Information processing apparatus

Abstract

The purpose of the present invention is to appropriately update a software program. An information processing apparatus of the present invention executes: a first reception process of receiving partial data including first version information but not including a first software program, from among update data including the first software program and the first version information about the first software program stored in a region closer to the head side than the first software program; a process of storing the partial data in a first storage area; a process of comparing second version information, which is stored in a second storage area in which the first software program is ready to store and represents a version of a second software program before update, with the first version information included in the partial data; when it is determined that the first version information is newer than the second version information, the first software program received by a second reception process performed after the first reception process is stored in the second storage area.

Description

Technical Field

[0001] The present invention relates to the technical field of updating software of an information processing device mounted in a vehicle. Background Art

[0002] Due to the electronicization of control, vehicles are equipped with various information processing devices such as ECU (Electronic Control Unit).

[0003] Such information processing devices are updated to eliminate errors in software programs and to improve performance (see, for example, Patent Document 1).

[0004] Prior art literature

[0005] Patent Literature

[0006] Patent Document 1: Japanese Patent Application Publication No. 2023-052938 Summary of the invention

[0007] Problems to be solved by the invention

[0008] However, when updating a software program, a connection terminal (external terminal) on which a reprogramming tool is installed is often used.

[0009] The connection terminal compares the software program version installed on the ECU with the software program version to be written, thus avoiding downgrading to an older version.

[0010] However, if the connection terminal is illegally modified, the version comparison process may be invalidated, and the ECU may be inevitably downgraded.

[0011] The present invention has been made in view of the above circumstances, and an object of the present invention is to appropriately update a software program.

[0012] Technical solutions for solving technical problems

[0013] An information processing device according to one aspect of the present invention includes: one or more processors; a storage medium storing a program executed by the one or more processors. The program includes one or more instructions, which cause the one or more processors to perform the following processing: a first receiving process, receiving partial data including first version information but not including a first software program in update data, the update data including the first software program, and information stored in an area closer to the beginning than the first software program, namely, the first version information indicating the version of the first software program; a process of storing the partial data in a first storage area; a process of comparing the newness of second version information with the first version information contained in the partial data, the second version information indicating the version of the second software program before the update, the second software program before the update being stored in a second storage area prepared to store the first software program; a process of storing the first software program received by a second receiving process performed after the first receiving process in the second storage area when it is determined that the first version information is newer than the second version information.

[0014] Effects of the Invention

[0015] According to the present invention, it is possible to appropriately update a software program. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a block diagram showing an example of the configuration of a vehicle;

[0017] Figure 2 is a diagram for explaining a communication path between a vehicle and a server device;

[0018] Figure 3 is a block diagram showing an example of the configuration of an ECU;

[0019] Figure 4 is a block diagram showing an example of the configuration of a computer device;

[0020] Figure 5 is a diagram showing a process of generating update data from a software program;

[0021] Figure 6 is a diagram showing a process of generating encrypted update data from update data;

[0022] Figure 7 is a flowchart showing an example of a process executed by the CGWECU as an update process;

[0023] Figure 8 Yes and Fig. 9 A flowchart collectively showing an example of a process executed by an update target ECU;

[0024] Fig. 9 Yes and Figure 8 A flowchart collectively showing an example of a process executed by an update target ECU;

[0025] Fig.10 is a flowchart showing an example of a process performed by a server device in an update process;

[0026] Fig.11 This is a flowchart showing an example of processing executed by the connection terminal in the update processing.

[0027] Explanation of symbols

[0028] 1ECU (Information Processing Unit)

[0029] 4CPU (processor)

[0030] 5ROM (storage medium, first storage area, second storage area)

[0031] 6RAM (storage medium, first storage area)

[0032] 103a CGWECU (information processing device)

[0033] Update data

[0034] SWP1 First Software Program

[0035] SWP2 Second Software Program

[0036] Dver1 first version information

[0037] Dver2 second version information

[0038] Dval verification data

[0039] Dp part data DETAILED DESCRIPTION

[0040] <1. Vehicle composition>

[0041] The configuration example of a vehicle 100 including an ECU 1 as an embodiment of the information processing device of the present invention is shown in FIG. Figure 1 .

[0042] The vehicle 100 has a first bus 101 and a second bus 102. The first bus 101 and the second bus 102 are configured as buses capable of communicating via CAN [Controller Area Network (registered trademark)], for example, and can transmit and receive information between devices.

[0043] The first bus 101 is connected to the ECU 1 , other various ECUs 103 , and a DCM (Data Communication Module) 104 .

[0044] Here, the ECU 1 and various ECUs 103 will be described.

[0045] The ECU 103 is, for example, an ACECU (Air Conditioner ECU), an engine control ECU, a charging control ECU, an airbag ECU, a display control ECU, or the like.

[0046] Each ECU 103 is configured to be able to perform a predetermined function by installing the software program SWP. When a new software program SWP is provided, the ECU 103 can be updated at any time.

[0047] In the following description, the ECU 103 that is the update target of the software program SWP is referred to as ECU 1. Then, the ECU that is not the update target of the software program SWP is referred to as ECU 103.

[0048] In addition, the ECU 103 also includes an ECU 103 having a vehicle gateway function. The ECU 103 is a CGWECU (Central Gateway Electronic Control Unit) 103a. It should be noted that the CGWECU 103a can also be the update target ECU 1.

[0049] The CGWECU 103 a receives update data Du for updating the software program SWP installed in the ECU 1 connected to the first bus 101 from the vehicle external device.

[0050] The CGWECU 103 a provides the ECU 1 with the update data Du received from outside the vehicle.

[0051] The ECU 1 that has received the update data Du performs a predetermined process described later to confirm the legitimacy of the update data Du, and then performs an update process of the software program SWP using the update data Du.

[0052] The DCM 104 is a vehicle communication device that performs data communication with other devices via an external vehicle communication network NW. The DCM 104 can also obtain the above-mentioned update data Du from an external file server (e.g., a server device 300 described later) via an OTA (Over The Air) method, for example. The obtained update data Du is provided to the CGWECU 103a via the first bus 101.

[0053] The second bus 102 is connected to the CGWECU 103 a and a DLC (Data Link Connector) 105 .

[0054] The DLC 105 is provided as a connector for connecting a device that communicates in an OBDII (On-Board Diagnostics II) system, for example.

[0055] The DLC 105 can acquire update data Du from a connected external device (for example, a connection terminal 200 described later), and provide the acquired update data Du to the CGWECU 103 a via the second bus 102 .

[0056] Figure 2 FIG. 1 is a diagram showing an example of a communication path from when the update data Du acquired through the DLC 105 is provided to the CGWECU 103a. Figure 2 The illustration of each bus included in the vehicle 100 is omitted.

[0057] The vehicle 100 is connected to the connection terminal 200 via the DLC 105 .

[0058] A reprogramming tool (hereinafter referred to as “reprogramming tool RT”) is installed in the connection terminal 200 , and by using the reprogramming tool RT, the CGWECU 103 a and other ECUs 103 can be updated.

[0059] The DCM 104 and the server device 300 connecting the terminal 200 and the vehicle 100 are connected to the communication network NW.

[0060] The server device 300 is connected to a database DB storing update data Du provided to the CGWECU 103 a via the connection terminal 200 and the DCM 104 .

[0061] That is, the CGWECU 103a acquires the update data Du acquired by the server device 300 from the database DB via the DLC 105 or the DCM 104, and provides the update data Du to the ECU 1 to be updated. The ECU 1 that has received the update data Du updates the software program SWP after verifying the legitimacy.

[0062] <2. Configuration of information processing device>

[0063] Combine the following Figure 3 , the structures of the above-mentioned ECU1, ECU103 and CGWECU103a are explained.

[0064] The ECU 1 includes a microcomputer 2 and a communication circuit 3 .

[0065] The microcomputer 2 includes a CPU (Central Processing Unit) 4 , a ROM (Read Only Memory) 5 , and a RAM (Random Access Memory) 6 .

[0066] The CPU 4 , ROM 5 , and RAM 6 are connected via a bus 7 so as to be communicable with each other.

[0067] The CPU 4 executes various processes according to the program stored in the ROM 5 or the program loaded into the RAM 6 .

[0068] For example, the CPU 4 in the update target ECU 1 first executes a process of receiving a part of the update data Du from the CGWECU 103 a and decrypting the part.

[0069] The CPU 4 then compares the version information Dver acquired from the update data Du with the version information Dver of the software program SWP installed in the ECU 1 , and determines whether the update process should be continued.

[0070] If it is determined that the update process should be continued, the CPU 4 performs a process of receiving data that has not been received in the update data Du through the CGWECU 103 a , decrypts the received data, and updates the software program SWP.

[0071] The data processed by the CPU 4 after performing such processing is temporarily stored in the RAM 6 , for example.

[0072] The ROM 5 is, for example, NVM (Non Volatile Memory).

[0073] The communication circuit 3 controls data communication based on the CAN communication standard or the like, which is performed via the first bus 101 and the second bus 102 .

[0074] like Figure 3 As shown, the ECU 103 and the CGWECU 103 a are configured to include a microcomputer 2 and a communication circuit 3 similarly to the ECU 1 .

[0075] The communication circuit 3 of the ECU 1 controls data communication via the first bus 101 in accordance with the CAN communication standard or the like.

[0076] Next, combine Figure 4 , the configuration of the computer device Com such as the connection terminal 200 and the server device 300 is described. It should be noted that each computer device Com does not need to have Figure 4 For example, each computer device Com may not include Figure 4 Some of the parts shown may also include Figure 4 Parts not shown in the figure.

[0077] The computer device Com includes a CPU 31 , a ROM 32 , a RAM 33 , a bus 34 , an input / output interface 35 , an input unit 36 ​​, an output unit 37 , a storage unit 38 , a communication unit 39 , a medium drive 40 , and the like.

[0078] The CPU 31 executes various processes according to the program stored in the ROM 32 or the program loaded from the storage unit 38 into the RAM 33. The RAM 33 also stores data and the like necessary for the CPU 31 to execute various processes as appropriate.

[0079] The CPU 31, the ROM 32, and the RAM 33 are connected to each other via a bus 34. In addition, an input-output interface 35 is also connected to the bus 34.

[0080] The input unit 36 ​​, the output unit 37 , the storage unit 38 , the communication unit 39 , and the medium drive 40 are connected to the input / output interface 35 .

[0081] The input unit 36 ​​is composed of a keyboard, a mouse, a touch panel, a microphone, and the like.

[0082] The output unit 37 is composed of a display such as an LCD (Liquid Crystal Display), a CRT (Cathode Ray Tube), an organic EL (Electro Luminescence) panel, or the like, a speaker, and the like.

[0083] The storage unit 38 is composed of a HDD (Hard Disk Drive), a flash memory device, and the like.

[0084] The communication unit 39 performs communication processing and inter-device communication via the communication network NW.

[0085] The media drive 40 has a removable medium 41 such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory installed therein as necessary, and writes information to or reads information from the removable medium 41 .

[0086] In the computer device Com, data and programs are uploaded and downloaded by performing communication via the communication unit 39. In addition, data and programs can be transferred via the removable medium 41.

[0087] The CPU 31 performs processing operations based on various programs, thereby executing necessary information processing and communication as the computer device Com.

[0088] Various functions are implemented in the computer device Com by means of CPU 31 , ROM 32 , RAM 33 , and the like.

[0089] Thus, for example, in the computer device Com as the server device 300, a process of acquiring and transmitting the update data Du for updating from the database DB is realized.

[0090] In addition, in the computer device Com as the connection terminal 200 , a process of providing the update data Du received from the server device 300 to the CGWECU 103 a included in the vehicle 100 and the like is implemented.

[0091] <3. Generate update data>

[0092] Combine the following Figure 5 , the composition of the update data Du will be described.

[0093] The update data Du is data prepared by the server device 300 , for example.

[0094] The CPU 31 of the server device 300 prepares a software program SWP including version information Dver.

[0095] The CPU 31 of the server device 300 first generates verification data Dval regarding the version information Dver extracted from the software program SWP.

[0096] The verification data Dval is, for example, a CRC (Cyclic Redundancy Check) code that can detect and correct errors in the version information Dver.

[0097] In addition, the CPU 31 of the server device 300 generates the authenticator AC using the entire software program SWP including the version information Dver.

[0098] The authenticator AC is data that can determine whether the software program SWP is legitimate, such as a digital signature and a MAC (Message Authentication Code).

[0099] The server device 300 generates update data Du in which the version information Dver, the verification data Dval, the entire software program SWP, and the authenticator AC are arranged in order.

[0100] At this time, in the update data Du, the version information Dver and the verification data Dval extracted from the software program SWP are arranged in a region closer to the beginning of the software program SWP.

[0101] It should be noted that, in order to distinguish from the old version information, the version information Dver included in the head area of ​​the update data Du or in an area based thereon is referred to as the first version information Dver1.

[0102] In addition, regarding the software program SWP, in order to distinguish it from an old version of the program, it is also referred to as a first software program SWP1.

[0103] The server device 300 provides the CGWECU 103a with the information through the connection terminal 200 or the DCM 104. Figure 5 The updated data Du is shown.

[0104] It should be noted that the server device 300 may also provide the CGWECU 103a with Figure 5 The updated data Du shown is encrypted to obtain the encrypted updated data Duen (refer to Figure 6 ).

[0105] Alternatively, the authenticator AC may also be generated from the encrypted update data Duen.

[0106] It should be noted that, in the encrypted update data Duen, the encrypted first version information Dver1 is stored in the head area or an area based thereon, and the first version information Dver1 is stored in an area at least closer to the head than the first software program SWP1.

[0107] It should be noted that in the encryption process of the update data Du, a block cipher such as AES (Advanced Encryption Standard) and Camellia cipher is used.

[0108] Thus, in the decryption process, only a predetermined area can be decrypted from the beginning of the encrypted update data Duen, and version verification can be performed even if the entire data is not decrypted.

[0109] In the update data Du, information stored in a region closer to the beginning of the first software program SWP1 is also recorded as partial data Dp.

[0110] That is, the partial data Dp includes at least the first version information Dver1 and the verification data Dval.

[0111] It should be noted that the partial data Dp in the encrypted update data Duen at least includes the encrypted first version information Dver1 and the verification data Dval.

[0112] <4. Processing Flow>

[0113] Figure 7FIG. 1 shows an example of an update process executed by the CPU 4 of the CGWECU 103 a of the vehicle 100 to update the software of the ECU 103 (or the CGWECU 103 a ). Figure 8 and Fig. 9 An example of the update process executed by the CPU 4 of the ECU 1 is shown.

[0114] It should be noted that the connector Cn1 in the figure represents the connection of the process.

[0115] The CPU 4 of the CGWECU 103a first Figure 7 The vehicle verification process is a process for verifying whether the vehicle 100 is the update target of the ECU 103 between the CGWECU 103a and the connection terminal 200 (or the server device 300). In the following process, an example of mainly sending the update data Du from the connection terminal 200 will be described.

[0116] In the vehicle verification process, for example, the CPU 4 sends information such as version information Dver of the software program SWP installed in the update target ECU 1 in the vehicle 100 , a chassis number identifying the vehicle 100 , and a VIN (Vehicle Identification Number).

[0117] If the vehicle verification process has not been completed normally, the CPU 4 does not execute the processes after step S102, but ends the process. Figure 7 A series of processing shown.

[0118] On the other hand, after the vehicle verification process is normally completed, the CPU 4 shifts to the update session in step S102 .

[0119] In step S103 , the CPU 4 receives partial data Dp (eg, first several kilobytes of data) in the encrypted update data Duen, and stores it in the RAM 6 , for example.

[0120] In step S104, the CPU 4 performs a process of transmitting the partial data Dp to the ECU 1. At this time, the CPU 4 may transmit a stop request for suspending the transmission of the remaining data after the partial data Dp to the connection terminal 200.

[0121] In step S105 , the CPU 4 determines whether a request to transmit the remaining data following the partial data Dp has been received from the ECU 1 .

[0122] When determining that the transmission request has not been received, the CPU 4 determines in step S106 whether a request to stop updating has been received from the ECU 1 .

[0123] When determining that the stop request is received, the CPU 4 proceeds to step S107 and transmits the stop request to the connection terminal 200. Thus, the connection terminal 200 can avoid transmitting the remaining data after the partial data Dp and stop the update process without updating.

[0124] On the other hand, when determining that neither the transmission request nor the suspension request has been received from the ECU 1 , the CPU 4 of the CGWECU 103 a executes the process of step S105 again.

[0125] When it is determined in step S105 that a transmission request has been received from the ECU 1 , the CPU 4 proceeds to step S108 and transmits a transmission request for the remaining data after the partial data Dp in the encrypted update data Duen to the connection terminal 200 .

[0126] In step S109, the CPU 4 performs a process of receiving the remaining data. Then, in step S110, the CPU 4 performs a process of sending the received remaining data to the ECU 1, and the process ends. Figure 7 A series of processing shown.

[0127] Next, the process executed by the CPU 4 of the ECU 1 which is the update target will be described.

[0128] exist Figure 8 In step S151 , the CPU 4 of the ECU 1 receives the partial data Dp in the encrypted update data Duen from the CGW ECU 103 a , and stores it in the RAM 6 , for example.

[0129] In step S152 , the CPU 4 performs decryption processing on the received partial data Dp.

[0130] Next, in step S153, the CPU 4 performs an error verification process. In the error verification process, the verification data Dval included in the partial data Dp obtained in the decryption process of step S152 is used to verify whether there is an error in the first version information Dver1 also included in the partial data Dp. At this time, errors of a specified number of bits can also be corrected.

[0131] In step S154, the CPU 4 determines whether an error exists. It should be noted that if error correction is performed in step S153, it can be determined in step S154 whether the error correction is performed appropriately.

[0132] If it is determined that there is an error, or if the normal first version information Dver1 is not obtained although the error is corrected, the CPU 4 requests the CGWECU 103a to stop updating in step S155.

[0133] On the other hand, if it is determined that there is no error, or if the normal first version information Dver1 is obtained after error correction, the CPU 4 performs a new-old comparison process (version verification process) in step S156.

[0134] In the new-old comparison process, the version information (referred to as second version information Dver2) of the pre-update software program SWP (referred to as second software program SWP2) currently installed in the ECU 1 is compared with the first version information Dver1 obtained in step S152 or S153.

[0135] In step S157, the CPU 4 performs branch processing corresponding to the result of the new-old comparison processing. Specifically, if it is determined that the second version information Dver2 is new, the CPU 4 determines "No" in step S157. In this case, the CPU 4 sends a stop request to the CGWECU 103a in step S155 to stop a series of update processing.

[0136] On the other hand, if it is determined that the first version information Dver1 is new, the CPU 4 determines "yes" in step S157. In this case, the CPU 4 enters Fig. 9 In step S158, a request for sending the remaining data after the partial data Dp is sent to the CGWECU 103a.

[0137] The CPU 4 receives the remaining data from the CGWECU 103 a in step S159 , and performs a decryption process on the remaining data in step S160 .

[0138] In step S161, the CPU 4 overwrites the area storing the second software program SWP2 with the first software program SWP1 included in the decrypted remaining data. As a result, the second software program SWP2 installed in the ECU 1 is deleted and the first software program SWP1 is installed.

[0139] In step S162, the CPU 4 generates an authenticator AC. In this authenticator generation process, a new digital signature and MAC as the authenticator AC are generated from the first software program SWP1 included in the decrypted remaining data.

[0140] In step S163, the CPU 4 performs a comparison process of the authenticator AC. This comparison process is a process for verifying the legitimacy of the first software program SWP1 written in the ECU 1 by comparing the authenticator AC newly generated in step S162 with the authenticator AC extracted from the remaining data obtained by the decryption process in step S160 (the authenticator AC generated by the server device 300).

[0141] In step S164 , the CPU 4 performs branch processing according to the result of the comparison processing (verification processing) in step S163 .

[0142] After verifying the legitimacy of the first software program SWP1, the CPU 4 determines that it is "yes" and completes the Figure 8 and Fig. 9 A series of update processes are shown.

[0143] On the other hand, when the validity of the first software program SWP1 is not obtained, the CPU 4 makes a "No" determination and performs corresponding processing in step S165.

[0144] In the corresponding processing, for example, in order to write the second software program SWP2 before update into the ECU 1 again, a process is performed in which the CGWECU 103 a requests the connection terminal 200 to transmit the second software program SWP2 .

[0145] Alternatively, a notification process may be performed to notify the user that there is a possibility that the update of the ECU 1 has failed, an illegal program has been written, and to recommend that the user visit a dealer or the like to legalize the program.

[0146] As such, the ROM 5 of the ECU 1 that is the update target does not have a capacity sufficient to store a plurality of software programs SWP, and the RAM 6 may be only several kbytes or several tens of kbytes.

[0147] Specifically, an old version of the second software program SWP2 is stored in the ROM5 (second storage area).

[0148] CPU4 of ECU1 is Figure 8 In step S151, partial data Dp is received and stored in RAM6 (first storage area).

[0149] Then, the CPU 4 of the ECU 1 compares the first version information Dver1 obtained by decrypting the partial data Dp on the RAM 6 (first storage area) and the second version information Dver2 regarding the old version.

[0150] Furthermore, if the CPU 4 of the ECU 1 determines that the first version information Dver1 is correct and newer than the second version information Dver2, in step S158, a request to transmit the remaining data of the encrypted update data Duen is transmitted to the CGWECU 103a.

[0151] Next, the CPU 4 of the ECU 1 executes steps S159 , S160 , and S161 to delete the second software program SWP2 stored in the ROM 5 (second storage area), and performs decryption processing and storage processing on the received remaining data.

[0152] In this way, even when there is no margin in the storage area of ​​the ECU 1 , it is possible to avoid degradation and deterioration of the software program SWP and to overwrite it with the appropriate first software program SWP1 .

[0153] In this example, the RAM 6 is the first storage area and the ROM 5 is the second storage area, but the ROM 5 may also be provided with a first storage area as a version verification work area and a second storage area for storing the software program SWP.

[0154] That is, the first storage area as the version verification work area and the second storage area storing the software program SWP may be set in different areas of the same memory or may be set on different memories.

[0155] Next, an example of the processing performed by the server device 300 is shown. Fig.10 .

[0156] In step S201 , the CPU 31 of the server device 300 acquires the first version information Dver1 of the first software program SWP1 to be transmitted, and generates verification data Dval.

[0157] In step S202 , the CPU 31 of the server device 300 generates an authenticator AC from the first software program SWP1 .

[0158] In step S203 , the CPU 31 of the server device 300 generates update data Du from the first version information Dver1 , the verification data Dval, the first software program SWP1 , and the authenticator AC.

[0159] In step S204 , the CPU 31 of the server device 300 encrypts the update data Du to generate encrypted update data Duen.

[0160] In step S205 , the CPU 31 of the server device 300 transmits the encrypted update data Duen to the connection terminal 200 .

[0161] It should be noted that the CPU 31 of the server device 300 may receive the result of the update process from the connection terminal 200 after step S205 .

[0162] Thereby, the update status of each vehicle 100 can be recorded in the server device 300 .

[0163] It should be noted that, as described above, when the authenticator AC is generated from the encrypted update data Duen, the process of step S202 may be performed after the encryption process of step S204.

[0164] Next, an example of the processing executed by the CPU 31 of the connection terminal 200 is shown. Fig.11 .

[0165] The CPU 31 of the connection terminal 200 performs a vehicle verification process in step S301. Figure 7 The process of step S101 is performed in conjunction with the process of step S101 , and is a process for verifying whether the vehicle 100 is the vehicle 100 having the update target ECU 1 .

[0166] Next, the CPU 31 of the connection terminal 200 shifts to the update session in step S302. Figure 7 This process is, for example, a process for shifting the reprogramming tool RT installed in the connection terminal 200 to the update mode.

[0167] In step S303 , the CPU 31 of the connection terminal 200 transmits the encrypted partial data Dp of the update data Duen to the CGWECU 103 a of the vehicle 100 .

[0168] The CPU 31 of the connection terminal 200 determines in step S304 whether a transmission request has been received. The transmission request is a request sent from the ECU 1 through the CGWECU 103a when the CGWECU 103a determines the version information Dver based on the received partial data Dp and determines that there is no problem with the update. Specifically, Figure 7 The request is sent from CGWECU103a in step S108.

[0169] If it is determined that the transmission request has been received, the CPU 31 of the connection terminal 200 proceeds to step S305, transmits the remaining data in the encrypted update data Duen that has not been transmitted to the CGWECU 103a, and ends the process. Fig.10 A series of processing shown.

[0170] On the other hand, if it is determined that no transmission request has been received, the CPU 31 of the connection terminal 200 then determines in step S306 whether a suspension request has been received. The suspension request is a request sent when the version verification fails, etc., specifically, when Figure 7 The request is sent from CGWECU103a in step S107.

[0171] If it is determined that the termination request has been received, the CPU 31 of the connection terminal 200 terminates Fig.10 The series of processing shown in FIG. 1 is as follows. Thus, the encrypted update data Duen only needs to send the partial data Dp to the CGWECU 103a.

[0172] When determining that the suspension request has not been received, the CPU 31 of the connection terminal 200 returns to the process of step S304 again.

[0173] That is, the CPU 31 of the connection terminal 200 repeatedly executes the two processes of steps S304 and S306 , and stands by until receiving a certain request from the CGWECU 103 a .

[0174] It should be noted that if the two processes of steps S304 and S306 are repeated and a predetermined time has passed, the CPU 31 of the connection terminal 200 may terminate the process. Fig.10 The series of processing shown is performed without receiving any request from the CGWECU 103a.

[0175] In addition, the CPU 31 of the connection terminal 200 may transmit the update result to the server device 300 after step S305 or step S306 .

[0176] <5. Modifications>

[0177] The above example shows that the ECU 1 to be updated executes Figure 8 and Fig. 9 The processing shown is an example, but it can be executed in CGWECU103a Figure 8 and Fig. 9 Partial processing shown.

[0178] For example, CPU4 of CGWECU103a may also perform decryption processing of partial data Dp of step S152, error detection processing of step S153, judgment processing of step S154, new and old comparison processing of step S155, judgment processing of step S157, and decryption processing of the remaining data of step S160.

[0179] In addition, the CPU 4 of the CGWECU 103 a may also execute each process from step S162 to step S165 instead of the ECU 1 .

[0180] In the above example, the CGWECU 103a and the connection terminal 200 outside the vehicle are provided separately, but the function of the connection terminal 200 may be provided in the CGWECU 103a. That is, the reprogramming tool RT may be installed in the CGWECU 103a, and the CGWECU 103a may obtain the update data Du (encrypted update data Duen) from the server device 300 through the DCM 104 and the communication network NW.

[0181] <6. Conclusion>

[0182] ECU1 (or CGWECU103a) as the above-mentioned information processing device includes one or more processors (CPU4) and a storage medium (ROM5 or RAM6) storing programs executed by one or more processors, wherein the program includes one or more instructions, and the one or more instructions enable one or more processors to perform the following processing.

[0183] That is, one or more instructions cause the CPU 4 to execute the following processing: a first receiving process (step S151) of receiving the first version information Dver1 but not the partial data Dp of the first software program SWP1 in the update data Du including the first software program SWP1 and the first version information Dver1 indicating the version of the first software program SWP1 which is information stored in the area closer to the beginning than the first software program SWP1; a process of storing the partial data Dp in the first storage area (ROM5 or RAM6) (step S151); a process of comparing the second version information Dver2 indicating the version of the second software program SWP2 before the update which is stored in the second storage area (ROM5) in which the first software program SWP1 is to be stored with the first version information Dver1 included in the partial data Dp (step S156); and a process of storing the first software program SWP1 received by the second receiving process (step S159) performed after the first receiving process in the second storage area (step S161) when the first version information Dver1 is determined to be newer than the second version information Dver2.

[0184] Thus, based on the result of comparing the newness and oldness of the version information Dver, an update process is executed to update the second software program SWP2 to the first software program SWP1.

[0185] Therefore, for example, when the version of the first software program SWP1 is older than that of the second software program SWP2, the update process can be aborted, thereby being able to prevent the error of the old software program SWP from occurring again.

[0186] Furthermore, even if the connection terminal 200 to which the reprogramming tool RT is installed is illegally modified and the program of the ECU 1 can be illegally rewritten, downgrade or rewriting to an illegal program can be suppressed by performing a process of comparing the version information Dver on the vehicle 100 side.

[0187] That is, it is possible to prevent abnormal operation or failure (bricking) of the ECU 1 (ECU 103 , CGWECU 103 a ), and further, it is possible to prevent the time and cost required for rewriting to a normal program from being incurred.

[0188] In particular, when the capacity of the ROM 5 is small and cannot store both the new and old software programs SWP, the old program will be deleted when the software program SWP is rewritten, so it is difficult to restore the normal program.

[0189] Even in this case, rewriting of the software program SWP can be stopped according to the result of the new-old comparison process, which is preferable.

[0190] In ECU1 (or CGWECU103a) serving as an information processing device, the update data Du is set to encrypted data (encrypted update data Duen), and partial data Dp includes verification data Dval for verifying the correctness of the first version information Dver1. One or more instructions can cause one or more processors (CPU4) to perform the following processing: decrypt the partial data Dp in accordance with the first receiving processing (step S151) (step S152); use the decrypted verification data Dval to perform the correctness judgment processing of the first version information Dver1 (step S153); when there is no error in the first version information Dver1 (step S154: judged as "No") and when the first version information Dver1 is judged to be newer than the second version information Dver2 in the comparison processing (step S156) (step S157: judged as "Yes"), decryption of the first software program SWP1 is performed in accordance with the second receiving processing (step S159) (step S160).

[0191] Thereby, it is determined whether or not there is an error (tampering) in the version information Dver.

[0192] Therefore, it is possible to prevent the update process from being executed using the old version of the software program SWP. That is, it is possible to appropriately prevent abnormal operation or failure of the ECU 1 (ECU 103, CGWECU 103a).

[0193] In ECU1 (or CGWECU103a) serving as an information processing device, one or more instructions may cause one or more processors (CPU4) to perform the following processing: when it is determined in the new-old comparison processing (step S156) that the first version information Dver1 is older than the second version information Dver2 (step S157: determined as "No"), the processing of storing the first software program SWP1 in the second storage area (ROM5) is terminated (step S155).

[0194] Thereby, the software program SWP stored in the storage area is regarded as a new program.

[0195] Therefore, degradation and deterioration of the program can be prevented.

[0196] In ECU1 (or CGWECU103a) serving as an information processing device, one or more instructions may cause one or more processors (CPU4) to perform the following processing: when it is determined in the new-old comparison processing (step S156) that the first version information Dver1 is newer than the second version information Dver2 (step S157: determined as "yes"), a request to send the remaining data of the first software program SWP1 included in the update data Du is sent (step S158).

[0197] Thus, the storage area provided on the vehicle 100 side only needs to have a surplus capacity for storing only partial data Dp in a state where one software program SWP is installed.

[0198] That is, even if the ECU 1 includes a storage unit (ROM 5 , RAM 6 ) composed of a storage area with a relatively small capacity, it is possible to prevent the illegal software program SWP from being written and to perform appropriate update processing.

[0199] In ECU1 (or CGWECU103a) serving as an information processing device, one or more instructions may cause the one or more processors (CPU4) to perform the following processing: when it is determined in the new-old comparison processing (step S156) that the first version information Dver1 is older than the second version information Dver2 (step S157: determined as "No"), a request to terminate the transmission of the remaining data of the first software program SWP1 included in the update data Du is sent (step S155).

[0200] This reduces the number of processes for sending and receiving old versions of the software program SWP. In other words, it is possible to reduce unnecessary communications.

[0201] The above-mentioned embodiments and modifications can be combined as appropriate.

Claims

1. An information processing device, comprising: one or more processors; as well as, a storage medium storing a program executed by the one or more processors, The program includes one or more instructions. The one or more instructions cause the one or more processors to perform the following processing: a first receiving process of receiving partial data in the update data including the first version information but not including the first software program, the update data including the first software program and information stored in an area closer to the beginning of the first software program, namely, the first version information indicating the version of the first software program; storing the portion of data in a first storage area; Comparing the second version information with the first version information included in the partial data, wherein the second version information indicates a version of the second software program before updating, and the second software program before updating is stored in a second storage area for storing the first software program; A process of storing the first software program received by a second receiving process performed after the first receiving process in the second storage area when it is determined that the first version information is newer than the second version information.

2. The information processing device according to claim 1, wherein: The update data is treated as encrypted data. The partial data includes verification data for verifying the correctness of the first version information, The one or more instructions cause the one or more processors to perform decryption on the portion of data corresponding to the first receiving process, The one or more instructions cause the one or more processors to perform a correctness determination process of the first version information using the decrypted verification data. When the first version information is correct and it is determined in the comparison process that the first version information is newer than the second version information, the one or more instructions cause the one or more processors to perform decryption on the first software program in response to the second receiving process.

3. The information processing device according to claim 1, wherein: When it is determined in the process of comparing the new and the old that the first version information is older than the second version information, the one or more instructions cause the one or more processors to suspend the process of storing the first software program in the second storage area.

4. The information processing device according to claim 1, wherein: When it is determined in the comparison process that the first version information is newer than the second version information, the one or more instructions cause the one or more processors to send a request to send remaining data including the first software program in the update data.

5. The information processing device according to claim 1, wherein: When it is determined in the comparison process that the first version information is older than the second version information, the one or more instructions cause the one or more processors to send a request to stop sending remaining data including the first software program in the update data.

Images