JP2012044355A - Data processor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a data processor capable of contributing to simplification of a process for generating both information for notifying the location of an own vehicle and a key for encrypting the state information of the vehicle.SOLUTION: The state information for a state of a vehicle is input and temporarily stored in a buffer storage part (BFLD), and in response to an occurrence of a prescribed event (TRFA,TMOi), a key (60), partially having own identification information (KOYU) together with location information (PDAT) and time information (TDAT) when the event occurs, is generated and output from a communication interface part (35) to the outside. And if the occurred prescribed event is the first event (TRFA), furthermore, the state information for a prescribed time before and after the event occurrence is encrypted by using the key generated in response to the occurrence of the event so as to be stored in an encryption storage part (CFLD).

Description

  The present invention relates to a data processor mounted on a vehicle and used, for example, to a technique effective when applied to a system-on-chip semiconductor device used for control of a drive recorder.

  A drive recorder for sequentially capturing and storing state data indicating the state of the vehicle, such as an image ahead of the vehicle and vehicle control data, is provided for the purpose of determining the cause when a vehicle accident occurs. .

  In Patent Document 1, vehicle state data relating to a vehicle state is encrypted based on a public key stored in an electronic license plate and written to the drive recorder, and stored in the drive recorder when a vehicle accident occurs. It is described that the occurrence of a situation in which the vehicle state data is tampered with maliciously is prevented.

  In Patent Document 2, it is determined that an accident has occurred when the magnitude of the acceleration of the vehicle exceeds a threshold value, and image data before and after the accident is recorded in a recording unit in association with the position information and time information of the accident. The recorded information is output to the outside in association with an identification number for identifying itself, thereby obtaining useful evidence used for verifying the cause of an automobile accident.

  In Patent Literature 3, an image captured by a vehicle is acquired, the acquired image is encoded, position information and time information at the time of image acquisition are generated, and the encoded image is associated with the position information and the time information. The recorded image is transferred to an external memory card so that it can be submitted to the police.

JP 2004-338607 A JP 2006-231942 A JP 2009-60477 A

  The technique described in Patent Document 1 is a technique that uses a public key for encryption of vehicle state data, and a specific administrator such as the police must manage the public key and the private key. A big burden is imposed.

  Since the technique described in Patent Document 2 transmits encrypted image data to the outside together with the identification data of the accident vehicle, and attempts to use the transmitted image data for investigation of the cause of the accident, the amount of data communication is large. The communication time becomes longer, and depending on the situation of the accident, there is a risk of data deterioration or dropout during communication.

  The technique described in Patent Document 3 is a technique that holds image data indicating the accident occurrence state in a reproducible manner in association with the location and time of occurrence of the accident. Data encryption is the same as in Patent Document 1. It only focuses on public key cryptography.

  Moreover, since the distance that can be traveled by one full charge is shorter for an electric vehicle than for a gasoline vehicle, it is considered that the location and distance of the nearest charging station are sequentially notified to the traveling vehicle. For this purpose, each vehicle needs to notify at least the location of the own vehicle to the management center or the like.

  An object of the present invention is to provide a data processor that can contribute to simplification of processing for generating both information used for notifying the location of a host vehicle and a key used for encrypting vehicle state information. It will be different.

  The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  The following is a brief description of an outline of typical inventions disclosed in the present application.

  In other words, state information related to the state of the vehicle is input and temporarily stored in the buffer memory, and in response to the occurrence of a predetermined event, part of the position information and time information at the time of the event occurrence together with its own identification information A key (in the present specification, simply means key data when written as a key) is generated and output to the outside from the communication interface unit, and if the generated event is the first event, it is further The state information for a predetermined time before and after the occurrence of the event is encrypted using the key generated in response to the occurrence of the event and stored in the nonvolatile storage unit.

  Thereby, the key transmitted from the data processor mounted on the vehicle can be used to determine the location of the vehicle corresponding to the identification information by using the position information and time information included in a part thereof, In addition, when the identification information, position information, and time information included in a part thereof are matched with the accident information, the key is a decryption key for the encrypted state information remaining in the corresponding accident vehicle. Will be available as Since the key is not issued by a predetermined certificate authority as in the public key cryptosystem, the processing and management are simplified for the user who uses the key. Since the key includes information about the time and place of occurrence of the first event, it is difficult for a third party to specify it, and it is not easy to illegally decrypt the encrypted information.

  The effects obtained by the representative ones of the inventions disclosed in the present application will be briefly described as follows.

  That is, it is possible to contribute to simplification of processing for generating both information used for notifying the location of the host vehicle and a key used for encrypting the vehicle state information.

FIG. 1 is a block diagram of a system-on-chip microcomputer shown as an embodiment of a data processor according to the present invention. FIG. 2 is a block diagram of a GPS interface unit focusing on a configuration for extracting position information from GPS format data GFDAT. FIG. 3 is a format diagram illustrating the format of the generated key. FIG. 4 is a flowchart illustrating an operation of latching the position information PDAT. FIG. 5 is a flowchart illustrating the operation of acquiring the vehicle body number in accordance with the ON operation of the ignition switch. FIG. 6 is a flowchart illustrating an operation of acquiring time information TDAT from the real-time clock unit. FIG. 7 is a flowchart illustrating an example of a process for calculating a key and issuing an interrupt request due to the occurrence of a collision event. FIG. 8 is a flowchart of interrupt processing for a collision event executed in response to the interrupt request of FIG. FIG. 9 is a system configuration diagram showing an example of an accident data maintenance system for an automatic operation in which an ECU network includes a microcomputer. FIG. 10 is a flowchart illustrating an operation when a dedicated device is used for accessing the encryption storage unit CFLD. FIG. 11 is a system configuration diagram illustrating an example of a traffic management system for electric self-operation in which an ECU network includes a microcomputer.

1. First, an outline of a typical embodiment of the invention disclosed in the present application will be described. Reference numerals in the drawings referred to in parentheses in the outline description of the representative embodiments merely exemplify what are included in the concept of the components to which the reference numerals are attached.

[1] <Generate and send encryption key in response to event occurrence>
A data processor (1) according to a representative embodiment of the present invention is input from an input interface unit (10, 12, 36) for inputting state information related to a vehicle state and the state information input unit. A buffer storage unit (BFLD) for temporarily storing the state information, an event detection unit (14, 20) for detecting occurrence of a predetermined event, and the event detection unit detecting occurrence of a predetermined event (TRFA) , TNOi), and a key generation unit (17) that generates a key (60) having a part of position information (PDAT) and time information (TDAT) at the time of occurrence of the event together with its own identification information (KOYU) ), An output interface unit (35) for outputting the key generated by the key generation unit to the outside, and the predetermined event detected by the event detection unit is a first event. An encryption unit that encrypts the state information for a predetermined time before and after the occurrence of the event using the key generated in response to the occurrence of the event; An encryption storage unit (CFLD) that stores state information encrypted by the encryption unit.

  As a result, the data processor can transmit a key partially including information indicating the location of the vehicle every time a predetermined event occurs, and if the predetermined event is a further specific first event, in addition to that The state information at the time of the event occurrence can be encrypted with the key and stored.

  The key transmitted from the data processor mounted on the vehicle can be used to determine the location of the vehicle corresponding to the identification information by using the position information and time information included in a part of the key. For example, when the data processor is mounted on an electric vehicle, it is used for notification of a charging point. In addition, the identification information, position information, and time information included in a part thereof are collated with the accident information, so that the key is used as a decryption key for the encrypted state information remaining in the corresponding accident vehicle. Become available. Since the key is not issued by a predetermined certificate authority as in the public key cryptosystem, the processing and management are simplified for the user who uses the key. Since the key includes information about the time and place of occurrence of the first event, it is difficult for a third party to specify it, and it is not easy to illegally decrypt the encrypted information.

[2] <Delete key>
The data processor according to item 1 further includes a storage unit (16) that holds a key generated by the key generation unit, and a key used for the encryption when the encryption unit completes the encryption of the state information. It has a control part (21) erased from the storage part.

  Encrypting the status information using a key requires a considerable amount of time, and during that time, the storage unit that temporarily holds the key is not left as it is, so that the key in the storage unit can be prevented from being misused. be able to.

[3] <Location information acquisition from GPS format data>
The data processor according to Item 2 further includes a GPS format data input unit (11) for inputting GPS format data, and the key generation unit includes position information (including the GPS format data input by the GPS format data input unit). The key is generated using PDAT).

  Accurate position information can be easily obtained with high accuracy, and contributes to improvement of the secure performance of the key.

[4] <Time information acquisition from GPS format data>
In the data processor according to item 3, the key generation unit generates the key using time information included in GPS format data input by the GPS format data input unit.

  Accurate time information can be easily obtained with high accuracy, and contributes to improvement of the secure performance of the key.

[5] <Acquiring time information from the real-time clock section>
The data processor according to item 3 further includes a real-time clock unit (19), and the key generation unit generates the key using time information (TDAT) output from the real-time clock unit.

  Time information can be easily obtained by using the real-time clock unit.

[6] <Time unit of microseconds or less>
In the data processor according to item 5, the time information has a unit of microseconds or less.

  By reducing the time unit, the secure performance of the key is improved.

[7] <Status information; image data of running video>
In the data processor according to item 1, the input interface unit (36) inputs image data of a running image captured by the vehicle camera (4) as the state information.

  The state of the vehicle accident can be accurately left by the traveling images before and after the accident.

[8] <Status information; Sensor information>
In the data processor according to item 7, the input interface unit (12) inputs sensor information (ADAT) output from the acceleration sensor (2) as the state information.

  By making the sensor information from the acceleration sensor to be encrypted, it is possible to infer the scale of the collision from the acceleration value.

[9] <Status information; vehicle control data>
In the data processor according to Item 7, the input interface unit (10) inputs vehicle control data (VDAT, BDAT, HDAT) by the vehicle electronic control unit as the state information.

  By making the vehicle control data to be encrypted, the speed at the time of the accident, the state of the hand operation, and the state of the brake operation can be confirmed.

[10] <Vehicle identification information>
In the data processor according to item 1, the input interface unit (10) inputs a vehicle number (KOYU) unique to the vehicle as the identification information of the vehicle, and the key generation unit includes the vehicle number in the key.
The target vehicle can be easily identified by the vehicle number.

[11] <Output of destination address information>
In the data processor according to item 1, the output interface unit outputs destination address information for transmitting the key together with the key, and the destination address information of the key generated in response to the occurrence of the first event is: This is different from the key destination address information generated in response to the occurrence of another predetermined event.

  It is possible to answer the difference between institutions that receive and use keys generated in response to events.

[12] <Timeout event>
12. The data processor according to item 11, wherein the predetermined event includes an external event when sensor information supplied from outside exceeds a predetermined threshold, a timer event due to a timer timeout (TMOi), and the first event. Is the external event.

  The notification of the key can be performed periodically using the timer timeout event, and the vehicle management center or the like can sequentially grasp the location of the vehicle based on the position information and time information included in a part of the key. For example, when the data processor is mounted on an electric vehicle, the management center can notify the nearest charging point toward the target vehicle.

[13] <Collision event>
In the data processor of item 12, the external event is a collision event caused by sensor information from an acceleration sensor exceeding a predetermined acceleration (TRFA).

  By responding to the collision event, the vehicle information can be encrypted and held in the vehicle as required. If the police data management center has received a key oscillated in response to the event, quickly identify that the key is related to the occurrence of a vehicle accident by the identification code included in the key. In addition to being able to cope with it, accident data can also be fully preserved.

[14] <LSI>
The data processor according to any one of Items 1 to 13 further includes a CPU as the control unit, and is formed on one semiconductor substrate.

  Necessary functions can be integrated into one chip.

2. Details of Embodiments Embodiments will be further described in detail.

  FIG. 1 illustrates a system-on-chip (SoC) microcomputer (MCU) 1 as an embodiment of a data processor according to the present invention. The microcomputer 1 is not particularly limited, but is formed on a single semiconductor substrate such as single crystal silicon by a known CMOS integrated circuit manufacturing technique.

  The microcomputer 1 is not particularly limited, but is used for control of a drive recorder mounted on an automobile. The drive recorder is used for sequentially storing image data photographed by a camera mounted on an automobile and keeping a running record.

  In FIG. 1, the microcomputer 1 includes, for example, a video interface unit (VDOIF) 36 as an input interface unit, an audio interface unit (AUDIF) 37, a memory controller (MCNT) 34, and an output interface as external interface units that interface with the outside. Wireless communication interface unit (RDCMIF) 35 as a unit, vehicle information input interface unit (VINFIF) 10 as an input interface unit, GPS interface unit (GPSIF) 11 as a GPS format data input unit, and sensor interface as an input interface unit Part (SNCIF) 12. These external interface units are connected to the internal bus 40, and information to be interfaced is exchanged between the external interface unit and other internal circuits via the internal bus 40 under the control of the central processing unit (CPU) 21. .

  The memory controller 34 performs memory control of a large-capacity RAM configured by, for example, DDRSDRSAM (Double-Data-Rate Synchronous Dynamic Random Access Memory).

  The video interface unit (VDOIF) 36 receives image data from a camera (CMR) 4 mounted on the automobile. The input image data is temporarily held in the buffer area of the RAM 7 through the memory controller 34 under the control of the direct memory access controller (DMAC) 23, for example, and the held image data is, for example, an image processing circuit (VDO) in units of frames. ) 31 and the compressed image data is stored in the buffer storage unit BFLD of the flash memory (FLSH) 33 which is an example of a rewritable nonvolatile memory. The image data stored in the buffer storage unit BFLD is, for example, data for the past 30 seconds with respect to the latest image data, and data older than that is erased.

  The audio interface unit (AUDIF) 37 inputs the audio signal output from the microphone (MIC) 5. The input audio signal is subjected to audio encoding processing or the like by the audio circuit (AUD) 30.

  The radio communication interface unit (RDCMIF) 35 is connected to a radio communication module (RDCM) 6 configured by, for example, a communication control LSI that performs mobile communication and other communication protocol control. The wireless communication interface unit 35 gives the wireless communication module 6 information to be transmitted by specifying the communication partner with the destination address information.

  A GPU receiver (GPSR) 3 is connected to a GPS (Global Positioning System) interface unit (GPSIF) 11. The GPS receiver 3 receives GPS signals from GPS satellites, and acquires GPS format data including reception position and time information, for example, GPS format data conforming to NMEA (National Marine Electronics Association) -0183. That is, the GPS signal includes time data from the atomic clock mounted on the GPS satellite, satellite orbit information, etc., and the GPS receiver 3 uses the received GPS signal to calculate the time difference between transmission and reception. By multiplying the propagation speed of the radio wave, the distance from the satellite is calculated, and the positions (latitude and longitude) of one point in the space are determined by acquiring the distances from the three GPS satellites. The GPS format data GFDAT acquired by the GPS receiver 3 is supplied to the GPS interface 11 unit.

  The sensor interface unit (SNCIF) 2 is connected to the sensor (SNC) 2. The sensor 2 is, for example, an acceleration sensor or a gyroscope. As a mechanism for knowing the position of the vehicle, a method using a GPS signal from a GPS satellite is fundamental, but since GPS is invalid in a tunnel or the like, an acceleration sensor, a gyroscope, and a vehicle speed signal accompanying the rotation of a tire It is used in combination with self-contained navigation based on such information. Here, the speed sensor is also used for collision detection. ADAT is acceleration data obtained from an acceleration sensor, and JDAT is gyro data such as an orientation obtained from a gyroscope.

  The vehicle information input interface unit (VINFIF) 10 is connected to an in-vehicle network such as a CAN (Controller Area Network). An ECU (Electronic Control Unit) as various electronic control units is connected to the in-vehicle network, and an automobile information input interface includes automobile speed information VDAT, brake operation information BDAT, steering wheel operation information HDAT, etc., which are vehicle control data by the ECU. The data is input to the register REGVI via the vehicle information input interface unit (VINFIF). The CPU 21 stores, for example, a vehicle number, that is, a vehicle body number KOYU unique to the automobile, in the vehicle information register as identification information that is attribute information unique to the automobile.

  The GPS format data GFDAT, acceleration data ADAT, gyro data JDAT, speed information VDAT, brake operation information BDAT, steering wheel operation information HDAT, and vehicle body number input from the external interface units 10, 11, and 12 are controlled by data transfer control of the DMAC 23, for example. The data held temporarily in the RAM 6 is stored in the buffer storage unit BFLD of the flash memory (FLSH) 33 every predetermined time unit. The control data and attribute information stored in the buffer storage unit BFLD are, for example, data for the past 30 seconds with respect to the latest data, and data older than that is erased.

  In addition to the internal bus 40, the CPU 21, a rewritable nonvolatile memory such as a flash memory (FLSH) 33, a timer counter unit (TMR) 20, a real-time clock unit (RTC) 19, an interrupt controller (INTC) 22, direct memory access A controller (DMAC) 23, an encryption unit (CRPT) 32, a key generation unit 13, and the like are connected.

  The CPU 21 performs overall control of the microcomputer 1 by executing a program stored in the program storage unit PFLD of the flash memory 33.

  The direct memory access controller 23 controls data transfer according to the data transfer control condition set by the CPU 21.

  The interrupt controller 22 arbitrates interrupt requests given from inside and outside the microcomputer 1 and gives an interrupt signal INT to the CPU 21. Here, interrupt request signals IRQr and IRQg described later are representatively shown. When the interrupt signal INT is activated, the CPU 21 interrupts execution of the current program, for example, obtains an interrupt factor corresponding to the interrupt request signal from the interrupt controller 22 and branches to execution of an interrupt processing program in response thereto.

  The timer counter unit (TMR) 20 performs a timer count operation according to the setting of the CPU 21. The timeout signal TMOi output from one timer count channel is exemplified as the timeout signal by the timer count operation. The real-time clock unit 19 is used for time management as a clock timer. The minimum unit of time generated by the real-time clock unit 19 is, for example, a microsecond unit.

  The microcomputer 1 has an extended control function of the drive recorder. The extended control function is a function in which the microcomputer 1 generates and transmits a key in response to the occurrence of a predetermined event and performs an accident response process using the key on condition that the additional requirement is satisfied. The extended control function will be described below.

  The extended control function unit 13 is an additional circuit configuration necessary for realizing the extended control function with respect to the existing configuration of the microcomputer 1. The extended function unit 13 includes a collision detection circuit (CLSDT) 14, a register circuit 15, a work memory (WRAM) 16, and a key generation unit (KCGNR) 17.

  The collision detection circuit (CLSDT) 14 receives the acceleration data ADAT input from the sensor interface unit 12, and activates an event signal TRFA for notifying the occurrence of a collision event when the acceleration exceeds a predetermined threshold. In addition to the events focused on by the extended control function, there is a timer vent notified by the activation of the timeout signal TMOi. The collision event and the timer event are examples of predetermined events, and the collision event is an example of a first event.

  The register circuit 15 includes a sensor information register REGSN, a GPS information register REGGP, an automobile information register REGVI, and a real time clock information register REGRT.

  The sensor information register REGSN latches the latest acceleration data ADAT and gyro data JDAT supplied to the sensor interface unit (SNCIF) 2.

  The GPS information register REGGP latches the latest position information PDAT extracted from the GPS format data GFDAT supplied to the GPS interface 11 unit. FIG. 4 illustrates an operation flow for latching the position information PDAT. Although not particularly limited, in order for the GPS interface 11 unit to extract the position information PDAT from the GPS format data GFDAT, the CPU 21 uses the sentence setting register via the bus interface 52 connected to the internal bus 40 as illustrated in FIG. Sentence data indicating the location of the position information PDAT in the GPS format data GFDAT is set in 51, and the position information cutout circuit 53 cuts out the position information PDAT from the GPS format data GFDAT based on the sentence data and outputs it to the GPS information register REGGP. To do.

  The car information register REGVI latches the latest information supplied to the car information input interface unit 10. FIG. 5 illustrates an operation flow for acquiring the vehicle body number KOYU according to the ON operation of the ignition switch.

  The real time clock information register REGRT latches the latest time information TDAT supplied from the real time clock unit 19. FIG. 6 illustrates an operation flow for obtaining time information TDAT from the real-time clock unit 19.

  When the occurrence of a collision event is notified by the activation of the event signal TRFA, or when the occurrence of a timer event is notified by the activation of the timeout signal TMOi, the key generation unit 17 responds to this by registering the register REGSN of the register circuit 15. , REGGP, REGVI, and REGRT, the register information is fetched in a state where the new latching operation is temporarily suppressed, and the key 60 is generated by combining the fetched information. The generated key 60 is not particularly limited, but as illustrated in FIG. 3, the acceleration data ADAT and gyro data JDAT acquired from the sensor information register REGSN, the position information data acquired from the GPS information register REGGP, and the vehicle information register The vehicle body number KOYU acquired from REGKO and the time information TDAT acquired from the real-time clock information register REGRT are included. Other sensor information and data in GPS-mat data may be included. The key 60 generated by the key generation unit 17 is temporarily stored in the work RAM 6.

  When the generation of the key 60 is completed based on the occurrence of the collision event, the key generation unit 17 outputs the interrupt request signal IRQg to the interrupt controller 22, and the interrupt controller 22 outputs the interrupt signal INT to the CPU 21 in response thereto. The interrupt factor is output to the bus 40. In response to the interrupt signal and the interrupt factor, the CPU 20 branches to the execution of the interrupt process for the collision event, and transmits the key 60 generated in response to the occurrence of the collision event, and the flash memory using the key 60 Encryption processing is performed in which the data in the buffer area BFLD 33 is encrypted by the encryption unit 32 and stored in the encryption area CFLD of the flash memory 33. FIG. 7 illustrates a processing flow in which the key 60 is calculated and an interrupt request is made due to the occurrence of a collision event. FIG. 8 illustrates an interrupt processing flow for a collision event executed in response to the interrupt request.

  The transmission processing is not particularly limited, but the CPU 23 loads the key 60 from the work RAM 16 to the wireless communication interface unit 35 according to the interrupt processing program, and addresses the destination such as an accident management center under the jurisdiction of the police. Is output to the wireless communication module 6. The wireless communication module 6 controls transmission of the key 60 to a designated address according to a predetermined protocol such as mobile communication.

  The encryption processing is not particularly limited, but the CPU 23 loads the key 60 from the work RAM 16 to the encryption unit 32 in accordance with the interrupt processing program, and gives an encryption processing command to the encryption unit 32, whereby the encryption unit 32 is a process of encrypting the data in the buffer storage unit BFLD for 30 seconds before and after the occurrence and detection of the collision event and storing them in the encryption area CFLD. According to the present embodiment, since the image data for the past 30 seconds, the control data VDAT, BDAT, HDAT and the vehicle body number KOYU are held in the buffer area BFLD of the flash memory 33 in the buffer storage unit BFLD, the collision event When the encryption process is instructed and the image data for the past 30 seconds already stored in the buffer storage unit BFLD and the control data VDAT, BDAT, HDAT and the vehicle body number KOYU for the past 30 seconds are stored. Are encrypted using the key 60, and the encrypted data is stored in the buffer storage unit CFLD of the flash memory 33. Since the data for 30 seconds after the occurrence of the collision event is sequentially accumulated in the buffer storage unit BFLD, the image data, control data, and attribute data for the next 30 seconds are similarly encrypted using the key 60. The encrypted data is added to the encryption storage unit CFLD and held. The storage of the encrypted data for 30 seconds before and after the collision event and the communication process of the key 60 are finished. Finally, the CPU 21 performs the process of prohibiting the write access to the encrypted area CFLD and deletes the key 60 from the work RAM 16. Ends the interrupt process for the collision event. Prohibition of write access to the encryption area CFLD is not particularly limited, but may be realized by enabling a write access prohibition bit for the encryption area CFLD. Alternatively, the key 60 may be stored in the encryption area CFLD, and once the key is stored, control for not permitting write access may be employed unless data corresponding to the key 60 is input during the write operation. When high confidentiality is ensured for the address of the encryption storage unit, the access prohibition process for the encryption storage unit CFLD may not be adopted.

  When the generation of the key 60 is completed based on the occurrence of the timer event, the key generation unit 17 outputs an interrupt request signal IRQt to the interrupt controller 22, and the interrupt controller 22 outputs an interrupt signal INT to the CPU 21 in response thereto. The resulting interrupt factor is output to the bus 40. In response to the interrupt signal and the interrupt factor, the CPU 20 branches to execution of interrupt processing for the timer event, and performs transmission processing of the key 60 generated in response to the occurrence of the timer event. This transmission process is different from the transmission process in the event of a collision event and is not particularly limited. However, the CPU 23 loads the key 60 from the work RAM 16 to the wireless communication interface unit 35 according to the interrupt processing program, and loads the loaded key 60. Is output to the wireless communication module 6 using a destination such as a support center of an automobile dealer or a traffic management center of an electric car as an address. The wireless communication module 6 controls transmission of the key 60 to a designated address according to a predetermined protocol such as mobile communication. By completing the communication process of the key 60, the interrupt process for the timer event is terminated.

  FIG. 9 shows an example of an accident data maintenance system for an automatic operation having the microcomputer 1 in the ECU network.

  When the microcomputer 1 is mounted on the drive recorder 101 of the automobile 100 and the collision event occurs, the transmission destination of the key by the communication module 6 is the accident management center 102 of the police department, and the accident management center 102 receives the received key. Keep 60. When an accident is inquired to the accident management center 102, the key 60 corresponding to the inquired accident is specified by comparing the location and time of the accident with the position information and time information held by the key 60. be able to. When the key 60 is specified, the accident vehicle is specified from the body number held by the key, the encryption storage unit CFLD of the accident vehicle is accessed, and the accessed encrypted data is decrypted with the key. The decoded image data, control data, etc. are used for accident analysis or proof of accident negligence.

  For access to the encryption storage unit CFLD, a dedicated device illustrated in the flowchart of FIG. 10 may be used. That is, the dedicated device 110 is connected to the microcomputer 1, the key 60 is supplied to the microcomputer 1, and the encrypted data in the encryption storage unit CFLD of the flash memory 33 is accessed and transferred to the dedicated device 110. The transferred encrypted data is decrypted using the key 60 in the dedicated device 110.

  FIG. 11 shows an example of a traffic management system for electric self-operation in which an ECU network includes a microcomputer 1.

  When the microcomputer 1 is mounted on the drive recorder 121 of the automobile 120 and the timer event occurs, the key transmission destination by the communication module 6 is the traffic management center 122 of the electric vehicle, and the traffic management center 122 receives the received key. From 60, information such as the position, time, acceleration, speed, and body number of the vehicle is acquired and used for traffic management. For example, the traffic management center 122 performs a service of transmitting data indicating the location and usage status of a battery charging station in the travelable range from the center 122 to the vehicle. In order to further enhance this service, the reliability of notification of battery charging stations in the driving range is increased by including the remaining battery power or the driving distance by the remaining power in the key 60 generated when the timer event occurs. Is desirable.

  According to the embodiment described above, the following operational effects are obtained.

  [1] The microcomputer 1 can transmit to the outside a key 60 having a part of information indicating the location of the vehicle every time a predetermined event such as a collision event or a timer event occurs. In addition, image information and control information at the time of the event occurrence can be encrypted with the key 60 and stored in the encryption storage unit CFLD. The key 60 transmitted from the microcomputer 1 mounted on the vehicle is used to determine the location of the vehicle corresponding to the identification information such as the vehicle body number by using the position information and time information included in a part thereof. Made possible. For example, when the micro computer 1 is mounted on an electric vehicle, it is used for notification of a reachable battery charging station. In addition, when the vehicle body number, position information, and time information included in a part thereof are collated with the accident information, the key 60 decrypts the encrypted information remaining in the corresponding accident vehicle. It can be used as a key. Since the key 60 is not issued by a predetermined certificate authority as in the public key cryptosystem, the processing and management are simplified for the user who uses the key 60. Since the key 60 includes information on the time and place of occurrence of the collision event, it is difficult for a third party to specify it, and it is not easy to illegally decrypt the encrypted information.

  [2] The key 60 held in the work RAM 16 is not left as it is until the encryption information is generated using the key 60, and is erased at the end of necessary processing. Therefore, the possibility that the key 60 of the work RAM 16 is misused can be prevented.

  [3] Since the position information included in the GPS format data is used as the position information included in the key, accurate position information can be easily obtained with high accuracy, and can contribute to improvement of the secure performance of the key.

  [4] The time information can be easily obtained by generating the time information included in the key using the real-time clock unit. By using time information having units of microseconds or less, the time unit can be reduced, and the secure performance of the key is improved.

  [5] Since the image data of the running video captured by the vehicle camera is subject to encryption, the situation of the vehicle accident can be accurately left by the running video before and after the accident.

  [6] Since the sensor information output from the acceleration sensor is to be encrypted, the scale of the collision can be inferred from the acceleration value.

  [7] Since the vehicle control data from the vehicle electronic control unit is subject to encryption, the speed at the time of the accident, the state of the hand operation, and the state of the brake operation can be analyzed.

  [8] A key notification can be made periodically using a timer time-out event, and a vehicle management center or the like can sequentially grasp the location of the vehicle based on position information and time information included in a part of the key. Become. Since the vehicle information can be encrypted and stored in the vehicle as needed by responding to the collision event, when the police data management center receives the key transmitted in response to the event, With the identification code included in the key, it is possible to quickly grasp that the key is related to the occurrence of a vehicle accident and deal with it, and it is possible to fully maintain accident data.

  Although the invention made by the present inventor has been specifically described based on the embodiments, it is needless to say that the present invention is not limited thereto and can be variously modified without departing from the gist thereof.

  For example, the buffer storage unit and the encryption storage unit may be individual memories or volatile, and may be removable memories, not on-chip.

  Communication processing and encryption processing in interrupt processing for a collision event can be performed in parallel.

  The time information included in the GPS format data may be used as the time information included in the key. This also makes it possible to easily obtain accurate time information with high accuracy, and contributes to an improvement in the secure performance of the key.

  The data processor taking the macro computer 1 as an example is not limited to being a single chip, and may be composed of multiple chips.

  The control data is not limited to VDAT, BDAT, and HDAT, and can be changed as appropriate. Needless to say, the vehicle identification information is not limited to the vehicle body number, and may be other information.

  The present invention can be widely applied to vehicles and ships other than automobiles.

1 Microcomputer (MCU)
36 Video interface unit (VDOIF)
37 Audio Interface Unit (AUDIF)
34 Memory controller (MCNT)
35 Wireless communication interface unit (RDCMIF) as output interface unit
10 Vehicle information input interface (VINFIF) as input interface
11 GPS interface unit (GPSIF) as GPS format data input unit
12 Sensor interface unit (SNCIF) as input interface unit
40 Internal bus 21 Central processing unit (CPU)
33 Flash memory (FLSH)
BFLD buffer storage unit PFLD program storage unit CFLD encryption storage unit GFDAT GPS format data ADAT Acceleration data obtained from acceleration sensor JDAT Gyro data such as bearing obtained from gyroscope VDAT Car speed information BDAT Brake operation information HDAT Handle operation information KOYU Car body number 20 Timer counter part (TMR)
19 Real time clock (RTC)
22 Interrupt controller (INTC)
32 Cryptographic part (CRPT)
13 Key generation unit IRQr, IRQg Interrupt request signal INT Interrupt signal 14 Collision detection circuit (CLSDT)
15 register circuit 16 work memory (WRAM)
17 Key generator (KCGNR)
TMOi Timeout Signal TRFA Collision Event Signal 60 Key 100 Car 101 Drive Recorder 102 Police Management Accident Management Center 120 Car 121 Drive Recorder 122 Electric Car Traffic Management Center

Claims (14)

An input interface unit for inputting state information relating to the state of the vehicle;
A buffer storage unit for temporarily storing the state information obtained from the input interface unit;
An event detector for detecting occurrence of a predetermined event;
In response to detecting the occurrence of a predetermined event by the event detection unit, a key generation unit that generates a key partially including position information and time information at the time of the event occurrence along with its own identification information
An output interface unit for outputting the key generated by the key generation unit to the outside;
In response to the fact that the predetermined event detected by the event detection unit is the first event, the state information for a predetermined time before and after the occurrence of the event is generated in response to the occurrence of the event. An encryption unit that encrypts using
An encryption storage unit for storing state information encrypted by the encryption unit; A key storage unit that holds the key generated by the key generation unit;
The data processor according to claim 1, further comprising: a control unit that deletes the key used for the encryption from the key storage unit when the encryption unit completes the encryption of the state information. A GPS format data input unit for inputting GPS format data;
The data processor according to claim 2, wherein the key generation unit generates the key using position information included in GPS format data input by the GPS format data input unit.   The data processor according to claim 3, wherein the key generation unit generates the key using time information included in GPS format data input by the GPS format data input unit. A real-time clock
The data processor according to claim 3, wherein the key generation unit generates the key using time information output from the real-time clock unit.   6. The data processor according to claim 5, wherein the time information has a unit of microseconds or less.   The data processor according to claim 1, wherein the input interface unit inputs image data of a running image captured by a camera of the vehicle as the state information.   The data processor according to claim 7, wherein the input interface unit inputs sensor information output from an acceleration sensor as the state information.   The data processor according to claim 7, wherein the input interface unit inputs vehicle control data from an electronic control unit of the vehicle as the state information. The input interface unit inputs a vehicle number unique to the vehicle as the identification information of the vehicle,
The data processor according to claim 1, wherein the key generation unit includes the vehicle number in the key.   The output interface unit outputs destination address information for transmitting the key together with the key, and the destination address information of the key generated in response to the occurrence of the first event is the occurrence of another predetermined event. The data processor according to claim 1, wherein the data processor is different from the transmission destination address information of the key generated in response to. The predetermined event is an external event when the sensor information supplied from the outside exceeds a predetermined threshold, and a timer event due to a timer timeout,
The data processor of claim 11, wherein the first event is the external event.   The data processor according to claim 12, wherein the external event is a collision event caused by sensor information from an acceleration sensor exceeding a predetermined acceleration.   The data processor according to claim 2, comprising a CPU as the control unit and formed on one semiconductor substrate.

Images