JP5783013B2 - In-vehicle communication system - Google Patents

Description

  The present invention relates to a technique for rewriting a program stored in an electronic control device installed inside a vehicle.

  2. Description of the Related Art Conventionally, in vehicles, various vehicle components such as engines and brakes are controlled through electronic parts as electronic control advances, and the number of electronic control units (ECUs) connected to these electronic parts is also increasing. It is in. Further, the ECU constructs a network (in-vehicle communication system) in order to enable a cooperative operation and information sharing between the ECUs.

  A vehicle equipped with such an in-vehicle communication system is provided with a connector for communicating with the ECU from the outside of the vehicle. By connecting an external device to such a connector, the external device and the ECU can communicate with each other, and rewriting processing (reprogramming) of a program stored in the ECU can be performed.

  However, in such a configuration, there is a possibility that an unauthorized act using an unauthorized external device (for example, unauthorized rewriting of an ECU program) may be performed. Therefore, a configuration has been proposed in which it is determined whether or not an external device connected to the connector is a regular one.

  For example, in the in-vehicle communication system described in Patent Document 1, a master ECU (relay device) that performs authentication of a tester (external device) connected to a connector is installed. The master ECU receives the identification code from the tester, determines whether or not the received identification code matches the identification code stored in the master ECU, and permits the flash memory of the ECU to be rewritten.

JP 2002-157165 A

  However, in the configuration described in Patent Document 1 described above, if direct communication is performed from an unauthorized external device to the electronic control device without a relay device, the program stored in the electronic control device is illegally rewritten. There is a possibility.

  The present invention has been made in view of these problems, and provides a technique capable of prohibiting rewriting of a program even when communication is performed from an external device to an electronic control device without using a relay device. The purpose is that.

This onset Ming-vehicle communication system comprises an electronic control device installed inside the vehicle, and the installed relay apparatus to the communication path for connecting the external device and the electronic control unit. In addition, an external device here is an apparatus for rewriting the program memorize | stored in the electronic control apparatus from the exterior of a vehicle.

  In the relay device, the relay-side storage means stores the verification code of the electronic control device, and the transmission means transmits a program rewrite request to the electronic control device in accordance with a request from the external device.

  On the other hand, in the electronic control device, the control-side storage means stores the verification code. Further, when the determination unit receives a rewrite request, it determines whether or not the transmission source is a relay device by using a verification code, and when it determines that the transmission source is a relay device, it rewrites the program. If it is permitted and it is determined that it is not a relay device, rewriting of the program is prohibited.

  According to such an in-vehicle communication system, the electronic control device can determine whether or not the transmission source of the program rewrite request is an authorized relay device based on the verification code. For this reason, even when a rewrite request for a program is directly transmitted from an external device to the electronic control unit without a relay device, rewriting of the program can be prohibited. Accordingly, it is possible to suppress the trick of connecting the external device and the electronic control device while avoiding the relay device.

By the way, the security can be improved by updating the verification code at an appropriate timing, rather than using the same verification code for a long time. Therefore, in the relay device, the relay-side update unit updates the verification code stored in the relay-side storage unit, and in the electronic control device, the control-side update unit stores the verification code stored in the control-side storage unit as the relay device. but it may also be configured to update at the same time. According to such an in-vehicle communication system, the verification code can be updated to improve security.

Specifically, the relay side update unit updates the verification code by performing a predetermined calculation using the verification code stored in the relay side storage unit, and the control side update unit stores the control side storage unit. by performing the same operation as the relay device using a verification code, but it may also be configured to update the verification code. According to such an in-vehicle communication system, since delivery of the updated verification code is not required, it is possible to easily maintain the secret state of the verification code.

The relay side update means and the control-side update means is a timing when rewriting is completed programs stored in the electronic control unit, but it may also be configured to update the verification code. According to such an in-vehicle communication system, since a different verification code is used for each rewriting of the program, the security can be enhanced.

By the way, it is preferable not to deliver the verification code itself when determining whether or not the transmission source of the program rewrite request is an authorized relay device based on the verification code. Therefore, the determination unit transmits a code corresponding value uniquely corresponding to the verification code to the relay device, and determines whether or not the code corresponding value uniquely corresponds to the verification code stored in the control-side storage unit. but it may also be so. According to such an in-vehicle communication system, since it is not necessary to pass the verification code itself, the security can be enhanced.

Further, when the in-vehicle communication system includes a plurality of electronic control devices, the verification code stored in the control-side storage means is unique to each electronic control device, and the relay-side storage means is provided for each of the plurality of electronic control devices. but it may also be configured to store the verification code. According to such an in-vehicle communication system, it is possible to increase the security as compared with the case where the verification code is common to a plurality of electronic control devices.

It is a block diagram which shows the structure of the vehicle-mounted communication system of embodiment. It is a flowchart which shows the process performed by GW-ECU and other ECU.

Embodiments to which the present invention is applied will be described below with reference to the drawings.
[1. overall structure]
FIG. 1 is a block diagram illustrating a configuration of an in-vehicle communication system 1 according to the embodiment.

  The in-vehicle communication system 1 has a gateway ECU (hereinafter referred to as “GW-ECU”) 10 and various functions as a plurality of electronic control devices (hereinafter referred to as “ECU”) installed in each part inside the vehicle. A plurality of other ECUs 20, 20,. The GW-ECU 10 and the ECUs 20 are connected to a bus 30 that is a common communication line, and perform mutual communication via the bus 30 in accordance with a CAN (Controller Area Network) protocol.

  The GW-ECU 10 connects the data link connector (hereinafter referred to as “connector”) 40 for connecting the external tool 50 from the outside of the vehicle and the bus 30 (in other words, the external tool 50 and the ECU 20 to each other). (Communication path for connection) 31. The external tool 50 is a device having a function of performing a rewriting process (reprogramming) of a program stored in the ECU 20 installed in the vehicle while being connected to the connector 40. That is, the external tool 50 is not directly connected to the ECU 20, but is connected via the GW-ECU 10, and the GW-ECU 10 functions as a relay device that relays communication between the external tool 50 and the ECU 20.

  The GW-ECU 10 includes a CPU 11 and a flash memory 12 that is a nonvolatile memory capable of electrically rewriting stored contents. The flash memory 12 stores a software program executed by the CPU 11. The flash memory 12 stores a verification code for each ECU 20. Here, the verification code is a secret for allowing the ECU 20 to confirm that the transmission source of the rewrite request is the legitimate GW-ECU 10 when the GW-ECU 10 transmits a program rewrite request to the ECU 20. Information. In the present embodiment, the collation code is common to the plurality of ECUs 20, and the GW-ECU 10 stores one collation code.

  Similarly, each ECU 20 includes a CPU 21 and a flash memory 22, and the flash memory 22 stores a software program executed by the CPU 21 and the same verification code as the GW-ECU 10 and the other ECUs 20. .

[2. processing]
FIG. 2 is a flowchart showing a process executed by the GW-ECU 10 and the other ECU 20 when a program rewrite process is requested from the external tool 50 connected to the connector.

  When the CPU 11 of the GW-ECU 10 receives a program rewrite request from the external tool 50 (S101), the ECU 11 (hereinafter also referred to as “target ECU”) 20 that is the target of the rewrite request in accordance with the request from the external tool 50. A program rewrite request is transmitted (S102). In addition, between the external tool 50 and the GW-ECU 10, the GW-ECU 10 may authenticate the external tool 50 so that a rewrite request from an unauthorized external tool is not transmitted to the ECU 20 as in the past. it can.

  When receiving the rewrite request from the GW-ECU 10 (S201), the CPU 21 of the target ECU 20 performs a process for determining whether or not the transmission source of the rewrite request is the legitimate GW-ECU 10. Specifically, first, a random number is generated, and the generated random number is transmitted to the transmission source GW-ECU 10 (S202). Further, a predetermined calculation is performed on the generated random number using the verification code stored in the flash memory 22 (S203).

  On the other hand, when the CPU 11 of the GW-ECU 10 receives a random number from the target ECU 20 (S103), the CPU 11 of the GW-ECU 10 uses a verification code stored in the flash memory 12 for the received random number to perform a predetermined calculation (in the target ECU 20). The same calculation as that performed) is performed (S104). Then, the calculation result is transmitted to the target ECU 20 (S105).

  When the CPU 21 of the target ECU 20 receives the calculation result from the GW-ECU 10 (S204), the CPU 21 determines whether or not the received calculation result matches the calculation result performed by itself (checks the verification code) (S205). When it is determined that the calculation results do not match (when the rewrite request source is not the regular GW-ECU 10) (S205: NO), rewriting of the program stored in the flash memory 22 is prohibited (S206). ). Specifically, even if data for rewriting is transmitted, the rewriting is not performed. On the other hand, when it is determined that the calculation results match (when the transmission source of the rewrite request is the regular GW-ECU 10) (S205: YES), rewriting of the program stored in the flash memory 22 is permitted ( (S207), a rewrite start request is transmitted to the GW-ECU 10 (S208).

  When receiving the rewrite start request from the target ECU 20 (S106), the CPU 11 of the GW-ECU 10 transmits (transfers) the rewrite program received from the external tool 50 to the target ECU 20 (S107). That is, the external tool 50 is allowed to communicate with the target ECU 20 (program rewriting process).

  When receiving the rewrite program from the GW-ECU 10 (S209), the CPU 21 of the target ECU 20 executes a rewrite process for rewriting the program stored in the flash memory 22 using the received rewrite program (S210). When the rewriting process is completed, a rewriting completion notification is transmitted to the GW-ECU 10 (S211).

  When the CPU 11 of the GW-ECU 10 receives the rewriting completion notification from the target ECU 20 (S108), it transmits a verification code rewriting request for updating the verification code to all the ECUs 20 (S109). Further, the verification code stored in its own flash memory 12 is updated (S110). In this embodiment, the verification code is updated by counting up the verification code by a certain value.

  On the other hand, when each CPU 21 of the target ECU 20 and the other ECU 20 receives the verification code rewrite request from the GW-ECU 10 (S212), it updates the verification code stored in its own flash memory 22 (S213). Specifically, like the GW-ECU 10, the verification code is updated by counting up the verification code by a certain value. Thereby, the collation codes of the GW-ECU 10 and all the ECUs 20 are updated to the same value.

[3. effect]
As described above, according to the in-vehicle communication system 1 of the present embodiment, the ECU 20 that is the target of program rewriting uses the verification code to determine whether or not the transmission source of the program rewrite request is the regular GW-ECU 10. It can be determined based on (S201 to S205). For this reason, even when a program rewrite request is directly transmitted from the external tool 50 to the ECU 20 without going through the GW-ECU 10, the rewriting of the program can be prohibited (S205: NO, S206). Therefore, it is possible to suppress the trick of connecting the external tool 50 and the ECU 20 while avoiding the GW-ECU 10 (connecting the external tool 50 directly to the bus 30).

  Specifically, the ECU 20 causes the GW-ECU 10 to transmit a code corresponding value (a calculation result using a random number and a verification code) uniquely corresponding to the verification code (S202), and the code corresponding value and its own calculation result. Are determined to match (S203 to S205). For this reason, it is not necessary to pass the verification code itself, and security can be enhanced.

  In addition, since the GW-ECU 10 and the ECU 20 update the collation code at the same timing (S109, S110, S212, S213), the security can be improved as compared with the case where the same collation code is used for a long period of time. Can do. In particular, since the verification code is updated when the rewriting of the program stored in the ECU 20 is completed, a different verification code is used for each rewriting of the program, and the security can be improved.

  In addition, since the GW-ECU 10 and the ECU 20 update the verification code by performing a predetermined calculation using the verification code (a calculation that counts up the verification code by a certain value), the updated verification code is delivered. Is not necessary, and it is possible to easily maintain the secret state of the verification code.

  The GW-ECU 10 corresponds to an example of a relay device, the flash memory 12 corresponds to an example of a relay-side storage unit, S102 corresponds to an example of a process as a transmission unit, and S110 is a process as a relay-side update unit. It corresponds to an example. The ECU 20 corresponds to an example of an electronic control device, the flash memory 22 corresponds to an example of a control-side storage unit, S202 to S205 correspond to an example of processing as a determination unit, and S213 serves as a control-side update unit. This corresponds to an example of processing. The external tool 50 corresponds to an example of an external device.

[4. Other Embodiments]
As mentioned above, although embodiment of this invention was described, it cannot be overemphasized that this invention can take a various form, without being limited to the said embodiment.

  (1) Although the collation code is common to the plurality of ECUs 20 and the GW-ECU 10 stores one collation code in the above embodiment, the present invention is not limited to this. For example, the verification code may be unique to each ECU 20, and the GW-ECU 10 may store the verification code for each ECU 20. In this way, it is possible to increase the security as compared with the case where the collation code is common to the plurality of ECUs 20.

  (2) In the above embodiment, the configuration in which the verification code is updated at the timing when the rewriting of the program stored in the ECU 20 is completed is illustrated, but the timing at which the verification code is updated is not limited to this. For example, it may be a timing at which a specific signal is received, such as a timing at which a signal indicating that the ignition switch is turned on is received.

  (3) In the above embodiment, the GW-ECU 10 and the ECU 20 exemplify a configuration in which the collation code is updated by performing the same computation using the collation code (calculation that counts up the collation code by a certain value). However, the updating method is not limited to this. For example, the verification code may be set (calculated) using a value indicating the time at a specific timing (when rewriting of the program is completed, when the ignition switch is turned on, etc.).

  (4) In the above embodiment, the GW-ECU 10 has exemplified the configuration in which the same verification code as the verification code stored in the ECU 20 is stored, but it is not always necessary to store the same information. For example, information uniquely corresponding to the verification code stored in the ECU 20 may be stored.

  DESCRIPTION OF SYMBOLS 1 ... In-vehicle communication system, 10 ... GW-ECU, 11, 21 ... CPU, 12, 22 ... Flash memory, 20 ... ECU, 30 ... Bus, 40 ... Connector, 50 ... External tool

Claims (5)

An electronic control unit installed inside the vehicle;
A relay device installed in a communication path for connecting the external device and the electronic control device for rewriting the program stored in the electronic control device from the outside of the vehicle;
With
The relay device is
Relay-side storage means for storing a verification code of the electronic control device;
In accordance with a request from the external device, a transmission means for transmitting a program rewrite request to the electronic control device,
The electronic control device
Control-side storage means for storing the verification code;
When the rewrite request is received, it is determined using the verification code whether the transmission source is the relay device, and when it is determined that the transmission source is the relay device, rewriting of the program is permitted. Determining means for prohibiting rewriting of the program when it is determined that the relay apparatus is not the relay device;
A plurality of the electronic control devices,
The verification code stored by the control-side storage means is unique to each electronic control device,
The in-vehicle communication system, wherein the relay-side storage unit stores the verification code for each of the plurality of electronic control devices . The in-vehicle communication system according to claim 1,
The relay device further includes a relay-side update unit that updates the verification code stored in the relay-side storage unit,
The on-board communication system, wherein the electronic control device further includes control-side update means for updating the verification code stored in the control-side storage means at the same timing as the relay device. The in-vehicle communication system according to claim 2,
The relay-side update unit updates the verification code by performing a predetermined calculation using the verification code stored in the relay-side storage unit,
The control-side update unit updates the verification code by performing the same calculation as that of the relay device using the verification code stored in the control-side storage unit. The in-vehicle communication system according to claim 2 or claim 3,
The in-vehicle communication system, wherein the relay side update unit and the control side update unit update the verification code at a timing when rewriting of a program stored in the electronic control device is completed. The vehicle-mounted communication system according to any one of claims 1 to 4,
The determination unit causes the relay device to transmit a code corresponding value uniquely corresponding to the verification code, and whether or not the code corresponding value uniquely corresponds to the verification code stored in the control-side storage unit. An in-vehicle communication system characterized by determining whether or not.

Images