On-vehicle electronic control device

Abstract

To write the same electronic key in all microcomputers utilizing electronic keys even in a case where an ECU including a plurality of microcomputers internally includes a microcomputer having no external communication function.SOLUTION: An on-vehicle electronic control device comprises a first microcomputer and a second microcomputer. The first microcomputer includes a first processor, a first storage section, a first communication section, a first HSM including a first nonvolatile storage section, and a first inter-microcomputer communication section. The second microcomputer includes a second processor, a second storage section, a second inter-microcomputer communication section, and a second HSM including a second nonvolatile storage section. The first processor writes a received electronic key in the first HSM, and the electronic key is transferred to the second microcomputer by the first processor and written in the second nonvolatile storage section.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to writing an electronic key to an in-vehicle electronic control unit. [Background technology]

[0002] In-vehicle electronic control devices such as ECUs (Electronic Control Units) are controlled by microcomputers (hereafter referred to as MCUs). Various functions are assigned to the MCUs, and external circuits corresponding to each function are also provided, and the target devices are controlled by control software stored in a flash ROM, which is a non-volatile memory. In automobiles, for example, the MCUs control the fuel injection and ignition of the engine.

[0003] Depending on the safety goal defined in the functional safety requirements, a high degree of redundancy may be required in the system configuration, and there is a method to ensure redundancy by installing and controlling multiple microcomputers inside one ECU. An example of such a system is an electric power steering control ECU.

[0004] From the perspective of cybersecurity, security threats from outside the vehicle have been increasing in recent years for on-board ECUs in the connected generation, and automotive standards regarding cybersecurity are being formulated. A forum called WP.29, a subordinate organization of the United Nations, began discussions toward issuing security regulations around 2019, reaching an agreement in June 2020 and publishing the regulations in December 2020.

[0005] WP.29 requires, for example, message authentication for communication between on-board ECUs, device authentication for software updates, verification of digital signatures, software encryption, and verification of secure boot during system startup.

[0006] In encryption technology, which is a fundamental technology for cybersecurity functions, electronic key (encryption key) information is important, and this electronic key and data are used as inputs to the encryption algorithm to perform encryption calculations. Possible encryption methods include "shared key encryption (symmetric encryption)" and "public key encryption (asymmetric encryption)."

[0007] Among electronic keys, symmetric key cryptography in particular uses a key that is shared between the sender and receiver, so if the symmetric key is leaked to a third party, they will be able to decrypt the plaintext from the ciphertext and discover its contents. In other words, the symmetric key has the same value as the plaintext that you want to keep secret, so it needs to be managed securely inside the vehicle's ECU.

[0008] For electronic keys used in public key cryptography, the data transfer client side, such as the electronic key transmission unit, holds the private key, while the server side, the on-board ECU, holds the public key. A characteristic of public key cryptography is that the private key must be managed securely in the same way as the common key, but this does not apply to the public key. However, in order to prevent the public key inside the on-board ECU from being rewritten by a third party, the public key may also be managed in the same way as the common key.

[0009] The microcomputer is equipped with an HSM (Hardware Security Module), which allows secure management of the ECU's electronic key inside (see, for example, Patent Document 1). The slot for the key to be registered is assigned according to the type of electronic key, and the electronic key is initially written and updated in a predefined slot.

[0010] The writing method involves connecting the electronic key transmission unit to the ECU via a wired OBD (On-board Diagnostic) connector, and sending the electronic key to the ECU to be rewritten using a specified communication protocol such as CAN (Car Area Network), Ethernet, LIN (Local Interconnect Network), FlexRay, etc. After the ECU has completed writing the electronic key, it must respond with a signal indicating the writing result to the electronic key transmission unit.

[0011] In addition, after the microcontroller obtains the electronic key from an external source, it must retain the electronic key until it executes the process of writing the electronic key to the HSM. However, security requirements may impose restrictions on the retention time, and in such cases, the system configuration must be considered taking these restrictions into account. [Prior art documents] [Patent documents]

[0012] [Patent Document 1] JP 2022-107288 A Summary of the Invention [Problem to be solved by the invention]

[0013] When multiple microcomputers are installed inside a single ECU, even if the electronic key is the same, the electronic key can be sent individually from the electronic key transmission unit to each microcomputer, and the microcomputer that receives the data can write the electronic key to the HSM and respond individually to the success or failure of the write result.

[0014] However, depending on the configuration of the redundant system, there may be a microcontroller inside the ECU that does not have external communication capabilities. When using an electronic key even with a microcontroller that does not have external communication capabilities, there was a problem with conventional technology in that it was not possible to send the same electronic key and respond with the writing results to all microcontrollers.

[0015] In microcontrollers that do not have external communication functions, there are cases where they cannot send or receive signals via CAN or other means, and cases where they can receive signals from the outside but cannot send signals. Therefore, it is necessary to send the same electronic key and respond to the writing result using a method that does not directly communicate with the electronic key transmission unit.

[0016] The present invention has been made to solve the above-mentioned problems, and aims to provide an in-vehicle electronic control device that can write the same electronic key to all microcomputers that use the electronic key in an ECU system that includes multiple microcomputers, even if the ECU system has an internal microcomputer that does not have external communication functions. [Means for solving the problem]

[0017] The present invention is an in-vehicle electronic control device having a first microcomputer and a second microcomputer, comprising: a first processor that performs arithmetic processing in the first microcomputer; a first storage unit connected to the first processor and storing information; a first communication unit connected to the first processor and communicating with the outside to receive an electronic key; a first non-volatile storage unit connected to the first processor and holding the electronic key; a first inter-microcomputer communication unit connected to the first processor and communicating with the second microcomputer; a second processor that performs arithmetic processing in the second microcomputer; a second storage unit connected to the second processor and storing information; a second inter-microcomputer communication unit connected to the second processor and communicating with the first microcomputer; and a second non-volatile storage unit connected to the second processor and holding the electronic key, and a second hardware security module, wherein the first processor passes the electronic key received by the first communication unit to the first hardware security module for writing it into the first non-volatile memory unit, the first processor transfers the electronic key to the second microcomputer via a first inter-microcomputer communication unit and obtains a first write result of the electronic key from the first hardware security module, the second processor passes the electronic key received via the second inter-microcomputer communication unit to the second hardware security module for writing it into the second non-volatile memory unit and obtains a second write result of the electronic key from the second hardware security module and transmits it to the first microcomputer via the second inter-microcomputer communication unit, and the first processor integrates the write result of the electronic key from the first write result and the second write result and transmits it to the outside. Effect of the Invention

[0018] Even if the in-vehicle electronic control device of the present invention has an internal microcomputer that does not have external communication capabilities, it can write the same electronic key to all microcomputers that use the electronic key by receiving a signal including the electronic key from the electronic key transmission unit once, and notify the electronic key sender of the writing result by transmitting a signal once.

[0019] When writing an electronic key, it is only necessary to send a signal to write the electronic key to the first microcomputer, so there is no need to give instructions to each microcomputer individually.The writer can obtain the success or failure of the writing at once, even in an on-board electronic control unit (ECU) that has multiple microcomputers.Since it appears to be a single ECU from the outside, the freedom of communication design and microcomputer configuration is also increased.

[0020] The second microcomputer begins writing by obtaining electronic key information from the first microcomputer through inter-microcomputer communication, so there is no problem with only obtaining the electronic key and spending a long period of time unable to perform the writing process, and the security conditions regarding the time constraints for holding the electronic key can be satisfied.

[0021] The details of at least one implementation of the subject matter disclosed herein are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the disclosed subject matter will become apparent from the following disclosure, drawings, and claims. [Brief description of the drawings]

[0022] [Figure 1] FIG. 2 is a diagram showing a system configuration in which a first microcomputer communication unit and an electronic key transmission unit of an ECU equipped with two microcomputers according to the first embodiment of the present invention are connected to each other. [Diagram 2] 5 is a flowchart showing an electronic key writing process according to the first embodiment of the present invention. [Diagram 3] 5 is a flowchart detailing a process from start to completion of writing an electronic key in the first microcomputer according to the first embodiment of the present invention. [Figure 4] 4 is a flowchart detailing an electronic key transfer process from a first microcomputer to a second microcomputer using inter-microcomputer communication according to the first embodiment of the present invention, from start to completion. [Diagram 5] 5 is a flowchart detailing a process from the start to the end of waiting for a response from a second microcomputer by a first microcomputer according to the first embodiment of the present invention. [Figure 6] 5 is a flowchart detailing a process from start to completion of writing an electronic key by a second microcomputer according to the first embodiment of the present invention. [Figure 7] 10 is a flowchart detailing a process from start to completion of a write result transfer process of an electronic key from a second microcomputer to a first microcomputer using inter-microcomputer communication according to the first embodiment of the present invention. [Figure 8] FIG. 11 is a diagram showing a system configuration in which a first microcomputer communication unit and a second microcomputer communication unit are connected to an electronic key transmission unit in an ECU equipped with two microcomputers according to a second embodiment of the present invention. [Figure 9] FIG. 11 is a diagram showing a system configuration in which a data relay ECU is connected between an ECU equipped with two microcomputers according to a third embodiment of the present invention and an electronic key transmission unit, and a first microcomputer communication unit is connected to the electronic key transmission unit. [Figure 10] FIG. 11 is a diagram showing a system configuration in which a data relay ECU is connected between an ECU equipped with two microcomputers according to a fourth embodiment of the present invention and an electronic key transmission unit, and a first microcomputer communication unit and a second microcomputer communication unit are connected to the electronic key transmission unit. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. EXAMPLES

[0024] 1 is a diagram showing an internal configuration of an ECU (electronic control unit for automobiles or on-board electronic control unit) 1 according to a first embodiment of the present invention. The ECU 1 includes a first microcomputer 2 and a second microcomputer 2'. The first microcomputer 2 and the second microcomputer 2' include at least one host-side CPU (Central Processing Unit) 3, 3' that executes software arithmetic processing, and at least one secure CPU 8, 8'.

[0025] The host-side CPUs 3, 3' are CPUs that execute publicly known or well-known application programs (host programs), for example. The secure CPUs 8, 8' (which may be CPUs dedicated to security) are CPUs that execute security programs and perform security calculations using a key (electronic key), for example. These CPUs execute each program, causing the first microcomputer 2 and the second microcomputer 2' to realize the functions described in this specification.

[0026] The first microcomputer 2 and the second microcomputer 2' each include a host-side memory area and a secure memory area as a memory unit. The host-side memory area includes at least one local RAM 4, 4' (host-side volatile memory) dedicated to each of the host-side CPUs 3, 3'.

[0027] The secure storage area includes local RAMs 9, 9′ (secure volatile memories) that are dedicated to the secure CPUs 8, 8′. These RAMs are configured so that they can only be accessed by the corresponding CPUs.

[0028] The host side memory area includes the first microcomputer host side non-volatile memory 7 and 7' which stores the programs (host programs) executed by the host side CPUs 3, 3' and the data used by the host programs, and the shared RAM 5, 5' (host side volatile memory) which can be accessed by the host side CPUs 3, 3' and the secure CPUs 8, 8', respectively.

[0029] The secure storage area includes a program (secure program, HSM (Hardware Security Module) firmware) executed by the secure CPU 8, 8', and a secure non-volatile memory 10, 10' for storing data used in the secure program. The secure non-volatile memory 10, 10' can store an electronic key used in the secure program.

[0030] The host-side CPU is connected to data buses and peripheral buses 12, 12'. Separated from these buses, data buses and peripheral buses 13, 13' dedicated to the secure core (HSM) to which only the secure CPUs 8, 8' are connected are provided.

[0031] The secure nonvolatile memories 10, 10' are configured such that they cannot be accessed by cores (host-side CPUs 3, 3') other than the secure CPUs 8, 8'. In other words, the secure CPUs 8, 8' can access the secure storage area, but the host-side CPUs 3, 3' cannot access the secure storage area.

[0032] A device having a secure CPU and a secure storage area is called HSM 20, 20', and can safely manage an electronic key in the secure non-volatile memory and perform cryptographic calculations using the electronic key. Note that, although an example in which the HSM 20, 20' is disposed inside the first microcomputer 2 and the second microcomputer 2' is shown, the present invention is not limited to this, and it is sufficient that the HSM 20, 20' is disposed outside the first microcomputer 2 and the second microcomputer 2' and connected to the data bus / peripheral bus 12, 12' of the first microcomputer 2 and the second microcomputer 2'.

[0033] The first microcomputer 2 and the second microcomputer 2' each include at least one communication unit 6, 6'. This communication unit 6 is connected to an electronic key transmission unit 14 that is external to the ECU 1, and communicates with the electronic key transmission unit 14 when writing the electronic key. The communication unit 6' of the second microcomputer 2' is not connected to the outside.

[0034] 2 is a flowchart showing an example of an electronic key writing process. In the electronic key writing process, an electronic key writing command is transmitted from the electronic key transmission unit (diagnostic device) 14 in step S1. When the command is received by the ECU to which the electronic key is to be written, the process starts and proceeds to step S2.

[0035] In step S2, the first microcomputer 2 judges whether the message identifiers defined by a communication protocol such as CAN are permitted to be received among the commands including the data to write the electronic key. If the second microcomputer 2' is also capable of receiving external data, it may perform a similar judgment. If the message identifiers are permitted to be received, the process proceeds to step S4, and if the message identifiers are not permitted to be received, the process proceeds to step S3.

[0036] In step S3, since reception has been prohibited, the first microcomputer 2 and the second microcomputer 2' discard the received electronic key write data, and the process proceeds to step S14.

[0037] In step S4, since reception has been permitted, the first microcomputer 2 starts the process of writing the electronic key, and proceeds to step S5 after writing is completed.

[0038] In step S5, the first microcomputer 2 judges whether the writing in step S4 has been completed normally. If the writing has been completed normally, the process proceeds to step S6. If the writing has failed, the process proceeds to step S13.

[0039] In step S6, since the writing of the electronic key in the first microcomputer 2 has been completed successfully, the first microcomputer 2 starts transferring the electronic key to the second microcomputer 2' using inter-microcomputer communication in order to move on to writing the electronic key to the second microcomputer 2'.

[0040] In step S7, the first microcomputer 2 determines whether the transfer of the electronic key to the second microcomputer 2' has been completed successfully. If the transfer process has been completed successfully, the process proceeds to step S8. If the transfer process has failed or ended abnormally, the process proceeds to step S13.

[0041] In step S8, since the transfer of the electronic key from the first microcomputer 2 to the second microcomputer 2' has been completed normally, the first microcomputer 2 starts waiting for a response from the second microcomputer 2'.

[0042] In step S9, when the second microcomputer 2' receives the electronic key from the first microcomputer 2 via inter-microcomputer communication, the second microcomputer 2' starts a write process of the electronic key, and proceeds to step S10 after writing is completed.

[0043] In step S10, the second microcomputer 2' starts to transfer the result of the electronic key writing process, ie, whether it has been successful or not, to the first microcomputer 2 using inter-microcomputer communication, and then the process proceeds to step S11.

[0044] In step S11, the first microcomputer 2 receives the result of the writing by the second microcomputer 2' via the inter-microcomputer communication, and if the writing by the second microcomputer 2' is successful, the process proceeds to step S12.

[0045] If the writing in the second microcomputer 2' has failed, the process proceeds to step S13. Also, in regard to the response waiting process started in step S8, if the first microcomputer 2 does not receive a result of the writing from the second microcomputer 2' within a predetermined period of time, it is assumed that the writing in the second microcomputer 2' has failed or there is a communication abnormality between the microcomputers, and the process proceeds to step S13.

[0046] In step S12, the first microcomputer 2 verifies that the writing result information of the first microcomputer 2 and the second microcomputer 2' matches and is successful, then sends a signal to the diagnostic device indicating a positive response that the writing of the electronic key to the first microcomputer 2 and the second microcomputer 2' was successful, and proceeds to step S14.

[0047] In step S13, the first microcomputer 2 transmits a signal indicating a negative response indicating a failure to write the electronic key to the first microcomputer 2 or the second microcomputer 2' in the ECU to which the electronic key is to be written, to the diagnostic machine, and then proceeds to step S14.

[0048] In step S14, the electronic key writing process is completed. At this point, the person writing the electronic key can obtain the success or failure of writing to the first microcomputer 2 and the second microcomputer 2' at the same time.

[0049] FIG. 3 is a flow chart detailing the electronic key writing process in the first microcomputer 2 in step S4 in FIG. 2 from start to completion.

[0050] In step S100, the first microcomputer host-side CPU 3 starts the writing process of the electronic key, and the process proceeds to step S101. At this time, the electronic key is held in the host-side local RAM 4.

[0051] In step S101, the first microcomputer host side CPU3 judges whether the structure of the received electronic key is as defined in advance, and if the judgment result is normal, the process proceeds to step S102. If the judgment result is abnormal, the process proceeds to step S107. At this time, the conditions judged by the first microcomputer host side CPU3 include, for example, whether the received data length is as defined, whether the command identifier for writing the electronic key is as defined, etc.

[0052] In step S102, the first microcomputer host-side CPU3 judges whether a write command can be executed by the secure CPU 8 to which the electronic key is to be written, and if the judgement result is normal, the process proceeds to step S103. If the judgement result is abnormal, the process proceeds to step S107. At this time, the first microcomputer host-side CPU3 judges the conditions as to whether the secure CPU 8 is valid, whether the secure CPU 8 is not currently executing another process and can receive a new command, whether the secure CPU 8 has left any fault information, etc.

[0053] In step S103, the first microcomputer host side CPU 3 executes a write command for the electronic key to the secure CPU 8 via the shared RAM 5. The secure CPU 8 receives the electronic key and the write command from the shared RAM 5, executes a write process for the electronic key to the secure non-volatile memory 10, and returns information indicating the success or failure of the write result to the first microcomputer host side CPU 3 via the shared RAM 5. Then, the process proceeds to step S104.

[0054] In step S104, the first microcomputer host side CPU 3 executes a command to write the electronic key to the secure CPU 8, and then starts transmitting a signal indicating that the electronic key is currently being written to the diagnostic device, and the process proceeds to step S105.

[0055] This signal is transmitted periodically (at a predetermined cycle) until the writing is completed in the first microcomputer 2 and the second microcomputer 2', and is transmitted continuously until the first microcomputer 2 stops the periodic transmission. This makes it possible to prevent the diagnostic device from judging that writing has failed due to the elapsed time since the writing command was sent.

[0056] In step S105, the first microcomputer host side CPU 3 judges whether or not the writing of the electronic key was successful based on the information indicating the writing result returned from the secure CPU 8 to the first microcomputer host side CPU 3 via the shared RAM 5 when the process of step S103 is completed. If the writing was successful, the process proceeds to step S106. If the writing was unsuccessful, the process proceeds to step S107.

[0057] In step S106, the first microcomputer host side CPU 3 holds information indicating that writing of the electronic key in the first microcomputer 2 has been completed normally by its own program, and then the process proceeds to step S108.

[0058] In step S107, the first microcomputer host side CPU3 holds the abnormal completion information of the writing of the electronic key in the first microcomputer by its own program, and proceeds to step S108.

[0059] In step S108, the first microcomputer 2 ends the electronic key writing process.

[0060] FIG. 4 is a flow chart detailing the process from start to completion of the transfer of the electronic key from the first microcomputer 2 to the second microcomputer 2' in step S6 in FIG.

[0061] In step S200, the first microcomputer 2 starts a process of transferring the electronic key received from the diagnostic device to the second microcomputer 2' using inter-microcomputer communication, and then the process proceeds to step S201.

[0062] In step S201, the first microcomputer 2 monitors the state of the inter-microcomputer communication and determines whether the transfer of the electronic key to the second microcomputer 2' is complete. If the transfer is complete, the first microcomputer 2 ends the monitoring of the inter-microcomputer communication state and proceeds to step S203. If the transfer is not complete, the first microcomputer 2 continues to monitor the inter-microcomputer communication state.

[0063] In step S203, the first microcomputer 2 determines whether the transfer process of the electronic key to the second microcomputer 2' has been successful. If the transfer process has been successful, the process proceeds to step S206. If the transfer process has not been successful, the process proceeds to step S204.

[0064] In step S204, the first microcomputer 2 determines whether the number of times the electronic key transfer process to the second microcomputer 2' has failed is greater than a predetermined number. If the number of times is greater than the predetermined number, the process proceeds to step S205. If the number of times is less than or equal to the predetermined number, the process proceeds to step S202.

[0065] In step S202, the first microcomputer 2 retries the transfer of the electronic key to the second microcomputer 2'. If a temporary inter-microcomputer communication abnormality occurs, this step and step S202 may result in a return to normal, so the first microcomputer 2 retries the process a predetermined number of times.

[0066] In step S205, the first microcomputer 2 saves a failure history indicating that there is an abnormality in the inter-microcomputer communication with the second microcomputer 2' in the non-volatile memory 7 on the first microcomputer host side, and proceeds to step S207. At this time, the first microcomputer 2 can determine that there is an abnormality in the inter-microcomputer communication as well as that the process of writing the electronic key to the second microcomputer 2' has failed.

[0067] In step S206, the first microcomputer host side CPU 3 holds information indicating that the transfer process of the electronic key from the first microcomputer 2 to the second microcomputer 2' has been completed normally by its own program, and then proceeds to step S208.

[0068] In step S207, the first microcomputer host side CPU 3 holds completion information indicating that an abnormality has occurred in the process of transferring the electronic key from the first microcomputer 2 to the second microcomputer 2' by its own program, and proceeds to step S208.

[0069] In step S208, the first microcomputer 2 ends the process of transferring the electronic key to the second microcomputer 2' using inter-microcomputer communication.

[0070] FIG. 5 is a flowchart detailing the process from start to completion of the waiting process for the electronic key writing result response from the second microcomputer 2′ in the first microcomputer 2 in step S8 in FIG.

[0071] In step S300, the first microcomputer 2 starts waiting for an electronic key writing completion response from the second microcomputer 2' by monitoring the reception state of the inter-microcomputer communication, and then proceeds to step S301.

[0072] In step S301, the first microcomputer 2 monitors the inter-microcomputer communication to determine whether or not the first microcomputer 2 has started receiving the write result data from the second microcomputer 2'. If the first microcomputer 2 has started receiving the write result data, the process proceeds to step S303. If the first microcomputer 2 has not yet received the write result data, the process proceeds to step S302.

[0073] In step S302, the first microcomputer 2 determines whether the elapsed time from the completion of the transfer of the electronic key to the second microcomputer 2' to the start of writing the electronic key in the second microcomputer 2' is greater than a predetermined time.

[0074] If the predetermined time has elapsed, the first microcomputer 2 proceeds to step S304. If the elapsed time is within the predetermined period, the determination process in step S301 continues. This step prevents the writer from having to wait for a long time when the second microcomputer 2' has an abnormality and cannot respond to a writing failure.

[0075] In step S303, the first microcomputer 2 determines whether the checksum calculation result is normal in order to detect whether the electronic key writing result transfer data received from the second microcomputer 2' through inter-microcomputer communication has been correctly received. If the checksum calculation result is normal, the first microcomputer 2 proceeds to step S305. If the checksum calculation result is abnormal, the first microcomputer 2 proceeds to step S304.

[0076] In step S304, the first microcomputer 2 saves a failure history indicating that there is an abnormality in the inter-microcomputer communication with the second microcomputer 2' in the first microcomputer host-side non-volatile memory 7, and proceeds to step S306. At this time, the first microcomputer 2 can determine that there is an abnormality in the inter-microcomputer communication as well as that the process of writing the electronic key to the second microcomputer 2' has failed.

[0077] In step S305, the first microcomputer host CPU 3 holds information indicating that the data transfer process of the writing result of the electronic key from the second microcomputer 2' to the first microcomputer 2 has been completed normally by its own program, and then proceeds to step S308.

[0078] In step S306, the first microcomputer host side CPU 3 holds completion information indicating that an abnormality has occurred in the data transfer process of the writing result of the electronic key from the second microcomputer 2' to the first microcomputer 2 by its own program, and proceeds to step S307.

[0079] In step S307, the first microcomputer 2 stops the transmission of the signal indicating that the electronic key is being written to the diagnostic machine, which started in step S104 in FIG. 3, and proceeds to step S308.

[0080] In step S308, the first microcomputer 2 ends the process of waiting for a response of the result of writing the electronic key from the second microcomputer 2'.

[0081] FIG. 6 is a flow chart detailing the process of writing the electronic key in the second microcomputer 2' in step S9 in FIG. 2 from start to completion.

[0082] In step S400, the second microcomputer 2' regards the receipt of the electronic key from the first microcomputer 2 as permission to write the electronic key to the second microcomputer 2', and the second microcomputer host side CPU 3' starts the writing process of the electronic key, and the process proceeds to step S401. At this time, the electronic key is held in the host side local RAM 4'. This step allows the second microcomputer 2' to start the writing process without sending or receiving a special write permission signal from the first microcomputer 2.

[0083] In step S401, the second microcomputer host side CPU 3' judges whether the structure of the received electronic key is as defined beforehand, and if the judgment result is normal, the process proceeds to step S402. If the judgment result is abnormal, the process proceeds to step S406. At this time, the second microcomputer host side CPU 3' judges whether the received data length is as defined, whether the command identifier for writing the electronic key is as defined, etc.

[0084] In step S402, the second microcomputer host side CPU 3' judges whether a write command can be executed to the secure CPU 8' to which the electronic key is to be written, and if the judgement result is normal, the process proceeds to step S403. If the judgement result is abnormal, the process proceeds to step S406. At this time, the second microcomputer host side CPU 3' judges the conditions as to whether the secure CPU 8' is valid, whether the secure CPU 8' is not currently executing another process and can receive a new command, whether the secure CPU 8' has left any fault information, etc.

[0085] In step S403, the second microcomputer host side CPU 3' executes a write command for the electronic key to the secure CPU 8' via the shared RAM 5'. The secure CPU 8' receives the electronic key and the write command from the shared RAM 5, executes the write process for the electronic key to the secure non-volatile memory 10', and returns information indicating the success or failure of the write result to the second microcomputer host side CPU 3' via the shared RAM 5'. Then, the process proceeds to step S404.

[0086] In step S404, the second microcomputer host side CPU 3' judges whether or not the writing of the electronic key was successful based on the information indicating the success or failure of the writing result returned from the secure CPU 8' to the second microcomputer host side CPU 3' via the shared RAM 5' at the completion of step S403. If it was successful, the process proceeds to step S405. If it was unsuccessful, the process proceeds to step S406.

[0087] In step S405, the second microcomputer host side CPU 3' holds information indicating that writing of the electronic key in the second microcomputer 2' has been completed normally by its own program, and the process proceeds to step S407.

[0088] In step S406, the second microcomputer host side CPU 3' holds completion information indicating that an abnormality has occurred in writing the electronic key in the second microcomputer 2' by its own program, and the process proceeds to step S407.

[0089] In step S407, the second microcomputer 2' ends the electronic key writing process.

[0090] FIG. 7 is a flow chart detailing the process of transferring the data indicating the result of writing the electronic key from the second microcomputer 2′ to the first microcomputer 2 in step S10 in FIG.

[0091] In step S500, the second microcomputer 2' starts the process of transferring data indicating the result of writing the electronic key to the first microcomputer 2 using inter-microcomputer communication, and then the process proceeds to step S501.

[0092] In step S501, the second microcomputer 2' monitors the state of inter-microcomputer communication and determines whether the transfer of the electronic key writing result data to the first microcomputer 2 is complete. If the transfer is complete, the second microcomputer 2' ends the state monitoring of inter-microcomputer communication and proceeds to step S503. If the transfer is not complete, the second microcomputer 2' continues to monitor the state of inter-microcomputer communication.

[0093] In step S503, the second microcomputer 2′ determines whether the transfer process of the writing result data of the electronic key to the first microcomputer 2 has been successful. If the transfer process has been successful, the process proceeds to step S505. If the transfer process has not been successful, the process proceeds to step S504.

[0094] In step S504, the second microcomputer 2' determines whether the number of failures in the process of transferring the write result data of the electronic key to the first microcomputer 2 is greater than a predetermined number. If the number of failures is greater than the predetermined number, the second microcomputer 2' proceeds to step S506. If the number of failures is equal to or less than the predetermined number, the second microcomputer 2' proceeds to step S502.

[0095] In step S502, the second microcomputer 2′ performs a retry process of transferring the electronic key to the first microcomputer 2. If a provisional inter-microcomputer communication abnormality occurs, this step and step S502 may result in a return to normal, so the retry process is performed a predetermined number of times.

[0096] In step S505, the second microcomputer host CPU 3' retains information indicating that the transfer process of the electronic key writing result data from the second microcomputer 2' to the first microcomputer 2 has been completed normally by its own program, and then proceeds to step S507.

[0097] In step S506, the second microcomputer host side CPU 3' holds completion information indicating that an abnormality has occurred in the process of transferring the electronic key from the second microcomputer 2' to the first microcomputer 2 by its own program, and then proceeds to step S507.

[0098] In step S507, the second microcomputer 2' ends the process of transferring the electronic key writing result data to the first microcomputer 2 using inter-microcomputer communication.

[0099] In the configuration of this embodiment, the electronic key is used for, for example, calculations for verifying digital signatures when rewriting software in each of the first microcomputer 2 and the second microcomputer 2', and for secure boot calculations when starting up the system.

[0100] In this way, even if the second microcomputer 2' without external communication function exists in the ECU 1, by applying the present invention, it is possible to write the electronic key to the second microcomputer 2' via the first microcomputer 2, detect the success or failure of the result, and use the electronic key for cryptographic calculation. The above is the first embodiment. EXAMPLES

[0101] In the first embodiment, the communication unit 6 is connected to an electronic key transmission unit 14 located outside the ECU 1, and the communication unit 6' is not connected to the outside. However, as shown in FIG. 8, the communication unit 6' may also be connected to the electronic key transmission unit 14, and the second microcomputer 2' may be configured to only be capable of receiving.

[0102] When writing the electronic key, the communication unit 6 communicates with the electronic key transmission unit 14, and the electronic key received by the communication unit 6' is discarded in the second microcomputer 2'. This is to shorten the time that the electronic key is held in the second microcomputer 2' and satisfy the security conditions (restrictions on the time that the electronic key is held), and in a configuration to which the present invention is applied, the second microcomputer 2' does not directly receive the electronic key from outside, but the electronic key is transferred from the first microcomputer 2 through inter-microcomputer communication and written.

[0103] The electronic key can be written to the first microcomputer 2 and the second microcomputer 2' in the same manner as the electronic key writing method in the first embodiment.

[0104] In the system configuration of this embodiment, a feature may be that output values ​​from control are allocated to the first microcomputer 2 and the second microcomputer 2' in a specific ratio to ensure redundancy. For example, in an ECU for controlling an electric power steering, the torque control value that the ECU outputs to the control motor is allocated to the first microcomputer 2 and the second microcomputer 2' in a ratio of 50:50, etc., to ensure that the vehicle can continue to run even if one of the microcomputers fails.

[0105] At this time, the communication unit 6' of the second microcomputer 2' can only receive signals from the outside, like the communication unit 6, in order to receive signals such as vehicle speed information from another on-board electronic control unit mounted in the vehicle and realize real-time control in the on-board electronic control unit. A message authenticator may be attached to the signal such as the vehicle speed information, and the electronic key is used for message authentication calculations in addition to the uses in the first embodiment.

[0106] In this way, even in a system configuration in which the communication unit 6' of the second microcomputer 2' only needs to receive signals, by applying the present invention, it is possible to write an electronic key to the second microcomputer 2' via the first microcomputer 2, detect the success or failure of the result, and use the electronic key for cryptographic calculations. The above is the second embodiment. EXAMPLES

[0107] In the first embodiment, the communication unit 6 was connected to the electronic key transmission unit 14 outside the ECU 1. However, as shown in FIG. 9, a data relay ECU 15 may be provided between the electronic key transmission unit 14 and the communication unit 6.

[0108] In this case, the data for writing the electronic key sent from the electronic key transmission unit 14 is temporarily stored in the data relay ECU 15, and then transferred to the communication unit 6 of the ECU 1. Writing the electronic key to the first microcomputer 2 and the second microcomputer 2' can be achieved in a similar manner to the method for writing the electronic key in the first embodiment.

[0109] In addition to the features of the first embodiment, the configuration of this embodiment is characterized in that communication with the electronic key transmission unit is performed via a data relay ECU that is publicly known or well-known as part of the vehicle system configuration.

[0110] The data relay ECU 15 may be configured, for example, as a CGW (Central Gateway) and may act as a firewall for the vehicle system between the outside and the target electronic control device. As in the first embodiment, the electronic key may be used for, for example, digital signature verification calculations when rewriting the software of the first microcomputer 2 and the second microcomputer 2′ and secure boot calculations when starting up the system.

[0111] Even in such a vehicle system configuration, by applying the present invention, it is possible to write the electronic key to the second microcomputer 2' via the first microcomputer 2, detect the success or failure of the result, and use the electronic key for cryptographic calculation. The above is the third embodiment. EXAMPLES

[0112] In the third embodiment, the communication unit 6 is connected to the electronic key transmission unit 14 via the data relay ECU 15 located outside the ECU 1, and the communication unit 6′ is not connected to the outside world. However, as shown in FIG. 10, the communication unit 6′ may also be connected to the data relay ECU 15, and the second microcomputer 2′ may be configured to only receive data.

[0113] When writing the electronic key, the communication unit 6 communicates with the electronic key transmission unit 14, and the electronic key received by the communication unit 6' is discarded in the second microcomputer 2'. Writing the electronic key to the first microcomputer 2 and the second microcomputer 2' can be achieved in the same manner as the method of writing the electronic key in the first embodiment.

[0114] The system configuration of this embodiment has the features of the first, second and third embodiments. Even in such a vehicle system configuration, by applying the present invention, it is possible to write an electronic key to the second microcomputer 2' via the first microcomputer 2, detect the result of the write, and use the electronic key for cryptographic calculations. The above is the fourth embodiment.

[0115] <Conclusion> The present invention is not limited to the above-mentioned embodiments 1 to 4, but includes various modified examples. For example, the above-mentioned embodiments are described in detail to easily explain the present invention, and are not necessarily limited to those including all the configurations described. Also, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Also, it is possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0116] In addition, in the above-mentioned embodiments 1 to 4, the electronic key is written first to the first microcomputer 2 of the control device, and only if the electronic writing to the first microcomputer 2 is successful is the writing to the second microcomputer 2' is performed. However, the function can also be realized as a configuration in which, after the first microcomputer 2 receives the electronic key from the electronic key transmission unit, the electronic key is first transferred to the second microcomputer 2', and then the electronic key is written by each of the first microcomputer 2 and the second microcomputer 2', and the first microcomputer 2 combines the success or failure of the results and transmits the result to the electronic key transmission unit.

[0117] In addition, in the above-mentioned first to fourth embodiments, the control device includes the first microcomputer 2 and the second microcomputer 2', but the configuration may include a plurality of microcomputers equivalent to the second microcomputer 2'. Even in this case, it is possible to use the present invention to configure the first microcomputer 2 to transfer the electronic key to the second microcomputer 2' or a third microcomputer, etc., using inter-microcomputer communication, and to perform writing and integrate the result of the writing.

[0118] As described above, the on-vehicle electronic control unit (ECU1) according to the first to fourth embodiments can be configured as follows.

[0119] (1) An in-vehicle electronic control unit (ECU1) having a first microcomputer (first microcomputer 2) and a second microcomputer (second microcomputer 2'), comprising: a first processor (3) for performing arithmetic processing in the first microcomputer (2); a first storage unit (local RAM 4, non-volatile memory 7) connected to the first processor (3) for storing information; a first communication unit (6) connected to the first processor (3) for communicating with the outside and receiving an electronic key; a first hardware security module (first HSM 20) for performing cryptographic processing, including a first nonvolatile storage unit (secure nonvolatile memory 10) for holding data, a first inter-microcomputer communication unit (11) connected to the first processor (3) for communicating with the second microcomputer (2'), a second processor (3') for performing arithmetic processing in the second microcomputer (2'), a second storage unit (local RAM 4', nonvolatile memory 7') connected to the second processor (3') for storing information, The second processor (3') includes a second inter-microcomputer communication unit (11') connected to the second processor (3') and communicating with the first microcomputer (2), and a second hardware security module (20') connected to the second processor (3') and including a second non-volatile storage unit (10') for holding the electronic key, and the first processor (3) transfers the electronic key received by the first communication unit (6) to the first hardware security module (20) and stores the electronic key in the first non-volatile storage unit (10'). 0), the first processor (3) transfers the electronic key to the second microcomputer (2') via a first inter-microcomputer communication unit 11 and acquires a first writing result of the electronic key from the first hardware security module (20), the second processor (3') passes the electronic key received via the second inter-microcomputer communication unit (11') to the second hardware security module (20') and causes it to be written into the second non-volatile storage unit (10');a second write result of the electronic key is obtained from the second hardware security module (20') and transmitted to the first microcomputer (2) via the second inter-microcomputer communication unit (11'), and the first processor (3) integrates the write result of the electronic key from the first write result and the second write result and transmits the integrated result to an external device.

[0120] With the above configuration, even if the in-vehicle electronic control device of the present invention has an internal microcomputer that does not have external communication capabilities, it can write the same electronic key to all microcomputers that use the electronic key by receiving a signal including the electronic key from the electronic key transmission unit once, and notify the electronic key sender of the writing result by transmitting a signal once.

[0121] When writing an electronic key, it is only necessary to send a signal to write the electronic key to the first microcomputer (2), so there is no need to give instructions to each microcomputer individually. The writing operator can obtain the success or failure of writing at once, even in an on-board electronic control unit (ECU) that has multiple microcomputers. Since it appears as a single ECU from the outside, the freedom of communication design and microcomputer configuration is also increased.

[0122] The second microcomputer starts writing by acquiring electronic key information from the first microcomputer (2) through inter-microcomputer communication, so there is no problem of only acquiring the electronic key and a long period of time elapses during which the writing process cannot be performed, and the security conditions regarding the time constraints for holding the electronic key can be satisfied.

[0123] (2) An in-vehicle electronic control device as described in (1) above, characterized in that the second microcomputer (2') writes the electronic key received from the first microcomputer (2) via the second inter-microcomputer communication unit (11') into the second hardware security module (20').

[0124] With the above configuration, the second microcomputer 2' can hold only the electronic key received from the first microcomputer 2 via inter-microcomputer communication in the HSM 20' of the second microcomputer 2' and perform cryptographic calculations.

[0125] (3) The in-vehicle electronic control device described in (1) above, wherein the second microcomputer (2') further has a second communication unit (6') connected to the second processor (3') to receive information from the outside, the electronic key is transmitted to the first microcomputer (2) and the second microcomputer (2') using a predetermined communication protocol, and the second microcomputer (2') discards the electronic key received by the second communication unit.

[0126] With the above configuration, when writing the electronic key, the communication unit 6 communicates with the electronic key transmission unit 14, and the electronic key received by the communication unit 6' of the second microcomputer 2' is discarded within the second microcomputer 2'. This shortens the time that the electronic key is held within the second microcomputer 2', and makes it possible to satisfy security conditions (restrictions on the time that the electronic key is held).

[0127] (4) An in-vehicle electronic control device as described in (1) above, characterized in that the first processor (3) verifies that the first writing result and the second writing result match, and transmits information indicating the success or failure of the electronic key writing result to the outside depending on the verification result.

[0128] With the above-described configuration, the person writing the electronic key to the electronic key transmission unit 14 can obtain the success or failure of writing to the first microcomputer 2 and the second microcomputer 2' at once, and can quickly verify the writing operation of the electronic key.

[0129] (5) An in-vehicle electronic control device as described in (4) above, characterized in that the information indicating whether the electronic key writing result was successful is determined to be successful if writing is successful in both the first microcomputer (2) and the second microcomputer (2'), and is determined to be unsuccessful if writing fails in either of them.

[0130] With the above configuration, the person who writes the electronic key to the electronic key transmission unit 14 can easily know whether writing to the first microcomputer 2 and the second microcomputer 2' has been successful.

[0131] (6) The in-vehicle electronic control device described in (1) above, wherein the second microcomputer (2') regards the receipt of an electronic key from the first microcomputer (2) as permission to write the electronic key.

[0132] With the above configuration, the second microcomputer 2' regards receiving the electronic key from the first microcomputer 2 as permission to write the electronic key to the second microcomputer 2', thereby reducing the exchange of commands within the ECU 1 and speeding up processing.

[0133] (7) An in-vehicle electronic control device as described in (1) above, characterized in that the first microcomputer (2) determines that the writing of the electronic key in the second microcomputer (2') has failed if the result of writing the electronic key from the second microcomputer (2') is not returned within a predetermined time.

[0134] With the above configuration, when there is no response of the writing result from the second microcomputer 2', the first microcomputer 2 can determine that the writing has failed after a predetermined time has elapsed.

[0135] (8) An in-vehicle electronic control device as described in (1) above, characterized in that the first microcomputer (2) receives the result of a checksum calculation process of the electronic key through inter-microcomputer communication with the second microcomputer (2') and determines whether the communication was performed normally.

[0136] With the above configuration, the first microcomputer 2 can determine whether or not the transfer process of the electronic key has been successful based on the result of the checksum calculation process of the electronic key from the second microcomputer 2'.

[0137] (9) An in-vehicle electronic control device as described in (1) above, characterized in that, when an abnormality occurs in the inter-microcomputer communication with the second microcomputer (2'), the first microcomputer (2) stores a history of the abnormality in the inter-microcomputer communication in the first memory unit.

[0138] With the above configuration, if an abnormality occurs in communication between microcomputers, the first microcomputer 2 can store the abnormality history in the non-volatile memory 7, thereby identifying the cause of the failure to write the electronic key.

[0139] (10) An in-vehicle electronic control device as described in (1) above, characterized in that, when inter-microcomputer communication between the first microcomputer (2) and the second microcomputer (2') fails, the in-vehicle electronic control device retries the inter-microcomputer communication up to a predetermined number of times.

[0140] With the above configuration, when a temporary abnormality occurs in communication between the microcomputers, the first microcomputer 2 executes retry processing a predetermined number of times since there is a possibility that communication can be restored to normal by retrying communication.

[0141] (11) An in-vehicle electronic control device as described in (1) above, characterized in that the first microcomputer (2) transmits a signal indicating that the first microcomputer (2) and the second microcomputer (2') are in the process of writing an electronic key to the outside at a predetermined period.

[0142] With the above configuration, the first microcomputer 2 can send a signal at a predetermined period while the ECU 1 is processing the writing of the electronic key, thereby preventing an external diagnostic device from determining that the writing has failed due to the elapsed time since the writing command was sent.

[0143] (12) An in-vehicle electronic control device as described in (1) above, characterized in that the in-vehicle electronic control device has a plurality of the second microcomputers (2'), and the first microcomputer (2) transfers an electronic key to the plurality of second microcomputers (2').

[0144] With the above configuration, even if the ECU 1 contains multiple second microcomputers 2' that do not have a communication function, it is possible to write the electronic key to the multiple second microcomputers 2' by using inter-microcomputer communication.

[0145] (13) The in-vehicle electronic control device according to (1) above, wherein the electronic key is compatible with a common key cryptosystem or an asymmetric key cryptosystem.

[0146] With the above configuration, the ECU 1 can use an electronic key of a common key cryptosystem or an asymmetric key cryptosystem.

[0147] The above configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. The above configurations and functions may also be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0148] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]

[0149] 1 ECU 2. First microcomputer 2′ Second microcomputer 3. First microcomputer host side CPU 3′ Second microcomputer host side CPU 4. First microcomputer host side local RAM 4′ Second microcomputer host side local RAM 5. First microcomputer shared RAM 5′ Second microcomputer shared RAM 6 First microcomputer communication section 6′ Second microcomputer communication section 7. First microcomputer non-volatile memory 7′ Second microcomputer non-volatile memory 8. First microcomputer secure CPU 8′ Second microcomputer secure CPU 9 First microcomputer secure local RAM 9′ Second microcontroller secure local RAM 10 First microcontroller secure non-volatile memory 10′ Second microcontroller secure non-volatile memory 11. Microcomputer communication section 12 First microcomputer host side data bus and peripheral bus 12' Second microcontroller host side data bus and peripheral bus 13 1st microcontroller secure data bus and peripheral bus 13' Second microcontroller secure data bus and peripheral bus 14 Electronic key transmission unit 15 Data Relay ECU 20, 20' HSM

Claims

1. An in-vehicle electronic control device having a first microcomputer and a second microcomputer, a first processor that performs arithmetic processing on the first microcomputer; a first storage unit connected to the first processor for storing information; a first communication unit connected to the first processor and configured to communicate with an external device and receive an electronic key; a first hardware security module connected to the first processor and including a first non-volatile storage unit for storing the electronic key, the first hardware security module performing cryptographic processing; a first inter-microcomputer communication unit connected to the first processor and communicating with the second microcomputer; a second processor that performs arithmetic processing on the second microcomputer; a second storage unit coupled to the second processor for storing information; a second inter-microcomputer communication unit connected to the second processor and communicating with the first microcomputer; a second hardware security module connected to the second processor and including a second non-volatile storage unit for holding the electronic key, the second hardware security module performing cryptographic processing; the first processor transfers the electronic key received by the first communication unit to the first hardware security module and writes the electronic key into the first non-volatile storage unit; the first processor transfers the electronic key to the second microcomputer via a first inter-microcomputer communication unit, and obtains a first writing result of the electronic key from the first hardware security module; the second processor delivers the electronic key received via the second inter-microcomputer communication unit to the second hardware security module to write the electronic key into the second non-volatile storage unit, obtains a second writing result of the electronic key from the second hardware security module and transmits the second writing result to the first microcomputer via the second inter-microcomputer communication unit; The in-vehicle electronic control device according to claim 1, wherein the first processor integrates the first write result and the second write result into a write result of the electronic key and transmits the integrated result to an external device.

2. 2. The on-vehicle electronic control device according to claim 1, The second microcomputer comprises: an electronic key received from the first microcomputer via the second inter-microcomputer communication unit and written into the second hardware security module;

3. 2. The on-vehicle electronic control device according to claim 1, the second microcomputer further includes a second communication unit connected to the second processor for receiving information from an external device; the electronic key is transmitted to the first microcomputer and the second microcomputer using a predetermined communication protocol; The second microcomputer comprises: The electronic control unit according to claim 1, further comprising: a first communication unit that receives the electronic key from the first communication unit;

4. 2. The on-vehicle electronic control device according to claim 1, The first processor, an electronic control unit for verifying that the first write result and the second write result match, and transmitting information indicating whether the electronic key write result was successful or not to an external device depending on the verification result;

5. The on-vehicle electronic control device according to claim 4, The information indicating whether the electronic key has been written successfully or not is an in-vehicle electronic control device which judges the writing as successful if the writing is successful in both the first microcomputer and the second microcomputer, and judges the writing as unsuccessful if the writing is unsuccessful in either one of the microcomputers.

6. 2. The on-vehicle electronic control device according to claim 1, The second microcomputer comprises:

2. An in-vehicle electronic control device, comprising: a first microcomputer that receives an electronic key from the first microcomputer, the first microcomputer being configured to receive the electronic key;

7. 2. The on-vehicle electronic control device according to claim 1, The first microcomputer comprises: an electronic control unit for determining whether or not the second microcomputer has successfully written the electronic key to the vehicle when the second microcomputer has not responded with a result of the writing of the electronic key within a predetermined period of time;

8. 2. The on-vehicle electronic control device according to claim 1, The first microcomputer comprises: an electronic control unit for receiving a checksum calculation result of the electronic key through inter-microcomputer communication with the second microcomputer, and determining whether the communication has been performed normally or not;

9. 2. The on-vehicle electronic control device according to claim 1, The first microcomputer comprises:

2. An on-vehicle electronic control device comprising: an on-vehicle electronic control unit configured to, when an abnormality occurs in inter-microcomputer communication with said second microcomputer, store a history of the abnormality in the inter-microcomputer communication in said first storage unit.

10. 2. The on-vehicle electronic control device according to claim 1, The first microcomputer comprises:

2. An in-vehicle electronic control device, comprising: an in-vehicle electronic control unit which, when inter-microcomputer communication with said second microcomputer fails, retries inter-microcomputer communication up to a predetermined number of times.

11. 2. The on-vehicle electronic control device according to claim 1, The first microcomputer comprises:

2. An in-vehicle electronic control device comprising: a first microcomputer and a second microcomputer, the first microcomputer and the second microcomputer transmitting, at a predetermined period, a signal indicating that an electronic key writing process is in progress to an external device.

12. 2. The on-vehicle electronic control device according to claim 1, A plurality of the second microcomputers are provided, The first microcomputer comprises:

2. An electronic control device for a vehicle, comprising: a first electronic key unit for transmitting an electronic key to a plurality of said second microcomputers;

13. 2. The on-vehicle electronic control device according to claim 1, The electronic key is compatible with a common key cryptosystem or an asymmetric key cryptosystem.

Images