JP2022083882A - Electronic control apparatus, software authentication method, software authentication program, and electronic control system - Google Patents

Abstract

To provide an electronic control apparatus for ensuring necessary security while preventing delay in processing related to authentication.SOLUTION: In an electronic control system 1, an electronic control apparatus 10 comprises an input unit 101, a software identifying information management unit 102, a storage unit 105, an authentication unit 103, and an output unit 106. The input unit inputs start-up information indicating that software for accessing a sensor apparatus has started. The software identifying information management unit acquires software identifying information for identifying software from the start-up information. The storage unit stores the software identifying information. The authentication unit authenticates the software to access to the sensor apparatus based on the start-up information. The output unit outputs an access request, which is output from the software, to the sensor apparatus.SELECTED DRAWING: Figure 2

Description

The present invention relates to an electronic control device, and mainly relates to an electronic control device for a vehicle, a method realized by the electronic control device, a program that can be executed by the electronic control device, and an electronic control system including a plurality of electronic control devices.

In automobiles, an electronic control system is constructed in which various sensor devices and electronic control devices are connected by an in-vehicle network.

The sensor data acquired by various sensor devices is used by software installed in the electronic control device. Since the sensor data is mainly used for vehicle running and vehicle control, it is conceivable to authenticate each sensor data to ensure safety.

For example, Patent Document 1 describes that when a message is transmitted from an electronic control device, a MAC is generated and transmitted for each message.

Japanese Unexamined Patent Publication No. 2013-98719

Here, the present inventor has found the following problems.
The sensor data generated by the sensor device is data used for traveling the vehicle and controlling the vehicle, but since the sensor device itself does not have an interface with the outside, it is not always necessary to take measures against hijacking. However, since the sensor data also has an aspect of privacy information, it is necessary to prevent the sensor data from leaking to the outside.

Therefore, an object of the present invention is to prevent a delay in processing and to ensure necessary security.

The electronic control device (10) according to one aspect of the present disclosure is
An input unit (101) into which start information indicating that software for accessing the sensor device (13 to 16) has started is input, and an input unit (101).
A software specific information management unit (102) that acquires software specific information that identifies the software from the startup information, and
A storage unit (105) that stores the software specific information, and
An authentication unit (103) that authenticates access to the sensor device of the software based on the activation information, and
It has an output unit (106) that outputs an access request output from the software to the sensor device.

The electronic control device system (1) according to one aspect of the present disclosure is
An electronic control system composed of a sensor device (13 to 16) and an electronic control device (10).
The electronic control device is
An input unit (101) into which start information indicating that the software that accesses the sensor device has started is input, and
A software specific information management unit (102) that acquires software specific information that identifies the software from the startup information, and
A storage unit (105) that stores the software specific information, and
An authentication unit (103) that authenticates access to the sensor device of the software based on the activation information, and
It has an output unit (106) that outputs an access request output from the software to the sensor device.
The sensor device is
The detector (111) that acquires sensor data and
It has a receiving unit (112) for receiving the access request and a transmitting unit (113) for transmitting the sensor data in response to the access request.

The scope of claims and the numbers in parentheses attached to the constituent requirements of the invention described in this section indicate the correspondence between the present invention and the embodiments described later, and are intended to limit the present invention. do not have.

According to the electronic control device, software authentication method, software authentication program, and electronic control system of the present disclosure, it is possible to prevent processing delays and ensure necessary security.

The figure explaining the structure of the electronic control apparatus system of this embodiment. The figure explaining the structure of the electronic control apparatus of this embodiment. The figure explaining the structure of the sensor device of this embodiment. The figure explaining the operation of the electronic control system or the electronic control apparatus of this embodiment. The figure explaining the operation of the electronic control system or the electronic control apparatus of this embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

The present invention means the invention described in the section of the scope of claims or the means for solving the problem, and is not limited to the following embodiments. Further, at least the words and phrases in the brackets mean the words and phrases described in the section of the scope of claims or the means for solving the problem, and are not limited to the following embodiments.

The configurations and methods described in the dependent clauses of the claims are arbitrary configurations and methods in the invention described in the independent clause of the claims. The configurations and methods of embodiments corresponding to the configurations and methods described in the dependent terms, and the configurations and methods described only in the embodiments that are not described in the claims, are arbitrary configurations and methods in the present invention. The configuration and method described in the embodiment when the description of the claims is broader than the description of the embodiment is also an arbitrary configuration and method in the present invention in the sense that it is an example of the configuration and method of the present invention. .. In either case, by describing in the independent clause of the claims, it becomes an essential configuration and method of the present invention.

The effect described in the embodiment is an effect in the case of having the configuration of the embodiment as an example of the present invention, and is not necessarily the effect of the present invention.

When there are a plurality of embodiments, the configuration disclosed in each embodiment is not closed only in each embodiment, but can be combined across the embodiments. For example, the configuration disclosed in one embodiment may be combined with another embodiment. Further, the disclosed configurations may be collected and combined in each of the plurality of embodiments.

The problem described in the problem to be solved by the invention is not a known problem but a problem independently discovered by the present inventor, and is a fact that affirms the inventive step of the invention together with the structure and method of the present invention.

1. 1. Configuration of Electronic Control System 1 An electronic control system 1 including the electronic control device 10 of the present embodiment will be described with reference to FIG. The electronic control device and the electronic control system of the present embodiment are assumed to be an in-vehicle device and an in-vehicle system "mounted" on a vehicle which is a "moving body", but are not limited thereto.

Here, the "moving body" means a movable object, and the moving speed is arbitrary. Of course, it also includes the case where the moving body is stopped. For example, including, but not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and objects mounted on them.
Further, "mounted" includes the case where it is directly fixed to the moving body and the case where it is not fixed to the moving body but moves together with the moving body. For example, it may be possessed by a person in a moving body, or it may be mounted on a cargo placed on the moving body.

The electronic control system 1 is a system composed of a single or a plurality of "electronic control devices" (sometimes referred to as an ECU (Electronic Control Unit)) and a sensor device. The electronic control device and each sensor device are connected via an in-vehicle network such as CAN (Controller Area Network) or LIN (Local Interconnect Network), Ethernet (registered trademark), or a wireless communication network. Hereinafter, these are collectively referred to as a network.

Here, the "electronic control device" is configured as a so-called information processing device, for example, which is mainly composed of a semiconductor device and has a volatile storage unit such as a CPU (Central Processing Unit) and a RAM (Random Access Memory). May be. In this case, the information processing device may further have a non-volatile storage unit such as a flash memory, a network interface unit connected to a communication network, or the like. Further, such an information processing device may be a packaged semiconductor device (element) or may have a configuration in which each semiconductor device is connected by wiring on a wiring board.

The electronic control device 10 is the electronic control device of the present embodiment, and the detailed configuration will be described later. The electronic control device 10 is, for example, an electronic control device based on a platform called Adaptive Platform (AP), which is capable of dynamically expanding functions. AP is mainly a platform suitable for electronic control devices for autonomous driving.

The electronic control device 11 for automatic operation is an electronic control device used for controlling automatic operation, and is based on an AP. In the electronic control device 11 for automatic operation, software for accessing various sensor devices is installed in order to realize automatic operation. For example, the millimeter wave sensor 13, the LiDAR (Light Detection and Ranging) sensor 14, and the image sensor 15, which will be described later, are accessed to comprehensively analyze the information acquired from the millimeter wave sensor 13, the LiDAR sensor 14, and the image sensor 15. , A sensor fusion software for discriminating the type of an object such as a person, a vehicle, a traveling path, a sign, etc. is installed and executed by the electronic control device 11 for automatic driving.

The vehicle control electronic control device 12 is an electronic control device used for vehicle control. The vehicle control electronic control device 12 is an electronic control device based on a platform with optimized static functions, for example, a Classic Platform (CP).

In the present embodiment, the electronic control device 11 for automatic driving and the electronic control device 12 for vehicle control are connected to the network, but other electronic control devices may be connected. Examples of the electronic control device to be connected include a drive system electronic control device that controls an engine, a handle, a brake, etc., a vehicle body system electronic control device that controls a meter, a power window, etc., and an information system electronic control device such as a navigation device. Alternatively, a safety control system electronic control device that controls to prevent collision with an obstacle or a pedestrian can be mentioned.

Further, each electronic control device constituting the electronic control system 1 may be realized by a virtual machine managed by a hypervisor.

The millimeter wave sensor 13 is a device that irradiates an object with millimeter waves for sensing, and detects position information such as the distance and angle of the object and the relative speed with the object.

The LiDAR sensor 14 is a device that measures scattered light with respect to laser irradiation that emits light in a pulse shape, and detects, for example, the distance to an object at a long distance and the properties of the object.

The image sensor 15 is a sensor including an optical system and an image pickup element such as a CCD. An example of the image sensor 15 is an in-vehicle camera that captures the outside and inside of the vehicle.

The vehicle interior / exterior environment sensor 16 is a sensor that acquires environmental information inside and outside the vehicle. Examples of the vehicle interior / exterior environment sensor 16 include a thermometer, a hygrometer, and a pyranometer. Further, an image sensor such as a camera for observing the movement of the occupant may be used as the in-vehicle / outside environment sensor 16.

The millimeter wave sensor 13, the LiDAR sensor 14, the image sensor 15, and the in-vehicle / outside environment sensor 16 correspond to the “sensor device”. In addition, electronic control devices for communication that control communication with the outside and various interfaces that connect external sensors also fall under the category of "sensor devices". Although these sensor devices are connected to the network via electronic control measures in FIG. 1, they may be directly connected to the network without going through the electronic control devices.

Here, the "sensor device" means a device that acquires, generates, or receives information or data.

2. 2. Configuration of Electronic Control Device 10 The configuration of the electronic control device 10 of the present embodiment will be described with reference to FIG.
The electronic control device 10 includes an input unit 101, a software specific information management unit 102, an authentication unit 103, an expiration date management unit 104, a storage unit 15, and an output unit 106.

The electronic control device 10 is roughly divided into a communication management unit and a security management unit. The communication management unit mainly manages communication on the network and has a function of blocking abnormal communication. The communication management unit is also referred to as PEP (Policy Enforcement Point). The security management unit has a function of ensuring the security of the network. The security management unit is also called PDP (Policy Decision Point). These may be mounted on the same semiconductor element or may be separately mounted on different semiconductor elements. Further, it is possible to appropriately decide whether to allocate the configuration of the electronic control device 10 to the communication control unit or the security management unit. For example, the software specific information management unit 102 or the expiration date management unit 104 may be used as a function of the security management unit.

The electronic control device 10 can be composed of a general-purpose CPU, a volatile memory such as RAM, a non-volatile memory such as a ROM, a flash memory or a hard disk, various interfaces, and an internal bus connecting them. Then, by executing the software on these hardware, it can be configured to exert the function of each functional block shown in FIG.
Of course, the electronic control device 10 may be realized by dedicated hardware such as LSI.

The input unit 101 inputs information (data) and commands (commands) transmitted by an electronic control device or a sensor device connected to the network. In the present embodiment, "startup information" indicating that software for accessing the sensor device, such as sensor fusion software of the electronic control device 11 for automatic operation, has been started is input.

Here, the "startup information" is information that directly indicates that the device has been started, or information that indicates an indirect fact that can be identified as having started, such as information that is specified to be transmitted first after the start-up. May be.

Examples of startup information include software-specific information that identifies the software. By first transmitting the software specific information when the software is started, it is possible to notify the device connected to the network that the software has started. Examples of software specific information include software type, vehicle identification number, software identification number, software checksum, software user identification number, software name, software storage location (file path), hash value (eg, software execution). Hash value calculated from the checksum of the file), pre-assigned fixed key, certificate.
In particular, by using checksums and hash values, software can be specified with a small amount of data.

In addition, the activation information may include sensor device identification information that identifies the sensor device to be accessed by the software. For example, in the sensor fusion software of the present embodiment, the identification number of the millimeter wave sensor 13 and the identification number of the LiDAR sensor 14 may be included. As a result, the software can be specified more accurately, and information on the sensor device to be accessed can be easily obtained.

The software specific information management unit 102 manages software specific information that specifies software. Specifically, the software specific information management unit 102 performs the following processing.

First, the software specific information management unit 102 "acquires" software specific information that specifies software from "startup information" input to the input unit 101. For example, the software specific information included in the startup information may be extracted, or the started software may be estimated from one or more pieces of information included in the startup information.

Here, "acquired" from "startup information" includes both cases of acquisition by newly generating software specific information from startup information and cases of acquisition by extracting software specific information from startup information. ..

Second, the software specific information management unit 102 manages input / output of software specific information, such as storing the acquired software specific information in the storage unit 105 described later and reading out the software specific information stored in the storage unit 105. do.

Third, the software specific information management unit 102 has the software specific information stored in the storage unit 105 (corresponding to the "first software specific information") and the activation information newly input to the input unit 101 ("first"). It is compared with the software specific information (corresponding to the "second software specific information") obtained from (corresponding to "2 startup information"), and it is determined whether or not they match. That is, by determining whether or not the software specific information obtained from the newly input startup information is already stored in the storage unit 105, it is determined whether or not the software has been started in the past.

The authentication unit 103 authenticates access to the software sensor device based on the activation information input from the input unit 101. In the present embodiment, for example, the start information of the sensor fusion software of the electronic control device 11 for automatic operation includes the identification number and fixed key of the software, the identification number of the millimeter wave sensor 13 as the sensor device, and the LiDAR sensor 14 as the sensor device. It is assumed that the identification number of is included. In this case, the authentication unit 103 checks whether or not these information match in a database (not shown) connected to the authentication unit 103. Then, the authentication unit 103 outputs an access request to the millimeter wave sensor 13 and the LiDAR sensor 14 subsequently output from the sensor fusion software to the communication management unit from the output unit 106 to the millimeter wave sensor 13 and the LiDAR sensor 14. By notifying the result of the authentication that it is okay to do so, the authentication of access is completed.

Any method can be used as the authentication method of the authentication unit 103. For example, message authentication may be performed on the activation information.

If the authentication of the authentication unit 103 is successful, the electronic control device 10 outputs the software access request to the sensor device as an authenticated access request. If the authentication of the authentication unit 103 fails, the access request is blocked by the electronic control device 10.

The expiration date management unit 104 manages the expiration date of the authentication notified by the authentication unit 103. The expiration date is information indicating the expiration date or period during which the certification is valid. The expiration date may be expressed in terms of time or time, or may be information that can specify the time when authentication becomes invalid, such as when the mileage or the traveling speed exceeds a predetermined speed. Specifically, the expiration date management unit 103 performs the following processing.

First, the expiration date management unit 104 sets an expiration date for the authentication notified from the authentication unit 103. The expiration date may be a constant value or a value that varies depending on the conditions. Further, it may be set according to the type of software. For example, for software that frequently accesses the sensor device, set a long expiration date. Further, if a sensor device that outputs important data is included, the expiration date may be set short.

Second, the expiration date management unit 104 manages input / output of the expiration date, such as storing the set expiration date in the storage unit 105 described later and reading the expiration date stored in the storage unit 105.

Third, whether the expiration date management unit 104 has entered the activation information newly input to the input unit 101 (corresponding to the "second activation information") within the expiration date stored in the storage unit 105. To judge. That is, by determining whether or not the newly input activation information is within the expiration date of the authentication already stored in the storage unit 105, it is determined whether or not the software has been activated in the past.

The storage unit 105 stores the software specific information acquired by the software specific information management unit 102. Further, the storage unit 105 stores the expiration date set by the expiration date management unit 104.
The storage unit 105 is a hardware memory, a volatile memory such as SRAM or DRAM, or a non-volatile memory such as a flash memory or a hard disk. The storage unit 105 also includes a buffer. When the electronic control device 100 is a virtual machine, it may be a virtual memory. The storage unit 105 may be provided outside the electronic control device 10 and may be accessed via a network.

The output unit 106 outputs the information (data) and commands (commands) input to the input unit 101 under the control of the application specific information management unit 102, the authentication unit 103, and the expiration date management unit 104. In the present embodiment, the access request to the millimeter wave sensor 13 and the LiDAR sensor 14 output from the certified sensor fusion software is output to the millimeter wave sensor 13 and the LiDAR sensor 14 as a certified access request.

With the above configuration, the electronic control device 10 of the present embodiment performs authentication based on software activation information, so that authentication can be performed on a software-by-software basis. As a result, it is not necessary to authenticate individual data and commands one by one, so it is possible to ensure the necessary security while preventing processing delays.
Further, since the electronic control device 10 of the present embodiment acquires and stores the software specific information from the activation information, it is possible to easily authenticate the software for the second and subsequent activations. As a result, it is possible to ensure the necessary security while preventing the delay of the processing at the time of the second and subsequent startups.
Since the electronic control device 10 of the present embodiment sets the expiration date of the authentication, the validity period of the security can be adjusted according to the software.

3. 3. Configuration of Sensor Device The configuration of the sensor device of this embodiment will be described with reference to FIG.
The sensor device includes a detection unit 111, a reception unit 112, and a transmission unit 113.
The following description of the detection unit 111, the reception unit 112, and the transmission unit 113 is realized not only in the case where the sensor device itself is realized, but also in cooperation with the electronic control device interposed between the sensor device and the network as shown in FIG. This includes cases where the sensor device only generates sensor data and is realized on an electronic control device which is interposed between the sensor device and the network. In any case, the portion that exerts the functions of the detection unit 111, the reception unit 112, and the transmission unit 113 corresponds to the “sensor device”.

The detection unit 111 acquires sensor data by measuring or detecting the sensing target.
When the sensor device is a millimeter wave sensor 13, position information such as the distance and angle of the object and the relative speed with the object are acquired.
When the sensor device is a LiDAR sensor 14, the distance to the object and the property of the object are acquired.
When the sensor device is the image sensor 15, the image data to be imaged is acquired.
When the sensor device is an in-vehicle / outside environment sensor 16, the temperature, humidity, light intensity, and the like are acquired.

The receiving unit 112 receives the access request transmitted to the sensor device by the software that accesses the sensor device. In the case of the present embodiment, for example, the sensor fusion software executed by the electronic control device 11 for automatic operation receives the access request transmitted to the millimeter wave sensor 13 and the LiDAR sensor 14. In the case of the present embodiment, since the software itself has been authenticated for access to the sensor device, the access request does not necessarily have to go through the electronic control device 10.

The transmission unit 113 transmits the sensor data detected by the detection unit 111 to the device in which the software that is the transmission source is running, in response to the access request received by the reception unit 112. In the case of the present embodiment, the sensor data detected by the millimeter wave sensor 13 and the LiDAR sensor 14 is transmitted to the electronic control device 11 for automatic operation, which is the transmission source.

4. Operation of Electronic Control Device 10 FIGS. 4 and 5 are diagrams showing the operation of the electronic control system 1 or the electronic control device 10. FIG. 4 is a diagram for explaining the processing at the time of starting the software for the first time, and FIG. 5 is a diagram for explaining the processing at the time of starting the software for the second time and thereafter.

4 and 5 not only show the software authentication method executed by the electronic control system 1 and the electronic control device 10, but also show the processing procedure of the software authentication program that can be executed by the electronic control system 1 and the electronic control device 10. It is also a thing. And these processes are not limited to the order shown in FIGS. 4 and 5. That is, the order may be changed as long as there is no restriction that the result of the previous step is used in a certain step. For example, the following S203 and S204 can be rearranged in order.

First, the process at the first startup of the software will be described with reference to FIG. An example of the first startup is when the vehicle is started, or when the function exhibited by the software is used for the first time after the vehicle is started.

When the software that accesses the sensor device is activated, the electronic control device equipped with the software sends activation information. In the present embodiment, when the sensor fusion software of the electronic control device 11 for automatic operation is activated, the electronic control device 11 for automatic operation transmits the activation information of the sensor fusion software.
Then, the activation information is input to the input unit 101 of the electronic control device 10 via the network (S101).

The software specific information management unit 102 acquires software specific information that identifies software from the startup information received in S101 (S102).

The storage unit 105 stores the software specific information acquired in S102 (S103).

The authentication unit 103 authenticates access to the software sensor device based on the activation information input in S101 (S104). In the present embodiment, the access to the millimeter wave sensor 13 and the LiDAR sensor 14 of the sensor fusion software is authenticated by using the sensor device specific information included in the activation information.

When the access to the software sensor device is authenticated by the authentication unit 103, the expiration date management unit 104 sets the authentication expiration date of S104 (S105).

When the access to the sensor device of the software is authenticated by the authentication unit 103, the output unit 106 outputs the access request output from the software to the sensor device (S106). In the case of the present embodiment, the access request to the millimeter wave sensor 13 and the LiDAR sensor 14 output from the certified sensor fusion software is output to the millimeter wave sensor 13 and the LiDAR sensor 14.

Next, with reference to FIG. 5, the processing at the time of starting the software from the second time onward will be described.
When the software that has been terminated is started again, the electronic control device equipped with the software sends the start information. Then, activation information (corresponding to "second activation information") is input to the input unit 101 of the electronic control device 10 via the network (S201).

The software specific information management unit 102 acquires software specific information (corresponding to "second software specific information") that identifies software from the startup information received in S201 (S202).

The software specific information management unit 102 reads out the software specific information (corresponding to the "first software specific information") that has already been stored from the storage unit 105. Then, the software specific information management unit 102 determines whether or not the software specific information read from the storage unit 105 and the software specific information acquired in S202 match (S203). If they match, the process is transferred to (S203: Y) S204, and if they do not match, the process is transferred to (S203: N) S205.

The expiration date management unit 104 reads out the expiration date already stored from the storage unit 105. Then, it is determined whether or not the activation information input in S201 is input within the expiration date (S204). If it is input within the expiration date, the process is transferred to (S204: Y) S207, and if it is not input within the expiration date, that is, if it is input outside the expiration date (S204: N), the process is transferred to S205.

The authentication unit 103 authenticates access to the software sensor device based on the activation information input in S201 (S205).

When the access to the software sensor device is authenticated by the authentication unit 103, the expiration date management unit 104 sets the expiration date of the authentication of S205 (S206).

The output unit 106 outputs the access request output from the software to the sensor device (S207).

The software specific information used for comparison by the software specific information management unit 102 in S203 and the activation information used by the authentication unit 103 in S104 and S205 may be the same, but it is desirable to use different information. For example, if the amount of software-specific information used in S203 is smaller than the amount of activation information used in S104 or S205, the reliability of authentication can be increased and the second and subsequent activations can be accelerated.

Further, a temporary key may be generated by the first authentication, and this temporary key may be used as software specific information used for comparison by the software specific information management unit 102 when the software is started from the second time onward.

Although FIG. 5 has been described as the processing at the time of starting the software for the second time or later, it can also be applied at the time of starting the software for the first time. That is, since the software specific information is not stored in the storage unit 105 at the first startup, the determination result in S203 is N (No), and authentication is performed in S205.

Further, in addition to the flow of FIG. 5, by periodically starting the expiration date management unit 104 to check the expiration date, the step of S203 may be omitted and the authentication unit 103 may perform authentication. As a result, it is possible to accelerate the start-up of software that is frequently started and stopped. Further, if there is an abnormality, access to the sensor device can be blocked regardless of the timing of starting the software.

By the above processing, the software authentication method and the software authentication program of the present embodiment omit the authentication at the time of the second and subsequent startups, so that the processing delay can be prevented.
Further, since the software authentication method and the software authentication program of the present embodiment perform authentication again when the software authentication program is started outside the expiration date, the necessary security can be ensured.

5. Summary The features of the electronic control device according to each embodiment of the present invention and the electronic control system including the electronic control device have been described above.

Since the terms used in each embodiment are examples, they may be replaced with synonymous terms or terms including synonymous functions.

The block diagram used in the description of the embodiment is a classification and arrangement of the configurations of the devices according to their functions. The blocks showing each function are realized by any combination of hardware or software. Further, since the block diagram shows the function, the block diagram can be grasped as the disclosure of the invention of the method and the invention of the program that realizes the method.

The order of the processes, flows, and functional blocks that can be grasped as a method described in each embodiment is changed unless there is a restriction that one step uses the results of other steps in the previous stage. May be good.

The terms first, second, and N (where N is an integer), which are used in each embodiment and in the claims, are used to distinguish two or more configurations or methods of the same type. , Does not limit the order or superiority or inferiority.

The electronic control device of each embodiment is premised on being an electronic control device constituting an in-vehicle device mounted on a vehicle, but the electronic control device of the present invention is not limited to the scope of claims. , Applies to any electronic control system.

Moreover, the following can be mentioned as an example of the form of the apparatus of this invention.
Examples of the form of the component include a semiconductor element, an electronic circuit, a module, and a microcomputer.
Examples of the form of the semi-finished product include an electronic control unit (ECU (Electric Control Unit)) and a system board.
Examples of the finished product include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers.
In addition, it includes a device having a communication function and the like, and examples thereof include a video camera, a still camera, and a car navigation system.

In addition, necessary functions such as an antenna and a communication interface may be added to each device.

In addition, the present invention can be realized not only by the dedicated hardware having the configuration and the function described in each embodiment, but also a program for realizing the present invention recorded on a recording medium such as a memory or a hard disk, and a program thereof. It can also be realized as a combination with a general-purpose hardware having an executable dedicated or general-purpose CPU and a memory or the like.

Programs stored in a non-transitional substantive recording medium of dedicated or general-purpose hardware (for example, an external storage device (for example, hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, ROM, etc.)) It can also be provided to dedicated or general-purpose hardware via a recording medium or via a communication line from a server without a recording medium. This ensures that you always have the latest features through program upgrades.

Although the electronic control device of the present invention has been described mainly as an in-vehicle electronic control device mounted on an automobile, it can be applied to all moving moving objects such as motorcycles, ships, railways, and aircraft. Further, it can be applied not only to mobile objects but also to all products including microcomputers.

1 Electronic control system, 10 Electronic control device, 101 Input unit, 102 Software specific information management unit, 103 Authentication unit, 104 Expiration date management unit, 105 Storage unit, 106 Output unit

Claims (11)

An input unit (101) into which start information indicating that software for accessing the sensor device (13 to 16) has started is input, and an input unit (101).
A software specific information management unit (102) that acquires software specific information that identifies the software from the startup information, and
A storage unit (105) that stores the software specific information, and
An authentication unit (103) that authenticates access to the sensor device of the software based on the activation information, and
It has an output unit (106) that outputs an access request output from the software to the sensor device.
Electronic control device (10). Further, it has an expiration date management unit (104) for setting the expiration date of the authentication.
The storage unit stores the expiration date.
The electronic control device according to claim 1. The activation information includes sensor device identification information that identifies the sensor device accessed by the software.
The electronic control device according to claim 1. The first software specific information, which is the software specific information acquired based on the first start information, which is the start information, is stored in the storage unit, and the second start information is input to the input unit. In that case
The software specific information management unit determines whether or not the first software specific information and the second software specific information acquired from the second startup information match, and the first software specific information and the said If the second software specific information matches, the authentication unit does not perform authentication.
The electronic control device according to claim 1. When the expiration date is stored in the storage unit and the second activation information is input to the input unit,
The expiration date management unit determines whether or not the second activation information has been input to the input unit within the expiration date, and if the second activation information is input within the expiration date, the authentication Do not authenticate in the department,
The electronic control device according to claim 2. The storage unit stores the first software specific information, which is the software specific information acquired based on the first startup information, which is the startup information, and the expiration date, and the second input unit stores the expiration date. When the startup information of is entered,
The software specific information management unit determines whether or not the first software specific information and the second software specific information acquired from the second startup information match.
The expiration date management unit determines whether or not the second activation information has been input to the input unit within the expiration date.
If the first software specific information and the second software specific information match, and if the second activation information is input within the expiration date, the authentication unit does not perform authentication.
The electronic control device according to claim 2. The storage unit stores the first software specific information, which is the software specific information acquired based on the first startup information, which is the startup information, and the expiration date, and the second input unit stores the expiration date. When the startup information of is entered,
The software specific information management unit determines whether or not the first software specific information and the second software specific information acquired from the second startup information match.
The expiration date management unit determines whether or not the second activation information has been input to the input unit within the expiration date.
If the first software specific information and the second software specific information do not match, or if the second activation information is input outside the expiration date, the authentication unit performs authentication.
The electronic control device according to claim 2. The electronic control device is mounted on the moving body,
The electronic control device according to claim 1. It is a software authentication method executed by the electronic control device (10).
Start information indicating that the software that accesses the sensor devices (13 to 16) has started is input (S101, S201), and
Software specific information that identifies the software is acquired from the startup information (S102, S202).
Save the software specific information (S103),
Based on the activation information, the access to the sensor device of the software is authenticated (S104, S205).
The access request output from the software is output to the sensor device (S106, S207).
Software authentication method. A software authentication program that can be executed by the electronic control device (10).
Start information indicating that the software that accesses the sensor devices (13 to 16) has started is input (S101, S201), and
Software specific information that identifies the software is acquired from the startup information (S102, S202).
Save the software specific information (S103),
Based on the activation information, the access to the sensor device of the software is authenticated (S104, S205).
The access request output from the software is output to the sensor device (S106, S207).
Software certification program. An electronic control system composed of a sensor device (13 to 16) and an electronic control device (10).
The electronic control device is
An input unit (101) into which start information indicating that the software that accesses the sensor device has started is input, and
A software specific information management unit (102) that acquires software specific information that identifies the software from the startup information, and
A storage unit (105) that stores the software specific information, and
An authentication unit (103) that authenticates access to the sensor device of the software based on the activation information, and
It has an output unit (106) that outputs an access request output from the software to the sensor device.
The sensor device is
The detector (111) that acquires sensor data and
An electronic control system (1) having a receiving unit (112) for receiving the access request and a transmitting unit (113) for transmitting the sensor data in response to the access request.

Images