WO2016075865A1 - 更新管理方法、更新管理装置及び制御プログラム - Google Patents
更新管理方法、更新管理装置及び制御プログラム Download PDFInfo
- Publication number
- WO2016075865A1 WO2016075865A1 PCT/JP2015/005165 JP2015005165W WO2016075865A1 WO 2016075865 A1 WO2016075865 A1 WO 2016075865A1 JP 2015005165 W JP2015005165 W JP 2015005165W WO 2016075865 A1 WO2016075865 A1 WO 2016075865A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- update
- message
- external tool
- update message
- ecu
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/44—Program or device authentication
- G06F21/445—Program or device authentication by mutual authentication, e.g. between devices or programs
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
- B60R16/00—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for
- B60R16/02—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for electric constitutive elements
- B60R16/023—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for electric constitutive elements for transmission of signals between vehicle parts or subsystems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/60—Software deployment
- G06F8/65—Updates
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/60—Software deployment
- G06F8/65—Updates
- G06F8/654—Updates using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/068—Network architectures or network communication protocols for network security for supporting key management in a packet data network using time-dependent keys, e.g. periodically changing keys
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2107—File encryption
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2113—Multi-level security, e.g. mandatory access control
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2137—Time limited access, e.g. to a computer or data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2151—Time stamp
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
Definitions
- the present invention relates to an update management method, an update management device, and the like for updating data held by an electronic control unit in an in-vehicle network system.
- ECUs electronice control units
- a network connecting these ECUs is called an in-vehicle network.
- CAN Controller Area Network
- ISO11898-1 a standard for in-vehicle networks.
- the communication path is composed of two buses, and an ECU connected to the bus is called a node.
- Each node connected to the bus transmits and receives a message called a frame.
- the transmission node transmits an ID (called a message ID) for each frame (that is, sends a signal to the bus), and each reception node is predetermined.
- the in-vehicle network has a port (hereinafter referred to as “diagnostic port”) that is an interface that communicates with an external tool (for example, an external device such as a failure diagnostic tool) called OBD2 (On-Board Diagnostics 2). Used for ECU diagnosis.
- diagnostic port an interface that communicates with an external tool (for example, an external device such as a failure diagnostic tool) called OBD2 (On-Board Diagnostics 2). Used for ECU diagnosis.
- OBD2 On-Board Diagnostics 2
- Patent Document 1 has a risk that the firmware of all ECUs may be illegally rewritten when an identification code assigned to an external tool for updating firmware is leaked.
- the present invention reduces the risk of unauthorized rewriting of firmware of all ECUs when confidential information assigned to an external tool is leaked, and updates management for causing external tools to update data in the ECU such as firmware Provide a method.
- the present invention also provides an update management device for reducing risk and causing an external tool to update data in the ECU, and a control program for the update management device.
- an update management method is an update management method used in an in-vehicle network system including a plurality of electronic control units that communicate via a bus and to which an external tool is connected.
- update authority information indicating authority of the external tool
- an update message instructing update of data held by one or a plurality of the electronic control units is transmitted from the external tool
- the update authority information indicates that the verification is successful and the transmission of the update message is within the authority range of the external tool
- the one or more electronic controls corresponding to the update message When the update is executed by the unit and the verification fails, or the transmission of the update message is the authority range of the external tool.
- the update permission information does not indicate that a inner is updated management method for inhibiting the update corresponding to the update message by said one or more electronic control units.
- an update management device is an electronic control unit connected to a diagnosis port in an in-vehicle network system including a plurality of electronic control units that communicate via a bus.
- An update management apparatus update authority information indicating the authority of the external tool transmitted from the external tool connected to the diagnostic port, and one or more electronic control units
- a receiving unit that receives an update message that instructs to update the data held by the receiving unit, a verification unit that verifies the update authority information received by the receiving unit, and the update message received by the receiving unit. The verification by the verification unit is successful and the transmission of the update message is within the authority of the external tool.
- the update authority information indicates that the update message is transferred to the bus, and when the verification by the verification unit fails, or the transmission of the update message is within the authority range of the external tool.
- the update management apparatus includes a transfer unit that suppresses the transfer.
- a control program is provided as an electronic control unit connected to a diagnosis port in an in-vehicle network system including a plurality of electronic control units that communicate via a bus.
- a control program for causing an update management apparatus having a processor to execute predetermined update management processing, wherein the update management processing is transmitted from an external tool connected to the diagnostic port via the diagnostic port.
- An update authority information receiving step for receiving update authority information indicating the authority of the external tool, a verification step for verifying the update authority information received in the update authority information receiving step, and the diagnostic port from the external tool.
- the update message is transferred to the bus, and when the verification in the verification step fails, or the transmission of the update message is the external tool
- a transfer control step for suppressing the transfer when the update authority information does not indicate that it is within the authority range.
- the present invention it is possible to reduce the risk that the firmware of all ECUs is illegally rewritten when confidential information assigned to an external tool is leaked, and allow the external tool to update data in the ECU.
- FIG. 1 is an overall configuration diagram of an in-vehicle network system according to Embodiment 1.
- FIG. It is a figure which shows the format of the data frame prescribed
- 1 is a configuration diagram of a master ECU (update management device) according to Embodiment 1.
- FIG. 6 is a diagram showing level information according to Embodiment 1.
- FIG. It is a block diagram of ECU.
- FIG. 15 It is a figure which shows a reception ID list. It is a figure which shows the shared key update sequence which concerns on Embodiment 1 (following FIG. 12). It is a figure which shows the shared key update sequence which concerns on Embodiment 1 (continuing from FIG. 11). It is a whole block diagram of the vehicle-mounted network system which concerns on Embodiment 2.
- FIG. It is a figure which shows the level information which concerns on Embodiment 2.
- FIG. It is a figure which shows the shared key update sequence which concerns on Embodiment 2 (following FIG. 16). It is a figure which shows the shared key update sequence which concerns on Embodiment 2 (continuing from FIG. 15).
- FIG. 15 It is a figure which shows a reception ID list. It is a figure which shows the shared key update sequence which concerns on Embodiment 1 (following FIG. 12). It is a figure which shows the shared key update sequence which concerns on Embodiment 1 (continuing from FIG. 11). It is a whole block diagram
- FIG. 9 is a configuration diagram of a master ECU (update management device) according to a third embodiment. It is a figure which shows the information which matched the shared key which concerns on Embodiment 3, and an expiration date.
- FIG. 10 is a diagram illustrating an example of a screen that prompts an update of a shared key according to the third embodiment. It is a figure which shows the shared key update sequence which concerns on Embodiment 4 (following FIG. 21). It is a figure which shows the shared key update sequence which concerns on Embodiment 4 (continuing from FIG. 20). It is a figure which shows the log information which the server which concerns on Embodiment 4 hold
- An update management method is an update management method used in an in-vehicle network system including a plurality of electronic control units that perform communication via a bus and to which an external tool is connected.
- the update authority information indicating the authority
- the update message instructing the update of the data held by one or more of the electronic control units is transmitted from the external tool
- the verification is successful.
- the update authority information indicates that the transmission of the update message is within the authority range of the external tool
- the update is executed by the one or more electronic control units in response to the update message.
- an update management method for inhibiting the update corresponding to the update message by said one or more electronic control units for inhibiting the update corresponding to the update message by said one or more electronic control units.
- the authority to transmit an update message instructing the update of data in the ECU can be determined differently for each external tool based on the verifiable update authority information.
- the external tool which has the authority to transmit about the update message of the data in some ECUs in a vehicle-mounted network system can update the data in the some ECUs.
- the ECUs other than some of the ECUs cannot be rewritten illegally. For this reason, it is possible to reduce the risk that the firmware and the like of all ECUs in the in-vehicle network are illegally rewritten, and allow the external tool to update the data in the ECU.
- the plurality of electronic control units may communicate via the bus according to a Controller Area Network (CAN) protocol, and the external tool may transmit the update message according to the CAN protocol.
- CAN Controller Area Network
- the data in the ECU can be updated by an external tool appropriately authorized in the in-vehicle network system according to CAN.
- the update message when the update message is transmitted from the external tool, whether the update authority information indicates that transmission of the update message is within the authority range of the external tool based on the message ID of the update message If the update authority information indicates that the transmission of the update message is within the authority range of the external tool, the update message having the message ID is determined to be received.
- the update may be executed by the electronic control unit. Thereby, it is discriminated whether or not the ECU is the target of the update instruction in the update message based on the CAN frame ID (message ID). For this reason, the authority to update specific one or more ECUs can be distinguished from the authority to update other one or more ECUs. For example, the authority according to the ECU that is the target of the update instruction It is possible to allow the update only to the appropriate external tool that it has.
- the update authority information identifies one or more function types among the plurality of function types for classification of the electronic control unit, and is classified into any one of the identified one or more function types.
- the update message is transmitted from the external tool, the message ID is received based on the message ID of the update message.
- Performing the determination by determining whether or not the function type of the electronic control unit determined to match one of the one or more function types specified by the update authority information. It is also good. Thereby, for each function type that classifies the ECU in terms of function, an operation that distinguishes the authority to update and recognizes it as an external tool is possible.
- This authorization is performed, for example, by providing update authority information that can be verified.
- the update authority information indicates one level among a plurality of levels for specifying one or a plurality of the function types, and a relatively high level is one or more specified by a relatively low level.
- a plurality of function types including a plurality of function types may be specified. This makes it possible to change the level of authority for updating for each external tool. For example, an ECU other than the function type of the ECU that can be updated in response to leakage of confidential information about an external tool having a low level of authority (ie, an ECU that can be updated by an external tool having a high level of authority) ) Cannot be rewritten illegally.
- the update management apparatus that is one electronic control unit receives the update authority information from the external tool connected to the diagnostic port connected to the update management apparatus, performs the verification, and performs the verification from the external tool.
- the update message is transmitted, the update message is received.
- the verification is successful, and the update authority information indicates that the transmission of the update message is within the authority range of the external tool.
- the update authority information is transferred to the bus and the verification fails, or when the update authority information does not indicate that the transmission of the update message is within the authority range of the external tool, It is also possible to suppress forwarding. Thereby, since an update management apparatus (master ECU) controls whether an update message is transferred to other ECUs, other ECUs can omit the inspection related to the authority of the external tool.
- the update management apparatus receives the update authority information. Is received by receiving a public key certificate related to the public key of the external tool that describes the update authority information, and when the verification is successful, the external tool responds to the update message when transmitting the update message.
- the session key used for performing predetermined encryption processing may be encrypted with the public key of the external tool and transmitted to the external tool.
- the authority to update the external tool can be certified by issuing a public key certificate.
- the update management device suppresses transfer of the update message to the bus when the vehicle equipped with the in-vehicle network system is not in a predetermined state. It's also good. As a result, for example, when the vehicle is stopped or the engine is stopped as the predetermined state, data in the ECU is updated in a vehicle stop state where the load on the ECU related to traveling is reduced and bus traffic is relatively low. Therefore, for example, the possibility of a problem in updating can be reduced.
- the update management device updates the update when a battery that supplies power to each electronic control unit in the in-vehicle network system does not have a predetermined remaining battery level. It is also possible to suppress the transfer of messages to the bus. Accordingly, if a sufficient amount is set as the predetermined battery remaining amount, for example, sufficient for the remaining amount of the battery to be updated, it is possible to prevent a problem due to the battery running out during the update.
- the electronic control unit other than the update management apparatus and the update management apparatus hold a shared key shared between them for use in transmitting a session key for cryptographic processing related to communication contents, and the update message is
- the update of the data held by the electronic control unit that is instructed may be an update of the shared key.
- the shared key shared between the master ECU and the other ECUs can be updated by the external tool.
- warning information for prompting the renewal of the shared key may be output before a predetermined period of the expiration date of the shared key. As a result, key renewal can be prompted before the expiration date of the shared key, and the risk that the shared key can continue to be used after the expiration date can be reduced.
- the update management device may transmit identification information for identifying the in-vehicle network system among a plurality of in-vehicle network systems and result information indicating a processing result of the update message to the external tool. Thereby, it becomes possible to manage the update result of the data in ECU for every vehicle (that is, every vehicle-mounted network system) on the external tool side.
- the external tool may transmit the result information and the identification information to a server. Thereby, it becomes possible to manage the update result of the data in ECU for every vehicle in a server.
- the update of the data held by the electronic control unit indicated by the update message may be a firmware update of the electronic control unit.
- the authority for updating the ECU firmware can be flexibly set for each external tool.
- An update management apparatus is an update management apparatus that is one electronic control unit connected to a diagnostic port in an in-vehicle network system including a plurality of electronic control units that communicate via a bus.
- Update authority information indicating the authority of the external tool transmitted from the external tool connected to the diagnostic port, and updating of data held by the one or more electronic control units.
- a receiving unit that receives an instructing update message; a verification unit that verifies the update authority information received by the receiving unit; and the verification by the verification unit when the update message is received by the receiving unit.
- the update authority information indicates that the update message has been successfully transmitted and that the transmission of the update message is within the authority range of the external tool.
- An update management device comprising a transfer unit that suppresses the transfer.
- a control program provides an update management apparatus having a processor as one electronic control unit connected to a diagnosis port in an in-vehicle network system including a plurality of electronic control units that perform communication via a bus.
- An update authority information receiving step for receiving the update authority information to be shown, a verification step for verifying the update authority information received in the update authority information receiving step, and a transmission from the external tool via the diagnostic port, 1
- An update message for instructing update of data held by one or more of the electronic control units
- the update message is received at the update message reception step and the update message reception step is received, the verification at the verification step is successful, and the transmission of the update message is within the authority range of the external tool.
- the update authority information indicates that the update message is transferred to the bus and the verification in the verification step fails, or the transmission of the update message is within the authority range of the external tool.
- the transfer control step for suppressing the transfer.
- the master ECU 100 authenticates the external tool 30 and satisfies the predetermined condition only when the external tool 30 is satisfied. Shows an example of permitting updating of ECU data (firmware or the like).
- FIG. 1 is a diagram illustrating an overall configuration of an in-vehicle network system 10 according to the first embodiment.
- an external tool 30 is shown in FIG.
- This external tool 30 represents each of various external tools (for example, external tools 30a and 30b to be described later) manufactured by an operator who manufactures and maintains various ECUs, for example.
- the in-vehicle network system 10 is an example of a network communication system that performs communication according to a CAN protocol, and is a network communication system in an automobile (vehicle) in which various devices such as a control device and a sensor are mounted.
- the in-vehicle network system 10 includes a plurality of devices (nodes) that perform communication related to a frame via a bus according to the CAN protocol, and uses an update management method.
- the in-vehicle network system 10 includes an ECU 400a connected to a diagnostic port 600, buses 500a to 500d, a master ECU (update management device) 100, a head unit 200, a gateway 300, and various devices. And each node connected to a bus such as an ECU such as 400f.
- the in-vehicle network system 10 may include a number of ECUs in addition to the master ECU 100 and the ECUs 400a to 400f, but here, the description will be given with a focus on the master ECU 100 and the ECUs 400a to 400f for convenience.
- the ECU is a device including, for example, a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like.
- the memory is a ROM, a RAM, or the like, and can store a control program (computer program) executed by the processor. For example, when the processor operates according to the control program, the ECU realizes various functions.
- the computer program is configured by combining a plurality of instruction codes indicating instructions for the processor in order to achieve a predetermined function.
- the diagnostic port 600 is a port for connecting the external tool 30 when maintenance of the ECU configuring the in-vehicle network system 10 is performed, and is connected to the master ECU 100 via a bus 500d.
- the diagnostic port 600 is a connector compliant with, for example, OBD2.
- the external tool 30 can transmit a frame according to the CAN protocol to the in-vehicle network system 10 by connecting to the diagnostic port 600.
- the external tool 30 receives a message including a message ID within a certain range predetermined in the in-vehicle network system 10, such as an update message for updating the firmware of the ECU or a diagnostic message for diagnosing the failure of the ECU. Can be sent.
- the external tool transmits an update message (that is, an update request frame) including a predetermined range of message IDs for updating each of the ECU firmware and the shared key. I will explain.
- the master ECU 100 authenticates the external tool 30, and permits an update message from the external tool to be updated based on the update authority information described in the certificate of the external tool 30 (a public key certificate described later). It is a kind of ECU as an update management device having a role of performing a determination on whether or not.
- the master ECU 100 is used to transmit a session key for cryptographic processing related to communication contents in a frame between each of one or more ECUs other than its own device among a plurality of ECUs in the in-vehicle network system 10. The same shared key shared in advance is held, and the session key is transmitted to each ECU.
- the ECUs 400a to 400f are connected to any of the buses 500a to 500c, and are connected to the engine 310, the brake 320, the door opening / closing sensor 330, the window opening / closing sensor 340, the airbag 350, and the head unit 200, respectively.
- Each of the ECUs 400a to 400e acquires the state of the connected device (such as the engine 310), and periodically transmits a frame representing the state to the network (that is, the bus).
- the head unit 200 includes, for example, a display device such as a liquid crystal display (LCD) provided on an instrument panel (instrument panel) or the like of an automobile, and can notify a vehicle driver.
- the ECU 400f connected to the head unit 200 has a function of receiving a frame from the bus 500c and displaying various states represented by the frame on the display device of the head unit 200.
- the gateway 300 is connected to a bus 500a connected to the ECU 400a and the ECU 400b, a bus 500b connected to the master ECU 100 and the ECUs 400c to 400e, and a bus 500c connected to the ECU 400f, and transfers a frame received from each bus to another bus. It has the function to do. It is also possible to switch whether the received frame is transferred or not for each connected bus.
- the gateway 300 is a kind of ECU.
- each ECU including the master ECU 400 exchanges frames via the bus.
- Frames in the CAN protocol include a data frame, a remote frame, an overload frame, and an error frame.
- the data frame will be mainly described here.
- FIG. 2 is a diagram showing a data frame format defined by the CAN protocol.
- a data frame in a standard ID format defined by the CAN protocol is shown.
- the data frame includes an SOF (Start Of Frame), ID field, RTR (Remote Transmission Request), IDE (Identifier Extension), reserved bit “r”, DLC (Data Length Code), data field, CRC (Cyclic Redundancy Check) sequence.
- SOF is composed of 1-bit dominant. When the bus is idle, it is recessive, and the start of frame transmission is notified by changing to dominant by SOF.
- the ID field is a field for storing an ID (that is, a message ID) that is a value indicating the type of data, which is composed of 11 bits.
- RTR is a value for identifying a data frame and a remote frame, and is composed of a dominant 1 bit in the data frame.
- IDE and “r” are both composed of dominant 1 bit.
- DLC is composed of 4 bits and is a value indicating the length of the data field. IDE, “r”, and DLC are collectively referred to as a control field.
- the data field is a value indicating the content of data to be transmitted composed of a maximum of 64 bits. The length can be adjusted every 8 bits.
- the specification of the data to be sent is not defined by the CAN protocol, but is defined in the in-vehicle network system 10. Therefore, the specification depends on the vehicle type, manufacturer (manufacturer), and the like.
- CRC sequence consists of 15 bits. It is calculated from the transmission values of the SOF, ID field, control field and data field.
- CRC delimiter is a delimiter representing the end of a CRC sequence composed of 1-bit recessive.
- the CRC sequence and the CRC delimiter are collectively referred to as a CRC field.
- ACK slot consists of 1 bit.
- the transmitting node performs transmission with the ACK slot being recessive.
- the receiving node transmits an ACK slot as a dominant if reception is successful up to the CRC sequence. Since dominant is given priority over recessive, if the ACK slot is dominant after transmission, the transmitting node can confirm that any receiving node has received successfully.
- ACK delimiter is a delimiter representing the end of ACK composed of 1-bit recessive.
- EOF is composed of 7 bits recessive and indicates the end of the data frame.
- FIG. 3 is a diagram showing a key issuing system related to the ECU and the external tool described above.
- the key issuing organization 20 distributes the public key certificates 40a to 40c, the private keys 50a to 50c, and the shared key 60 to the manufacturer 21.
- the distributed keys and certificates are written by the manufacturer 21 in the external tools 30a and 30b, the master ECU 100, and the ECUs 400a to 400f at the manufacturing stage.
- the manufacturer 21 is, for example, an OEM manufacturer (Original Equipment Manufacturer), an ECU vendor, or the like.
- the public key certificate describing the public key and the private key are used in a public key infrastructure (PKI), and the public key and the private key are a key pair such as elliptical encryption or RSA encryption.
- PKI public key infrastructure
- the shared key 60 representatively represents each shared key.
- the shared key 60 is a common encryption key AES (Advanced Encryption Standard) key, and is shared between the master ECU 100 and other ECUs, and is used to transmit a session key for cryptographic processing related to the frame.
- AES Advanced Encryption Standard
- As encryption processing related to the frame in addition to encryption and decryption of the contents of the data field of the frame, for example, a message authentication code (MAC) is generated in the data field of the frame on the transmission side of the frame. In addition, a process of verifying the MAC on the receiving side can be given. This MAC makes it possible to detect data tampering.
- the session key is used for generating a MAC, for example.
- the public key certificate 40a and the private key 50a are written in the external tool 30a
- the public key certificate 40b and the private key 50b are written in the external tool 30b
- the master ECU 20 The public key certificate 40c, the private key 50c and the shared key 60 are written, and the shared key 60 is written in the ECUs 400a to 400f.
- the level of the update authority information described in the public key certificate 40a is 3, and the level of the update authority information described in the public key certificate 40b is 4.
- FIG. 4 is a diagram showing an example of the configuration of a public key certificate 40a that is issued or distributed by the key issuing institution 20 for writing to the external tools 30a and 30b.
- the public key certificate 40b has a similar configuration.
- a public key certificate includes a version, an issuer, start and end of a validity period, certificate identification information (ID), public key, update authority information (level), and a signature for them. Composed.
- the signature is given by the key issuing organization 20 or a certificate authority such as a portal server. Therefore, the master ECU 100 can authenticate the external tool 30 by acquiring a public key certificate from the external tool 30 and verifying the signature.
- the authority to transmit an update message instructing the external tool 30 (external tools 30a, 30b, etc.) to update the data in the ECU for any type of ECU is recognized. Specifically, it indicates one of the levels divided into a plurality of levels for the authority. For this reason, the level of authority authorized by the certificate authority or the like that is the signing entity for the external tool 30 is indicated in the update authority information.
- the public key certificate 40c written to the master ECU 100 includes elements other than the update authority information in the configuration example shown in FIG.
- FIG. 5 shows an example of a correspondence relationship between the level (that is, the authority level) as the content of the update authority information described in the public key certificate of FIG. 3 and a plurality of function types for classifying ECU functions.
- FIG. 5 shows an example of a correspondence relationship between the level (that is, the authority level) as the content of the update authority information described in the public key certificate of FIG. 3 and a plurality of function types for classifying ECU functions.
- the drive system function is a function related to traveling of the vehicle such as control of an engine, a motor, fuel, a battery, a transmission, and the like.
- the ECU 400a related to the engine 310 corresponds to the function type of the drive system function.
- the chassis system function is a function related to control of the behavior of the vehicle such as “turn”, “stop”, etc., such as brake and steering.
- the ECU 400b related to the brake 320 corresponds to the function type of the chassis system function.
- the body system function is a function related to control of vehicle equipment such as a door lock, an air conditioner, a light, and a blinker.
- the ECU 400c related to the door opening / closing sensor 330 and the ECU 400d related to the window opening / closing sensor 340 correspond to the function type of the body function.
- the safety / comfort function is a function for automatically realizing safe and comfortable driving such as an automatic brake, a lane keeping function, an inter-vehicle distance keeping function, a collision prevention function, and an air bag.
- the ECU 400e related to the airbag 350 corresponds to the function type of the safety / comfort function.
- the ITS (Intelligent Transport System) system function is a function corresponding to an intelligent transportation system such as ETC (Electronic Toll Collection System).
- the telematics function is a function corresponding to a service using mobile communication.
- the infotainment function is an entertainment function related to car navigation, audio, and the like.
- the ECU 400f related to the head unit 200 corresponds to the function type of the infotainment function, for example.
- the authority level as the content of the update authority information authorized by the certificate authority or the like that is the signing subject of the public key certificate is one of the above-described function types based on the correspondence illustrated in FIG. Alternatively, a plurality of function types are specified. Then, the external tool to which the public key certificate is given is sent to the data (firmware, shared) in the ECU, which is classified into one or a plurality of function types specified by the level of the update authority information. Key), that is, the authority to transmit an update message for updating the firmware or shared key.
- the public key certificate describing the update authority information indicating any one of the four levels from the highest level 4 to the lowest level 1 is given to each external tool. (That is, written).
- Individual external tools may have different functions, configurations, and the like. For this reason, for example, considering the function type of the ECU to be handled by the external tool, the confidentiality and reliability of the external tool, the reliability of the company that manufactures the external tool, and other various circumstances, Update authority information can be defined. Note that FIG. 5 only shows an example of the level, and the number of level stages, the correspondence between the level and the function type, and the like may be determined differently from this example.
- a correspondence relationship in which each of a plurality of levels (for example, level 4 and level 2) corresponds to the same function type may be determined. Further, the classification of the function type can be determined so as to be different from the example of FIG.
- a relatively high level in update authority information specifies a plurality of function types including one or more function types specified by a lower level, that is, a higher level includes a lower level authority. It will be described as being.
- the correspondence between levels and function types may be determined so that there is no authority inclusion relationship between authority levels.
- the level of authority authorized for external tools is relatively low, only the update of data in some ECUs not related to vehicle running, behavior, etc. is permitted, and other ECUs It is useful not to update the data inside.
- the level of authority authorized for the external tool (that is, the level that is the content of the update authority information) is 3, the external tool is assigned to all levels below level 3 (that is, level 1 to level 3). ) It is permitted to update the data in the ECU by transmitting an update message to each ECU classified into the function type corresponding to each.
- the master ECU 100 receives the update authority information that determines the authority level from the external tool 30, and based on this update authority information, the external tool 30 A determination is made as to whether or not to permit an update to the update message transmitted by 30. In this determination, the master ECU 100 refers to the level information 1040 determined based on the above-described correspondence between the level and the function type (see FIG. 5). The level information 1040 will be described later with reference to FIG.
- FIG. 6 is a diagram showing a shared key held by the master ECU 100 and the ECUs 400a to 400f.
- the shared key 60 described above includes a shared key 60a shared by all ECUs, a shared key 60b shared by the ECU 400f and the master ECU 100, ECUs 400c and 400d, and the master ECU 100, as shown in FIG. Shared key 60c shared by ECU 400a, 400b and master ECU 100, and shared key 60e shared by ECU 400e and master ECU 100.
- FIG. 7 is a configuration diagram of the master ECU 100.
- the master ECU 100 includes a transmission / reception unit 101, a key storage unit 102, a determination unit 103, a level information storage unit 104, a frame transmission / reception unit 160, a frame interpretation unit 150, a reception ID determination unit 130, and a reception ID list storage.
- Each of these components is a functional component, and each function is realized by a communication circuit in the master ECU 100, a processor that executes a control program stored in a memory, a digital circuit, or the like.
- the transmission / reception unit 101 transmits the public key certificate 40c of the master ECU 100 and the public key certificate (public key certificate 40a) from the external tool 30 for authentication between the master ECU 100 and the external tool 30 (external tools 30a, 30b). Alternatively, the public key certificate 40b) is received. Further, the transmission / reception unit 101 receives an update message according to the CAN protocol transmitted from the external tool 30 to the bus 500d via the diagnostic port 600, and transmits an update result by the update message.
- the key holding unit 102 holds the public key certificate 40c, the secret key 50c, and the shared keys 60a to 60e of the master ECU 100.
- the key holding unit 102 may hold a MAC key that is used when a MAC is assigned as an encryption process for data in a data frame according to the CAN protocol.
- a session key used for encryption processing related to communication with the external tool 30 or the like may be held in the key holding unit 102.
- the session key can also be used for MAC generation.
- the frame transmission / reception unit 160 transmits / receives a frame according to the CAN protocol to / from the bus 500b. That is, the frames from ECUs 400a to 400f are received and the frames are transmitted to ECUs 400a to 400f. A frame is received from the bus 500b bit by bit and transmitted to the frame interpretation unit 150. Further, the contents of the frame notified from the frame generation unit 120 are transmitted bit by bit to the bus 500b.
- the frame interpretation unit 150 receives a frame value from the frame transmission / reception unit 160 and interprets the value so as to map it to each field in the frame format defined by the CAN protocol.
- the frame interpretation unit 150 transfers the value (message ID) determined as the ID field to the reception ID determination unit 130.
- the value of the ID field and the data field appearing after the ID field are transferred to the frame processing unit 110, or reception of the frame is stopped (that is, the frame) To cancel the interpretation as).
- the frame generation unit 120 is notified to transmit an error frame. If the frame interpreter 150 receives an error frame, that is, if it interprets that the value in the received frame is an error frame, then the frame interpreter 150 discards the frame, that is, stops interpreting the frame. To do.
- the reception ID determination unit 130 receives the value of the ID field notified from the frame interpretation unit 150, and receives each field of the frame after the ID field according to the list of message IDs held by the reception ID list holding unit 140. Judge whether to do. The reception ID determination unit 130 notifies the frame interpretation unit 150 of the determination result. Similarly to the frame interpretation unit 150, the reception ID determination unit 130 also determines whether or not the message ID is a frame to be received, and notifies the determination result to the determination unit 103.
- the reception ID list holding unit 140 holds a reception ID list that is a list of message IDs received by the master ECU 100.
- the frame generation unit 120 configures an error frame in accordance with the error frame transmission request notified from the frame interpretation unit 150, and notifies the frame transmission / reception unit 160 to transmit the error frame.
- the data is subjected to encryption processing (for example, addition of a MAC corresponding to a session key or the like) to form a frame, and the frame transmission / reception unit 160 is notified and transmitted.
- the determination unit 103 authenticates the external tool 30 by verifying the public key certificate including the update authority information received from the external tool 30. If the determination unit 103 succeeds in verifying the public key certificate received from the external tool 30, the external tool 30 has been successfully authenticated. The fact that the determination unit 103 has successfully verified the public key certificate also means that the update authority information has been successfully verified.
- the determination unit 103 confirms that the update authority information has been successfully verified and that the transmission of the update message is within the authority range of the external tool 30. By determining whether or not the information indicates, it is determined whether or not the update corresponding to the update message is permitted.
- the message ID of the received update message and the level indicated by the update authority information described in the received public key certificate are compared with level information 1040 (described later) held by the level information holding unit 104. This is done by determining whether or not it corresponds appropriately.
- the determination unit 103 determines that the update authority information indicates that the transmission of the update message made by the external tool 30 is within the authority range of the external tool 30 (that is, when it is determined that the update message is permitted)
- the frame generation unit 120 is instructed to generate a new update message that is a frame corresponding to the (original) update message for transfer to another ECU (that is, for transmission to the bus 500b).
- the new update message generated for transfer by the frame generation unit 120 has the same message ID as the original update message, and the data in the data field of the update message is substantially the same. In the case of application, encryption processing (for example, MAC added to the data) applied to the data is different.
- the update message generated by the frame generation unit 120 is sent to the bus 500b by the frame transmission / reception unit 160. Thereby, when the verification of the update authority information from the external tool 30 is successful and it is determined that the update message from the external tool 30 is an allowed update message, the master ECU 100 determines that the update message is To the ECU (that is, to the bus 500b). If the determination unit 103 determines that the update message for updating the shared key from the external tool 30 is a permitted update message, the determination unit 103 updates the shared key held in the key holding unit 102.
- the frame processing unit 110 performs a predetermined process according to the frame data received from the bus 500b. For example, when the frame processing unit 110 receives a frame indicating an update result in each ECU by an update message from the bus 500b, the frame processing unit 110 generates a message (frame) having the update result as a content, and transmits and receives To the bus 500d connected to the diagnostic port 600.
- the level information holding unit 104 holds the level information 1040.
- FIG. 8 is a diagram illustrating an example of the level information 1040 held by the level information holding unit 104.
- the level information 1040 is information in which the message ID 1041 and the level 1042 are associated with each other, and is used in the determination unit 103 to determine whether or not to permit an update message from the external tool 30.
- Message ID 1041 indicates a message ID of an update message that can be transmitted from the external tool 30.
- “0x100” to “0x104” are defined as message IDs for the update message for updating the shared key held by the ECU
- “0x104” is defined as the message ID for the update message for updating the firmware of the ECU. The description will be made assuming that “0x200” to “0x206” are defined.
- Level 1042 indicates the level of authority necessary for transmitting the update message with the corresponding message ID. This level corresponds to the level as the contents of the update authority information. For example, if the value of the level indicated by the update authority information described in the public key certificate of the external tool 30 indicates a value indicating the authority equal to or higher than the value of the level 1042, it is associated with the value of the level 1042. The external tool 30 has the authority to transmit the update message with the received message ID 1041. Conversely, if the value of the level indicated by the update authority information described in the public key certificate of the external tool 30 is a value indicating an authority lower than the value of the level 1042, the message ID 1041 associated with the level 1042 is displayed. The external tool 30 does not have the authority to transmit the update message.
- the message ID “0x100” shown in FIG. 8 is a message ID regarding an update message for updating the shared key 60a held by the master ECU 100 and the ECUs 400a to 400f.
- the value of the level 1042 corresponding to this message ID “0x100” is set to 4 which is the highest. This 4 is the value of the highest level (specifically, the level corresponding to the safety / comfort function that is the function type of the ECU 400e) among the levels corresponding to the function type of each ECU that is the target of updating the shared key 60a. (See FIG. 5).
- the message ID “0x101” is a message ID for an update message for updating the shared key 60e held by the master ECU 100 and the ECU 400e.
- the value of the level 1042 is set to 4.
- the message ID “0x102” is a message ID for an update message for updating the shared key 60d held by the master ECU 100 and the ECUs 400a and 400b.
- the value of the level 1042 is set to 3 corresponding to the ECU 400a having the drive system function and the ECU 400b having the chassis system function.
- the message ID “0x103” is a message ID for an update message for updating the shared key 60c held by the master ECU 100 and the ECUs 400c and 400d.
- the value of the level 1042 is set to 2 corresponding to the ECUs 400c and 400d having the body functions.
- the message ID “0x104” is a message ID for an update message for updating the shared key 60b held by the master ECU 100 and the ECU 400f.
- the value of the level 1042 is set to 1 corresponding to the ECU 400f having the infotainment function.
- the message ID “0x200” is a message ID for an update message for updating the firmware of the master ECU 100.
- the value of the level 1042 corresponding to this message ID is set to 4 which is the highest level by specially handling the master ECU 100.
- the message ID “0x201” is a message ID for an update message for updating the firmware of the ECU 400e.
- the value of the level 1042 corresponding to this message ID is set to 4 corresponding to the ECU 400e having the safety and comfort function.
- the message ID “0x202” is a message ID for an update message for updating the firmware of the ECU 400b.
- the level 1042 value corresponding to this message ID is set to 3 corresponding to the ECU 400b having the chassis system function.
- the message ID “0x203” is a message ID for an update message for updating the firmware of the ECU 400a.
- the value of the level 1042 corresponding to this message ID is set to 3 corresponding to the ECU 400a having the drive system function.
- the message ID “0x204” is a message ID for an update message for updating the firmware of the ECU 400c.
- the value of level 1042 corresponding to this message ID is set to 2 corresponding to ECU 400c having a body system function.
- Message ID “0x205” is a message ID for an update message for updating the firmware of ECU 400d.
- the value of level 1042 corresponding to this message ID is set to 2 corresponding to ECU 400d having a body function.
- the message ID “0x206” is a message ID for an update message for updating the firmware of the ECU 400f.
- the value of the level 1042 corresponding to this message ID is set to 1 corresponding to the ECU 400f having the infotainment function.
- FIG. 9 is a configuration diagram of the ECU 400a.
- the ECU 400a includes a key storage unit 402, a frame transmission / reception unit 460, a frame interpretation unit 450, a reception ID determination unit 430, a reception ID list storage unit 440, a frame processing unit 410, a frame generation unit 420, and data acquisition. Part 470.
- Each of these components is a functional component, and each function is realized by a communication circuit in the ECU 400a, a processor that executes a control program stored in a memory, a digital circuit, or the like.
- the ECUs 400b to 400f have basically the same configuration as the ECU 400a.
- the key holding unit 402 holds the shared key shown in FIG. That is, the key holding unit 402 of the ECU 400a holds the shared keys 60a and 60d.
- the key holding unit 402 may hold a MAC key used when MAC is assigned as encryption processing to data in a data frame according to the CAN protocol. Further, a session key used for encryption processing related to communication with other ECUs or the like may be held in the key holding unit 402. The session key can also be used for MAC generation.
- the frame transmission / reception unit 460 transmits / receives a frame according to the CAN protocol to / from the bus 500a.
- a frame is received bit by bit from the bus 500a and transferred to the frame interpreter 450.
- the content of the frame notified from the frame generation unit 420 is transmitted to the bus 500a.
- the frame interpretation unit 450 receives a frame value from the frame transmission / reception unit 460 and interprets it so as to map it to each field in the CAN protocol.
- the value determined as the ID field is transferred to the reception ID determination unit 430.
- the value of the ID field (message ID) and the data field appearing after the ID field are transferred to the frame processing unit 410 or received the determination result Thereafter, it is determined whether to stop receiving the frame (that is, stop the interpretation as the frame). If it is determined that the frame does not comply with the CAN protocol, the frame generation unit 420 is notified to transmit an error frame. If the frame interpreter 450 receives an error frame, that is, if it interprets that the value in the received frame is an error frame, the frame interpreter 450 discards the frame thereafter, that is, cancels the interpretation of the frame. To do.
- the reception ID determination unit 430 receives the value of the ID field notified from the frame interpretation unit 450, and receives each field of the frames after the ID field according to the list of message IDs held by the reception ID list holding unit 440. Judge whether to do. The reception ID determination unit 430 notifies this determination result to the frame interpretation unit 450.
- the reception ID list holding unit 440 holds a reception ID list (see FIG. 10) that is a list of message IDs received by the ECU 400a.
- the frame processing unit 410 performs processing related to different functions for each ECU according to the received frame data.
- ECU 400a connected to engine 310 can perform predetermined control according to the relationship between the rotational speed of engine 310 and the state of a part of the vehicle indicated by frame data received from another ECU.
- the data acquisition unit 470 acquires data indicating the state of devices and sensors connected to the ECU, and notifies the frame generation unit 420 of the data.
- the frame generation unit 420 configures an error frame in accordance with the error frame transmission request notified from the frame interpretation unit 450, and notifies the frame transmission / reception unit 460 to transmit the error frame. Also, the frame generation unit 420 composes a data frame by adding a predetermined message ID to the value of the data field determined based on the data notified from the data acquisition unit 470, and notifies the frame transmission / reception unit 460 of the data frame. To send. Note that the frame generation unit 420 can add the MAC generated using the MAC key or the session key to the value of the data field.
- FIG. 10 shows an example of the reception ID list 900 held by the reception ID list holding unit 440 of the ECU 400a.
- the example in FIG. 10 indicates that the ECU 400a receives an update message for updating the shared key with the message ID “0x102”, an update message for updating the firmware with the message ID “0x203”, and the like. ing.
- the message IDs of the messages (frames) received by the ECU 400a are not limited to “0x102” and “0x203”. In the example of FIG.
- reception ID list held by the reception ID list holding unit 140 of the master ECU 100 also has a configuration in which the message IDs of messages that can be received by the master ECU 100 are listed in the same manner as the reception ID list 900.
- 11 and 12 are diagrams showing an example of a shared key update sequence performed among the external tool 30a, the master ECU 100, and the ECU 400a.
- the external tool 30a as one of the external tools 30 and the ECU 400a that is one of the ECUs 400a to 400f will be described.
- a description will be given assuming that the external tool 30a is used to update the shared key held by each ECU having the drive system function and the chassis system function.
- an update message with a message ID “0x102” for updating the shared key 60d held by each of the ECU 400a having the drive system function and the ECU 400b having the chassis system function is sent from the external tool 30a to the in-vehicle network system. 10 will be transmitted. Since the operation of the ECU 400b is similar to the operation of the ECU 400a, the description thereof is omitted here.
- the external tool 30a buses the certificate (that is, the public key certificate 40a held by the external tool 30a).
- an authentication request is transmitted to ECU 100 for communication connection (step S1001).
- the external tool 30a can transmit an update message for updating data (shared key, firmware) in the ECU of the in-vehicle network system 10 in accordance with, for example, a user operation.
- an authentication request certificate
- the transmission / reception unit 101 of the master ECU 100 receives the public key certificate 40a, and the determination unit 103 verifies the public key certificate 40a (step S1002).
- the signature by the certificate authority is verified, and further, the private key corresponding to the public key described in the public key certificate 40a by the challenge response (CR) authentication method is used as the external tool 30a.
- the master ECU 100 transmits a random number to the external tool 30a, and when the external tool 30a returns an encrypted random number, which is a result of encrypting the random number with a secret key, to the master ECU 100, the master ECU is disclosed.
- the encrypted random number is decrypted with the public key in the key certificate 40a, and it is confirmed whether it is equal to the first transmitted random number. If the verification in step S1002 fails, the master ECU 100 performs error processing (step S1003). Due to the error processing in step S1003, the communication connection from the external tool 30a is not permitted, and the external tool 30a cannot update the ECU data by transmitting an update message, for example. Note that the master ECU 100 may or may not return a response to the external tool 30a as error processing.
- the master ECU 100 If the verification in step S1002 is successful, the master ECU 100 generates a session key used for performing encryption processing in communication with the external tool 30a using a random number (step S1004). For example, when encrypting the data in the update message, the session key is used as a key for encryption, and when adding the MAC to the data in the update message, the session key generates the MAC. Used as a key to
- step S1004 the transmission / reception unit 101 of the master ECU 100 encrypts the session key with the public key of the external tool 30a, and obtains the encrypted session key as a result of the encryption and the public key certificate 40c of the master ECU 100. It transmits to the external tool 30a (step S1005).
- the external tool 30a verifies the public key certificate 40c of the master ECU 100 (step S1006). If the verification fails, error processing is performed (step S1007). If the verification is successful, the external tool 30a decrypts the encrypted session key transmitted and received from the master ECU 100 in step S1004 with the private key held by the external tool 30a to obtain the session key (step S1004). S1008).
- the external tool 30a After step S1008, the external tool 30a generates an update message for updating the shared key 60d with the message ID “0x102”, and performs an encryption process on the update message using the session key (step S1009). ).
- data necessary for updating the shared key 60d is stored in the data field (for example, data that becomes a key when the ECU 400a is updated by a keyed hash function or the like). And encrypting the data or adding a MAC to the data. Even when data is not required for updating the shared key 60d, for example, the MAC corresponding to the whole or a part of the update message can be stored in the data field.
- a predetermined cryptographic process to be performed (that is, a predetermined cryptographic process using a session key) to be performed is defined in advance as to what kind of processing is performed as the cryptographic process corresponding to the update message.
- each ECU performs an update in response to an update message in which predetermined encryption processing (for example, addition of MAC) is appropriately performed (that is, verification using a session key is successful) in accordance with the regulations, and the predetermined encryption If the process is not properly implemented, the update message is inhibited from being updated.
- predetermined encryption processing for example, addition of MAC
- the external tool 30a transmits the update message generated in step S1009 to the master ECU 100 (step S1010).
- the determination unit 103 determines whether or not the message ID of the message (frame) received by the transmission / reception unit 101 of the master ECU 100 is an ID to be received by the external tool 30a in step S1010. (Step S1011).
- the message IDs “0x100” to “0x104” for updating the shared key and the message IDs “0x200” to “0x206” for updating the firmware are determined to be IDs to be received.
- the description is made on the assumption that the external tool 30a transmits an update message. Therefore, a message (frame) from the external tool 30a is referred to as an update message, but it may not actually be an update message. Since this is possible, the determination is made in step S1011.
- the master ECU 100 does not handle a message ID for a message other than the update message as an ID to be received from the external tool 30 (for example, the external tool 30a) connected to the diagnostic port 600. .
- step S1011 If it is determined in step S1011 that the message ID of the message received by the transmission / reception unit 101 is not an ID to be received, the determination unit 103 of the master ECU 100 stops the process related to the message with the message ID and transmits / receives the transmission / reception unit. In 101, the process ends without receiving the contents (data field, etc.) after the ID field (step S1012).
- step S1011 when it is determined that the message ID of the message received by the transmission / reception unit 101 is an ID to be received, the determination unit 103 of the master ECU 100 determines the message ID “0x102” of the received message and the external tool 30a. Depending on whether or not the level of the update authority information described in the public key certificate 40a matches the correspondence between the message ID 1041 and the level 1042 in the level information 1040 held in the level information holding unit 104 It is determined whether or not the received message is a permitted update message (step S1013). That is, the determination unit 103 determines based on the level information 1040 whether or not the update authority information indicates that the transmission of the update message by the external tool 30a is within the authority range of the external tool 30a.
- step S1014 If the received message is not an allowed update message, error processing is performed (step S1014).
- the update corresponding to the update message is suppressed by the error processing in step S1014.
- the determination unit 103 determines that the update message received from the external tool 30a is a permitted update message.
- step S1013 when it is determined that the transmission of the received message is within the authority range of the external tool 30a (that is, when it is determined that the received message is a permitted update message), the determination unit 103 The generation unit 120 is instructed to generate a transfer update message (step S1015).
- a transfer update message (step S1015)
- a new update message (frame) for transfer to the bus 500b (that is, transfer to another ECU).
- frame generation is performed.
- unit 120 performs decryption using the session key for communication with external tool 30a, and uses the result of the process for communication with another ECU.
- a new update message is generated by performing encryption using the session key.
- the frame generation unit 120 generates a MAC using a session key used for communication with another ECU, and generates the MAC of the original update message. Is replaced with the generated MAC to generate a new update message. In this case, error processing may be performed when the MAC of the original update message is verified and the verification fails. Further, for example, when the session key used for communication with the external tool 30a by the master ECU 100 is the same as the session key used for communication with another ECU, the frame generation unit 120 uses the original update message and Generate the same new update message.
- the frame transmission / reception unit 160 sends the update message generated by the frame generation unit 120 of the master ECU 100 to the bus 500b (step S1016). That is, when the update message is transmitted from the external tool 30a, the master ECU 100 has successfully verified the update authority information (that is, the verification of the public key certificate), and has transmitted the update message to the external tool 30a. When the update authority information indicates that it is within the authority range, the update message is transferred to the bus 500b. When the verification of the update authority information has failed or when the update authority information does not indicate that the update message transmission is within the authority range of the external tool 30a, the update message is transferred to the bus 500b. I will not.
- the update authority information that is, the verification of the public key certificate
- the update message sent to the bus 500b by the master ECU 100 is transferred to the bus 500a and the bus 500c by the gateway 300.
- the ECUs 400a to 400f can receive the update message.
- the master ECU 100 determines that the update authority information indicates that the transmission of an update message with a message ID is within the authority range of the external tool 30a, it is predetermined to receive the update message with the message ID.
- An update corresponding to the update message can be executed by the existing ECU.
- the frame transmission / reception unit 460 receives the update message, the frame interpretation unit 450 interprets the content of the message, and inquires of the reception ID determination unit 430 whether there is an ID to be received.
- the reception ID determination unit 430 refers to the reception ID list held by the reception ID list holding unit 440 and determines whether the value of the ID field of the received message is an ID to be received (step S1017).
- the frame interpretation unit 450 relates to the received message.
- the processing is stopped, and the frame transmission / reception unit 460 ends the processing without receiving the contents after the ID field (step S1018).
- the ECU 400a causes the frame processing unit 410 to execute the message. Processing corresponding to (that is, update message) (that is, updating of shared key 60d) is executed (step S1019).
- a new shared key 60d to be updated is obtained from the shared key 60d currently held by the key holding unit 402 by using a key function in the data field of the update message by a keyed hash function. Generate.
- ECU 400a processing (decryption or MAC verification) corresponding to encryption processing (encryption or MAC addition) performed on the update message is performed using the session key, and key data of the update message is acquired.
- the ECU 400a sends a message indicating the result of the update (referred to as an update result message) to the master ECU 100 after the update of the shared key 60d to the bus 500a (S1020).
- the message ID of the update result message is determined in advance, and the master ECU 100 holds the message ID of the update result message in the list of the reception ID list holding unit 140.
- the update result message indicates, for example, that the update has been completed (that is, a successful update). When an error occurs during the update (for example, when the key data MAC verification fails), the update result message may indicate that the update has failed.
- the update result message is transferred from the bus 500a to the bus 500b by the gateway 300.
- the master ECU 100 updates the shared key 60d held by the key holding unit 102 (see FIG. 6) in the same manner as the ECU 400a (step S1021).
- the master ECU 100 holds the key holding unit 102 only when, for example, both the update result message indicating the successful update from the ECU 400a and the update result message indicating the successful update from the ECU 400b are received.
- the shared key 60d may be updated.
- the master ECU 100 transmits the update result message received in step S1020 to the external tool 30a via the diagnostic port 600 by sending it to the bus 500d (step S1022).
- the external tool 30a receives the update result message, knows that the target update has been completed in the in-vehicle network system 10, and notifies the user of the completion of the update (for example, the external tool 30a has a display device). If it does, it can be displayed).
- the external tool 30a transmits the update message for updating the shared key 60d held by each of the ECUs 400a, 400b and the master ECU 100 has been described.
- Each device performs the same operation even when an update message for updating firmware in the ECU is transmitted.
- the external tool 30a may sequentially transmit each update message after transmitting the authentication request once. In this case, after the processing from step S1001 to step S1008 is executed once, each time the external tool 30a transmits each update message, the processing after step S1009 is repeated.
- the update message for updating the firmware in the ECU includes, for example, information for specifying the content of the updated firmware, and the ECU that is the target of the update message specifies the content of the updated firmware.
- the firmware is rewritten based on the information.
- the firmware includes, for example, software such as a program in the ECU and data used in the program, and may include, for example, microcode in a processor in the ECU.
- the firmware may include data for circuit configuration when the ECU includes, for example, an FPGA (Field Programmable Gate Array).
- FPGA Field Programmable Gate Array
- the level of update authority information can be set (and certified) depending on, for example, the confidentiality and reliability of the external tool, the reliability of the operator handling the external tool, and other various circumstances. It is also possible to distribute external tools with different levels to different maintenance companies, etc., and it becomes possible to operate with limited update authority flexibly according to various circumstances. For example, an external tool with sufficient security such as confidentiality and reliability can recognize a higher authority level.
- the ability to set the level of update authority information for each external tool in this way is used to efficiently and flexibly design and manufacture the external tool according to the application, etc., or to ensure security in the operation of the external tool. It is useful to perform flexibly according to the situation.
- the master ECU 100 authenticates the external tool 30, and the update message from the external tool 30 is updated update information.
- the external tool 30 is allowed to update the data in the ECU with the update message only when it is within the range of authority (level) to be shown.
- the in-vehicle network system 10a not only the level but also the state of the vehicle in which the in-vehicle network system 10a is mounted, and the battery in the vehicle, in determining whether or not to permit the update message of the external tool 30 Refer to the status of the remaining amount.
- the configuration of the in-vehicle network system 10a according to the present embodiment is substantially the same as that of the in-vehicle network system 10 (see FIG. 1) shown in the first embodiment, and hereinafter, the same reference numerals are used for the same components as in the first embodiment. .
- FIG. 13 is a diagram showing an overall configuration of the in-vehicle network system 10a according to the second embodiment.
- an external tool 30 is shown in addition to the in-vehicle network system 10a.
- a storage battery 800 and an ECU 400g are added to the in-vehicle network system 10 (FIG. 1).
- description of the same components as those in the first embodiment is omitted.
- the ECU 400g is connected to the bus 500b, performs control related to charging / discharging of the battery (storage battery) 800, acquires and manages the remaining amount of the storage battery 800, and periodically displays a frame indicating the remaining battery state on the network (that is, To the bus 500b).
- the storage battery 800 supplies power to each ECU in the in-vehicle network system 10.
- FIG. 14 is a diagram illustrating an example of level information 2040 held by the level information holding unit 104 of the master ECU 100 according to the second embodiment.
- the level information 2040 is information in which the message ID 2014, the level 2042, the remaining battery level condition 2043, and the vehicle state condition 2044 are associated with each other, and the determination unit 103 determines whether or not to permit an update message from the external tool 30. Used.
- the message ID 2041 and the level 2042 are the same as the message ID 1041 and the level 1042 described in the first embodiment.
- the battery remaining amount condition 2043 indicates the condition of the remaining amount of battery required for permitting the update message. For example, the remaining amount of battery is set to an amount sufficient for the update. With the fully charged amount as 100%, either a remaining amount of 50% or more of charging or a remaining amount of 80% or more of charging is set.
- the vehicle state condition 2044 indicates a vehicle state condition required for permitting the update message. For example, the vehicle state condition (state where the vehicle speed is zero) and the engine OFF state (engine 310 is stopped). Is set).
- the update message for updating the shared key with the message ID “0x104” has an update authority information level of 1 or higher, the remaining battery level of the storage battery 800 is 50% or more, and the vehicle state is stopped. Indicates that it is allowed when The update message for updating the firmware with the message ID “0x201” is when the level of update authority information is 4, the remaining battery level of the storage battery 800 is 80% or more, and the vehicle state is the engine OFF state. Indicates that it is allowed.
- 15 and 16 are diagrams illustrating an example of a shared key update sequence performed among the external tool 30a, the master ECU 100, and the ECU 400a.
- the external tool 30a as one of the external tools 30 and the ECU 400a that is one of the ECUs 400a to 400g will be described. Further, a description will be given assuming that the external tool 30a is used to update the shared key held by each ECU having the drive system function and the chassis system function.
- an update message with a message ID “0x102” for updating the shared key 60d held by each of the ECU 400a having the drive system function and the ECU 400b having the chassis system function is sent from the external tool 30a to the in-vehicle network system. 10 will be transmitted.
- step S2001 to step S2012 and from step S2014 to step S2022 is equivalent to the processing from step S1001 to step S1012 and from step S1014 to step S1022 shown in the first embodiment (see FIGS. 11 and 12).
- the description is omitted, and only steps S2013a to S2013c different from the first embodiment will be described here.
- step S2013a the determination unit 103 of the master ECU 100 holds the message ID “0x102” of the received message and the level of the update authority information described in the public key certificate 40a of the external tool 30a in the level information holding unit 104. It is determined whether or not the received message satisfies the condition for the authority level as an appropriate update message depending on whether or not the correspondence between the message ID 2041 and the level 2042 in the level information 2040 that has been set matches. That is, the determination unit 103 determines based on the level information 2040 whether or not the update authority information indicates that the transmission of the update message by the external tool 30a is within the authority range of the external tool 30a. If the received message does not satisfy the condition for the authority level, error processing is performed (step S2014).
- the determination unit 103 determines that the update message received from the external tool 30a is an appropriate update message in terms of level, and moves the process to the next step S2013b.
- step S2013b the determination unit 103 checks whether the remaining battery level of the storage battery 800 satisfies a condition.
- the ECU 400g that manages the remaining battery level of the storage battery 800 periodically transmits a message indicating the remaining battery level (referred to as a remaining battery frame)
- the master ECU 100 displays the remaining battery frame from the ECU 400g. Received by the frame transmission / reception unit 160. Note that the reception ID list held by the reception ID list holding unit 140 of the master ECU 100 includes the message ID of the battery remaining amount frame from the ECU 400g.
- the determination unit 103 checks whether or not the remaining battery level indicated by the remaining battery level frame received from the ECU 400g satisfies the remaining battery level condition 2043 corresponding to the message ID 2041 held in the level information holding unit 104. If the remaining battery condition is satisfied, the process proceeds to the next step S2013c. If the condition of the remaining battery level is not satisfied (that is, if the result of the check is NG), error processing is performed (step S2014). Note that the ECU 400g may not periodically transmit the remaining battery level frame indicating the remaining battery level. In this case, in step S2013b, the master ECU 100 requests the ECU 400g to transmit the remaining battery level frame, for example. By transmitting the frame, the battery remaining amount frame may be received from the ECU 400g, and the state of the remaining battery amount when the update message is received (that is, current) may be acquired.
- step S2013c the determination unit 103 checks whether the vehicle state satisfies a condition.
- ECU 400a associated with engine 310 periodically transmits a message (referred to as a vehicle state frame) indicating vehicle state information such as the engine state and vehicle speed
- master ECU 100 transmits the vehicle state frame from ECU 400a to a frame transmission / reception unit. Receive at 160. It is assumed that the reception ID list held by the reception ID list holding unit 140 of the master ECU 100 includes the message ID of the vehicle state frame from the ECU 400a.
- the determination unit 103 checks whether or not the vehicle state such as the engine state and the vehicle speed indicated by the vehicle state frame received from the ECU 400a satisfies the vehicle state condition 2044 corresponding to the message ID 2041 held in the level information holding unit 104. To do. If the condition of the vehicle state is satisfied, the determination unit 103 determines that the update message received from the external tool 30a is permitted, and moves the process to step S2015. If the vehicle condition is not satisfied (that is, if the result of the check is NG), error processing is performed (step S2014). The ECU 400a may not periodically transmit the vehicle state frame.
- step S2013c the master ECU 100 transmits a frame requesting the ECU 400a to transmit the vehicle state frame, for example, from the ECU 400a.
- the vehicle state frame may be received to acquire the vehicle state at the time when the update message is received (that is, the present).
- FIG. 17 is a configuration diagram of the master ECU 100a.
- the master ECU 100a has a configuration in which a time information acquisition unit 180 and a key update confirmation unit 190 are added to the components of the master ECU 100 shown in the first embodiment in order to check the expiration date of the shared key.
- Each of these components is a functional component, and each function is realized by a communication circuit in the master ECU 100a, a processor that executes a control program stored in a memory, a digital circuit, or the like.
- the description of the components shown in the first embodiment is omitted.
- the time information acquisition unit 180 is configured by a timekeeping mechanism such as a real time clock, for example, and acquires the current time (that is, the current date and time) and sequentially notifies the key update confirmation unit 190.
- a timekeeping mechanism such as a real time clock, for example, and acquires the current time (that is, the current date and time) and sequentially notifies the key update confirmation unit 190.
- the key update confirmation unit 190 confirms the current time notified from the time information acquisition unit 180 and the expiration date set in advance for the shared key held by the key holding unit 102, and is set in advance as an alert notification timing. At a point in time when a certain timing has passed (that is, before a fixed period of the expiration date), the key update alert message is generated by the frame generation unit 120 and transmitted from the frame transmission / reception unit 160.
- FIG. 18 shows an example of information in which the shared key identification information 3310, the expiration date 3311, and the alert notification timing 3312 are associated with each other for each shared key held by the key holding unit 102.
- the shared key identification information 3310 is information for distinguishing each shared key.
- the expiration date 3311 indicates an expiration date determined in advance for ensuring the security of the shared key indicated by the corresponding shared key identification information.
- the alert notification timing 3312 indicates the timing at which the key update should be prompted prior to the expiration date.
- the key update confirmation unit 190 refers to the information shown in FIG. For example, in the case of the shared key 60a, a key update alert message is transmitted from three months before the expiration date, and in the case of the shared key 60d, a key update alert message is transmitted from one month before the expiration date.
- the key update alert message is received by the ECU 400f connected to the head unit 200.
- the ECU 400f displays warning information (screen) prompting the renewal of the shared key indicating that the expiration date of the shared key is approaching on the display device of the head unit 200.
- FIG. 19 is a diagram illustrating an example of a screen displayed on the display device of the head unit 200 when the expiration date of the shared key approaches.
- the screen 3320 includes the current date and time and the expiration date of the shared key of the ECU. Further, the contact information of the maintenance company (dealer in this example) for updating the shared key, the website Contains URL (Uniform Resource Locator).
- the screen 3320 includes a GUI (Graphical User Interface) button 3321 for transitioning to a screen for setting the destination to the dealer's address by the navigation system.
- the dealer information may be registered in advance in the master ECU 100a at the time of sale, for example, or may be acquired via an ECU having a telematics function.
- the dealer or the like may use the external tool 30 as described in the first and second embodiments. Can be used to update the shared key held by the ECU in the in-vehicle network system.
- Embodiment 3 In the in-vehicle network system according to Embodiment 3, the expiration date of the shared key is managed, and when the expiration date approaches, warning information (screen) that prompts the driver of the vehicle to update the key is displayed on the head unit. Display on the display device. As a result, alerting for ensuring the security related to the shared key, such as a warning to receive maintenance at a dealer or the like, is realized.
- the master ECU 100 in the in-vehicle network system 10 according to the first embodiment is modified so that vehicle update information is attached to the update result message and transmitted to the external tool 30, and the external tool 30 is connected to the server 35.
- vehicle update information is attached to the update result message and transmitted to the external tool 30, and the external tool 30 is connected to the server 35.
- the server 35 that communicates with the external tool 30 is a computer located outside the vehicle on which the in-vehicle network system 10 is mounted. Assuming that the in-vehicle network system 10 is mounted on each of the plurality of vehicles, the server 35 determines which update (data in the ECU) the external tool 30 has for which vehicle (that is, the in-vehicle network system). (Update) is managed.
- step S3001 to step S3021 are diagrams illustrating an example of a shared key update sequence performed between the external tool 30a communicating with the server 35, the master ECU 100, and the ECU 400a.
- the processing from step S3001 to step S3021 is the same as the processing from step S1001 to step S1021 shown in the first embodiment (see FIGS. 11 and 12), and thus the description thereof is omitted.
- the processing is different from the first embodiment. Only steps S3000a, S3000b, S3022, S3023, and S3024 will be described.
- step S3000a the external tool 30a issues a connection request to the server 35. That is, the external tool 30a transmits a login request using, for example, a pre-registered ID (for example, a tool ID) and a password to the server 35.
- a pre-registered ID for example, a tool ID
- a password for example, a password
- step S3000b the server 35 receives a connection request from the external tool 30a, performs a login process and returns a normal response if the ID and password match information registered in advance.
- step S3000b the external tool 30a, the master ECU 100, and the ECU 400a perform processing related to the update of the shared key as described in the first embodiment.
- step S3020 master ECU100 has received the update result message which shows the update result from ECU400a.
- step S3022 the master ECU 100 sends an update result message with vehicle identification information, which is a message including the vehicle identification information, to the bus 500d in addition to the update result from the ECU 400a, thereby allowing the external tool 30a to pass through the diagnostic port 600. Send to. Thereby, the external tool 30a receives the update result message with vehicle identification information.
- vehicle identification information only needs to identify the in-vehicle network system to which the external tool 30a is connected among the plurality of in-vehicle network systems.
- the vehicle identification information is a public key certificate 40c (see FIG. 3) of the master ECU 100. is there.
- step S ⁇ b> 3023 the external tool 30 a transmits the vehicle identification information and the update result indicated by the received update result message with vehicle identification information to the server 35.
- step S3024 the server 35 stores the received vehicle identification information and the update result, the current date and time, and the log information 4000 in association with the ID received at the time of login.
- FIG. 22 is a diagram illustrating an example of log information 4000 stored by the server 35.
- the log information 4000 includes vehicle identification information 4001, an external tool ID 4002, an update message message ID 4003, a date and time 4004, and an update result 4005.
- the server 35 stores the log information 4000 and information such as which vehicle has been updated by which external tool remains, so that the maintenance status can be grasped.
- the log information 4000 can be used for specifying the range of influence by the external tool.
- Embodiments 1 to 4 have been described as examples of the technology according to the present invention.
- the technology according to the present invention is not limited to this, and can also be applied to embodiments in which changes, replacements, additions, omissions, etc. are made as appropriate.
- the following modifications are also included in one embodiment of the present invention.
- the shared key shown in the above embodiment shows an example in which the shared range is distinguished by the function type for classifying the function, it is not limited to this, and the master ECU and one or more other
- the unit in which the ECU has the shared key can be arbitrarily determined in the in-vehicle network system.
- the in-vehicle network may be divided into a plurality of domains and a shared key may be set for each domain.
- the level information may be set by distinguishing the domain as the level of authority required for the update.
- the external tool 30 has the public key certificate including the update authority information in which the authority level is set based on the function type. However, the update corresponding to the automobile manufacturer and the vehicle type is shown. It is also possible to have a public key certificate including update authority information in which the authority is set.
- the shared key is updated by generating a new shared key using a keyed hash function from the shared key currently held by each ECU.
- the tool 30 may send the new shared key itself in the update message. In this case, if the value of the shared key does not fit within one frame of CAN, it may be divided into a plurality of frames and transmitted.
- an update message for updating data (shared key, firmware, etc.) in the ECU is transmitted from the external tool 30 is shown. Can be sent.
- in-vehicle network system for example, master ECU
- in-vehicle network system may perform processing corresponding to the message without determining the authority based on the level information.
- authority information indicating an authority level indicating whether the transmission of the message is within the authority range permitted by the external tool 30 in the in-vehicle network system (for example, master ECU). It is good also as judging based on.
- the authority level is set from 1 to 4, but the level does not have to be four levels, and may be set to be more than that.
- the method of classifying the function type shown in the above embodiment is merely an example, and may be subdivided in more detail, for example.
- the function type may be classified most finely, and for example, the authority level related to updating of data in the ECU may be set for each ECU.
- the battery remaining condition 2043 is distinguished based on the ratio (percentage) of the storage battery 800 with respect to the full charge, but the battery remaining condition 2043 may be distinguished based on the voltage of the storage battery 800 or the like. Further, a condition for distinguishing whether or not the storage battery 800 is being charged from an external power source located outside the vehicle may be set. Thereby, for example, it is possible to permit a certain shared key and firmware update only during charging.
- the time information acquisition unit 180 of the master ECU 100a acquires the current time with a timekeeping mechanism in order to confirm that the shared key has expired, but WiFi (registered trademark), mobile phone Time information indicating the current time may be acquired from a telephone carrier network, or time information may be acquired from a GPS (Global Positioning System) signal. Further, the master ECU 100a may acquire time information from another ECU.
- WiFi registered trademark
- mobile phone Time information indicating the current time may be acquired from a telephone carrier network
- time information may be acquired from a GPS (Global Positioning System) signal.
- GPS Global Positioning System
- the external tool 30 shown in the above embodiment may acquire the update message by receiving it from the server and transfer it to the master ECU via the diagnostic port 600.
- authentication is performed between the external tool 30 and the master ECU.
- an electronic circuit for example, a memory, a processor, or the like responsible for authentication is provided to the diagnostic port 600 that is a connector or the like compliant with OBD2.
- the master ECU can omit the authentication of the external tool 30.
- the authentication may be performed between the external tool 30 and the master ECU as shown in the above embodiment.
- the diagnostic port 600 may be realized by another connector instead of a connector compliant with OBD2.
- the diagnostic port 600 including the wireless communication circuit may be realized so that it can be connected to the external tool 30 by wireless communication.
- the update authority information may indicate not only the authority level but also the conditions for the update authority such as the battery remaining condition and the vehicle state condition described in the second embodiment.
- the update authority information specifies at least one stop state that is the state of the vehicle as the vehicle state condition or a state in which the engine is stopped, and transmits an update message when the vehicle is in the specified state. As one condition, it may be expressed that the external tool has the authority to update the ECU.
- the update authority information specifies a remaining battery state that supplies power to the ECU as a remaining battery condition, and an update message is displayed when the battery has the specified remaining battery capacity. It is also possible to indicate that the external tool has the authority to update the ECU under the condition that transmission is at least one condition. Then, for example, the master ECU 100 performs a check (steps S2013b and S2013c) based on the battery remaining condition and vehicle state condition indicated by the update authority information instead of the battery remaining condition 2043 and the vehicle state condition 2044 in the level information 2040. You may make it do. This allows the external tool to recognize the authority with a certain condition according to the reliability of the external tool, etc., and to provide the public key certificate with the update authority information indicating the condition and the level of authority. Operation like issuing is possible.
- the data frame in the CAN protocol is described in the standard ID format, but it may be in the extended ID format.
- the message ID is represented by 29 bits by combining the base ID at the ID position in the standard ID format and the extended ID.
- the master ECU updates the update message that is permitted. (Step S1013), if the update message is not permitted, error processing is performed (step S1014), and the update corresponding to the update message is suppressed.
- an ECU other than the master ECU for example, an ECU to be instructed to update by an update message
- the gateway 300 manages the function type of the ECU connected to the transfer destination bus or the message ID that can be received by the ECU. When the gateway 300 receives the update message, the gateway 300 connects to the transfer destination bus. An unnecessary update message may not be transferred based on the function type of the ECU or the message ID that can be received by the ECU.
- the master ECUs 100 and 100 a include a receiving unit corresponding to the receiving function of the transmission / reception unit 101, a verification unit in charge of verifying the public key certificate (public key certificate including update authority information) in the determination unit 103, and the determination unit 103. And a transfer unit that performs control related to transmission of the update message corresponding to a part of the frame generation unit 120 and a part of the frame transmission / reception unit 160.
- the receiving unit transmits update authority information indicating the authority of the external tool 30 and one or more ECUs transmitted from the external tool 30 connected to the diagnosis port 600 via the diagnosis port 600. Bears the function of receiving an update message instructing to update the data held by.
- the verification unit has a function of verifying the update authority information received by the reception unit.
- the transfer unit indicates that the verification by the verification unit is successful and the update authority information indicates that the transmission of the update message is within the authority range of the external tool 30
- the control program executed by the processor in the master ECU 100, 100a having a processor may be a program for causing the master ECU 100, 100a to execute, for example, the following predetermined update management process.
- the predetermined update management process includes an update authority information receiving step for receiving update authority information indicating the authority of the external tool transmitted from the external tool connected to the diagnostic port, and an update authority information receiving step.
- the update message receiving step for receiving the update message transmitted from the external tool through the diagnostic port, and the update message receiving step
- the update message is transferred to the bus for communication with the ECU
- verification in the verification step fails or the update message is sent by an external tool
- a transfer control step of inhibiting the transfer When the update authority information does not indicate that it is within the limited range, and a transfer control step of inhibiting the transfer.
- the master ECU and other ECUs in the above embodiment are devices including a digital circuit such as a processor and a memory, an analog circuit, a communication circuit, and the like.
- a digital circuit such as a processor and a memory
- an analog circuit such as a communication circuit, and the like.
- a hard disk device such as a hard disk device, a display, a keyboard, and a mouse
- the function may be realized by dedicated hardware (digital circuit or the like).
- a part or all of the constituent elements constituting each device in the above embodiment may be constituted by one system LSI (Large Scale Integration).
- the system LSI is an ultra-multifunctional LSI manufactured by integrating a plurality of components on a single chip.
- the system LSI is a computer system including a microprocessor, a ROM, a RAM, and the like. .
- a computer program is recorded in the RAM.
- the system LSI achieves its functions by the microprocessor operating according to the computer program.
- each part of the constituent elements constituting each of the above devices may be individually made into one chip, or may be made into one chip so as to include a part or the whole.
- the system LSI is used here, it may be called IC, LSI, super LSI, or ultra LSI depending on the degree of integration.
- the method of circuit integration is not limited to LSI's, and implementation using dedicated circuitry or general purpose processors is also possible.
- An FPGA that can be programmed after manufacturing the LSI, or a reconfigurable processor that can reconfigure the connection and setting of circuit cells inside the LSI may be used.
- integrated circuit technology comes out to replace LSI's as a result of the advancement of semiconductor technology or a derivative other technology, it is naturally also possible to carry out function block integration using this technology. Biotechnology can be applied as a possibility.
- a part or all of the constituent elements constituting each of the above devices may be constituted by an IC card or a single module that can be attached to and detached from each device.
- the IC card or the module is a computer system including a microprocessor, a ROM, a RAM, and the like.
- the IC card or the module may include the super multifunctional LSI described above.
- the IC card or the module achieves its function by the microprocessor operating according to the computer program. This IC card or this module may have tamper resistance.
- One aspect of the present invention may be an update management method such as the shared key update sequence described above.
- the present invention may be a computer program that realizes these methods by a computer, or may be a digital signal composed of the computer program.
- the computer program or the digital signal can be read by a computer, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, and a BD. (Blu-ray (registered trademark) Disc), recorded on a semiconductor memory or the like. Further, the digital signal may be recorded on these recording media.
- the computer program or the digital signal may be transmitted via an electric communication line, a wireless or wired communication line, a network typified by the Internet, data broadcasting, or the like.
- an aspect of the present invention may be a computer system including a microprocessor and a memory, in which the memory records the computer program, and the microprocessor operates according to the computer program.
- the program or the digital signal is recorded on the recording medium and transferred, or the program or the digital signal is transferred via the network or the like and executed by another independent computer system. You may do that.
- the present invention can be used for managing updates of ECU firmware and the like from an external tool in an in-vehicle network to reduce the risk of unauthorized rewriting and the like.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computing Systems (AREA)
- Health & Medical Sciences (AREA)
- Databases & Information Systems (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Mechanical Engineering (AREA)
- Stored Programmes (AREA)
- Small-Scale Networks (AREA)
Abstract
Description
以下、本発明の実施の形態として、更新管理装置としてのマスタECU100を含む複数のECUがバスを介して通信する車載ネットワークシステム10において用いられる更新管理方法について、図面を用いて説明する。
図1は、実施の形態1に係る車載ネットワークシステム10の全体構成を示す図である。なお、同図には車載ネットワークシステム10の他に、外部ツール30が示されている。この外部ツール30は、例えば各種ECUの製造、メンテナンスを行う事業者等により製造された、個々の各種外部ツール(例えば後述する外部ツール30a、30b)を代表して表したものである。車載ネットワークシステム10は、CANプロトコルに従って通信するネットワーク通信システムの一例であり、制御装置、センサ等の各種機器が搭載された自動車(車両)におけるネットワーク通信システムである。車載ネットワークシステム10は、CANプロトコルに従ってバスを介してフレームに係る通信を行う複数の装置(ノード)を備え、更新管理方法を用いる。具体的には図1に示すように車載ネットワークシステム10は、診断ポート600と、バス500a~500dと、マスタECU(更新管理装置)100、ヘッドユニット200、ゲートウェイ300、各種機器に接続されたECU400a~400f等のECUといったバスに接続された各ノードとを含んで構成される。なお、車載ネットワークシステム10には、マスタECU100及びECU400a~400f以外にもいくつものECUが含まれ得るが、ここでは、便宜上マスタECU100及びECU400a~400fに注目して説明を行う。ECUは、例えば、プロセッサ(マイクロプロセッサ)、メモリ等のデジタル回路、アナログ回路、通信回路等を含む装置である。メモリは、ROM、RAM等であり、プロセッサにより実行される制御プログラム(コンピュータプログラム)を記憶することができる。例えばプロセッサが、制御プログラムに従って動作することにより、ECUは各種機能を実現することになる。なお、コンピュータプログラムは、所定の機能を達成するために、プロセッサに対する指令を示す命令コードが複数個組み合わされて構成されたものである。
以下、CANプロトコルに従ったネットワークで用いられるフレームの1つであるデータフレームについて説明する。
図3は、上述したECU及び外部ツールに関わる鍵発行システムを示す図である。鍵発行機関20は、公開鍵証明書40a~40c、秘密鍵50a~50c、共有鍵60をメーカ21に配布する。配布された鍵や証明書は、メーカ21によって製造段階等において、外部ツール30a、30b、マスタECU100、ECU400a~400fに書き込まれる。メーカ21は、例えばOEMメーカ(Original Equipment Manufacturer)、ECUベンダー等である。公開鍵を記載した公開鍵証明書と、秘密鍵とは、公開鍵基盤(PKI:Public Key Infrastructure)で利用され、公開鍵及び秘密鍵が、楕円暗号、RSA暗号等の鍵ペアである。この秘密鍵及び公開鍵証明書は、マスタECU100と外部ツール30a~b間の認証に用いられる。共有鍵60は、個々の共有鍵を代表的に表している。この共有鍵60は、共通鍵暗号方式のAES(Advanced Encryption Standard)の鍵であり、マスタECU100と他の各ECUとの間で共有され、フレームに係る暗号処理用のセッション鍵の伝達に用いられる。フレームに係る暗号処理としては、フレームのデータフィールドの内容の暗号化及び復号の他に、例えば、フレームの送信側で、フレームのデータフィールドに、メッセージ認証コード(MAC:Message Authentication Code)を生成して付加して送信し、受信側ではそのMACについて検証する処理が挙げられる。このMACによりデータの改ざんの検出が可能となる。セッション鍵は、例えばMACの生成に用いられる。
図4は、鍵発行機関20が、外部ツール30a、30bに書き込まれるために発行つまり配布する公開鍵証明書40aの構成の一例を示す図である。公開鍵証明書40bも同様の構成を有する。
図5は、図3の公開鍵証明書に記載された更新権限情報の内容としてのレベル(つまり権限のレベル)と、ECUの機能の分類用の複数の機能種別との対応関係の一例を示す図である。
図6は、マスタECU100、ECU400a~400fが保持する共有鍵を示す図である。上述した共有鍵60は、具体的には同図に示すように、全ECUで共有される共有鍵60aと、ECU400fとマスタECU100とで共有される共有鍵60bと、ECU400c、400dとマスタECU100とで共有される共有鍵60cと、ECU400a、400bとマスタECU100とで共有される共有鍵60dと、ECU400eとマスタECU100とで共有される共有鍵60eがある。
図7は、マスタECU100の構成図である。マスタECU100は、送受信部101と、鍵保持部102と、判定部103と、レベル情報保持部104と、フレーム送受信部160と、フレーム解釈部150と、受信ID判断部130と、受信IDリスト保持部140と、フレーム処理部110と、フレーム生成部120とを含んで構成される。これらの各構成要素は、機能的な構成要素であり、その各機能は、マスタECU100における通信回路、メモリに格納された制御プログラムを実行するプロセッサ或いはデジタル回路等により実現される。
図8は、レベル情報保持部104が保持するレベル情報1040の一例を示す図である。
図9は、ECU400aの構成図である。ECU400aは、鍵保持部402と、フレーム送受信部460と、フレーム解釈部450と、受信ID判断部430と、受信IDリスト保持部440と、フレーム処理部410と、フレーム生成部420と、データ取得部470とを含んで構成される。これらの各構成要素は、機能的な構成要素であり、その各機能は、ECU400aにおける通信回路、メモリに格納された制御プログラムを実行するプロセッサ或いはデジタル回路等により実現される。なお、ECU400b~400fも、ECU400aと基本的に同様の構成を備える。
図10は、ECU400aの受信IDリスト保持部440が保持する受信IDリスト900の一例を示す。
以下、更新管理方法の一例として、外部ツール30aを診断ポート600に接続して、外部ツール30aから車載ネットワークシステム10におけるECUが保持する共有鍵を更新させる場合の動作(共有鍵更新シーケンス)について、図11及び図12を用いて説明する。
実施の形態1に係る車載ネットワークシステム10では、診断ポート600に接続される外部ツール30が特定のECU内のデータを更新する更新メッセージの送信権限を有するか否か、つまり外部ツール30が特定のECU内のデータを更新する権限を有するか否かを、外部ツール30に対して認定された権限を示す更新権限情報が示す、ECUの機能種別に対応して定められたレベルに基づいて、判定している。これにより、不正な外部ツールによるECU内の共有鍵或いはファームウェアの更新を防ぐことができる。また。外部ツール毎に、例えば外部ツールの機密性、信頼性、外部ツールを扱う事業者の信頼性その他の各種事情に応じて、更新権限情報のレベルを異ならせて設定(及び認定)できる。レベルを変えた外部ツールを別々のメンテナンス業者等に対して配布することも可能となり、各種事情に応じて柔軟に更新権限を制限した運用が可能になる。例えば、機密性、信頼性等のセキュリティ確保が十分である外部ツールほど、高い権限のレベルを認定する等が可能となる。このように外部ツール毎に更新権限情報のレベルを設定できることは、外部ツールを用途等に応じて効率的に柔軟に設計及び製造するために、或いは、外部ツールの運用上のセキュリティ確保等を用途に応じて柔軟に行うために、有用となる。
以下、実施の形態1で示した車載ネットワークシステム10を一部変形してなる車載ネットワークシステム10aについて説明する。
図13は、実施の形態2に係る車載ネットワークシステム10aの全体構成を示す図である。なお、同図には車載ネットワークシステム10aの他に、外部ツール30が示されている。
図14は、実施の形態2におけるマスタECU100のレベル情報保持部104が保持するレベル情報2040の一例を示す図である。
以下、更新管理方法の一例として、外部ツール30aを診断ポート600に接続して、外部ツール30aから車載ネットワークシステム10aにおけるECUが保持する共有鍵を更新させる場合の動作(共有鍵更新シーケンス)について、図15及び図16を用いて説明する。
実施の形態2に係る車載ネットワークシステム10aでは、外部ツール30からの更新メッセージに係る処理(更新)を許可するか否かについて、権限のレベルだけでなく電池残量の状態及び車両状態がどのような場合に更新メッセージが送信されたかに応じて判定している。このため、実施の形態1に係る車載ネットワークシステム10の効果に加え、次の効果を有する。即ち、電池残量を確認することで、ECU内のデータ(共有鍵或いはファームウェア)の更新処理が途中で途切れることなく確実に完了させられる。また、車両状態を確認することで、例えば、車両の走行中等のECUの負荷が高くバストラフィックが増大するときに更新メッセージを転送して更新を行うことを回避でき、更新が成功する可能性を高められる。
本実施の形態では、実施の形態1に係る車載ネットワークシステム10におけるマスタECU100を部分的に変形し、共有鍵の有効期限に係る報知を行えるようにした例について説明する。
図17は、マスタECU100aの構成図である。マスタECU100aは、実施の形態1で示したマスタECU100の構成要素に、共有鍵の有効期限をチェックするために、時刻情報取得部180と鍵更新確認部190とを加えた構成を有する。これらの各構成要素は、機能的な構成要素であり、その各機能は、マスタECU100aにおける通信回路、メモリに格納された制御プログラムを実行するプロセッサ或いはデジタル回路等により実現される。ここでは、実施の形態1で示した構成要素についての説明を省略する。
図19は、共有鍵の有効期限が近付いた場合に、ヘッドユニット200の表示装置に表示される画面の一例を示す図である。
実施の形態3に係る車載ネットワークシステムにおいては、共有鍵の有効期限を管理し、有効期限が近付いた場合に、車両の運転者等に鍵更新を促すような警告情報(画面)をヘッドユニットの表示装置に表示する。これにより、ディーラー等でのメンテナンスを受けるべきことの警告等といった共有鍵に係るセキュリティを確保するための注意喚起が実現される。
本実施の形態では、実施の形態1に係る車載ネットワークシステム10におけるマスタECU100を、更新結果メッセージに車両識別情報を付して外部ツール30へ送信するように変形し、外部ツール30がサーバ35と通信するようにした例について説明する。
外部ツール30と通信するサーバ35は、車載ネットワークシステム10が搭載される車両の外部に所在するコンピュータである。複数の車両それぞれに車載ネットワークシステム10が搭載されていることを前提として、サーバ35は、外部ツール30が、どの車両(つまり車載ネットワークシステム)に対して、どのような更新(ECU内のデータの更新)を行ったかを管理する。
以下、本実施の形態での更新管理方法の一例として、サーバ35と通信する外部ツール30aを、ある車両の車載ネットワークシステム10における診断ポート600に接続して、外部ツール30aから車載ネットワークシステム10におけるECUが保持する共有鍵を更新させる場合の動作(共有鍵更新シーケンス)について、図20及び図21を用いて説明する。
図22は、サーバ35が保存するログ情報4000の一例を示す図である。ログ情報4000は、車両識別情報4001と、外部ツールID4002と、更新メッセージのメッセージID4003と、日時4004と、更新結果4005とを含む。
本実施の形態では、サーバ35が、ログ情報4000を保存し、どの車両がどの外部ツールによって更新されたか等の情報が残るので、メンテナンス状況の把握が可能となる。また、不正な外部ツールが発見された場合にその外部ツールによる影響範囲の特定のためにログ情報4000が利用できる。
以上のように、本発明に係る技術の例示として実施の形態1~4を説明した。しかしながら、本発明に係る技術は、これに限定されず、適宜、変更、置き換え、付加、省略等を行った実施の形態にも適用可能である。例えば、以下のような変形例も本発明の一実施態様に含まれる。
20 鍵発行機関
21 メーカ
30,30a,30b 外部ツール
35 サーバ
101 送受信部
102,402 鍵保持部
103 判定部
104 レベル情報保持部
110,410 フレーム処理部
120,420 フレーム生成部
130,430 受信ID判断部
140,440 受信IDリスト保持部
150,450 フレーム解釈部
160,460 フレーム送受信部
180 時刻情報取得部
190 鍵更新確認部
200 ヘッドユニット
300 ゲートウェイ
310 エンジン
320 ブレーキ
330 ドア開閉センサ
340 窓開閉センサ
350 エアバッグ
470 データ取得部
500a~500d バス
600 診断ポート
800 蓄電池
Claims (16)
- バスを介して通信を行う複数の電子制御ユニットを備え、外部ツールが接続される車載ネットワークシステムにおいて用いられる更新管理方法であって、
前記外部ツールの権限を示す更新権限情報を受信して検証し、
前記外部ツールから、1つ又は複数の前記電子制御ユニットが保持するデータの更新を指示する更新メッセージが送信された場合において、
前記検証が成功し、かつ、当該更新メッセージの送信が当該外部ツールの権限範囲内であることを前記更新権限情報が示すときには、前記更新メッセージに対応して前記1つ又は複数の電子制御ユニットにより前記更新を実行し、
前記検証が失敗したとき、又は、当該更新メッセージの送信が当該外部ツールの権限範囲内であることを前記更新権限情報が示さないときには、前記1つ又は複数の電子制御ユニットによる前記更新メッセージに対応した前記更新を抑止する
更新管理方法。 - 前記複数の電子制御ユニットは、Controller Area Network(CAN)プロトコルに従って前記バスを介して通信を行い、
前記外部ツールは、CANプロトコルに従って前記更新メッセージを送信する
請求項1記載の更新管理方法。 - 前記外部ツールから前記更新メッセージが送信された場合において、当該更新メッセージのメッセージIDに基づいて、当該更新メッセージの送信が当該外部ツールの権限範囲内であることを前記更新権限情報が示すか否かを判定し、当該更新メッセージの送信が当該外部ツールの権限範囲内であることを前記更新権限情報が示すと判定したときには、前記メッセージIDを有する前記更新メッセージを受信するように定められている前記電子制御ユニットにより前記更新を実行する
請求項2記載の更新管理方法。 - 前記更新権限情報は、前記電子制御ユニットの分類用の複数の機能種別のうち1つ又は複数の機能種別を特定し、特定した当該1つ又は複数の機能種別のいずれかに分類される前記電子制御ユニットに前記更新を行わせる権限を前記外部ツールが有することを表し、
前記外部ツールから前記更新メッセージが送信された場合において、当該更新メッセージのメッセージIDに基づいて、当該メッセージIDを受信するように定められている前記電子制御ユニットの機能種別が、前記更新権限情報により特定される1つ又は複数の機能種別のいずれかと一致するか否かを判別することにより、前記判定を行う
請求項3記載の更新管理方法。 - 前記更新権限情報は、1つ又は複数の前記機能種別を特定するための複数のレベルのうち1つのレベルを示し、相対的に高いレベルは、相対的に低いレベルが特定する1つ又は複数の機能種別を包含した複数の機能種別を特定する
請求項4記載の更新管理方法。 - 1つの前記電子制御ユニットである更新管理装置が、
当該更新管理装置と繋がった診断ポートに接続された前記外部ツールから前記更新権限情報を受信して前記検証を行い、
前記外部ツールから前記更新メッセージが送信された場合に当該更新メッセージを受信し、当該受信した場合において、前記検証が成功し、かつ、当該更新メッセージの送信が当該外部ツールの権限範囲内であることを前記更新権限情報が示すときには、前記更新メッセージを前記バスに転送し、前記検証が失敗したとき、又は、当該更新メッセージの送信が当該外部ツールの権限範囲内であることを前記更新権限情報が示さないときには、前記転送を抑止する
請求項1~5のいずれか一項に記載の更新管理方法。 - 前記更新メッセージにセッション鍵を用いた所定暗号処理が施されていなければ当該更新メッセージに対応した前記電子制御ユニットによる前記更新を抑止し、
前記更新管理装置は、
前記更新権限情報の前記受信を、当該更新権限情報を記載した、前記外部ツールの公開鍵に係る公開鍵証明書の受信により行い、
前記検証に成功した場合に、前記外部ツールが前記更新メッセージの送信に際して当該更新メッセージに対して所定暗号処理を施すために用いる前記セッション鍵を、前記外部ツールの公開鍵で暗号化して前記外部ツールに送信する
請求項6記載の更新管理方法。 - 前記更新管理装置は、前記外部ツールから前記更新メッセージが送信された場合において、前記車載ネットワークシステムを搭載する車両の状態が所定状態でないときには、前記更新メッセージの前記バスへの転送を抑止する
請求項6記載の更新管理方法。 - 前記更新管理装置は、前記外部ツールから前記更新メッセージが送信された場合において、前記車載ネットワークシステムにおける各電子制御ユニットに電力を供給する電池が所定電池残量を有さないときには、前記更新メッセージの前記バスへの転送を抑止する
請求項6記載の更新管理方法。 - 前記更新管理装置以外の電子制御ユニットと前記更新管理装置とは、通信内容に係る暗号処理用のセッション鍵の伝達に用いるために相互間で共有する共有鍵を保持し、
前記更新メッセージが指示する、前記電子制御ユニットが保持するデータの前記更新は、前記共有鍵の更新である
請求項6記載の更新管理方法。 - 前記共有鍵の有効期限の一定期間前に前記共有鍵の更新を促す警告情報を出力する
請求項10記載の更新管理方法。 - 前記更新管理装置は、前記車載ネットワークシステムを、複数の車載ネットワークシステムの中で識別する識別情報と前記更新メッセージの処理結果を示す結果情報とを前記外部ツールに送信する
請求項6記載の更新管理方法。 - 前記外部ツールは、前記結果情報と前記識別情報とをサーバに送信する
請求項12記載の更新管理方法。 - 前記更新メッセージが指示する、前記電子制御ユニットが保持するデータの前記更新は、前記電子制御ユニットのファームウェアの更新である
請求項1記載の更新管理方法。 - バスを介して通信を行う複数の電子制御ユニットを備える車載ネットワークシステムにおいて診断ポートと繋がった1つの電子制御ユニットである更新管理装置であって、
前記診断ポートに接続された外部ツールから前記診断ポートを介して送信される、当該外部ツールの権限を示す更新権限情報、及び、1つ又は複数の前記電子制御ユニットが保持するデータの更新を指示する更新メッセージを、受信する受信部と、
前記受信部により受信された前記更新権限情報を検証する検証部と、
前記受信部により前記更新メッセージが受信された場合において、前記検証部による前記検証が成功し、かつ、当該更新メッセージの送信が前記外部ツールの権限範囲内であることを前記更新権限情報が示すときには、前記更新メッセージを前記バスに転送し、前記検証部による前記検証が失敗したとき、又は、当該更新メッセージの送信が前記外部ツールの権限範囲内であることを前記更新権限情報が示さないときには、前記転送を抑止する転送部とを備える
更新管理装置。 - バスを介して通信を行う複数の電子制御ユニットを備える車載ネットワークシステムにおいて診断ポートと繋がった1つの電子制御ユニットとしての、プロセッサを有する更新管理装置に、所定の更新管理処理を実行させるための制御プログラムであって、
前記更新管理処理は、
前記診断ポートに接続された外部ツールから前記診断ポートを介して送信される、当該外部ツールの権限を示す更新権限情報を受信する更新権限情報受信ステップと、
前記更新権限情報受信ステップにおいて受信された前記更新権限情報を検証する検証ステップと、
前記外部ツールから前記診断ポートを介して送信される、1つ又は複数の前記電子制御ユニットが保持するデータの更新を指示する更新メッセージを受信する更新メッセージ受信ステップと、
前記更新メッセージ受信ステップで前記更新メッセージが受信された場合において、前記検証ステップでの前記検証が成功し、かつ、当該更新メッセージの送信が前記外部ツールの権限範囲内であることを前記更新権限情報が示すときには、前記更新メッセージを前記バスに転送し、前記検証ステップでの前記検証が失敗したとき、又は、当該更新メッセージの送信が前記外部ツールの権限範囲内であることを前記更新権限情報が示さないときには、前記転送を抑止する転送制御ステップとを含む
制御プログラム。
Priority Applications (7)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP18186944.7A EP3412514B1 (en) | 2014-11-12 | 2015-10-13 | Update management method, update management device, and control program |
CN201910654690.5A CN110377310B (zh) | 2014-11-12 | 2015-10-13 | 更新管理方法、更新管理装置以及计算机可读取的记录介质 |
JP2016558862A JP6618480B2 (ja) | 2014-11-12 | 2015-10-13 | 更新管理方法、更新管理システム及び制御プログラム |
EP15858625.5A EP3219553B1 (en) | 2014-11-12 | 2015-10-13 | Update management method, update management device, and control program |
CN201580027431.XA CN106458112B (zh) | 2014-11-12 | 2015-10-13 | 更新管理方法、更新管理系统以及计算机可读取的记录介质 |
US15/416,061 US10637657B2 (en) | 2014-11-12 | 2017-01-26 | Update management method, update management system, and non-transitory recording medium |
US16/820,428 US11283601B2 (en) | 2014-11-12 | 2020-03-16 | Update management method, update management system, and non-transitory recording medium |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201462078476P | 2014-11-12 | 2014-11-12 | |
US62/078,476 | 2014-11-12 | ||
JP2015187536 | 2015-09-24 | ||
JP2015-187536 | 2015-09-24 |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/416,061 Continuation US10637657B2 (en) | 2014-11-12 | 2017-01-26 | Update management method, update management system, and non-transitory recording medium |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2016075865A1 true WO2016075865A1 (ja) | 2016-05-19 |
Family
ID=55953972
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2015/005165 WO2016075865A1 (ja) | 2014-11-12 | 2015-10-13 | 更新管理方法、更新管理装置及び制御プログラム |
Country Status (5)
Country | Link |
---|---|
US (2) | US10637657B2 (ja) |
EP (2) | EP3219553B1 (ja) |
JP (2) | JP6618480B2 (ja) |
CN (2) | CN110377310B (ja) |
WO (1) | WO2016075865A1 (ja) |
Cited By (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP6279174B1 (ja) * | 2017-02-28 | 2018-02-14 | 三菱電機株式会社 | 車両通信監視装置、車両通信監視方法および車両通信監視プログラム |
CN108241514A (zh) * | 2017-12-28 | 2018-07-03 | 宁德时代新能源科技股份有限公司 | 车载程序更新方法和装置 |
WO2019012888A1 (ja) * | 2017-07-12 | 2019-01-17 | 住友電気工業株式会社 | 車載装置、管理方法および管理プログラム |
JP2019075056A (ja) * | 2017-10-19 | 2019-05-16 | 三菱電機株式会社 | 車両用セキュリティ装置およびセキュリティ方法 |
CN110275720A (zh) * | 2018-03-16 | 2019-09-24 | 丰田自动车株式会社 | 程序更新管理装置 |
US10491392B2 (en) | 2017-03-01 | 2019-11-26 | Ford Global Technologies, Llc | End-to-end vehicle secure ECU unlock in a semi-offline environment |
EP3553684A4 (en) * | 2016-12-09 | 2019-11-27 | FeliCa Networks, Inc. | INFORMATION PROCESSING DEVICE AND INFORMATION PROCESSING METHOD |
KR20200020515A (ko) * | 2018-08-17 | 2020-02-26 | 재단법인대구경북과학기술원 | Can 시스템 및 메시지 인증 방법 |
JP2020086540A (ja) * | 2018-11-15 | 2020-06-04 | Kddi株式会社 | メンテナンスサーバ装置、車両メンテナンスシステム、コンピュータプログラム及び車両メンテナンス方法 |
JP2020092289A (ja) * | 2018-12-03 | 2020-06-11 | 大日本印刷株式会社 | 機器統合システム及び更新管理システム |
JP2020132026A (ja) * | 2019-02-22 | 2020-08-31 | 本田技研工業株式会社 | ソフトウェア更新装置、車両及びソフトウェア更新方法 |
CN112083940A (zh) * | 2020-07-29 | 2020-12-15 | 宁波三星医疗电气股份有限公司 | 基于国密算法的电力采集终端远程升级方法 |
EP3754935A1 (en) | 2019-06-20 | 2020-12-23 | Fujitsu Limited | Key update device and storage medium storing key update program |
WO2021005949A1 (ja) * | 2019-07-05 | 2021-01-14 | 住友電気工業株式会社 | 中継装置および車両通信方法 |
US20220263849A1 (en) * | 2020-01-14 | 2022-08-18 | Panasonic Intellectual Property Corporation Of America | Anomaly detection method, recording medium, and anomaly detection system |
Families Citing this family (86)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP6216730B2 (ja) * | 2015-03-16 | 2017-10-18 | 日立オートモティブシステムズ株式会社 | ソフト更新装置、ソフト更新方法 |
JP2016174243A (ja) * | 2015-03-16 | 2016-09-29 | カルソニックカンセイ株式会社 | 通信システム |
JP6197000B2 (ja) * | 2015-07-03 | 2017-09-13 | Kddi株式会社 | システム、車両及びソフトウェア配布処理方法 |
JP6281535B2 (ja) * | 2015-07-23 | 2018-02-21 | 株式会社デンソー | 中継装置、ecu、及び、車載システム |
KR101966626B1 (ko) * | 2016-02-11 | 2019-04-09 | 현대자동차주식회사 | 차량용 무선 소프트웨어 업데이트 방법 및 장치 |
JP6352325B2 (ja) * | 2016-03-15 | 2018-07-04 | 本田技研工業株式会社 | 通信システム |
US9866563B2 (en) * | 2016-04-12 | 2018-01-09 | Gaurdknox Cyber Technologies Ltd. | Specially programmed computing systems with associated devices configured to implement secure communication lockdowns and methods of use thereof |
US10819418B2 (en) | 2016-04-29 | 2020-10-27 | Honeywell International Inc. | Systems and methods for secure communications over broadband datalinks |
US10171478B2 (en) * | 2016-06-30 | 2019-01-01 | Faraday & Future Inc. | Efficient and secure method and apparatus for firmware update |
US20180032421A1 (en) * | 2016-07-29 | 2018-02-01 | Wipro Limited | Method and system for debugging automotive applications in an electronic control unit of an automobile |
JP6665728B2 (ja) * | 2016-08-05 | 2020-03-13 | 株式会社オートネットワーク技術研究所 | 車載更新装置、車載更新システム及び通信装置の更新方法 |
KR102473100B1 (ko) * | 2016-09-23 | 2022-12-01 | 애플 인크. | 네트워크 트래픽의 보안 통신 |
FR3057086B1 (fr) | 2016-10-04 | 2018-11-23 | Stmicroelectronics (Rousset) Sas | Procede de gestion d'une mise a jour d'au moins un microcode au sein d'une unite de traitement, par exemple un microcontroleur, et unite de traitement correspondante |
JP6696417B2 (ja) * | 2016-12-20 | 2020-05-20 | 株式会社オートネットワーク技術研究所 | 車載更新装置、更新システム及び可搬型通信器 |
JP2018120422A (ja) * | 2017-01-25 | 2018-08-02 | ルネサスエレクトロニクス株式会社 | 車載通信システム、ドメインマスタ、及びファームウェア更新方法 |
US20180212967A1 (en) * | 2017-01-25 | 2018-07-26 | NextEv USA, Inc. | Portable device used to support secure lifecycle of connected devices |
JP6981755B2 (ja) * | 2017-01-25 | 2021-12-17 | トヨタ自動車株式会社 | 車載ネットワークシステム |
DE112017006980T5 (de) * | 2017-02-01 | 2019-10-17 | Sumitomo Electric Industries, Ltd. | Steuereinrichtung, Programmaktualisierungsverfahren und Computerprogramm |
WO2018142504A1 (ja) * | 2017-02-01 | 2018-08-09 | 富士通株式会社 | 暗号鍵配信システム、鍵配信ecu、鍵受信ecu、鍵配信プログラム、鍵受信プログラム及び暗号鍵配信方法 |
US10757113B2 (en) * | 2017-03-17 | 2020-08-25 | Cylance Inc. | Communications bus signal fingerprinting |
GB2561256A (en) * | 2017-04-05 | 2018-10-10 | Stmicroelectronics Grenoble2 Sas | Apparatus for use in a can system |
US10462193B2 (en) * | 2017-06-07 | 2019-10-29 | GM Global Technology Operations LLC | Vehicle add-on multimedia playback and capture devices |
JP7094670B2 (ja) * | 2017-07-03 | 2022-07-04 | 矢崎総業株式会社 | 設定装置及びコンピュータ |
US10402192B2 (en) | 2017-07-25 | 2019-09-03 | Aurora Labs Ltd. | Constructing software delta updates for vehicle ECU software and abnormality detection based on toolchain |
KR102368606B1 (ko) * | 2017-07-31 | 2022-03-02 | 현대자동차주식회사 | 효율적인 차량용 리프로그래밍 장치 및 그 제어방법 |
US10904224B2 (en) | 2017-09-29 | 2021-01-26 | Rolls-Royce Corporation | Aircraft engine monitoring system |
DE102017218872A1 (de) * | 2017-10-23 | 2019-04-25 | Robert Bosch Gmbh | Verfahren und Vorrichtung zum Aktualisieren von Software eines Kfz-Steuergerätes |
JP6915500B2 (ja) * | 2017-11-06 | 2021-08-04 | トヨタ自動車株式会社 | 更新システム、電子制御装置、更新管理装置、及び更新管理方法 |
CN108073156B (zh) * | 2017-11-20 | 2019-11-01 | 广州汽车集团股份有限公司 | 一种汽车电子控制单元的安全算法管理方法及系统 |
US10009325B1 (en) * | 2017-12-07 | 2018-06-26 | Karamba Security | End-to-end communication security |
US10850684B2 (en) * | 2017-12-19 | 2020-12-01 | Micron Technology, Inc. | Vehicle secure messages based on a vehicle private key |
WO2019127276A1 (zh) * | 2017-12-28 | 2019-07-04 | 深圳市元征软件开发有限公司 | 诊断设备的诊断接头升级验证方法、装置及诊断接头 |
US11178158B2 (en) * | 2018-01-29 | 2021-11-16 | Nagravision S.A. | Secure communication between in-vehicle electronic control units |
JP7010049B2 (ja) * | 2018-02-16 | 2022-01-26 | トヨタ自動車株式会社 | 車両制御装置、プログラムの更新確認方法および更新確認プログラム |
JP7311245B2 (ja) | 2018-03-07 | 2023-07-19 | トヨタ自動車株式会社 | マスタ装置、マスタ、制御方法、プログラム及び車両 |
US11321466B2 (en) * | 2018-03-09 | 2022-05-03 | Qualcomm Incorporated | Integrated circuit data protection |
JP6950605B2 (ja) * | 2018-03-27 | 2021-10-13 | トヨタ自動車株式会社 | 車両用通信システム |
US10715511B2 (en) * | 2018-05-03 | 2020-07-14 | Honeywell International Inc. | Systems and methods for a secure subscription based vehicle data service |
US10819689B2 (en) | 2018-05-03 | 2020-10-27 | Honeywell International Inc. | Systems and methods for encrypted vehicle data service exchanges |
CN110493002B (zh) | 2018-06-25 | 2020-05-08 | 北京白山耘科技有限公司 | 一种证书续签的方法、装置及系统 |
JP7111074B2 (ja) * | 2018-08-10 | 2022-08-02 | 株式会社デンソー | 車両用マスタ装置、セキュリティアクセス鍵の管理方法、セキュリティアクセス鍵の管理プログラム及び車両用電子制御システム |
JP7439402B2 (ja) * | 2018-08-10 | 2024-02-28 | 株式会社デンソー | 表示制御装置、書換え進捗状況の表示制御方法及び書換え進捗状況の表示制御プログラム |
JP7408937B2 (ja) * | 2018-08-10 | 2024-01-09 | 株式会社デンソー | センター装置,配信パッケージの生成方法及び配信パッケージ生成用プログラム |
KR102523250B1 (ko) | 2018-09-20 | 2023-04-20 | 현대자동차주식회사 | 차량용 제어 장치, 차량, 및 차량의 제어방법 |
US10931476B2 (en) * | 2018-10-29 | 2021-02-23 | Analog Devices Global Unlimited Company | Content protection over synchronous data networks |
JP7132132B2 (ja) * | 2019-01-09 | 2022-09-06 | 国立大学法人東海国立大学機構 | 車載通信システム、車載通信制御装置、車載通信装置、コンピュータプログラム、通信制御方法及び通信方法 |
FR3092684B1 (fr) * | 2019-02-11 | 2021-01-15 | Psa Automobiles Sa | Procédé et dispositif de mise à jour d’une unité de commande électronique |
CN110001553B (zh) * | 2019-02-25 | 2021-07-09 | 南京航空航天大学 | 一种汽车四向可调转向操纵装置、控制器下载方法 |
JP7111030B2 (ja) * | 2019-03-04 | 2022-08-02 | 株式会社オートネットワーク技術研究所 | 車載更新装置、更新処理プログラム及び、プログラムの更新方法 |
CN110138642B (zh) * | 2019-04-15 | 2021-09-07 | 深圳市纽创信安科技开发有限公司 | 一种基于can总线的安全通信方法和系统 |
KR20200131639A (ko) * | 2019-05-14 | 2020-11-24 | 현대자동차주식회사 | 게이트웨이 장치 및 그 제어방법 |
JP7396356B2 (ja) * | 2019-05-30 | 2023-12-12 | 住友電気工業株式会社 | 設定装置、通信システムおよび車両通信管理方法 |
CN110290002B (zh) * | 2019-06-27 | 2023-08-01 | 北京百度网讯科技有限公司 | 一种更新方法、终端及电子设备 |
CN110324335B (zh) * | 2019-07-02 | 2020-04-28 | 成都信息工程大学 | 一种基于电子移动证书的汽车软件升级方法及系统 |
WO2021012078A1 (zh) * | 2019-07-19 | 2021-01-28 | 华为技术有限公司 | Can通信方法、设备及系统 |
JP7490636B2 (ja) | 2019-08-30 | 2024-05-27 | パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ | 認証方法、認証システム及び認証装置 |
US20210075783A1 (en) * | 2019-09-10 | 2021-03-11 | William Mazzara, JR. | Authenticated vehicle diagnostic access techniques |
US11538287B2 (en) | 2019-09-20 | 2022-12-27 | Sonatus, Inc. | System, method, and apparatus for managing vehicle data collection |
CN114651427B (zh) | 2019-09-20 | 2024-08-27 | 桑纳特斯公司 | 用于在交通工具上支持混合网络通信的系统、方法和装置 |
TWI716135B (zh) * | 2019-10-04 | 2021-01-11 | 財團法人資訊工業策進會 | 用於車用網路之安全監控裝置及方法 |
JP7502014B2 (ja) * | 2019-10-31 | 2024-06-18 | トヨタ自動車株式会社 | 車両用制御装置、プログラム更新方法、及びプログラム更新システム |
JP7220397B2 (ja) * | 2019-12-09 | 2023-02-10 | パナソニックIpマネジメント株式会社 | 情報処理装置および情報処理方法 |
CN114884737A (zh) * | 2019-12-23 | 2022-08-09 | 华为技术有限公司 | 通信方法及相关产品 |
CN113132092B (zh) * | 2019-12-31 | 2022-04-22 | 华为技术有限公司 | 通信方法和电子设备 |
CN113138591B (zh) * | 2020-01-20 | 2022-12-23 | 北京新能源汽车股份有限公司 | 一种车辆安全因子的控制方法、装置、控制设备及汽车 |
JP7342734B2 (ja) | 2020-03-03 | 2023-09-12 | 株式会社デンソー | 車両データ管理装置、車両データ管理システム、車両データ管理方法、車両データ管理プログラム |
US12094259B2 (en) | 2020-03-06 | 2024-09-17 | Sonatus, Inc. | System, method, and apparatus for managing vehicle automation |
US20230161583A1 (en) * | 2020-03-06 | 2023-05-25 | Sonatus, Inc. | System, method, and apparatus for managing vehicle automation |
CN113497704A (zh) * | 2020-04-01 | 2021-10-12 | 罗伯特·博世有限公司 | 车载密钥生成方法、车辆及计算机可读存储介质 |
EP3913880A1 (en) * | 2020-05-19 | 2021-11-24 | Continental Teves AG & Co. OHG | Method of and system for secure data export from an automotive engine control unit |
US11871228B2 (en) * | 2020-06-15 | 2024-01-09 | Toyota Motor Engineering & Manufacturing North America, Inc. | System and method of manufacturer-approved access to vehicle sensor data by mobile application |
US11880670B2 (en) | 2020-06-23 | 2024-01-23 | Toyota Motor North America, Inc. | Execution of transport software update |
US11281450B2 (en) | 2020-06-23 | 2022-03-22 | Toyota Motor North America, Inc. | Secure transport software update |
EP4177734A4 (en) * | 2020-07-03 | 2023-11-22 | Sony Group Corporation | INFORMATION PROCESSING DEVICE, INFORMATION PROCESSING METHOD, INFORMATION PROCESSING SYSTEM AND PROGRAM |
CN111942154B (zh) * | 2020-07-28 | 2022-03-08 | 广汽埃安新能源汽车有限公司 | 一种用于电池管理系统的唤醒装置、车辆 |
US20220085984A1 (en) * | 2020-09-14 | 2022-03-17 | Amir Keyvan Khandani | Methods and apparatus for randomized encryption, with an associated randomized decryption |
CN114384887B (zh) * | 2020-10-16 | 2024-07-19 | 长城汽车股份有限公司 | 一种排放诊断方法、装置与电子设备 |
KR102427977B1 (ko) * | 2020-11-13 | 2022-08-01 | 경희대학교 산학협력단 | 추가 하드웨어 모듈을 이용하는 자동차 ecu 업데이트 방법 |
JP7380530B2 (ja) * | 2020-11-13 | 2023-11-15 | トヨタ自動車株式会社 | 車両通信システム、通信方法及び通信プログラム |
CN112506562B (zh) * | 2020-12-29 | 2023-09-26 | 一汽解放汽车有限公司 | 车辆软件升级方法、系统、车辆及存储介质 |
CN112698844B (zh) * | 2020-12-29 | 2024-08-23 | 威海新北洋技术服务有限公司 | 操作系统的刷机方法、装置及电子设备 |
JP7447864B2 (ja) * | 2021-04-26 | 2024-03-12 | トヨタ自動車株式会社 | Otaマスタ、方法およびプログラム |
CN113259933B (zh) * | 2021-06-15 | 2023-08-29 | 北京天融信网络安全技术有限公司 | 一种密钥更新的方法、网关、控制装置、电子设备及介质 |
JP7540401B2 (ja) * | 2021-06-22 | 2024-08-27 | トヨタ自動車株式会社 | センタ、otaマスタ、方法、プログラム、及び車両 |
KR20230025131A (ko) * | 2021-08-13 | 2023-02-21 | 주식회사 엘지에너지솔루션 | 배터리 데이터 관리 시스템 및 그것의 동작 방법 |
US20230153094A1 (en) * | 2021-11-18 | 2023-05-18 | Toyota Motor North America, Inc. | Robust over the air reprogramming |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2009147734A1 (ja) * | 2008-06-04 | 2009-12-10 | 株式会社ルネサステクノロジ | 車両、メンテナンス装置、メンテナンスサービスシステム及びメンテナンスサービス方法 |
JP2012103181A (ja) * | 2010-11-12 | 2012-05-31 | Clarion Co Ltd | 車載機のオンライン更新方法 |
JP2012188027A (ja) * | 2011-03-11 | 2012-10-04 | Omron Automotive Electronics Co Ltd | 情報処理装置、情報処理方法、およびプログラム |
JP2013141948A (ja) * | 2012-01-12 | 2013-07-22 | Denso Corp | 車両通信システム |
JP2014168219A (ja) * | 2013-01-31 | 2014-09-11 | Auto Network Gijutsu Kenkyusho:Kk | アクセス制限装置、車載通信システム及び通信制限方法 |
Family Cites Families (45)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE19623145B4 (de) * | 1996-06-10 | 2004-05-13 | Robert Bosch Gmbh | Verfahren zum Betreiben eines Steuergerätes mit einer über eine Programmiervorrichtung programmierbaren Speichereinrichtung |
JP3913823B2 (ja) * | 1997-02-10 | 2007-05-09 | 株式会社東海理化電機製作所 | 車両用始動許可装置 |
US8325994B2 (en) * | 1999-04-30 | 2012-12-04 | Davida George I | System and method for authenticated and privacy preserving biometric identification systems |
US7068147B2 (en) | 1999-12-07 | 2006-06-27 | Denso Corporation | Control information rewriting system |
JP2001225706A (ja) * | 1999-12-07 | 2001-08-21 | Denso Corp | 電子制御装置の制御情報書換システム、当該システムに用いられるセンタ、電子制御装置、及び書換装置 |
DE10008974B4 (de) * | 2000-02-25 | 2005-12-29 | Bayerische Motoren Werke Ag | Signaturverfahren |
JP4426733B2 (ja) * | 2000-03-31 | 2010-03-03 | 富士通株式会社 | 指紋データ合成方法,指紋データ合成装置,指紋データ合成プログラムおよび同プログラムを記録したコンピュータ読取可能な記録媒体 |
JP2002144983A (ja) | 2000-11-14 | 2002-05-22 | Toyoda Mach Works Ltd | 車両制御装置の制御ソフト変更装置及びその方法 |
JP2003343133A (ja) * | 2002-03-20 | 2003-12-03 | Matsushita Electric Ind Co Ltd | デジタル鍵システムと装置 |
JP2004028000A (ja) * | 2002-06-27 | 2004-01-29 | Mitsubishi Electric Corp | 通信による車載ecuのメモリ書き換え装置 |
US7366892B2 (en) * | 2003-01-28 | 2008-04-29 | Cellport Systems, Inc. | Secure telematics |
US8842887B2 (en) * | 2004-06-14 | 2014-09-23 | Rodney Beatson | Method and system for combining a PIN and a biometric sample to provide template encryption and a trusted stand-alone computing device |
US8375218B2 (en) * | 2004-12-07 | 2013-02-12 | Mitsubishi Electric Research Laboratories, Inc. | Pre-processing biometric parameters before encoding and decoding |
EP1887731A1 (en) * | 2005-06-01 | 2008-02-13 | Matsushita Electric Industrial Co., Ltd. | Electronic device, update server device, key update device |
US20080072068A1 (en) * | 2006-09-19 | 2008-03-20 | Wang Liang-Yun | Methods and apparatuses for securing firmware image download and storage by distribution protection |
JP2008239021A (ja) * | 2007-03-28 | 2008-10-09 | Denso Corp | 車両制御装置及びそのデータ書換システム |
DE102007039602A1 (de) * | 2007-08-22 | 2009-02-26 | Siemens Ag | Verfahren zum Prüfen einer auf einer ersten Einrichtung auszuführenden oder zu installierenden Version eines Softwareproduktes |
US8484752B2 (en) * | 2007-11-14 | 2013-07-09 | Caterpillar Inc. | Verifying authenticity of electronic control unit code |
CA2716335A1 (en) * | 2008-02-22 | 2009-08-27 | Stephen C. Bono | Systems and methods for secure workgroup management and communication |
US8838990B2 (en) * | 2008-04-25 | 2014-09-16 | University Of Colorado Board Of Regents | Bio-cryptography: secure cryptographic protocols with bipartite biotokens |
JP5248930B2 (ja) * | 2008-06-12 | 2013-07-31 | 株式会社東海理化電機製作所 | 暗号通信システム及び暗号鍵更新方法 |
US8127124B2 (en) * | 2009-03-19 | 2012-02-28 | Hewlett-Packard Development Company, L.P. | Remote configuration of computing platforms |
JP4931957B2 (ja) | 2009-04-23 | 2012-05-16 | 本田技研工業株式会社 | 車両機能管理システム |
JP2010271952A (ja) * | 2009-05-21 | 2010-12-02 | Toshiba Corp | 分散型制御システムのデータ管理装置 |
WO2011042950A1 (ja) * | 2009-10-05 | 2011-04-14 | 富士通株式会社 | 生体情報処理装置、生体情報処理方法及び生体情報処理用コンピュータプログラム |
JP5218366B2 (ja) | 2009-10-07 | 2013-06-26 | トヨタ自動車株式会社 | 車両用プログラム更新装置 |
KR101030910B1 (ko) * | 2009-10-19 | 2011-04-22 | 에스비리모티브 주식회사 | 배터리 관리 시스템 및 그 구동 방법 |
US9464905B2 (en) * | 2010-06-25 | 2016-10-11 | Toyota Motor Engineering & Manufacturing North America, Inc. | Over-the-air vehicle systems updating and associate security protocols |
US9191199B2 (en) * | 2011-04-09 | 2015-11-17 | Universitat Zurich | Method and apparatus for public-key cryptography based on error correcting codes |
JP5605294B2 (ja) * | 2011-04-15 | 2014-10-15 | トヨタ自動車株式会社 | 認証システム及び認証方法 |
JP2013048374A (ja) * | 2011-08-29 | 2013-03-07 | Toyota Motor Corp | 保護通信方法 |
JP2013137729A (ja) | 2011-11-29 | 2013-07-11 | Auto Network Gijutsu Kenkyusho:Kk | プログラム書換システム、制御装置、プログラム配信装置、識別情報記憶装置、及びプログラム書換方法 |
JP5435022B2 (ja) * | 2011-12-28 | 2014-03-05 | 株式会社デンソー | 車載システム及び通信方法 |
CN102662692B (zh) * | 2012-03-16 | 2015-05-27 | 北京经纬恒润科技有限公司 | 一种电子控制单元中应用程序的更新方法及系统 |
KR101974136B1 (ko) * | 2012-09-10 | 2019-04-30 | 삼성전자주식회사 | 차량의 정보를 처리하는 시스템 및 방법 |
US20140372766A1 (en) * | 2013-06-14 | 2014-12-18 | Pitney Bowes Inc. | Automated document notarization |
US9288048B2 (en) * | 2013-09-24 | 2016-03-15 | The Regents Of The University Of Michigan | Real-time frame authentication using ID anonymization in automotive networks |
JP6126980B2 (ja) * | 2013-12-12 | 2017-05-10 | 日立オートモティブシステムズ株式会社 | ネットワーク装置およびネットワークシステム |
KR20150074414A (ko) * | 2013-12-24 | 2015-07-02 | 현대자동차주식회사 | 펌웨어 업그레이드 방법 및 그 시스템 |
EP3358800B1 (en) * | 2014-01-06 | 2021-10-20 | Argus Cyber Security Ltd | Bus watchman |
KR101450166B1 (ko) * | 2014-01-23 | 2014-10-13 | 현대자동차주식회사 | 차량 내 통신 네트워크에서의 라우팅 정보 갱신 방법 및 그 장치 |
US9231936B1 (en) * | 2014-02-12 | 2016-01-05 | Symantec Corporation | Control area network authentication |
US9229704B2 (en) * | 2014-04-01 | 2016-01-05 | Ford Global Technologies, Llc | Smart vehicle reflash with battery state of charge (SOC) estimator |
US9460567B2 (en) * | 2014-07-29 | 2016-10-04 | GM Global Technology Operations LLC | Establishing secure communication for vehicle diagnostic data |
US9684908B2 (en) * | 2014-08-01 | 2017-06-20 | Yahoo!, Inc. | Automatically generated comparison polls |
-
2015
- 2015-10-13 EP EP15858625.5A patent/EP3219553B1/en active Active
- 2015-10-13 JP JP2016558862A patent/JP6618480B2/ja active Active
- 2015-10-13 WO PCT/JP2015/005165 patent/WO2016075865A1/ja active Application Filing
- 2015-10-13 EP EP18186944.7A patent/EP3412514B1/en active Active
- 2015-10-13 CN CN201910654690.5A patent/CN110377310B/zh active Active
- 2015-10-13 CN CN201580027431.XA patent/CN106458112B/zh active Active
-
2017
- 2017-01-26 US US15/416,061 patent/US10637657B2/en active Active
-
2020
- 2020-03-16 US US16/820,428 patent/US11283601B2/en active Active
-
2022
- 2022-07-28 JP JP2022120341A patent/JP7334312B2/ja active Active
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2009147734A1 (ja) * | 2008-06-04 | 2009-12-10 | 株式会社ルネサステクノロジ | 車両、メンテナンス装置、メンテナンスサービスシステム及びメンテナンスサービス方法 |
JP2012103181A (ja) * | 2010-11-12 | 2012-05-31 | Clarion Co Ltd | 車載機のオンライン更新方法 |
JP2012188027A (ja) * | 2011-03-11 | 2012-10-04 | Omron Automotive Electronics Co Ltd | 情報処理装置、情報処理方法、およびプログラム |
JP2013141948A (ja) * | 2012-01-12 | 2013-07-22 | Denso Corp | 車両通信システム |
JP2014168219A (ja) * | 2013-01-31 | 2014-09-11 | Auto Network Gijutsu Kenkyusho:Kk | アクセス制限装置、車載通信システム及び通信制限方法 |
Cited By (25)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11159521B2 (en) | 2016-12-09 | 2021-10-26 | Felica Networks, Inc. | Information processing apparatus and information processing method |
EP3553684A4 (en) * | 2016-12-09 | 2019-11-27 | FeliCa Networks, Inc. | INFORMATION PROCESSING DEVICE AND INFORMATION PROCESSING METHOD |
JP6279174B1 (ja) * | 2017-02-28 | 2018-02-14 | 三菱電機株式会社 | 車両通信監視装置、車両通信監視方法および車両通信監視プログラム |
WO2018158848A1 (ja) * | 2017-02-28 | 2018-09-07 | 三菱電機株式会社 | 車両通信監視装置、車両通信監視方法および車両通信監視プログラム |
US10491392B2 (en) | 2017-03-01 | 2019-11-26 | Ford Global Technologies, Llc | End-to-end vehicle secure ECU unlock in a semi-offline environment |
WO2019012888A1 (ja) * | 2017-07-12 | 2019-01-17 | 住友電気工業株式会社 | 車載装置、管理方法および管理プログラム |
JP2019021973A (ja) * | 2017-07-12 | 2019-02-07 | 住友電気工業株式会社 | 車載装置、管理方法および管理プログラム |
US11938897B2 (en) | 2017-07-12 | 2024-03-26 | Sumitomo Electric Industries, Ltd. | On-vehicle device, management method, and management program |
CN110892683A (zh) * | 2017-07-12 | 2020-03-17 | 住友电气工业株式会社 | 车载装置、管理方法和管理程序 |
JP2019075056A (ja) * | 2017-10-19 | 2019-05-16 | 三菱電機株式会社 | 車両用セキュリティ装置およびセキュリティ方法 |
CN108241514A (zh) * | 2017-12-28 | 2018-07-03 | 宁德时代新能源科技股份有限公司 | 车载程序更新方法和装置 |
CN110275720A (zh) * | 2018-03-16 | 2019-09-24 | 丰田自动车株式会社 | 程序更新管理装置 |
KR102148453B1 (ko) | 2018-08-17 | 2020-08-27 | 재단법인대구경북과학기술원 | Can 시스템 및 메시지 인증 방법 |
KR20200020515A (ko) * | 2018-08-17 | 2020-02-26 | 재단법인대구경북과학기술원 | Can 시스템 및 메시지 인증 방법 |
JP2020086540A (ja) * | 2018-11-15 | 2020-06-04 | Kddi株式会社 | メンテナンスサーバ装置、車両メンテナンスシステム、コンピュータプログラム及び車両メンテナンス方法 |
JP2020092289A (ja) * | 2018-12-03 | 2020-06-11 | 大日本印刷株式会社 | 機器統合システム及び更新管理システム |
JP7143744B2 (ja) | 2018-12-03 | 2022-09-29 | 大日本印刷株式会社 | 機器統合システム及び更新管理システム |
US11099830B2 (en) | 2019-02-22 | 2021-08-24 | Honda Motor Co., Ltd. | Software updating apparatus, vehicle, and software updating method |
JP2020132026A (ja) * | 2019-02-22 | 2020-08-31 | 本田技研工業株式会社 | ソフトウェア更新装置、車両及びソフトウェア更新方法 |
EP3754935A1 (en) | 2019-06-20 | 2020-12-23 | Fujitsu Limited | Key update device and storage medium storing key update program |
WO2021005949A1 (ja) * | 2019-07-05 | 2021-01-14 | 住友電気工業株式会社 | 中継装置および車両通信方法 |
JP7476896B2 (ja) | 2019-07-05 | 2024-05-01 | 住友電気工業株式会社 | 中継装置、車両通信方法および車両通信プログラム |
US20220263849A1 (en) * | 2020-01-14 | 2022-08-18 | Panasonic Intellectual Property Corporation Of America | Anomaly detection method, recording medium, and anomaly detection system |
CN112083940A (zh) * | 2020-07-29 | 2020-12-15 | 宁波三星医疗电气股份有限公司 | 基于国密算法的电力采集终端远程升级方法 |
CN112083940B (zh) * | 2020-07-29 | 2023-03-03 | 宁波三星医疗电气股份有限公司 | 基于国密算法的电力采集终端远程升级方法 |
Also Published As
Publication number | Publication date |
---|---|
JPWO2016075865A1 (ja) | 2017-10-19 |
EP3219553A4 (en) | 2017-10-25 |
EP3219553B1 (en) | 2019-01-23 |
EP3412514A1 (en) | 2018-12-12 |
US20170134164A1 (en) | 2017-05-11 |
JP6618480B2 (ja) | 2019-12-11 |
US11283601B2 (en) | 2022-03-22 |
CN110377310B (zh) | 2023-04-07 |
CN110377310A (zh) | 2019-10-25 |
CN106458112A (zh) | 2017-02-22 |
EP3412514B1 (en) | 2019-12-04 |
US20200220716A1 (en) | 2020-07-09 |
JP7334312B2 (ja) | 2023-08-28 |
US10637657B2 (en) | 2020-04-28 |
CN106458112B (zh) | 2019-08-13 |
JP2022163096A (ja) | 2022-10-25 |
EP3219553A1 (en) | 2017-09-20 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP7334312B2 (ja) | 更新管理方法、更新管理装置及び制御プログラム | |
JP6873198B2 (ja) | 不正検知ルール更新方法、不正検知電子制御ユニット及び車載ネットワークシステム | |
JP6713415B2 (ja) | 鍵管理方法、車載ネットワークシステム及び鍵管理装置 | |
JP7116204B2 (ja) | 更新管理方法、更新管理装置及び制御プログラム | |
EP3403246B1 (en) | A device and method for collecting user-based insurance data in vehicles | |
US20130212659A1 (en) | Trusted connected vehicle systems and methods | |
WO2017217070A1 (ja) | システム、認証局、車載コンピュータ、車両、公開鍵証明書発行方法、及びプログラム | |
US20130173112A1 (en) | In-vehicle system and communication method | |
WO2009147734A1 (ja) | 車両、メンテナンス装置、メンテナンスサービスシステム及びメンテナンスサービス方法 | |
WO2017115751A1 (ja) | 車載コンピュータシステム、車両、管理方法、及びコンピュータプログラム | |
JP7412506B2 (ja) | 不正検知ルール更新方法、不正検知電子制御ユニット及び車載ネットワークシステム | |
KR102436138B1 (ko) | 차량용 이더넷 기반 차량 내부 네트워크를 이용한 차량 부품 교체 방법 및 시스템 | |
JP6260068B1 (ja) | 保守装置、保守方法、及びコンピュータプログラム | |
Ammar et al. | Securing the on-board diagnostics port (obd-ii) in vehicles | |
Daimi | A Security Architecture for Remote Diagnosis of Vehicle Defects | |
CN118018280A (zh) | 用于车辆数据传输的方法、装置、车辆和存储介质 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 15858625 Country of ref document: EP Kind code of ref document: A1 |
|
ENP | Entry into the national phase |
Ref document number: 2016558862 Country of ref document: JP Kind code of ref document: A |
|
REEP | Request for entry into the european phase |
Ref document number: 2015858625 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2015858625 Country of ref document: EP |
|
NENP | Non-entry into the national phase |
Ref country code: DE |