Vehicle control device and program

Abstract

To provide a vehicle control device and a program for improving security by performing secure boot only in a necessary scene and efficiently operating an ECU by suppressing a processing delay in the ECU repeating wake-up and sleep.SOLUTION: The controller 12 repeats wake-up and sleep of a ECU10 provided in the vehicle according to a condition. When a specific condition is satisfied at the time of waking up the ECU10, the controller 12 executes secure booting of the ECU10.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to a vehicle control device and a program. [Background technology]

[0002] In recent years, there has been a growing risk of ECU (Electronic Control Unit) programs being tampered with through cyber attacks. Cybersecurity regulations (e.g., UN-R155) have also been enacted. Given this background, secure booting is now required, which verifies whether the boot process is legitimate and the integrity of the program before booting the ECU.

[0003] For example, a technology has been disclosed in which, if it is determined that there is a possibility of unauthorized access, a secure boot is performed the next time the ECU is started (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2022-118486 Summary of the Invention [Problem to be solved by the invention]

[0005] However, conventional techniques may not be able to operate the ECU efficiently.

[0006] For example, in the case of an ECU that only starts up when connected to a battery and then repeatedly goes into sleep and wake-up states, secure boot can only be performed once when connected to the battery, which lacks security.

[0007] On the other hand, if secure boot is performed every time the device wakes up, the secure boot takes time, which can cause delays in control processing.

[0008] The present invention has been made in view of the above, and has an object to operate an ECU efficiently. [Means for solving the problem]

[0009] A vehicle control device according to the present invention includes a controller that repeatedly wakes up and puts the vehicle control device equipped in a vehicle into sleep mode according to certain conditions. When the controller wakes up the vehicle control device, if certain conditions are met, the controller executes a secure boot of the vehicle control device. [Effects of the Invention]

[0010] According to the present invention, especially for ECUs that repeatedly go into a wake-up and sleep state, by performing secure boot only when necessary, it is possible to improve security and suppress processing delays, thereby enabling the ECU to operate efficiently. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a time chart showing the operation of the ECU of the first reference example. [Figure 2] FIG. 2 is a time chart showing the operation of the ECU of the second reference example. [Figure 3] FIG. 3 is a diagram illustrating an example of the configuration of an ECU according to the embodiment. [Figure 4] FIG. 4 is a functional block diagram of the controller. [Figure 5] FIG. 5 is a flowchart showing a processing procedure of the ECU according to the embodiment. [Figure 6] FIG. 6 is a flowchart showing a processing procedure of the ECU according to the embodiment. [Figure 7] FIG. 7 is a flowchart showing a processing procedure of the ECU according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of a vehicle control device and a program disclosed herein will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the embodiments described below. Note that the ECU in the embodiments is an example of a vehicle control device. The ECU may also be a microcomputer.

[0013] Here, the ECU state can be on, off, or sleep. Off means that no power is being supplied to the ECU. On means that the ECU is executing a program or can execute a program quickly. Sleep means that the ECU has stopped executing a program and is reducing power consumption.

[0014] The transition of an ECU's state to on is called startup or booting. In particular, the transition of an ECU's state from sleep to on is called wakeup. Sleep can also mean the transition of an ECU's state from on to sleep.

[0015] The process of booting after verifying the integrity of the program for boot-related processing (for example, whether it is authentic) is called secure boot.

[0016] The ECU installed in a vehicle transitions from off to on after the battery is installed and powered on. Also, when the vehicle's ignition is turned off, the ECU transitions from on to sleep. Also, when the vehicle's ignition is turned on, the ECU transitions from sleep to on. Also, after the ECU transitions from on or sleep to off, the battery is removed.

[0017] 1, the operation of an ECU in a case where secure boot is performed only when connected to a battery will be described as Reference Example 1. FIG. 1 is a time chart showing the operation of the ECU in Reference Example 1.

[0018] As shown in Figure 1, the ECU performs secure boot at times T11 and T17 when the battery is attached. On the other hand, the ECU does not perform secure boot from times T12 to T16 when IG is turned on and off repeatedly.

[0019] In this case, the security is reduced because it is not possible to respond to program tampering that occurs between times T12 and T16.

[0020] 2, the operation of the ECU when a secure boot is performed at each wake-up will be described as Reference Example 2. FIG. 2 is a time chart showing the operation of the ECU in Reference Example 2.

[0021] As shown in FIG. 2, the ECU performs a secure boot when the IG is turned on, that is, at times T23 and T25 when the ECU receives a wake-up signal.

[0022] In this case, secure booting frequently causes processing delays. In particular, delays in vehicle body control can significantly reduce convenience.

[0023] For example, consider a case where a door is opened with the ignition off. Also, assume that the courtesy lamp is turned on when the vehicle door is opened. In this case, if the ECU is securely booted in response to the operation, it will take longer for the courtesy lamp to light up due to processing delays compared to when the secure boot is not performed, which reduces user convenience.

[0024] In this embodiment, secure boot is not performed at every wake-up as in Reference Example 2 in Fig. 2, but is performed only when specific conditions are met at the time of wake-up. This reduces the frequency of processing delays associated with secure boot compared to Reference Example 2. Furthermore, in this embodiment, security can be improved compared to Reference Example 1 because secure boot is performed at wake-up.

[0025] In this way, the present embodiment can improve the security of an ECU that repeatedly wakes up and goes to sleep, and can also prevent processing delays. That is, the present embodiment allows the ECU to operate efficiently.

[0026] The configuration of an ECU according to an embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the configuration of an ECU according to an embodiment. As shown in Fig. 3, an ECU 10 includes an interface 11, a controller 12, a memory 13, a secure processor 14, a secure memory 15, and a flash controller 16.

[0027] The ECU 10 is also connected to each system provided in the vehicle. The ECU 10 is also connected to a body system 20 and a charging system 30. The body system 20 includes the vehicle's doors, sliding doors, locking mechanisms, lamps, etc. The charging system 30 is connected to a battery 40 and supplies power to the ECU 10. The body system 20 and the charging system 30 also include sensors, actuators, ECUs, etc. The ECU 10 may also be connected to other ECUs, etc. (not shown).

[0028] The ECU 10 controls the body system 20. For example, the ECU 10 controls unlocking of vehicle doors, starting of sliding doors, lighting of lamps, etc. The ECU 10 also receives input of signals from the body system 20.

[0029] The interface 11 inputs and outputs data between the ECU 10 and other devices. For example, the interface 11 is a port compatible with USB (Universal Serial Bus), Ethernet (registered trademark), CAN (Controller Area Network), etc. The interface 11 also receives a supply of power via the charging system 30.

[0030] The controller 12 reads and executes a program stored in the memory 13. The controller 12 is a central processing unit (CPU), a digital signal processor (DSP), a field programmable gate array (FPGA), a graphics processing unit (GPU), a system on a chip (SoC), or the like.

[0031] The controller 12 may be a single processor, a multiprocessor configuration, or a multicore configuration having multiple cores in a single chip connected via a single socket.

[0032] The controller 12 executes a program to realize each processing unit shown in Fig. 4. Fig. 4 is a functional block diagram of the controller.

[0033] As shown in FIG. 4, the controller 12 includes a start control unit 121, a determination unit 122, and an update unit 123.

[0034] The start-up control unit 121 controls the start-up of the ECU 10. The start-up control unit 121 performs either a secure boot or a normal boot. A secure boot is a boot that is performed after verifying the integrity of a program. A normal boot is a boot that is performed without verifying the integrity of a program.

[0035] The activation control unit 121 repeatedly wakes up and puts the ECU 10 provided in the vehicle into sleep mode according to certain conditions. If certain conditions are met when waking up the ECU 10, the activation control unit 121 executes a secure boot of the ECU 10. The certain conditions will be described in detail later.

[0036] The determining unit 122 determines whether the start control unit 121 will perform a secure boot or a normal boot.

[0037] The update unit 123 updates data such as flags and counters used in the processing of the determination unit 122. The data such as flags and counters is stored in the memory 13.

[0038] The memory 13 is a storage medium such as an eMMC (embedded multi media card), etc. The memory 13 functions as a ROM (read only memory) or a RAM (random access memory).

[0039] The secure processor 14 and the secure memory 15 are a processor and a memory for performing a secure boot. The secure processor 14 and the secure memory 15 are located in a more secure area than the controller 12 and the memory 13.

[0040] Program data is stored in memory 13. Program data to be verified in security boot is expanded from memory 13 to secure memory 15. Then, secure processor 14 verifies the integrity of the program data expanded in secure memory 15.

[0041] For example, a value is assigned to the program data in advance as an authenticator. The secure processor 14 calculates a specific value (e.g., a sum value) based on the program data. If the value calculated by the secure processor 14 matches the authenticator assigned to the program data, the program is deemed to have integrity.

[0042] In the secure boot, if the program has integrity, the ECU 10 continues the boot. On the other hand, in the secure boot, if the program does not have integrity, the ECU 10 stops the boot.

[0043] The flash controller 16 performs reprogramming of the ECU 10 in response to an operation from an external device. That is, the flash controller 16 rewrites the program data stored in the memory 13. For example, the flash controller 16 performs reprogramming in response to an operation from a computer installed in a vehicle repair shop.

[0044] Here, each functional unit of the controller 12 will be described in detail. The determination unit 122 determines whether a predetermined condition is met. If the determination unit 122 determines that the condition is met, the boot control unit 121 performs secure boot. For example, the condition is determined depending on the security risk. Hereinafter, several embodiments with different conditions will be described using flowcharts. Note that the subject of processing by the boot control unit 121, determination unit 122, and update unit 123 described below may be rephrased as the controller 12.

[0045] Example 1 As shown in Fig. 5, the start-up control unit 121 can perform a secure boot during charging or the first wake-up after charging. Fig. 5 is a flowchart showing the processing procedure of the ECU according to the embodiment.

[0046] 5, the activation control unit 121 wakes up the ECU 10 (step S11). For example, the activation control unit 121 wakes up the ECU 10 when the IG of the vehicle is turned on. Next, the determination unit 122 determines whether or not the vehicle is being charged (step S12).

[0047] For example, when the ECU 10 receives a wake-up request from the charging system 30 via the CAN, the determination unit 122 determines that charging is in progress. The determination unit 122 may also determine that charging is in progress when an inlet connection signal is received. The inlet connection signal is a signal indicating that the battery 40 is connected to a charging facility. The determination unit 122 may make the determination based on an outlet connection signal indicating that the battery is connected to a household power source, instead of the inlet connection signal.

[0048] If the determination unit 122 determines that charging is in progress (Yes in step S12), the update unit 123 updates the charging execution flag to ON (step S13). Then, the startup control unit 121 performs secure boot (step S14).

[0049] On the other hand, if the determination unit 122 does not determine that charging is in progress (step S12, No), it determines whether the charging execution flag is on (step S15). If the charging execution flag is on (step S15, Yes), the update unit 123 updates the charging execution flag to off (step S16). Then, the startup control unit 121 performs secure boot (step S14).

[0050] If the charging execution flag is not on (No in step S15), the startup control unit 121 does not perform secure boot. That is, the startup control unit 121 performs normal boot.

[0051] In this way, when the ECU 10 is woken up due to a device external to the vehicle connected to the ECU 10, the start-up control unit 121 executes a secure boot of the ECU 10. In the first embodiment, the charging facility corresponds to the external device.

[0052] In addition, after waking up the ECU 10 due to a charging facility external to the vehicle being connected to the ECU 10, the startup control unit 121 performs a secure boot of the ECU 10 when waking up the ECU 10 next time (when the charging execution flag is on).

[0053] Example 2 6, the start-up control unit 121 can perform a secure boot every time a wake-up is performed a predetermined number of times. FIG. 6 is a flowchart showing the processing procedure of the ECU according to the embodiment.

[0054] 6, the activation control unit 121 wakes up the ECU 10 (step S21). For example, when the IG of the vehicle is turned on, the activation control unit 121 wakes up the ECU 10. Next, the update unit 123 increments the wake-up counter by 1 (step S22).

[0055] Next, the determination unit 122 determines whether the wake-up counter exceeds N (step S23), where N is a predetermined integer of 2 or greater.

[0056] If the wake-up counter exceeds N (step S23, Yes), the update unit 123 updates the wake-up counter to 0 (step S24). Then, the activation control unit 121 performs a secure boot (step S25).

[0057] On the other hand, if the wake-up counter does not exceed N (No in step S23), the boot control unit 121 does not perform a secure boot. That is, the boot control unit 121 performs a normal boot.

[0058] In this way, the start-up control unit 121 executes secure boot of the ECU 10 every time the ECU 10 is woken up a specified number of times (for example, N times).

[0059] Example 3 Reprogramming may be performed on the ECU 10 using the flash controller 16. As shown in FIG. 7, the startup control unit 121 can perform a secure boot when the ECU 10 wakes up for the first time after reprogramming has been performed. FIG. 7 is a flowchart showing the processing procedure of the ECU according to the embodiment. When reprogramming of the ECU 10 has been performed, the flash controller 16 updates the reprogramming execution flag to ON. The reprogramming execution flag is stored by the flash controller 16. However, the reprogramming execution flag may also be stored by the memory 13.

[0060] 7, the activation control unit 121 wakes up the ECU 10 (step S31). For example, the activation control unit 121 wakes up the ECU 10 when the IG of the vehicle is turned on. Furthermore, the activation control unit 121 periodically wakes up the ECU 10 when the ECU 10 is in a sleep state.

[0061] Next, the determination unit 122 determines whether the reproductive execution flag is on or not (step S32). If the reproductive execution flag is on (step S32, Yes), the update unit 123 updates the reproductive execution flag to off (step S33). Then, the boot control unit 121 performs secure boot (step S34). In this way, the determination unit 122 checks whether there is a history of reproductive execution using the reproductive execution flag.

[0062] On the other hand, if the repro execution flag is not on (step S32, No), the boot control unit 121 does not execute the secure boot. That is, the boot control unit 121 executes the normal boot.

[0063] In this way, the start-up control unit 121 performs a secure boot of the ECU 10 when waking up the ECU 10 for the first time after an external device is connected to the ECU 10 and the ECU 10 is reprogrammed by the external device.

[0064] An external device performs reprogramming via the flash controller 16. After executing reprogramming of the ECU 10, the flash controller 16 stores the execution history of the reprogramming. If the execution history is stored in the flash controller 16, the controller 12 executes a secure boot of the ECU 10. The execution history is represented by a reprogramming execution flag.

[0065] Example 4 The start-up control unit 121 can perform a secure boot when a start-up request is made to the ECU 10 via an external device. For example, when a start-up request for the ECU 10 is made by wireless communication from a smart key with a wireless communication function or a smartphone, the start-up control unit 121 performs a secure boot. Furthermore, the start-up control unit 121 may perform a secure boot when the IG of the vehicle is turned on by wireless communication.

[0066] In this way, the start-up control unit 121 executes a secure boot of the ECU 10 when waking up the ECU 10 in response to a request from an external device.

[0067] (Effects of the embodiment) As described above, the controller 12 repeatedly wakes up and puts the ECU 10 provided in the vehicle into sleep mode according to certain conditions. If a specific condition is met when the controller 12 wakes up the ECU 10, the controller 12 executes a secure boot of the ECU 10.

[0068] As described above, the controller 12 of the present embodiment performs secure boot not only once when the battery 40 is attached, but also when a specific condition is met, thereby improving the security of the ECU 10. Furthermore, the controller 12 does not perform secure boot every time the ECU 10 wakes up, thereby reducing processing delays. As a result, the controller 12 can operate the ECU 10 efficiently in terms of security and processing speed.

[0069] When the controller 12 wakes up the ECU 10 due to a device external to the vehicle connected to the ECU 10, the controller 12 executes a secure boot of the ECU 10. When the controller 12 wakes up the ECU 10 in response to a charging device external to the vehicle being connected to the ECU 10, the controller 12 executes a secure boot of the ECU 10. When the controller 12 wakes up the ECU 10 again after waking up the ECU 10 due to a charging device external to the vehicle being connected to the ECU 10, the controller 12 executes a secure boot of the ECU 10.

[0070] The program of the ECU 10 may be tampered with when the ECU 10 is connected to an external device of the vehicle. For example, when the vehicle is connected to an external inlet or outlet, the program of the ECU 10 may be tampered with. The controller 12 of this embodiment can prevent normal booting from being performed in a tampered state when the ECU 10 is connected to an external device for charging or the like.

[0071] When the controller 12 wakes up the ECU 10 for the first time after a device is connected to the ECU 10 and the device has reprogrammed the ECU 10, the controller 12 executes a secure boot of the ECU 10. After executing reprogramming of the ECU 10, the flash controller 16 stores the execution history of the reprogramming. When the execution history is stored in the flash controller 16, the controller 12 executes a secure boot of the ECU 10.

[0072] This allows the controller 12 to prevent normal booting from being performed in a state where the program of the ECU 10 has been tampered with at the time of reprogramming.

[0073] When the controller 12 wakes up the ECU 10 in response to a request from an external device, the controller 12 executes a secure boot of the ECU 10.

[0074] This allows the controller 12 to prevent normal booting from being performed in a state where the program of the ECU 10 has been tampered with via an external device (such as a smartphone or a smart key).

[0075] The controller 12 executes a secure boot of the ECU 10 every time the controller 12 wakes up the ECU 10 a specified number of times.

[0076] This allows the controller 12 to ensure security by periodically performing secure boot while reducing the frequency of processing delays.

[0077] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. [Explanation of symbols]

[0078] 10 ECU 11 Interface 12 Controllers 13. Memory 14 Secure Processor 15 Secure Memory 16 Flash Controller 20 Body 30 Charging system 40 Battery 121 Start control unit 122 Judgment section 123 Update Department

Claims

1. a controller that repeatedly wakes up and puts a vehicle control device provided in the vehicle into sleep mode according to conditions; The controller executes a secure boot of the vehicle control device if a specific condition is met when the vehicle control device is woken up. Vehicle control device.

2. The controller When the vehicle control device is woken up due to a device external to the vehicle connected to the vehicle control device, the vehicle control device is securely booted. The vehicle control device according to claim 1 .

3. The controller When the vehicle control device is woken up in response to a connection between a charging facility external to the vehicle and the vehicle control device, a secure boot of the vehicle control device is executed. The vehicle control device according to claim 2.

4. The controller After waking up the vehicle control device due to connection of a charging facility external to the vehicle with the vehicle control device, when waking up the vehicle control device next time, a secure boot of the vehicle control device is executed. The vehicle control device according to claim 2.

5. The controller When the device is connected to the vehicle control device and the device reprograms the vehicle control device, the device performs a secure boot of the vehicle control device when the device wakes up the vehicle control device for the first time. The vehicle control device according to claim 2.

6. Further, a reprogramming control device is provided which stores a history of the reprogramming after the reprogramming of the vehicle control device is performed, The controller If the execution history is stored in the repro control device, the secure boot of the vehicle control device is executed. The vehicle control device according to claim 5.

7. The controller When the vehicle control device is woken up in response to a request from the device, a secure boot of the vehicle control device is executed. The vehicle control device according to claim 2.

8. The controller Execute a secure boot of the vehicle control device every time the vehicle control device is woken up a specified number of times. The vehicle control device according to claim 1 .

9. A controller that repeatedly wakes up and puts a vehicle control device installed in a vehicle into sleep mode depending on conditions. If a specific condition is met when the vehicle control device is woken up, the vehicle control device is caused to execute a secure boot. A program that executes a process.

Images