JP2001202266A - Method for inspecting on-vehicle control unit - Google Patents

Abstract

PROBLEM TO BE SOLVED: To rightly inspect an on-vehicle control unit and to prevent illegal alteration as the result. SOLUTION: An ECU 10 is provided with a widely known microcomputer 11, which is provided with a CPU 12 forming the center of various kinds of control, a flash memory 13 which can be erased and written electrically, and the other input/output circuit, etc., not shown in the figure. An external tool 20 is also provided with a widely known microcomputer 11 consisting of a CPU, a memory, an input/output circuit, etc. On judging (inspecting) the authenticity of the ECU 10, the tool 20 first transmits transmission data including a sum value calculation command and a random number to the ECU 10. The ECU 10 calculates the sum value of data in the memory 13 and enciphers the sum value in accordance with the random number by using a prescribed enciphering algorithm. After then, the enciphered sum value is transmitted to the tool 20, which compares and judges a decoded sum value and a previously registered true sum value to judge whether the ECU 10 is normal or abnormal by the result of it.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for inspecting a vehicle-mounted control unit.

[0002]

2. Description of the Related Art Japanese Patent Laid-Open Publication No.
Japanese Patent Application Laid-Open No. 132097 discloses a “memory rewriting device for vehicle control”. The apparatus disclosed in the publication includes an ECU (vehicle control unit) equipped with a control memory (flash memory) that can be electrically erased and written by an external tool, and data is rewritten to the control memory only when rewriting is permitted. You. Further, this device checks that the software (control program) stored in the control memory is correct. The features include: a sum value (true value) of the control memory stored in advance;
The sum value calculated by the ECU is displayed together, and a comparison is made to determine whether the sum is correct. -The above sum value is compared inside the external tool, and only the result (true or false) is returned. • Calculate the sum value after switching the ignition key switch from OFF to ON. Is performed.

[0003]

In the prior art disclosed in the above publication, the sum value calculated by the ECU is directly transmitted to an external tool. Therefore, by monitoring communication data between the ECU and the external tool, the correct sum value calculated by the ECU can be easily obtained.

Further, since the sum value of the control memory does not change unless the software is rewritten, an unauthorized remodeler creates an unauthorized program which always transmits a correct sum value to an external checker. By incorporating it in the ECU, it becomes possible to easily impersonate the legitimate ECU without knowing the legitimate sum value calculation algorithm. The same applies to a configuration in which the ECU makes a true / false determination. That is, by creating a fake program that replies the monitored sum value, even if the fake ECU has been falsified, the external tool recognizes that the correct sum value (always the same) has been returned, and The ECU is determined to be ECU.

The present invention has been made in view of the above-mentioned problems, and has as its object to inspect a vehicle-mounted control unit capable of correctly inspecting the vehicle-mounted control unit and, thereby, preventing unauthorized modification. Is to provide a way.

[0006]

According to the first aspect of the present invention, there is provided a method for inspecting an on-vehicle control unit, wherein (1) a random number is generated, and the random number is transmitted from an external tool to the control unit together with a sum value calculation command. (2) calculating a sum value of the memory and encrypting the sum value according to the random number; and (3) transmitting the encrypted data to an external tool. (4) Decoding the data received by the external tool, comparing the sum value in the data with a true sum value prepared in advance, and inspecting the vehicle-mounted control unit based on the result of the comparison.
Steps are performed in order, so
The possibility that a correct sum value is leaked to a person who intends to perform unauthorized modification is reduced. Even if the authorized control unit is tampered with and an unauthorized program that can return the correct sum value of the memory to the external tool is incorporated in the control unit, the external tool receives the encrypted data and After decrypting the encrypted data, the comparison of the sum value is performed, so that it is extremely difficult to impersonate the illegally modified control unit as a legitimate control unit. As a result, the onboard control unit is correctly inspected,
As a result, unauthorized modification can be prevented.

The above invention is particularly effective when the memory in the vehicle-mounted control unit is constituted by an electrically rewritable nonvolatile memory such as a flash memory (claim 2).

[0010] In the invention according to claim 3, when the sum values do not match in the fourth step, the first
Returning to the step, a new random number is set, and the subsequent second to fourth steps are performed again. Thereby, even when the inspection is not performed correctly due to a temporary communication abnormality, an appropriate inspection can be performed by re-communication. In addition, here, since the transmission / reception data between the control unit and the external tool is different each time in order to reset the random number, even if it is assumed that the communication line is monitored, there is a possibility that a correct sum value may be leaked. Extremely low.

According to the invention of claim 4, in the first step, one of a plurality of encryption algorithms is designated, and identification data representing the designation is externally transmitted together with a random number and a sum value calculation command. Transmitting from the tool to the control unit; in the second step, encryption is performed using an encryption algorithm specified by the identification data; and thereafter, in the fourth step, the specified encryption algorithm is used. , The decoding formula corresponding to is extracted, the received data is decoded, and the sum value is extracted.

In such a case, by using a plurality of encryption algorithms alternatively, even if the encryption algorithm is known to an unauthorized alterator, the sum value is clarified corresponding to the actually used encryption algorithm. It will be very difficult to do. Therefore, unauthorized modification of the vehicle-mounted control unit can be made more difficult.

According to the fifth aspect of the present invention, the on-vehicle control unit comprises a first microcomputer mounted with an electrically rewritable nonvolatile memory and a non-rewritable R
A second microcomputer having an OM mounted therein, and an encryption algorithm for encrypting a sum value of the nonvolatile memory is stored in a ROM of the second microcomputer. That is, by arranging the encryption algorithm of the sum value in the ROM of the non-rewritable second microcomputer, the unauthorized modification prevention is further enhanced.

In the fifth aspect of the present invention, in order to realize the second step, the sum value of the nonvolatile memory is transmitted from the first microcomputer to the second microcomputer. Step and second
After the microcomputer has encrypted the sum value with the encryption algorithm in the ROM, the microcomputer may return the encrypted data to the first microcomputer.

[0013]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS (First Embodiment) In a first embodiment of the present invention, an E controlling the engine control and the like is provided.
The CU constitutes an onboard control unit, and this ECU
, An external tool is connected to the ECU to perform inspection of the ECU, exchange of data, and the like. Hereinafter, the details will be described with reference to the drawings.

FIG. 1 is a block diagram showing a schematic configuration of the control system. In this system, the ECU 10 is a well-known microcomputer (hereinafter referred to as a microcomputer) 1.
The microcomputer 11 performs various controls of the engine using a control program prepared in advance. The microcomputer 11 includes a CPU 12 serving as a center of various controls, a flash memory 13 that can be electrically erased and written, and a RAM and an input / output circuit (not shown).

Similarly, the external tool 20 includes a well-known microcomputer 21 including a CPU, a memory, an input / output circuit, and the like. The external tool 20 is connected to the ECU 10 via the communication line L1 when checking whether the ECU 10 is correct or false or when rewriting data in the flash memory 13 in the ECU 10. As a result, data is exchanged between the ECU 10 and the external tool 20 by serial communication.

The outline of the true / false judgment (inspection) of the ECU 10 is as follows.
This will be described with reference to FIG. In such a case, the sum value of the data in the flash memory 13 is compared with a known correct sum value, and if they match, the ECU 10 is determined to be legitimate. At this time, on the external tool 20 side, a random number is generated and transmitted to the ECU 10, while a random number is generated.
On the 10 side, the sum value is encrypted using an encryption algorithm stored in advance therein and transmitted to the external tool 20. Note that, in FIG. 2, in order to represent the processing order, serial numbers (1) to (6) are assigned.

First, a sum value calculation command and a random number Rt are calculated.
Is transmitted to the external tool 2 via the communication line L1.
It transmits from 0 to the ECU 10 ((1) in the figure). At this time, the transmission data of the external tool 20 is, for example, as shown in FIG.
The transmission header is composed of a transmission source ID, a transmission destination ID, and a command code, and the data is composed of a transmission data ID, a random number, and a checksum (CS) of the transmission data. I have.

On the ECU 10 side, the flash memory 13
The sum value Xsum of the data within is calculated, and the sum value Xsum is calculated according to the random number Rt using a predetermined encryption algorithm.
The sum is encrypted ((2), (3) in the figure). That is,
An encrypted sum value Xt (hereinafter referred to as an encrypted sum value Xt for convenience) is calculated by a calculation formula Xt = f (Xsum, Rt).

Thereafter, the encrypted sum value Xt is transmitted to the external tool 20 via the communication line L1 ((4) in the figure). At this time, the received data of the external tool 20 is, for example, as shown in FIG.
(B), the transmission header is composed of a transmission source ID, a transmission destination ID, and a command code, and the data is a transmission data ID, encrypted data, and a checksum (CS) of the main transmission data. It consists of.

In the external tool 20, the encrypted sum value Xt is decrypted by the calculation formula Xsum = f-1 (Xt, Rt), and the sum value Xsum is calculated.
Is calculated ((5) in the figure). Thereafter, the sum value Xsum calculated as described above and the pre-registered true sum value Xsum
ref is compared ((6) in the figure). If they match, the ECU 10 is determined to be a legitimate ECU, and if they do not match, the ECU 10 is determined to be a fake ECU.

Hereinafter, the ECU 1 using the external tool 20 will be described.
The flow of processing executed by the microcomputer 10 and the microcomputers 21 and 21 in the ECU 10 and the external tool 20 at the time of determining whether the value is 0 will be described with reference to the flowcharts of FIGS. First, the flow of processing of the external tool 20 will be described with reference to the flowchart of FIG.

For example, when the operator operates the external tool 20 at a repair shop or the like, the processing shown in FIG. 3 starts.
In step 102, a command is transmitted. That is, the random number Rt is transmitted to the ECU 10 together with the sum value calculation command. In step 103, a timer is set. Steps 101 to 103 correspond to pre-communication processing.

Thereafter, the external tool 20 confirms reception of the command from the ECU 10. In other words, on condition that a timeout has not occurred (NO in step 104), in step 105, step 1
It is determined whether a response to the 02 command transmission has been received from the ECU 10. If a timeout occurs without a response (YES in step 104), the process returns to step 102, and the command is transmitted again using the same random number.
Then, the timer setting and reception confirmation processes are performed again.

If the number of command retransmissions is limited in advance, for example, if the timeout is repeated three times, it is determined that a communication error has occurred, a code to that effect is stored, and the subsequent processing is stopped. good. Further, if a timeout occurs even once, a communication error may be determined at that time.

When a response to the command transmission is received,
Proceed to step 106 to perform the subsequent post-reception processing.
That is, in step 106, the encrypted sum value Xt received from the ECU 10 is decrypted, and raw data of the sum value Xsum is extracted. In step 107, a true sum value Xref registered in advance is extracted.

Thereafter, at step 108, the sum value Xs
um (raw data) and the true sum value Xref are compared, and if it is determined that both sum values match (step 109 is Y
ES), it is determined that the ECU is normal.

If the two sum values do not match (NO in step 109), it is determined in step 110 whether communication has been repeated a predetermined number of times. If NO, the process returns to step 101. Thereby, another random number is reset, and the above-described processing is repeatedly performed. And
If the sum value does not match even if the resetting of the random number and the sum value judgment process accompanying it are repeated a specified number of times (for example, three times), step 110 becomes YES and EC
It is determined that there is a U abnormality.

Next, the processing flow of the ECU 10 will be described with reference to the flowchart of FIG. First, in step 201, it is determined whether or not a command has been received from the external tool 20, and if YES, the process proceeds to step 202, where a random number Rt is extracted from the received data.

Thereafter, in step 203, a sum value Xsum is calculated by the calculation formula Xsum = ΣData (i). That is, all the data of the address i is added to the specified address area in the flash memory 13, and the sum is added to the sum value Xsu
m.

Then, in step 204, the sum value Xsum is encrypted with the received random number Rt to obtain an encrypted sum value Xt. In the following step 205, the encrypted sum value Xt is calculated.
t is transmitted to the external tool 20. By this data transmission, the external tool 20 confirms the data reception in step 105 of FIG.

In this embodiment, step 1 in FIG.
The processing of 01 and 102 is the “first step” of the present invention.
The processing in steps 203 and 204 in FIG. 4 is referred to as “second step”, the processing in step 205 in FIG. 4 is referred to as “third step”, and the processing in steps 106 to 109 in FIG.
Step ".

According to the embodiment described above, the following effects can be obtained. That is, according to the inspection method of the ECU 10, the possibility that the correct sum value (the calculated sum value Xsum) is leaked to a person who intends to perform unauthorized remodeling is reduced. Also, if the legitimate ECU 10 is tampered with,
The correct sum value of the flash memory 13 is stored in the external tool 20
Even if an unauthorized program that can reply to the side is incorporated in the fake ECU, the external tool 20 receives the encrypted data and decrypts the encrypted data.
Since the comparison of the sum values is performed, it is extremely difficult to impersonate the illegally modified ECU as a legitimate ECU. As a result, it is possible to correctly inspect the ECU 10 and to prevent unauthorized modification.

If the sum values do not match, a new random number R
Since the re-examination is performed by setting t, even if the inspection is not performed correctly due to a temporary communication abnormality, an appropriate inspection can be performed by the re-communication. Here, since the transmission / reception data between the ECU 10 and the external tool 20 is different each time in order to reset the random number Rt, a correct sum value can be leaked even if it is assumed that the communication line L1 is monitored. Sex is extremely low.

(Second Embodiment) Next, a second embodiment of the present invention will be described. However, in the present embodiment, those that are the same as those in the above-described first embodiment will be described in a simplified manner, and the description will focus on differences from the first embodiment.

In the first embodiment, although the possibility of unauthorized alteration is extremely low, if an encryption algorithm is leaked to an unauthorized alterator, unauthorized alteration is possible. As a countermeasure, this embodiment proposes a method in which a plurality of encryption algorithms (calculation formulas) are prepared, and an external tool 20 indicates which algorithm is to be used. In this embodiment, the configuration shown in FIG. 1 is used as it is as the control system.

The outline of the true / false judgment (inspection) of the ECU 10 in the present embodiment will be described with reference to FIG. FIG. 6
In order to indicate the processing order, serial numbers (1) to (8) are assigned.

First, a sum value calculation command and a random number R
and the transmission data including the identification code ID of the encryption algorithm from the external tool 20 via the communication line L1.
It is transmitted to U10 ((1) in the figure). At this time, the transmission data of the external tool 20 has a configuration in which, for example, an identification code ID of an encryption algorithm is added as data to the frame configuration of FIG.

On the ECU 10 side, the flash memory 13
In addition to calculating the sum value Xsum of the data in the data, the corresponding encryption calculation formula is extracted based on the identification code ID of the encryption algorithm included in the transmission data from the external tool 20 ((2), ( 3)). Further, the sum value Xsum is encrypted according to the random number Rt using this calculation formula ((4) in the figure). That is, the encrypted sum value Xt is calculated by the calculation formula Xt = f (Xsum, Rt). Here, as shown in the figure, the encryption ID is 0x01, 0x02,.
When given as F, the corresponding calculation formula is f
(*, *), G (*, *),... T (*, *), and the sum value Xsum is encrypted using any one of these formulas. Thereafter, the encrypted sum value Xt is transmitted to the external tool 20 via the communication line L1 ((5) in the figure).

The external tool 20 takes out a calculation formula for decryption corresponding to the identification code ID of the encryption algorithm at that time, and decrypts the encrypted sum value Xt using the calculation formula ((6), (6) in FIG. 7)). That is, the sum value Xsum is calculated by the calculation formula Xsum = f-1 (Xt, Rt).

Thereafter, the sum value Xsu calculated as described above is obtained.
m is compared with a pre-registered true sum value Xref ((8) in the figure). And if they match,
The ECU 10 determines that the ECU is a legitimate ECU, and if they do not match, determines that the ECU 10 is a fake ECU.

Hereinafter, the ECU 1 using the external tool 20 will be described.
The flow of processing executed by the microcomputer 10 and the microcomputers 21 and 21 in the ECU 10 and the external tool 20 when determining the true / false of 0 will be described with reference to the flowcharts of FIGS.

First, the processing flow of the external tool 20 will be described with reference to the flowchart of FIG. However, FIG.
Is actually changed only in that steps 301 and 302 are added to FIG. 3 itself. Hereinafter, the description will focus on the differences from FIG.

In FIG. 7, after the random number generation processing, in step 301, one of a number of encryption algorithms is selected. In the following step 102, the identification code ID of the encryption algorithm is transmitted to the ECU 10 together with the random number Rt and the sum value calculation command.

Thereafter, when the reception confirmation from the ECU 10 is completed, in step 302, a calculation formula for decryption corresponding to the identification code ID of the encryption algorithm is extracted. Thereafter, as described above with reference to FIG. 3, decryption of the encrypted sum value Xt, comparison determination with the true sum value Xref, and the like are performed.
The true / false judgment of the CU 10 is performed.

Next, the processing flow of the ECU 10 will be described with reference to the flowchart of FIG. The process of FIG. 8 is performed in place of the process of FIG. In FIG. 8, the external tool 20
When it is determined that a command has been received from the server, step 401
From the received data to the random number Rt and the identification code ID of the encryption algorithm (algorithm N
o. ) And extract.

Thereafter, in step 403, all the data of the address i are added to the specified address area in the flash memory 13, and the sum is added to the sum value Xsu.
Calculate m.

Thereafter, in step 404, the designated encryption algorithm is extracted, and in step 405,
The sum value Xsum is encrypted to obtain an encrypted sum value Xt. In step 406, the encrypted sum value Xt is transmitted to the external tool 20. By this data transmission, the external tool 20 confirms the data reception in step 105 of FIG.

In the present embodiment, as a difference from the first embodiment, the processing of step 301 in FIG. 7 is included in the “first step”, and the processing of step 302 is “the fourth step”. Steps ". Further, the processing of steps 402 to 405 in FIG. 8 corresponds to “second step”, and the processing of step 406 corresponds to “third step”.

As described above, according to the second embodiment, by using a plurality of encryption algorithms alternatively, even if the encryption algorithm is known to a person who intends to perform unauthorized alteration, the encryption algorithm is not actually used. It is very difficult to determine the sum value corresponding to the encryption algorithm used. Therefore, EC
Unauthorized modification of U10 can be made even more difficult. Further, in this case, even if each encryption algorithm is simple, it becomes difficult for an illegally modified person to recognize the algorithm and perform an illegal act such as passing both the illegally modified person through a vehicle inspection.

(Third Embodiment) Some ECUs requiring complicated control are provided with a plurality of microcomputers (CPUs) in order to distribute a high calculation load.
For example, a two-microcomputer system EC with two microcomputers
In U, the above-mentioned flash memory is mounted, and a microcomputer on the main side that is in charge of main control of the engine, and a ROM in which the control program is not rewritable in the market, are mounted.
It may be composed of a sub-side microcomputer that performs control other than the main control.

FIG. 9 is a configuration diagram showing an outline of the control system in the present embodiment. In the configuration of FIG. 9, the ECU 30 includes a first microcomputer (first microcomputer) 31 and a second microcomputer (second microcomputer) 32 as a difference from the configuration of FIG. The first microcomputer 31 is a microcomputer that performs main control of the engine such as fuel injection control and ignition timing control, and includes a CPU 31a and a flash memory 31b. The second microcomputer 32 is a microcomputer that performs transmission control and the like, and has a CPU 32a and a ROM 32b whose program cannot be rewritten in the market.

The ECU 30 of such a two-microcomputer system
In the ROM 32b of the second microcomputer 32, an encryption algorithm used to determine whether the first microcomputer 31 is authentic is stored.

FIG. 10 shows the processing of the first microcomputer 31 and the second processing.
4 is a flowchart showing the processing of the microcomputer 32 individually. First, the flow of processing of the first microcomputer 31 will be described with reference to FIG.

In FIG. 10A, when it is determined that a command has been received from the external tool 20, the process proceeds from step 501 to step 502, where a random number Rt is extracted from the received data. Thereafter, in step 503, the flash memory 3
All the data of the address i are added to the specified address area in 1b, and a sum value Xsum is calculated from the sum. Thereafter, in step 504, the received random number Rt and the calculated sum value Xsum are transmitted to the second microcomputer 32.

In the following step 505, the second microcomputer 3
It is determined whether or not data has been received from the second microcomputer 32 in response to the data transmission to the second microcomputer 32. The received data includes an encrypted sum value Xt encrypted by the second microcomputer 32.
After confirming data reception, step 5
At 06, the encrypted sum value Xt is transmitted to the external tool 20. By this data transmission, the external tool 20 confirms the data reception in step 105 of FIG.

Next, the processing flow of the second microcomputer 32 will be described with reference to the flowchart of FIG. FIG.
In FIG. 10B, data transmission in step 504 of FIG. 10A is involved, and if it is determined that data has been received from the first microcomputer 31, steps 601 to 60 are performed.
Proceeding to 2, the random number Rt and the sum value Xsum are extracted from the received data. Thereafter, in step 603, the ROM 32
Using a predetermined encryption algorithm prepared in b, the sum value Xsum is encrypted to obtain an encrypted sum value Xt. In the following step 604, the encrypted sum value Xt is transmitted to the first microcomputer 31. As a result of this data transmission, the first microcomputer 31 executes step 50 in FIG.
At 5, the data reception is confirmed. And furthermore
This data is transmitted to the external tool 20.

Note that the present embodiment differs from the first embodiment in that steps 503 and 503 in FIG.
The processing in step 504 and step 603 in FIG. 10B correspond to “second step”, and the processing in step 506 in FIG. 10A corresponds to “third step”.

According to the third embodiment, since the encryption algorithm is stored in the ROM 32b of the second microcomputer 32, it becomes impossible to illegally rewrite the encryption algorithm, thereby further preventing unauthorized modification. Is done.

In the third embodiment, the predetermined encryption algorithm is stored in the ROM 32b of the second microcomputer 32. However, this configuration may be changed. For example, as in the above-described second embodiment, a plurality of encryption algorithms are stored in the ROM 32b of the second microcomputer 32, and the plurality of encryption algorithms are stored in accordance with the identification code specified by the external tool 20. It is good also as composition which selects one from among them.

In the third embodiment, the random number Rt transmitted from the external tool 20 is once received by the first microcomputer 31 and thereafter, the random number Rt is transmitted to the second microcomputer 32 together with the sum value.
Was transferred from the external tool 20 to the second
A configuration in which the data is directly transmitted to the microcomputer 32 may be adopted.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a schematic configuration of a control system according to an embodiment of the present invention.

FIG. 2 is an explanatory diagram showing a state of true / false judgment of the ECU.

FIG. 3 is a flowchart showing the flow of processing of an external tool.

FIG. 4 is a flowchart showing a flow of processing of the ECU.

FIG. 5 is a diagram showing a frame configuration of transmission data and reception data.

FIG. 6 is an explanatory view showing a state of an authenticity determination by an ECU in the second embodiment.

FIG. 7 is a flowchart illustrating a flow of processing of an external tool according to the second embodiment.

FIG. 8 is a flowchart illustrating a flow of processing of an ECU according to the second embodiment.

FIG. 9 is a block diagram illustrating a schematic configuration of a control system according to a third embodiment.

FIG. 10 is a flowchart showing a flow of processing of a first microcomputer and a second microcomputer in the third embodiment.

[Explanation of symbols]

10: ECU, 11: microcomputer, 12: CPU, 13 ...
Flash memory, 20: external tool, 30: ECU,
31: first microcomputer, 31b: flash memory, 32
... second microcomputer, 32b ... ROM.

Continued on the front page (72) Inventor Chizuru Aoki 1-1-1 Showa-cho, Kariya-shi, Aichi F-term in DENSO Corporation (Reference) 5B048 AA14 CC02 DD06

Claims (6)

[Claims] An inspection method of an on-vehicle control unit for obtaining a sum value of data from a memory in an on-vehicle control unit and inspecting the control unit based on the sum value, generates a random number, and instructs the random number to calculate a sum value. A second step of calculating a sum value of the memory and encrypting the sum value in accordance with the random number, and transmitting the encrypted data to an external device. A third step of transmitting the data to the tool, decoding the data received by the external tool, comparing the sum value in the data with a true sum value prepared in advance, and, based on the result of the comparison determination, the onboard control unit. And a fourth step of inspecting the vehicle-mounted control unit. 2. The method according to claim 1, wherein the memory in the on-vehicle control unit is an electrically rewritable nonvolatile memory. 3. If the sum values do not match in the fourth step, the procedure returns to the first step, a new random number is set, and the subsequent second to fourth steps are performed again. 3. The inspection method of the vehicle-mounted control unit according to 1 or 2. 4. A plurality of encryption algorithms are prepared in a vehicle control unit in advance, and in the first step, one of a plurality of encryption algorithms is designated and identification data representing the one is designated by a random number. And a command to calculate the sum value from the external tool to the control unit. In the second step, encryption is performed using an encryption algorithm specified by the identification data. Thereafter, in the fourth step, 3. A sum value is extracted by extracting a decryption calculation formula corresponding to the designated encryption algorithm, decrypting the received data, and extracting a sum value.
Inspection method of the in-vehicle control unit according to 1. 5. The on-vehicle control unit includes a first microcomputer mounted with an electrically rewritable nonvolatile memory and a second microcomputer mounted with a non-rewritable ROM.
5. The inspection method for a vehicle-mounted control unit according to claim 1, wherein an encryption algorithm for encrypting a sum value of the nonvolatile memory is stored in the OM. 6. The inspection method for a vehicle-mounted control unit according to claim 5, wherein the second step includes transmitting a sum value of the nonvolatile memory from the first microcomputer to the second microcomputer. (B) encrypting the sum value with the encryption algorithm in the ROM by using the microcomputer, and returning the encrypted data to the first microcomputer.