JP2024055384A - Vehicle control device - Google Patents

Abstract

The present invention prevents spoofing attacks by intrusion of unauthorized data into an in-vehicle network by verifying transmitted and received data, and improves responsiveness from an operation request to a controlled object until the operation is completed.
[Solution] A vehicle control device is provided that includes a first control unit that authenticates the sender of action request information for a control object mounted in the vehicle and transmits the action request information from the authenticated sender, and a second control unit that controls the control object based on the action request information received from the first control unit, wherein the first control unit and the second control unit stop communication with each other after generating encryption information for encrypting or decrypting the action request information using a mutually common encryption key, and after resuming communication with the second control unit, the first control unit generates encrypted data by encrypting the action request information using the encryption information and transmits it to the second control unit, and the second control unit decrypts the encrypted data using the encryption information to obtain the action request information and verifies whether the action request information has been tampered with.
[Selected Figure] Figure 1

Description

The present invention relates to a vehicle control device, and in particular to a vehicle control device that prevents the intrusion of unauthorized signals by verifying signals transmitted and received on an in-vehicle network.

Conventionally, systems are known that lock and unlock a vehicle by communicating between a key carried by the user and an in-vehicle device. For example, Patent Document 1 discloses a remote keyless entry system that generates an encryption key based on vehicle driving information when unlocking the vehicle, and uses this to authenticate the user's portable device (key) and the in-vehicle device.

JP 2019-100059 A

In recent years, there has been a problem with a technique known as CAN invaders, which involves unauthorized unlocking of vehicle doors by infiltrating in-vehicle networks such as the Controller Area Network (CAN) and sending "spoofed signals."

The encryption key used in the remote keyless entry system of the above-mentioned Patent Document 1 is used for authentication between the portable device (key) owned by the user and the in-vehicle device, and cannot eliminate "spoofed signals" that have infiltrated the in-vehicle network.

To counter the above-mentioned intrusions into in-vehicle networks, it is possible to use so-called CAN message authentication for transmitted signals in the in-vehicle network or to encrypt the transmitted signals using block encryption.

However, CAN message authentication requires that the vehicle's IGN is ON, so it cannot be used as is to unlock doors that require communication when the IGN is OFF. In addition, because it requires Freshness Value (FV) synchronization, the response time from when the user unlocks the door to when it is actually unlocked is degraded. On the other hand, when it comes to encryption of the transmission signal, one frame in CAN communication is 64 bits, whereas general block encryption encrypts in 128-bit units, so two frames of data must be transmitted to encrypt the transmission signal, degrading the response time.

The present invention aims to address such situations. In other words, it aims to prevent spoofing attacks by intrusion of unauthorized data by verifying data transmitted and received in the in-vehicle network, and to improve the responsiveness from the operation request to the controlled object until the operation is completed.

In order to solve such problems, a vehicle control device according to the present invention has the following configuration.
That is, one aspect of the present invention provides a vehicle control device in which a plurality of control units that control control objects mounted on a vehicle are connected to each other so that they can communicate with each other, the vehicle control device including a first control unit that authenticates a sender of operation request information for the control objects and transmits the operation request information from the authenticated sender, and a second control unit that controls the control objects based on the operation request information acquired from the first control unit, the first control unit and the second control unit each hold a common encryption key, and after generating encryption information for encrypting or decrypting the operation request information using the encryption key, communication between the first control unit and the second control unit is stopped, and after resuming communication with the second control unit, the first control unit generates encrypted data by encrypting the operation request information using the encryption information and transmits the encrypted data to the second control unit, and the second control unit decrypts the encrypted data using the encryption information to obtain the operation request information and verifies whether the operation request information has been tampered with.

A vehicle control device with these characteristics can verify data sent and received over the vehicle network, preventing spoofing attacks caused by the intrusion of unauthorized data, while improving responsiveness from the time an operation request is made to a controlled object until the operation is completed.

1 is an explanatory diagram showing a schematic configuration of a vehicle control device according to an embodiment of the present invention; 2 is an explanatory diagram showing an outline of processing in a first ECU and a second ECU of the vehicle control device according to the embodiment of the present invention; FIG. 2 is an explanatory diagram showing an overview of transmission and reception of information between a CGW, a first ECU, and a second ECU of the vehicle control device according to the embodiment of the present invention; FIG. 5 is a flowchart showing a flow of processing in a first ECU when a lock request is made in the vehicle control device according to the embodiment of the present invention. 5 is a flowchart showing a flow of processing in a second ECU when a lock request is made in the vehicle control device according to the embodiment of the present invention. 5 is a flowchart showing a flow of processing in a first ECU when an unlock request is made in the vehicle control device according to the embodiment of the present invention. 5 is a flowchart showing a flow of processing in a second ECU when an unlock request is made in the vehicle control device according to the embodiment of the present invention.

Embodiments of the present invention will be described below with reference to the drawings. In the following description, the same reference numerals in different drawings indicate parts with the same function, and duplicate descriptions in each drawing will be omitted as appropriate.

As shown in FIG. 1, a vehicle control device 1 according to an embodiment of the present invention is mounted on a vehicle 100 and includes various electronic devices necessary for the running of the vehicle 100, and a number of ECUs (Electronic Control Units) that control these electronic devices. The electronic devices and ECUs are connected to each other via an in-vehicle network 3 such as a CAN (Controller Area Network) or a LIN (Local Interconnect Network) so that they can communicate with each other, and are also connected to a central gateway (CGW) 4 as a relay device to constitute the vehicle control device 1.

Each ECU controls the operation of the electronic device connected thereto based on information (data) acquired from the in-vehicle network 3. In addition, each ECU outputs information related to the operation of each electronic device acquired from the connected electronic device to the in-vehicle network 3.
Each ECU may be configured to include, for example, a processor such as a central processing unit (CPU) or a micro processing unit (MPU), electrical circuits, and storage elements such as a random access memory (RAM) or a read only memory (ROM). In addition, some or all of the operations executed by the ECU may be realized by hardware such as an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a graphics processing unit (GPU).
In the following description, detailed description and illustration of electronic devices and the like that are not directly related to the vehicle control device 1 according to this embodiment will be omitted.

As shown in FIG. 1, the vehicle control device 1 includes a first ECU (first control unit) 10 and a second ECU (second control unit) 20 that are communicatively connected by an in-vehicle network 3. In the vehicle control device 1, the first ECU 10 authenticates the sender of the operation request information based on the operation request information for the control object received by an operation request receiving unit 30 (described later) included in the vehicle control device 1, and if the sender is authenticated, the first ECU 10 outputs the operation request information to the second ECU 20, and the second ECU 20 controls the control object according to the operation request information.

As an example, the case where the control object is a door lock actuator of the vehicle 100 and the operation request information is lock request information indicating locking of the doors of the vehicle 100 or unlock request information indicating unlocking of the doors will be described below with reference to Figures 1 to 3.
FIG. 1 is an explanatory diagram showing the general configuration of the vehicle control device 1, FIG. 2 is an explanatory diagram showing an outline of data processing in the first ECU 10 and the second ECU 20, and FIG. 3 is an explanatory diagram showing an outline of information transmission and reception between the CGW 4, the first ECU 10 and the second ECU 20 in the vehicle control device 1.

The first ECU 10 is connected to an operation request receiving unit 30, and the second ECU 20 is connected to a door lock actuator 40.
The operation request receiving unit 30 receives, via wireless or wired communication, operations of a mobile device, a smart key, a door handle touch sensor, or the like by the user of the vehicle 100 as operation request information for a door lock actuator 40 that is subject to control by the second ECU 20, and outputs the received operation request information to the first ECU 10. The door lock actuator 40 locks or unlocks the doors of the vehicle 100 under the control of the second ECU 20.

The first ECU 10 includes a CPU 11, a ROM 12, a RAM 13, and a storage unit 14. The CPU 11 loads a program stored in the ROM 12 into a memory such as the RAM 13 and executes it, thereby functioning as an authentication processing unit 111, a first time-varying information generating unit 112, a first encryption information generating unit 113, a CRC (Cyclic Redundancy Check) adding unit 114, and an encryption processing unit 115, all of which are shown in FIG. 1.

The storage unit 14 also stores an encryption key used for encryption processing in the encryption processing unit 115. This encryption key is a common encryption key to the encryption key stored in the storage unit 24 of the second ECU 20 described below. In addition, the storage unit 14 stores information necessary for the CPU 11 to operate as the authentication processing unit 111, the first time change information generating unit 112, the first encryption information generating unit 113, the CRC adding unit 114, and the encryption processing unit 115.

The first ECU 10 configured in this manner acquires operation request information for the door lock actuator 40 received by the operation request receiver 30, and authenticates the sender of the operation request information. If the operation request information is information received from an authenticated sender, encrypted data is generated based on the operation request information as described below, and output to the second ECU 20 via the in-vehicle network 3. Note that in the following example, the processing in the first ECU 10 differs depending on whether the operation request information is lock request information or unlock request information.

The following describes the authentication processing unit 111, the first time change information generation unit 112, the first encryption information generation unit 113, the CRC addition unit 114, and the encryption processing unit 115.

The authentication processing unit 111 acquires the operation of a mobile device, smart key, door handle touch sensor, etc. by the user received by the operation request receiving unit 30 via wireless or wired communication as operation request information (lock request information or unlock request information) for the door lock actuator 40, and authenticates the sender of the operation request information. When the sender is authenticated, the authentication processing unit 111 outputs the operation request information to the first time change information generating unit 112, the first encryption information generating unit 113, the CRC adding unit 114, and the encryption processing unit 115.

When the operation request information is lock request information, the first ECU 10 outputs the lock request information to the second ECU 20 without encrypting it. When the authentication processing unit 111 recognizes that a mobile device, a smart key, a door handle touch sensor, or the like has been operated while the first ECU 10 is in a sleep state, it starts up the first ECU 10 and outputs wake-up request information to the second ECU 20 and the CGW 4 to release the sleep state.

The first time change information generating unit 112 generates time change information when a door lock request is made to the vehicle 100 by the user, that is, when the operation request information acquired from the authentication processing unit 111 is lock request information. Specifically, the first time change information generating unit 112 acquires information that changes over time from the CGW 4 at a predetermined cycle, such as information indicating the number of times the ignition of the vehicle 100 has been turned on (IGN-ON) and time stamp information associated with the time, and generates time change information by adding random numbers as necessary.

The information that changes over time that the first time change information generating unit 112 and the second time change information generating unit 211 described later acquire from the CGW 4 is the same information, and the time change information generated by the first time change information generating unit 112 is transmitted to the second time change information generating unit 211 of the second ECU 20 and shared.

The first encryption information generation unit 113 generates encryption information when a door lock request is made to the vehicle 100 by the user, that is, when the operation request information obtained from the authentication processing unit 111 is lock request information. Specifically, the first encryption information generation unit 113 generates encryption information for encrypting an operation request from a sender authenticated by the authentication processing unit 111, using the time change information generated by the first time change information generation unit 112 and an encryption key stored in the storage unit 14. The encryption information generated by the first encryption information generation unit 113 is stored in the storage unit 14, and then communication between the first ECU 10 and the second ECU 20 is stopped.

When communication between the first ECU 10 and the second ECU 20 is resumed and the user requests the vehicle 100 to unlock the doors, that is, when the operation request information obtained from a sender authenticated by the authentication processing unit 111 is unlock request information, the CRC addition unit 114 calculates and adds a CRC to the unlock request information as check data for detecting errors.

The encryption processing unit 115 encrypts the unlock request information with the CRC added, using the encryption information stored in the storage unit 14, to generate encrypted data. As shown in FIG. 2, the encryption processing in the encryption processing unit 115 is an exclusive OR operation (XOR operation) of the unlock request information with the CRC added and the encryption information, thereby generating encrypted data. The encryption processing unit 115 outputs the generated encrypted data to the second ECU 20 via the in-vehicle network 3.

The second ECU 20 includes a CPU 21, a ROM 22, a RAM 23, and a storage unit 24. The CPU 21 loads a program stored in the ROM 22 into a memory such as the RAM 23 and executes it, thereby functioning as a second time-varying information generating unit 211, a second encrypted information generating unit 212, a decryption processing unit 213, and a CRC verification unit 214, as shown in FIG. 1.

The storage unit 24 also stores an encryption key used for the decryption process of the encrypted data in the decryption processing unit 213. This encryption key is a common encryption key to the encryption key stored in the storage unit 14 of the first ECU 10 described above. In addition, the storage unit 24 stores information necessary for the CPU 21 to operate as the second time-varying information generating unit 211, the second encryption information generating unit 212, the decryption processing unit 213, and the CRC verification unit 214.

The second ECU 20 thus configured controls the door lock actuator 40 based on the operation request received from the first ECU 10. At this time, if the operation request sent from the first ECU 10 is encrypted data, the second ECU 20 decrypts the encrypted data, verifies that it has not been tampered with, and then controls the door lock actuator 40 according to the operation request.

The second time change information generation unit 211, the second encryption information generation unit 212, the decryption processing unit 213, and the CRC verification unit 214 are described below.

The second time change information generating unit 211 generates time change information when a door lock request is made to the vehicle 100 by the user, that is, when lock request information is acquired from the first ECU 10. Specifically, the second time change information generating unit 211 acquires information that changes over time from the CGW 4 at a predetermined cycle, such as information indicating the number of times the ignition of the vehicle 100 has been turned on (IGN-ON) and time stamp information associated with the time, and generates time change information by adding random numbers as necessary.

The information that changes over time that the first time change information generating unit 112 and the second time change information generating unit 211 acquire from the CGW 4 is the same information, and the time change information generated by the second time change information generating unit 211 is transmitted to the first time change information generating unit 112 of the first ECU 10 described above and shared.

The second encryption information generating unit 212 generates encryption information when a door lock request is made to the vehicle 100 by the user, that is, when lock request information is obtained from the first ECU 10. Specifically, the second encryption information generating unit 212 generates encryption information for encrypting an unlock operation request from a sender authenticated by the authentication processing unit 111, using the time change information generated by the second time change information generating unit 211 and the encryption key stored in the storage unit 24. The encryption information generated by the second encryption information generating unit 212 is stored in the storage unit 24, and then communication between the first ECU 10 and the second ECU 20 is stopped.

When communication between the first ECU 10 and the second ECU 20 is resumed and the decryption processing unit 213 receives encrypted data from the first ECU 10, the decryption processing unit 213 decrypts the encrypted data using the encryption information generated by the second encryption information generation unit 212 and stored in the memory unit 24. As shown in FIG. 2, the decryption processing in the decryption processing unit 213 is a process of performing an exclusive OR operation (XOR operation) on the encrypted data received from the first ECU 10 and the encryption information stored in the memory unit 24, thereby decrypting the encrypted data. The decrypted data is verified by the CRC verification unit 214 for the presence or absence of errors, i.e., the presence or absence of tampering.

The CRC verification unit 214 calculates a CRC' as check data for detecting errors for the data decoded by the decoding processing unit 213, and verifies whether the decoded data has been tampered with by comparing it with the CRC that was already added to the decoded data. If the verification result shows that the data has not been tampered with, the CRC verification unit 214 controls the door lock actuator 40 to unlock the doors of the vehicle 100.

Hereinafter, the flow of processing in the vehicle control device 1 configured as above when the doors of the vehicle 100 are locked and unlocked will be described with reference to the flowcharts of FIG. 4 to FIG.
First, a description will be given of the processing in the first ECU 10 and the second ECU 20 when the doors of the vehicle 100 are locked. Fig. 4 shows the flow of processing in the first ECU 10 when the doors are locked, and Fig. 5 shows the flow of processing in the second ECU 20 when the doors are locked.

As shown in FIG. 4, when the door is locked, in the first ECU 10, the first time-varying information generating unit 112 acquires information that changes over time, such as time stamp information associated with the time, from the CGW 4 at a predetermined interval (step S101), and the authentication processing unit 111 authenticates the sender of the operation request information transmitted from the operation request receiving unit 30 (step S102).

When the authentication processing unit 111 authenticates the sender, it determines whether the operation request information is lock request information (step S103), and if it is lock request information, it transmits the lock request information to the second ECU 20 (step S104) and proceeds to the next step.
The first time change information generation unit 112 generates time change information by adding a random number to the time-changing information received from the CGW 4, and outputs the generated time change information to the second time change information generation unit 211 of the second ECU 20 for sharing (step S105).

Then, the first encryption information generation unit 113 generates encryption information using the time change information generated by the first time change information generation unit 112 and the encryption key stored in the storage unit 14 (step S106). The encryption information generated by the first encryption information generation unit 113 is stored in the storage unit 14 (step S107), and then communication between the first ECU 10 and the second ECU 20 is stopped (step S108). The encryption information stored at this time is used to encrypt the unlock request information the next time unlock request information is received.

As shown in FIG. 5, when the door is locked, in the second ECU 20, the second time-change information generating unit 211 acquires information that changes over time, such as time stamp information associated with the time, from the CGW 4 at a predetermined period (step S201), and proceeds to the next step when lock request information is received from the first ECU 10 (step S202).
The second time change information generation unit 211 generates time change information by adding a random number to the time-changing information received from the CGW 4, and outputs the generated time change information to the first time change information generation unit 112 of the first ECU 10 for sharing (step S203).

Then, the second encryption information generating unit 212 generates encryption information using the time change information generated by the second time change information generating unit 211 and the encryption key stored in the storage unit 24 (step S204). The encryption information generated by the second encryption information generating unit 212 is stored in the storage unit 24 (step S205), and then communication between the first ECU 10 and the second ECU 20 is stopped (step S206). The encryption information stored at this time is used to decrypt the next encrypted data received from the first ECU.

Next, the processing in the first ECU 10 and the second ECU 20 when the doors of the vehicle 100 are unlocked will be described. Figure 6 shows the flow of processing in the first ECU 10 when the doors are unlocked, and Figure 7 shows the flow of processing in the second ECU 20 when the doors are unlocked.

As shown in FIG. 6, when the door is unlocked, the operation request receiving unit 30 recognizes whether or not the user has operated a mobile device, a smart key, a door handle touch sensor, etc., received through wireless or wired communication, and outputs this as wake-up request information to the first ECU 10, thereby waking up the first ECU 10 that was in a sleep state (step S301). At the same time, the first ECU 10 outputs wake-up request information to the second ECU 20, which resumes communication between the first ECU 10 and the second ECU 20.

Then, the authentication processing unit 111 authenticates the sender of the operation request information sent from the operation request receiving unit 30 (step S302). When the sender is authenticated by the authentication processing unit 111, it determines whether the operation request information is unlock request information (step S303), and if it is unlock request information, the CRC adding unit 114 calculates and adds a CRC to the unlock request information as check data for detecting errors (step S304).

When the CRC is added to the unlock request information, the encryption processing unit 115 obtains the encrypted information stored in the memory unit 14 (step S305), and performs an XOR operation between this encrypted information and the unlock request information to which the CRC has been added, to generate encrypted data (step S306). The encryption processing unit 115 transmits the generated encrypted data to the second ECU 20 (step S307).

As shown in FIG. 7, when the door is unlocked and wake-up request information is received from the first ECU 10, communication between the first ECU 10 and the second ECU 20 is resumed, and the second ECU 20, which was in a sleep state, is woken up (step S401). When the second ECU 20 wakes up, the second ECU 20 determines whether encrypted data has been received from the first ECU 10 (step S402), and if encrypted data has been received, the decryption processing unit 213 performs a decryption process (step S403).

The decryption processing unit 213 decrypts the encrypted data by performing an XOR operation using the encrypted information generated by the second encryption information generation unit 212 and stored in the storage unit 24 (step S403). The CRC verification unit 214 calculates a CRC' from the decrypted data as check data for detecting errors, and verifies whether the decrypted data has been tampered with by comparing it with the CRC already added to the decrypted data (step S404). If the verification by the CRC verification unit 214 shows that the decrypted unlock request information has not been tampered with, the second ECU 20 controls the door lock actuator 40 to unlock the doors of the vehicle 100.

In the vehicle control device according to this embodiment, the first ECU 10 and the second ECU 20 each hold a common encryption key and share time-varying information that changes over time. When the door is locked, the first ECU 10 and the second ECU 20 generate and store encryption information required for unlocking in advance using the common encryption key and the time-varying information that they share, and then stop communication between the first ECU 10 and the second ECU 20.

In this way, since the encrypted information is generated using information common to the first ECU 10 and the second ECU 20, there is no need to transmit and receive the encrypted information between the first ECU 10 and the second ECU 20, and since the first ECU 10 and the second ECU 20 stop communicating with each other after generating and storing the encrypted information, leakage of the encrypted information can be prevented. In addition, since the encrypted information is generated using time-varying information, the encrypted information is different each time it is generated, improving the security of data encrypted using the encryption information.

When unlocking the doors, the first ECU 10 encrypts the unlock request information using encryption information stored in advance before acquiring the unlock request information to generate encrypted data, so there is no need to generate or transmit/receive encrypted information when unlocking. During the encryption process, a CRC is added to the unlock request information as check data for detecting errors, making it easy to verify whether or not the information has been tampered with, and encrypted data is generated by simply performing an XOR operation on the unlock request information and the encryption information, so encrypted data can be generated with a simple operation.

When the second ECU 20 decrypts encrypted data, it is possible to obtain the decrypted unlock request information by a simple calculation of only performing an XOR operation using pre-stored encryption information. Furthermore, by calculating and comparing a CRC' for the decrypted unlock request information, it is possible to easily verify whether the decrypted unlock request information has been tampered with.

In this way, when unlock request information is received from a user, the time required for encryption and decryption is calculated using encryption information that has been generated in advance, and the encryption and decryption of the unlock request information can be performed using simple calculations, thereby shortening the time required from the user's operation related to the unlock request until the door is actually unlocked.

As described above, the vehicle control device according to this embodiment can verify data transmitted and received over the in-vehicle network to prevent spoofing attacks caused by the intrusion of unauthorized data, and can improve responsiveness from an operation request to a controlled object until the operation is completed. In particular, when the operation request is a request to unlock the doors, it can prevent spoofing attacks caused by the intrusion of unauthorized data into the in-vehicle network, and can improve responsiveness from a request to unlock the doors until the doors are actually unlocked.

In the above-described embodiment, an example of preventing unauthorized intrusion of data in response to operation requests related to door locking and unlocking has been described, but by applying other ECUs to the first control unit and the second control unit, it is possible to prevent spoofing attacks due to the intrusion of various unauthorized data by verifying data transmitted and received in the in-vehicle network.

For example, by applying an immobilizer unit to the first control unit and a power unit ECU (engine ECU, hybrid ECU, EV ECU) to the second control unit, it is possible to prevent spoofing attacks by intrusion of unauthorized data when starting the engine, and to prevent unintended transition to a drivable state, such as unauthorized engine start or drive unit activation.

Furthermore, by applying a main unit to the first control unit and a sub-unit to the second control unit among the multiple ECUs that make up the immobilizer unit, it is possible to prevent spoofing attacks using unauthorized data between the ECUs that make up the immobilizer unit and reduce the risk of theft due to spoofing attacks.

In this way, the vehicle control device of the present invention can prevent spoofing attacks by intrusion of unauthorized data by verifying data transmitted and received on the in-vehicle network for operation requests that require a quick response after waking up from a sleep state and resuming communication, such as operations for door locking and unlocking and operations related to starting the engine, and can improve responsiveness from the operation request to the controlled object until the operation is completed.

Although the embodiments of the present invention have been described in detail with reference to the drawings, the specific configuration is not limited to these embodiments, and the present invention includes design changes and the like that do not deviate from the gist of the present invention. In addition, the above-mentioned embodiments can be combined by reusing each other's technologies, as long as there are no particular contradictions or problems in the purpose and configuration, etc.

1: Vehicle control device, 3: In-vehicle network, 4: CGW, 10: First ECU, 20: Second ECU, 11: CPU, 12: ROM, 13: RAM, 14: Storage unit, 21: CPU, 22: ROM, 23: RAM, 24: Storage unit, 30: Receiving unit, 40: Door lock actuator, 100: Vehicle, 111: Authentication processing unit, 112: First time-varying information generating unit, 113: First encryption information generating unit, 114: CRC adding unit, 115: Encryption processing unit, 211: Second time-varying information generating unit, 212: Second encryption information generating unit, 213: Decryption processing unit, 214: CRC verification unit

Claims (5)

A vehicle control device in which a plurality of control units that control control objects mounted on a vehicle are connected to each other so as to be able to communicate with each other,
a first control unit that authenticates a transmission source of an operation request information for the control target and transmits the operation request information from the authenticated transmission source;
a second control unit that controls the control target based on the operation request information acquired from the first control unit,
The first control unit and the second control unit hold a common encryption key, and after generating encryption information for encrypting or decrypting the operation request information using the encryption key, communication between the first control unit and the second control unit is stopped;
the first control unit, after resuming communication with the second control unit, generates encrypted data by encrypting the operation request information using the encryption information, and transmits the encrypted data to the second control unit;
The second control unit decrypts the encrypted data using the encryption information to obtain the operation request information, and verifies whether the operation request information has been tampered with. The vehicle control device according to claim 1, wherein the first control unit adds an error detection code to the operation request information, and encrypts the operation request information to which the error detection code has been added to generate encrypted data. The vehicle control device according to claim 1, wherein the first control unit and the second control unit share time-varying information that changes over time with each other, and generate the encrypted information using the time-varying information and the encryption key. the first control unit generates the encrypted data by an exclusive OR operation;
The vehicle control device according to claim 1 , wherein the second control unit decrypts the encrypted data by an exclusive OR operation. a first control unit that authenticates a transmission source of lock request information or unlock request information for the door lock actuator and transmits the lock request information or the unlock request information from the authenticated transmission source;
a second control unit that controls the door lock actuator based on lock request information or unlock request information received from the first control unit,
the first control unit and the second control unit hold a common encryption key, and when lock request information is received, generate encryption information for encrypting or decrypting unlock request information using the encryption key, and stop communication between the first control unit and the second control unit after generating the encryption information;
when the first control unit receives unlock request information from the authenticated transmission source after resuming communication with the second control unit, the first control unit generates encrypted data by encrypting the unlock request information using the encryption information and transmits the encrypted data to the second control unit;
The second control unit decrypts the encrypted data using the encryption information to obtain unlock request information, and verifies whether the obtained unlock request information has been tampered with.