Digital map data with enhanced functional safety

1 . A method of handling map data that is being transmitted from a remote server to one or more map-based applications executing on an electronic control unit (ECU) of a vehicle traversing a navigable network covered by a digital map, wherein the digital map is represented as a plurality of map tiles, each map tile representing a particular geographical area including a portion of the navigable network, the method comprising:

generating, at the remote server, a map tile data structure for a map tile, wherein the map tile data structure includes object data indicative of one or more objects falling at least partially within the geographical area represented by the map tile and/or within the geographical area represented by another one or more of the map tiles representing the digital map, the generating comprising including, in the map tile data structure:

security data for at least one object among the one or more objects, the security data being usable for object-level verification to verify an integrity of the object data that is associated with the at least one object and is stored within the map tile data structure; and

a digital signature for the map file data structure, the digital signature being usable for tile-level verification to verify an authenticity and/or integrity of the map tile data structure; and

transmitting, by the remote server, the map tile data structure from the remote server to a client application executing on the one or more processing units of the vehicle.

2 . The method of claim 1 , further comprising:

unpacking, by the client application, the map tile data structure to extract the object data indicative of the one or more objects for which data is stored in the map tile data structure; and

using, by the client application, the security data to verify the integrity of the extracted object data.

3 . A method of operating a client application executing on-board a vehicle traversing a navigable network in a geographical area covered by a digital map, wherein the digital map is represented as a plurality of map tiles, each map tile representing a particular geographical area including a portion of the navigable network, and wherein each map tile has an associated map tile data structure including:

object data indicative of one or more objects falling at least partially within the geographical area represented by the map tile and/or within the geographical area represented by another one or more of the map tiles representing the digital map;

security data usable for object level verification to verify an integrity of the object data associated with at least one object for which object data is stored in the map tile data structure; and

a digital signature for the map file data structure and usable for tile-level verification to verify an authenticity and/or integrity of the map tile data structure, the method comprising:

receiving, at the client application, a request from one or more map-based applications for map data relating to one or more features of the navigable network;

obtaining, by the client application, given object data related to the one or more features from a respective map tile data structure;

obtaining, by the client application, from the respective map tile data structure, associated security data for the given object data; and

using, by the client application, the security data to verify the integrity of the given object data and, when the integrity of the data is verified, passing the object data to the one or more map-based applications.

4 . The method of claim 3 , wherein:

the security data useable for verifying the integrity of the given object data includes a hash value for a given object data; and

verifying the integrity of the given object data comprises the client application:

recalculating a hash using the given object data to generate a recalculated hash value; and

comparing the recalculated hash value with the hash value for the given object data.

5 . The method of claim 3 , wherein the client application comprises a first application and a second application, the first application being in communication with the one or more map-based applications and the second application being in communication with at least one remote server.

6 . The method of claim 5 , comprising:

responsive to a request from the one or more map-based applications for information regarding a feature within the navigable network covered by the digital map:

requesting, by the first application from the second application, specified object data associated with the feature;

obtaining, by the second application, the specified object data and associated security data;

providing, by the second application to the first application, the specified object data and the associated security data; and

using, by the first application, the associated security data to verify the integrity of the specified object data.

7 . The method of claim 6 , comprising:

responsive to the first application determining, while verifying the integrity of the specified object data, that the integrity of the specified object data is undamaged:

providing, by the first application to the map-based application, the specified object data.

8 . The method of claim 7 , comprising:

responsive to the first application determining, while verifying the integrity of the specified object data, that the integrity of the specified object data is damaged:

providing, by the first application to the map-based application, an integrity error message; and/or

re-requesting, by the first application from the second application, the specified object data.

9 . The method of claim 5 , wherein:

the second application comprises a map tile cache storing map tile data structures obtained from the at least one remote server for a plurality of map tiles; and

the method comprises:

obtaining, by the second application, particular object data by first checking whether the particular object data is present in the map tile cache, wherein:

when the particular object data is present in the map tile cache, the second application reads the particular object data from the map tile cache; and

when the particular object data is not present in the map tile cache, the second application issues a request for the particular object data to the remote server.

10 . The method of claim 9 , comprising:

verifying, by the second application, the authenticity and/or integrity of the one or more map tile data structures received from the at least one remote server using respective digital signatures before adding the one or more map tile data structures received from the at least one remote server to the map tile cache.

11 . The method of claim 3 , wherein the map tiles represent the navigable network in respective particular geographical areas as a plurality of arcs connected by nodes, wherein each arc and node of a map tile have object data and security data associated therewith.

12 . A method of operating a client application running on one or more processing units of a vehicle traversing a navigable network in a geographical area to provide digital map data from at least one remote server to one or more map-based applications running on an electronic control unit (ECU) of the vehicle, wherein: the client application comprises a first application and a second application, the first application being in communication with the map-based application and the second application, and the second application being in communication with the at least one remote server; the at least one remote server has access to: (i) a map tile data store storing a plurality of map tiles, each map tile representing the navigable network in a portion of the geographical area as a plurality of arcs connected by nodes and each map tile including a digital signature usable for tile-level verification to verify an authenticity and/or integrity of the map tile; and (ii) a map tile metadata data store storing metadata for each of the map tiles in the map tile data store, wherein each arc and node of a map tile have object data and a security data for object level verification to verify an integrity of the object data, the security data including a hash value associated with the object data, the hash value being calculated at the remote server based on at least the object data for the respective arc or node and tile metadata for the map tile containing the object data for the respective arc or node; and the second application comprises: (i) a map tile cache storing a plurality of map tiles obtained from the at least one remote server; and (ii) a map tile metadata cache storing the metadata for each of the map tiles in the map tile cache obtained from the at least one remote server, the method comprising:

receiving, by the first application from the map-based application, a request for digital map data concerning a feature of the navigable network;

requesting, by the first application from the second application, the object data and hash value for the at least one arc or node relating to the digital map data;

obtaining, by the second application, the object data and one or more hash values from the map tile cache or the map tile data store if the map tile is not stored in the map tile cache;

providing, by the second application to the first application, the object data and one or more hash values to the first application;

requesting, by the first application from the second application, the metadata for the map tile concerning the at least one arc or node relating to the digital map data;

obtaining, by the second application, the tile metadata from the map tile metadata cache, or the map tile metadata data store if the required tile metadata is not stored in the map tile metadata cache;

providing, by the second application to the first application, the tile metadata;

calculating, by the first application, a new hash value for the at least one arc or node based on the object data and tile metadata;

comparing, by the first application, the new hash value with the one or more hash values; and

providing, by the first application to the map-based application, based on the comparison, either the digital map data or an integrity error message.

13 . The method of claim 12 , wherein:

the map-based application is an autonomous driving application or is a vehicle horizon provider that in turn provides map data to an autonomous driving application; and

upon receiving the integrity error message, the autonomous driving application operates the vehicle in a safe mode and/or brings the vehicle to a safe stop.

14 . A method of operating a client application running on one or more processing units of a vehicle traversing a navigable network in a geographical area to provide digital map data from at least one remote server to one or more map-based applications running on an electronic control unit (ECU) of the vehicle, wherein: the client application comprises a first application running on the ECU and a second application, the first application being in communication with the map-based application and the second application, and the second application being in communication with the at least one remote server; the at least one remote server has access to a map tile data store storing a plurality of map tiles, each map tile representing the navigable network in a portion of the geographical area as a plurality of arcs connected by nodes, wherein each arc and node of a map tile have object data associated therewith, wherein each map tile is associated with a digital signature usable for tile-level verification to verify an authenticity and/or integrity of the map tile, and wherein some or all of the object data for some or all of the arcs and/or nodes in the map tile is associated with security data usable for object-level verification to verify an integrity of the object data; and the second application comprises a map tile cache storing a plurality of map tiles obtained from the at least one remote server, the method comprising:

receiving, by the first application, a request from the map-based application for digital map data concerning a feature of the navigable network;

requesting, by the first application from the second application, the object data for the at least one arc or node relating to the digital map data;

obtaining, by the second application, the object data, wherein the object data is either obtained from the map tile cache if the object data is present in the map tile cache or from the map tile data store if the map tile associated with the object data is not present in the map tile cache;

providing, by the second application to the first application, the object data;

identifying, by the first application, a portion of the object data corresponding to the feature of the navigable network; and

providing, by the first application, the requested digital map data to the map-based application using the portion of the object data.

15 . The method of claim 14 , wherein the second application is developed according to a lower functional safety standard than the first application.

16 . The method of claim 15 , wherein the first application is developed at least according to an ISO 26262:2018 ASIL-B functional safety standard.

17 . The method of claim 16 , wherein the first application is implemented redundantly.

18 . The method of claim 17 , wherein the first application is executed on a same one or more processing units of the vehicle as the map-based application.

19 . The method of claim 18 , wherein the one or more processing units of the vehicle comprise an electronic control unit (ECU) of the vehicle.

20 . The method of claim 1 , wherein the security data is a hash associated with the object data of the at least one object and is calculated based on both the object data of the at least one object and metadata for the map tile containing the object data of the at least one object.