JP6223484B2 - In-vehicle control system, vehicle, key distribution device, control device, key distribution method, and computer program - Google Patents

Description

  The present invention relates to an in-vehicle control system, a vehicle, a key distribution device, a control device, a key distribution method, and a computer program.

  2. Description of the Related Art Conventionally, an automobile has an ECU (Electronic Control Unit), and functions such as engine control are realized by the ECU. The ECU is a kind of computer and realizes a desired function by a computer program. For example, Non-Patent Document 1 discloses a security technique for an in-vehicle control system configured by connecting a plurality of ECUs to a CAN (Controller Area Network).

Keisuke Takemori, “Protection of in-vehicle control systems based on secure elements: Organizing and considering element technologies”, IEICE, IEICE Technical Report, vol. 114, no. 508, pp. 73-78, 2015 March

  In the security technology of the conventional in-vehicle control system, it is a problem to improve the security performance after starting the engine. For example, when the ECUs communicate with each other after the engine is started, the security strength of the communication may be insufficient.

  The present invention has been made in consideration of such circumstances, and an in-vehicle control system, a vehicle, a key distribution device, a control device, a key distribution method, and a computer capable of improving the security performance after the engine is started. The challenge is to provide a program.

(1) According to an aspect of the present invention, in an in-vehicle control system in which the vehicle control devices provided in a vehicle communicate with each other via a communication network provided in the vehicle, engine start information indicating start of the vehicle engine is acquired. A vehicle information acquisition unit, a distribution timing determination unit that determines whether it is a distribution timing of a key used for communication of the control device, based on engine start information acquired by the vehicle information acquisition unit, and the distribution timing determination A distribution unit that distributes the key to the control device via the communication network according to a determination result of the unit.
(2) One aspect of the present invention is the vehicle-mounted control system according to (1), wherein the delivery timing determination unit is configured to perform a predetermined time from the start of the engine based on the engine start information acquired by the vehicle information acquisition unit. It is a vehicle-mounted control system which determines that it is the said delivery timing when it passes.
(3) In one aspect of the present invention, in the in-vehicle control system according to (1), the vehicle information acquisition unit further acquires travel state information indicating whether the vehicle is in a travel state, and the distribution The timing determination unit determines that it is the distribution timing when the engine is started and the vehicle is running based on the engine start information and the running state information acquired by the vehicle information acquisition unit. System.
(4) According to one aspect of the present invention, in the in-vehicle control system according to any one of (1) to (3), the in-vehicle control system further includes a notification unit that notifies whether or not the distribution of the key is completed. It is.
(5) According to one aspect of the present invention, in the in-vehicle control system according to any one of (1) to (4), the distribution unit responds to a distribution request for the key received from the control device via the communication network. In response, the key is distributed to the control device that is the distribution request source via the communication network, and the control device receives the key from the distribution unit via the communication network, and the key Based on the distribution request determination information acquisition unit that acquires information used to determine whether to make a distribution request, whether the reception unit has received the key, and the information acquired by the distribution request determination information acquisition unit A distribution request unit that transmits the key distribution request to the distribution unit via the communication network.
(6) According to one aspect of the present invention, in the in-vehicle control system according to (5), the distribution request determination information acquisition unit acquires an elapsed time since activation of the own control device, and the distribution request unit includes: An in-vehicle control system that transmits the key distribution request to the distribution unit via the communication network when the reception unit has not received the key and when a predetermined time has elapsed since the start of the own control device. is there.
(7) According to one aspect of the present invention, in the in-vehicle control system according to (5), the distribution request determination information acquisition unit acquires traveling state information indicating whether or not the vehicle is traveling, The distribution request unit is an in-vehicle control system that transmits the key distribution request to the distribution unit via the communication network when the key of the reception unit is not received and the vehicle is running. is there.

(8) One aspect of the present invention is a vehicle including the vehicle-mounted control system according to any one of (1) to (5) above.

(9) One aspect of the present invention is a key distribution device of an in-vehicle control system in which the vehicle control devices provided in the vehicle communicate with each other via a communication network provided in the vehicle, and indicates an engine start of the vehicle A vehicle information acquisition unit that acquires start information; a distribution timing determination unit that determines whether it is a distribution timing of a key used for communication of the control device based on engine start information acquired by the vehicle information acquisition unit; A distribution unit that distributes the key to the control device via the communication network according to a determination result of the distribution timing determination unit.

(10) One aspect of the present invention is the control device of the in-vehicle control system in which the vehicle control devices provided in the vehicle communicate with each other via a communication network provided in the vehicle, and indicates an engine start of the vehicle A vehicle information acquisition unit that acquires start information; a distribution timing determination unit that determines whether it is a distribution timing of a key used for communication of the control device based on engine start information acquired by the vehicle information acquisition unit; And a distribution unit that distributes the key to the control device via the communication network according to a determination result of the distribution timing determination unit.

(11) One aspect of the present invention is a key distribution method for an in-vehicle control system in which the vehicle control devices provided in the vehicle communicate with each other via a communication network provided in the vehicle, and the vehicle information acquisition unit includes: A vehicle information acquisition step for acquiring engine start information indicating engine start and a distribution of a key used for communication of the control device based on the engine start information acquired by the distribution timing determination unit by the vehicle information acquisition unit A distribution timing determination step for determining whether the timing is present, and a distribution step in which the distribution unit distributes the key to the control device via the communication network according to a determination result of the distribution timing determination unit. It is a key distribution method.

(12) According to one aspect of the present invention, engine start information indicating engine start of the vehicle is transmitted to a computer of an in-vehicle control system in which the vehicle control devices provided in the vehicle communicate with each other via a communication network provided in the vehicle. A vehicle information acquisition function to be acquired, a distribution timing determination function for determining whether it is a distribution timing of a key used for communication of the control device, based on engine start information acquired by the vehicle information acquisition function, and the distribution A computer program for realizing a distribution function for distributing the key to the control device via the communication network in accordance with a determination result of a timing determination function.

  According to the present invention, it is possible to improve the security performance after starting the engine.

1 is a diagram illustrating a configuration example of an automobile 1 according to an embodiment. It is a figure showing an example of functional composition of the 1ECU10 concerning one embodiment. It is a figure which shows the function structural example of 2nd ECU20 which concerns on one Embodiment. It is a flowchart which shows the example of the key distribution method which concerns on one Embodiment. It is a flowchart which shows the example of the key distribution method which concerns on one Embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the following embodiment, a vehicle will be described as an example of a vehicle.

  FIG. 1 is a diagram illustrating a configuration example of an automobile 1 according to the present embodiment. In FIG. 1, the automobile 1 includes a plurality of ECUs (Electronic Control Units) 10, 20, a CAN 30, an infotainment device 102, and a diagnostic port 104. The ECUs 10 and 20 are connected to the CAN 30. CAN 30 is a communication network. CAN is known as an example of a communication network mounted on a vehicle. The ECU 10 exchanges data with the ECU 20 via the CAN 30. The ECU 20 exchanges data with other ECUs 20 via the CAN 30.

  The ECUs 10 and 20 are a kind of computer. The ECUs 10 and 20 are in-vehicle computers provided in the automobile 1. The ECUs 10 and 20 are composed of a CPU (Central Processing Unit) and a memory. The functions of the ECUs 10 and 20 are realized by the CPU of the ECUs 10 and 20 executing a computer program for realizing the functions of the ECUs 10 and 20. For example, the ECUs 10 and 20 have a control function for controlling devices in the automobile 1.

  The ECU 10 is referred to as a first ECU 10. The ECU 20 is referred to as a second ECU 20. The first ECU 10 is an ECU having a gateway function among the ECUs mounted on the automobile 1. The second ECU 20 is an ECU having functions such as engine control among the ECUs mounted on the automobile 1. Examples of the second ECU 20 include an ECU having an engine control function, an ECU having a handle control function, and an ECU having a brake control function.

  The first ECU 10 communicates with the second ECU 20 via the CAN 30. The second ECU 20 communicates with the other second ECU 20 via the CAN 30. In the present embodiment, the in-vehicle control system 2 includes a first ECU 10, a second ECU 20, and a CAN 30.

  Examples of the infotainment device 102 include a navigation function, a location information service function, a multimedia playback function such as music and video, a voice communication function, a data communication function, and an Internet connection function. The infotainment device 102 is connected to the external device 200 and exchanges data with the external device 200. Examples of the external device 200 include a mobile communication terminal and an audio visual device. The infotainment device 102 is connected to the first ECU 10.

  The diagnostic port 104 connects the diagnostic tool 210. The diagnostic tool 210 executes installation of update programs such as the first ECU 10 and the second ECU 20 and data setting change via the diagnostic port 104. As the diagnostic port 104, for example, an OBD (On-board Diagnostics) port may be used.

  The infotainment device 102 transmits / receives data to / from the second ECU 20 connected to the CAN 30 via the first ECU 10. The first ECU 10 monitors data transmission / reception between the infotainment device 102 and the second ECU 20.

  The diagnostic tool 210 transmits / receives data to / from the second ECU 20 connected to the CAN 30 via the diagnostic port 104 and the first ECU 10. The first ECU 10 monitors data transmission / reception between the diagnostic tool 210 and the second ECU 20.

  FIG. 2 is a diagram illustrating a functional configuration example of the first ECU 10 according to the present embodiment. In FIG. 2, the first ECU 10 includes a vehicle information acquisition unit 11, a distribution timing determination unit 12, a distribution unit 13, and a notification unit 14. The functions of these units are realized by the CPU of the first ECU 10 executing a computer program stored in the memory of the first ECU 10.

  The vehicle information acquisition unit 11 acquires engine start information indicating the start of the engine of the automobile 1. The vehicle information acquisition unit 11 acquires engine start information from the second ECU 20 that controls the start of the engine of the automobile 1. For example, the vehicle information acquisition unit 11 receives information transmitted from the CAN 30 by the second ECU 20 that controls the start of the engine of the automobile 1 to the CAN 30 and acquires engine start information from the received information.

  The vehicle information acquisition unit 11 may further acquire traveling state information indicating whether or not the automobile 1 is in a traveling state. The traveling state information may be information indicating the state of the transmission (gear) of the automobile 1, for example. As the state of the transmission of the automobile 1, there are a traveling state such as a drive range and a reverse range and a non-traveling state such as neutral and parking. When information indicating the state of the transmission of the automobile 1 is used as the traveling state information, the vehicle information acquisition unit 11 acquires the traveling state information from the second ECU 20 that controls the transmission of the automobile 1. For example, the vehicle information acquisition unit 11 receives information transmitted from the CAN 30 by the second ECU 20 that controls the transmission of the automobile 1 from the CAN 30, and acquires traveling state information from the received information.

  The distribution timing determination unit 12 determines whether it is the distribution timing of the key used for communication between the first ECU 10 and the second ECU 20 based on the engine start information acquired by the vehicle information acquisition unit 11. In the present embodiment, a key used for communication between the first ECU 10 and the second ECU 20 is referred to as a session key. The session key is used to increase the security strength of communication. For example, the session key is used for encryption and decryption of communication data, generation and inspection of a message authentication code (MAC).

  The distribution timing determination unit 12 may determine whether it is the session key distribution timing based on the engine start information and the running state information acquired by the vehicle information acquisition unit 11.

  The distribution unit 13 distributes the session key to the second ECU 20 via the CAN 30 according to the determination result of the distribution timing determination unit 12. The distribution unit 13 may transmit the session key by broadcast. The session key transmitted by broadcast is received by each second ECU 20 via CAN 30.

  The distribution unit 13 may distribute the session key to the second ECU 20 that is the distribution request source via the CAN 30 in response to the session key distribution request received from the second ECU 20 via the CAN 30.

  The notification unit 14 notifies whether or not the distribution of the session key has been completed. For example, the notification unit 14 may display on the display screen of the driver's seat of the automobile 1 whether or not the distribution of the session key has been completed. Moreover, the alerting | reporting part 14 may alert | report by voice whether the delivery of the session key is completed.

  FIG. 3 is a diagram illustrating a functional configuration example of the second ECU 20 according to the present embodiment. In FIG. 3, the second ECU 20 includes a receiving unit 21, a distribution request unit 22, and a distribution request determination information acquisition unit 23. The functions of these units are realized by the CPU of the second ECU 20 executing a computer program stored in the memory of the second ECU 20.

  The receiving unit 21 receives a session key from the first ECU 10 via the CAN 30. The distribution request determination information acquisition unit 23 acquires information used for determining whether or not to make a session key distribution request. The distribution request unit 22 transmits a session key distribution request to the first ECU 10 via the CAN 30 based on whether the reception unit 21 has received the session key and the information acquired by the distribution request determination information acquisition unit 23.

  Next, each operation of the first ECU 10 and the second ECU 20 according to the present embodiment will be described with reference to FIGS. 4 and 5.

  The first ECU 10 according to the present embodiment will be described with reference to FIG. FIG. 4 is a flowchart showing an example of a key distribution method according to the present embodiment. The process of FIG. 4 is started when the first ECU 10 is activated, for example.

(Step S <b> 1) In the first ECU 10, the distribution timing determination unit 12 determines whether it is the session key distribution timing based on the engine start information acquired by the vehicle information acquisition unit 11. Alternatively, the distribution timing determination unit 12 determines whether it is the session key distribution timing based on the engine start information and the running state information acquired by the vehicle information acquisition unit 11. If it is determined that the session key distribution timing is reached, the process proceeds to step S2. If the session key distribution timing is not reached, step S1 is continued.

(Step S <b> 2) The distribution unit 13 distributes the session key to the second ECU 20 via the CAN 30 when the determination result of the distribution timing determination unit 12 is the session key distribution timing. The distribution unit 13 may transmit the session key by broadcast.

(Step S3) The distribution unit 13 determines whether the distribution of the session key to the second ECU 20 has been completed. Specifically, the distribution unit 13 determines whether or not a session key reception response has been received from each second ECU 20 via the CAN 30. As a result of the determination, the distribution unit 13 determines that the distribution of the session key to the second ECU 20 has been completed when receiving a session key reception response from the second ECUs 20 of all distribution destinations. On the other hand, as a result of the determination, the distribution unit 13 determines that the distribution of the session key to the second ECU 20 has not been completed when the session key reception response has not been received from the second ECU 20 of any distribution destination. To do.

  If the session key distribution is completed as a result of the determination in step S3, the process proceeds to step S4. If the session key distribution is not completed, the process proceeds to step S5.

(Step S4) The notification unit 14 notifies that the distribution of the session key has been completed. For example, the notification unit 14 performs a display on the display screen of the driver's seat of the automobile 1 indicating that the session key distribution has been completed.

(Step S <b> 5) The distribution unit 13 determines whether a session key distribution request is received from the second ECU 20 via the CAN 30. If it is determined that a session key distribution request has been received, the process proceeds to step S6. If no session key distribution request has been received, the process returns to step S3.

(Step S6) In response to the session key distribution request received from the second ECU 20 via the CAN 30, the distribution unit 13 distributes the session key to the second ECU 20 that is the distribution request source via the CAN 30.

(Step S7) If the process of FIG. 4 is completed, the present process is terminated, and if the process of FIG. 4 is continued, the process returns to Step S1.

  The second ECU 20 according to the present embodiment will be described with reference to FIG. FIG. 5 is a flowchart illustrating an example of a key distribution method according to the present embodiment. The process of FIG. 5 is started when the second ECU 20 is activated, for example.

(Step S <b> 11) In the second ECU 20, the receiving unit 21 determines whether a session key is received from the first ECU 10 via the CAN 30. For example, the receiving unit 21 determines whether a session key is received from the first ECU 10 via the CAN 30 by broadcasting.

  If it is determined in step S11 that the session key has been received, the process proceeds to step S12. If the session key has not been received, the process proceeds to step S13.

(Step S <b> 12) The receiving unit 21 transmits a session key reception response to the first ECU 10 via the CAN 30.

  For example, CMAC (Cipher-based Message Authentication Code) may be used as the session key reception response. For example, the receiving unit 21 may generate a CMAC of concatenated data between the ECU_ID of the second ECU 20 and the counter value using the session key received by the receiving unit 21 as the CMAC of the reception response. The ECU_ID is an identifier of a CAN assigned to the second ECU 20. The counter value represents the number of times communication data is transmitted from the second ECU 20 to the first ECU 10. In this case, in step S3 of FIG. 4 described above, the distribution unit 13 of the first ECU 10 checks the CMAC of the session key reception response received from the second ECU 20 using the session key distributed by itself. The delivery unit 13 determines that the delivery of the session key to the second ECU 20 is complete when the CMAC inspection result is acceptable, and to the second ECU 20 when the CMAC inspection result is unacceptable. It is determined that the distribution of the session key is not completed. By using CMAC as a session key reception response, a replay attack can be prevented.

(Step S <b> 13) The distribution request unit 22 determines whether to make a session key distribution request based on whether or not the reception unit 21 has received the session key and the information acquired by the distribution request determination information acquisition unit 23. As a result of the determination, if a session key distribution request is made, the process proceeds to step S14, and if no session key distribution request is made, the process returns to step S11.

(Step S14) The distribution request unit 22 transmits a session key distribution request to the first ECU 10 via the CAN 30.

(Step S15) If the process of FIG. 5 is completed, the present process is terminated. If the process of FIG. 5 is continued, the process returns to Step S11.

  Next, an example of session key distribution timing according to the present embodiment will be described.

[Example 1 of session key distribution timing]
Example 1 of session key distribution timing is when a predetermined time has elapsed since the engine of the automobile 1 was started. Based on the engine start information acquired by the vehicle information acquisition unit 11, the distribution timing determination unit 12 determines that it is the session key distribution timing when a predetermined time has elapsed since the start of the engine of the automobile 1. When the distribution timing determination unit 12 determines that the distribution timing is the distribution timing, the distribution unit 13 distributes the session key to the second ECU 20 via the CAN 30. Thus, the session key is distributed from the first ECU 10 to the second ECU 20 at a timing when a predetermined time has elapsed since the engine of the automobile 1 is started.

  According to the session key distribution timing example 1, the session key is distributed from the first ECU 10 to the second ECU 20 at a timing when a predetermined time (distribution timing determination time) has elapsed since the start of the engine of the automobile 1. Thereby, when each 2ECU20 is started or restarted by starting the engine of the automobile 1, the session key can be distributed from the first ECU10 to the second ECU20 after waiting until the operation of each second ECU20 is stabilized. Even if the time until the operation of each second ECU 20 is stabilized is different, the session key can be stably distributed by setting the distribution timing determination time in consideration of the difference time.

[Example 2 of session key distribution timing]
Example 2 of session key distribution timing is when the engine of the automobile 1 is started and the automobile 1 is in a running state. Based on the engine start information and the running state information acquired by the vehicle information acquisition unit 11, the delivery timing determination unit 12 starts the session key delivery timing when the engine of the automobile 1 is started and the automobile 1 is in a running state. It is determined that When the distribution timing determination unit 12 determines that the distribution timing is the distribution timing, the distribution unit 13 distributes the session key to the second ECU 20 via the CAN 30. Thus, the session key is distributed from the first ECU 10 to the second ECU 20 at a timing when the engine of the automobile 1 is started and the automobile 1 is in a traveling state. For example, the session key is distributed from the first ECU 10 to the second ECU 20 at the timing when the state of the transmission becomes the drive range after the engine of the automobile 1 is started.

  According to the session key distribution timing example 2, the session key is distributed from the first ECU 10 to the second ECU 20 at a timing when the engine of the automobile 1 is started and the automobile 1 is in a traveling state. Thereby, the session key can be distributed from the first ECU 10 to the second ECU 20 at the timing when the automobile 1 travels. Since most of the second ECUs 20 are considered to be stable at the timing when the vehicle 1 travels, stable distribution of the session key can be realized.

  Next, an example of a session key distribution request method according to the present embodiment will be described.

[Example 1 of session key distribution request method]
In Example 1 of the session key distribution request method, when the second ECU 20 does not receive a session key from the first ECU 10 and when a predetermined time has elapsed since the second ECU 20 started, the second ECU 20 Make a delivery request. The distribution request determination information acquisition unit 23 acquires the elapsed time since the start of the second ECU 20. For example, the distribution request determination information acquisition unit 23 measures the elapsed time after the CPU of the second ECU 20 is activated. Based on the presence / absence of reception of the session key by the reception unit 21 and the elapsed time acquired by the distribution request determination information acquisition unit 23, the distribution request unit 22 receives no session key from the reception unit 21 and the second ECU 20 When a predetermined time has elapsed since the activation, a session key distribution request is transmitted to the first ECU 10 via the CAN 30. In response to the session key distribution request received from the second ECU 20 via the CAN 30, the distribution unit 13 of the first ECU 10 distributes the session key to the second ECU 20 that is the distribution request source via the CAN 30.

  According to example 1 of the session key distribution request method, when activation of a certain second ECU 20 among the plurality of second ECUs 20 included in the in-vehicle control system 2 is not in time for the session key distribution timing from the first ECU 10, the first The session key can be retransmitted to the 2ECU 20. Thereby, stable distribution of the session key can be realized.

[Example 2 of session key distribution request method]
In example 2 of the session key distribution request method, the second ECU 20 makes a session key distribution request to the first ECU 10 when no session key is received from the first ECU 10 and the vehicle 1 is in a traveling state. . The distribution request determination information acquisition unit 23 acquires travel state information. The acquisition method of driving state information is the same as the acquisition method of the driving state information of the vehicle information acquisition part 11 mentioned above. The distribution request unit 22 receives the session key from the reception unit 21 based on the presence / absence of reception of the session key by the reception unit 21 and the running state information acquired by the distribution request determination information acquisition unit 23. When the vehicle is traveling, a session key distribution request is transmitted to the first ECU 10 via the CAN 30. In response to the session key distribution request received from the second ECU 20 via the CAN 30, the distribution unit 13 of the first ECU 10 distributes the session key to the second ECU 20 that is the distribution request source via the CAN 30.

  According to example 2 of the session key distribution request method, when the activation of a certain second ECU 20 among the plurality of second ECUs 20 included in the in-vehicle control system 2 is not in time for the session key distribution timing from the first ECU 10, the second The session key can be retransmitted to the 2ECU 20. Thereby, stable distribution of the session key can be realized.

  In the second example of the session key distribution request method described above, a time when a predetermined time has passed since the engine of the automobile 1 is started may be added as a condition for executing the session key distribution request. . In this case, the distribution request determination information acquisition unit 23 further acquires engine start information. The acquisition method of engine start information is the same as the acquisition method of engine start information of the vehicle information acquisition part 11 mentioned above. The distribution request unit 22 has received no session key from the reception unit 21 based on whether or not the session key is received by the reception unit 21 and the running state information and engine start information acquired by the distribution request determination information acquisition unit 23. When the vehicle 1 is in a traveling state and when a predetermined time has elapsed since the start of the engine of the vehicle 1, a session key distribution request is transmitted to the first ECU 10 via the CAN 30. In response to the session key distribution request received from the second ECU 20 via the CAN 30, the distribution unit 13 of the first ECU 10 distributes the session key to the second ECU 20 that is the distribution request source via the CAN 30.

  According to the embodiment described above, in the automobile 1, an effect of improving the security strength of communication when the ECUs communicate with each other after the engine is started can be obtained.

  If the session key delivered from the first ECU 10 to the second ECU 20 has a long data length and cannot be delivered once via the CAN 30, the session key may be delivered multiple times. Good.

  Moreover, when distributing the session key to the second ECU 20, the first ECU 10 may distribute information used together with the session key. For example, when a session key is used for generating and checking the MAC, the first ECU 10 may distribute other information used for generating and checking the MAC to the second ECU 20 together with the session key. For example, when the count value of the number of transmissions of communication data is used for MAC generation and inspection, the first ECU 10 may distribute the initial value of the count value to the second ECU 20 together with the session key.

  Further, in step S12 of FIG. 5 described above, the session key reception response is performed from the second ECU 20 to the first ECU 10, but the session key reception response is not essential. When the session key reception response is not sent from the second ECU 20 to the first ECU 10, the first ECU 10 monitors communication using the session key by the second ECU 20, and distribution of the session key to the second ECU 20 is completed based on the monitoring result. Determine if you did. For example, when the MAC included in the communication data transmitted by the second ECU 20 is generated using the session key, the first ECU 10 uses the session key distributed by the first ECU 10 to the MAC included in the communication data transmitted by the second ECU 20. Use and inspect. The first ECU 10 determines that the delivery of the session key to the second ECU 20 has been completed when the MAC inspection result is acceptable, and the second ECU 20 determines that the MAC inspection result is unacceptable. Judge that session key distribution has not been completed. For example, CMAC may be used as the MAC. For example, the CMAC may be a CMAC that is generated by using a session key with respect to connection data of transmission data included in communication data transmitted by the second ECU 20 and a counter value. The counter value represents the number of times communication data is transmitted from the second ECU 20 to the destination second ECU 20.

  In the present embodiment, the first ECU 10 corresponds to a key distribution device.

  As mentioned above, although embodiment of this invention was explained in full detail with reference to drawings, the specific structure is not restricted to this embodiment, The design change etc. of the range which does not deviate from the summary of this invention are included.

  In the embodiment described above, the first ECU 10 has the function of a key distribution device, but the key distribution device may be provided separately as a single device that connects to the CAN 30.

  In addition, as a communication network mounted on the vehicle, a communication network other than CAN is provided in the automobile 1, and data exchange between the first ECU 10 and the second ECU 20 via the communication network other than CAN, and between the second ECUs 20 Data exchanges between them may be performed. For example, the automobile 1 may be provided with a LIN (Local Interconnect Network). Further, the automobile 1 may be provided with CAN and LIN. Further, the automobile 1 may include a second ECU 20 connected to the LIN. The first ECU 10 may be connected to CAN and LIN. The first ECU 10 exchanges data with the second ECU 20 connected to the CAN via the CAN, and exchanges data with the second ECU 20 connected to the LIN via the LIN. Also good. Further, the second ECUs 20 may exchange data via the LIN.

  In the above-described embodiment, an automobile is taken as an example of a vehicle. However, the present invention can also be applied to other vehicles using an engine other than an automobile such as a motorbike and a motorcycle.

Further, a computer program for realizing the functions of the first ECU 10 or the second ECU 20 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed. Also good. Here, the “computer system” may include an OS and hardware such as peripheral devices.
“Computer-readable recording medium” refers to a flexible disk, a magneto-optical disk, a ROM, a writable nonvolatile memory such as a flash memory, a portable medium such as a DVD (Digital Versatile Disc), and a built-in computer system. A storage device such as a hard disk.

Further, the “computer-readable recording medium” means a volatile memory (for example, DRAM (Dynamic DRAM) in a computer system that becomes a server or a client when a program is transmitted through a network such as the Internet or a communication line such as a telephone line. Random Access Memory)), etc., which hold programs for a certain period of time.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

DESCRIPTION OF SYMBOLS 1 ... Automobile, 2 ... In-vehicle control system, 10 ... 1ECU, 20 ... 2ECU, 30 ... CAN, 11 ... Vehicle information acquisition part, 12 ... Delivery timing determination part, 13 ... Delivery part, 14 ... Notification part, 21 ... Receiving unit, 22 ... delivery request unit, 23 ... delivery request determination information acquisition unit, 102 ... infotainment device, 104 ... diagnostic port

Claims (11)

In a vehicle-mounted control system in which the vehicle control devices provided in a vehicle communicate with each other via a communication network provided in the vehicle,
A vehicle information acquisition unit for acquiring engine start information indicating start of the engine of the vehicle;
A distribution timing determination unit that determines whether it is a distribution timing of a key used for communication of the control device based on engine start information acquired by the vehicle information acquisition unit;
A distribution unit that distributes the key to the control device via the communication network according to a determination result of the distribution timing determination unit ;
The delivery timing determination unit determines that it is the delivery timing when a predetermined time has elapsed from the start of the engine based on the engine start information acquired by the vehicle information acquisition unit.
In-vehicle control system. The predetermined time is a time set based on a time difference until the operations of the control devices are stabilized when a plurality of the control devices are started or restarted by starting the engine.
The in-vehicle control system according to claim 1. A notification section for notifying whether or not the distribution of the key is completed;
The vehicle-mounted control system of any one of Claim 1 or 2 . In response to the key distribution request received from the control device via the communication network, the distribution unit distributes the key to the distribution request source control device via the communication network,
The controller is
A receiving unit that receives the key from the distribution unit via the communication network;
A distribution request determination information acquisition unit that acquires information used to determine whether to make a distribution request for the key;
A distribution request unit that transmits the key distribution request to the distribution unit via the communication network based on whether the reception unit receives the key and the information acquired by the distribution request determination information acquisition unit; Comprising
The in-vehicle control system according to any one of claims 1 to 3 . The distribution request determination information acquisition unit acquires an elapsed time since the start of the own control device,
The distribution request unit transmits the key distribution request to the distribution unit via the communication network when the reception unit has not received the key and when a predetermined time has elapsed since the activation of the own control device. To
The in-vehicle control system according to claim 4 . The distribution request determination information acquisition unit acquires traveling state information indicating whether the vehicle is in a traveling state,
The distribution request unit transmits the key distribution request to the distribution unit via the communication network when the reception unit does not receive the key and the vehicle is in a traveling state.
The in-vehicle control system according to claim 4 . A vehicle provided with the vehicle-mounted control system of any one of Claim 1 to 6 . The vehicle control system key distribution device in which the vehicle control devices provided in the vehicle communicate with each other via a communication network provided in the vehicle,
A vehicle information acquisition unit for acquiring engine start information indicating start of the engine of the vehicle;
A distribution timing determination unit that determines whether it is a distribution timing of a key used for communication of the control device based on engine start information acquired by the vehicle information acquisition unit;
A distribution unit that distributes the key to the control device via the communication network according to a determination result of the distribution timing determination unit ;
The delivery timing determination unit determines that it is the delivery timing when a predetermined time has elapsed from the start of the engine based on the engine start information acquired by the vehicle information acquisition unit.
Key distribution device. The control device of the in-vehicle control system in which the control devices of the vehicle provided in the vehicle communicate with each other via a communication network provided in the vehicle,
A vehicle information acquisition unit for acquiring engine start information indicating start of the engine of the vehicle;
A distribution timing determination unit that determines whether it is a distribution timing of a key used for communication of the control device based on engine start information acquired by the vehicle information acquisition unit;
A distribution unit that distributes the key to the control device via the communication network according to a determination result of the distribution timing determination unit ;
The delivery timing determination unit determines that it is the delivery timing when a predetermined time has elapsed from the start of the engine based on the engine start information acquired by the vehicle information acquisition unit.
Control device. A vehicle key distribution method for an in-vehicle control system in which the vehicle control devices provided in a vehicle communicate with each other via a communication network provided in the vehicle.
A vehicle information acquisition unit for acquiring engine start information indicating start of the engine of the vehicle;
A distribution timing determination step for determining whether the distribution timing determination unit is a distribution timing of a key used for communication of the control device based on the engine start information acquired by the vehicle information acquisition unit;
Delivery unit, in accordance with the determination result of the distribution timing determining section, seen including and a distribution step of distributing via the communication network the key to the control unit,
The delivery timing determination unit determines that it is the delivery timing when a predetermined time has elapsed from the start of the engine based on the engine start information acquired by the vehicle information acquisition unit.
Key distribution method. In a vehicle-mounted control system computer in which the vehicle control devices provided in the vehicle communicate with each other via a communication network provided in the vehicle,
A vehicle information acquisition function for acquiring engine start information indicating start of the engine of the vehicle;
A distribution timing determination function for determining whether it is a distribution timing of a key used for communication of the control device, based on engine start information acquired by the vehicle information acquisition function;
A distribution function for distributing the key to the control device via the communication network according to a determination result of the distribution timing determination function;
A computer program for implementing the,
The distribution timing determination function determines that it is the distribution timing when a predetermined time has elapsed from the start of the engine based on the engine start information acquired by the vehicle information acquisition function.
Computer program.

Images