JP2019066984A - Control device - Google Patents

Abstract

To provide a control device capable of being started at high speed while securing safety by eliminating a secure boot process performed every time of the startup, under a determined condition.SOLUTION: A control device comprises: state information acquisition means 112 for acquiring state information related to control; a first storage area 120 storing control data; a second storage area 121 storing the state information; a third storage area 122 storing an expectation value generated based on data of the first storage area; verification value generation means 114 for generating a verification value based on the data of the first storage area; first determination means 115 for determining whether to perform control means 110 from the expectation value and the verification value; and second determination means 116 for determining whether to perform the first determination means on the basis of the state information. When stopping the control means, the state information is obtained and stored in the second storage area, and before starting the control means, the state information is obtained again, and the second determination means determines whether to perform the first determination means on the basis of the state information at the time of stop and the state information at the time of startup.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a control device that can be activated at high speed while securing security for security.

  A plurality of control devices called ECUs (Electronic Control Units) are mounted on a vehicle, and since the ECUs are connected to other ECUs and communication devices outside the vehicles by communication, there is a possibility that the vehicle may be illegitimately invaded. If it is illegitimately invaded, the program data of the ECU may be falsified and remotely controlled.

  Secure boot is known as one of measures against data alteration of ECU. Secure Boot is a technology that verifies integrity of an expected value created in advance from data using cryptographic technology and a verification value created at that time from data, and detects data tampering. It is possible to determine whether the control can be started in a normal state by verifying whether the data has not been tampered with since the last time before the processing relating to the control of the ECU is started.

  On the other hand, the ECU is severely restricted in start-up time, and the processing time of the secure boot must be within the restriction of the start-up time of the ECU (the required time until control starts). Therefore, in order to start the ECU safely, shortening of the secure boot process time is required.

  In Patent Document 1, in order to solve the above problems, it is determined whether or not a target program or data is a program or data that requires verification, with reference to a stored program list, and verification If the program or data required is the verification of the program or data in question, the scope of verification can be minimized and the secure boot process can be launched safely and quickly.

JP, 2017-33248, A

  However, when the technology of Patent Document 1 is applied, there are the following problems. In the secure boot, when the verification range is minimized, the secure boot process is performed each time the boot is performed, so the processing time is increased, and the processing time is increased compared to the case where the secure boot is not performed.

  The present invention has been made to solve the above problems, and under the determined conditions, the normal boot time in which the secure boot process is not performed by eliminating the secure boot process performed each time the boot is performed. It is an object of the present invention to obtain a control device with an ECU start time close to

  According to the control device of the present invention, the control means needs the control means for controlling the control object, the control start means for controlling the start of the control means, the state information obtaining means for obtaining the state information related to the control, and the control means A first storage area for storing data, a second storage area for storing state information acquired by the state information acquiring means, and a third storage for storing an expected value generated from data of the first storage area It is determined whether to execute the control means from the area and the verification value generation means for generating the verification value from the data of the first storage area, and the verification value by the expectation value and verification value generation means stored in the third storage area And second judging means for judging whether to execute the first judging means from one or more state information, and when the control means is stopped, the state from the state information acquiring means is provided. Get information and make it to the second storage area The second determination means determines whether to implement the first determination means from the state information at the time of stopping and the state information at the time of starting, before obtaining the state of the control means. It is.

  According to the present invention, the processing time of the secure boot performed at startup of the control device is not verified under a specific condition, thereby making the startup time of the control device equal to the normal startup time when the secure boot processing is not performed. Therefore, the ECU can be started safely and at high speed.

この発明の実施の形態１における制御システムの構成を示すブロック図である。 この発明の実施の形態１による制御装置の終了時の処理の流れを示す図である。 この発明の実施の形態１による制御装置の起動時の処理の流れを示す図である。 この発明の実施の形態２における制御システムの構成を示すブロック図である。 この発明の実施の形態２による制御装置の終了時の処理の流れを示す図である。 この発明の実施の形態２による制御装置の起動時の処理の流れを示す図である。

It is a block diagram which shows the structure of the control system in Embodiment 1 of this invention. It is a figure which shows the flow of a process at the time of completion | finish of the control apparatus by Embodiment 1 of this invention. It is a figure which shows the flow of a process at the time of starting of the control apparatus by Embodiment 1 of this invention. It is a block diagram which shows the structure of the control system in Embodiment 2 of this invention. It is a figure which shows the flow of a process at the time of completion | finish of the control apparatus by Embodiment 2 of this invention. It is a figure which shows the flow of a process at the time of starting of the control apparatus by Embodiment 2 of this invention.

  Hereinafter, a control device of the present invention will be described according to each embodiment with reference to the drawings. In each of the embodiments, the same or corresponding parts are indicated by the same reference numerals, and duplicate explanations are omitted.

Embodiment 1
As an example of a control device according to Embodiment 1 of the present invention, FIG. 1 shows a configuration of a vehicle control system in which a starting method capable of starting safely and at high speed is implemented. Here, it is assumed that the vehicle control system includes the motor control device 100 and the drive motor 101 to be controlled. The vehicle control system also includes components other than those shown in FIG. 1, but illustration of components not directly related to the first embodiment is omitted.

  The motor control device 100 is connected to the drive motor 101 to control it. The configuration and function of the motor control device 100 will be briefly described. The control unit 110 calculates control amounts and various processing values related to control of the drive motor 101. The stopping unit 111 ends the operation by stopping the supply of power to the motor control device 100. The state information acquiring unit 112 collects data of state information indicating a state related to control of the motor control device 100 itself. Here, the count value which counting means 117 counts is collected. The control activation unit 113 activates the control unit 110 based on the results of the first determination unit 115 and the second determination unit 116.

  The verification value generation unit 114 generates a verification value from the data stored in the first storage area 120. The first determination unit 115 determines whether to execute the control unit 110 based on the expected value stored in the third storage area 122 and the verification value of the verification value generation unit 114. The second determination means 116 compares the state information (count value) stored in the second storage area 121 with the state information (count value) obtained by the state information obtaining means 112, and the comparison result is predetermined. It is determined whether or not the first determination means 115 is to be implemented depending on whether it is within the range of The counting means 117 increments the counter value held each time the motor control device 100 is activated.

  Here, the motor control device 100 is activated when power is supplied or the control device is reset according to the state of an IG (ignition) switch of the vehicle. The start mode confirmation unit 118 confirms the start mode requested at the time of start. Here, as the start mode, a control mode for controlling the drive motor 101 and a rewrite mode for rewriting data stored in the first storage area 120 and the third storage area 122 are prepared. The request for the rewrite mode is performed when a tester or the like is connected from the outside of the control device. The storage area rewriting means 119 is a means for actually rewriting the data stored in the first storage area 120 and the third storage area 122.

  Next, the first storage area 120 stores data required for control by the control means 110. The second storage area 121 stores the state information acquired by the state information acquiring unit 112. The third storage area 122 stores an expected value generated in advance from data stored in the first storage area 120. Although it is desirable to separate these storage areas for each device, they may be defined as separate areas on one device.

  Next, the flow of processing when the motor control device 100 of the vehicle control system according to the first embodiment is stopped and started will be described using the flowcharts of FIG. 2 and FIG. 3 respectively. The process at the time of stop in FIG. 2 is executed as the last process when the motor control device 100 is stopped with the detection that the IG switch in the vehicle is turned off as a trigger. The process at the time of startup of FIG. 3 is first executed when power is supplied to the motor control device 100 or is reset and started with the IG switch in the vehicle turned on or the like as a trigger.

First, processing when the motor control device 100 is stopped will be described with reference to FIG.
In FIG. 2, step S201 confirms whether the control means 110 has stopped the process concerning motor control. If the control has ended (Yes), the process proceeds to step S202, and if the control has not ended (No), the process waits until the end. Subsequently, in step S202, the state information obtaining means 112 collects the count value held by the counting means 117 as state information. In step S 203, the state information acquisition unit 112 attempts to store the collected count value in the second storage area 121. Subsequently, in step S204, if the storage is completed (Yes), the process proceeds to step S205, and if the storage is not completed (No), the process returns to step S203.
In step S205, the stopping means 111 stops the supply of power to the motor control device 100 to stop the motor control device 100 by controlling a power supply relay or the like.

Next, processing at the time of startup of the motor control device 100 will be described with reference to FIG.
In FIG. 3, in step S301, the counting means 117 updates the count value held by the self. Here, the held count value is assumed to be +1.
In step S302, the start mode confirmation unit 118 confirms the start mode. If it is a control mode for controlling the drive motor 101, the process proceeds to step S303, and if it is a rewrite mode for rewriting data stored in the first storage area 120 and the third storage area 122, the process proceeds to step S310.

In step S303, the state information obtaining means 112 collects the count value held by the counting means 117 as state information. Subsequently, in step S304, if collection of the count value is completed (Yes), the process proceeds to step S305. If collection of the count value is not completed (No), the process waits until completion.
In step S305, the second determination unit 116 compares the count value stored in the second storage area 121 with the count value acquired by the state information acquisition unit 112 in step S202. Subsequently, in step S306, it is determined whether the comparison result of the count value is within the range of +1 as a predetermined value. If it is in the range (Yes), the process proceeds to step S311. If it is not in the range (No), the process proceeds to step S307.

In step S307, the verification value generation unit 114 generates a verification value from the data stored in the first storage area 120. In step S308, the first determination unit 115 compares the expected value stored in the third storage area 122 with the verification value generated in step S307.
Subsequently, in step S309, if the comparison result of the expected value and the verification value is the same (Yes), the process proceeds to step S311. If the comparison result is different (No), the process is ended without implementing the control unit 110. . Steps S307, S308, and S309 are portions requiring a processing time as the secure boot processing.

In step S310, the storage area rewriting unit 119 rewrites the storage data of the first storage area 120 and writes the expected value generated in advance from the data stored in the first storage area 120 in the third storage area 122. Thereafter, the processing is ended without implementing the control means 110. The storage area rewriting unit 119 is not particularly limited because it does not affect the operation and effects of the embodiment.
In step S311, the control activation unit 113 activates the control unit 110.

  As described above, in the configuration of FIG. 1, the motor control device 100 stores the counter value of itself as the state information according to the flow shown in FIG. 2 at the time of stop. After that, when the motor control device 100 is started, it is confirmed whether the difference between the stored counter value and the counter value collected again falls within a predetermined range according to the flow shown in FIG. If it is included, it is determined that the motor control apparatus 100 has not been started up since the termination of the motor control apparatus 100 until the main start, and the processing time is generated (step S307). Step S308) The control means 110 can be activated without carrying out confirmation of the determination result (step S309).

  According to such a vehicle control system, the motor control device 100 is not started due to rewriting or the like during stop by comparison of state information at the time of stop of the motor control device 100 and state information at the time of start, or unintentionally If it can be confirmed that this is not the case, then the verification processing at startup is omitted, so that the control device can be activated at high speed while securing security for security.

  Although the state information is described as the counter value in the first embodiment, the present invention is not limited to this. Even when using analog values such as the voltage value of the battery held for backup that the motor control device 100 holds, by appropriately determining the range at the time of verification used in step S306, it is not unintentionally started during stop Since it is detected that the restart is performed in a short time and the verification process at the time of start is omitted, the control device can be started safely and quickly.

  Also, state information is encrypted when stored in the second storage area 121, and if it is decrypted when comparing state information, the possibility of falsifying the state information itself is reduced and security is enhanced for security. be able to.

Second Embodiment
Next, a control device according to Embodiment 2 of the present invention will be described based on FIG. 4 to FIG.
FIG. 4 shows, as an example of a control device according to Embodiment 2 of the present invention, a configuration of a vehicle control system in which a starting method capable of starting safely and at high speed is implemented. The vehicle control system according to the second embodiment includes a door control device 410 in addition to the vehicle control system including the motor control device 100 and the drive motor 101 described in the first embodiment.
Although each control device 100, 410 in FIG. 4 also includes components other than those shown in FIG. 4, illustration of components not directly related to the second embodiment is omitted, and the embodiment shown in FIG. About what was demonstrated in form 1, the same numerals are attached and explanation is omitted.

In the vehicle control system according to the second embodiment, the motor control device 100 and the door control device 410 are communicably connected to each other via a CAN (Controller Area Network) network 400 as a communication line of the vehicle.
First, the added configuration and functions of the motor control device 100 according to the second embodiment will be briefly described. The data transmission / reception means 401 transmits / receives data to / from the connected door control device 410 via the CAN network 400.

  The door control device 410 is connected to the door module 411 of the vehicle and controls locking / unlocking of the door. The configuration and function of the door control device 410 will be briefly described. The second control means 420 implements control related to the door module 411. The storage area 421 stores data required for control by the second control unit 420. Here, the state detection unit 422 collects the number of times of opening and closing of the door of the driver's seat as state information on the door. However, the state information is not limited to this. The second data transmission / reception unit 423 transmits / receives data to / from the data transmission / reception unit 401 of the motor control device 100 connected via the CAN network 400.

  Next, the flow of processing when the motor control device 100 of the vehicle control system according to Embodiment 2 is stopped and started will be described using the flowcharts of FIG. 5 and FIG. 6, respectively. The process at the time of stop in FIG. 5 is executed as the final process when the motor control device 100 is stopped with the detection that the IG switch in the vehicle is turned off or the like as a trigger. The process at the time of startup of FIG. 6 is first executed when power is supplied to the motor control device 100 or is reset and started with the IG switch in the vehicle turned on or the like as a trigger.

First, processing when the motor control device 100 is stopped will be described using FIG.
In FIG. 5, step S501 confirms whether the control means 110 has stopped the process related to motor control. If the control has ended (Yes), the process proceeds to step S502, and if the control has not ended (No), the process waits until the end.
Subsequently, in step S 502, the status information acquisition unit 112 requests the door control device 410 to send the status information using the data transmission / reception unit 401. Subsequently, in step S503, if reception of the door opening / closing number has been completed as status information (Yes), the process proceeds to step S504, and if reception is not completed (No), the process waits until reception.

In step S 504, the state information acquisition unit 112 attempts to store the number of times of door opening and closing that has been received and collected in the second storage area 121. Subsequently, in step S505, if the storage is completed, the process proceeds to step S506, and if the storage is not completed, the process returns to step S504.
In step S506, the stopping unit 111 stops the supply of power to the motor control device 100 to stop the motor control device 100 by controlling a power supply relay or the like.

Next, processing at the time of startup of the motor control device 100 will be described with reference to FIG.
In FIG. 6, in step S601, the motor control device 100 activates the data transmission / reception means 401. In step S602, the start mode confirmation unit 118 confirms the start mode. If the start mode is a control mode for controlling the drive motor 101, the process proceeds to step S603, and if it is a rewrite mode in which data stored in the first storage area 120 and the third storage area 122 is rewritten, the process proceeds to step S610. .

In step S603, the status information acquisition unit 112 requests the door control device 410 to send the status information using the data transmission / reception unit 401. Subsequently, in step S604, if reception of the door opening / closing number has been completed as status information (Yes), the process proceeds to step S605, and if reception is not completed (No), the process waits until reception.
In step S605, the second determination unit 116 compares the door opening / closing count stored in the second storage area 121 with the door opening / closing count acquired by the state information obtaining unit 112 in step S604. Subsequently, in step S606, it is determined whether the comparison result is within the range of +1 as a predetermined value. If it is in the range (Yes), the process proceeds to step S611. If it is not in the range (No), the process proceeds to step S607.

In step S 607, the verification value generation unit 114 generates a verification value from the data stored in the first storage area 120. In step S608, the first determination unit 115 compares the expected value stored in the third storage area 122 with the verification value generated in step S607.
Subsequently, in step S609, if the comparison result is the same (Yes), the process proceeds to step S611. If the comparison result is different (No), the processing is ended without implementing the control unit 110. Steps S607, S608, and S609 are portions requiring a processing time as the secure boot processing.

In step S 610, the storage area rewriting unit 119 rewrites the storage data of the first storage area 120 and writes the expected value generated in advance from the data stored in the first storage area 120 in the third storage area 122. Thereafter, the processing is ended without implementing the control means 110. The rewriting means is not particularly limited because it does not affect the operation and effects of the embodiment.
In step S611, the control activation unit 113 activates the control unit 110.

  As described above, in the configuration of FIG. 4, at the time of stop, the motor control device 100 stores the door opening / closing number received from the door control device 410 as the state information according to the flow shown in FIG. 5. After that, when the motor control device 100 is started, the stored number of opening / closing times is again compared with the number of opening / closing times of the door received from the door control device 410 according to the flow shown in FIG. If it is within the predetermined range, it is judged that no one is in the vehicle (the control device has not been accessed) since the control device was terminated and the main start, and the processing time is It is possible to activate the control means 110 without performing verification value generation (step S607) where the error occurs, execution of the first determination means (step S608), and confirmation of the determination results (step S609).

  According to such a vehicle control system, by comparing the state information at the time of stopping and the state information at the time of starting, if it can be confirmed that it is not activated for rewriting while stopped or if it is not activated unintentionally Since the verification process at the time of startup is omitted, the control device can be started up at high speed while securing security for security.

  In the second embodiment, the state information is described as the number of times of opening and closing of the door possessed by the door control device 410, but the present invention is not limited to this. By appropriately defining the range at the time of verification used in step S606 using the state information that can show the access to the vehicle possessed by the other control device, it is detected that it is not unintentionally started during stop, and verification processing at startup Can be started safely and at high speed. In addition, it is detected that the restart is performed in a short time by appropriately setting the range at the time of verification used in step S606 using time information etc. possessed by other control devices, and in that case, the security against security is It is possible to start the control device safely and at high speed by omitting the verification process at the time of start-up, which is regarded as secured.

Also, if the state information is encrypted when stored in the second storage area 121 and compounded when comparing the state information, the possibility of falsification of the state information itself is reduced, and security against security is reduced. It can be enhanced.
Furthermore, by encrypting when transmitting / receiving status information and decrypting after reception, the possibility of tampering with status information on the CAN network 400 can be reduced, and security with respect to security can be enhanced.
In the second embodiment, the CAN network 400 is described as the communication line, but the type of network is not limited to this.

  As mentioned above, although the embodiment of this invention was described, this invention is not limited to the embodiment, It is possible to make various design changes, and within the scope of the invention, each embodiment Can be combined freely, and each embodiment can be appropriately modified or omitted.

  The present invention can be used not only as a motor control device of a vehicle control system but also as any verification device of a storage area at start-up as long as it is a system including a control device controlled by an ECU. it can.

  100: Motor control device, 101: Drive motor, 110: Control means, 111: Stop means, 112: State information acquisition means, 113: Control start means, 114: Verification value generation means, 115: First judgment means, 116: second determination means, 117: count means, 118: start mode confirmation means, 119: storage area rewriting means, 120: first storage area, 121: second storage area, 122: third storage area , 400: CAN network, 401: data transmission / reception means, 410: door control device, 411: door module, 420: second control means, 421: storage area, 422: state detection means, 423: second data transmission / reception means .

It is a block diagram which shows the structure of the control system in Embodiment 1 of this invention. It is a figure which shows the flow of a process at the time of completion | finish of the control apparatus by Embodiment 1 of this invention. It is a figure which shows the flow of a process at the time of starting of the control apparatus by Embodiment 1 of this invention. It is a block diagram which shows the structure of the control system in Embodiment 2 of this invention. It is a figure which shows the flow of a process at the time of completion | finish of the control apparatus by Embodiment 2 of this invention. It is a figure which shows the flow of a process at the time of starting of the control apparatus by Embodiment 2 of this invention.

Claims (4)

Control means for controlling a control target, control activation means for controlling activation of the control means, state information obtaining means for acquiring state information related to control, and data required for control by the control means A first storage area, a second storage area for storing state information acquired by the state information acquisition means, and a third storage area for storing an expected value generated from data of the first storage area; Verification value generation means for generating a verification value from data of the first storage area, and whether the control means is to be implemented from the expected value stored in the third storage area and the verification value by the verification value generation means And a second determination unit that determines whether to execute the first determination unit from one or more pieces of status information.
When stopping the control means, the state information is obtained from the state information obtaining means and stored in the second storage area, and the state information is obtained again before the control means is activated, The control device determines whether or not the first determination means is to be implemented from the state information at the time of stop and the state information at the time of start.   The second determination means of the control device determines that the first determination means is not implemented when the difference between the state information at the time of stop and the state information at the time of start is within a predetermined range. The control device according to claim 1, characterized in that   The control device according to claim 1 or 2, wherein the state information obtaining means obtains state information from information in the control device.   The control device is connected to another control device via a communication line, and includes transmission / reception means for performing transmission / reception of data via the communication line, and the state information obtaining means receives state information from another control device by the transmission / reception means The controller according to claim 1, wherein the controller is obtained.

Images