JP2016200948A - Program unauthorized rewriting prevention device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a program unauthorized rewriting prevention device capable of preventing unauthorized rewriting of program data.SOLUTION: When a user accesses a controller 1 from a tool 11 and performs program rewriting, a fraud frequency counting unit 13 counts the failure frequency Kx of the authentication (in this example, challenge response authentication) applied between the tool 11 and the controller 1. An unauthorized rewriting prevention unit 14, when recognizing that the failure frequency Kx is a defined value Kt or higher, executes processing of restricting or prohibiting the rewriting of program data Pd written in a first memory 3 of the controller 1.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a program illegal rewrite prevention apparatus for preventing illegal rewrite of program data written in a controller.

  2. Description of the Related Art Conventionally, a program illegal rewrite preventing apparatus for preventing illegal rewrite of program data written in a memory of a controller is well known (see Patent Document 1, etc.). As an example of rewriting the program data of the controller, there is a form using a tool, for example. In this case, for example, authentication is performed between the tool and the controller, and if this authentication is established, rewriting of program data by the tool is permitted.

JP 2014-88062 A

  By the way, it is assumed that a third party tries to rewrite the controller program data using an unauthorized tool. When the challenge response authentication is adopted as the authentication between the tool and the controller, for example, it is possible to illegally establish the authentication by repeatedly transmitting a pseudo random number to the other party. Therefore, a countermeasure against such illegal program data rewriting action is required.

  An object of the present invention is to provide an apparatus for preventing illegal program rewriting that can prevent unauthorized rewrite of program data.

  An apparatus for preventing illegal program rewriting that solves the above problems is configured to prevent the program written in the memory of the controller from being illegally rewritten, and based on a program rewrite request input from the tool, the controller and the tool In the repeated authentication, when the authentication is repeated, the fraud count counting unit that counts the number of times the authentication is fraud, and the number of times that the fraud is greater than a specified value And an unauthorized rewrite prevention unit that restricts or prohibits rewriting of the program in the memory.

  According to this configuration, the number of times of failure of authentication executed between the tool and the controller is counted, and when the number of failures is not less than a specified value, rewriting of the program written in the memory of the controller is limited or Perform the action to be prohibited. For this reason, if an unauthorized tool is used to perform authentication many times and attempts to establish the authentication illegally, this fraudulent activity is It can be terminated. Therefore, it is possible to make it difficult for the program data to be illegally rewritten.

  In the program illegal rewriting prevention device, the authentication is preferably challenge response authentication. According to this configuration, even if a third party performs an illegal act that creates a challenge response weakness through a tool, rewriting of the program is restricted or stopped when the number of authentication failures is equal to or greater than a specified value. . Therefore, even if challenge-response authentication is used for authentication between two parties, it is possible to make it difficult for the program to be rewritten illegally.

  In the program unauthorized rewrite prevention device, the controller includes a first memory to which the program is written, and a second memory to which the number of times the authentication has been invalidated is written, It is preferable to count the number of times that the authentication has been invalidated by sequentially writing the number of times to the second memory. According to this configuration, since the program writing location and the writing failure count writing location are separated from each other, each information can be easily managed.

  In the program unauthorized rewrite preventing apparatus, the unauthorized rewrite preventing unit is configured to notify the tool that communication is not possible when the number of times the authentication has become unauthorized exceeds a specified value, or It is preferable to execute a process that does not return a reply. According to this configuration, when the number of unsuccessful authentications exceeds the specified value, a tool by a third party is used by a simple process of notifying the tool that communication is impossible or not returning a reply to the tool. It is possible to take measures against illegal program rewriting.

  In the program unauthorized rewrite preventing apparatus, the memory of the controller is written with a product control program used during normal operation, and the unauthorized rewrite preventing unit is configured such that the number of times the authentication is unauthorized is a predetermined value or more. In this case, it is preferable that the product control program written in the memory is erased and a recovery operation is executed. According to this configuration, when the number of failed authentications exceeds the specified value, the controller performs a recovery operation. Therefore, after the recovery, rewrite the program with a tool owned by a third party (unauthorized tool). Can not do. Therefore, it is further advantageous for preventing illegal program rewriting.

  According to the present invention, illegal rewriting of program data can be made difficult to occur.

1 is a configuration diagram of a program unauthorized rewrite prevention device according to an embodiment. FIG. The sequence diagram of the authentication performed between a tool and a controller. The sequence diagram which shows an example of a process when it determines with authentication being fraudulent. Explanatory drawing which shows an example of the other treatment when it determines with authentication being fraudulent.

Hereinafter, an embodiment of the program illegal rewrite preventing apparatus will be described with reference to FIGS.
As shown in FIG. 1, the controller 1 is composed of an ECU (Electronic Control Unit), for example. The controller 1 includes a control unit 2 that controls the operation of the controller 1, a first memory 3 in which program data Pd that is executed when the controller 1 is operated, and a second that can be written and read only by the program data Pd. And a memory 4. The first memory 3 and the second memory 4 are preferably composed of, for example, a non-volatile memory, the first memory 3 is preferably composed of a program ROM (Read Only Memory), and the second memory 4 is preferably composed of a data flash.

  The first memory 3 is written and stored with a product control program 5 executed when the controller 1 is normally operated and a recovery program 6 executed when the controller 1 is recovered (initialized). Has been. The control unit 2 executes the product control program 5 to execute calculations in the controller 1 and data communication with other ECUs. The controller 2 initializes the controller 1 by executing the recovery program 6 when, for example, the requirements for starting the recovery are complete in the controller 1 or when an instruction such as a recovery request is received from the outside. .

  The controller 1 includes a program unauthorized rewrite prevention function (program unauthorized rewrite prevention device 10) that prevents unauthorized rewrite of the program data Pd. By the way, when the program data Pd of the controller 1 is rewritten, it is required that challenge response authentication be established with the controller 1. Challenge response authentication is authentication in which a challenge code, which is a pseudo-random number, is transmitted to the other party to be operated, a response code as a result of the operation is acquired, and the correctness is confirmed. The program illegal rewrite preventing apparatus 10 of this example is for the case where the program data Pd is illegally rewritten intentionally in response to an illegal program rewrite action from an external tool 11 connected to the controller 1, for example. It is provided as a countermeasure. The illegal program rewriting action assumed in this example is, for example, a continuous rewriting attack of program data Pd.

  The program unauthorized rewrite preventing apparatus 10 includes program rewrite control information 12 serving as software for realizing the program unauthorized rewrite preventing apparatus 10. The program rewriting control information 12 is written and saved in the first memory 3. The program rewrite control information 12 of this example counts the number of times the challenge response authentication is not established (the number of times of failure Kx), and when the number exceeds the specified value Kt, the program rewrite action is executed. It is software that realizes to do.

  The program unauthorized rewrite prevention device 10 includes an unauthorized number counting unit 13 that counts the number of times the challenge response authentication is not established. The fraud count unit 13 is functionally generated in the control unit 2 when the control unit 2 executes the program rewrite control information 12. The fraud count unit 13 performs authentication that is continuously repeated when authentication (in this example, challenge response authentication) is performed between the controller 1 and the tool 11 based on a program rewrite request input from the tool 11. The number of times of failure (number of failures Kx) is counted. The fraud count counting unit 13 writes the authentication failure count Kx in the second memory 4 and sequentially updates it every time the count increases.

  The program unauthorized rewrite preventing apparatus 10 includes an unauthorized rewrite preventing unit 14 that restricts or prohibits rewriting of the program data Pd when the number of times of failure Kx is equal to or greater than a specified value Kt. The unauthorized rewrite prevention unit 14 is functionally generated in the control unit 2 when the control unit 2 executes the program rewrite control information 12. As processing for restricting or prohibiting rewriting of the program data Pd, for example, notification of communication failure to the other party in challenge response authentication or communication itself is not performed (stopped halfway). In addition to this, there is a recovery operation of the controller 1.

Next, the operation of the program illegal rewrite prevention device 10 will be described with reference to FIGS.
As shown in FIG. 2, in step 101, the tool 11 outputs to the controller 1 a program rewriting request Sa that requests the controller 1 to execute program rewriting. The program rewriting request Sa is preferably an authentication information output request for requesting the controller 1 to transmit authentication information Sb necessary for challenge response authentication. In this case, the program rewriting request Sa is a request for causing the controller 1 to transmit, for example, an encryption key (common key) necessary for challenge response authentication and a random value (challenge code) that takes a different value every time authentication is performed. Preferably there is.

  In step 102, when receiving a program rewrite request (authentication information output request) Sa from the tool 11, the controller 1 transmits the authentication information Sb to the tool 11. The authentication information Sb is preferably information including an encryption key (common key) for challenge response authentication and a random value (challenge code) whose value is changed each time transmission is performed.

  In step 103, the tool 11 calculates a key value (response code) Sc that is a calculation result of challenge response authentication based on the authentication information Sb received from the controller 1. In the case of this example, the tool 11 performs an operation by passing the random number and the encryption key acquired from the controller 1 through an algorithm (function) registered in the tool 11.

In step 104, the tool 11 transmits the calculated key value (response code) Sc to the controller 1.
In step 105, when the controller 1 receives the key value (response code) Sc from the tool 11, the controller 1 performs authentication by comparing with the key value (response code) calculated in the same manner. If the controller 1 confirms that these key values Sc match, the controller 1 determines that challenge response authentication is established, and conversely if it does not match, does not establish challenge response authentication. At this time, when it is confirmed that the authentication (challenge response authentication) is not established, the fraud count counting unit 13 counts the number of times authentication is not established Kx by updating the counter of the second memory 4 to “1”, for example. .

  In step 106, the controller 1 notifies the tool 11 of the authentication result Sd of the key value Sc. That is, if challenge response authentication is established, the controller 1 outputs a notification Sd indicating that authentication has been established to the tool 11, and if challenge response authentication is not established, the controller 1 outputs a notification Sd indicating that authentication has not been established to the tool 11. .

  In step 107, the tool 11 confirms whether or not authentication has been established based on the key value authentication result Sd acquired from the controller 1. That is, if the notification Sd indicating that the authentication is established is received, it is determined that the challenge response authentication is established, and if the notification Sd indicating that the authentication is not established is received, it is determined that the challenge response authentication is not established.

  By the way, when a malicious third party tries to pass authentication (challenge response authentication) with the controller 1 through the tool (illegal tool) 11, the challenge response authentication is repeatedly executed by generating a pseudo random number each time. Is done. At this time, if the tool 11 is an unauthorized tool, the authentication is not established, so the count value of the number of times of failure Kx is incremented by “1”. When the unauthorized rewrite prevention unit 14 confirms that the non-establishment count Kx is equal to or greater than the specified value Kt, the unauthorized rewrite preventive unit 14 performs a measure against the unauthorized program rewrite.

  FIG. 3 illustrates an example of a measure against program illegal rewriting. As shown in the example (1) in the figure, when the unauthorized rewrite prevention unit 14 determines that the program rewriting action is unauthorized, it notifies the currently communicating tool 11 that communication is not possible. To do. As other operations, as shown in the example (2) in the figure, the unauthorized rewrite preventing unit 14 sends a reply itself to the tool 11 when it is determined that the program rewriting action is illegal. You may make it not implement (a response is not returned). Regardless of which measure is performed, the communication with the tool 11 is forcibly terminated midway, so that the program data Pd is not rewritten illegally.

  FIG. 4 illustrates another example of a measure for illegal program rewriting. As shown in the figure, the unauthorized rewrite preventing unit 14 erases the product control program 5 written in the first memory 3 when determining that the program rewriting action is illegal, and recovers the program. The recovery operation may be executed by executing step 6. By doing so, the controller 1 is initialized and communication with the tool 11 becomes impossible, so that the program data Pd is not rewritten illegally.

According to the configuration of the present embodiment, the following effects can be obtained.
(1) When the program is rewritten by accessing the controller 1 from the tool 11, the number of times Kx of failure of authentication (in this example, challenge response authentication) imposed between the tool 11 and the controller 1 is counted, and the number of times of failure. When Kx is equal to or greater than the specified value Kt, a measure for restricting or prohibiting rewriting of the program data Pd written in the first memory 3 of the controller 1 is executed. For this reason, when the number of times of authentication failure Kx becomes equal to or greater than the specified value Kt for an action that attempts to falsely establish the authentication by using the unauthorized tool 11 many times, It becomes possible to terminate the cheating. Accordingly, it is possible to make it difficult for unauthorized rewriting of the program data Pd of the controller 1 to occur.

  (2) The authentication imposed when the program data Pd of the controller 1 is rewritten by the tool 11 is challenge response authentication. By the way, in the challenge response authentication, random numbers tend to be biased, and when the tool 11 accesses the controller 1, it is assumed that an attempt is made to pass this point and pass through the authentication. However, in the case of this example, when the number of authentication failures Kx becomes equal to or greater than the specified value Kt, the program rewriting is restricted, so that even if an illegal act that creates a weak point of challenge response authentication is performed, this is dealt with. can do.

  (3) The controller 1 includes a first memory 3 to which the program data Pd is written and a second memory 4 to which the number Kx of authentication failure is written. Therefore, in the case of this example, the program writing location and the writing location of the authentication failure count Kx are separated from each other, so that each information can be easily managed.

  (4) The processing when the authentication failure count Kx is equal to or greater than the specified value Kt is processing for notifying the tool 11 that communication is impossible or processing for not returning a reply to the tool 11. For this reason, when there is an unauthorized attack to rewrite the program from the tool 11 to the controller 1, a tool by a third party is notified by a simple process of notifying the tool 11 that communication is impossible or not responding to the tool 11. 11 can be taken against illegal rewriting of the program.

  (5) The recovery operation of the controller 1 is performed when the authentication failure count Kx is equal to or greater than the specified value Kt. As a result, after the recovery, the program rewriting cannot be executed by a tool (unauthorized tool) 11 possessed by a third party. Therefore, it is further advantageous for preventing illegal program rewriting.

Note that the embodiment is not limited to the configuration described so far, and may be modified as follows.
Generally, setting information that is sequentially registered when the controller 1 is operated is written in the first memory 3 of the controller 1. The setting information is, for example, a kind of application. In this case, the setting information written in the first memory 3 of the controller 1 may be deleted when the number of times of authentication failure Kx is equal to or greater than the specified value Kt and the program rewriting action is determined to be illegal. . Even in this case, since the normal operation cannot be performed when the setting information is deleted from the controller 1, communication with the tool 11 cannot be executed. Accordingly, it is possible to make it difficult for a third party to illegally rewrite the program through the tool 11.

  -Any timing may be used to clear (reset) the authentication failure count Kx. That is, the failure count Kx may be a count value with respect to one-day illegal attacks, or an integrated value over a plurality of opportunities.

  The authentication imposed between the two when the program is rewritten using the tool 11 is not limited to challenge response authentication, and can be changed to various modes as long as the correctness of the other party can be confirmed.

The first memory 3 and the second memory 4 may be combined into one memory.
The treatment performed when the authentication failure count Kx is equal to or greater than the specified value Kt can be changed to various modes as long as the program rewriting is restricted or prohibited.

  -The controller 1 of this example is applicable to various apparatuses and apparatuses.

  DESCRIPTION OF SYMBOLS 1 ... Controller, 3 ... Memory (1st memory), 5 ... Product control program, 6 ... Recovery program, 10 ... Program illegal rewriting prevention apparatus, 11 ... Tool, 13 ... Invalid number counting part, 14 ... Invalid write Replacement prevention unit, Pd... Program (program data), Sa... Program rewrite request, Kx.

Claims (5)

In the program illegal rewriting prevention device for preventing the program written in the memory of the controller from being illegally rewritten,
When authentication is performed between the controller and the tool based on a program rewrite request input from a tool, an unauthorized number counting unit that counts the number of times the authentication is invalid in the repeated authentication,
An unauthorized program rewrite prevention apparatus comprising: an unauthorized rewrite prevention unit that restricts or prohibits rewriting of the program in the memory when the number of times that the authentication has become invalid exceeds a predetermined value. The program unauthorized rewrite prevention apparatus according to claim 1, wherein the authentication is challenge response authentication. The controller includes a first memory as a write destination of the program, and a second memory for writing the number of times the authentication is invalid,
3. The program illegal rewriting according to claim 1, wherein the fraud count counting unit counts the number of fraud by sequentially writing the number of times the authentication is fraudulent in the second memory. Prevention device. The unauthorized rewrite prevention unit executes a process of notifying the tool that communication is impossible or a process of not returning a reply when the number of times that the authentication is invalid exceeds a specified value. The program illegal rewriting prevention device according to any one of claims 1 to 3, wherein: In the memory of the controller, a product control program used during normal operation is written,
The unauthorized rewrite prevention unit deletes the product control program written in the memory and executes a recovery operation when the number of times the authentication is unauthorized exceeds a specified value. The program illegal rewriting prevention apparatus as described in any one of Claims 1-3.