Information processing device

Abstract

To provide an information processing device capable of properly performing the update of a software program.SOLUTION: A method includes: first receiving processing for receiving some data in which first version information is included but a first software program is not included among update data including the first software program and the first version information about the first software program stored in an area on the head side than the first software program; processing for storing some data in a first storage area; processing for comparing new and old information between second version information representing a version about a second software program before the update which is stored in a second storage area in which the first software program is to be stored and the first version information included in some data; and processing for receiving the first software program by second receiving processing and storing it in the second storage area when it is determined that the first version information is newer than the second version information.SELECTED DRAWING: Figure 8

Description

[Technical Field]

[0001] The present invention relates to the technical field of updating software in an information processing device mounted on a vehicle. [Background technology]

[0002] Due to the electronic control of vehicles, many information processing devices such as ECUs (Electronic Control Units) are installed. In such information processing devices, updates are carried out to eliminate bugs in software programs and improve performance (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2023-052938 Summary of the Invention [Problem to be solved by the invention]

[0004] Incidentally, when updating a software program, a connection terminal (external terminal) in which a reprogramming tool is installed is often used. The connected terminal avoids downgrading to an older version by comparing the version of the software program installed in the ECU with the version of the software program to be written.

[0005] However, if the connection terminal is illegally modified, the version comparison process may be invalidated, making it impossible to avoid downgrading the ECU.

[0006] The present invention has been made in view of the above circumstances, and has as its object to appropriately update software programs. [Means for solving the problem]

[0007] An information processing device according to one embodiment of the present invention comprises one or more processors and a storage medium on which a program executed by the one or more processors is stored, the program including one or more instructions that cause the one or more processors to execute the following processes: a first reception process for receiving partial data of update data including a first software program and first version information, which is information stored in an area further forward than the first software program and indicates the version of the first software program, and which includes the first version information but does not include the first software program; a process for storing the partial data in a first storage area; a process for comparing the newness of second version information, which indicates the version of a second software program before the update and is stored in a second storage area where the first software program is to be stored, with the first version information included in the partial data; and a process for storing the first software program received by a second reception process performed after the first reception process in the second storage area if it is determined that the first version information is newer than the second version information. [Effects of the Invention]

[0008] According to the present invention, it is possible to appropriately update a software program. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of a vehicle. [Figure 2] FIG. 2 is a diagram for explaining a communication path between a vehicle and a server device. [Figure 3] FIG. 2 is a block diagram illustrating an example of the configuration of an ECU. [Figure 4] FIG. 1 is a block diagram illustrating an example of the configuration of a computer device. [Figure 5]FIG. 10 is a diagram illustrating a process of generating update data from a software program. [Figure 6] FIG. 10 is a diagram showing a process of generating encrypted update data from update data. [Figure 7] 10 is a flowchart illustrating an example of a process executed by a CGWECU as an update process. [Figure 8] 10 is a flowchart illustrating an example of processing executed by an ECU to be updated together with FIG. 9. [Figure 9] 9 is a flowchart illustrating an example of processing executed by an ECU to be updated together with FIG. 8. [Figure 10] 10 is a flowchart illustrating an example of a process executed by a server device in an update process. [Figure 11] 10 is a flowchart illustrating an example of a process executed by a connection terminal in an update process. DETAILED DESCRIPTION OF THE INVENTION

[0010] <1. Vehicle configuration> FIG. 1 shows an example of the configuration of a vehicle 100 equipped with an ECU 1 according to an embodiment of the present invention as an information processing device.

[0011] Vehicle 100 includes a first bus 101 and a second bus 102. First bus 101 and second bus 102 are configured as buses using, for example, CAN (Controller Area Network (registered trademark)) communication, and are capable of transmitting and receiving information between devices.

[0012] To the first bus 101, the ECU 1, various other ECUs 103, and a DCM (Data Communication Module) 104 are connected.

[0013] Here, the ECU 1 and the various ECUs 103 will be described. The ECU 103 is, for example, an ACECU (Air Conditioner ECU), an engine control ECU, a charge control ECU, an airbag ECU, or a display control ECU.

[0014] Each ECU 103 is configured to be able to perform a predetermined function by installing a software program SWP therein. When a new software program SWP is provided, each ECU 103 is updated at any timing.

[0015] In the following description, the ECU 103 that is the target of updating the software program SWP will be referred to as ECU 1. The ECU that is not the target of updating the software program SWP will be referred to as ECU 103.

[0016] The ECUs 103 include one equipped with a gateway function for a vehicle. This ECU 103 is referred to as a CGWECU (Central Gateway Electronic Control Unit) 103a. Note that the CGWECU 103a may be the ECU 1 to be updated.

[0017] The CGWECU 103a receives update data Du for updating the software program SWP installed in the ECU 1 connected to the first bus 101 from a device outside the vehicle. The CGWECU 103a supplies the update data Du received from outside the vehicle to the ECU 1.

[0018] Upon receiving the update data Du, the ECU 1 performs a predetermined process, which will be described later, to verify the validity of the update data Du, and then updates the software program SWP using the update data Du.

[0019] The DCM 104 is a vehicle communication device that performs data communication with other devices via an external communication network NW. The DCM 104 may be configured to acquire the update data Du from an external file server (e.g., a server device 300 described later) using an OTA (Over The Air) method. The acquired update data Du is provided to the CGWECU 103a via the first bus 101.

[0020] The second bus 102 is connected to a CGWECU 103 a and a DLC (Data Link Connector) 105 .

[0021] The DLC 105 is provided as a connector to which a device that communicates in accordance with, for example, the OBDII (On-Board Diagnostics II) method is connected.

[0022] The DLC 105 is capable of acquiring update data Du from a connected device outside the vehicle (for example, the connection terminal 200 described later), and the acquired update data Du is provided to the CGWECU 103a via the second bus 102.

[0023] 2 is a diagram illustrating an example of a communication path through which the update data Du acquired via the DLC 105 is provided to the CGWECU 103a. Note that in FIG. 2, the buses provided in the vehicle 100 are not shown.

[0024] The vehicle 100 is connected to a connection terminal 200 via a DLC 105 .

[0025] A reprogramming tool (hereinafter referred to as "ReproTool RT") is installed in the connection terminal 200, and the CGWECU 103a and other ECUs 103 can be updated using the ReproTool RT.

[0026] A connection terminal 200, a DCM 104 of a vehicle 100, and a server device 300 are connected to the communication network NW.

[0027] The server device 300 is connected to a database DB in which update data Du provided to the CGWECU 103 a via the connection terminal 200 and the DCM 104 is stored.

[0028] That is, the CGWECU 103a acquires the update data Du acquired by the server device 300 from the database DB via the DLC 105 or the DCM 104, and provides the data to the ECU 1 that is to be updated. Upon receiving the update data Du, the ECU 1 verifies its authenticity and then updates the software program SWP.

[0029] <2. Configuration of information processing device> The configurations of the above-mentioned ECU1, ECU103, and CGWECU103a will be described with reference to FIG. The ECU 1 is configured to include a microcomputer 2 and a communication circuit 3 .

[0030] The microcomputer 2 includes a CPU (Central Processing Unit) 4, a ROM (Read Only Memory) 5, and a RAM (Random Access Memory) 6.

[0031] The CPU 4, ROM 5, and RAM 6 are connected by a bus 7 so as to be able to communicate with each other.

[0032] The CPU 4 executes various processes according to a program stored in the ROM 5 or a program loaded into the RAM 6 .

[0033] For example, the CPU 4 in the ECU 1 to be updated first receives a part of the update data Du from the CGWECU 103a and executes a process of decoding the part.

[0034] The CPU 4 further compares the version information Dver obtained from the update data Du with the version information Dver of the software program SWP installed in the ECU 1, and determines whether or not to continue the update process.

[0035] When it is determined that the update process should be continued, the CPU 4 receives any unreceived data of the update data Du via the CGWECU 103a, decrypts the received data, and updates the software program SWP.

[0036] Data handled by the CPU 4 when performing such processing is temporarily stored in the RAM 6, for example.

[0037] The ROM 5 is, for example, NVM (Non Volatile Memory).

[0038] The communication circuit 3 controls data communication via the first bus 101 and the second bus 102 in accordance with the CAN communication standard or the like.

[0039] As shown in FIG. 3, the ECU 103 and the CGWECU 103a are configured to include a microcomputer 2 and a communication circuit 3, similar to the ECU 1.

[0040] The communication circuit 3 of the ECU 1 controls data communication via the first bus 101 in accordance with the CAN communication standard or the like.

[0041] Next, the configuration of a computer device Com such as the connection terminal 200 or the server device 300 will be described with reference to Fig. 4. Note that each computer device Com does not need to have all of the units shown in Fig. 4. For example, each computer device Com may not have some of the units shown in Fig. 4, or may have units not shown in Fig. 4.

[0042] The computer device Com comprises a CPU 31, a ROM 32, a RAM 33, a bus 34, an input / output interface 35, an input unit 36, an output unit 37, a storage unit 38, a communication unit 39, a media drive 40, and the like.

[0043] The CPU 31 executes various processes in accordance with a program stored in the ROM 32 or a program loaded from the storage unit 38 into the RAM 33. The RAM 33 also stores data necessary for the CPU 31 to execute various processes as appropriate.

[0044] The CPU 31, ROM 32, and RAM 33 are interconnected via a bus 34. An input / output interface 35 is also connected to the bus 34.

[0045] To the input / output interface 35, an input unit 36, an output unit 37, a storage unit 38, a communication unit 39, and a media drive 40 are connected. The input unit 36 ​​is composed of a keyboard, a mouse, a touch panel, a microphone, and the like. The output unit 37 is configured by a display such as an LCD (Liquid Crystal Display), a CRT (Cathode Ray Tube), or an organic EL (Electro Luminescence) panel, as well as a speaker.

[0046] The storage unit 38 is configured by a HDD (Hard Disk Drive), a flash memory device, or the like. The communication unit 39 performs communication processing and communication between devices via the communication network NW. Removable media 41 such as a magnetic disk, optical disk, magneto-optical disk, or semiconductor memory is loaded into the media drive 40 as needed, and information is written to and read from the removable media 41 .

[0047] In the computer device Com, data and programs are uploaded and downloaded through communication by a communication unit 39. Data and programs can also be transferred via a removable medium 41. The CPU 31 performs processing operations based on various programs, thereby executing necessary information processing and communication as the computer device Com.

[0048] In the computer device Com, various functions are implemented by a CPU 31, a ROM 32, a RAM 33, and the like. As a result, for example, in the computer device Com serving as the server device 300, a process is realized in which update data Du used for updating is obtained from the database DB and transmitted. Furthermore, the computer device Com serving as the connection terminal 200 performs processing such as providing the update data Du received from the server device 300 to the CGWECU 103a provided in the vehicle 100.

[0049] <3. Generate update data> The structure of the update data Du will be described with reference to FIG. The update data Du is, for example, data prepared by the server device 300.

[0050] The CPU 31 of the server device 300 prepares the software program SWP including the version information Dver.

[0051] First, the CPU 31 of the server device 300 generates verification data Dval for the version information Dver extracted from the software program SWP. The verification data Dval is, for example, a CRC (Cyclic Redundancy Check) code that can detect and correct errors in the version information Dver.

[0052] Furthermore, the CPU 31 of the server device 300 generates an authenticator AC using the entire software program SWP including the version information Dver.

[0053] The authenticator AC is data that can be used to determine whether the software program SWP is valid, and is, for example, an electronic signature or a MAC (Message Authentication Code).

[0054] The server device 300 generates update data Du in which the version information Dver, the verification data Dval, the entire software program SWP, and the authenticator AC are arranged in this order. At this time, in the update data Du, the version information Dver and the verification data Dval extracted from the software program SWP are placed in an area further ahead than the software program SWP.

[0055] The version information Dver included in the head area of ​​the update data Du or an area equivalent thereto is referred to as first version information Dver1 in order to distinguish it from information of previous versions.

[0056] Furthermore, the software program SWP will also be referred to as the first software program SWP1 in order to distinguish it from the older version.

[0057] The server device 300 provides the update data Du as shown in FIG. 5 to the CGWECU 103a via the connection terminal 200 or via the DCM 104.

[0058] The server device 300 may provide the CGWECU 103a with encrypted update data Duen obtained by encrypting the update data Du shown in FIG. 5 (see FIG. 6). The authenticator AC may also be generated from the encrypted update data Duen.

[0059] In addition, in the encrypted update data Duen, the encrypted first version information Dver1 is stored in the leading area or an area equivalent thereto, and the first version information Dver1 is stored in an area at least further ahead than the first software program SWP1.

[0060] The update data Du is encrypted using a block cipher such as the Advanced Encryption Standard (AES) or Camellia cipher. This makes it possible to first decrypt only a predetermined area from the beginning of the encrypted update data Duen in the decryption process, and makes it possible to verify the version without decrypting the entire data.

[0061] The information stored in the area of ​​the update data Du that is located further ahead than the first software program SWP1 is collectively referred to as partial data Dp. That is, the partial data Dp includes at least the first version information Dver1 and the verification data Dval.

[0062] The partial data Dp in the encrypted update data Duen includes at least the encrypted first version information Dver1 and the verification data Dval.

[0063] <4. Processing flow> FIG. 7 shows an example of an update process executed by the CPU 4 of the CGWECU 103a of the vehicle 100 to update the software of the ECU 103 (or the CGWECU 103a), and FIGS. 8 and 9 show examples of an update process executed by the CPU 4 of the ECU 1. Note that the connector Cn1 in the figure represents a connection between processes.

[0064] The CPU 4 of the CGWECU 103a first performs vehicle verification processing in step S101 of Fig. 7. The vehicle verification processing is processing for verifying whether the vehicle 100 is a target for updating the ECU 103 between the CGWECU 103a and the connection terminal 200 (or the server device 300). In the processing that follows, an example in which update data Du is transmitted from the connection terminal 200 will be mainly described.

[0065] In the vehicle verification process, for example, the CPU 4 transmits information such as the version information Dver of the software program SWP installed in the ECU 1 that is the target of update in the vehicle 100, the chassis number and VIN (Vehicle Identification Number) that identify the vehicle 100, etc.

[0066] If the vehicle verification process has not ended normally, the CPU 4 ends the series of processes shown in FIGS. 8 and 9 without executing the processes from step S102 onwards.

[0067] On the other hand, after the vehicle verification process has been completed normally, the CPU 4 proceeds to an update session in step S102.

[0068] In step S103, the CPU 4 receives a portion of the data Dp (for example, the first few kBytes of data) in the encrypted update data Duen, and stores it in the RAM 6, for example.

[0069] In step S104, the CPU 4 performs a process of transmitting the partial data Dp to the ECU 1. At this time, the CPU 4 may transmit a stop request to the connection terminal 200 to temporarily stop transmission of the remaining data following the partial data Dp.

[0070] In step S105, the CPU 4 determines whether or not a transmission request for the remaining data following the partial data Dp has been received from the ECU 1.

[0071] If it is determined that the transmission request has not been received, the CPU 4 determines in step S106 whether or not a request to cancel the update has been received from the ECU 1.

[0072] If it is determined that the abort request has been received, the CPU 4 proceeds to step S107 and transmits the abort request to the connected terminal 200. As a result, the connected terminal 200 avoids transmitting the remaining data following the partial data Dp, and the update process is aborted without performing the update.

[0073] On the other hand, if it is determined that neither a transmission request nor a stop request has been received from the ECU 1, the CPU 4 of the CGWECU 103a executes the process of step S105 again.

[0074] Also, if it is determined in step S105 that a transmission request has been received from ECU 1, CPU 4 proceeds to step S108 and transmits to connection terminal 200 a transmission request for the remaining data following partial data Dp in encrypted update data Duen.

[0075] In step S109, the CPU 4 performs a receiving process to receive the remaining data. Then, in step S110, the CPU 4 performs a process to transmit the received remaining data to the ECU 1, and ends the series of processes shown in FIG.

[0076] Next, the process executed by the CPU 4 of the ECU 1 that is the update target will be described.

[0077] In step S151 of FIG. 8, the CPU 4 of the ECU 1 receives the partial data Dp in the encrypted update data Duen from the CGWECU 103a and stores it in the RAM 6, for example.

[0078] In step S152, the CPU 4 performs a decoding process on the received partial data Dp. Furthermore, in step S153, the CPU 4 executes an error verification process. In the error verification process, the CPU 4 verifies whether or not there is an error in the first version information Dver1 included in the partial data Dp, using the verification data Dval included in the partial data Dp obtained in the decoding process in step S152. At this time, errors of a predetermined number of bits may be corrected.

[0079] In step S154, the CPU 4 determines whether or not there is an error. If an error correction has been performed in step S153, it may also be determined in step S154 whether or not the error correction has been performed appropriately.

[0080] If it is determined that an error exists, or if the error is corrected but normal first version information Dver1 cannot be obtained, the CPU 4 requests the CGWECU 103a to stop the update in step S155.

[0081] On the other hand, if it is determined that there is no error, or if correct first version information Dver1 is obtained as a result of correcting the error, the CPU 4 executes a new / old comparison process (version verification process) in step S156.

[0082] In the new / old comparison process, the version information (referred to as second version information Dver2) of the pre-update software program SWP (referred to as second software program SWP2) currently installed in ECU1 is compared with the first version information Dver1 obtained in step S152 or step S153.

[0083] In step S157, the CPU 4 performs branching processing according to the result of the new / old comparison processing. Specifically, if the CPU 4 determines that the second version information Dver2 is newer, the CPU 4 determines "No" in step S157. In this case, the CPU 4 transmits a stop request to the CGWECU 103a in step S155 and stops the series of update processing.

[0084] On the other hand, if the CPU 4 determines that the first version information Dver1 is newer, it makes a "Yes" determination in step S157. In this case, the CPU 4 proceeds to step S158 in Fig. 9 and transmits a transmission request for the remaining data following the partial data Dp to the CGWECU 103a.

[0085] The CPU 4 receives the remaining data from the CGWECU 103a in step S159, and performs a decoding process on the remaining data in step S160.

[0086] In step S161, the CPU 4 overwrites the area in which the second software program SWP2 is stored with the first software program SWP1 included in the decrypted remaining data, thereby deleting the second software program SWP2 installed in the ECU 1 and installing the first software program SWP1 instead.

[0087] In step S162, the CPU 4 generates an authenticator AC. This authenticator generation process is a process for generating a new digital signature or MAC as the authenticator AC from the first software program SWP1 included in the decrypted remaining data.

[0088] In step S163, the CPU 4 performs a comparison process of the authenticator AC. This comparison process verifies the legitimacy of the first software program SWP1 written to the ECU 1 by comparing the authenticator AC newly generated in step S162 with the authenticator AC extracted from the remaining data obtained by the decryption process in step S160 (the authenticator AC generated by the server device 300).

[0089] In step S164, the CPU 4 performs branching processing according to the result of the comparison processing (verification processing) in step S163.

[0090] If the validity of the first software program SWP1 is verified, the CPU 4 judges "Yes" and completes the series of update processes shown in FIGS.

[0091] On the other hand, if the validity of the first software program SWP1 is not confirmed, the CPU 4 judges "No" and performs the corresponding process in step S165.

[0092] In the response process, for example, in order to write the second software program SWP2 before the update into the ECU1 again, the ECU1 performs a process of requesting the connection terminal 200 via the CGWECU 103a to transmit the second software program SWP2.

[0093] Alternatively, a notification process may be executed to notify the user that the update of ECU1 has failed and that an incorrect program may have been written, and to recommend that the user visit a dealer or the like to have the program corrected.

[0094] In this way, the ROM 5 of the ECU 1 to be updated may not have a capacity large enough to store a plurality of software programs SWP, and the RAM 6 may be only a few kBytes or tens of kBytes.

[0095] Specifically, the ROM 5 (second storage area) stores an older version of the second software program SWP2.

[0096] The CPU 4 of the ECU 1 receives the partial data Dp in step S151 of FIG. 8 and stores it in the RAM 6 (first storage area).

[0097] Then, the CPU 4 of the ECU 1 compares the first version information Dver1 obtained by decoding the part of the data Dp on the RAM 6 (first storage area) with the second version information Dver2 for the old version. Furthermore, if the CPU 4 of the ECU 1 determines that the first version information Dver1 is free from errors and is newer than the second version information Dver2, then in step S158, the CPU 4 of the ECU 1 transmits a request to the CGWECU 103a to transmit the remaining data of the encrypted update data Duen.

[0098] Next, the CPU 4 of the ECU 1 executes steps S159, S160, and S161 to delete the second software program SWP2 stored in the ROM 5 (second storage area) and to perform decryption and storage processes on the remaining data received.

[0099] In this way, even in a situation where the storage area of ​​the ECU 1 is not so large, it is possible to overwrite the software program SWP with an appropriate first software program SWP1 while avoiding downgrading or degradation of the software program SWP.

[0100] Also, in this example, RAM 6 is the first storage area and ROM 5 is the second storage area, but it is also possible to provide both a first storage area as a working area for version verification and a second storage area in which the software program SWP is stored on ROM 5.

[0101] That is, the first storage area serving as a working area for version verification and the second storage area in which the software program SWP is stored may be provided in different areas of the same memory, or may be provided on different memories.

[0102] Next, an example of the process executed by the server device 300 is shown in FIG. In step S201, CPU 31 of server device 300 acquires first version information Dver1 of first software program SWP1 to be transmitted and generates verification data Dval.

[0103] In step S202, the CPU 31 of the server device 300 generates an authenticator AC from the first software program SWP1.

[0104] In step S203, the CPU 31 of the server device 300 generates update data Du from the first version information Dver1, the verification data Dval, the first software program SWP1, and the authenticator AC.

[0105] In step S204, the CPU 31 of the server device 300 encrypts the update data Du to generate encrypted update data Duen.

[0106] In step S205, the CPU 31 of the server device 300 transmits the encrypted update data Duen to the connection terminal 200.

[0107] It should be noted that the CPU 31 of the server device 300 may receive the result of the update process from the connection terminal 200 after step S205. This allows the server device 300 to record the update status for each vehicle 100 .

[0108] As described above, when generating the authenticator AC from the encrypted update data Duen, the process of step S202 may be performed after the encryption process of step S204.

[0109] Next, an example of processing executed by CPU 31 of connection terminal 200 is shown in FIG. In step S301, the CPU 31 of the connection terminal 200 performs a vehicle verification process. This process is performed in conjunction with the process of step S101 in Fig. 7, and is a process for verifying whether the vehicle 100 is the vehicle 100 equipped with the ECU 1 to be updated.

[0110] Next, in step S302, the CPU 31 of the connected terminal 200 transitions to an update session. This process is performed in conjunction with the process of step S102 in Fig. 7. This process is, for example, a process for causing the repro tool RT installed in the connected terminal 200 to transition to update mode.

[0111] In step S303, the CPU 31 of the connection terminal 200 transmits partial data Dp of the encrypted update data Duen to the CGWECU 103a of the vehicle 100.

[0112] In step S304, the CPU 31 of the connection terminal 200 determines whether a transmission request has been received. This transmission request is a request sent from the ECU 1 via the CGWECU 103a when the CGWECU 103a determines the version information Dver based on the received partial data Dp and determines that updating is safe, and specifically, is a request sent from the CGWECU 103a in step S108 in FIG.

[0113] If it is determined that a transmission request has been received, the CPU 31 of the connected terminal 200 proceeds to step S305, transmits the remaining untransmitted data in the encrypted update data Duen to the CGWECU 103a, and ends the series of processes shown in FIG.

[0114] On the other hand, if it is determined that a transmission request has not been received, the CPU 31 of the connection terminal 200 determines whether an abort request has been received in the following step S306. This abort request is a request sent when version verification is unsuccessful, and specifically, is a request sent from the CGWECU 103a in step S107 of FIG.

[0115] If it is determined that a stop request has been received, the CPU 31 of the connected terminal 200 ends the series of processes shown in Fig. 10. As a result, only a portion of the encrypted update data Duen, that is, data Dp, is transmitted to the CGWECU 103a.

[0116] If it is determined that a stop request has not been received, CPU 31 of connected terminal 200 returns to the process of step S304 again. That is, the CPU 31 of the connected terminal 200 repeatedly executes the processes of steps S304 and S306, and waits until it receives a request from the CGWECU 103a.

[0117] If a predetermined time has elapsed while repeating the processes of steps S304 and S306, the CPU 31 of the connected terminal 200 may end the series of processes shown in FIG. 10 without receiving any request from the CGWECU 103a.

[0118] Furthermore, CPU 31 of connected terminal 200 may transmit the update result to server device 300 after step S305 or step S306.

[0119] <5. Variations> In the above example, the ECU 1 to be updated executes the processes shown in FIGS. 8 and 9. However, part of the processes shown in FIGS. 8 and 9 may be executed in the CGWECU 103a.

[0120] For example, the CPU 4 of the CGWECU 103a may execute the decoding process of the partial data Dp in step S152, the error detection process in step S153, the determination process in step S154, the new / old comparison process in step S155, the determination process in step S157, and the decoding process of the remaining data in step S160.

[0121] Furthermore, the CPU 4 of the CGWECU 103a may further execute the processes from step S162 to step S165 in place of the ECU 1.

[0122] In the above example, the CGWECU 103a and the connection terminal 200 outside the vehicle are provided separately, but the functions of the connection terminal 200 may be provided in the CGWECU 103a. That is, the repro tool RT may be installed in the CGWECU 103a, and the CGWECU 103a may be able to obtain the update data Du (encrypted update data Due) from the server device 300 via the DCM 104 and the communication network NW.

[0123] <6. Summary> The ECU1 (or CGWECU103a) as the information processing device described above includes one or more processors (CPU4) and a storage medium (ROM5 or RAM6) storing a program executed by the one or more processors, the program including one or more instructions, and the one or more instructions cause the one or more processors to perform the following processing: That is, the one or more instructions cause the CPU 4 to perform a first reception process (step S151) of receiving partial data Dp that includes the first version information Dver1 but does not include the first software program SWP1 out of update data Du that includes the first software program SWP1 and first version information Dver1 that is information stored in an area further forward than the first software program SWP1 and indicates the version of the first software program SWP1, a process of storing the partial data Dp in a first storage area (ROM 5 or RAM 6) (step S151), and a process of storing the partial data Dp in a first storage area (ROM 5 or RAM 6) that stores the first software program SWP1. The control unit 100 executes a process (step S156) of comparing the newness of second version information Dver2, which indicates the version of the second software program SWP2 before the update stored in the second storage area (ROM5) to be used, with the newness of first version information Dver1 included in the partial data Dp, and if it is determined that the first version information Dver1 is newer than the second version information Dver2 (step S157: Yes judgment), it executes a process (step S161) of storing the first software program SWP1 received by the second receiving process (step S159) performed after the first receiving process in the second storage area. As a result, an update process is executed to update the second software program SWP2 to the first software program SWP1 based on the result of comparing the old and new versions of the version information Dver. Therefore, for example, if the first software program SWP1 is an older version than the second software program SWP2, it is possible to stop the update process, and prevent a bug in the older software program SWP from recurring. Furthermore, even if the connection terminal 200 on which the Repro Tool RT is installed is illegally modified, making it possible to illegally rewrite the program of the ECU 1, downgrading or rewriting to an illegal program can be prevented by performing a process on the vehicle 100 side to compare the version information Dver. That is, it is possible to prevent abnormal operation or failure (paperweighting) of the ECU1 (ECU103, CGWECU103a), and further to prevent the trouble and cost of rewriting the program to a normal one. In particular, if the capacity of ROM 5 is small and it is not possible to store both the old and new software programs SWP, the old software programs SWP are deleted when the software programs SWP are rewritten, making it difficult to restore the normal program. Even in such a case, it is preferable that the rewriting of the software program SWP can be stopped depending on the result of the comparison process between the old and new programs.

[0124] In ECU1 (or CGWECU103a) as an information processing device, the update data Du is encrypted data (encrypted update data Duen), the partial data Dp includes verification data Dval used to verify the correctness of the first version information Dver1, and one or more instructions may cause one or more processors (CPU4) to decrypt the partial data Dp (step S152) in response to the first receiving process (step S151), execute a process to determine the correctness of the first version information Dver1 using the decrypted verification data Dval (step S153), and, if there is no error in the first version information Dver1 (step S154: No judgment) and the process of comparing the new and old information (step S156) determines that the first version information Dver1 is newer than the second version information Dver2 (step S157: Yes judgment), execute decryption of the first software program SWP1 (step S160) in response to the second receiving process (step S159). This allows a determination to be made as to whether or not there is an error (tampering) in the version information Dver. Therefore, it is possible to prevent the update process from being performed using an old version of the software program SWP, which in turn makes it possible to appropriately prevent abnormal operation or failure of the ECU1 (ECU103, CGWECU103a).

[0125] In ECU1 (or CGWECU103a) as an information processing device, one or more instructions may cause one or more processors (CPU4) to stop the process of storing the first software program SWP1 in the second storage area (ROM5) (step S155) if it is determined in the process of comparing the new and old versions (step S156) that the first version information Dver1 is older than the second version information Dver2 (step S157: No determination). As a result, the software program SWP stored in the storage area is designated as the newer program. Therefore, downgrading or degradation of the program can be prevented.

[0126] In ECU1 (or CGWECU103a) as an information processing device, one or more instructions may cause one or more processors (CPU4) to send a request to send the remaining data including the first software program SWP1 in the update data Du (step S158) when it is determined in the process of comparing the old and new versions (step S156) that the first version information Dver1 is newer than the second version information Dver2 (step S157: Yes determination). As a result, the storage area provided on the vehicle 100 side only needs to have a capacity large enough to store some extra data Dp when one software program SWP is installed. That is, even if the ECU 1 has a storage unit (ROM 5, RAM 6) configured with a small storage capacity, it is possible to prevent an unauthorized software program SWP from being written and to perform an appropriate update process.

[0127] In ECU1 (or CGWECU103a) as an information processing device, one or more instructions may cause the one or more processors (CPU4) to send a request to stop sending the remaining data including the first software program SWP1 in the update data Du (step S155) when it is determined in the process of comparing the new and old versions (step S156) that the first version information Dver1 is older than the second version information Dver2 (step S157: No determination). This reduces the amount of processing required to send and receive old versions of the software program SWP, which means that unnecessary communication can be reduced.

[0128] The above-described embodiments and modifications can be combined as appropriate. [Explanation of symbols]

[0129] 1 ECU (information processing unit) 4 CPUs (processors) 5 ROM (storage medium, 1st storage area, 2nd storage area) 6 RAM (storage medium, first storage area) 103a CGWECU (Information Processing Equipment) Du update data SWP1 First Software Program SWP2 Second Software Program Dver1 1st version information Dver2 2nd version information Dval validation data Dp Partial Data

Claims

1. one or more processors; A storage medium storing a program executed by the one or more processors, The program includes one or more instructions, The one or more instructions may be for the one or more processors to: a first reception process for receiving a part of update data including a first software program and first version information, the first version information being information stored in an area closer to the beginning of the first software program and indicating a version of the first software program, the part including the first version information and not including the first software program; storing the part of the data in a first storage area; a process of comparing second version information indicating a version of the second software program before the update stored in a second storage area in which the first software program is to be stored with the first version information included in the partial data; and storing, in the second storage area, the first software program received by a second reception process that is performed after the first reception process, when it is determined that the first version information is newer than the second version information. Information processing device.

2. The update data is encrypted data, the partial data includes verification data used to verify the authenticity of the first version information, The one or more instructions may be for the one or more processors to: Executing a decoding of the part of the data in response to the first receiving process; executing a process of determining whether the first version information is correct or not using the decrypted verification data; When the first version information is free of error and the process of comparing the new and old information determines that the first version information is newer than the second version information, the second receiving process is performed to decrypt the first software program. The information processing device according to claim 1 .

3. The one or more instructions may be for the one or more processors to: When it is determined in the process of comparing the new and old information that the first version information is older than the second version information, the process of storing the first software program in the second storage area is stopped. The information processing device according to claim 1 .

4. The one or more instructions may be for the one or more processors to: When it is determined in the process of comparing the new and old versions that the first version information is newer than the second version information, a request to transmit the remaining data including the first software program in the update data is transmitted. The information processing device according to claim 1 .

5. The one or more instructions may be for the one or more processors to: When it is determined in the process of comparing the new and old versions that the first version information is older than the second version information, a request to stop transmission of the remaining data including the first software program in the update data is transmitted. The information processing device according to claim 1 .

Images