In-vehicle control system

Abstract

To more properly detect unauthorized replacement or tampering of an electronic control unit.SOLUTION: When ignition is on, if there is no operation history as a history of executing a predetermined operation and predetermined encryption or hashing, an operation result obtained by performing the predetermined operation and the predetermined encryption or hashing on a value unique to a vehicle is stored and transmitted to a server. If there is an operation history, the stored operation result is updated with a value obtained by performing the predetermined operation and the predetermined encryption or hashing on the stored operation result, and the updated operation result is transmitted to the server.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to in-vehicle control systems. [Background technology]

[0002] Conventionally, as this type of in-vehicle control system, one that includes a plurality of electronic control units and a fraud detection electronic control unit that is connected to the plurality of electronic control units via an in-vehicle network has been proposed (see, for example, Patent Document 1). In this system, the fraud detection electronic control unit stores rules for determining whether a frame transmitted from another electronic control unit is fraudulent, and determines whether a frame transmitted from another electronic control unit is fraudulent according to the rules. In this way, it is possible to detect fraudulent tampering with another electronic control unit. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2018-111468 A Summary of the Invention [Problem to be solved by the invention]

[0004] In the above-described in-vehicle control system, if the tamper-detecting electronic control unit is tampered with, it becomes impossible to properly detect tampering or replacement of other electronic control units.

[0005] The main purpose of the in-vehicle control system of the present disclosure is to more accurately detect unauthorized replacement or tampering of an electronic control unit. [Means for solving the problem]

[0006] The in-vehicle control system of the present disclosure employs the following means to achieve the above-mentioned main object.

[0007] The in-vehicle control system of the present disclosure comprises: An in-vehicle control system for controlling a device mounted in a vehicle, the in-vehicle control system including a plurality of electronic control units, capable of exchanging information with a server, the in-vehicle control system comprising: When the ignition is on, if there is no calculation history as a history of execution of a predetermined calculation and a predetermined encryption or hashing, the plurality of electronic control units store a calculation result obtained by performing a predetermined calculation and a predetermined encryption or hashing on a value unique to the vehicle and transmit the result to the server, and when there is the calculation history, update the stored calculation result with a value obtained by performing the predetermined calculation and the predetermined encryption or hashing on the stored calculation result and transmit the updated calculation result to the server. The gist of the present invention is as follows.

[0008] In the vehicle control system disclosed herein, when the ignition is on, if there is no calculation history of a predetermined calculation and a predetermined encryption or hashing, the electronic control units store the calculation results obtained by performing the predetermined calculation and the predetermined encryption or hashing on a value unique to the vehicle and transmit them to the server, and if there is a calculation history, they update the stored calculation results with values ​​obtained by performing the predetermined calculation and the predetermined encryption or hashing on the stored calculation results and transmit the updated calculation results to the server. This makes it possible to more accurately detect unauthorized replacement or tampering of the electronic control units. [Brief description of the drawings]

[0009] [Figure 1] 1 is a diagram showing an outline of the configuration of an in-vehicle control system 20 according to the present embodiment. [Diagram 2] 4 is a flowchart showing an example of a processing routine executed by an ECU 22 of a vehicle V. [Diagram 3] 4 is an explanatory diagram showing an example of changes in the calculation result value Nvr in the ECU 22 and the ECU 24. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] An embodiment of the present disclosure will be described with reference to the drawings. Fig. 1 is a schematic diagram showing the configuration of an on-vehicle control system 20 according to the present embodiment. The on-vehicle control system 20 is mounted on a vehicle V equipped with an engine, a motor, etc., and is configured to be able to exchange information with an external server 10 via the Internet. The on-vehicle control system 20 includes electronic control units (hereinafter referred to as "ECUs") 22 and 24.

[0011] The ECUs 22 and 24 are configured as devices for controlling an engine, a motor, and the like mounted on the vehicle V, and include a microcomputer. The microcomputer has a CPU, a ROM, a RAM, a flash memory, an input / output port, and a communication port. The ECUs 22 and 24 receive signals from various sensors. For example, an ignition signal from an ignition switch (IG) 26 is input to the ECUs 22 and 24. The ECUs 22 and 24 output control signals for controlling the engine and the motor mounted on the vehicle V. The ECU 22 can communicate with the ECU 24 via an in-vehicle network. The ROM of the ECUs 22 and 24 stores a vehicle-specific value Nv, which is a unique value assigned to the vehicle V at the time of shipment. An example of the vehicle-specific value Nv is an eight-digit number.

[0012] The server 10 includes a microcomputer. The microcomputer has a CPU, a ROM, a RAM, a flash memory, an input / output port, and a communication port. The server 10 performs various types of arithmetic processing.

[0013] Next, the operation of the in-vehicle control system 20 thus configured, particularly the operation when determining whether the ECUs 22, 24 have been fraudulently replaced, will be described. Fig. 2 is a flowchart showing an example of a processing routine executed by the ECU 22 of the vehicle V. This routine is executed when the ignition switch 26 is turned on. Note that the ECU 24 of the vehicle V executes the same processing as the processing routine exemplified in Fig. 2, but to avoid redundant explanation, the explanation of the operation of the ECU 22 will be used to explain the operation of the ECU 24.

[0014] When this routine is executed, the CPU of the ECU 22 determines whether there is a calculation history in which the calculation and hashing processes of steps S110 and S130 described later have been executed (step S100). When there is no calculation history, that is, when this routine is executed for the first time after the vehicle V is shipped, the calculation process is performed on the vehicle-specific value Nv, and then the hashing process is performed to calculate the calculation result value Nvr (step 110). The calculation of the calculation result value Nvr is performed by a predetermined calculation process or a predetermined hashing process. The predetermined calculation process is a calculation process that is predetermined at the time of shipping the vehicle V, such as a process of doubling each digit of the calculation target value (the vehicle-specific value Nv in step S110) and extracting the first digit of each digit. The predetermined hashing process is a process using a hash function that is predetermined at the time of shipping the vehicle V.

[0015] When the calculation result value Nvr is calculated, the calculation history is changed to "present" (step S120), the calculation result value Nvr is stored in the flash memory, and the calculation result value Nvr is transmitted to the server 10 (step S140), and this routine is terminated.

[0016] If there is a calculation history in step S100, the calculation result value Nvr stored in the flash memory is subjected to the same calculation processing as in step S110, and then a hashing process is performed (step S130). The calculation result value Nvr stored in the ECU 24 is updated with the calculation result value Nvr calculated in step S130, stored in the flash memory, and transmitted to the server 10 (step S140), and this routine is then terminated.

[0017] The server 10, which has received the calculation result value Nvr, compares the calculation result value Nvr in the ECU 22 with the calculation result value Nvr in the ECU 24. When the calculation result value Nvr in the ECU 22 and the calculation result value Nvr in the ECU 24 match, the server 10 determines that the ECUs 22, 24 are not unauthorized ECUs. When the calculation result value Nvr in the ECU 22 and the calculation result value Nvr in the ECU 24 do not match, the server 10 determines that either the ECU 22, 24 has been replaced with an unauthorized ECU or has been tampered with.

[0018] FIG. 3 is an explanatory diagram showing an example of changes in the calculation result value Nvr in the ECU 22 and the ECU 24. In FIG. 3, it is assumed that the ECU 22 and the ECU 24 store "12345678" as the vehicle-specific value Nv at the time of shipment of the vehicle V. When the ignition is turned on for the first time after the shipment of the vehicle V (first ignition-on), the ECU 22 and the ECU 24 obtain the calculation result value Nvr ("24680246") by performing calculation processing on the vehicle-specific value Nv and then performing hash processing (step S110), and store the calculation result value Nvr ("24680246") in a flash memory and transmit it to the server 10 (step S140). The server 10, which has received the calculation result value Nvr, compares the calculation result value Nvr in the ECU 22 with the calculation result value Nvr in the ECU 24. When neither of the ECUs 22, 24 is an unauthorized ECU, the calculation result values ​​Nvr of the ECUs 22, 24 match each other. The server 10 determines that the ECUs 22, 24 are not unauthorized ECUs.

[0019] Next, when the ignition is turned on, the ECUs 22 and 24 execute the process of step S130, and obtain the calculation result value Nvr ("48260482") by performing calculation processing on the calculation result value Nvr ("24680246") stored in the flash memory and hashing the result (step S130), and store the calculation result value Nvr ("48260482") in the flash memory and transmit it to the server 10 (step S140). The server 10, which has received the calculation result value Nvr, compares the calculation result value Nvr in the ECU 22 with the calculation result value Nvr in the ECU 24. If neither the ECUs 22 and 24 are unauthorized ECUs, the calculation result values ​​Nvr of the ECUs 22 and 24 match, and the server 10 determines that the ECUs 22 and 24 are not unauthorized ECUs. In this way, when neither of the ECUs 22, 24 has been illegally replaced or tampered with, the calculation result value Nvr of the ECU 22 and the calculation result value Nvr of the ECU 24 always match, and the server 10 determines that the ECUs 22, 24 are not illegal ECUs.

[0020] Consider a case where the ECU 24 is illegally replaced or tampered with after the second ignition is turned on. When the ECU 24 is illegally replaced or tampered with, the ECU 22 stores the calculation result value Nvr ("48260482") calculated when the ignition is turned on the second time, but the ECU 24 has no calculation history and does not store the calculation result value Nvr. Then, when the ignition is turned on (the third ignition is turned on), the ECU 22 performs calculation processing on the stored calculation result value Nvr ("48260482") and then performs hash processing to obtain the calculation result value Nvr ("86420864") (step S130). Since the ECU 24 obtains a calculation result value Nvr ("24680246") by performing a calculation process on the vehicle-specific value Nv and then performing a hash process (step S120), the calculation result value Nvr of the ECU 22 and the calculation result value Nvr of the ECU 24 are different. The server 10, which has received the calculation result value Nvr, compares the calculation result value Nvr of the ECU 22 with the calculation result value Nvr of the ECU 24. Since the calculation result values ​​Nvr of the ECU 22 and the ECU 24 do not match, the server 10 determines that one of the ECUs 22 and 24 is an unauthorized ECU. In this way, when one of the ECUs 22 and 24 is illegally replaced or tampered with, the calculation result value Nvr of the ECU 22 and the calculation result value Nvr of the ECU 24 become different values, and the server 10 determines that one of the ECUs 22 and 24 is an unauthorized ECU. Through such processing, the server 10 can manage the states of the ECUs 22, 24 more appropriately.

[0021] According to the in-vehicle control system 20 of the present embodiment described above, when the ignition is on, if there is no calculation history as a history of performing a specified calculation and a specified hashing, the calculation result value Nvr obtained by performing a specified calculation and a specified hashing on the vehicle unique value Nv is stored and transmitted to the server 10, and if there is a calculation history, the stored calculation result value Nvr is updated with a value obtained by performing a specified calculation and a specified hashing on the stored calculation result value Nvr, and the updated calculation result value Nvr is transmitted to the server 10, thereby more accurately detecting whether the electronic control unit has been illegally replaced or tampered with.

[0022] In the in-vehicle control system 20 of the embodiment described above, a predetermined calculation is performed on the vehicle-specific value Nv and the stored calculation result value Nvr in steps S110 and S130, and then a predetermined hashing is performed. However, instead of the processing in steps S110 and S130, a predetermined calculation may be performed on the vehicle-specific value Nv and the stored calculation result value Nvr after the predetermined hashing is performed. Also, instead of the predetermined hashing, a predetermined encryption may be performed. Examples of algorithms used for encryption include DES (Data Encryption Standard), RC4 (Rivest Cipher 4), and AES (Advanced Encryption Standard).

[0023] The on-vehicle control system 20 of the embodiment described above includes two ECUs (ECUs 22, 24), but may include three or more ECUs.

[0024] The relationship between the main elements of the embodiment and the main elements of the invention described in the section on solving the problems will be described below. In the embodiment, the ECUs 22 and 24 correspond to the "plurality of electronic control units."

[0025] Note that the correspondence between the main elements of the embodiment and the main elements of the invention described in the Means for Solving the Problem column does not limit the elements of the invention described in the Means for Solving the Problem column, since the embodiment is an example for specifically explaining the form for implementing the invention described in the Means for Solving the Problem column. In other words, the interpretation of the invention described in the Means for Solving the Problem column should be made based on the description in that column, and the embodiment is merely a specific example of the invention described in the Means for Solving the Problem column.

[0026] The above describes embodiments for implementing the present disclosure, but the present disclosure is not limited to these embodiments, and it goes without saying that the present disclosure can be implemented in various forms without departing from the gist of the present disclosure.

[0027] The above describes the forms for implementing the invention of the present disclosure, but the invention of the present disclosure is in no way limited to these embodiments, and it goes without saying that the invention can be implemented in various forms without departing from the gist of the present invention. [Industrial Applicability]

[0028] The present disclosure is applicable to the manufacturing industry of in-vehicle control systems, etc. [Explanation of symbols]

[0029] 10 server, 20 in-vehicle control system, 22, 24 electronic control unit (ECU), 26 ignition switch, V vehicle.

Claims

[Claim 1] An in-vehicle control system for controlling a device mounted in a vehicle, the in-vehicle control system including a plurality of electronic control units, capable of exchanging information with a server, the in-vehicle control system comprising: When the ignition is on, if there is no calculation history as a history of execution of a predetermined calculation and a predetermined encryption or hashing, the plurality of electronic control units store a calculation result obtained by performing a predetermined calculation and a predetermined encryption or hashing on a value unique to the vehicle and transmit the result to the server, and when there is the calculation history, update the stored calculation result with a value obtained by performing the predetermined calculation and the predetermined encryption or hashing on the stored calculation result and transmit the updated calculation result to the server. In-vehicle control system.

Images