30of the public-key infrastructure16that is associated with the component14,36is loaded onto the component14,36when configuring the component14,36(offline). The private key30assigned to the component14,36is stored in a write-once memory of the component14,36such that it cannot be read (in an encrypted form).

The manufacturer of the components14,36or the operator of the certification authority18assigns an identifier from the list of identifiers56to each component14,36. When producing the component14,36, one of the identifiers from the list of identifiers56is loaded onto the component14,36(offline). When producing the component14,36, one of the identifiers from the list of identifiers56is stored in a memory of the component14,36(offline). Alternatively or additionally, one of the identifiers from the list of identifiers56is loaded onto the component14,36when configuring the component14,36(offline) and/or is stored in the memory of the component14,36. The identifier assigned to the component14,36is stored in a write-once memory of the component14,36or in a rewritable memory of the component14,36. It is conceivable for the identifier assigned to the component14,36to be stored in the memory of the component14,36such that it cannot be read (in an encrypted form).

FIG.5shows an exemplary schematic flowchart of the copy protection method. In at least one method step58, an electronic system10,10′,10″ having the electronic unit12and having at least one component14,36that interacts with the electronic unit12is provided. The copy protection method comprises a first method part32. The copy protection method comprises a second method part34. The first method part32and the second method part34are carried out and/or repeated in succession each time a component14,36of the electronic system10;10′;10″ that interacts with the electronic unit12is replaced and/or each time a component14,36that interacts with the electronic unit12is newly installed. During a normal start of the electronic system10,10′,10″, which was not preceded by any replacement of a component14,36and/or any reinstallation of a component14,36in particular, only the second method part34is carried out and/or repeated. The first method part32is skipped during the normal start of the electronic system10,10′,10″. Alternatively, however, a situation is also conceivable in which no permanent storage of the certificates20,22, which have been replaced in the first method part32, is provided for the electronic unit12and/or for the component14,36. Instead, temporary storage, use and subsequent deletion could be provided in this case. In this case, the first method part32is then carried out again each time the electrical system10,10′,10″ is started, in particular even during the normal start of the electrical system10,10′,10″.

The first method part32comprises a plurality of method steps60,62,64,66,68,70,72. The method steps60,62,64,66,68,70,72of the first method part32may also have a sequence of method steps which differs from the sequence of method steps described below. In at least one method step60of the first method part32, a data connection is set up between the electronic unit12and the component14,36. In at least one further method step62of the first method part32, the first certificate20is transmitted from the electronic unit12to the component14,36. The first certificate20transmitted in the method step62comprises the public key24of the electronic unit12. In at least one further method step64of the first method part32, the first certificate20is verified by the component14,36. In the method step64, the first certificate20is verified by means of a public key110of the certification authority18. In the method step64, the public key24of the electronic unit12is determined by the component14,36. In at least one further method step66of the first method part32, the public key24of the electronic unit12is locally stored by the component14,36in the memory of the component14,36, in particular in a ROM (permanent) of the component14,36or in a RAM (temporary) of the component14,36, after the first certificate20has been successfully verified by the component14,36. In at least one further method step68of the first method part32, the second certificate22is transmitted from the component14,36to the electronic unit12. The second certificate22transmitted in the method step68comprises the further public key28of the component14,36. In at least one further method step70of the first method part32, the second certificate22is verified by the electronic unit12. In the method step70, the second certificate22is verified by means of the public key110of the certification authority18. In the method step70, the further public key28of the component14,36is determined by the electronic unit12. In at least one further method step72of the first method part32, the further public key28of the component14,36is locally stored by the electronic unit12in the memory of the electronic unit12, in particular in a ROM (permanent) of the electronic unit12or in a RAM (temporary) of the electronic unit12, after the second certificate22has been successfully verified by the electronic unit12.

The second method part34comprises a plurality of method steps74,76,78,80,82,84,86,88,90,92,94,96,98,100,102,104,106. The method steps74,76,78,80,82,84,86,88,90,92,94,96,98,100,102,104,106of the second method part34may also have a sequence of method steps that differs from the sequence of method steps described below. In at least one method step74of the second method part34, at least one additional encrypted data element that is implemented as a time stamp and/or a cryptographically secure random number is transmitted back and forth at least once between the electronic unit12and the component14,36by means of the public-key infrastructure16. The electronic unit12has a cryptographically secure random number generator (not shown). In at least one method step76of the second method part34, a cryptographically secure random number is generated by the random number generator of the electronic unit12. In at least one method step78of the second method part34, a time stamp is generated by the electronic unit12. In at least one further method step80of the second method part34, the cryptographically secure random number and the time stamp are locally and/or temporarily stored by the electronic unit12in the memory of the electronic unit12. In this context, “temporarily storing” should be understood as meaning, in particular, time-limited storage during which the temporarily stored data are preferably deleted again after successfully identifying authenticity of the component14,36or are overwritten when a further cryptographically secure random number or a further time stamp is generated. In at least one further method step82of the second method part34, the electronic unit12creates a packet comprising at least the cryptographically secure random number and the time stamp. In at least one further method step84of the second method part34, the packet comprising the cryptographically secure random number and the time stamp is encrypted by means of the further public key28of the component14,36that is stored by the electronic unit12. In at least one further method step86of the second method part34, the encrypted packet is transmitted from the electronic unit12to the component14,36. In at least one further method step88of the second method part34, the packet is decrypted by the component14,36by means of the further private key30of the component14,36. In at least one further method step90of the second method part34, the specific identifier assigned to the component14,36is added to the packet by the component14,36. In at least one further method step92of the second method part34, the packet expanded by the specific identifier assigned to the component14,36is encrypted by means of the public key24of the electronic unit12that is stored by the component14,36. In at least one further method step94of the second method part34, the packet expanded by the specific identifier assigned to the component14,36is transmitted from the component14,36to the electronic unit12. In at least one further method step96of the second method part34, the packet expanded by the specific identifier assigned to the component14,36is decrypted by the electronic unit12by means of the private key26of the electronic unit12. In at least one further method step98of the second method part34, the time stamp from the expanded packet received by the electronic unit12and decrypted by the electronic unit12is compared with the time stamp stored locally and/or temporarily in the memory of the electronic unit12. In at least one further method step100of the second method part34, the cryptographically secure random number from the expanded packet received by the electronic unit12and decrypted by the electronic unit12is compared with the cryptographically secure random number stored locally and/or temporarily in the memory of the electronic unit12. In at least one further method step102of the second method part34, the specific identifier from the expanded packet received by the electronic unit12and decrypted by the electronic unit12is matched with identifiers from the list of identifiers56stored in the memory of the electronic unit12. In at least one further method step104of the second method part34, authenticity of the component14,36is confirmed by the electronic unit12if the following three criteria are satisfied: a) correspondence of the cryptographically secure random numbers, b) correspondence of the time stamps and c) correspondence of the specific identifier to at least one identifier from the list of identifiers56stored in the memory of the electronic unit12. Alternatively, in at least one further method step106of the second method part34: a) in the event of a discrepancy of the cryptographically secure random numbers, b) in the event of a discrepancy of the time stamps or c) if the specific identifier transmitted to the electronic unit12is absent in the list of identifiers56stored by the electronic unit12, a forgery and/or an incompatible component are/is identified by the electronic unit12.

In at least one further method step108, if a forgery and/or an incompatible component are/is identified by the electronic unit12in the second method part34, use of the forgery and/or use of the incompatible component within the electronic system10,10′,10″ is denied.

FIG.6shows the electronic system10that is implemented as an injection molding machine40, for example, in a further configuration. The electronic system10comprises further components116,118,120,122,124. The further components116,118,120,122,124form, by way of example, solenoid valves of a battery of solenoid valves of the injection molding machine40. The electronic system10comprises a hardware element112. The hardware element112is connected to the electronic unit12of the electronic system10of the injection molding machine40. The hardware element112is plugged into the electronic unit12by means of IO pins. The hardware element112comprises an electronic circuit114having a processor (not shown) and a data memory (not shown). The hardware element112comprises pre-installed software and/or programming provided at least for the purpose of carrying out the copy protection method described. The hardware element112is provided for the purpose of transmitting an item of information relating to authenticity of one or more components14,36,116,118,120,122,124of the electronic system10, as determined by means of the copy protection method, to the electronic unit12. The electronic unit12is provided for the purpose of allowing or preventing the operation of individual components14,36,116,118,120,122,124and/or of the entire electronic system10on the basis of the information received from the hardware element112. The hardware element112has a radio module126. The components116,118,120,122,124have a further radio module128. The components116,118,120,122,124are connected to the further radio module128. Alternatively, each component14,36,116,118,120,122,124may have a separate further radio module128, in particular a further radio module specifically associated with the respective component14,36,116,118,120,122,124. The radio modules126,128each comprise a transmitter (transmission antenna) and a receiver (receiver antenna). The radio modules126,128replace the data line38. The components116,118,120,122,124and the electronic unit12are connected to one another using communication technology (for example via BLE, LORA, WLAN, etc.) by means of the radio modules126,128. The radio modules126,128are provided for the purpose of mutually transmitting the certificates20,22and/or public keys24,28,110needed to carry out the copy protection method.