JP2006146583A - Electronic controller and identification code generation method thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent a control program and control data stored in an electronic controller from being illegally rewritten at a high security level. <P>SOLUTION: When a rewriting request of the control program and the control data is requested through an external tool 30 and an identification code request signal is issued from the external tool 30, the electronic controller 10 generates an identification code and responds to the request. Then the electronic controller 10 collates an authentication code generated from the identification code with an authentication code similarly generated and issued by the external tool 30 on the basis of authentication algorithm determined between the electronic controller 10 and the external tool 30 in common and permits the rewriting request under a condition that these authentication codes coincide with each other. Especially in this invention, the identification code is generated as an operation result of a value determined at the issue timing of an identification code acquiring request from the external tool 30 and an inherent security code. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an electronic control device that controls various in-vehicle devices and a method for generating an identification code for an electronic control device that is useful when rewriting a control program of the electronic control device using an external tool.

  In recent years, with the enhancement of functions of vehicles, particularly various in-vehicle devices, for example, electronic control devices that control engine operation, as well as many electronic control devices that control transmissions, air conditioners, lighting devices, doors, mirrors, etc. Installed in the vehicle. Each of these electronic control devices includes a non-volatile memory in which control programs and control data used for control of the control targets are stored in advance, and the control data, sensors, and the like stored in the non-volatile memory By executing the control program using the data fetched through the network, each desired control is performed.

By the way, the control program and control data stored in the non-volatile memory may need to be rewritten as the control program is upgraded or modified. However, if these control programs can be rewritten unconditionally, NOx, HC, CO emissions exceeding legal standards, etc., may cause adverse environmental impacts and reduced vehicle performance due to worsening of emissions. . Therefore, conventionally, in order to cope with such a situation, for example, an electronic control device described in Patent Document 1 has been proposed. In this electronic control device, when there is a request to update the contents of the non-volatile memory through an external tool, an identification code uniquely determined by the timing of the request is returned to the external tool, and the identification code An authentication code is generated according to a predetermined authentication algorithm. Then, the electronic control device collates the unlock code, which is the same authentication code generated and issued according to the same authentication algorithm from the external tool in response to the returned identification code, with the authentication code generated by itself. The update of the contents of the non-volatile memory is permitted on condition that they match. By such verification using the authentication code, unauthorized updating of the contents of the nonvolatile memory can be suitably limited.
JP 2004-51056 A

  By the way, in the conventional electronic control device, when a request for updating the contents of the nonvolatile memory is received from an external tool, an identification code that is uniquely determined by the timing of the request is employed. For this reason, if the request is issued at the same timing, accidentally or intentionally, there is a disadvantage that an identification code having the same content is returned to the external tool. In addition, in the conventional electronic control device, since such timing is specified based on the count value of the free-run counter, identification of the timing is not impossible. And once this identification code is deciphered, the non-volatile memory can be illegally rewritten for all electronic control devices adopting the same algorithm as the authentication algorithm. Social impacts are immeasurable.

  The present invention has been made in view of such circumstances, and an object of the present invention is to provide an electronic control device capable of preventing unauthorized rewriting of the contents of a nonvolatile memory by an external tool with a higher security level, and generation of an identification code thereof. It is to provide a method.

  In order to achieve such an object, in the invention described in claim 1 or claim 6, the control program and control data for controlling the in-vehicle device are stored in a rewritable area of the non-volatile memory, and those through an external tool are stored. When a request for rewriting the control program and control data is issued, an identification code is generated based on the request for obtaining the identification code issued from the external tool and responds to the request, and is defined in common with the external tool. Based on the authentication algorithm, the authentication code created from the identification code is compared with the authentication code created and issued in the same way by an external tool, and the non-volatile memory by the external tool is provided on condition that these authentication codes match. From an external tool as an electronic control device or its identification code generation method Identification code generated based on the issuance of the identification code of the acquisition request, and to be generated as the operation result between the value and the unique security code determined by the timing of the acquisition request of the identification code is issued.

  According to the electronic control device or the identification code generation method having such a configuration, the identification code used in the authentication algorithm is a calculation between a value determined at the timing when the acquisition request for the identification code is issued and a unique security code. Since it is generated as a result, even if the acquisition request timing of the identification code from the external tool is the same as the value determined by the issuance timing, the same identification code, and hence the same authentication code, is generated Such a concern will surely be resolved. For this reason, it becomes possible to prevent unauthorized rewriting of the contents of the nonvolatile memory by an external tool with a higher security level. In addition, the storage location or holding mode of the security code is arbitrary. That is, the security code may be stored in, for example, a part of the storage area of the nonvolatile memory or storage means (including a register) provided separately from the nonvolatile memory, Alternatively, the same code may be generated and held through a connection pattern of a plurality of jumper pins. In addition, the operation content of the value determined at the timing when the identification code acquisition request is issued and the unique security code is arbitrary, for example, normal four arithmetic operations (addition / subtraction remainder) and logical operations (logical sum, logical product, exclusive) Arbitrary operations such as logical OR) can be employed.

In this case, as the unique security code, for example, according to the inventions of claims 2 and 7,
(A) An identification number unique to the vehicle on which the electronic control device is mounted.
Or, according to the inventions of claims 3 and 8,
(B) A number uniquely assigned to each electronic control device when the electronic control device is manufactured.
And so on. Incidentally, even if the timing at which the acquisition request for the identification code is issued is the same, according to the configuration or method of (a) above, a different identification code for each vehicle will be returned from the electronic control unit. Further, according to the configuration or method of (b) above, an identification code different for each electronic control device is returned from the electronic control device. In any case, by using such a number as the unique security code, the secrecy of the identification code generated as the calculation result can be suitably maintained.

  On the other hand, in the electronic control device according to any one of the first to third aspects, as in the invention according to the fourth or ninth aspect, the second or subsequent identification code acquisition request is issued from the external tool. When generating the identification code based on the above, if the previous identification code generated as a result of the operation is used as a new unique security code, the identification code itself is never used again. In addition to confidentiality, the security level of the entire system is greatly improved. In this case, it is desirable that the storage location of the security code is a rewritable storage means including a part of the storage area of the nonvolatile memory described above, a register, and the like.

  In these electronic control devices or their identification code generation method, the value determined at the timing when the acquisition request for the identification code is issued from the external tool, as in the invention according to claim 5 or 10, It is practically desirable to use the count value of the free-run counter. Such a free-run counter is also employed in the above-described conventional system. If the count value of such a free-run counter is used as the above-mentioned value, the security level is improved through a smaller change. The above-described electronic control device and its identification code generation method according to the present invention can be realized.

  Hereinafter, an embodiment in which an electronic control device and an identification code generation method according to the present invention are embodied in an electronic control device mounted on a vehicle, for example, an electronic control device that controls the operation of an in-vehicle engine will be described.

  In the electronic control device according to the present embodiment, various control programs and control data used for operation control of the in-vehicle engine are stored in advance in a nonvolatile memory mounted therein. As is well known, in such an electronic control device, an engine operating state, for example, an ignition timing and a fuel injection amount, is executed by executing a control program using control data and data indicating an operation state captured through various sensors. Etc. are controlled in real time.

  By the way, these control programs and control data may need to be upgraded or modified. In that case, the control program and control data are updated by an external tool. The external tool is electrically connected to various electronic control devices mounted on the vehicle via connectors provided at appropriate locations such as the engine room of the vehicle, and the settings of these electronic control devices. It is a device used when browsing control information, modifying control programs and control data, and updating. In the present embodiment, when the control program and control data executed through such an external tool are corrected and updated, access to the nonvolatile memory is permitted with a higher security level. And illegal rewriting of control data is prevented. Hereinafter, an electronic control device and its identification code generation method capable of preventing such unauthorized rewriting will be described in detail.

FIG. 1 is a block diagram schematically showing the relationship between the electronic control apparatus according to this embodiment and the external tool.
As shown in FIG. 1, an electronic control device 10 (only one is shown for convenience) is mounted on a vehicle 1, and is electrically connected to an external tool 30 via an external bus OB and an interface circuit (I / F circuit) 20. And are communicably connected.

  Here, the external bus OB is configured as a part of an in-vehicle network such as a CAN (Controller Area Network), for example, and a plurality of electronic control devices including the electronic control device 10 can communicate with each other via the external bus OB. It is connected to the.

The interface circuit 20 is a circuit that converts signals exchanged between the external bus OB and the external tool 30 into recognizable signals.
The external tool 30 is electrically connected to the vehicle 1 (more precisely, the interface circuit 20) via a connector or the like when the above-described rewriting of the control program and control data stored in the electronic control device 10 is performed. A device that performs communication with the electronic control device 10 according to a predetermined protocol. Then, on the condition that an access permission is issued from the electronic control device 10, the control program and control data are rewritten. Further, as described above, the external tool 30 also has a function of browsing the various control information for the purpose of setting the electronic control device 10 and countermeasures against errors.

  On the other hand, the electronic control unit 10 includes a control unit 11 mainly composed of a microcomputer, for example, a rewritable nonvolatile memory 12 composed of a flash memory and the like, a free-run counter 13 and the like. They are electrically connected to each other through an internal bus IB connected to OB. For convenience, although illustration in FIG. 1 is omitted, when the electronic control device 10 is a device that controls the operation of the on-vehicle engine, the electronic control device 10 further includes an engine detected through various sensors. A port for taking in data indicating an operation state, a drive circuit for driving an injector and other actuators, and the like are provided.

  FIG. 2 schematically shows a memory map of the nonvolatile memory 12 employed in the electronic control device 10. As shown in FIG. 2, the nonvolatile memory 12 is provided with storage areas in the following manner. That is, in addition to a storage area 121 that stores a download program that communicates with the external tool 30 according to the procedure described below, a storage area 122 that stores a vehicle code of the vehicle 1 as a security code to be described later. A storage area 123 in which the control program and control data are stored is provided. In this embodiment, among these storage areas 121 to 123, only the storage area 123 in which the control program and control data are stored is an area that can be rewritten by the external tool 30. Both of the storage areas 121 and 122 are set so that rewriting of the stored (stored) contents is prohibited.

  FIG. 3 illustrates communication performed in the electronic control device 10 based on the execution of the download program by the control unit 11 when a request for rewriting the control program and control data is issued from the external tool 30. The procedure is shown as a sequence chart. Hereinafter, the operation of the electronic control unit 10 when a program (data) rewrite request is issued from the external tool 30 will be described in detail with reference to FIG.

  Assuming that an identification code request signal, which is a signal for requesting an identification code for authentication (unlocking), is issued from the external tool 30 to the electronic control device 10, the electronic control device 10 performs the process of step S10. In response to this, response processing is executed. This response process is a process of generating an identification code as a calculation result of the count value of the free-run counter 13 at that time and the vehicle code used as the security code in this embodiment. Shown in

  That is, in this response process, as shown in FIG. 4, first, in step S101, the current count value of the free-run counter 13 is obtained as the first parameter, and in step S102, the non-volatile property is obtained as the second parameter. The vehicle code stored in the storage area 122 of the memory 12 is read out. In the subsequent step S103, the first parameter and the second parameter are added to generate an identification code. Thereafter, in step S104, the generated identification code is transmitted (response) to the external tool 30.

  The electronic control device 10 that has responded with the identification code thus generates an authentication code from the generated identification code according to a predetermined authentication algorithm as the processing of step S20 of the sequence (FIG. 3).

  On the other hand, when the external tool 30 receives the identification code returned from the electronic control device 10, the external tool 30 uses the same authentication algorithm as the authentication algorithm executed in the electronic control device 10 as the process of step S30 in the same sequence. An unlock code is generated as an authentication code from the identification code. Then, the generated unlock code is transmitted (issued) to the electronic control device 10.

  The electronic control device 10 that has received the unlock code (authentication code) in this way then performs the processing of step S40, and the unlock code (authentication code) transmitted (issued) from the external tool 30 and the authentication code generated by itself. The matching process is executed. Details of this collation processing are shown in FIG.

  That is, in this collation process, as shown in FIG. 5, first, in step S401, it is determined whether or not the unlock code (authentication code) issued from the external tool 30 matches the authentication code generated by itself. to decide. As a result, if it is determined that the two codes match, a signal to permit access to the storage area 123 of the nonvolatile memory 12 is returned to the external tool 30 in step S402. On the other hand, if it is determined in step S401 that the two codes do not match, a signal indicating that the access is not permitted is returned to the external tool 30 in step S403. If it is determined that the authentication codes do not match in this way, the electronic control apparatus 10 may forcibly block communication with the external tool 30 as the process of step S403.

  In the electronic control device 10, if the authentication codes of both match as the verification processing (FIG. 3) in step S 40, an access permission signal for permitting access to the nonvolatile memory 12 is sent to the external tool 30. respond. On the other hand, if the two authentication codes do not match, an access non-permission signal (indicated by a broken line in FIG. 3) for prohibiting access to the nonvolatile memory 12 is returned to the external tool 30 or communication is cut off. .

  Then, when the access permission signal is returned from the electronic control device 10 through such verification processing, rewriting processing for the control program and control data is started. That is, these control programs and control data are updated. When updating the control program and control data, a known error process such as a checksum may be performed between the external tool 30 and the electronic control device 10.

According to the electronic control device and its identification code generation method of the present embodiment described above, the following effects can be obtained.
(1) The identification code used in the authentication algorithm of the external tool 30 and the electronic control device 10 is generated as a calculation result of the count value of the free-run counter 13 and the vehicle code unique to the vehicle 1. For this reason, even if the identification code request signal is issued from the external tool 30 at the same time as the count value of the free-run counter, the same identification code and hence the same authentication code are not generated. Therefore, the confidentiality as the identification code is suitably maintained, and unauthorized rewriting of the contents of the nonvolatile memory 12 by the external tool 30 can be prevented with a higher security level.

  (2) To generate the identification code, the count value of the free-run counter 13 that is also used in the conventional system is used. For this reason, the above-described security level can be improved through a smaller change.

  Note that the electronic control device and the identification code generation method thereof according to the present invention are not limited to the above-described embodiment, and can be realized as, for example, the following forms obtained by appropriately changing the embodiment.

  In the above embodiment, the vehicle code is adopted as the security code. However, for example, a number that is uniquely assigned to each electronic control device when the electronic control device is manufactured, specifically, a manufacturing number. A production code such as a serial number such as a combination of alphanumeric characters generated with a certain rule can also be adopted as the security code. In this case, the manufacturing code is stored in advance in the storage area 122 of the nonvolatile memory 12 as shown in FIG. Furthermore, a code combining these vehicle code and manufacturing code may be employed as the security code.

  As such a security code, as shown as the non-volatile memory 12a in FIG. 7, the identification code obtained at the previous access from the external tool 30 can be adopted as a new security code each time. That is, in the nonvolatile memory 12a, the storage area 122a is set as a rewritable area by the control unit 11, and the identification calculated when the identification code request signal is issued from the external tool 30 for the second time or later is stored in the storage area 122a. Code will be written. Also, as a download program stored in advance in the storage area 121a, a program for generating an identification code and performing the process in the manner illustrated in FIG. 8 is stored in the response process described above (step S10 in FIG. 3). It will be. That is, as shown in FIG. 8, in step S111, the current count value of the free-run counter 13 is acquired as the first parameter, and in step S112, it is stored in the storage area 122a as the second parameter. Read the previous identification code. In the subsequent step S113, the first parameter and the second parameter are added to generate a new identification code. Thereafter, in step S114, the generated identification code is transmitted (response) to the external tool 30, and in the next step S115, the newly generated identification code is stored (overwritten) in the storage area 122a of the nonvolatile memory 12a. ) If such a code is adopted as the security code, the identification code itself is never used again, so that the security level of the entire system as well as its confidentiality is greatly improved. Become.

  In the above embodiment, the first parameter and the second parameter are added when generating the identification code, but the calculation content is arbitrary. In addition, for example, four arithmetic operations such as subtraction, multiplication, and division, and logical operations such as logical sum, logical product, and exclusive logical sum can be appropriately employed. Further, the identification code may be generated by a combination of these operations.

  -Also, the storage location of the security code is arbitrary. That is, the security code is not limited to a part of the storage area of the non-volatile memories 12 and 12a, but is stored in a storage means provided separately from the non-volatile memory 12, for example, a register included in a microcomputer constituting the control unit 11 May be stored. Further, in cases other than the examples shown in FIGS. 7 and 8, the same code may be generated and held through, for example, a connection pattern of a plurality of jumper pins provided on the circuit board.

  Further, the value determined at the timing of issuing the identification code request signal (identification code acquisition request) from the external tool 30 is not limited to the count value of the free-run counter 13. In addition, for example, a random number generator (random number generation program) may be provided, and a random number generated when the identification code request signal is issued may be adopted as a value determined at this issue timing. The point is that the identification code may be generated as a result of the calculation of the unique security code and the value determined by the issue timing of the identification code request signal from the external tool 30.

The block diagram which shows typically the relationship with an external tool about one Embodiment of the electronic controller concerning this invention, and its identification code production | generation method. The figure which shows typically the memory map of the non-volatile memory employ | adopted as the electronic control apparatus of the embodiment. The sequence diagram which shows the communication aspect between the electronic controller of the embodiment, and an external tool. The flowchart which shows the process sequence about the production | generation of the identification code by the electronic control apparatus of the embodiment, and a response process. The flowchart which shows the process sequence about the collation process by the electronic control apparatus of the embodiment. The figure which shows typically the memory map of the non-volatile memory employ | adopted in the modification of the electronic controller of the embodiment. The figure which shows typically the memory map of the non-volatile memory employ | adopted in the other modification of the electronic control apparatus of the embodiment. The flowchart which shows the process sequence about the production | generation of the identification code by the modification illustrated in FIG. 7, and a response process.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Vehicle, 10 ... Electronic controller, 11 ... Control part, 12, 12a ... Nonvolatile memory, 13 ... Free-run counter, 20 ... Interface circuit, 30 ... External tool.

Claims (10)

A control program and control data for controlling the in-vehicle device are stored in a rewritable area of the nonvolatile memory, and when the control program and control data are rewritten through the external tool, an identification code acquisition request is issued from the external tool. An identification code is generated based on what is issued and responds to it, and the authentication code created from the identification code and the external tool are created in the same way based on the authentication algorithm defined in common with the external tool. In the electronic control device that verifies the authentication code issued and permits the access to the non-volatile memory by the external tool on the condition that the authentication codes match,
An identification code generated based on an issuance of an identification code acquisition request from the external tool is generated as a calculation result of a value determined at a timing when the identification code acquisition request is issued and a unique security code. Electronic control device characterized. The electronic control device according to claim 1, wherein the unique security code includes an identification number unique to a vehicle on which the electronic control device is mounted. The electronic control device according to claim 1, wherein the unique security code is a number uniquely assigned to each electronic control device when the electronic control device is manufactured. When generating an identification code based on a second or subsequent identification code acquisition request from the external tool, the previous identification code generated as the calculation result is used as a new unique security code. 4. The electronic control device according to any one of 3. The electronic control device according to any one of claims 1 to 4, wherein a value determined at a timing when the acquisition request for the identification code is issued from the external tool is a count value of a free-run counter. A control program and control data for controlling the in-vehicle device are stored in a rewritable area of the nonvolatile memory, and when the control program and control data are rewritten through the external tool, an identification code acquisition request is issued from the external tool. An identification code is generated based on what is issued and responds to it, and the authentication code created from the identification code and the external tool are created in the same way based on the authentication algorithm defined in common with the external tool. The identification code is generated in the electronic control device that permits access to the non-volatile memory by the external tool on the condition that the authentication codes are collated and the authentication codes match. A method,
When an identification code acquisition request is issued from the external tool, the identification code is generated as a calculation result of a value determined at a timing when the identification code acquisition request is issued and a unique security code. ID code generation method for electronic control device The identification code generation method for the electronic control device according to claim 6, wherein an identification number unique to a vehicle on which the electronic control device is mounted is used as the unique security code. The method for generating an identification code for an electronic control device according to claim 6, wherein a number uniquely assigned to each electronic control device when the electronic control device is manufactured is used as the unique security code. The generation of an identification code based on a second or subsequent identification code acquisition request from the external tool uses the previous identification code generated as the calculation result as a new unique security code. An identification code generation method for an electronic control device according to any one of the above. The identification code generation method for an electronic control device according to any one of claims 6 to 9, wherein a count value of a free-run counter is used as a value determined at a timing when the acquisition request for the identification code is issued from the external tool.

Images