JP2013029085A - Data writing device, data writing method, and program for data writing - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a data writing device capable of preventing fraudulent use of a program and data written in an electronic control unit.SOLUTION: This data writing device 10 manages and controls downloading of control data for a client device 13, and writes the data downloaded to the client device 13 via a public communication line 12 to a nonvolatile memory of an electronic control unit 14 without leaving the data in the client device 13.

Description

  The present invention relates to a data writing device, a data writing method, and a data writing used when writing data to a recording medium included in a work machine such as an agricultural machine or a construction machine, or an electronic control unit for a vehicle such as a passenger car, a truck, or a bus. Is related to the program for

  Conventionally, an engine control device in which a plurality of electronic control units (ECUs) for controlling an engine of a work machine such as an agricultural machine or a construction machine are connected via a communication line so that data can be communicated with each other. Is known (see, for example, Patent Document 1).

  In this engine control apparatus, a plurality of electronic control units are linked via a communication line. Coordinated control between electronic control units is facilitated by multiplexing and speeding up communication between electronic control units in the engine control apparatus. Further, a combination of exchanging data between electronic control units is realized by connecting a plurality of electronic control units to one communication line.

Each of the electronic control units includes a nonvolatile storage unit such as a flash memory or an E ² P-ROM that does not destroy data even when the power is turned off. For example, the first electronic control unit stores fuel supply amount setting data in its storage means. This fuel supply amount setting data is data for calculating the target fuel supply amount of the engine fuel supply device of the working machine. The first electronic control unit controls the target fuel supply amount of the engine of the work implement based on the fuel supply amount setting data.

  The second electronic control unit stores engine control command setting data having control characteristics corresponding to the work characteristics of the work implement. The engine control command setting data is data for calculating the command engine speed and the command engine torque of the work implement. The second electronic control unit controls the command engine speed and the command engine torque of the engine of the work implement based on the engine control command setting data.

In order to write a program or data to the flash memory or E ² P-ROM which is the storage means of the electronic control unit as described above, an external flash writer or E ² P-ROM writer is connected to the electronic control unit. It will be necessary. The flash writer or the like generally has a function of acquiring the program or data from a personal computer storing the program or data and writing the acquired program or the like in the flash memory of the electronic control unit.

  In the storage means of the electronic control unit, a predetermined program and data are usually written at a stage before the work machine equipped with the electronic control unit is delivered to the user. Conventionally, an electronic control unit supplied from a supplier of the electronic control unit is attached to each work machine, and a program or data corresponding to each work machine is stored using a flash writer or the like as described above. The process of writing to is performed.

If the program written in the storage means of the electronic control unit needs to be upgraded, corrected for bugs, or adjusted to make adjustments if a malfunction occurs during operation, the flash writer Etc., a new program is written. Programs and data are stored in a flash memory or E ² P-ROM which is a non-volatile memory so that the contents can be updated at any time for version upgrade or bug correction.

  By the way, when an abnormality occurs in the electronic control unit due to, for example, a failure after the work machine is once on the market, it is necessary to replace the electronic control unit with a new one. As a matter of course, there are various types of programs and data written in the storage means of the electronic control unit depending on the type, performance, application, etc. of the work machine on which the electronic control unit is mounted. It goes without saying that the same program and data as those for the electronic control unit before replacement must be written into the new electronic control unit after replacement.

  In many cases, such a program or data writing process is performed by a dealer or a dealer by bringing a work machine by a user. Specifically, a flash writer as described above is connected to an electronic control unit to which a program or data is to be written, and writing processing by an operator using the flash writer is performed.

JP 2009-156140 A (released on July 16, 2009)

However, when the electronic control unit is written in a dealer or a dealer, it is necessary to verify whether or not the flash writer or E ² P-ROM writer described above is used by an authorized user. In the past, it was difficult to say that it was fully considered.

  In particular, for unauthorized use such as flash writer due to theft, spoofing, replacement balls, etc., stronger authentication technology is required than general personal authentication technology using a password or the like.

  Further, dealers and dealers are required to receive programs and data from suppliers of electronic control units when performing write processing using a flash writer or the like. At this time, the program supplied from the supplier of the electronic control unit needs to be temporarily stored in the personal computer. This is because the transfer of the program or the like to the flash writer is performed using a personal computer as described above.

  In this case, there is a possibility that a program or the like once stored in the personal computer is illegally extracted and transferred to a third party. Further, programs, data, and the like stored in a personal computer remain in the personal computer as long as they are not intentionally deleted. Such a program leads to innumerable duplicates.

  In particular, when a program or data is supplied from an electronic control unit supplier to a dealer or a dealer via an open network called the Internet, the security of the program is very important. For this reason, encryption technology is usually used for communication between the supplier and each dealer. Usually, a supplier encrypts a program or the like and transmits the program, and each dealer uses the program or the like by decrypting the transmitted program or the like. However, if a personal computer of each dealer can be used by a third party other than a legitimate user, the program may be illegally copied. That is, since the transmitted program is decrypted in the personal computer of each dealer, the program stored in the personal computer may be stolen by a third party.

  Thus, in the past, if a program or data supplied from a supplier of an electronic control unit was taken out by some unauthorized means, or if an unexpected situation such as theft or loss occurred, the program or the data was illegally There was a possibility of being used.

  As a result, there is a possibility that a malicious third party abuses this program or the like to produce, for example, an unauthorized electronic control unit.

  The present invention has been made in view of such problems, and provides a data writing apparatus, a data writing method, and a data writing program capable of preventing unauthorized use of programs and data written in an electronic control unit. Objective.

  In order to achieve the above object, a data writing apparatus according to the present invention is a data writing apparatus for writing data used for engine control by the electronic control unit into a nonvolatile memory of the electronic control unit that controls the engine. The client device that downloads the data via the communication line manages and controls the download of the data, and is downloaded to the client device via the communication line under the management and control of the download. Data is written into the non-volatile memory of the electronic control unit without remaining in the client device.

  The above data writing device is a data used when the electronic control unit controls the engine in a non-volatile memory of a work machine such as an agricultural machine or a construction machine, or an electronic control unit for a vehicle such as a passenger car, a truck, or a bus. Is a data writing device for writing.

  In the above data writing device, data to be written to the nonvolatile memory of the electronic control unit is acquired from the client device that downloads the data via the communication line, and the data is written to the nonvolatile memory of the electronic control unit. .

  The data writing device manages and controls downloading by a client device that downloads data to be written to the nonvolatile memory of the electronic control unit. For example, the data writing device causes the client device to (A) divide the data into a plurality of parts and request the server device that transmits the data via the communication line so that each divided data can be downloaded intermittently. (B) After the data download, the data stored in the client device is temporarily deleted. (C) The data transmitted from the server device is output to the data writing device without temporarily storing it. Management and control are performed.

  The client device outputs the data downloaded to itself to the data writing device without remaining in the client device. At this time, the client device may temporarily store the downloaded data in the client device, and output the data to the data writing device side when it is stored to some extent, or download the data as it is to the data writing device side. It may be output. In short, it is only necessary that the data downloaded to the client device does not remain.

  For this reason, it becomes difficult for a third party to read data from the client device, and unauthorized use by a third party can be prevented.

  Therefore, for example, it is possible to prevent a third party from misusing data supplied from the server device and creating an unauthorized electronic control unit.

  Instructing means for instructing the client apparatus to manage and control the download of the data, and the data downloaded to the client apparatus via the communication line under the management and control of the downloading instruction means It is preferable to include an acquisition unit that acquires the data and an output unit that outputs the data acquired by the acquisition unit to the electronic control unit.

  In this case, the instruction means instructs the client device to manage and control data download. The acquisition unit acquires data downloaded to the client device via the communication line under the management and control by the download instruction unit. The output means outputs the data acquired by the acquisition means to the electronic control unit.

  A storage unit that stores the data acquired by the acquisition unit; and an erasing unit that deletes the data stored in the storage unit. The output unit is stored in the storage unit. In addition to outputting the data to the electronic control unit, the erasure means stores the memory when a predetermined erasure condition is satisfied that it should erase the data stored in the memory. It is preferable to delete the data stored in the section.

  In this case, the output means outputs the data stored in the storage unit to the electronic control unit. The erasing unit erases data stored in the storage unit when the erasing condition is satisfied.

  For this reason, after the data is output by the output means, the data does not remain in the storage unit.

  Therefore, even if the data writing device is damaged such as theft after the data is stored in the storage unit, it is difficult for a third party to illegally read the data from the storage unit.

  The erasing unit may erase the data stored in the storage unit by using, as the erasing condition, that a predetermined time has elapsed since the acquisition of the data by the obtaining unit has started or ended. preferable.

  In this case, the data stored in the storage unit is surely erased after a predetermined time has elapsed from the start or end of data acquisition.

  Therefore, even if the data writing device is damaged such as theft after the data is stored in the storage unit, it is difficult for a third party to illegally read the data from the storage unit.

  A data writing method according to the present invention is a data writing method for writing data used for engine control by an electronic control unit to a nonvolatile memory of an electronic control unit that controls the engine. Manages and controls the download of the data for the client device to be downloaded, and the data downloaded to the client device via the communication line remains in the client device under the download management and control. Without writing to the non-volatile memory of the electronic control unit.

  The above data writing method uses data used when an electronic control unit controls an engine in a nonvolatile memory of a work machine such as an agricultural machine or a construction machine, or an electronic control unit for a vehicle such as a passenger car, a truck, or a bus. This is a data writing method for writing.

  In the above data writing method, data to be written to the nonvolatile memory of the electronic control unit is acquired from the client device that downloads the data via the communication line, and the data is written to the nonvolatile memory of the electronic control unit. .

  The above data writing method manages and controls download by a client device that downloads data to be written to the nonvolatile memory of the electronic control unit. For example, the data writing device causes the client device to (A) divide the data into a plurality of parts and request the server device that transmits the data via the communication line so that each divided data can be downloaded intermittently. (B) After the data download, the data stored in the client device is temporarily deleted. (C) The data transmitted from the server device is output to the data writing device without temporarily storing it. Management and control are performed.

  The client device outputs the data downloaded to itself to the data writing device without remaining in the client device. At this time, the client device may temporarily store the downloaded data in the client device, and output the data to the data writing device side when it is stored to some extent, or download the data as it is to the data writing device side. It may be output. In short, it is only necessary that the data downloaded to the client device does not remain.

  For this reason, it becomes difficult for a third party to read data from the client device, and unauthorized use by a third party can be prevented.

  Therefore, for example, it is possible to prevent a third party from misusing data supplied from the server device and creating an unauthorized electronic control unit.

  The data writing device may be realized by a computer. In this case, a data writing program for causing the data writing device to be realized by a computer by causing the computer to operate as the respective means, and A computer-readable recording medium on which is recorded also falls within the scope of the present invention.

  As described above, the data writing device of the present invention is a data writing device that writes data used for engine control by the electronic control unit to the nonvolatile memory of the electronic control unit that controls the engine. In addition to managing and controlling the download of the data for the client device that downloads the data, the data downloaded to the client device via the communication line is managed and controlled under the download management and control. The data is written in the non-volatile memory of the electronic control unit without remaining in the client device.

  Therefore, there is an effect that it is possible to prevent unauthorized use of programs and data written in the electronic control unit.

It is a block diagram which shows the connection relation of the data writer which concerns on one Embodiment of this invention, a server apparatus, a client apparatus, and an electronic control unit. It is a block diagram which shows the structure of the memory writer apparatus of said data writing apparatus. It is a block diagram which shows the structure of the dongle apparatus of said data writing apparatus. It is a block diagram which shows the structure of said electronic control unit. It is a block diagram which shows the structure of said server apparatus. It is a block diagram which shows the structure of said client apparatus.

  An embodiment of the present invention will be described below with reference to FIGS.

  A data writing apparatus according to an embodiment of the present invention prevents a program or the like from being acquired by a third party and illegally used when writing the program or data into a nonvolatile memory included in the electronic control unit. Is.

  In a working machine such as an agricultural machine or a construction machine, various engine controls such as fuel injection control, ignition control, and exhaust purification control of the engine are generally performed by an electronic control unit including a microcomputer. . Various programs and data executed by the microcomputer are set in this electronic control unit, and optimization of each program and data is performed so that optimum engine control is realized for each work machine and its engine. Has been made. Such a program and data (hereinafter sometimes referred to as “control data”) are stored in a non-volatile memory incorporated in the electronic control unit.

  For example, the control data is supplied from a supplier of the electronic control unit to a dealer of the working machine or a store. A dealer or the like connects a client device such as a personal computer owned by the dealer to a public communication line such as the Internet. This client device can communicate with a server device held by a supplier of an electronic control unit connected to the public communication line by connecting to the public communication line. The control data is downloaded from the server device to the client device through communication between the client device and the server device.

  Here, the data writing device manages and controls the download of control data from the server device to the client device as described above. Specifically, the data writing device is configured so that when the control data is downloaded from the server device to the client device, the control data is not extracted from the client device so that unauthorized use by a third party is not caused. Manages and controls downloads by.

  The data writing device acquires control data downloaded from the server device from the client device. This acquisition is realized by connection between the data writing device and the client device. When the writing process of the electronic control unit is performed, the data writing device connects to the client device to which the control data has been downloaded, and acquires the control data from the client device.

  After obtaining the control data, the data writing device leaves the client device and this time connects to the electronic control unit. The data writing device executes a process of writing the control data acquired from the client device to the nonvolatile memory of the electronic control unit by connecting to the electronic control unit.

  Here, the data writing device temporarily holds the control data in its own storage memory from when the control data is acquired from the client device to when the control data is written to the electronic control unit. It will be. For this reason, the data writing device also has high tamper resistance that makes it difficult to illegally read control data held in the storage memory during this period.

  As described above, the data writing device can make it difficult for a third party to illegally use the control data supplied from the supplier of the electronic control unit, and can prevent the production of the unauthorized electronic control unit. .

  The data writing device is not limited to the one for performing the writing process of the engine control electronic control unit of a work machine such as an agricultural machine or a construction machine, but is an engine of a vehicle such as a passenger car, a truck, or a bus. You may perform the write-in process of the electronic control unit for control. The use of the electronic control unit is not limited to the engine control of the work machine or the vehicle, but may be an electronic control unit for security, air conditioning control, or brake control for preventing theft. . In any vehicle and application, the same effect can be obtained. Hereinafter, in an embodiment of the present invention, a data writing apparatus that executes a control data writing process on an electronic control unit for engine control of a work machine will be described as an example.

(overall structure)
The configuration of the data writing device will be described below with reference to the drawings. FIG. 1 is a block diagram showing a connection relationship among a data writing device, a server device, a client device, and an electronic control unit according to an embodiment of the present invention.

  As shown in FIG. 1, the server device 11 is owned and managed by the supplier of the electronic control unit 14. The server device 11 is connected to a public communication line 12 and can communicate with each of the client devices 13 via the public communication line 12.

  The server device 11 stores control data to be written in the electronic control unit 14 in advance. There are various types of control data depending on the type, performance, application, etc. of the work machine on which the electronic control unit 14 is mounted, and the server device 11 has all types of control data. Can be stored and supplied.

  The public communication line 12 only needs to be capable of constructing a bidirectional digital line environment. For example, the Internet, broadband ISDN (Integrated Services Digital Network) telephone line, urban CATV network, general public line, wireless line, Ethernet (Registered trademark).

  The client device 13 is owned and managed by a dealer or a store that performs data writing processing of the electronic control unit 14. The client device 13 is connected to the public communication line 12 when, for example, a work machine on which the electronic control unit 14 is mounted is brought in and it becomes necessary to write control data to the electronic control unit 14.

  The client device 13 can communicate with the server device 11 by connecting to the public communication line 12 and downloads control data from the server device 11. The download of control data by the client device 13 is managed and controlled by the data writing device 10. For this reason, when the client device 13 downloads control data, the data writing device 10 is connected to the client device 13. When connected to the client device 13, the data writing device 10 outputs a download processing program used when the client device 13 downloads control data to the client device 13.

  The client device 13 downloads the control data stored in the server device 11 using this download processing program.

  The data writing device 10 includes a dongle device 20 and a memory writer device 30. The dongle device 20 enables communication between the client device 13 and the memory writer device 30 only when the memory writer device 30 is connected to the client device 13 via itself.

  The memory writer device 30 stores in advance a download processing program used when the client device 13 downloads control data. When communication with the client device 13 becomes possible, the memory writer device 30 outputs the download processing program to the client device 13. The memory writer device 30 can manage and control the download of control data by the client device 13 by causing the client device 13 to execute this download processing program.

  In addition, the memory writer device 30 acquires the control data downloaded by the client device 13 from the client device 13 and executes a process of writing the control data to the electronic control unit 14.

  First, the memory writer device 30 is connected to the client device 13 via the dongle device 20 when acquiring control data from the client device 13.

  Here, the electronic control unit 14 is connected to other electronic control units mounted on one work machine via a communication standard such as CAN (Controller Area Network). The plurality of electronic control units including the electronic control unit 14 mutually transmit / receive data indicating that each is normal, data including information related to control such as vehicle speed and engine speed, and the like.

  The memory writer device 30 is connected to an external input terminal such as CAN described above when writing control data to the electronic control unit 14.

  The electronic control unit 14 controls the engine by adjusting the throttle opening, the fuel injection amount, etc. of the engine of the work implement using the control data stored in the nonvolatile memory built in the electronic control unit 14. is there.

  The electronic control unit 14 is connected to the memory writer device 30 of the data writing device 10 via the CAN to which the electronic control unit 14 is connected, and control data is written from the memory writer device 30. The control data is stored in a nonvolatile memory built in the electronic control unit 14.

(Data writing device 10)
Next, the data writing device 10 will be described.

  As described above, the data writing device 10 includes the dongle device 20 and the memory writer device 30.

(Dongle device 20)
FIG. 3 shows the configuration of the dongle device 20. As shown in FIG. 3, the dongle device 20 includes an authentication information storage unit 21, a connection control unit 22, a client device side port 23, and a memory writer device side port 24.

  The client device side port 23 is connected to a USB (Universal Serial Bus) input / output port 139 of the client device 13. The connection between the client apparatus side port 23 and the client apparatus 13 may be another communication port of the client apparatus 13 or a slot such as a PCMCIA or SD memory card. Furthermore, a method such as a wireless LAN, Bluetooth (registered trademark), or infrared interface (IrDA) can be employed.

  The memory writer device side port 24 is connected to the dongle device side input / output port 301 of the memory writer device 30.

  The authentication information storage unit 21 stores authentication information in advance. It is necessary to be able to determine whether the authentication information matches the unique identification code of the client device 13 and to prevent tampering and spoofing. For example, the authentication information can use an identification code unique to the dongle device 20 and a password corresponding to the identification code.

  Further, the authentication information storage unit 21 outputs the authentication information to the connection control unit 22.

  The connection control unit 22 controls the open / closed state of each of the client device side port 23 and the memory writer device side port 24. Specifically, the connection control unit 22 can switch the dongle device 20 and the client device 13 into a connected state by switching the open / closed state of the client device side port 23. In addition, the connection control unit 22 can switch the dongle device 20 and the memory writer device 30 into a connected state by switching the open / close state of the memory writer device side port 24. That is, the connection control unit 22 can place the client device 13 and the memory writer device 30 in a connected state.

  Further, the connection control unit 22 acquires the authentication information from the authentication information storage unit 21, and outputs the authentication information to the client device 13 via the client device side port 23 and the input / output port 139 of the client device 13. By doing so, it is proved that the dongle device 20 has a legitimacy to connect to the client device 13.

  When it is proved that the dongle device 20 is connected to the client device 13, the connection control unit 22 opens each of the client device side port 23 and the memory writer device side port 24. As a result, the memory writer device 30 is connected to the client device 13 via the dongle device 20.

(Memory writer device 30)
FIG. 2 shows the configuration of the memory writer device 30. As shown in FIG. 2, the memory writer device 30 includes a dongle device side input / output port 301, an electronic control unit side input / output port 302, a download instruction unit (instruction unit) 303, and a data acquisition unit (acquisition unit). ) 304, a data output unit (output unit) 305, a data storage unit (storage unit) 306, a data erasing unit (erasing unit) 307, and a timer 308.

  The dongle device side input / output port 301 is connected to the memory writer device side port 24 of the dongle device 20, and the electronic control unit side input / output port 302 is connected to the external input terminal 141 of the CAN to which the electronic control unit 14 is connected. It is connected.

  The download instruction unit 303 instructs download of control data from the server apparatus 11 to the client apparatus 13. For example, the download instruction unit 303 gives the following instruction to the client device 13.

  (A) Requesting the server device 11 to divide the control data into a plurality of parts and to download each divided data intermittently.

  For example, the control data can be streamed as streaming data. The client device 13 may download such streaming data at predetermined time intervals according to an instruction from the download instruction unit 303.

  (B) After the control data is downloaded, the temporarily stored control data is deleted.

  For example, the client device 13 waits until the streaming data sent from the server device 11 is stored, and then outputs the stored data to the data writing device 10 side. The client device 13 erases the streaming data once stored when it is output to the data writing device 10 side.

  (C) To output the control data transmitted from the server device 11 to the data writing device 10 side without temporarily storing it.

  For example, unlike the above (B), the client device 13 may output the streaming data sent from the server device 11 as it is to the data writing device 10 side without storing it. In this case, the client device 13 downloads the streaming data and simultaneously outputs it to the data writing device 10 side. For this reason, the data output time to the data writing device 10 side can be shortened.

  The data acquisition unit 304 acquires the control data downloaded by the client device 13 and stores it in the data storage unit 306.

  The control data is encrypted when transmitted from the server device 11. The data acquisition unit 304 stores the control data in the data storage unit 306 as it is without being decrypted. For this reason, even if the memory writer device 30 is damaged such as theft after the control data is stored in the data storage unit 306, it is difficult for a third party to illegally read the control data from the data storage unit 306.

  Further, as described in (A) above, the control data may be divided into a plurality of portions and downloaded intermittently. In this case, even if the memory writer device 30 is damaged such as theft before the entire control data is downloaded, only a part of the control data is stored in the data storage unit 306. Therefore, control data is not illegally read from the data storage unit 306 by a third party.

  The data output unit 305 outputs the control data to the electronic control unit 14 after the control data is stored in the data storage unit 306 by the data acquisition unit 304. The control data is output to the electronic control unit 14 connected to the CAN via the electronic control unit side input / output port 302 and the CAN external input terminal 141.

  The data storage unit 306 can be appropriately selected from known storage devices such as a semiconductor memory such as a DRAM or an SRAM, for example.

  The data erasure unit 307 erases the control data stored in the data storage unit 306. The data erasure unit 307 may erase the control data in the data storage unit 306 after all of the control data stored in the data storage unit 306 is output to the electronic control unit 14 by the data output unit 305, for example. In addition, when the communication state between the memory writer device 30 and the electronic control unit 14 is interrupted for some reason, the data erasing unit 307 may erase the control data in the data storage unit 306 at that time. By doing so, control data does not remain in the data storage unit 306 for a long period of time, and unauthorized reading of control data from the data storage unit 306 can be prevented.

  The data erasure unit 307 may include a timer 308. In this case, the data erasing unit 307 measures, for example, using the timer 308 from the time point when the data acquisition unit 304 finishes storing the control data in the data storage unit 306, and forcibly stores the data after a predetermined time has elapsed. The control data in the unit 306 may be deleted. By doing so, the control data is surely erased from the data storage unit 306 after a predetermined time has elapsed, so that opportunities for illegal reading of the control data from the data storage unit 306 can be reduced.

  Of course, there may be a case where the output of control data by the data output unit 305 is continued when a predetermined time has passed. In this case, the data erasure unit 307 may erase the control data in the data storage unit 306 at the time when the output of the control data by the data output unit 305 is completed.

  The data erasure unit 307 may start measurement using the timer 308 from the time when the data acquisition unit 304 starts storing control data in the data storage unit 306.

  Furthermore, the data erasure unit 307 may erase the control data in the data storage unit 306 at the time when an abnormality occurs in the mounting state of the semiconductor memory or the like that is the data storage unit 306. For example, the semiconductor memory or the like in the data storage unit 306 is physically removed from the memory writer device 30 by a third party. The data erasure unit 307 may constantly monitor the mounting state of the data storage unit 306 and delete control data in the data storage unit 306 when an abnormality is detected.

(Electronic control unit)
FIG. 4 shows the configuration of the electronic control unit 14. As shown in FIG. 4, the electronic control unit 14 includes an input / output circuit 143, an engine control unit 144, a nonvolatile memory 145, and a data input unit 146.

  The input / output circuit 143 is connected to the CAN 142 and performs data communication with the external input terminal 141 and the other electronic control units 51 and 52.

  The data input unit 146 receives control data output from the memory writer device 30 of the data writing device 10 via the external input terminal 141, the CAN 142 and the input / output circuit 143. The data input unit 146 stores the control data in a nonvolatile memory.

  As described above, the control data is encrypted when transmitted from the server device 11. Then, the memory writer device 30 of the data writing device 10 outputs the control data to the electronic control unit 14 without decrypting the control data. Upon receiving the encrypted control data, the data input unit 146 decrypts the control data and stores it in the nonvolatile memory 145.

  Thus, the control data remains encrypted while being transmitted via the CAN 142. Even if a third party reads control data from the CAN 142, it is difficult to illegally use the control data.

The nonvolatile memory 145 has a nonvolatile feature that data is not destroyed even when the power is turned off. For example, a flash memory, a P-ROM, an EP-ROM, or an E ² P-ROM can be used as the nonvolatile memory 145.

  The engine control unit 144 uses the control data stored in the nonvolatile memory 145 to adjust the throttle opening, the fuel injection amount, and the like of the engine of the work implement, thereby executing engine control. The engine control unit 144 performs data communication with the other electronic control units 51 and 52 connected to the CAN 142 using the input / output circuit 143, for example, and executes the engine control described above.

(Server device 11)
FIG. 5 shows the configuration of the server device 11. As shown in FIG. 5, the server device 11 temporarily stores a CPU 111 that processes instructions of various programs, a ROM 112 that stores a control program of the server device 11, and intermediate results of operations performed by the CPU 111. A RAM 113 capable of high-speed writing / reading, a communication I / F device 114 for communicating with the outside, an input device 115 for inputting various instructions, and a control data DB 116 for storing various control data, It has an HDD 117 and a display device 118.

  The CPU 111 performs various processes according to a program stored in the ROM 112, a program stored in the HDD 117, or a program stored in the RAM 113. The CPU 111 temporarily stores data necessary for each process by the RAM 113. The CPU 111 controls the entire server device 11.

  The communication I / F device 114 processes input / output with the public communication line 12.

  The input device 115 includes, for example, a numeric keypad, a keyboard, and the like, and various instructions and data are input. The input device 115 stores the input instructions and data in the RAM 113 and the HDD 117.

  The control data DB 116 stores control data downloaded to the client device 13. The control data DB 116 stores a wide variety of types depending on differences in the type, performance, application, and the like of the work machine on which the electronic control unit 14 is mounted. As the control data DB 116, for example, a magnetic memory or the like can be used.

  The HDD 117 is composed of a magnetic memory or the like, and stores, for example, software that is a program group necessary for various processes by the CPU 111. Note that the programs constituting the software for various processes performed by the CPU 111 may be incorporated in advance in a computer with dedicated hardware, or may be provided in advance in the ROM 112 or the HDD 117.

  The display device 118 outputs various types of information (data), and includes a display device such as an LCD (liquid crystal display), a PDP (plasma display panel), or a CRT (cathode-ray tube) display.

(Client device 13)
FIG. 6 shows the configuration of the client device 13. As shown in FIG. 6, the client device 13 temporarily stores a CPU 131 that processes instructions of various programs, a ROM 132 that stores a control program of the client device 13, and intermediate results of operations performed by the CPU 131. The RAM 133 capable of writing / reading at high speed, the communication I / F device 134 for communicating with the outside, the input device 135 for inputting various instructions, and the control data downloaded from the server device 11 are temporarily stored. A temporary data storage device 136, an HDD 137, and a display device 138 are stored.

  The CPU 131 performs various processes according to a program stored in the ROM 132, a program stored in the HDD 137, or a program stored in the RAM 133. Further, the CPU 131 temporarily stores data necessary for each process by the RAM 133. The CPU 131 controls the entire client device 13.

  Here, as described above, for example, the client device 13 is given the following instruction from the download instruction unit 303 of the memory writer device 30 of the data writing device 10.

  (A) Requesting the server device 11 to divide the control data into a plurality of parts and to download each divided data intermittently.

  (B) After the control data is downloaded, the temporarily stored control data is deleted.

  (C) To output the control data transmitted from the server device 11 to the data writing device 10 side without temporarily storing it.

  In this case, for example, the data writing device 10 outputs a download processing program used when the client device 13 downloads control data to the client device 13. The client device 13 stores the download processing program in the RAM 133 or HDD 137.

  Then, the CPU 131 executes each instruction described above according to the download processing program stored in the RAM 133 or the HDD 137.

  The communication I / F device 134 processes input / output with the public communication line 12.

  The input device 135 includes, for example, a numeric keypad and a keyboard, and various instructions and data are input. The input device 135 stores each input instruction or data in the RAM 133 or the HDD 137.

  The temporary data storage device 136 temporarily stores control data downloaded from the client device 13. As the temporary data storage device 136, for example, a magnetic memory or the like can be used.

  The control data is encrypted when transmitted from the server device 11. The temporary data storage device 136 temporarily stores the control data as encrypted. For this reason, even if the client device 13 is damaged such as theft after the control data is stored in the temporary data storage device 136, it is difficult for a third party to illegally read the control data from the temporary data storage device 136. .

  Further, as described in (A) above, the control data may be divided into a plurality of portions and downloaded intermittently. In this case, even if the client device 13 is damaged such as theft before the download of the entire control data is completed, only a part of the control data is stored in the data temporary storage device 136. Therefore, control data is not illegally read from the temporary data storage device 136 by a third party.

  The HDD 137 is configured with a magnetic memory or the like, and stores, for example, software that is a program group necessary for various processes by the CPU 131. Note that programs constituting software for various processes performed by the CPU 131 may be incorporated in advance in a computer with dedicated hardware, or provided in advance in the ROM 132 or the HDD 137.

  The display device 138 outputs various types of information (data), and includes a display device such as an LCD (liquid crystal display), a PDP (plasma display panel), or a CRT (cathode-ray tube) display.

  As described above, according to the data writing device of one embodiment of the present invention, it is possible to make unauthorized use of control data supplied from a supplier of the electronic control unit difficult by a third party, The production of the control unit can be prevented beforehand.

  The present invention is not limited to the above-described embodiments, and various modifications can be made within the scope shown in the claims. That is, embodiments obtained by combining technical means appropriately modified within the scope of the claims are also included in the technical scope of the present invention.

  Finally, each block of the memory writer device 30 of the data writing device 10 may be configured by hardware logic, or may be realized by software using a CPU as follows.

  That is, the memory writer device 30 includes a storage device (such as a CPU that executes instructions of a control program that realizes each function, a ROM that stores the program, a RAM that expands the program, a memory that stores the program and various data, and the like. Recording medium). An object of the present invention is to provide a recording medium on which a program code (execution format program, intermediate code program, source program) of a control program of the memory writer device 30 which is software that realizes the above-described functions is recorded in a computer-readable manner. This can also be achieved by supplying the memory writer device 30 and reading and executing the program code recorded on the recording medium by the computer (or CPU or MPU).

Examples of the recording medium include a tape system such as a magnetic tape and a cassette tape, a magnetic disk such as a floppy (registered trademark) disk / hard disk, and a compact disk-ROM / MO / MD / digital video disk / compact disk-R. A disk system including an optical disk, a card system such as an IC card (including a memory card) / optical card, or a semiconductor memory system such as a mask ROM / E-PROM / E ² -PROM / flash ROM can be used.

  The memory writer device 30 may be configured to be connectable to a communication network, and the program code may be supplied via the communication network. The communication network is not particularly limited. For example, the Internet, intranet, extranet, LAN, ISDN, VAN, CATV communication network, virtual private network, telephone line network, mobile communication network, satellite communication. A net or the like is available. Further, the transmission medium constituting the communication network is not particularly limited. For example, even in the case of wired communication such as IEEE 1394, USB, power line carrier, cable TV line, telephone line, ADSL line, etc., infrared rays such as IrDA and remote control, Bluetooth, It can also be used with radio such as 802.11 radio, HDR, mobile phone network, satellite line, and terrestrial digital network. The present invention can also be realized in the form of a computer data signal embedded in a carrier wave in which the program code is embodied by electronic transmission.

  According to the data writing device of the present invention, it is possible to provide a data writing device, a data writing method, and a data writing program capable of preventing unauthorized use of programs and data written to the electronic control unit. It is useful when applied to working machines such as machines, passenger cars, vehicles such as trucks and buses, and the like.

DESCRIPTION OF SYMBOLS 10 Data writing apparatus 11 Server apparatus 12 Public communication line 13 Client apparatus 14 Electronic control unit 20 Dongle apparatus 30 Memory writer apparatus 301 Dongle apparatus side input / output port 302 Electronic control unit side input / output port 303 Download instruction | indication part (instruction means)
304 Data acquisition unit (acquisition means)
305 Data output unit (output means)
306 Data storage unit (storage unit)
307 Data erasure unit (erasure means)
308 timer

Claims (6)

A data writing device for writing data used for engine control by the electronic control unit into a nonvolatile memory of the electronic control unit for controlling the engine,
Managing and controlling the download of the data for the client device that downloads the data via a communication line,
Under the management and control of the download, the data downloaded to the client device via the communication line is written in a nonvolatile memory of the electronic control unit without remaining in the client device. Data writing device. Instruction means for instructing the client device to manage and control the downloading of the data;
Acquisition means for acquiring the data downloaded to the client device via the communication line under the management and control of the download instruction means;
The data writing apparatus according to claim 1, further comprising: an output unit that outputs the data acquired by the acquisition unit to the electronic control unit. A storage unit for storing the data acquired by the acquisition unit;
Erasing means for erasing the data stored in the storage unit,
The output means outputs the data stored in the storage unit to the electronic control unit,
The erasing unit erases the data stored in the storage unit when a predetermined erasing condition is satisfied that the data stored in the storage unit should be erased. The data writing device according to claim 2.   The erasing means erases the data stored in the storage unit by using, as the erasing condition, that a predetermined time has elapsed since the acquisition of the data by the obtaining means has started or ended. 4. The data writing apparatus according to claim 3, wherein A data writing method for writing data used for engine control by the electronic control unit to a nonvolatile memory of the electronic control unit for controlling the engine,
Managing and controlling the download of the data for the client device that downloads the data via a communication line,
Under the management and control of the download, the data downloaded to the client device via the communication line is written in a nonvolatile memory of the electronic control unit without remaining in the client device. To write data.   A data writing program for operating a computer as each means in the data writing apparatus according to claim 2.

Images