JP2019105946A - In-vehicle updating apparatus, program, and method of updating program or data - Google Patents

Abstract

To provide an in-vehicle updating apparatus, or the like, configured to prevent leakage of a decoded program and update a program of an in-vehicle ECU.SOLUTION: An in-vehicle updating apparatus configured to execute processing for updating a program or data of an in-vehicle ECU includes: an acquisition section which acquires a concealed program or data; a first storage section which stores the program or data acquired by the acquisition section; a decoding section which decodes the program or data read from the first storage section; a volatile second storage section which stores the decoded program or data; and a transmission section which transmits the decoded program or data stored in the second storage section to the in-vehicle ECU.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an onboard update device, a program, and a method of updating a program or data.

  In updating the program of the in-vehicle ECU that controls the in-vehicle device, the relay device performs the program update by communicating with the server that transmits the program, receiving the program, and transmitting the received program to the in-vehicle ECU. Are known.

  At the time of reception of the program of the on-board ECU, it is desirable to encrypt the received program from the viewpoint of preventing information leakage regarding the program. The received encrypted program is decrypted by the device on the receiving side, and the decrypted program is in the state of plaintext, and the content of the program can be referred to.

  In order to cope with this, the information processing apparatus of Patent Document 1 applies an access restriction to a storage device in which a decoded program is stored, and a retrieval control unit for restricting the extraction of the decrypted program from the apparatus. Have.

JP 2003-173215 A

  However, although the information processing apparatus of Patent Document 1 is provided with the retrieval control means, the decrypted program is stored in the non-volatile storage medium. Therefore, by optically observing the storage medium or directly probing the internal bus of the storage medium, the decoded program may be illegally obtained. In particular, during the process of updating a program, the update is interrupted by, for example, shutting off the power, and the decrypted program is illegally acquired if it is intentionally caused to remain in the storage medium. The risk is even greater.

  The present invention has been made in view of such circumstances, and an object thereof is to provide an on-vehicle updating device and the like capable of updating a program of an on-vehicle ECU while preventing leakage of a decrypted program. Intended to be provided.

  An on-vehicle update device according to an aspect of the present disclosure is an on-vehicle update device that performs processing for updating a program or data of an on-vehicle ECU, and includes an acquisition unit that acquires a concealed program or data; A first storage unit for storing the program or data acquired by the unit; a decryption unit for decrypting the program or data read from the first storage unit; and a volatile second program for storing the decrypted program or data A storage unit, and a transmission unit that transmits the decoded program or data stored in the second storage unit to the on-vehicle ECU.

  A program according to an aspect of the present disclosure is a program that acquires a program or data subjected to concealment processing in a computer, stores the acquired program or data in a first storage unit, and stores the acquired program or data in the first storage unit. Alternatively, the data is decoded, the decoded program or data is stored in the volatile second storage unit, and the processing of transmitting the decoded program or data stored in the second storage unit to the on-vehicle ECU is executed.

  A program or data update method according to an aspect of the present disclosure acquires a program or data subjected to a concealment process, stores the acquired program or data in a first storage unit, and stores the acquired program or data in the first storage unit. The program or data is decoded, the decoded program or data is stored in a volatile second storage unit, and the decoded program or data stored in the second storage unit is transmitted to the on-vehicle ECU.

  According to one aspect of the present disclosure, it is possible to provide an on-vehicle update device or the like that can update the program of the on-vehicle ECU while preventing the decrypted program from leaking.

FIG. 1 is a schematic view showing a configuration of an on-vehicle update system according to a first embodiment. FIG. 1 is a block diagram showing a configuration of an on-vehicle update device and the like according to Embodiment 1. 5 is a flowchart showing processing of a control unit according to the first embodiment. 7 is a flowchart showing processing of a control unit according to the second embodiment. It is a flowchart which shows the process of the control part which concerns on Embodiment 3. FIG.

Description of the embodiment of the present invention
First, the embodiments of the present disclosure will be listed and described. In addition, at least part of the embodiments described below may be arbitrarily combined.

(1) The on-vehicle update device according to an aspect of the present disclosure is a vehicle-mounted update device that performs a process for updating a program or data of an on-vehicle ECU, and an acquisition unit that acquires a concealed program or data A first storage unit for storing the program or data acquired by the acquisition unit; a decryption unit for decrypting the program or data read from the first storage unit; and volatileity for storing the decrypted program or data A second storage unit, and a transmission unit for transmitting the decoded program or data stored in the second storage unit to the in-vehicle ECU.

  In this aspect, since the decoded program or data is stored in the second storage unit by the volatile storage medium, the program or data is stored in the volatile storage medium, for example, when the power of the on-board updating device is shut off. The program or data being stored is erased. Therefore, even if the power is shut off and the updating process is interrupted, leakage of the decrypted program can be prevented by surely erasing the decrypted program or data.

(2) The configuration preferably includes an erasing unit that erases the decoded program or data from the second storage unit after the decoded program or data is transmitted to the on-vehicle ECU.

  In this aspect, after the decrypted program or data is transmitted to the on-vehicle ECU, the decryption unit is provided with an erasure unit that erases the decrypted program or data stored in the second storage unit. It is possible to prevent the program from leaking.

(3) The first storage unit is preferably configured to be non-volatile.

  In this aspect, by using the first storage unit as a non-volatile storage medium, even when the power is shut off and the update processing is interrupted, the decryption processing is performed while the decrypted program or data is erased. The stored program or data can be held. Therefore, when restarting the update processing after the interruption, it is not necessary to acquire the concealed program or data again, and communication cost and processing time for acquiring can be reduced.

(4) The program or data subjected to the concealment processing includes confirmation data for confirming the legitimacy of the program or data, and the decryption unit decrypts the program or data when the decryption unit decrypts the program or data. It is preferable that the program or data be verified based on the data.

  In this aspect, when the in-vehicle update device decrypts the concealed program or data, the in-vehicle update device decrypts the program or data in order to confirm the legitimacy of the program or data based on the confirmation data. The legitimacy of can be compensated. In addition, the process of confirming the correctness of the program or data based on the confirmation data is performed in the storage area of the second storage unit by the volatile storage medium, so that the decrypted program is prevented from leaking be able to.

(5) The concealment process is performed by an encryption process using an encryption key, and the decryption unit preferably decrypts the concealed program or data with a decryption key corresponding to the encryption key.

  In this aspect, since the concealment process is performed by the encryption process using the encryption key, the robustness of the concealed program or data can be improved.

(6) The configuration preferably includes an erasing unit that erases the concealed program or data from the first storage unit after the decrypted program or data is transmitted to the in-vehicle ECU.

  In the present aspect, the storage capacity of the first storage unit is provided because the deletion unit is configured to delete the concealed program or data from the first storage unit after transmitting the decrypted program or data to the on-vehicle ECU. Can be restrained. In addition, it is possible to prevent leakage of the concealed program or data after transmitting the decrypted program or data to the in-vehicle ECU.

(7) The concealed program or data is generated based on difference data between the current program or data already applied to the in-vehicle ECU and the new program or data to be applied this time, and the acquisition unit Further acquires a current program or data from the in-vehicle ECU, and the decoding unit decodes the concealed program or data to generate difference data, and generates the difference data generated; The new program or data is generated based on the data, and the current program or data and the generated new program or data are stored in the second storage unit, and the transmission unit is configured to 2) Replace the new program or data stored in the storage unit with the decoded program or data, and Configuration in which trust is preferable.

  In this aspect, the concealed program or data is generated based on the difference data between the current program or data already applied to the in-vehicle ECU and the new program or data to be applied this time. Or, data leakage can be prevented. Since the concealed program or data is generated based on the difference data, the communication cost and communication traffic for acquiring the concealed program or data can be reduced. Since the current program or data is stored in the volatile second storage unit, it is possible to prevent the current program or data from being erased when the power is shut off or the like and the current program or the like to leak. The new program or data generated by the decoded differential data and the current program or data is stored in the volatile second storage unit, so that the new program or data is prevented from leaking when the power is shut off, etc. be able to.

(8) The program according to an aspect of the present disclosure acquires the program or data subjected to the concealment processing, stores the acquired program or data in the first storage unit, and stores the acquired program or data in the first storage unit Alternatively, the data is decoded, the decoded program or data is stored in the volatile second storage unit, and the processing of transmitting the decoded program or data stored in the second storage unit to the on-vehicle ECU is executed.

  In this aspect, the computer can function as the on-vehicle update device according to one aspect of the present disclosure.

(9) A program or data updating method according to an aspect of the present disclosure acquires a program or data that has been concealed, stores the acquired program or data in a first storage unit, and stores the first storage unit. Decoding the program or data stored in the memory, storing the decoded program or data in the volatile second storage unit, and transmitting the decoded program or data stored in the second storage unit to the on-vehicle ECU .

  In this aspect, storing the decrypted program or data in the volatile second storage unit ensures the decrypted program or data even when the power is shut off and the update process is interrupted. Erasure can prevent the decrypted program from leaking.

Details of the Embodiment of the Present Invention
The present invention will be specifically described based on the drawings showing the embodiments thereof. The on-vehicle updating device 2 according to the embodiment of the present disclosure will be described below with reference to the drawings. The present invention is not limited to these exemplifications, but is shown by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

(Embodiment 1)
Hereinafter, embodiments will be described based on the drawings. FIG. 1 is a schematic view showing the configuration of the in-vehicle update system S according to the first embodiment. The on-vehicle update system S includes the external communication device 1 and the on-vehicle update device 2 mounted on the vehicle C, and the program or data acquired from the program providing device S1 connected via the external network N is mounted on the vehicle C Send to the on-board ECU 3 (Electronic Control Unit).

  The program providing device S1 is, for example, a computer such as a server connected to an outside network N such as the Internet or a public network. The program providing device S1 stores a program or data for controlling the on-vehicle ECU 3 created by a manufacturer or the like of the on-vehicle ECU 3. The program or data is transmitted to the vehicle C as described later, and is used to update the program or data of the in-vehicle ECU 3 mounted on the vehicle C.

  The program or data for update is subjected to concealment processing. The concealing process is, for example, encryption. Alternatively, for updating, by using the difference data between the program or data (current program etc.) already applied to the in-vehicle ECU 3 already mounted on the vehicle C and the program or data to be updated this time (new program) The program or data of may be concealed. The difference data itself may be encrypted.

  The vehicle C is equipped with the outside communication apparatus 1, the in-vehicle updating device 2, and a plurality of in-vehicle ECUs 3 for controlling various in-vehicle devices. The out-of-vehicle communication device 1, the in-vehicle update device 2, and the in-vehicle ECU 3 are communicably connected by the in-vehicle LAN 4.

  FIG. 2 is a block diagram showing the configuration of the on-vehicle update device 2 and the like according to the first embodiment. The on-vehicle update device 2 includes a control unit 20, a first storage unit 21, a second storage unit 22, and an in-vehicle communication unit 23. The in-vehicle updating device 2 is configured to acquire a program or data received from the program providing device S1 by wireless communication from the in-vehicle communication device 1 via the in-vehicle LAN 4 and transmit the program or data to a predetermined in-vehicle ECU 3 ing. The in-vehicle updating device 2 is, for example, a central gateway (CGW) that controls segments of a system of a plurality of in-vehicle ECUs 3 such as a control system, a safety system, and a body system. Alternatively, the on-vehicle update device 2 may be a body ECU that controls the entire vehicle C.

  The control unit 20 is configured by a CPU (Central Processing Unit) or an MPU (Micro Processing Unit) or the like, and reads and executes control programs and data stored in advance in the first storage unit 21 to perform various controls. Processing and arithmetic processing and the like are performed. The control unit 20 functions as a decoding unit and an erasing unit by executing a control program. The control unit 20 functions as an acquisition unit via the outside-vehicle communication device 1 or the in-vehicle communication unit 23. The control unit 20 functions as a transmission unit through the in-vehicle communication unit 23.

  The first storage unit 21 is composed of a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM) or a flash memory, and stores in advance a control program and data to be referred to during processing. is there. The control program stored in the first storage unit 21 may store the control program read from the recording medium readable by the on-vehicle updating device 2. Alternatively, the control program may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the first storage unit 21. The first storage unit 21 stores a decryption key for decrypting the program or data concealed by encryption or the like. For example, a predetermined hash function or the like may be stored in the first storage unit 21 in order to confirm the legitimacy of the acquired program or data. Although the details will be described later, the first storage unit 21 stores the acquired concealed program or data.

  The second storage unit 22 is configured by a volatile memory element such as a random access memory (RAM), and is used as a work area when the control unit 20 performs control processing, arithmetic processing, and the like. Although the details will be described later, the decrypted program or data is temporarily stored in the second storage unit 22.

  The in-vehicle communication unit 23 is an input / output interface using a communication protocol such as CAN (Control Area Network), LIN (Local Interconnect Network) or Ethernet (registered trademark), and the outside-vehicle communication device 1 connected to the in-vehicle LAN 4 It communicates with on-vehicle devices such as on-vehicle ECU 3 mutually.

  The control unit 20, the first storage unit 21 and the second storage unit 22 are distributed to a plurality of in-vehicle devices such as a CGW and a body ECU, and function by communicating with each other and cooperating or cooperating. It may be

  The outside-of-vehicle communication device 1 includes an outside-of-vehicle communication unit 11 and an in-vehicle communication unit 12. The external communication unit 11 is an input / output interface for wireless communication using a mobile communication protocol such as 3G, LTE, 4G or WiFi, and provides a program via an external network such as a public network or the Internet. It communicates with the device S1.

  The in-vehicle communication unit 12 has the same function as the in-vehicle communication unit 23 of the in-vehicle updating device 2 and mutually communicates with the in-vehicle updating device 2 and the like via the in-vehicle LAN 4.

  In the present embodiment, the out-vehicle communication device 1 is a separate device from the in-vehicle update device 2 and these devices are communicably connected by the in-vehicle LAN 4, but the present invention is not limited thereto. The out-of-vehicle communication device 1 may be built in the in-vehicle update device 2 as a component of the in-vehicle update device 2.

  The in-vehicle ECU 3 includes a storage unit 31, a control unit 30, and an in-vehicle communication unit 32. The storage unit 31 is configured by a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM), or a flash memory, and stores the program or data of the on-vehicle ECU 3. This program or data is an object to be updated by the on-vehicle update device 2.

  The control unit 30 is configured by a CPU (Central Processing Unit) or MPU (Micro Processing Unit) or the like, reads out and executes programs and data stored in advance in the storage unit 31 and performs control processing etc. An on-vehicle device including the ECU 3 or an actuator is controlled. Although the details will be described later, the control unit 30 acquires the program or data transmitted from the on-vehicle updating device 2 and updates the program or data from the current program or data stored in the storage unit 31 to the acquired program or data. I do.

  The in-vehicle communication unit 32 has the same function as the in-vehicle communication unit 23 of the in-vehicle updating device 2 and mutually communicates with the in-vehicle updating device 2 and the like via the in-vehicle LAN 4.

  FIG. 3 is a flowchart showing processing of the control unit 20 according to the first embodiment. The control unit 20 of the in-vehicle updating device 2 periodically or non-periodically communicates with the program providing device S1 via the external communication device 1, and the program or data (program etc.) to be updated is prepared in the program providing device S1. If it is, start the following process. Alternatively, the control unit 20 may start the following processing based on the update notification from the program providing device S1 acquired via the external communication device 1.

  The control unit 20 acquires the concealed program and the like (the concealment program and the like) transmitted from the program providing device S1 via the outside-vehicle communication device 1 (S11). The control unit 20 stores the obtained concealment program and the like in the non-volatile first storage unit 21 (S12). Since the concealment program and the like are encrypted, they are stored in the first storage unit 21 in a state in which the content itself of the program and the like can not be referred to.

  The control unit 20 reads the concealment program and the like stored in the first storage unit 21, and decodes the concealment program and the like (S13). The encryption of the concealment program or the like is performed by, for example, a common key method, a public key method, or the like. The control unit 20 performs a process of decoding a concealment program or the like using a secret key corresponding to the common key or the public key stored in the first storage unit 21. The arithmetic processing of decoding by the control unit 20 is performed in the storage area of the volatile second storage unit 22. That is, the control unit 20 uses the storage area of the second storage unit 22 as a work area for performing the arithmetic processing of decoding.

  The control unit 20 completes the decryption of the concealment program and the like, and stores the decrypted program and the like, that is, the program in the plaintext, and the like in the second storage unit 22 (S14). The control unit 20 reads the decrypted program and the like stored in the second storage unit 22 and transmits the read program and the like to the predetermined on-vehicle ECU 3 to be updated via the in-vehicle LAN 4 (S15).

  After completion of the transmission to the on-vehicle ECU 3, the control unit 20 deletes the decrypted program and the like from the second storage unit 22 (S16), and further deletes the concealment program and the like from the first storage unit 21 (S17). The order of deletion of the decrypted program and the like and the concealment program and the like is not limited to this, and the concealment program and the like may be deleted first. Alternatively, a sub process may be generated to simultaneously delete the decrypted program and the like and the concealment program and the like.

  In the present embodiment, the concealment program and the like are received from the program providing device S1 by wireless communication and acquired, but the present invention is not limited to this. For example, the in-vehicle update device 2 and an external device in which an update program is stored May be obtained by wired connection.

  The decrypted program and the like are stored in the volatile second storage unit 22. Therefore, when interruption such as interruption of the power occurs during the program update processing by the on-vehicle updating device 2, the second storage unit The decrypted program stored in 22 is erased. Therefore, even if such an interruption occurs, it is possible to prevent leakage of the decrypted program or the like.

  The arithmetic processing of decoding by the control unit 20 is performed with the storage area on the volatile second storage unit 22 as a work area. Accordingly, temporary data for performing decoding arithmetic processing, for example, a part of a program that has been partially decoded, is stored only in the second storage unit 22 to interrupt power interruption or the like. If it occurs, it will be deleted. Therefore, even a part of the decrypted program can be prevented from leaking.

  Since the concealment program and the like transmitted from the program providing device S1 are stored in the non-volatile first storage unit 21, the concealment program is again concealed from the program providing device S1 even when the program update process is interrupted. It is possible to eliminate the need to receive a communication program and the like, and to reduce the communication cost and the processing time for updating.

  FIG. 4 is a flowchart showing processing of the control unit 20 according to the second embodiment. The control unit 20 of the in-vehicle updating device 2 according to the second embodiment is different from that of the first embodiment in that, when decoding the concealment program or the like, the control unit 20 performs processing to confirm the legitimacy of the program. The following mainly describes the differences. Since the processes of S21 to S22 are the same as the processes of S11 to S12 of the first embodiment, the description will be omitted.

  The control unit 20 reads the concealment program and the like stored in the first storage unit 21 and decodes them in block units (S23). A block is, for example, data divided into predetermined data sizes. Alternatively, upon decoding, the control unit 20 may extract a separator included in a data string in a concealment program or the like, and divide the concealment program or the like into blocks by the unit of the separator.

  The control unit 20 extracts confirmation data included in the decoded block (S24). The confirmation data is, for example, a parity bit or the like indicating the legitimacy of the data with respect to part of the data of the program included in the block. Alternatively, the confirmation data may be a hash value included in the block.

The control unit 20 confirms the legitimacy of the program included in the decoded block based on the extracted confirmation data (S25). The control unit 20 may confirm the correctness of the program based on, for example, parity bits. Alternatively, the control unit 20 may confirm the legitimacy by comparing the hash value extracted from the block with the hash value derived using the hash function stored in the first storage unit 21.

  If it is determined that there is no problem in the legitimacy (S26: YES), the control unit 20 determines whether the block processed this time is the last block (S27), and if it is not the last block (S27: NO), S23 again. Perform loop processing to execute the processing of

  If it is the last block (S27: YES), the control unit 20 stores the decrypted program and the like in the second storage (S28). Since the processes of S29 to S292 are the same as the processes of S15 to S17 of the first embodiment, the description will be omitted.

  If it is determined that there is a problem with the legitimacy (S26: YES), the control unit 20 notifies the program providing device S1 via the external communication device 1 (S261). Further, the control unit 20 may notify the driver or the like of the vehicle C via a notification unit (not shown) provided in the vehicle C. After performing the notification, the control unit 20 deletes the concealment program and the like from the first storage unit 21 (S292).

  In the present embodiment, the concealment program and the like are decoded in block units to check the legitimacy, but the present invention is not limited to this. The control unit 20 may decrypt the concealment program and the like, and confirm the legitimacy of the program or the like for the entire decrypted program or the like.

  In the present embodiment, when there is a problem in the verification of the legitimacy, the update processing is immediately interrupted to notify the program providing device S1, but the present invention is not limited to this. When there is a problem in the verification of the legitimacy, the control unit 20 repeats the process of acquiring the concealment program etc. again or decrypting the concealment program etc. again a predetermined number of times, If the problem in the confirmation continues, the updating process may be interrupted to notify the program providing device S1.

  Since the control unit 20 confirms the legitimacy when decoding the obtained concealed program and the like, the control unit 20 can perform integrity verification of the decoded program and the like.

  If there is a problem in the verification of the legitimacy, there is a concern that the acquired concealment program etc. has been falsified, etc., the update processing is interrupted, and the effect is notified to the program provision device S1 etc. Processing safety can be improved.

  Since the decryption and the arithmetic processing for confirming the legitimacy of the program and the like are performed on the volatile second storage unit 22, the program on the second storage unit 22 and the like is performed when an interruption such as a power interruption occurs. Can be eliminated to prevent it from leaking.

  FIG. 5 is a flowchart showing processing of the control unit 20 according to the third embodiment. The control unit 20 of the in-vehicle updating device 2 according to the third embodiment generates a program (such as a new program) to be transmitted to the in-vehicle ECU 3 based on the acquired differential data and the current program of the in-vehicle ECU 3 The second embodiment differs from the first embodiment in that The following mainly describes the differences.

  The control unit 20 acquires the concealed program and the like (the concealment program and the like) transmitted from the program providing device S1 via the outside-vehicle communication device 1 (S31). The concealment program and the like in the present embodiment are the current program or data (current program or the like) already applied to the in-vehicle ECU 3 and the new program or data (new program or the like) to be applied to the in-vehicle ECU 3 by this update. The difference data is encrypted.

  The control unit 20 stores the obtained concealment program and the like in the first storage unit 21 (S32). The control unit 20 reads the concealment program and the like stored in the first storage unit 21, and decodes the concealment program and the like (S33). The control unit 20 stores, in the second storage unit 22, the difference data that has become plaintext by decrypting the concealment program or the like (S34).

  The control unit 20 is stored in the storage unit 31 of the on-vehicle ECU 3 from the on-vehicle ECU 3 to be updated, acquires a currently applied program or data (current program etc.), and stores it in the second storage unit 22. (S35).

  The control unit 20 generates a program or data (such as a new program) to be applied to the on-vehicle ECU 3 from the difference data stored in the second storage unit 22 and the current program and the like by the current update. Are stored in the second storage unit 22 (S36). The control unit 20 reads the new program and the like stored in the second storage unit 22 and transmits the read new program and the like to the predetermined on-vehicle ECU 3 via the in-vehicle LAN 4 (S37).

  After completing the transmission to the on-vehicle ECU 3, the control unit 20 deletes the difference data, the current program, etc. and the new program, etc. from the second storage unit 22 (S38), and further deletes the concealment program etc. from the first storage unit 21. (S39).

  In the present embodiment, the concealment program and the like further encrypt differential data, but the present invention is not limited to this. The concealment program or the like may be plaintext differential data. In this case, it goes without saying that the process of decoding the concealment program or the like is unnecessary.

  Since the concealment program etc. is difference data between the current program etc. and the new program etc., the program itself to be applied to the in-vehicle ECU 3 can not be generated even if the difference data leaks by any chance. It is possible to improve the security of program update processing using wireless communication.

  The decoded differential data, the current program, etc., and the new program are stored in the volatile second storage unit 22. Therefore, when interruption such as power interruption occurs during the updating process, the second memory is stored. The difference data, the current program and the new program stored in the unit 22 are erased. Therefore, even if such an interruption occurs, it is possible to prevent the leakage of these programs and the like.

  The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is indicated not by the meaning described above but by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

C vehicle S on-board update system S1 program provision device (server)
1 out-of-vehicle communication device 11 out-of-vehicle communication unit 12 in-vehicle communication unit 2 in-vehicle update device (CGW)
20 control unit (decoding unit, acquisition unit, transmission unit, deletion unit)
21 first storage unit 22 second storage unit 23 in-vehicle communication unit 24 recording medium 3 in-vehicle ECU
30 control unit 31 storage unit 32 in-vehicle communication unit 4 in-vehicle LAN
N outside network

Claims (9)

An on-vehicle updating device that performs processing for updating a program or data of an on-vehicle ECU, comprising:
An acquisition unit for acquiring the program or data subjected to the concealment processing;
A first storage unit that stores the program or data acquired by the acquisition unit;
A decoding unit that decodes the program or data read from the first storage unit;
A volatile second storage unit for storing the decrypted program or data;
A transmitting unit that transmits the decoded program or data stored in the second storage unit to the on-vehicle ECU. The in-vehicle update device according to claim 1, further comprising: an erasing unit that erases the decoded program or data from the second storage unit after the decoded program or data is transmitted to the in-vehicle ECU. The on-vehicle update device according to claim 1, wherein the first storage unit is non-volatile. The concealed program or data includes confirmation data for confirming the legitimacy of the program or data,
The in-vehicle updating device according to any one of claims 1 to 3, wherein the decoding unit confirms the legitimacy of the program or data based on the confirmation data when decoding the program or data. . The concealment process is an encryption process using an encryption key,
The on-vehicle update device according to any one of claims 1 to 4, wherein the decryption unit decrypts the concealed program or data using a decryption key corresponding to an encryption key. The erasing unit further comprising: an erasing unit that erases the concealed program or data from the first storage unit after the decoded program or data is transmitted to the on-vehicle ECU. On-board updating device described in The concealed program or data is generated based on difference data between a current program or data already applied to the in-vehicle ECU and a new program or data to be applied this time,
The acquisition unit further acquires a current program or data from the in-vehicle ECU,
The decoding unit decodes the concealed program or data to generate difference data, and generates the new program or data based on the generated difference data and the current program or data.
The current program or data and the generated new program or data are stored in the second storage unit,
The transmission unit is configured to transmit the new program or data stored in the second storage unit to the in-vehicle ECU instead of the decoded program or data. In-vehicle updating device described. On the computer
Get the program or data that has been concealed
Storing the acquired program or data in the first storage unit;
Decrypting the program or data stored in the first storage unit;
Storing the decrypted program or data in the volatile second storage;
A program for executing a process of transmitting the decoded program or data stored in the second storage unit to an onboard ECU. Get the program or data that has been concealed
Storing the acquired program or data in the first storage unit;
Decrypting the program or data stored in the first storage unit;
Storing the decrypted program or data in the volatile second storage;
A program or data updating method for transmitting the decoded program or data stored in the second storage unit to an onboard ECU.

Images