JP6769270B2 - In-vehicle electronic control device, in-vehicle electronic control system, relay device - Google Patents

Description

The present disclosure relates to an in-vehicle electronic control device constituting a vehicle network, an in-vehicle electronic control system including an in-vehicle electronic control device, and a relay device constituting the vehicle network.

In recent years, vehicles that inspect the ECU and rewrite the program of the ECU by communicating with the ECU and an external device via the vehicle network have been distributed. In such a vehicle, an unauthorized tool may be connected to the vehicle network, and the ECU may be illegally modified by the unauthorized tool. Therefore, in order to suppress unauthorized modification of the ECU, a technique for monitoring unauthorized rewriting of ECU data has been proposed, as in the vehicle network described in Patent Document 1.

The vehicle network described in Patent Document 1 includes a relay device that relays communication between the ECU and an external device, and the relay device detects that the reprogramming frame of the ECU has been sent to the vehicle network. , It is determined whether or not the frame is transmitted by the own device. Then, the relay device treats the frame that the own device has not sent by regarding it as being sent from an unauthorized tool.

Japanese Unexamined Patent Publication No. 2013-150059

In the above vehicle network, since the relay device needs to constantly monitor the frames transmitted to a plurality of communication paths via the relay device, the processing load of the relay device becomes high, and the original relay processing delay and relay omission occur. May occur.

One aspect of the present disclosure has been made in view of the above circumstances, and is an in-vehicle electronic control device capable of confirming that the access route from the external device to the rewrite target is a normal route while suppressing the load on the relay device. , An in-vehicle electronic control system including an in-vehicle electronic control device, and a relay device.

One aspect of the present disclosure is an in-vehicle electronic control device (20) that constitutes a vehicle network and has a rewritable memory (25), and includes a receiving unit and a confirmation unit. The receiving unit uses a frame that requests the own device to authenticate an external device (70, 80) outside the vehicle network as an authentication request frame, and is sent from the external device to the vehicle network to form a relay device (30) that constitutes the vehicle network. , 40, 50), and the route information regarding the relay route of the authentication request frame given to the vehicle network by the relay device are received. The confirmation unit is configured to use the route information received by the reception unit to confirm whether the access route from the external device to the own device is a regular route that is a regular rewrite route via the vehicle network. Has been done.

According to one aspect of the present disclosure, the relay device gives the route information of the frame from the external device to the own device to the vehicle network, and the own device receives the route information. Then, the own device confirms whether the access route from the external device to the own device is a normal route by using the received route information. That is, the relay device only adds the route information, and the confirmation of the normal route is performed by the in-vehicle electronic control device itself, which is the target of rewriting. Therefore, it is possible to confirm that the access route from the external device to the rewrite target is a normal route while suppressing the load on the relay device.

Further, another aspect of the present disclosure is a relay device, which includes a relay unit and a route giving unit. The relay unit receives a frame sent from the external device to the vehicle network and relays it to the target device, with the device that constitutes the vehicle network and is the target of memory rewriting by an external device outside the vehicle network as the target device. It is configured in. The route assigning unit is configured to impart route information regarding the relay route of the frame to the vehicle network when the frame is relayed by the relay unit.

According to another aspect of the present disclosure, when the frame is relayed, the route information regarding the relay route of the frame is given to the vehicle network. As a result, the target device can receive the route information and confirm whether the access route from the external device to the target device is a normal route. Further, since the relay device only adds the route information to the network, the load on the relay device can be suppressed as compared with the case where the access route of the relayed frame is constantly monitored.

In addition, the reference numerals in parentheses described in this column and the scope of claims indicate the correspondence with the specific means described in the embodiment described later as one embodiment, and the technical scope of the present invention is defined. It is not limited.

It is a figure which shows the schematic structure of the in-vehicle electronic control system. It is a figure which shows the information which is stored in the memory of an in-vehicle electronic control device. It is a figure which shows the normal route for each rewrite type stored in a database, and the management number of the relay node included in the normal route. It is a sequence diagram which shows the flow of the process which requests the authentication from the external device to the rewrite target node. It is a figure which shows the data content of the authentication request frame. It is a flowchart which shows the processing procedure of relaying the authentication request frame to the rewrite target node by a relay node. It is a flowchart which shows the processing procedure which authenticates the external device by the rewrite target node.

Hereinafter, modes for carrying out the invention will be described with reference to the drawings.
<1. Configuration>
<1-1. Overall system configuration>
First, the overall configuration of the vehicle-mounted electronic control system 10 according to the present embodiment will be described with reference to FIG. The in-vehicle electronic control system 10 includes an A-ECU 20, a B-ECU 30, a DCM-ECU 40, and a C-GW 50. The A-ECU 20, B-ECU 30, DCM-ECU 40, and C-CW50 are constituent devices that are connected by communication lines of CAN and Ethernet standards to form a vehicle network, that is, nodes of the vehicle network. CAN and Ethernet are registered trademarks.

The A-ECU 20 is an electronic control device that controls a controlled object mounted on a vehicle such as an engine or a brake. The A-ECU 20 is mainly composed of a microcomputer 21 (hereinafter referred to as a microcomputer 21) including a CPU 23, a RAM 24, a ROM 25, and a data transmission / reception unit 22. The A-ECU 20 is assigned "0 x 06" as a node management number, which is a number for managing each node on the vehicle network.

The CPU 23 is an arithmetic unit, and the RAM 24 is a volatile memory for temporarily storing the arithmetic results of the CPU 23 and the like. The ROM 25 is a non-volatile memory having a rewritable storage area, for example, an EEPROM. The program executed by the CPU 23 is stored in the ROM 25. The data transmission / reception unit 22 transmits / receives data to / from each device constituting the vehicle network via a communication line. The details of the configuration of the ROM 25 will be described later.

The B-ECU 30 is an electronic device that controls a control target different from that of the A-ECU 20, and is mainly composed of a microcomputer like the A-ECU 20. “0 × 05” is assigned to the B-ECU 30 as a node management number.

The DCM-ECU 40 is an electronic control device that controls an in-vehicle communication module, and is mainly composed of a microcomputer like the A-ECU 20. The in-vehicle communication module is a communication device that wirelessly connects to an external device outside the vehicle network to send and receive data. “0 × 03” is assigned to the DCM-ECU 40 as a node management number. In addition to the A-ECU 20, B-ECU 30, and DCM-ECU 40, the vehicle network includes various ECUs with different control targets.

Further, the DCM-ECU 40 wirelessly connects to the center 80, which is an external device, via an in-vehicle communication module to transmit and receive data. The center 80 is installed so that the user of the vehicle can update the program stored in the node on the vehicle network without bringing the vehicle to the dealer. When the center 80 needs to update the program stored in the node of the vehicle network, the center 80 transmits a new program to the node via the vehicle network to rewrite the program. Further, the center 80, which is an external node, is also assigned "0 × 01" as a node management number.

The C-GW 50 is a central gateway, which is a device that interconnects a CAN standard network and an Ethernet standard network to realize high-speed data communication of the entire vehicle network. "0x04" is assigned to the C-CW50 as a node management number.

Further, the C-CW 50 is wiredly connected to the diagnostic device 70, which is an external device mounted on the vehicle, via a communication line of CAN and Ethernet standards, and transmits / receives data between the diagnostic device 70 and each node of the vehicle network. Relay. The diagnostic device 70 is a device that receives data on the control target from each node, diagnoses the vehicle, and rewrites the data stored in the nodes of the vehicle network according to the diagnosis result. The diagnostic device 70, which is an external device, is also assigned "0 x 02" as a node management number.

In the present embodiment, the A-ECU 20 is a rewriting node that is a memory rewriting target, corresponds to an in-vehicle electronic control device and a target device within the scope of claims, and corresponds to a memory in which the ROM 25 can be rewritten. The A-ECU 20 realizes the functions of the receiving unit, the confirmation unit, and the authentication unit by a method using software or hardware. Further, the B-ECU 30, DCM-ECU 40, and C-GW 50 are relay nodes that receive a frame sent from an external device to the vehicle network and relay it to the A-ECU 20, which corresponds to a relay device within the scope of claims. To do. The B-ECU 30, DCM-ECU 40, and C-GW 50 realize the functions of the relay unit, the route assigning unit, and the denial unit by a method using software or hardware. The A-ECU 20 may be a relay node, and the B-ECU 30 or the DCM-ECU 40 may be a rewrite node. Each ECU constituting the vehicle network can be both a relay node and a rewrite node.

<1-2. ROM configuration of rewrite node>
Next, the configuration of the ROM 25 of the A-ECU 20 will be described with reference to FIGS. 2 and 3. The ROM 25 stores information on the control program, the mode change flag, the node management number of the own node, and the number DB in the rewritable storage area. DB is an abbreviation for database.

The control program is a program that controls the control target of the A-ECU 20 by being executed by the CPU 23. A control program for controlling each control target is stored in each of the various ECUs. Further, the node management number of the own node is stored in the rewritable memory of each node of the vehicle network, and can be rewritten from an external device. That is, when a node is added to the vehicle network or a node is reduced, a new node management number can be assigned to each node.

The mode change flag is a flag that enables one of the two rewriting modes for rewriting the data in the ROM 25. The rewrite mode includes a system rewrite mode and a single item rewrite mode. When the mode change flag is off, the system rewrite mode is enabled, and when it is on, the single item rewrite mode is enabled.

The system rewrite mode is a mode in which the ROM 25 can be rewritten from the external device on condition that the A-ECU 20 is accessed from the external device by a regular route. The regular route is a regular rewrite route via the vehicle network from the external device to the A-ECU 20. That is, in the system rewrite mode, it is preset which relay node passes through in what order from the external device to transmit data to the A-ECU 20. Then, in the system rewrite mode, if the route for transmitting data from the external device to the A-ECU 20 is different from the normal route, the ROM 25 cannot be rewritten from the external device. As a result, even if the unauthorized tool is directly connected to the A-ECU 20 and the unauthorized tool directly accesses the A-ECU 20 without going through the vehicle network, the unauthorized rewriting of the ROM 25 is suppressed.

On the other hand, the single item rewriting mode is a mode in which the ROM 25 can be rewritten from the external device by directly connecting the external device and the A-ECU 20 without going through the vehicle network. Normally, in order to avoid unauthorized modification of the A-ECU 20, the system rewrite mode is enabled and the single item rewrite mode is disabled. However, there are cases where it is desired to remove the A-ECU 20 from the vehicle network, collect the A-ECU 20 as a single item, and rewrite the ROM 25 at a factory or the like. In such a case, if there is only a system rewrite mode, the ROM 25 cannot be rewritten at a factory or the like.

Therefore, in addition to the system rewriting mode, a single item rewriting mode is provided, and the single item rewriting mode is enabled only when it is necessary to rewrite the A-ECU 20 as a single item. However, the rewriting of the mode change flag from off to on is possible only when the system rewrite mode is enabled and the A-ECU 20 is requested to change the flag via the regular route from the external device. There is. That is, an unauthorized tool directly connected to the A-ECU 20 cannot illegally rewrite the ROM 25 by illegally changing the mode change flag from off to on.

The number DB stores a normal route, a first key information, and a second key information according to the rewriting type. Specifically, as shown in FIG. 3, in the number DB, for each rewrite management number, the rewrite type, the regular route from the external device to the rewrite node, the node management number of the regular route, the first key information, and the second Key information is stored. The information in the number DB can also be rewritten from an external device.

The rewriting type indicates whether the connection from the external device to the vehicle network is wireless, wired using Ethernet, or wired using CAN. The regular route from the external device to the rewrite node is a regular route for each rewrite type. Further, the node management number of the regular route is a node management number of each node of the regular route shown in the order of relaying from the upstream to the downstream of the regular route with the external device side as the upstream.

The first key information is the key information used when authenticating the external device. The second key information is the key information used when authenticating the immediately preceding node. Here, the immediately preceding node with respect to the predetermined node is a node that is directly connected to the predetermined node by a communication line and is the source of the frame received by the predetermined node. Further, the immediate node with respect to the predetermined node is a node that is directly connected to the predetermined node by a communication line and receives a frame from which the predetermined node is the source. In this embodiment, either the B-ECU 30 or the C-GW 50 becomes the immediately preceding node of the A-ECU 20. The immediately preceding node corresponds to the immediately preceding device.

In addition, the B-ECU 30, DCM-ECU 40, and C-GW 50 also have a relay path from the external device to the own node, a node management number included in the relay path, a first key information, and a first key information for each rewrite type. A number DB for a relay node in which the key information of 2 is stored is provided. Each node of the vehicle network includes both a number DB for the rewriting node used when the own node becomes a rewriting node and a number DB for the relay node used when the own node becomes a relay node.

<2. Processing>
<2-1. Authentication sequence>
Next, the flow of processing when the rewrite target node authenticates the external device will be described with reference to the sequence diagram of FIG. Here, the case where there is one relay node and the mode change flag is off will be described. That is, it is assumed that the A-ECU 20 is the node to be rewritten, the diagnostic device 70 is the external device, and the C-GW 50 is the relay node.

First, in A1, the external device transmits the authentication request frame R1 requesting the relay node to authenticate the external device and the node management number of the external device to the relay node. Normally, the authentication request frame R1 does not use the entire data area of the frame. Therefore, the node management number is assigned as a part of the data and transmitted to the vacant data area of the authentication request frame R1. The authentication request frame R1 corresponds to a relay authentication frame.

Next, in A2, the relay node collates the received node management number of the external device with the number DB for the relay node, and confirms that the node management number of the immediately preceding node matches the information in the number DB. That is, the relay node confirms whether the access route from the external device to the own node is a normal route.

Subsequently, in A3, the relay node transmits SEED to the external device. Subsequently, in A4, the external device encrypts the SEED received by the encryption algorithm to generate a KEY, and transmits the generated KEY to the relay node. Subsequently, in A5, the relay node authenticates the external device. Specifically, the relay node encrypts the SEED by the same encryption algorithm as the external device to generate an authentication KEY, and collates the generated authentication KEY with the received KEY. Subsequently, in A6, the relay node transmits a response of authentication completion to the external device because the authentication KEY and the received KEY match.

Next, in A7, the external device transmits to the relay node by assigning the node management number of the external device to the authentication request frame R2 that requests the rewriting node to authenticate the external device. The node management number of the external device is assigned as a part of the data of the authentication request frame R2.

Subsequently, in A8, the relay node assigns the node management number of the own node to the received authentication request frame R2. The node management number of the relay node is assigned to the authentication request frame R2 as a part of the data. As a result, as shown in FIG. 5, the data of the authentication request frame R2 includes the rewrite management number, the node management number of the external node, and the node management number of the relay node through which the authentication request frame R2 has passed.

When the authentication request frame R2 passes through a plurality of relay nodes, each time the authentication request frame R2 passes through the relay node, the relay node 2, the relay node 3, ..., And the node management number are sequentially added. The node management number and its order included in the authentication request frame R2 serve as route information regarding the relay route from the external device to the rewriting node. This route information is encrypted so that the route information is not leaked to the outside. That is, the external device and the relay node assign an encrypted node management number to the authentication request frame R2.

Then, in A9, the relay node transmits the authentication request frame R2 to which the node management number of the own node is assigned to the rewrite node.
Next, in A10, the rewriting node decodes the route information included in the authentication request frame R2, collates the decoded route information with the number DB of the ROM 25, and accesses the access route from the external device to the own node. Make sure that is a regular route. Specifically, the rewriting node confirms that at least one of the node management number of the immediately preceding node and the order in which the relay node relays the authentication request frame R2 matches the information in the number DB, and if they match, the normal route. Is determined to be.

Subsequently, in A11, by confirming that the rewriting node is a normal route, the SEED for the relay node is transmitted to the relay node which is the immediately preceding node. Subsequently, in A12, the relay node generates a KEY from the received SEED and transmits the generated KEY to the rewriting node. Subsequently, in A13, the rewriting node collates the generated authentication KEY with the received KEY, and authenticates the relay node which is the immediately preceding node. Subsequently, in A14, the rewriting node transmits a response of authentication completion to the relay node because the authentication KEY and the received KEY match.

Subsequently, in A15, the rewriting node transmits the SEED to the external device to the relay node. Subsequently, in A16, the relay node relays the received SEED for the external device to the external device. Subsequently, in A17, the external device generates a KEY addressed to the rewriting node from the received SEED, and transmits the generated KEY to the relay node. Subsequently, in A18, the relay node relays the received KEY addressed to the rewrite node to the rewrite node.

Subsequently, in A19, the rewriting node collates the generated authentication KEY with the received KEY to authenticate the external device. Subsequently, in A20, the rewriting node transmits the authentication completion response to the external device to the relay node because the authentication KEY and the received KEY match. Subsequently, in A21, the relay node relays the received authentication completion response to the external device to the external device.

After that, a plurality of processing request frames for rewriting processing are sequentially transmitted from the external device to the rewriting node. The plurality of processing request frames are an erasure request frame that requests erasure of the data to be rewritten and a write request frame that requests the writing of data to the memory area after erasure.

When there are a plurality of relay nodes, the exchange of frames between the relay nodes increases, but the exchange between the relay nodes is the same as the exchange of frames between the relay node and the node to be rewritten. For example, when there are two relay nodes, in the sequence diagram of FIG. 4, the rewrite target node becomes the relay node, and the rewrite target node increases downstream thereof. Then, the authentication request frame R2 becomes an authentication request frame for the relay node on the downstream side, and the authentication request frame R3 for the rewrite node is transmitted from the external device to the relay node after A21. Then, the node management numbers of the two relay nodes are assigned to the authentication request frame R3 and transmitted to the rewrite target node. The node to be rewritten confirms the node management number, authenticates the immediately preceding node, and authenticates the external device.

<2-2. Relay processing of authentication request frame>
Next, the processing procedure of the relay processing of the authentication request frame R2 for the rewrite node, which is executed by the relay node, will be described with reference to the flowchart of FIG. Here, the processing procedure of the relay processing when there is one relay node will be described.

First, in S10, it is determined whether or not the authentication request frame R1 addressed to the own node has been received. If the authentication request frame R1 has not been received in S10, a negative determination is made and the process proceeds to S20. In S20, it is determined whether or not the authentication request frame R2 addressed to the node downstream of the own node (hereinafter, the subordinate node) has been received. Here, the subordinate node is a rewrite node. If the authentication request frame R2 has not been received in S20, a negative determination is made and the process returns to S10. On the other hand, in S20, when the authentication request frame R2 is received, that is, when the authentication request frame R2 is transmitted from the external device to the subordinate node before the own node authenticates the external device, the authentication request frame R2 is transmitted in advance. It may be accessed by a rogue tool, unlike the routine procedure. Therefore, the process proceeds to S30, and a negative response for rejecting the authentication is transmitted to the external device.

Further, in S10, when the authentication request frame R1 is received, an affirmative determination is made and the process proceeds to S40. In S40, the node management number of the external device is confirmed, and it is determined whether or not the information matches the information in the relay number DB. If they do not match in S40, a negative determination is made, the process proceeds to S30, and a negative response is transmitted to the external device. On the other hand, in S40, if they match, a positive determination is made and the process proceeds to S50. In S50, SEED is transmitted to the external device, KEY is received from the external device, and the external device is authenticated.

Subsequently, in S60, it is determined whether or not the authentication of the external device is completed. If the external device cannot be authenticated in S60, a negative determination is made, the process proceeds to S30, and a negative response is transmitted to the external device. On the other hand, in S60, if the external device can be authenticated, an affirmative determination is made, the process proceeds to S70, and the authentication completion response is transmitted to the external device.

Subsequently, in S80, it is determined whether or not the authentication request frame R2 addressed to the subordinate node has been received. If the authentication request frame R2 has not been received in S80, a negative determination is made and the device waits until it is received. On the other hand, in S80, when the authentication request frame R2 is received, an affirmative determination is made and the process proceeds to S90.

In S90, the node management number of the own node is assigned to the authentication request frame R2. Subsequently, in S100, the authentication request frame R2 to which the node management number is assigned is relayed to the subordinate node.

Subsequently, in S110, the SEED for the own node is received from the subordinate node, a KEY is generated, and the generated KEY is transmitted to the subordinate node.
Subsequently, in S120, it is determined whether or not a response of authentication completion to the own node has been received from the subordinate node. If the authentication completion response is not received in S120, a negative determination is made and the process waits until it is received. On the other hand, if the authentication completion response is received in S120, an affirmative determination is made and the process proceeds to S130.

In S130, the SEED for the external device is received from the subordinate node and relayed to the external device, and the KEY for the subordinate node is received from the external device and relayed to the subordinate node.
Subsequently, in S140, it is determined whether or not a response of authentication completion to the external device has been received from the subordinate node. If the authentication completion response is not received in S140, a negative determination is made and the process waits until the response is received. On the other hand, in S140, when the authentication completion response is received, the authentication completion response is relayed to the external device. This is the end of this process.

As described above, the relay node confirms that the access route from the external device to the own node is a normal route, authenticates the external device, and receives authentication from the node immediately after the own node, and the subordinate node. Relays the exchange of frames between and the external device. Here, when a plurality of relay nodes exist, the most upstream relay node may repeatedly execute the processes of S80 to S100 and S130 to S150, that is, the relay of the frame, after executing the process of S150. The processing of the relay node on the downstream side will be described later.

In the present embodiment, the function realized by executing the processes of S10 to S30 corresponds to the negative unit, and the function realized by executing the process of S90 corresponds to the route giving unit. Further, the function realized by executing the process of S100 corresponds to the relay unit.

<2-3. External device authentication process>
Next, the processing procedure of the authentication process of the external device executed by the rewriting node will be described with reference to FIG. 7.

First, in S200, it is determined whether or not the authentication request frame R2 addressed to the own node has been received. If the authentication request frame R2 has not been received in S200, a negative determination is made and the device waits until it is received. If the authentication request frame R2 is received in S200, an affirmative determination is made and the process proceeds to S210.

In S210, it is determined whether or not the change mode flag is on. In S210, when the change mode flag is on, that is, when the single item rewrite mode is enabled, an affirmative determination is made, confirmation of the normal route is skipped, and the process proceeds to S270. On the other hand, in S210, when the change mode flag is off, that is, when the system rewrite mode is in the enabled state, a negative determination is made and the process proceeds to S220.

In S220, it is confirmed whether at least one of the node management number of the immediately preceding node and the order of the relay nodes match the information in the number DB, and it is determined whether the access route from the external device to the own node is a normal route. .. If it is determined in S220 that the route is not a normal route, the process proceeds to S230 and a negative response is transmitted to the immediately preceding node. On the other hand, if it is determined in S220 that the route is a normal route, the process proceeds to S240.

In S240, SEED is transmitted to the immediately preceding node, KEY is received from the immediately preceding node, and the immediately preceding node is authenticated. Subsequently, in S250, it is determined whether or not the authentication of the immediately preceding node is completed. If the immediately preceding node cannot be authenticated in S250, a negative determination is made, the process proceeds to S230, and a negative response is transmitted to the immediately preceding node. On the other hand, in S250, if the immediately preceding node can be authenticated, an affirmative determination is made, the process proceeds to S260, and the authentication completion response is transmitted to the immediately preceding node.

Subsequently, in S270, the SEED for the external device is transmitted to the immediately preceding node, the KEY generated by the external device is received from the immediately preceding node, and the external device is authenticated.
Subsequently, in S280, it is determined whether or not the authentication of the external device is completed. In S280, if the external device cannot be authenticated, it waits until it can be authenticated. On the other hand, in S280, if the external device can be authenticated, an affirmative determination is made, the process proceeds to S290, and the authentication completion response to the external device is transmitted to the immediately preceding node. This is the end of this process.

As described above, the rewriting node confirms that the access route from the external device to the own node is a normal route, authenticates the immediately preceding node, and then authenticates the external device. Here, when a plurality of relay devices exist, the relay node on the downstream side may execute the processes of S10 to S30, then the processes of S220 to S290, and then execute the processes of S80 to S150. ..

In the present embodiment, the function realized by executing the process of S200 corresponds to the receiving unit, and the function realized by executing the process of S220 corresponds to the confirmation unit. Further, the function realized by executing the processes of S230 to S260 corresponds to the authentication unit.

<3. Effect>
According to the first embodiment described in detail above, the following effects can be obtained.
(1) The relay node gives the route information of the frame from the external device to the rewriting node to the vehicle network, and the rewriting node receives the route information. Then, the rewrite node confirms whether the access route from the external device to the rewrite node is a normal route by using the received route information. That is, the relay node only adds route information, and the rewriting node itself confirms that the access route is a normal route. Therefore, it is possible to confirm that the access is performed by the regular route from the external device while suppressing the load on the relay node.

(2) By using at least one of the management number of the node immediately before the rewrite node and the relay order information of the authentication request frame by the relay node, it is possible to confirm whether the access route from the external device to the rewrite node is a normal route. it can.

(3) After confirming that the access route is a regular route, the rewriting node performs individual authentication of the immediately preceding node and confirms that the immediately preceding node is a legitimate relay node to access the rewriting node. It can be more reliable.

(4) By adding the route information to the authentication request frame as a part of the data, it is not necessary to provide a dedicated frame for the route information. As a result, there is no need to change the sequence of the external device.

(5) Even if there are a plurality of regular routes according to the rewriting type, the number DB and the route information can be stored by providing the number DB in which the node management number corresponding to each regular route is stored. It is possible to confirm whether the access route is a regular route by collating.

(6) When the single item rewrite mode is enabled because not only the system rewrite mode but also the single item rewrite mode is set, even if the A-ECU 20 is removed from the vehicle network and collected as a single item, the A-ECU 20 The ROM 25 can be rewritten. Further, the mode change flag is changed from the effective state of the system rewrite mode to the effective state of the single item rewrite mode only when the external device is accessed by the regular route. As a result, it is possible to prevent the single item rewriting mode from being enabled due to unauthorized access, and by extension, it is possible to suppress unauthorized rewriting of the ROM 25.

(7) Since the node management number of each node can be rewritten, it is possible to construct an in-vehicle electronic control system 10 having excellent expandability and flexibility.
(8) If the relay node receives the authentication request frame R2 for the rewrite node before the authentication request frame R1 for requesting the authentication of the external device to the local node is received, the procedure differs from the normal procedure. Therefore, a negative response denying authentication is sent from the relay node to the external device. This makes it possible to detect and deny unauthorized access that differs from the legitimate procedure.

(Other embodiments)
Although the embodiment for carrying out the present invention has been described above, the present invention is not limited to the above-described embodiment and can be implemented in various modifications.

(A) In the above embodiment, the route information is given to the authentication request frame R2 of the external device for the rewrite node, but after the authentication of the external device, a plurality of processing request frames transmitted from the external device to the rewrite node. Route information may be added to at least one. As a result, the rewrite node confirms whether the access route from the external device to the own node is a normal route each time it receives route information not only when an authentication request is made but also when an erase request or write request is made during the rewrite process. can do. As a result, even if an unauthorized access is received after the external device is recognized, the unauthorized access can be detected and the unauthorized rewriting can be suppressed.

(B) As a node management number assigned to each node, an identification number assigned in advance to each node and the external device in order to identify each node and the external device on the vehicle network, for example, identification for CAN communication. Numbers may be used. In this way, there is no need to assign a node management number separately.

(C) As in the above embodiment, it is preferable that the relay node also confirms whether the access route from the external device to the own node is a regular route, but the relay node does not have to confirm the regular route. At least the rewrite node should confirm the normal route.

(D) As the rewriting mode, it is preferable to have both the system rewriting mode and the single item rewriting mode, but the single item rewriting mode may not be provided. In this case, the mode change flag does not have to be stored in the ROM 25.

(E) The node management number is preferably added as a part of the data of the authentication request frames R1 and R2, but a dedicated frame for transmitting the node management number is provided separately from the authentication request frame to set the node management number. You may send it.

(F) A plurality of functions possessed by one component in the above embodiment may be realized by a plurality of components, or one function possessed by one component may be realized by a plurality of components. .. Further, a plurality of functions possessed by the plurality of components may be realized by one component, or one function realized by the plurality of components may be realized by one component. Further, a part of the configuration of the above embodiment may be omitted. In addition, at least a part of the configuration of the above embodiment may be added or replaced with the configuration of the other above embodiment. It should be noted that all aspects included in the technical idea specified only by the wording described in the claims are embodiments of the present invention.

(G) In addition to the above-mentioned in-vehicle electronic control device, in-vehicle electronic control system, and relay device, a program for operating a computer as an in-vehicle electronic control device or relay device, and a non-transitional actual state such as a semiconductor memory in which this program is recorded. The present invention can also be realized in various forms such as a target recording medium.

10 ... In-vehicle electronic control system, 20 ... A-ECU, 25 ... ROM, 30 ... B-ECU, 40 ... DCM-ECU, 50 ... C-GW, 70 ... Diagnostic device, 80 ... Center.

Claims (12)

It is an in-vehicle electronic control device (20) that constitutes a vehicle network and has a rewritable memory (25).
A relay device (30) that is sent from the external device to the vehicle network and constitutes the vehicle network, using a frame that requests the own device to authenticate an external device (70, 80) outside the vehicle network as an authentication request frame. , 40, 50), and a receiving unit (S210) configured to receive the authentication request frame relayed by the relay device and the route information regarding the relay route of the authentication request frame given to the vehicle network by the relay device. )When,
Using the route information received by the receiving unit, it is confirmed whether the access route from the external device to the own device is a regular route which is a regular rewriting route via the vehicle network. configured confirmation unit and (S220), the Bei example,
When the confirmation unit confirms that the access route is different from the normal route, rewriting of the memory is prohibited, and when the confirmation unit confirms that the access route is a normal route, the external device Receives a processing request frame for the memory rewriting process.
In-vehicle electronic control device. The relay device, which is directly connected to the own device by a communication line and is the source of the authentication request frame received by the receiving unit, is used as the immediately preceding device.
The route information according to claim 1, wherein the route information is at least one of a control number assigned to the immediately preceding device and order information indicating the order in which the relay device relays the authentication request frame in the relay route. In-vehicle electronic control device. The relay device, which is directly connected to the own device by a communication line and is the source of the authentication request frame received by the receiving unit, is used as the immediately preceding device.
The in-vehicle electronic device according to claim 1 or 2, further comprising an authentication unit (S230 to S260) configured to authenticate the immediately preceding device after confirmation by the confirmation unit whether the route is the normal route. Control device. The vehicle-mounted electronic control device according to any one of claims 1 to 3, wherein the route information is added to the authentication request frame as a part of data. The route information is encrypted and
The vehicle-mounted electronic control according to any one of claims 1 to 4, wherein the confirmation unit is configured to decode the route information received by the reception unit and use the decoded route information. apparatus. The route information includes a control number assigned to the relay device on the relay route.
A number database in which the control number of the relay device included in the regular route is stored in association with each of the plurality of regular routes from each of the plurality of types of external devices to the own device is further provided.
The confirmation unit collates the control number included in the route information with the control number stored in the number database to confirm whether the access route is the regular route. The vehicle-mounted electronic control device according to any one of claims 1 to 5, which is configured. The receiving unit is further transmitted from the external device to the vehicle network and relayed by the relay device to a plurality of processing request frames for rewriting processing of the memory, and is given to the vehicle network by the relay device. It is configured to receive at least one of the route information of the plurality of processing request frames.
The claim unit is configured to confirm whether or not the access route is the normal route by using the received route information each time the route information is received by the receiving unit. Item 4. The in-vehicle electronic control device according to any one of Items 1 to 6. The external device and the own device are directly connected without going through the vehicle network, and the memory can be rewritten from the external device in a single item rewriting mode, and the external device accesses the own device by the regular route. On condition that, the system rewrite mode in which the memory can be rewritten is set.
In the memory, a flag for enabling one of the single item rewriting mode and the system rewriting mode is stored.
The flag stored in the memory can be changed from the active state of the system rewrite mode on condition that the system rewrite mode is enabled and the change of the flag is requested from the external device via the regular route. The in-vehicle electronic control device according to any one of claims 1 to 7, wherein the single item rewriting mode is changed to an effective state. An in-vehicle electronic control system including the in-vehicle electronic control device according to any one of claims 1 to 8 and the relay device that constitutes the vehicle network together with the in-vehicle electronic control device.
A control number is assigned to each of the constituent devices, with the devices constituting the vehicle network as constituent devices.
An in-vehicle electronic control system in which the control number is stored in a rewritable memory of the corresponding component device and can be rewritten from the external device. The relay device
A relay unit configured to receive the relay authentication frame and the authentication request frame for the in-vehicle electronic control device, using the frame for requesting authentication from the external device to the relay device as the relay authentication frame. S100) and
The relay unit is configured to transmit a negative response denying the authentication of the external device to the external device when the authentication request frame is received before the relay authentication frame is received. The vehicle-mounted electronic control system according to claim 9, further comprising a negative unit (S10 to S30). An identification number for identifying each of the constituent devices on the vehicle network is assigned to the constituent device in advance.
The vehicle-mounted electronic control system according to claims 9 and 10, wherein the identification number is used as the control number. A device that constitutes a vehicle network and is a memory rewriting target by an external device outside the vehicle network is set as a target device, and a frame transmitted from the external device to the vehicle network is received and relayed to the target device. The relay unit (S100) configured in
When the frame is relayed by the relay unit, a route assigning unit (S90) configured to transmit route information regarding the relay route of the frame to the vehicle network is provided.
A frame that requests the target device to authenticate the external device is used as an authentication request frame, and a frame that requests the own device to authenticate the external device is used as a relay authentication frame.
The relay unit is configured to receive the authentication request frame and the relay authentication frame.
The relay unit is configured to transmit a negative response denying the authentication of the external device to the external device when the authentication request frame is received before the relay authentication frame is received. A relay device including a negative unit (S10 to S30) .

Images