Electronic control apparatus and method of starting electronic control apparatus

Abstract

To ensure the integrity of all functions of a control program of an electronic control apparatus mounted on a vehicle, and reduce the startup time of the electronic control apparatus.SOLUTION: An electronic control apparatus mounted on a vehicle to control the operation of the vehicle includes a processor system and a storage unit which stores a control program. The control program includes: a main program section for controlling the operation of the vehicle; and a communication function section for communicating with a device mounted on the vehicle. The processor system verifies the integrity of the communication function section when the electronic control apparatus is started. When the verification of the integrity of the communication function section is successful, the processor system verifies the integrity of the main program section, and starts executing the communication function section before the processing to verify the integrity of the main program section is completed.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to an electronic control unit mounted on a vehicle and a method for starting the electronic control unit. [Background technology]

[0002] Vehicles (including general passenger cars and industrial vehicles such as forklifts) are usually equipped with multiple electronic control units (ECUs). ECUs control the safe and efficient running of the vehicle. For example, a motor ECU controls the driving motor in response to instructions from the driver. In addition, a battery ECU monitors the battery status and controls the charging / discharging of the battery.

[0003] Since modern vehicles are configured to be able to communicate with external networks, the problem of ECU programs being tampered with by malicious attacks has become apparent. For this reason, secure boot processing is often performed on ECUs installed in vehicles. That is, the integrity of the ECU's control program is verified before it is executed. Integrity refers to a normal state in which data has not been tampered with or destroyed. In the following description, an ECU installed in a vehicle may be referred to as an "in-vehicle ECU."

[0004] On the other hand, in many cases, automotive ECUs have strict constraints on their startup time. That is, they are required to complete verification by secure boot processing within a specified startup time. For this reason, techniques have been proposed to shorten the time required for secure boot processing (for example, see Patent Document 1).

[0005] In Patent Document 1, the presence or absence of unintended startup of the vehicle is monitored by counting the number of times the ignition switch is turned on / off, the number of times the driver's door of the vehicle is opened and closed, etc. If unintended startup is not detected, only data of high importance is verified by secure boot processing. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent No. 6639615 Summary of the Invention [Problem to be solved by the invention]

[0007] According to the method described in Patent Document 1, the time required for secure boot processing can be reduced by verifying the integrity of only some of the functions of the control program depending on the situation. However, from the viewpoint of safety, it is preferable that the integrity of all functions of a program related to vehicle control be verified before execution.

[0008] An object of one aspect of the present invention is to ensure the integrity of all functions of a control program of an electronic control unit installed in a vehicle, and to reduce the startup time of the electronic control unit. [Means for solving the problem]

[0009] According to one aspect of the present invention, an electronic control device is mounted on a vehicle and controls the operation of the vehicle. The electronic control device includes a processor system and a storage unit that stores a control program. The control program includes a main program unit for controlling the operation of the vehicle and a communication function unit for communicating with devices mounted on the vehicle. The processor system verifies the integrity of the communication function unit when the electronic control device is started, and if the verification of the integrity of the communication function unit is successful, verifies the integrity of the main program unit and starts execution of the communication function unit before the process of verifying the integrity of the main program unit is completed.

[0010] According to the above configuration, the electronic control unit can start communicating with other devices when the integrity of the communication function unit is successfully verified before the integrity of the entire control program is completed. After this, the main program unit in the control program is verified. Therefore, while verifying the integrity of the entire control program, the period from when the electronic control unit is started until the electronic control unit can start communicating can be shortened.

[0011] In the electronic control device described above, the processor system may include a first processor that executes a control program and a second processor that executes a secure boot process for the control program. The second processor may verify the integrity of the communication function unit when the electronic control device is started, and when the verification of the integrity of the communication function unit is successful, may start verifying the integrity of the main program unit and may issue a startup request to the first processor to instruct the first processor to start the communication function unit before the process of verifying the integrity of the main program unit is completed. [Effects of the Invention]

[0012] According to the above-described aspect, it is possible to shorten the startup time of an electronic control unit mounted on a vehicle while ensuring the integrity of all functions of the control program of the electronic control unit. [Brief explanation of the drawings]

[0013] [Figure 1] 1 is a diagram illustrating an example of a control system of a vehicle according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram illustrating an example of the configuration of an ECU. [Figure 3] 10 is a time chart illustrating an example of a secure boot process in an ECU. [Figure 4] 10 is a flowchart illustrating an example of processing by a secure microcomputer involved in secure boot processing. [Figure 5] 10 is a flowchart showing an example of a process performed by a CPU in relation to a secure boot process. DETAILED DESCRIPTION OF THE INVENTION

[0014] FIG. 1 shows an example of a control system for a vehicle according to an embodiment of the present invention. The control system 1 according to the embodiment of the present invention controls the operation of the vehicle. The vehicle is not particularly limited and may be either a general passenger car or an industrial vehicle such as a forklift. The vehicle may also be an electric vehicle driven by a motor, an engine vehicle, or a hybrid vehicle.

[0015] The control system 1 includes one or more input / output devices 11, one or more sensors 12, multiple electronic control units (ECUs) 13, a gateway device (GW) 14, and a communication terminal 15. The control system 1 may further include other devices not shown in Fig. 1. The input / output devices 11, the sensors 12, the ECUs 13, and the gateway device 14 may be connected to a network such as a controller area network (CAN).

[0016] The input / output device 11 receives instructions from a user (i.e., a driver of the vehicle). The input / output device 11 also includes various actuators (such as a brake actuator and an airbag actuator) mounted on the vehicle. The sensor 12 detects various sensor information. For example, the sensor 12 may be a GPS sensor, a temperature sensor, a speed sensor, a current sensor, a voltage sensor, etc.

[0017] Each ECU 13 controls the operation of the vehicle based on instructions received by the input / output device 11 and sensor information detected by the sensor 12. For example, in an electric vehicle, the ECU 13 may be a motor ECU that controls a motor. In an engine vehicle, the ECU 13 may be an engine ECU that controls the engine. Alternatively, the ECU 13 may be a battery ECU that controls charging / discharging of a battery mounted on the vehicle.

[0018] The gateway device 14 connects an in-vehicle network accommodating the input / output devices 11, the sensors 12, and the ECU 13 with an external network. Therefore, a communication terminal 15 is connected to the gateway device 14. The communication terminal 15 can be connected to a public network via a wireless link.

[0019] 2 shows an example of the configuration of the ECU 13. The ECU 13 includes a memory 21, a CPU 22, a secure microcomputer 23, and a communication circuit 24. Note that the ECU 13 may further include other circuits, devices, or functions not shown in FIG.

[0020] The memory 21 is an example of a storage unit that stores a program executed by the ECU 13. The memory 21 stores a control program. The control program is one of the programs that controls the operation of the vehicle and is composed of a main program unit and a communication function unit. The main program unit contains program code for controlling the operation of the vehicle. The communication function unit contains program code for communicating with devices mounted on the vehicle. The "devices mounted on the vehicle" are not particularly limited, but correspond to the input / output device 11, the sensor 12, other ECUs 13, and the gateway device 14 in the example shown in FIG. 1. The memory 21 can also be used as a work area for the CPU 22.

[0021] The CPU 22 executes programs stored in the memory 21. The CPU 22 can control the operation of the vehicle by executing a control program. At this time, the operation of the vehicle is controlled in accordance with the code written in the main program section. However, the control program controls the operation of the vehicle while communicating with devices mounted on the vehicle. Therefore, when the ECU 13 is started, the communication function section must be started before the main program section is executed. The communication function section sets up communication with devices mounted on the vehicle. For example, the communication function section provides a function for receiving data or information transmitted from the input / output device 11, the sensor 12, other ECUs 13, and / or the gateway device 14.

[0022] The secure microcomputer 23 includes a processor element (not shown) and a memory 23a, and can provide corresponding functions by executing a program. A secure boot program is stored in the memory 23a. The secure microcomputer 23 then executes this secure boot program to implement secure boot processing for the control program stored in the memory 21.

[0023] The secure microcomputer 23 is a microcomputer with advanced security functions built in. In other words, the programs and data stored in the memory 23a of the secure microcomputer 23 are not supposed to be updated or tampered with by external access. In other words, the secure boot program and MAC values ​​(MAC-C, MAC-M) are not supposed to be updated or tampered with by external access. The MAC values ​​will be explained later. The secure microcomputer 23 may also be an HSM (Hardware Security Module).

[0024] The CPU 22 and the secure microcomputer 23 are an example of a processor system included in the ECU 13. In this case, the CPU 22 is an example of a first processor that executes a control program, and the secure microcomputer 23 is an example of a second processor that executes a secure boot process for the control program.

[0025] The communication circuit 24 can communicate with devices installed in the vehicle via a network. Therefore, the communication circuit 24 includes a modulator / demodulator. The communication circuit 24 may also include an encoding circuit / decoding circuit. Data or information received by the communication circuit 24 from other devices is passed to the CPU 22. The CPU 22 can also use the communication circuit 24 to transmit data or information to other devices.

[0026] When the ECU 13 configured as described above is started, the CPU 22 controls the operation of the vehicle by executing a control program stored in the memory 21. However, since the control system 1 including the ECU 13 is connected to an external network as shown in Fig. 1, there is a risk that the program of the ECU 13 may be tampered with by a malicious attack. Therefore, the ECU 13 executes a secure boot process before starting control by the control program.

[0027] The secure boot process is realized by the secure microcomputer 23 executing a secure boot program. At this time, the secure microcomputer 23 verifies the integrity of the control program stored in the memory 21. In other words, it verifies whether the control program has been tampered with.

[0028] FIG. 3 is a time chart showing an example of secure boot processing in the ECU 13. The secure boot processing starts when the ECU 13 is started. When the ECU 13 is started at time T0, the secure microcomputer 23 executes a secure boot program startup process. When the secure boot program startup process ends, the secure microcomputer 23 verifies the integrity of the control program stored in the memory 21. FIG. 3A shows an example of secure boot processing according to a comparative example. In the example shown in FIG. 3A, the secure boot processing for the entire control program ends at time T11. If the control program integrity verification is successful, the secure microcomputer 23 issues a startup request to the CPU 22 to instruct the CPU 22 to start the control program. Then, the CPU 22 starts executing the control program. Specifically, the CPU 22 first executes an initialization process for the control program. Then, the CPU 22 starts a process for controlling the vehicle operation in accordance with the contents of the control program. In the example shown in FIG. 3A, the process for controlling the vehicle operation starts at time T12.

[0029] 3A, when the ECU 13 is started at time T0, the CPU 22 starts the control program at time T11 and can control the operation of the vehicle in accordance with the control program from time T12 onward. That is, the period from time T0 to time T12 corresponds to a "startup waiting time" that represents the period from when the ECU 13 is started until the ECU 13 becomes able to use the control program.

[0030] Generally, an ECU mounted on a vehicle (i.e., an on-board ECU) is required to have a short startup latency. However, the process of verifying the integrity of a program usually requires processing time that corresponds to the size of the program. For example, when verifying the integrity of a program using a hash value, the time required for hash calculation increases as the size of the program increases. Therefore, in cases where the size of the control program is large, it may be difficult to meet the requirement related to the startup latency. Therefore, the ECU 13 according to an embodiment of the present invention employs a secure boot processing method that shortens the startup latency.

[0031] As described above, when the ECU 13 controls the operation of the vehicle in accordance with the control program, first, communication between the ECU 13 and other devices is set up. The required startup waiting time depends on the specifications to be complied with, but in the present invention, it represents the period from when the ECU 13 is started until the ECU 13 is able to communicate with other devices.

[0032] Fig. 3B shows an example of secure boot processing according to an embodiment of the present invention. In the procedure shown in Fig. 3B, the ECU 13 is started at time T0, as in the case shown in Fig. 3A. Then, the secure microcomputer 23 starts a secure boot program to start the secure boot processing.

[0033] As shown in Figure 2, the control program is composed of a communication function section and a main program section. The secure microcomputer 23 then verifies the integrity of both the communication function section and the main program section. At this time, the secure microcomputer 23 first verifies the integrity of the communication function section, and then verifies the integrity of the main program section.

[0034] At time T21, the verification of the integrity of the communication function unit is completed. If the verification of the integrity of the communication function unit is successful, the secure microcomputer 23 issues a startup request to the CPU 22 to instruct the startup of the communication function unit in the control program. Then, the CPU 22 starts executing the communication function unit in the control program. Specifically, the CPU 22 first executes initialization processing of the communication function unit. Thereafter, the CPU 22 starts communication between the ECU 13 and other devices in accordance with the contents of the communication function unit. In the example shown in FIG. 3B, communication between the ECU 13 and other devices starts at time T22.

[0035] While the CPU 22 is executing the communication function section in the control program, the secure microcomputer 23 continues the secure boot process. At this time, the secure microcomputer 23 verifies the integrity of the main program section. That is, the CPU 22 starts executing the communication function section before the secure microcomputer 23 finishes verifying the integrity of the main program section. In other words, the CPU 22 processes the communication function section and the secure microcomputer 23 performs secure boot processing on the main program section in parallel. Then, at time T23, the verification of the integrity of the main program section ends. Here, if the verification of the integrity of the main program section is successful, the secure microcomputer 23 notifies the CPU 22 of the verification result. Then, the CPU 22 starts executing the main program section in the control program. Specifically, the CPU 22 first executes initialization processing of the main program section. Thereafter, the CPU 22 controls the operation of the vehicle in accordance with the contents of the main program section. In the example shown in FIG. 3B, the control of the operation of the vehicle begins at time T24. In this way, when the CPU 22 receives the verification result indicating that the integrity of the main program section has been successfully verified, the CPU 22 starts executing the main program section. Therefore, this notification corresponds to a request to start the main program section.

[0036] 3B, when the integrity of the main program section is successfully verified, the secure microcomputer 23 notifies the CPU 22 of the verification result, but the embodiment of the present invention is not limited to this procedure. For example, when a predetermined procedure by the communication function section is completed, the CPU 22 may confirm the verification result of the main program section with the secure microcomputer 23. Then, when the integrity of the main program section is successfully verified, the CPU 22 may perform an object transition from an operation mode in which the communication function section is executed to an operation mode in which the main program section is executed.

[0037] The integrity of the data (here, the communication function unit and the main program unit) is verified using, for example, a message authentication code (MAC). In this case, a MAC value (MAC-C) for the communication function unit and a MAC value (MAC-M) for the main program unit are calculated in advance and stored in the memory 23a of the secure microcomputer 23, as shown in FIG. 2. The MAC value is obtained, for example, by providing the target data and an encryption key to a predetermined MAC generation function. In this case, the target data is the program code for the communication function unit and the program code for the main program unit. The encryption key is assumed to be prepared in advance.

[0038] When the secure boot process starts, the secure microcomputer 23 first acquires the communication function unit from the memory 21, and calculates a new MAC value by providing the acquired communication function unit and private key to a MAC generation function. If the new MAC value matches MAC-C, the secure microcomputer 23 determines that the communication function unit has not been tampered with, and transmits a startup request to the CPU 22 to instruct the CPU 22 to start up the communication function unit.

[0039] Next, the secure microcomputer 23 obtains the main program portion from the memory 21 and calculates a new MAC value by providing the obtained main program portion and the private key to a MAC generation function. If the new MAC value matches MAC-M, the secure microcomputer 23 determines that the main program portion has not been tampered with and transmits this verification result to the CPU 22.

[0040] In this way, in the ECU 13 according to the embodiment of the present invention, the integrity of each of the communication function section and the main program section constituting the control program is verified, that is, the integrity of the entire control program is verified.

[0041] Furthermore, the ECU 13 can start communication with other devices once the integrity of the communication function unit has been successfully verified. Therefore, even when a secure boot process is performed on the entire control program, the startup wait time can be shortened. For example, as shown in FIG. 3A, in a configuration in which a startup request is given to the CPU 22 after the verification of the entire control program has been completed, the startup wait time is from time T0 to time T12. In contrast, in an embodiment of the present invention, as shown in FIG. 3B, a startup request is given to the CPU 22 once the verification of the communication function unit has been completed, so the startup wait time is from time T0 to time T22, which is shorter than the method shown in FIG. 3A.

[0042] Therefore, according to the embodiment of the present invention, it is possible to shorten the waiting time from when the ECU is started until the ECU is ready for communication, while ensuring the integrity of the entire control program executed by the vehicle-mounted ECU.

[0043] 4 is a flowchart showing an example of the secure boot process performed by the secure microcomputer 23. The process of this flowchart is executed when the ECU 13 is started up.

[0044] In S1, the secure microcomputer 23 executes a startup process for the secure microcomputer 23. This startup process includes initialization of various settings within the secure microcomputer 23.

[0045] In steps S2 and S3, the secure microcomputer 23 obtains the communication function section of the control program from the memory 21 and verifies its integrity. The integrity is verified using, for example, a MAC value. If the verification of the integrity of the communication function section is successful, the secure microcomputer 23 issues a request to start the communication function section to the CPU 22 in step S4. This allows the CPU 22 to start communication between the ECU 13 and other devices.

[0046] In S5 and S6, the secure microcomputer 23 obtains the main program portion of the control program from the memory 21 and verifies its integrity. The integrity of the main program portion is also verified using, for example, a MAC value. If the verification of the integrity of the main program portion is successful, the secure microcomputer 23 notifies the CPU 22 of the verification result in S7. Alternatively, the secure microcomputer 23 issues a request to start the main program portion to the CPU 22. This enables the CPU 22 to control the operation of the vehicle in accordance with the control program.

[0047] If the verification of the communication function section or the main program section fails, the ECU 13 cannot execute the control program. In this case, the secure microcomputer 23 may output an alarm as necessary.

[0048] 5 is a flowchart showing an example of secure boot processing performed by the CPU 22. The processing of this flowchart is also executed when the ECU 13 is started up.

[0049] In S11, the CPU 22 waits for a start-up request for the communication function unit transmitted from the secure microcomputer 23. Then, upon receiving the start-up request for the communication function unit, in S12 the CPU 22 initializes various settings of the communication function unit in the control program and various settings of the communication circuit 24. Next, in S13, the CPU 22 starts communication between the ECU 13 and other devices.

[0050] In S14, the CPU 22 waits for a start request for the main program section transmitted from the secure microcomputer 23. Then, upon receiving the start request for the main program section, the CPU 22 initializes various settings of the main program section in S15. Next, in S16, the CPU 22 starts controlling the operation of the vehicle in accordance with the control program.

[0051] In the above-described embodiment, the integrity of the control programs (communication function unit and main program unit) is verified using a MAC value, but the embodiment of the present invention is not limited to this method. For example, a signature for the control program may be prepared in advance and the signature may be checked when the ECU 13 is started. In this case, a signature is prepared for each of the communication function unit and the main program unit.

[0052] Furthermore, in the above-described embodiment, the control program is composed of a communication function section and a main program section, but the control program may include other functions. In this case, the secure microcomputer 23 first verifies the integrity of the communication function section. If the verification of the integrity of the communication function section is successful, the secure microcomputer 23 issues a request to the CPU 22 to start the communication function section. Thereafter, the secure microcomputer 23 verifies the integrity of the remaining parts of the control program. [Explanation of symbols]

[0053] 1 Control system 11 Input / Output Devices 12 sensors 13 Electronic Control Unit (ECU) 21 Memory 22 CPU 23 Secure Microcontroller 23a Memory 24 Communication Circuit

Claims

1. An electronic control device mounted on a vehicle to control the operation of the vehicle, a processor system; a storage unit for storing a control program; the control program includes a main program section for controlling the operation of the vehicle and a communication function section for communicating with a device mounted in the vehicle; The processor system includes: verifying the integrity of the communication function unit when the electronic control device is started; When the verification of the integrity of the communication function unit is successful, the integrity of the main program unit is verified, and the execution of the communication function unit is started before the process of verifying the integrity of the main program unit is completed. An electronic control device characterized by:

2. The processor system includes: a first processor that executes the control program; a second processor that executes a secure boot process for the control program; The second processor verifying the integrity of the communication function unit when the electronic control device is started; When the integrity of the communication function unit is successfully verified, the integrity of the main program unit is verified, and a start request for instructing the first processor to start the communication function unit is issued before the process of verifying the integrity of the main program unit is completed.

2. The electronic control device according to claim 1.

3. 1. A method for starting an electronic control device mounted on a vehicle to control an operation of the vehicle, comprising: a control program including a main program section for controlling the operation of the vehicle and a communication function section for communicating with devices mounted on the vehicle is stored in the memory of the vehicle; verifying the integrity of the communication function unit when the electronic control device is started; When the verification of the integrity of the communication function unit is successful, the integrity of the main program unit is verified, and the execution of the communication function unit is started before the process of verifying the integrity of the main program unit is completed. A method for starting an electronic control unit.

Images