JP2023085958A - On-vehicle device, program, and information processing method - Google Patents

Abstract

To provide an on-vehicle device mounted on a vehicle having an on-vehicle network including a first segment in which external communication data and internal communication data flow and a second segment in which only internal communication data flows.SOLUTION: In an on-vehicle system, an on-vehicle device 3 includes: a first communication unit 321 connected to a first segment; a second communication unit 322 connected to a second segment; a first processing unit 301 that processes external communication data and internal communication data received by the first communication unit; and a second processing unit 302 that processes internal communication data received by the second communication unit. The first processing unit identifies transfer data to be transferred to the second processing unit in the external communication data or the internal communication data received by the first communication unit, generates encrypted data obtained by encrypting the identified transfer data, and transfers the generated encrypted data to the second processing unit. The second processing unit decrypts the encrypted data transferred from the first processing unit.SELECTED DRAWING: Figure 2

Description

The present invention relates to an in-vehicle device, a program, and an information processing method.

Conventionally, a CAN communication protocol is widely used for communication between a plurality of in-vehicle ECUs (Electronic Control Units) mounted on a vehicle. As vehicles become more multi-functional and sophisticated, the number of on-board ECUs tends to increase. The in-vehicle ECUs are connected by a common communication line to exchange data with each other, and data transmission and reception between in-vehicle ECUs in different groups is relayed by an in-vehicle relay device (gateway) (for example, Patent Document 1).

In addition to an in-vehicle relay device (gateway), the vehicle network of Patent Document 1 includes a vehicle network monitoring device that is connected to each segment of the vehicle network and detects unauthorized data (messages) flowing through the vehicle network. When the vehicle network monitoring device detects unauthorized data (message), it transmits warning information (message code) to an on-vehicle control device (on-vehicle ECU).

JP 2013-131907 A

However, the vehicle network monitoring device of Patent Document 1 does not take into consideration the reduction of the influence between the segment through which the communication data outside the vehicle flows and the segment through which the communication data inside the vehicle flows.

An object of the present disclosure is to provide an in-vehicle device or the like that can reduce the influence between a segment in which external communication data flows and a segment in which in-vehicle communication data flows.

An in-vehicle device according to an aspect of the present disclosure is an in-vehicle device mounted in a vehicle having an in-vehicle network including a first segment in which external communication data and in-vehicle communication data flow, and a second segment in which only in-vehicle communication data flows. a first communication unit connected to the first segment; a second communication unit connected to the second segment; 1 processing unit, and a second processing unit that processes in-vehicle communication data received by the second communication unit, wherein the first processing unit processes external communication data or in-vehicle communication received by the first communication unit In the data, specifying transfer data to be transferred to the second processing unit, generating encrypted data by encrypting the specified transfer data, transferring the generated encrypted data to the second processing unit, and transferring the generated encrypted data to the second processing unit; The processing unit decrypts the encrypted data transferred from the first processing unit.

According to one aspect of the present disclosure, it is possible to provide an in-vehicle device or the like that reduces the influence between a segment in which external communication data flows and a segment in which in-vehicle communication data flows.

1 is a schematic diagram illustrating a system configuration of an in-vehicle system according to Embodiment 1; FIG. 2 is a block diagram illustrating an internal configuration of an in-vehicle device included in the in-vehicle system; FIG. 5 is a flowchart illustrating processing of a first processing unit and a second processing unit of an in-vehicle device; 10 is a flowchart illustrating processes of the first processing unit and the second processing unit of the in-vehicle device according to the second embodiment (recovery program);

[Description of Embodiments of the Present Disclosure]
First, embodiments of the present disclosure are enumerated and described. Moreover, at least part of the embodiments described below may be combined arbitrarily.

(1) An in-vehicle device according to an aspect of the present disclosure is an in-vehicle device mounted in a vehicle having an in-vehicle network including a first segment in which external communication data and in-vehicle communication data flow, and a second segment in which only in-vehicle communication data flows. A device comprising: a first communication unit connected to the first segment; a second communication unit connected to the second segment; and external communication data and internal communication data received by the first communication unit a first processing unit for processing; and a second processing unit for processing in-vehicle communication data received by the second communication unit, wherein the first processing unit processes external communication data received by the first communication unit. or identifying transfer data to be transferred to the second processing unit in the in-vehicle communication data, generating encrypted data by encrypting the identified transfer data, and transferring the generated encrypted data to the second processing unit; The second processing section decrypts the encrypted data transferred from the first processing section.

In this aspect, the in-vehicle device includes a first processing unit that processes the external communication data and the internal communication data received by the first communication unit, and a second processing unit that processes the internal communication data received by the second communication unit. 2 processing units. Thus, the first segment in which the external communication data flows and the second segment in which the external communication data does not flow and only the in-vehicle communication data flows are separated, and the first processing unit and the second processing unit perform processing respectively. can be done. Of the data received by the in-vehicle device via the first communication unit connected to the first segment (external communication data and internal communication data), all data acquired (received) by the second processing unit are processed by the first processing. After being encrypted by the unit, it is transferred (transmitted) from the first processing unit to the second processing unit. The first processing unit processes external communication data via the first communication unit, and when the external communication data includes unauthorized data and the first processing unit becomes abnormal due to the unauthorized data, the first processing unit The encryption by the unit will not be performed normally, and the decryption by the second processing unit will also be impossible. When the decoding of the data transferred from the first processing unit fails, the second processing unit does not process the data for which the decoding has failed. Even if the data contains illegal data, the influence of the illegal data can be avoided. Therefore, the second segment in which the second processing unit transmits/receives the in-vehicle communication data via the second communication unit and the first segment in which the external communication data flows are encrypted by the first processing unit and the second communication unit. Even if unauthorized data from outside the vehicle flows into the first segment, it is possible to efficiently reduce or prevent the second segment from being adversely affected by the unauthorized data. can. In order to achieve separation (zone separation) between the first segment and the second segment in this way, a relay device such as an Ethernet switch (Ether SW) is included in or connected to the in-vehicle device, and zone separation is performed by the Ethernet SW. However, by using the in-vehicle device of this aspect, the Ethernet SW can be eliminated and the product cost can be reduced.

(2) In the vehicle-mounted device according to an aspect of the present disclosure, the vehicle-external communication data includes data transmitted from an external device located outside the vehicle, and the vehicle-internal communication data is transmitted and received within the vehicle. Data, including data used to control the vehicle.

In this aspect, the external communication data includes data transmitted from an external device such as an external server located outside the vehicle, a mobile terminal, or a smart key. Even if incorrect data is transmitted to the vehicle from the second segment, it is possible to efficiently reduce or prevent the occurrence of adverse effects on the second segment.

(3) An in-vehicle device according to an aspect of the present disclosure includes a shared storage unit accessible from the first processing unit and the second processing unit, and the encryption from the first processing unit to the second processing unit Data transfer is performed via the shared storage unit.

In this aspect, the in-vehicle device includes a shared storage unit accessible from the first processing unit and the second processing unit. Encrypted data is transferred from the first processing unit to the second processing unit by accessing using the address. As a result, each process by a program that runs independently in each of the first processing unit and the second processing unit writes encrypted data (first writing processing by the first processing unit) and reading (reference processing by the second processing unit) can be efficiently performed.

(4) An in-vehicle device according to an aspect of the present disclosure includes a first storage unit accessible only from the first processing unit and a second storage unit accessible only from the second processing unit, The first processing unit uses the first storage unit as a work area to encrypt the transfer data, and the second processing unit uses the second storage unit as a work area to encrypt the encrypted data. process to decrypt the

In this aspect, the first processing unit performs encryption using the first storage unit accessible only from itself as a work area, and the second processing unit performs encryption processing accessible only from itself. By performing the decryption process using the second storage unit as a work area, the work area used for the encryption process and the work area used for the decryption process can be physically different storage areas. As a result, it is possible to reduce interdependence or process correlation between the first processing unit and the second processing unit, and even if the first processing unit becomes abnormal due to unauthorized data flowing in the first segment, However, it is possible to further reduce the adverse effect on the second processing section.

(5) In the in-vehicle device according to an aspect of the present disclosure, the second processing unit determines whether the decryption of the encrypted data succeeds or fails, and if the decryption of the encrypted data succeeds, transfers the decrypted transfer data to the 2. When the encryption data is transmitted from the second communication unit and the decryption of the encryption data fails, the encryption data transferred from the first processing unit is discarded.

In this aspect, the encryption and decryption by the first processing unit and the second processing unit are performed by a public encryption method such as RSA (Rivest-Shamir-Adleman cryptosystem) stored in advance in the first storage unit and the second storage unit. This is performed using a key and a private key, or an encryption key such as a common key such as the AES (Advanced Encryption Standard) method. When attempting to decrypt encrypted data using such a predetermined (prepared) encryption key, the second processing unit, for example, based on the return value (return value) of the decryption process, Success or failure (success: 1, failure: 0) can be determined. If the second processing unit determines that the decryption of the encrypted data has failed, it determines that the first processing unit is abnormal, and discards the encrypted data transferred from the first processing unit. Even if unauthorized data is transferred (sent) from the device, the influence of the unauthorized data can be avoided. As a result, the second processing unit can avoid becoming abnormal due to unauthorized data flowing in the first segment, maintain a normal state, and transmit the relevant data to the second segment connected to the second communication unit. It is possible to suppress or prevent the flow of unauthorized data.

(6) In the in-vehicle device according to an aspect of the present disclosure, the second processing unit transmits a recovery program for restoring the first processing unit to the first processing unit when decryption of the encrypted data fails. let it run.

In this aspect, when the second processing unit determines that the decryption of the encrypted data has failed, it determines that the first processing unit is abnormal. writes a recovery program stored in advance in the area of a predetermined physical address in the shared storage unit. The second processing unit further forcibly restarts the first processing unit by sending, for example, a reset signal for forcibly restarting the first processing unit through inter-process communication, The first processing unit is caused to execute the restoration program written in the shared storage unit. The recovery program is a program for recovering the first processing unit, for example, a backup of a program that the first processing unit was executing normally, or a simple program for running the first processing unit in safe mode. It's a program. As a result, the first processing unit that has become abnormal due to the unauthorized data flowing in the first segment can be restored (restored) to a normal state.

(7) An information processing method according to an aspect of the present disclosure includes a first communication unit connected to a first segment through which external communication data and in-vehicle communication data flow, and a second segment connected to a second segment through which only in-vehicle communication data flows. a second communication unit, a first processing unit that processes external communication data and internal communication data received by the first communication unit, and a second processing unit that processes internal communication data received by the second communication unit in the first processing unit, in the external communication data or the internal communication data received by the first communication unit, the transfer data to be transferred to the second processing unit is specified, and the specified transfer Encrypted data is generated to generate encrypted data, the generated encrypted data is transferred to the second processing section, and the encrypted data transferred from the first processing section is decrypted in the second processing section.

In this aspect, it is possible to provide an information processing method that causes a computer to function as an in-vehicle device that reduces the influence between a segment in which external communication data flows and a segment in which in-vehicle communication data flows.

(8) A program according to an aspect of the present disclosure includes a first communication unit connected to a first segment through which external communication data and in-vehicle communication data flow, and a second communication unit connected to a second segment through which only in-vehicle communication data flows. a communication unit, a first processing unit that processes external communication data and internal communication data received by the first communication unit, and a second processing unit that processes internal communication data received by the second communication unit; In the computer provided, the first processing unit specifies transfer data to be transferred to the second processing unit in the vehicle external communication data or the vehicle internal communication data received by the first communication unit, and transfers the specified transfer data to the second processing unit. Encrypted encrypted data is generated, the generated encrypted data is transferred to the second processing section, and the encrypted data transferred from the first processing section is decrypted in the second processing section.

In this aspect, it is possible to provide a program that causes a computer to function as an in-vehicle device that reduces the influence between a segment in which external communication data flows and a segment in which in-vehicle communication data flows.

[Details of the embodiment of the present disclosure]
The present disclosure will be specifically described based on the drawings showing the embodiments thereof. An in-vehicle system S according to an embodiment of the present disclosure will be described below with reference to the drawings. The present disclosure is not limited to these examples, but is indicated by the scope of the claims, and is intended to include all modifications within the scope and meaning equivalent to the scope of the claims.

(Embodiment 1)
Embodiments will be described below with reference to the drawings. FIG. 1 is a schematic diagram illustrating the system configuration of an in-vehicle system S according to the first embodiment. FIG. 2 is a block diagram illustrating the internal configuration of the in-vehicle device 3 included in the in-vehicle system S. As shown in FIG. The in-vehicle system S includes an integrated ECU 2 mounted in the vehicle C, a single or multiple in-vehicle device 3 , and an in-vehicle ECU 4 connected to the in-vehicle device 3 . Vehicle-mounted devices such as actuators and sensors are directly connected to the vehicle-mounted ECU 4 .

The integrated ECU 2 and the in-vehicle device 3 are connected by a first segment 51 configured by an Ethernet cable or the like, for example. The in-vehicle device 3 and the in-vehicle ECU 4 are connected by a second segment 52 configured by, for example, a CAN bus. The in-vehicle network 5 is configured by the first segment 51 and the second segment 52 . That is, in the in-vehicle network 5, a segment means a zone or domain indicating a physical or logical part (area) or the like in the network.

The integrated ECU 2 is connected with an external communication device 1 for communicating via an external network. The integrated ECU 2 communicates with an external server 100, a mobile terminal, or the like via the external communication device 1 and an external network. Also, the integrated ECU 2 may be connected to the LF antenna and the RF antenna to receive signals transmitted from the smart key. The integrated ECU 2 acquires (receives) data transmitted from external devices such as the external server 100, a mobile terminal, and a smart key, and generates the data or data based on the data via a communication unit provided in the own ECU. It outputs (transmits) control data and the like to the in-vehicle device 3 via the first segment 51 .

Therefore, data transmitted from an external device located outside the vehicle C or data generated by the integrated ECU 2 based on the data flows through the first segment 51 . In addition, the integrated ECU 2 and the in-vehicle device 3 or each other in-vehicle devices 3 transmit and receive data (in-vehicle communication data) used for controlling the vehicle C via the first segment 51 . The in-vehicle communication data is, for example, data relayed by the in-vehicle device 3 to the in-vehicle ECU 4 connected to the second segment 52, and is data transmitted and received within the vehicle C. FIG. That is, through the first segment 51, vehicle-external communication data, such as data transmitted from an external device located outside the vehicle C, and vehicle-internal communication data flow.

On the other hand, the second segment 52 is not connected to an ECU that directly communicates with an external device located outside the vehicle C, such as the integrated ECU 2. Therefore, only in-vehicle communication data flows through the second segment 52. External communication data does not flow. The in-vehicle device 3 and the in-vehicle ECU 4 connected to the second segment 52 transmit and receive in-vehicle communication data, thereby controlling the in-vehicle devices such as actuators and sensors directly connected to the respective in-vehicle ECU 4 . Alternatively, the vehicle-mounted devices such as these actuators and sensors may be directly connected to the vehicle-mounted device 3, and the vehicle-mounted device 3 may control these vehicle-mounted devices.

As described above, the in-vehicle network 5 includes the first segment 51 through which the external communication data and the in-vehicle communication data flow, and the second segment 52 through which only the in-vehicle communication data flows without the external communication data. It is connected to these first segment 51 and second segment 52 . Although details will be described later, the in-vehicle device 3 functions as a relay device that relays data between the first segment 51 and the second segment 52, and if an abnormality or the like occurs in the first segment 51, the first It functions as a separation device that logically separates the segment 51 and the second segment 52 . As a result, an abnormality occurring in the first segment 51 can be prevented from affecting the second segment 52 .

The external server 100 is a computer such as a server connected to a network outside the vehicle such as the Internet or a public network, and has a storage unit such as a RAM (Random Access Memory), a ROM (Read Only Memory), or a hard disk. The integrated ECU 2 is communicably connected to the external communication device 1, communicates with an external server 100 connected via the external network via the external communication device 1, and communicates with the external server 100 and the in-vehicle device mounted on the vehicle C. 3 may relay communication between them.

The vehicle-external communication device 1 includes a vehicle-external communication unit (not shown) and an input/output I/F (not shown) for communicating with the integrated ECU 2 . The external communication unit is a communication device for wireless communication using mobile communication protocols such as 4G, LTE (Long Term Evolution/registered trademark), 5G, and WiFi (registered trademark), and is connected to the external communication unit. Data is transmitted/received to/from the external server 100 via the antenna 11 . Communication between the external communication device 1 and the external server 100 is performed via an external network such as a public network or the Internet, for example. The input/output I/F is a communication interface for serial communication with the integrated ECU 2, for example. The external communication device 1 and the integrated ECU 2 communicate with each other via an input/output I/F and a wire harness such as a serial cable connected to the input/output I/F. In the present embodiment, the external communication device 1 is separate from the integrated ECU 2, and these devices are communicably connected via an input/output I/F or the like, but the present invention is not limited to this. The external communication device 1 may be built in the integrated ECU 2 as one component of the integrated ECU 2 .

The integrated ECU 2 includes a control unit, a storage unit, an input/output I/F, and a communication unit like the in-vehicle device 3 to be described later, and is a central control unit such as a vehicle computer, for example. The integrated ECU 2 is based on data (external communication data) transmitted from an external device such as an external server 100 located outside the vehicle C, a mobile terminal or a smart key, and data transmitted from the in-vehicle device 3 (in-vehicle communication data). , generates control data and the like for controlling the entire vehicle C, and outputs (transmits) it to the in-vehicle device 3 connected to the first segment 51 .

The in-vehicle device 3 includes a first processing unit 301, a second processing unit 302, a shared storage unit 310, a first storage unit 311, a second storage unit 312, a first communication unit 321, and a second communication unit 322. The parts are connected by an internal bus 33 . The in-vehicle device 3 may include an HSM (Hardware Security Module) that performs encryption and decryption (decryption).

A processing unit (control unit) included in the in-vehicle device 3 is composed of two processing units (control unit) including a first processing unit 301 and a second processing unit 302 . The first processing unit 301 and the second processing unit 302 are configured by a CPU (Central Processing Unit) or MPU (Micro Processing Unit) or the like, and read programs P (program products) and data stored in the storage unit in advance. Various control processing, arithmetic processing, and the like are performed by executing the program. The first processing unit 301 and the second processing unit 302 may have a multi-CPU configuration with two CPUs or a multi-core configuration with a single CPU having multiple cores.

The storage unit (storage area) included in the in-vehicle device 3 is composed of three storage units (storage areas) including a shared storage unit 310 , a first storage unit 311 and a second storage unit 312 . Storage units (shared storage unit 310, first storage unit 311, and second storage unit 312) are volatile memory devices such as RAM (Random Access Memory), ROM (Read Only Memory), EEPROM (Electrically Erasable Programmable ROM) or a non-volatile memory device such as a flash memory, in which a program P (program product) and data to be referred to during processing are stored in advance. The program P (program product) stored in the storage unit 61 may be a program P (program product) read from a recording medium readable by the integrated ECU 2 . Alternatively, the program P (program product) may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 61 .

The shared storage unit 310 is communicably connected to the first processing unit 301 and the second processing unit 302 via the internal bus 33 . Thereby, the shared storage unit 310 functions as a shared memory that can be accessed from both the first processing unit 301 and the second processing unit 302 .

The first storage unit 311 is communicably connected only to the first processing unit 301 via the internal bus 33 . As a result, the first storage unit 311 functions as an individual memory accessible only from the first processing unit 301 (dedicated memory for the first processing unit 301). A program P (program product) executed by the first processing unit 301 is stored in the first storage unit 311 .

The second storage unit 312 is communicably connected only to the second processing unit 302 via the internal bus 33 . Thereby, the second storage unit 312 functions as an individual memory (dedicated memory for the second processing unit 302) accessible only from the second processing unit 302. FIG. A program P (program product) executed by the second processing unit 302 is stored in the second storage unit 312 .

The first storage unit 311 and the second storage unit 312 store encryption keys for encryption and decryption (decryption) by the first processing unit 301 and the second processing unit 302 . The encryption key includes, for example, a public key and a secret key such as RSA (Rivest-Shamir-Adleman cryptosystem), or a common key such as AES (Advanced Encryption Standard).

The communication unit provided in the in-vehicle device 3 is composed of two communication units including a first communication unit 321 and a second communication unit 322 . The first communication unit 321 is, for example, an Ethernet PHY, and is an input/output interface that uses an Ethernet (registered trademark) communication protocol. The second communication unit 322 is, for example, a CAN transceiver, and is an input/output interface using a CAN communication protocol. The first communication unit 321 is connected to the first segment 51 through which the vehicle-external communication data and the vehicle-internal communication data flow. A second segment 52 through which only in-vehicle communication data flows is connected to the second communication unit 322 .

Access to the first communication unit 321 is restricted so that it can be accessed only from the first processing unit 301 . Alternatively, only the first processing unit 301 may be configured to acquire data received via the first communication unit 321 . That is, the second processing unit 302 is configured not to directly acquire data received via the first communication unit 321 . In addition, the second processing unit 302 may be capable of transmitting (outputting) data via the first communication unit 321 .

Access to the second communication unit 322 is restricted so that it can be accessed only from the second processing unit 302 . That is, the second communication unit 322 is configured such that data transmission (output) directly from the first processing unit 301 via the second communication unit 322 is prohibited. For example, by setting only the core number of the second processing unit 302 as a processing unit that can access the second communication unit 322 to the device driver that controls the second communication unit 322, Access to the second communication unit 322 may be prohibited directly. Alternatively, the second communication section 322 may be connected only to the second processing section 302 via the internal bus 33, like the second storage section 312 is.

The in-vehicle device 3 configured as described above relays data flowing through the first segment 51 connected to the first communication unit 321 and data flowing through the second segment 52 connected to the second communication unit 322. It functions as a device (gateway). Alternatively, the in-vehicle device 3 may function as an individual ECU that controls communication or the like in a predetermined area, zone, or domain in the in-vehicle network 5 . Alternatively, the in-vehicle device 3 may function as a PLB (Power Lan Box) that distributes power supplied from a power supply device mounted on the vehicle C in addition to relaying communication data.

In the in-vehicle device 3, the first processing unit 301 acquires (receives) the data flowing through the first segment 51 via the first communication unit 321 and generates encrypted data by encrypting the data. The first processing unit 301 writes the generated encrypted data to a predetermined area (physical address) of the shared storage unit 310 accessible by the second communication unit 322, thereby transferring the encrypted data to the second processing unit 302. Forward. The second processing unit 302 reads the encrypted data written in the shared storage unit 310 and decrypts the encrypted data to obtain the original data. The second processing unit 302 transmits (outputs) the data obtained by decoding from the second communication unit 322 .

FIG. 3 is a flowchart illustrating the processing of the first processing unit 301 and the second processing unit 302 of the in-vehicle device 3. As shown in FIG. The in-vehicle device 3 steadily performs the following processing, for example, when the vehicle C is in an activated state (the IG switch is on) or in a stopped state (the IG switch is off). A series of processes of the first processing unit 301 and the second processing unit 302 of the in-vehicle device 3 are performed in association with each other. The processing by 302 will be explained.

The first processing unit 301 acquires data flowing through the first segment 51 via the first communication unit 321 (S101). The in-vehicle device 3 is communicably connected to an ECU or the like that communicates with an external device located outside the vehicle C, such as the integrated ECU 2 , via the first segment 51 . Therefore, through the first segment 51, for example, data from an external device received by the integrated ECU 2 or external communication data, which is data generated by the integrated ECU 2 based on data from the external device, flows. Therefore, the external communication data and the internal communication data, which is data transmitted and received within the vehicle C and used for controlling the vehicle C, flow through the first segment 51 . The first processing unit 301 acquires (receives) data flowing through the first segment 51 , ie, vehicle-external communication data and vehicle-internal communication data, via the first communication unit 321 .

The first processing unit 301 identifies transfer data to be transferred to the second processing unit 302 in the acquired data (S102). The first processing unit 301 extracts, for example, the destination address or port number included in the header of the data (external communication data and internal communication data) acquired via the first communication unit 321 (refer to ) to specify transfer data to be transferred to the second processing unit 302 . The transfer data is data required by the in-vehicle ECU 4 connected to the second segment 52 and corresponds to in-vehicle communication data. The first processing unit 301, for example, refers to the routing table stored in the first storage unit 311, and determines whether or not to transfer the acquired data to the second processing unit 302. It may specify transfer data to be transferred to the unit 302 .

The first processing unit 301 generates encrypted data by encrypting the specified transfer data (S103). The first processing unit 301 encrypts the identified transfer data using, for example, an encryption key stored in the first storage unit 311 to generate encrypted data. The first processing unit 301 may use the first storage unit 311 as a work area when performing the process of encrypting the specified transfer data. Alternatively, the first processing unit 301 may generate encrypted data using an HSM provided in the in-vehicle device 3 .

The first processing unit 301 transfers the generated encrypted data to the second processing unit 302 (S104). The first processing unit 301 transfers the generated encrypted data to the second processing unit 302 by writing the generated encrypted data to a predetermined physical address number (address address) in the shared storage unit 310 . may In other words, the physical address for transferring encrypted data is predetermined in the shared storage unit 310, and each process by a program that runs independently in each of the first processing unit 301 and the second processing unit 302 receives the encrypted data. Encrypted data is transferred from the first processing unit 301 to the second processing unit 302 by accessing the physical address for data transfer. After the processing of S104, the first processing unit 301 may perform loop processing so as to execute the processing from S101 again.

The second processing unit 302 acquires the encrypted data transferred from the first processing unit 301 (T101). The second processing unit 302 accesses a predetermined physical address number (address address) in the shared storage unit 310, and refers to the encrypted data stored in the area specified by the address address. Get the encrypted data.

The second processing unit 302 attempts to decrypt (decrypt) the acquired encrypted data (T102). The second processing unit 302 uses the encryption key stored in the second storage unit 312, for example, to attempt processing to decrypt the encrypted data into transfer data, which is the original data. The second processing unit 302 may use the second storage unit 312 as a work area when performing processing for decrypting encrypted data. Alternatively, the second processing unit 302 may decrypt encrypted data using an HSM provided in the in-vehicle device 3 .

The second processing unit 302 determines whether or not the decryption (decryption) of the encrypted data has succeeded (T103). When trying to decrypt encrypted data using an encryption key, the second processing unit 302 determines whether the decryption is correct (success: 1, failure: 0) based on the return value of the decryption process, for example. do. If the first processing unit 301 is normal, encryption by the first processing unit 301 is normally performed, and therefore decryption by the second processing unit 302 is also normally (successfully) performed. If the first processing unit 301 is abnormal due to incorrect data, the encryption by the first processing unit 301 is also abnormal, or the encryption processing itself is not performed, so the second processing unit 302 cannot decrypt ( failure). In other words, the second processing unit 302 can determine whether the first processing unit 301 is normal or abnormal based on the result of the decryption of the encrypted data.

If the decryption of the encrypted data is successful (T103: YES), the second processing unit 302 transmits the decrypted data via the second communication unit 322 (T104). If the decryption of the encrypted data is successful, the second processing unit 302 determines that the first processing unit 301 is normal, and transmits the decrypted data (transfer data) via the second communication unit 322 . Alternatively, the second processing unit 302 may perform processing based on the decoded data (transfer data) and transmit control data generated as a result of the processing via the second communication unit 322 .

The data transmitted via the second communication unit 322 is received by the in-vehicle ECU 4 connected to the second segment 52 via the second segment 52 to which the second communication unit 322 is connected. Based on the received data, these in-vehicle ECUs 4 control in-vehicle devices such as actuators directly connected to their own ECUs.

If the decryption of the encrypted data fails (T103: NO), the second processing unit 302 discards the encrypted data transferred from the first processing unit 301 (T1031). The second processing unit 302 determines that the first processing unit 301 is abnormal, and discards the data (encrypted data) transferred from the first processing unit 301 . As a result, it is possible to prevent the second processing unit 302 from transmitting the data via the second communication unit 322 according to the data transferred from the first processing unit 301, and the second communication unit 322 The communication state in the connected second segment 52 can be maintained in a normal state.

In other words, even when unauthorized data is flowing in the first segment 51, the unauthorized data or data resulting from the unauthorized data is efficiently suppressed or prevented from flowing to the second segment 52. be able to. The second processing unit 302 acquires the encrypted data transferred from the first processing unit 301 without directly acquiring the data received via the first communication unit 321, so the first communication unit 321 is connected. Even if unauthorized data flows in the first segment 51, the unauthorized data is not affected. Since the second processing unit 302 discards the data transferred from the abnormal first processing unit 301, it can prevent itself from becoming abnormal due to the data.

By discarding the data (encrypted data) transferred from the first processing unit 301 , the second processing unit 302 becomes incapable of communicating with the integrated ECU 2 or the like connected to the first segment 51 . On the other hand, the second processing unit 302 performs, for example, a process (degenerate operation process) for executing a degenerate operation mode in which the functions performed by the vehicle-mounted device such as the actuator are restricted in the normal operation mode. Data generated in the driving process may be transmitted (output) to the in-vehicle ECU 4 connected to the second segment 52 via the second communication section 322 .

The in-vehicle ECU 4 connected to the second segment 52 acquires (receives) in-vehicle communication data generated and transmitted by the degenerate operation processing performed by the second processing unit 302 of the in-vehicle device 3, and converts the in-vehicle communication data Depending on the situation, the vehicle-mounted equipment such as an actuator connected to the own ECU may be controlled in the degenerate operation mode.

The second processing unit 302 may perform loop processing so as to execute the processing from T101 again after the processing of T1031 or T104.

(Embodiment 2)
FIG. 4 is a flowchart illustrating processes of the first processing unit 301 and the second processing unit 302 of the in-vehicle device 3 according to the second embodiment (recovery program). The in-vehicle device 3 steadily performs the following processing, for example, when the vehicle C is in an activated state (the IG switch is on) or in a stopped state (the IG switch is off).

The first processing unit 301 acquires data flowing through the first segment 51 via the first communication unit 321 (S201). The first processing unit 301 identifies transfer data to be transferred to the second processing unit 302 in the acquired data (S202). The first processing unit 301 generates encrypted data by encrypting the identified transfer data (S203). The first processing unit 301 transfers the generated encrypted data to the second processing unit 302 (S204). The first processing unit 301 performs the processing from S201 to S204 in the same manner as from S101 to S104 in the first embodiment.

The second processing unit 302 acquires the encrypted data transferred from the first processing unit 301 (T201). The second processing unit 302 attempts to decrypt (decrypt) the acquired encrypted data (T202). The second processing unit 302 determines whether or not the decryption of the encrypted data has succeeded (T203). If the decryption of the encrypted data is successful (T203: YES), the second processing unit 302 transmits the decrypted data via the second communication unit 322 (T204). The second processing unit 302 performs processing from T201 to T204 in the same manner as from T101 to T104 in the first embodiment.

If the decryption of the encrypted data fails (T203: NO), the second processing unit 302 discards the encrypted data transferred from the first processing unit 301 (T2031). The second processing unit 302 performs the process of T2031 in the same manner as T1031 of the first embodiment.

The second processing unit 302 writes a restoration program for restoring the abnormal first processing unit 301 to the shared storage unit 310 (T2032). The second processing unit 302 transmits a reset signal to the first processing unit 301 (T2033). The second processing unit 302 writes, for example, a recovery program pre-stored (stored) in the second storage unit 312 to a predetermined physical address area of the shared storage unit 310 . Since the recovery program is saved (stored) in the second storage unit 312 accessible only from the second processing unit 302, it can be saved securely without being affected by the processing by the abnormal first processing unit 301. state can be maintained. The predetermined physical address of the shared storage unit 310 may be set in advance as a physical address to be accessed when the first processing unit 301 is restarted by a reset signal. Alternatively, the predetermined physical address address is included in the reset signal transmitted from the second processing unit 302, and the first processing unit 301 receiving the reset signal resets the predetermined physical address address based on the reset signal. It may be something that can be specified.

The first processing unit 301 determines whether or not a reset signal has been received from the second processing unit 302 (S205). When determining that the reset signal has not been received (S205: NO), the first processing unit 301 ends the series of processes. Alternatively, the first processing unit 301 may perform loop processing so as to execute the processing from S201 again.

When determining that the reset signal has been received (S205: NO), the first processing unit 301 restarts and executes the recovery program (S206). The first processing unit 301 restarts by resetting itself according to the received reset signal. Run the recovery program. As a result, the first processing unit 301 can return to a normal state from an abnormal state caused by incorrect data. The first processing unit 301 ends the series of processes. Alternatively, the first processing unit 301 may perform loop processing so as to execute the processing from S201 again.

The embodiments disclosed this time are illustrative in all respects and should be considered not restrictive. The scope of the present disclosure is indicated by the scope of the claims rather than the meaning described above, and is intended to include all modifications within the scope and meaning equivalent to the scope of the claims.

C vehicle S in-vehicle system 100 external server 1 external communication device 11 antenna 2 integrated ECU
3 In-vehicle device (individual ECU)
301 first processing unit 302 second processing unit 310 shared storage unit 311 first storage unit 312 second storage unit 321 first communication unit (Ether PHY unit)
322 second communication unit (CAN transceiver)
33 internal bus 4 in-vehicle ECU
5 In-vehicle network 51 1st segment (1st zone)
52 second segment (second zone)

Claims (8)

An in-vehicle device mounted in a vehicle having an in-vehicle network including a first segment in which external communication data and in-vehicle communication data flow and a second segment in which only in-vehicle communication data flows,
a first communication unit connected to the first segment;
a second communication unit connected to the second segment;
a first processing unit that processes external communication data and internal communication data received by the first communication unit;
a second processing unit that processes in-vehicle communication data received by the second communication unit;
The first processing unit is
identifying transfer data to be transferred to the second processing unit in the external communication data or the internal communication data received by the first communication unit;
generating encrypted data by encrypting the identified transfer data;
transferring the generated encrypted data to the second processing unit;
A vehicle-mounted device, wherein the second processing unit decrypts the encrypted data transferred from the first processing unit. The external communication data includes data transmitted from an external device located outside the vehicle,
The in-vehicle device according to claim 1, wherein the in-vehicle communication data is data transmitted and received within the vehicle and includes data used for controlling the vehicle. A shared storage unit accessible from the first processing unit and the second processing unit,
3. The in-vehicle device according to claim 1, wherein said encrypted data is transferred from said first processing unit to said second processing unit via said shared storage unit. a first storage unit accessible only from the first processing unit;
A second storage unit accessible only from the second processing unit,
The first processing unit uses the first storage unit as a work area to perform a process of encrypting the transfer data,
The in-vehicle device according to any one of claims 1 to 3, wherein the second processing section uses the second storage section as a work area to perform a process of decrypting the encrypted data. The second processing unit is
Determining success or failure of decryption of the encrypted data,
If the decryption of the encrypted data is successful, the decrypted transfer data is transmitted from the second communication unit;
The in-vehicle device according to any one of claims 1 to 4, wherein if the decryption of the encrypted data fails, the encrypted data transferred from the first processing unit is discarded. The in-vehicle device according to claim 5, wherein, when decryption of the encrypted data fails, the second processing unit causes the first processing unit to execute a restoration program for restoring the first processing unit. a first communication unit connected to a first segment through which external communication data and in-vehicle communication data flow;
a second communication unit connected to a second segment through which only in-vehicle communication data flows;
a first processing unit that processes external communication data and internal communication data received by the first communication unit;
A computer comprising a second processing unit that processes in-vehicle communication data received by the second communication unit,
In the first processing section,
identifying transfer data to be transferred to the second processing unit in the external communication data or the internal communication data received by the first communication unit;
generating encrypted data by encrypting the identified transfer data;
transferring the generated encrypted data to the second processing unit;
An information processing method in which the second processing unit decrypts the encrypted data transferred from the first processing unit. a first communication unit connected to a first segment through which external communication data and in-vehicle communication data flow;
a second communication unit connected to a second segment through which only in-vehicle communication data flows;
a first processing unit that processes external communication data and internal communication data received by the first communication unit;
A computer comprising a second processing unit that processes in-vehicle communication data received by the second communication unit,
In the first processing section,
identifying transfer data to be transferred to the second processing unit in the external communication data or the internal communication data received by the first communication unit;
generating encrypted data by encrypting the identified transfer data;
transferring the generated encrypted data to the second processing unit;
A program that causes the second processing unit to decrypt the encrypted data transferred from the first processing unit.

Images