JP5790551B2 - COMMUNICATION SYSTEM, RELAY DEVICE, EXTERNAL DEVICE, AND COMMUNICATION METHOD - Google Patents

Description

  The present invention relates to a technique for performing communication between an external device and an in-vehicle device.

  In recent years, with the advancement of electronic control in vehicles, various vehicle components such as engines and brakes are controlled via electronic components, and the number of electronic control units (ECUs) connected to these electronic components is also increasing. It is in. For this reason, a network (in-vehicle LAN) is constructed by a plurality of ECUs, and cooperative operation and information sharing between the ECUs is realized.

  Further, the vehicle is provided with a connector for connecting an external tool (external device), and the vehicle condition can be diagnosed by connecting the external tool to the connector and communicating with the ECU. It has become. However, operations that can be performed using external tools include operations that should not be performed by persons other than authorized workers, such as setting and canceling security-related information and program rewriting (reprogramming). It is.

  Therefore, a technique has been proposed to prevent an unauthorized person from performing a specific operation by providing an external tool with an authentication function and requesting a password when performing a specific operation. (See Patent Document 1).

JP-A-9-250970

  However, since the authentication function described in Patent Document 1 is completed within the external tool, there is a problem that it cannot be handled when an unauthorized external tool is used. That is, since the connector itself provided in the vehicle is standardized, even if it is an unauthorized external tool, various operations can be performed if the connector standard is satisfied. For this reason, it is easy to connect an unauthorized external tool that does not have an authentication function to the connector and monitor the communication content on the network. Security-related information can be obtained from the communication content, and reprogramming is performed. There was a possibility of being.

  The present invention has been made in view of these problems, and an object of the present invention is to provide a technique for suppressing specific communication from being performed using an unauthorized outside device.

  The communication system of the present invention includes an on-vehicle device (50) for communicating with the on-vehicle device (20), and a relay device (10) mounted on the vehicle and relaying communication between the on-vehicle device and the on-vehicle device. And comprising. The relay device includes execution means (11) and in-vehicle storage means (12). The execution means executes processing according to the program. The in-vehicle storage means also requires a communication program (121) for causing the execution means to execute a specific relay process for relaying a specific communication performed between the external device and the in-vehicle apparatus. It memorizes the state where the part is missing. On the other hand, the vehicle exterior device includes transmission means (53). The transmission means transmits a supplement program (520) that compensates for the missing portion of the communication program stored in the in-vehicle storage means to the relay device. And the execution means of a relay apparatus performs a specific relay process according to the communication program by which the missing part was supplemented with the supplement program received from the vehicle exterior apparatus.

  The communication program stored in the relay device is in a state where a part necessary for executing the specific relay processing is missing, and the relay device can execute the specific relay processing by receiving the supplement program from the outside device. It becomes a state. In other words, the external device cannot perform specific communication with the in-vehicle device unless it transmits the supplement program to the relay device. For this reason, it can suppress that specific communication will be performed using an unauthorized vehicle outside apparatus. In particular, in the communication system according to the present invention, a relay device that has not acquired a supplement program does not prohibit a specific relay process in a state where it can be executed, but does not prohibit the execution of the specific process. It has become. Therefore, according to this communication system, compared with a configuration in which the relay device permits specific relay processing according to an authentication result such as a password, an effect of suppressing specific communication from being performed illegally is obtained. Can be high.

  In addition, the code | symbol in the parenthesis described in this column and a claim shows the correspondence with the specific means as described in embodiment mentioned later as one aspect, Comprising: The technical scope of this invention is shown. It is not limited.

It is a block diagram which shows the structure of a communication system. It is a flowchart of a relay process. It is a flowchart of a communication process.

Embodiments to which the present invention is applied will be described below with reference to the drawings.
[1. overall structure]
The communication system shown in FIG. 1 includes an in-vehicle system 1 mounted on a vehicle and an external tool (external diagnostic device) 50 for communicating with an electronic control unit (ECU) constituting the in-vehicle system 1.

  The in-vehicle system 1 includes a gateway ECU (hereinafter referred to as “GW-ECU”) 10 and a plurality of other ECUs 20 having various functions as a plurality of ECUs installed (mounted) in each part inside the vehicle. Prepare. The GW-ECU 10 and the other ECUs 20 are connected to a bus 30 that is a shared communication line (multiplex communication line) to construct a network (in-vehicle LAN), and are connected to each other in accordance with a CAN (Controller Area Network) protocol via the bus 30. Communicate.

  The GW-ECU 10 is installed on a communication path 31 that relays a data link connector (hereinafter simply referred to as “connector”) 40 for connecting an external tool 50 and a bus 30. That is, in the in-vehicle system 1, the GW-ECU 10 communicates directly with the external tool 50, and the ECU 20 communicates with the external tool 50 via the GW-ECU 10. In other words, the external tool 50 is not directly connected to the ECU 20, but is connected via the GW-ECU 10, and the GW-ECU 10 relays communication performed between the external tool 50 and the ECU 20. Function as.

  Specifically, the GW-ECU 10 includes a CPU 11, a flash memory 12, a LAN communication unit 13, and an external communication unit 14. The CPU 11 executes processing according to a program stored in the flash memory 12 or the like. Note that the in-vehicle system 1 of the present embodiment is configured such that power is supplied to the GW-ECU 10 even when the ignition switch of the vehicle is off, and the CPU 11 can execute processing. Further, the CPU 11 is configured to be able to detect whether the ignition switch of the vehicle is on or off.

  The flash memory 12 is a nonvolatile storage device that can electrically rewrite stored contents. In the flash memory 12, a communication application (hereinafter simply referred to as “communication application”) 120, which is a program for causing the CPU 11 to execute relay processing for relaying communication performed between the external tool 50 and the ECU 20. It is remembered. The communication application 120 is an application dedicated to security communication (hereinafter referred to as “security communication dedicated application”), which is a program for causing the CPU 11 to execute a specific relay process for relaying security communication performed between the external tool 50 and the ECU 20. .) 121 is included. However, the security communication dedicated application 121 is stored in an incomplete state in which a part necessary for executing the specific relay process (a part corresponding to a complementary application 520 described later) is missing.

  The LAN communication unit 13 is an interface for communicating with other ECUs 20 via the bus 30. The vehicle exterior communication unit 14 is an interface for communicating with the external tool 50 via the communication path 31 and the connector 40.

  Each ECU 20 includes a CPU 21, a flash memory 22, and a LAN communication unit 23. The CPU 21 executes processing according to a program stored in the flash memory 22 or the like. The flash memory 22 stores a program for causing the CPU 21 to execute processing for realizing various functions. The LAN communication unit 23 is an interface for communicating with the GW-ECU 10 and other ECUs 20 via the bus 30.

  The external tool 50 is connected to the connector 40, diagnoses the vehicle state via the ECU 20 installed in the vehicle, reads out data, controls the control component by the function of the ECU 20, and stores it in the GW-ECU 10 and the ECU 20. It is a device having a function of performing reprogramming (hereinafter, simply referred to as “repro”) which is a rewriting process of a program being executed.

  Specifically, the external tool 50 includes a control unit 51, a storage unit 52, and a communication unit 53. The control unit 51 includes a CPU, a ROM, a RAM, and the like, and executes various processes. In the storage unit 52, a supplementary application 520 that compensates for a missing part of the incomplete security communication application 121 stored in the GW-ECU 10 is stored in an encrypted state. That is, an application for relaying security communication performed between the external tool 50 and the ECU 20 is stored separately in the GW-ECU 10 and the external tool 50. The communication unit 53 is an interface for communicating with the GW-ECU 10 and the ECU 20 via the connector 40. The external tool 50 may be configured using a general-purpose personal computer, a smartphone (multifunctional mobile phone), or the like.

[2. processing]
Next, processing (communication method) executed in the communication system of the present embodiment will be described. First, relay processing executed by the CPU 11 of the GW-ECU 10 will be described with reference to the flowchart of FIG. First, in S101, the CPU 11 determines whether or not the external tool 50 is connected to the connector 40. If the CPU 11 determines that the external tool 50 is connected (S101: YES), the process proceeds to S102. Whether or not the external tool 50 is connected to the connector 40 may be determined, for example, by providing a sensor or the like for detecting the connection in the connector 40, and the signal transmitted via the vehicle exterior communication unit 14 may be determined. You may determine based on transmission / reception.

  In S102, the CPU 11 determines whether or not the ignition switch of the vehicle is in an on state. If it is determined that the vehicle is in an on state (S102: YES), the process proceeds to S103. In S103, the CPU 11 determines whether or not a communication end notification (notification transmitted in S206 to be described later) has been received from the external tool 50, and determines that the notification has not been received. (S103: NO), the process proceeds to S104.

  In S104, the CPU 11 determines whether the communication requested by the external tool 50 is security communication. In the present embodiment, the communication performed between the external tool 50 and the ECU 20 is classified in advance into normal communication and security communication according to the security level. For example, if the authentication code stored in the ECU 20 that performs immobilizer control is read or rewritten, the antitheft function by the immobilizer may be invalidated and the vehicle may be stolen. In this way, communication that requires high security (in other words, communication that is highly necessary to prevent unauthorized external tools from being used) is classified as security communication. On the other hand, communication that has no problem even with low security (in other words, communication that is less necessary to prevent unauthorized external tools from being used), such as normal diagnosis, is classified as normal communication.

  When determining that the communication requested by the external tool 50 is not security communication (normal communication) (S104: NO), the CPU 11 shifts the processing to S105. In S105, the CPU 11 executes normal relay processing for relaying normal communication performed between the external tool 50 and the ECU 20. This normal relay process does not require the security communication dedicated application 121. The CPU 11 shifts the process to S101 after starting the normal relay process. That is, the processing of S101 to S105 is repeated while these determination results do not change, and normal relay processing (normal communication) is continued during that time.

  When the CPU 11 determines in S102 that the ignition switch of the vehicle is not turned on (S102: NO), or when it is determined in S103 that the communication has been received from the external tool 50 (S103: YES), the process proceeds to S106.

  In S <b> 106, the CPU 11 determines whether or not the communication application 120 is in a state where repro is executed. As will be described later, the repro of the communication application 120 is performed when security communication is performed, and is not performed when normal communication is performed. If the CPU 11 determines that the communication application 120 is not in a state of being reproposed (S106: NO), the CPU 11 proceeds to S101 as it is. At this stage, normal relay processing (normal communication) ends.

  On the other hand, if the CPU 11 determines that the communication requested by the external tool 50 is security communication (S104: YES), the CPU 11 shifts the processing to S107. In S107, the CPU 11 determines whether or not the communication application 120 is in a state in which repro is executed.

  If the CPU 11 determines that the communication application 120 is not in the state of being reproposed (S107: NO), the CPU 11 shifts the processing to S108 and requests the external tool 50 to repropose the communication application 120. Here, the repro of the communication application 120 is a program rewriting process to make up for a missing part of the incomplete security communication application 121 and to make it complete. That is, the repro request for the communication application 120 is, in other words, a transmission request for the complementary application 520.

  Subsequently, in S109, the CPU 11 determines whether or not the communication application 120 can be reproposed. Specifically, when the complementary application 520 is not transmitted from the external tool 50, it is determined that the communication application 120 cannot be reproposed (S109: NO), and the process proceeds to S101. That is, when the external tool 50 is an unauthorized (non-regular) external tool that does not have the complementary application 520, security communication cannot be performed.

  On the other hand, when the complementary application 520 is transmitted from the external tool 50, the CPU 11 determines that the communication application 120 can be reproposed (S109: YES), and shifts the processing to S110 for communication. Implement repro of app 120. Specifically, using the supplementary application 520 received from the external tool 50, the missing part of the incomplete security communication application 121 is compensated to configure the complete security communication application 121. In the present embodiment, the supplementary application 520 is transmitted from the external tool 50 to the GW-ECU 10 in an encrypted state. For this reason, the CPU 11 decrypts the complementary application 520 received from the external tool 50 and then executes the repro of the communication application 120. Thereafter, the CPU 11 shifts the process to S101.

  In S107 after the repro of the communication application 120 is performed, the CPU 11 determines that the communication application 120 is in a state of being reproposed (S107: YES), and shifts the processing to S111. In S111, the CPU 11 determines whether or not the elapsed time after the repro is performed is within the time limit (for example, within 10 minutes), and if it is determined that it is within the time limit (S111: YES). Then, the process proceeds to S112. In step S112, the CPU 11 executes specific relay processing for relaying security communication performed between the external tool 50 and the ECU 20. The security communication dedicated application 121 is a program for causing the CPU 11 to execute the specific relay process. The CPU 11 shifts the process to S101 after starting the specific relay process. That is, the processes of S101 to S104, S107, S111, and S112 are repeated while these determination results do not change, and the specific relay process (security communication) is continued during that period.

  When the CPU 11 determines in S102 that the ignition switch of the vehicle is not turned on (S102: NO), or when it is determined in S103 that the communication has been received from the external tool 50 (S103: YES), the process proceeds to S106. In S106, the CPU 11 determines whether or not the communication application 120 is in a state where repro is implemented. If the CPU 11 determines that the communication application 120 is in a state where repro is implemented (S106: YES), the process proceeds to S113.

  Also, when the CPU 11 determines that the elapsed time after the repro is executed in S111 is not within the time limit (exceeds the time limit) (S111: NO), the CPU 11 shifts the processing to S113.

  In S113, the CPU 11 removes the complementary application 520 received from the external tool 50, and is in a state before executing the repro for the communication application 120 (the part necessary for executing the specific relay process in the security communication dedicated application 121 is missing). To return to the incomplete state. Specifically, in S110 described above, when the communication application 120 in the incomplete state before the repro implementation is left as it is and the communication application 120 in the complete state is newly generated, the complete The communication application 120 in the state is deleted. On the other hand, if the communication application 120 in a complete state is rewritten in S110 described above to rewrite the communication application 120 in an incomplete state before the repro is executed, the communication application in the complete state is generated. The application 120 is rewritten again (repro is executed), and the communication application 120 is returned to the incomplete state. Thereafter, the CPU 11 shifts the process to S101. At this stage, the specific relay process (security communication) ends.

  Next, communication processing executed by the control unit 51 of the external tool 50 when the external tool 50 is connected to the connector 40 will be described with reference to the flowchart of FIG. First, in S201, the control unit 51 determines whether to perform security communication with the ECU 20 (whether to perform normal communication). Note that what operation is performed using the external tool 50 is determined by the user (operator) of the external tool 50. In S201, the user is to perform the operation based on the user's operation and setting contents. It is determined whether the operation to be classified into security communication or normal communication.

  When it is determined that security communication is not performed (normal communication is performed) (S201: NO), the control unit 51 shifts the process to S202 and performs normal communication with the ECU 20 via the GW-ECU 10. When the normal communication ends, the control unit 51 shifts the process to S206 and transmits a notification that the communication is ended to the GW-ECU 10. Then, the communication process in FIG. 3 ends.

  On the other hand, if it is determined that the security communication with the ECU 20 is to be performed (S201: YES), the control unit 51 shifts the process to S203 and requests the GW-ECU 10 for security communication. As a result, as described above (S108), the GW-ECU 10 requests a repro of the communication application 120. When the GW-ECU 10 requests the repro of the communication application 120, the control unit 51 shifts the process to S204 and performs the process for the repro of the communication application 120. Specifically, the supplementary application 520 is transmitted to the GW-ECU 10 to cause the GW-ECU 10 to perform the repro of the communication application 120.

  After the repro of the communication application 120 is performed by the GW-ECU 10, the control unit 51 shifts the process to S205 and performs security communication with the ECU 20 via the GW-ECU 10. When the security communication is finished, the control unit 51 shifts the process to S206 and transmits a notification that the communication is finished to the GW-ECU 10. Then, the communication process in FIG. 3 ends.

[3. effect]
As described above, the GW-ECU 10 can execute the specific relay process by receiving the complementary application 520 from the external tool 50 and performing the repro of the communication application 120. That is, the external tool 50 cannot perform security communication with the ECU 20 unless it transmits the complementary application 520 to the GW-ECU 10. For this reason, it can suppress that security communication is performed using an unauthorized external tool. Note that the size of the program to be omitted from the security communication dedicated application 121 (in other words, the size of the complementary application 520) is not particularly limited. Can do.

  In particular, in the communication system according to the present embodiment, the GW-ECU 10 that has not acquired the complementary application 520 does not prohibit the execution of the specific relay process but cannot execute the specific process. It is in a state. Therefore, according to this communication system, compared with a configuration in which the GW-ECU 10 permits specific relay processing according to an authentication result such as a password, an effect of suppressing the security communication from being performed illegally is obtained. Can be high. Moreover, it is possible to make it difficult to create unauthorized external tools. As a result, for example, an illegal act of invalidating a theft prevention function by the immobilizer can be suppressed by an unauthorized access to the ECU that performs immobilizer control.

  Further, after starting the execution of the specific relay process, the GW-ECU 10 (CPU 11) returns the security communication dedicated application 121 to the state before the missing part is compensated when it is determined that the predetermined end condition is satisfied. Then, a process for ending the specific relay process (security communication) is performed. For this reason, after the regular external tool 50 is used, it is possible to prevent the security communication by an unauthorized external tool from being performed using the complete security communication application 121 remaining in the GW-ECU 10. be able to.

  In particular, the condition for terminating the security communication includes a condition for limiting the executable time of the specific relay process. For this reason, even in a situation where the notification that the communication to be transmitted from the external tool 50 has ended cannot be received for some reason, it is possible to return to a state where security communication cannot be performed.

  In addition, the condition for terminating the security communication includes a condition for prohibiting the specific relay process when the ignition switch of the vehicle is in the OFF state. That is, since turning on the ignition switch is one condition for permitting communication, the security can be enhanced as compared with the configuration permitting communication regardless of the state of the ignition switch.

  The security communication end condition includes a condition for prohibiting the specific relay processing after the end of the security communication is notified from the external tool 50. For this reason, when the communication to be performed by the external tool 50 is completed, it is possible to immediately return to a state where the security communication cannot be performed.

  On the other hand, since the external tool 50 includes the storage unit 52 that stores the complementary application 520 in an encrypted state, the external tool 50 manages the complementary application 520 in a highly secure state as compared with a configuration in which the external application 50 is stored without encryption. be able to.

  In the communication system according to the present embodiment, communication performed between the external tool 50 and the ECU 20 is roughly classified into normal communication and security communication, and the communication application 120 is not reproposed for normal communication. To be able to do. For this reason, compared with the structure which implements the repro of the communication application 120 about all the communication, time until communication without a problem with low security can be shortened.

  In this embodiment, the GW-ECU 10 corresponds to an example of a relay device, the CPU 11 corresponds to an example of an execution unit, the flash memory 12 corresponds to an example of an in-vehicle storage unit, and the security communication dedicated application 121 is a communication program. It corresponds to an example. Further, S110 corresponds to an example of a complement step, S112 corresponds to an example of an execution step, and S204 corresponds to an example of a transmission step. In addition, the external tool 50 corresponds to an example of an external device, the storage unit 52 corresponds to an example of an external storage unit, the complement application 520 corresponds to an example of a supplement program, and the communication unit 53 corresponds to an example of a transmission unit. . The ECU 20 corresponds to an example of an in-vehicle device, and the security communication corresponds to an example of specific communication.

[4. Other Embodiments]
As mentioned above, although embodiment of this invention was described, it cannot be overemphasized that this invention can take a various form, without being limited to the said embodiment.

  In the above embodiment, the configuration in which the complementary application 520 is stored in the storage unit 52 of the external tool 50 is exemplified, but the present invention is not limited to this. For example, the complementary application 520 may be stored in a place other than the external tool 50 (another device or other storage medium), and the external tool 50 may acquire the complementary application 520 from the place and send it to 10. . Specifically, for example, the complementary application 520 may be stored in a non-volatile portable storage medium such as an SD card or a Memory Stick (registered trademark) that can be read by the external tool 50. In addition, for example, a storage medium may be provided in an intermediate cable connecting the external tool 50 and the connector 40, and the complementary application 520 may be stored in the storage medium.

  DESCRIPTION OF SYMBOLS 1 ... In-vehicle system, 10 ... GW-ECU, 11 ... CPU, 12 ... Flash memory, 20 ... ECU, 50 ... External tool, 53 ... Communication part, 121 ... Security communication exclusive application, 520 ... Complementary application

Claims (9)

An external device (50) for communicating with the in-vehicle device (20);
A relay device (10) that is mounted on a vehicle and relays communication performed between the external device and the in-vehicle device;
With
The relay device is
Execution means (11) for executing processing according to a program;
A vehicle memory means (12) for memorize a communications program (12 0) for performing a relay processing in you relay is Ru communication carried out between the vehicle-mounted apparatus and the outside device to the execution unit, With
The communication program includes a specific communication program (121) for causing the execution means to execute a specific relay process for relaying specific communication performed between the external device and the in-vehicle device,
The in-vehicle storage means stores the specific communication program in a state where a part necessary for execution of the specific relay process is missing,
The outside device is
Vehicle storage means (52) for storing a complementing program (520) for compensating for the missing part of the specific communication program stored in the vehicle storage means ;
Comprising a transmitting means (53) for transmitting said complementary program to the relay device,
The said execution means performs the said specific relay process according to the said specific communication program by which the said missing part was supplemented with the said supplement program received from the said external device. The communication system characterized by the above-mentioned. The communication system according to claim 1,
The execution means performs processing for returning the specific communication program to a state before the missing portion is compensated when it is determined that a predetermined end condition is satisfied after execution of the specific relay processing is started. A communication system characterized by the above. A communication system according to claim 2,
The termination condition includes a condition for limiting an executable time of the specific relay process. The communication system according to claim 2 or claim 3,
The termination condition includes a condition for prohibiting the specific relay processing when an ignition switch of a vehicle is in an OFF state. A communication system according to any one of claims 2 to 4, wherein
The end condition includes a condition for prohibiting the specific relay process after the end of the specific communication is notified from the outside device. A communication system according to any one of claims 1 to 5, wherein
It said outside memory means, you storage while encrypting the complementary program
Communication system comprising a call. A relay device that is mounted on a vehicle and relays communication performed between an external device and an in-vehicle device,
Execution means for executing processing according to a program;
A vehicle memory means for memorize a communication program for performing the relay process in you relay is Ru communication carried out between the vehicle-mounted apparatus and the outside device to the execution unit,
With
The communication program includes a specific communication program for causing the execution means to execute a specific relay process for relaying a specific communication performed between the external device and the in-vehicle device,
The in-vehicle storage means stores the specific communication program in a state where a part necessary for execution of the specific relay process is missing,
The execution means includes
The supplementary program stored in the out-of-vehicle device to compensate for the missing part of the specific communication program stored in the in-vehicle storage means is received from the out-of-vehicle device, and the specified communication in which the missing part is supplemented by the supplement program A relay device that executes the specific relay processing according to a program. An external device for communicating with an in-vehicle device via a relay device mounted on a vehicle,
A transmission means for transmitting data to the relay device;
The relay device is
Execution means for executing processing according to a program;
And a vehicle storage means the communication program serial to憶for executing said execution means to relay processing in you relaying performed Ru communication between the exterior device and the vehicle device,
The communication program includes a specific communication program for causing the execution means to execute a specific relay process for relaying a specific communication performed between the external device and the in-vehicle device,
The in-vehicle storage means stores the specific communication program in a state where a part necessary for execution of the specific relay process is missing,
The out-of-vehicle apparatus includes an out-of-vehicle storage unit that stores a supplement program that compensates for a missing portion of the specific communication program
Said transmitting means transmits Previous Kiho complete program the relay device, the specific relay processing in accordance with the specific communication program said missing portion is complemented by the complementary program that is executed by the execution unit A feature outside the vehicle. An external device for communicating with the in-vehicle device;
A relay device that is mounted on a vehicle and relays communication performed between the external device and the in-vehicle device;
A communication method between
The outside device is included in the relay device in the storage communication program in order to execute the relay processing in you relay is Ru communication carried out between the exterior device and the vehicle device to the relay device, A specific communication program for causing the relay device to execute a specific relay process for relaying a specific communication performed between the external device and the in-vehicle device, and a portion necessary for the execution of the specific relay process is missing A transmission step (S204) for transmitting a supplementary program stored in the external device to compensate for the missing part of the specific communication program stored in the relay device in a state of being performed (S204);
A complementing step (S110) in which the relay device compensates for the missing portion of the specific communication program using the complementing program received from the vehicle exterior device;
An execution step (S112) in which the relay device executes the specific relay process according to the specific communication program in which the missing portion is compensated in the complementing step;
A communication method comprising:

Images