Information processing device, in-vehicle system, information processing method, and computer program

Abstract

To shorten a starting time while ensuring security.SOLUTION: An information processing apparatus comprising: a switch device that relays a plurality of processing devices; and an external device that is externally attached to the switch device, wherein the switch device includes a first non-volatile memory that stores a first program, and a first control unit that sets a register based on the first program when the switch device is activated, and the external device includes a second non-volatile memory that stores a second program, A second control unit configured to control the switch device based on the setting of the register and the second program after executing the verification process of the second program.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device, an in-vehicle system, an information processing method, and a computer program. [Background technology]

[0002] In-vehicle networks in which multiple ECUs (Electronic Control Units) are connected are known. Patent Document 1 discloses a technology in which, in a network configured with multiple ECUs including a central ECU equipped with a control unit and an Ethernet switch, when changing network settings in association with software downloads, the control unit and the Ethernet switch each perform a verification process for setting information.

[0003] Furthermore, a technology known as "secure boot" performs a program verification process (also called authentication process) when a device is started up in order to detect software tampering due to unauthorized access. However, when secure boot technology is applied to a multi-core system including multiple central processing units (CPUs), the secure boot process must be performed for each of these CPUs, which poses a problem of prolonged startup time.

[0004] To address this issue, Patent Document 2 describes an information processing device equipped with multiple CPUs, in which only a specific CPU executes authentication processing (secure boot) for the programs of the other CPUs, and the other CPUs execute startup processing in parallel with the authentication processing. In this way, the technology of Patent Document 2 achieves a reduction in startup time while ensuring security by performing authentication of the specific CPU and startup of the other CPUs in parallel. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2023-109114 [Patent Document 2] Japanese Patent Application Laid-Open No. 2015-171008 Summary of the Invention [Problem to be solved by the invention]

[0006] In the technology of Patent Document 2, for example, if the number of CPUs included in an information processing device increases or the amount of programs to be authenticated (for example, the number of lines of source code) increases, the time required for authentication processing in a specific CPU increases, and other CPUs enter a "waiting state" after startup processing. In other words, startup time is limited by the time required for authentication processing, making it difficult to further reduce startup time.

[0007] In view of the above problem, an object of the present disclosure is to provide an information processing device, an in-vehicle system, an information processing method, and a computer program that can further shorten the startup time while ensuring security. [Means for solving the problem]

[0008] An information processing device according to one example of the present disclosure is an information processing device comprising: a switch device that relays multiple processing devices; and an external device that is externally attached to the switch device; the switch device includes a first non-volatile memory that stores a first program; and a first control unit that sets a register based on the first program when the switch device is started; and the external device includes a second non-volatile memory that stores a second program; and a second control unit that, when started, executes a verification process for the second program and then controls the switch device based on the register setting and the second program. [Effects of the Invention]

[0009] According to the present disclosure, it is possible to further shorten the startup time while ensuring security. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of an in-vehicle system according to an embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of register settings according to the embodiment. [Figure 3] FIG. 3 is a diagram illustrating an example of register settings according to the embodiment. [Figure 4] FIG. 4 is a sequence diagram illustrating an example of an information processing method according to the embodiment. [Figure 5] FIG. 5 is a diagram showing a first nonvolatile memory according to a modified example. DETAILED DESCRIPTION OF THE INVENTION

[0011] [Description of the embodiments of the present disclosure] The gist of the present disclosure includes the following configurations.

[0012] (1) An information processing device according to an example of the present disclosure includes a switch device that relays multiple processing devices and an external device that is externally attached to the switch device, wherein the switch device includes a first non-volatile memory that stores a first program and a first control unit that sets a register based on the first program when the switch device is started up, and the external device includes a second non-volatile memory that stores a second program and a second control unit that, when the switch device is started up, executes a verification process for the second program and then controls the switch device based on the register settings and the second program.

[0013] In the present disclosure, the setting process and verification process are shared between the switch device and the external device, and the verification process is omitted for the switch device, thereby shortening the startup time. Furthermore, after the setting process, security is ensured by controlling the switch device based on the verified second program. As a result, the startup time of the information processing device can be further shortened while ensuring security.

[0014] (2) In the information processing device of (1) above, the first control unit may set the register without waiting for the start and end of the verification process.

[0015] By configuring it in this manner, the switch device can perform the register setting process while the external device is performing the verification process, thereby shortening the startup time of the information processing device compared to, for example, a case in which the switch device performs the register setting process after the verification process of the first program.

[0016] (3) In the information processing device of (1) or (2) above, the first control unit may provide a judgment value regarding the setting of the register to the second control unit, and if the second control unit judges based on the judgment value that the setting of the register is incorrect, it may reset the register based on the second program.

[0017] With this configuration, if the register settings are determined to be valid, the information processing device will start relay processing as is, thereby shortening the startup time, while if the register settings are determined to be incorrect, the register will be reset using the second program whose validity has been confirmed, thereby completing the startup process even if there is an abnormality in the first program. This makes it possible to shorten the startup time while ensuring security.

[0018] (4) In the information processing device of (3) above, the judgment value may be a value of the register, and the second control unit may determine that the setting of the register is incorrect if the value stored in the second program does not match the value of the register.

[0019] For example, if the first program is tampered with and a setting value included in the first program is rewritten with a different value, the register value included in the judgment value will not match the value stored in the second program (register setting value). Even if the register setting value itself in the first program is not tampered with, if the program related to the setting process is tampered with, the setting value may not be correctly reflected in the register, and the register value included in the judgment value may not match the value stored in the second program. In such a case, the second control unit can detect tampering of the first program by determining that the register setting is incorrect. This ensures security.

[0020] (5) In the information processing device of (3) above, the judgment value may be a hash value calculated based on the value of the register, and the second control unit may determine that the setting of the register is incorrect if the value stored in the second program does not match the hash value.

[0021] Since the judgment value is a hash value (that is, a summary value of the register values), the amount of processing required for judgment is reduced, and startup time can be shortened.

[0022] (6) In the information processing device of (3) above, the judgment value is a hash value that is stored in advance in the first program before the register is set and is calculated based on a predicted value predicted as the value of the register, and the second control unit may determine that the setting of the register is incorrect if the value stored in the second program does not match the hash value.

[0023] Since the determination value is stored in the first nonvolatile memory before the setting process, calculation processing after the register setting process is not required, and the startup time can be further shortened.

[0024] (7) In the information processing device of (3) above, the first control unit may provide the second control unit with the judgment value indicating that the setting of the register is incorrect when the value stored in the first program does not match the value of the register.

[0025] This configuration reduces the processing load on the second control unit. Also, since the calculation process of the judgment value in the first control unit can be executed in parallel with the verification process after the register setting process, even if the verification process takes a long time, the time that the switch device is in a "waiting" state can be reduced, and the startup time can be shortened.

[0026] (8) In the information processing device of (3) to (7) above, the switch device may include a setting pin that sets the switch device to a first mode upon input of a first signal and sets the switch device to a second mode upon input of a second signal different from the first signal, the first mode being a mode in which the first control unit sets the register based on the first program, and the second mode being a mode in which the second control unit sets the register based on the second program, the external device may include a signal pin connected to the setting pin, and the second control unit may output the first signal from the signal pin at the time of startup and, if it is determined that the register setting is incorrect, output the second signal from the signal pin.

[0027] With this configuration, the activation mode of the switch device 20 can be easily switched from the first mode M1 to the second mode M2 ​​based on an input signal to the setting pin.

[0028] (9) An in-vehicle system according to an example of the present disclosure is an in-vehicle system including the information processing device (1) to (8) mounted on a vehicle and the plurality of processing devices mounted on the vehicle. Therefore, the in-vehicle system of the present disclosure has the same effects as the information processing device (1) to (8).

[0029] (10) An information processing method according to an example of the present disclosure is an information processing method performed by the information processing devices described above in (1) to (8). Therefore, the information processing method according to the present disclosure has the same effects as the information processing devices described above in (1) to (8).

[0030] (11) A computer program according to an example of the present disclosure is a computer program for causing a computer to function as the information processing device described above in (1) to (8). Therefore, the computer program according to the present disclosure has the same effects as the information processing device described above in (1) to (8).

[0031] [Details of the embodiments of the present disclosure] Hereinafter, details of embodiments of the present disclosure will be described with reference to the drawings.

[0032] [Configuration of in-vehicle system 1] FIG. 1 is a diagram showing an example of the configuration of an in-vehicle system 1 according to an embodiment. The in-vehicle system 1 is a system mounted on a vehicle V1 such as an automobile. The in-vehicle system 1 includes an information processing device 10 and a plurality of processing devices 40.

[0033] The processing device 40 is, for example, an ECU (Electronic Control Unit). The number of processing devices 40 included in the in-vehicle system 1 is not particularly limited as long as it is two or more. The processing device 40 is, for example, a device (operation system ECU) that controls each part of the vehicle V1 (e.g., braking system, doors, battery, air conditioner, etc.). The function of the processing device 40 is not particularly limited, and the processing device 40 may be a device (cognition system ECU) that communicates with sensors and monitors the state of each part of the vehicle V1. The multiple processing devices 40 may each have different functions or each have the same functions.

[0034] The information processing device 10 functions as a relay device (also referred to as a gateway) that relays data transmitted and received among the plurality of processing devices 40. For example, the information processing device 10 is an integrated ECU (also referred to as a central ECU) that manages the plurality of processing devices 40. In this case, the information processing device 10 may distribute update data provided from outside the vehicle V1 to the plurality of processing devices 40.

[0035] The information processing device 10 is connected to a plurality of processing devices 40 via a transmission line L3. That is, the in-vehicle system 1 configures an in-vehicle network that connects the information processing device 10 and the plurality of processing devices 40 via the transmission line L3. The transmission line L3 is a communication line that complies with the Ethernet (registered trademark) communication protocol. Note that the transmission line L3 may be a communication line that complies with another communication protocol, such as CAN (Controller Area Network) or FlexRay (registered trademark).

[0036] [Internal configuration of information processing device 10] The information processing device 10 includes a switch device 20 and an external device 30. The switch device 20 is connected to the external device 30 via transmission lines L1 and L2.

[0037] The switch device 20 relays data between multiple processing devices 40. More specifically, the switch device 20 transfers data to the destination processing device 40 based on a destination address included in the data (packet) transmitted from the processing device 40. The switch device 20 is also called an "Ethernet switch" or a "switching hub." The external device 30 is an external calculation support device that assists the information processing in the switch device 20. The external device 30 is also called an "external microcomputer."

[0038] In the present disclosure, when starting up the information processing device 10, the switching device 20 and the external device 30 share various processes at the time of startup in order to shorten the startup time while ensuring security.

[0039] Specifically, the switch device 20 executes setting processes such as setting the register 24 described below, while in parallel with this, the external device 30 executes verification processes (secure boot) of the program stored therein. After the external device 30 has executed its own verification process, it determines whether the setting of the register 24 in the switch device 20 is correct, and if it is correct, it completes the startup of the information processing device 10. If it determines that the setting of the register 24 is incorrect, it resets the register 24 based on the program of the external device 30 that has been verified.

[0040] For example, when the setting process is executed after the verification process of the switch device 20 in the switch device 20, the processing time required to start the information processing device 10 is the sum of the verification process time and the setting process time. Similarly, when the setting process of the register 24 is executed in the switch device 20 after the verification process of the switch device 20 is executed in the external device 30, the processing time required is the sum of the verification process time and the setting process time.

[0041] In contrast, in the present disclosure, the setting process and verification process are shared between the switch device 20 and the external device 30, and the verification process is omitted for the switch device 20, thereby shortening the startup time. Here, since the verification process is not executed for the switch device 20, the startup time can be shortened, but it is unclear whether the security of the switch device 20 is ensured as it is. Therefore, the external device 30 determines whether the settings in the register 24 are correct after the verification process, thereby ensuring the security of the switch device 20.

[0042] The configuration of each part of the information processing device 10 will be described in more detail below.

[0043] [Regarding the switch device 20] The switch device 20 includes a switch integrated circuit (IC) 21, a first nonvolatile memory 22, a plurality of communication interfaces 26, 26, and a plurality of input / output interfaces 27, 28. These components are electrically connected to each other via a bus B1.

[0044] The switch IC 21 includes a first control unit 23, a register 24, and a first volatile memory 25. The first control unit 23 includes a circuit configuration such as a processor. The first control unit 23 reads out a first program P1 stored in the first non-volatile memory 22 and executes various calculations and controls described below.

[0045] Specifically, the first control unit 23 is one or more CPUs (Central Processing Units). Since the first control unit 23 is provided inside the switch IC 21, it is also referred to as an "internal CPU" to distinguish it from the external device 30. Note that the processor included in the first control unit 23 may be a GPU (Graphics Processing Unit).

[0046] The first control unit 23 shares various processes with the second control unit 31, which will be described later. Specifically, the first control unit 23 mainly executes the setting process of the register 24, while the second control unit 31 executes the program verification process and the resetting process of the register 24 when a problem occurs in the setting process of the register 24 by the first control unit 23. Because the first control unit 23 has a smaller processing load than the second control unit 31, a CPU that is less expensive and has lower performance than the second control unit 31 may be used. Lower performance means, for example, a smaller number of threads, a smaller cache memory capacity, or a lower clock frequency. This allows the manufacturing cost (material cost) of the information processing device 10 to be reduced.

[0047] The register 24 is a temporary storage device that holds instructions or settings related to the operation of the switch IC 21. The register 24 is a volatile memory that returns to its initial state (default) when power supply to the switch device 20 is stopped. Therefore, every time the switch device 20 is powered on, the first control unit 23 or the second control unit 31 described below writes settings to the register 24, and the switch IC 21 operates based on the settings.

[0048] 2 and 3 are diagrams each showing an example of the setting of the register 24. In the register 24, for example, the port setting or the MAC (Media Access Control) address setting of the switch device 20 is written.

[0049] 2 shows an example of the contents written to the register 24 when the register 24 is used to set the ports of the switch device 20. The communication standard and mode type for each port are written in each row of the register 24. In the example of FIG. 2, the communication standard for ports 1 and 2 is 100BASE-T1, and the ports are set to the master mode. Also, the communication standard for port 3 is 1000BASE-T1, and the port is set to the slave mode.

[0050] 3 illustrates an example of the contents written to the register 24 when the register 24 sets a combination of MAC addresses of multiple processing devices 40 connected to the switch device 20. In each row of the register 24, a MAC address and a VLAN (Virtual Local Area Network) ID for each port are written.

[0051] 1, the first volatile memory 25 includes, for example, a RAM (Random Access Memory). The first control unit 23 reads various data from the first nonvolatile memory 22 and temporarily stores the data and calculation results of the data in the first volatile memory 25, while executing various calculations and controls described below.

[0052] The first nonvolatile memory 22 is a memory that can retain data even when the switch device 20 is powered off. The first nonvolatile memory 22 is a flash memory, specifically an SPI (Serial Peripheral Interface) flash memory. The first nonvolatile memory 22 stores a first program P1 and a hash value H1. The first program P1 includes a computer program for setting the register 24 and a setting value SV1 of the register 24.

[0053] The communication interface 26 is connected to the processing device 40 via a transmission line L3. The communication interface 26 converts various signals in accordance with Ethernet. For example, the communication interface 26 converts an electrical signal output from the switch device 20 into a communication signal and transmits it to the transmission line L3. The communication interface 26 also converts a communication signal input from the transmission line L3 into an electrical signal and inputs it into the switch device 20.

[0054] The input / output interface 27 is connected to the external device 30 via a transmission line L1. The input / output interface 27 is, for example, an MII (Media Independent Interface). The input / output interface 27 connects the switch device 20 and the external device 30 in accordance with Ethernet. The transmission line L1 is a communication line in accordance with Ethernet.

[0055] The input / output interface 28 is connected to an external device 30 via a transmission line L2. The input / output interface 28 is a setting pin for setting the startup method of the switch device 20, and is also called a "configuration pin" or a "bootstrap pin."

[0056] The transmission line L2 is a signal line that transmits two-level signals, High and Low. For example, when a Low-level signal (hereinafter referred to as a "first signal") is input from the transmission line L2 to the input / output interface 28, the startup method of the switch device 20 is set to the first mode M1. Also, when a High-level signal (hereinafter referred to as a "second signal") is input from the transmission line L2 to the input / output interface 28, the startup method of the switch device 20 is set to the second mode M2.

[0057] The first mode M1 is a mode in which the first control unit 23 sets the register 24 based on the first program P1 when starting up the switch device 20. The second mode M2 ​​is a mode in which the second control unit 31 sets the register 24 based on the second program P2 when starting up the switch device 20.

[0058] [Regarding the external device 30] The external device 30 includes a second control unit 31, a second non-volatile memory 32, a second volatile memory 33, input / output interfaces 34, 35, and 36, and a communication interface 37. These units are electrically connected to each other via a bus B2.

[0059] The second control unit 31 includes a circuit configuration such as a processor. Specifically, the second control unit 31 is one or more CPUs. The processor included in the second control unit 31 may be a GPU. In this case, the second control unit 31 reads out a program stored in the second non-volatile memory 32 and executes various calculations and controls described below.

[0060] The second control unit 31 may include a processor in which a program is written in advance. For example, the second control unit 31 may be an integrated circuit such as a Complex Programmable Logic Device (CPLD), a Field-Programmable Gate Array (FPGA), or an Application Specific Integrated Circuit (ASIC). In this case, the second control unit 31 executes various calculations and controls based on the program written in advance.

[0061] The second nonvolatile memory 32 is a memory that can retain data even when the external device 30 is powered off. The second nonvolatile memory 32 includes, for example, a flash memory, a hard disk drive (HDD), a solid state drive (SSD), or a read only memory (ROM). A part of the second nonvolatile memory 32 may be provided outside the external device 30 as a separate auxiliary storage device.

[0062] The second non-volatile memory 32 stores a second program P2, a verification program P3, and a verification key K1. The second program P2 includes a computer program for setting the register 24, a setting value SV1 of the register 24, and a computer program for controlling the switch device 20. The verification program P3 is a computer program for verifying whether the second program P2 is authentic. The verification key K1 is a key used during the verification process by the verification program P3, and is also referred to as a "public key."

[0063] The second volatile memory 33 includes, for example, a RAM. The second control unit 31 reads various data from the second nonvolatile memory 32 and temporarily stores the data and calculation results of the data in the second volatile memory 33 while executing various calculations and controls described below.

[0064] The input / output interface 34 is connected to the switch device 20 via a transmission line L1. The input / output interface 34 is, for example, an MII.

[0065] The input / output interface 35 is connected to the switch device 20 via a transmission line L2. The input / output interface 35 is a signal pin that outputs a two-level signal, High or Low, and is, for example, a general-purpose I / O (GPIO: General-purpose input / output).

[0066] The input / output interface 36 is, for example, a general-purpose I / O, and is a pin for inputting and outputting digital signals to and from devices other than the switch device 20 .

[0067] The communication interface 37 is a pin for communicating with devices other than the switch device 20 in accordance with a predetermined communication protocol (for example, Ethernet, CAN, or FlexRay).

[0068] [Information processing method] Fig. 4 is a sequence diagram showing an example of an information processing method executed by the information processing device 10. In Fig. 4, the process executed by the external device 30 is shown on the left side, and the process executed by the switch device 20 is shown on the right side. The order of the processes shown in Fig. 4 may be changed as appropriate.

[0069] In the external device 30, the second control unit 31 reads various programs (e.g., the second program P2 and the verification program P3) from the second nonvolatile memory 32 and executes various processes. In the switch device 20, the first control unit 23 reads various programs (e.g., the first program P1) from the first nonvolatile memory 22 and executes various processes.

[0070] First, the outline of the information processing method will be explained. The information processing method of the present disclosure ensures security and shortens startup time by having the switch device 20 share the setting process of the register 24 and the external device 30 share the program verification process when starting up the information processing device 10.

[0071] To ensure the security of the switch device 20 in which program verification is not performed, the external device 30 performs its own verification process and then determines whether the setting of the register 24 in the switch device 20 is correct (register setting confirmation process). If it determines that the setting of the register 24 is correct, it simply completes the startup of the information processing device 10. On the other hand, if it determines that the setting of the register 24 is incorrect, it resets the register 24 based on the program of the external device 30 that has undergone the verification process (register reset process).

[0072] Each step will be described in detail below.

[0073] First, the information processing device 10 is powered on, which starts power supply to the external device 30 and the switch device 20 (steps ST101 and ST201). For example, the driver turns on the ignition switch of the vehicle V1, which turns on the information processing device 10. This starts various startup processes described below.

[0074] When the power is turned on, the external device 30 outputs a first signal from the input / output interface 35 (signal pin) (step ST102). After this, the first signal continues to be output from the input / output interface 35 until it is determined that the register setting is incorrect in a determination process (step ST106) described below.

[0075] Next, the external device 30 executes the verification process of the second program P2 based on the verification program P3 (step ST103). First, the second control unit 31 reads the verification program P3 from the second nonvolatile memory 32 and starts the verification process in accordance with the verification program P3. Specifically, the second control unit 31 reads the second program P2 to be verified from the second nonvolatile memory 32. Then, the second control unit 31 generates a hash value H2 for verification from the code of the second program P2.

[0076] The second program P2 is previously assigned a digital signature E1 created by the creator of the second program P2 using a private key. The digital signature E1 is information generated by encrypting a hash value generated from the code of the second program P2 with the private key. The second control unit 31 decrypts the digital signature E1 using a verification key K1 previously stored in the second nonvolatile memory 32 to obtain a legitimate hash value H3.

[0077] Finally, if the verification hash value H2 matches the regular hash value H3, the second control unit 31 determines that the second program P2 is valid. This completes the process of verifying the validity of the second program P2.

[0078] If the verification hash value H2 does not match the legitimate hash value H3, the second control unit 31 determines that the second program P2 is unauthorized. In this case, the second program P2 may have been tampered with, and starting the second program P2 as is may cause a malfunction in the in-vehicle system 1. Therefore, the second control unit 31 stops the startup process from step ST104 onwards. The second control unit 31 also notifies the administrator of the in-vehicle system 1 of the abnormality by sending an error message indicating that the second program P2 is unauthorized to another device (for example, a management device for the in-vehicle system 1) via the communication interface 37.

[0079] Next, the external device 30 executes its own initialization process (step ST104). For example, it initializes various flags included in the external device 30 and waits until the voltage in the circuit becomes stable. This initialization process is also called "initialization of the microcomputer" or "resetting the microcomputer."

[0080] Similarly, the switch device 20 also executes its own initialization process (step ST202). For example, it initializes various flags included in the switch device 20 and waits until the voltage in the circuit stabilizes. At this time, since the first signal is input to the input / output interface 28 (setting pin) of the switch device 20, the switch device 20 starts up in the first mode M1.

[0081] Next, the switch device 20 executes a setting process for the register 24 (step ST203). Because the register 24 is in an initial state when the switch device 20 is powered on, it is necessary to define the operation of the switch IC 21 by writing a value to the register 24. First, the first control unit 23 reads the first program P1 from the first nonvolatile memory 22 and writes a value to the register 24 in accordance with the first program P1. The first program P1 describes a setting value SV1 for the register 24, and the first control unit 23 writes a value to the register 24 based on the setting value SV1.

[0082] The first control unit 23 executes the setting process of the register 24 without waiting for the start and end of the verification process (step ST103) in the external device 30. Therefore, even if the verification process (step ST103) in the external device 30 takes time after the information processing device 10 is powered on, the setting process (step ST203) in the switch device 20 is executed in parallel with the verification process, thereby shortening the startup time.

[0083] Next, the information processing device 10 executes a register setting confirmation process to confirm whether the setting of the register 24 is valid. First, the external device 30 transmits a request signal to the switch device 20 to request the determination value J1 (step ST105). Specifically, after the initialization process (step ST104), the second control unit 31 outputs the request signal to the switch device 20. The request signal is input to the switch device 20 from the input / output interface 34 via the transmission path L1.

[0084] In response to the request signal, the switch device 20 outputs a judgment value J1 to the external device 30 (step ST204). Here, the judgment value J1 is a value for judging whether the setting of the register 24 in the setting process (step ST203) is correct or incorrect, and is, for example, the value of the register 24. After the setting process, the first control unit 23 outputs the value of each row of the register 24 as the judgment value J1 from the input / output interface 27 to the external device 30 via the transmission path L1.

[0085] Instead of transmitting the request signal (step ST105) and outputting the judgment value J1 (step ST204), the external device 30 may directly read the register 24 of the switch device 20. In this case, the second control unit 31 refers to the register 24 via the input / output interfaces 34 and 27 without going through the processing of the first control unit 23.

[0086] Next, the external device 30 determines whether the setting of the register 24 is correct or incorrect based on the determination value J1 (step ST106). Here, the setting value SV1 of the register 24 is stored in the second program P2. The authenticity of the second program P2 (i.e., that the code has not been tampered with) has been confirmed by the verification process (step ST103), so the setting value SV1 of the register 24 stored in the second program P2 is considered to be a regular value.

[0087] Therefore, the second control unit 31 reads the value of the register 24 included in the judgment value J1 line by line and compares it with the corresponding part of the setting value SV1. If the value of the register 24 included in the judgment value J1 completely matches the setting value SV1, the second control unit 31 determines that the setting of the register 24 is valid.

[0088] In this case, the second control unit 31 determines that there is no abnormality in the setting process by the switch device 20, and transmits a link-up instruction to the switch device 20 based on the second program P2 (step ST107). In response to the link-up instruction, the switch device 20 starts relay processing of the multiple processing devices 40. This completes the startup process of the information processing device 10.

[0089] On the other hand, if the value of register 24 included in judgment value J1 does not match set value SV1, second control unit 31 determines that the setting of register 24 is incorrect. For example, if first program P1 is tampered with and the set value SV1 included in first program P1 is rewritten to a different value, the value of register 24 included in judgment value J1 will not match set value SV1. Also, even if the set value SV1 itself in first program P1 is not tampered with, if a program related to the setting process is tampered with, the set value SV1 may not be correctly reflected in register 24, and the value of register 24 included in judgment value J1 may not match set value SV1. In such a case, second control unit 31 determines that there is an abnormality in the setting process by switch device 20 and executes register resetting processing.

[0090] Specifically, the external device 30 outputs the second signal from the input / output interface 35 (signal pin) (step ST108). After this, the second signal continues to be output from the input / output interface 35 until the start-up process of the information processing device 10 is completed.

[0091] Next, the second control unit 31 transmits a reset request to the switch device 20 (step ST109). In response to the reset request, the switch device 20 executes a reset process (step ST205). In the reset process, the first control unit 23 initializes the switch IC 21 in the same manner as in the initialization process (step ST202), and also resets the value of the register 24 to its initial state. At this time, since the second signal is input to the input / output interface 28 (setting pin) of the switch device 20, the switch device 20 starts up in the second mode M2.

[0092] By using the input / output interface 28 as a setting pin in this way, the start-up mode of the switch device 20 can be easily switched from the first mode M1 to the second mode M2 ​​based on an input signal to the setting pin.

[0093] After the reset process is completed, the first control unit 23 transmits a reset completion notification to the external device 30 (step ST206). Since the switch device 20 is in the second mode M2, the switch device 20 is subsequently controlled by the second control unit 31, and the first control unit 23 is disabled and stops. This ensures security by preventing the first control unit 23, which operates according to the first program P1 that may be subject to tampering, from participating in the subsequent startup process. Furthermore, by disabling the first control unit 23, the power consumption of the first control unit 23 can be reduced.

[0094] In response to the reset completion notification, the second control unit 31 resets the register 24 based on the setting value SV1 stored in the second program P2 (step ST110). As described above, the legitimacy of the second program P2 has been confirmed by undergoing the verification process (step ST103). Therefore, even if the setting of the register 24 by the first program P1 is invalid, security can be ensured by resetting the register 24 by the legitimate second program P2.

[0095] After the setting of the register 24 is completed, the switch device 20 transmits a setting completion notification to the external device 30 (step ST207). In response to the setting completion notification, the second control unit 31 transmits a link-up instruction to the switch device 20 based on the second program P2 (step ST111). In response to the link-up instruction, the switch device 20 starts relay processing of the multiple processing devices 40. This completes the startup processing of the information processing device 10.

[0096] According to the information processing method described above, the switch device 20 can execute the setting process of the register 24 while the external device 30 is executing the verification process, and therefore the startup time of the information processing device 10 can be shortened compared to, for example, when the switch device 20 executes the setting process of the register 24 after the verification process of the first program P1.

[0097] On the other hand, because verification processing is not performed on the first program P1, security is not ensured for the setting processing of the register 24 by the first program P1 as it is. For this reason, the switch device 20 transmits a determination value J1 regarding the setting of the register 24 to the external device 30, and after the verification processing, the external device 30 determines the validity of the setting of the register 24 based on the second program P2, the validity of which has been confirmed by the verification processing, and the determination value J1. Then, if it is determined that the setting of the register 24 is valid, the information processing device 10 starts the relay processing as is, thereby shortening the startup time.

[0098] Furthermore, if the setting of the register 24 is determined to be invalid, the register 24 is reset by the second program P2, which has been confirmed to be valid, so the startup process can be completed even if there is an abnormality in the first program P1. This makes it possible to shorten the startup time while ensuring security.

[0099] It is preferable to execute the determination process (step ST106) to ensure the security of the information processing device 10, but if a request to shorten the startup time has a higher priority, the register 24 may be set and a link-up instruction may be executed based on the second program P2 prior to the determination process. This allows the information processing device 10 to start the relay process more quickly. Even in this case, the link-up is performed by the second control unit 31 controlling the switch device 20 based on the second program P2, the legitimacy of which has been examined, so a certain degree of security can be ensured.

[0100] Furthermore, when a link-up instruction is executed before the determination process, second control unit 31 may execute the determination process after information processing device 10 starts the relay process, and if the setting of register 24 is valid, continue the relay process as is, or if there is an error in the setting of register 24, interrupt the relay process and execute the register reset process as described above. This makes it possible to ensure the security of information processing device 10.

[0101] [Variations] Modifications of the embodiment will be described below. In the modifications, the same components as those in the above embodiment will be denoted by the same reference numerals and the description thereof will be omitted.

[0102] [Determination Value Variation 1: Hash Value Calculated from Register Values] In the above embodiment, the judgment value J1 is the value of the register 24 set based on the first program P1. However, the judgment value is not limited to this as long as it is a value that can confirm the validity of the setting of the register 24. For example, instead of the judgment value J1, a hash value calculated based on the value of the register 24 (hereinafter referred to as "judgment value J2") may be used.

[0103] In this case, in response to the judgment value request (step ST105), the first control unit 23 reads the value of the register 24 and calculates a judgment value J2 as a hash value from the value of the register 24 based on a predetermined hash function. Then, the first control unit 23 outputs the judgment value J2 to the external device 30 (step ST204).

[0104] The second control unit 31 reads the setting value SV1 stored in the second program P2 and calculates a hash value SV2 from the setting value SV1 based on a predetermined hash function. If the judgment value J2 matches the hash value SV2, the second control unit 31 determines that the setting of the register 24 is valid, and if the judgment value J2 does not match the hash value SV2, the second control unit 31 determines that the setting of the register 24 is incorrect (step ST106).

[0105] Because the judgment value J2 is a hash value (i.e., a summarized value of the value of the register 24), the amount of data is smaller than the judgment value J1, which is the actual value of the register 24. This reduces the amount of processing in the process of outputting the judgment value J2 from the first control unit 23 to the external device 30 (step ST204) and in the judgment process (step ST106), thereby enabling the startup time to be shortened.

[0106] [Determination Value Variation 2: Pre-calculated Hash Value] Instead of the judgment value J1, a hash value that has been calculated in advance (hereinafter referred to as "judgment value J3") may be used. The judgment value J2 described above is a hash value that is calculated by the first control unit 23 based on the value of the register 24 after the setting process (step ST203). In contrast, the judgment value J3 in this modification is a value that is stored in advance in the first non-volatile memory 22 before the register 24 is set. Specifically, the judgment value J3 is a hash value H1 (FIG. 1) that is calculated based on a predicted value that is predicted as the value of the register 24 when the register 24 is set based on the first program P1.

[0107] Since the setting value SV1 of the register 24 is stored in the first program P1, it is possible to predict the value of the register 24 after setting based on the first program P1 even before actually setting the register 24. Therefore, the hash value H1 (i.e., the judgment value J3) can be stored in advance in the first nonvolatile memory 22 before the setting process.

[0108] In this case, in response to the judgment value request (step ST105), the first control unit 23 outputs the judgment value J3 stored in advance in the first nonvolatile memory 22 to the external device 30 (step ST204). In the case of the judgment value J2, a step of calculating the judgment value J2 from the value of the register 24 is required after the setting process. In contrast, since the judgment value J3 is stored in advance in the first nonvolatile memory 22 before the setting process, the calculation process after the setting process is not required, and the startup time can be further shortened.

[0109] The second control unit 31 reads the setting value SV1 stored in the second program P2 and calculates a hash value SV2 from the setting value SV1 based on a predetermined hash function. If the judgment value J3 matches the hash value SV2, the second control unit 31 determines that the setting of the register 24 is valid, and if the judgment value J3 does not match the hash value SV2, the second control unit 31 determines that the setting of the register 24 is incorrect (step ST106).

[0110] Because the judgment value J3 is a hash value (i.e., a summary value of the predicted value of the register 24), the amount of data is smaller than the judgment value J1, which is the actual value of the register 24. This reduces the amount of processing in the process of outputting the judgment value J3 from the first control unit 23 to the external device 30 (step ST204) and the judgment process (step ST106), thereby enabling the startup time to be shortened.

[0111] [Modification 3 of Determination Value: Determination Process by First Control Unit 23] Instead of the judgment value J1, a value indicating the judgment result by the first control unit 23 (hereinafter referred to as "judgment value J4") may be used. In the above embodiment, the second control unit 31 judges the validity of the value of the register 24 based on the judgment value J1 and the set value SV1. However, in this modified example, it is the first control unit 23, not the second control unit 31, that judges the validity of the value of the register 24.

[0112] For example, after the setting process of the register 24 (step ST203), the first control unit 23 reads the value of the register 24 and compares it with the setting value SV1 of the register 24 stored in the first program P1. If the value of the register 24 matches the setting value SV1 in the first program P1, the first control unit 23 outputs a determination value J4 (for example, J4=0) indicating that the setting of the register 24 is valid to the external device 30 (step ST204).

[0113] On the other hand, if the value of register 24 does not match the set value SV1 in the first program P1, first control unit 23 outputs a judgment value J4 (e.g., J4=1) indicating that the setting of register 24 is incorrect to external device 30 (step ST204).

[0114] The second control unit 31 determines the validity of the setting of the register 24 based on the determination value J4 (step ST106). Here, since the determination value J4 already includes a value indicating whether the setting of the register 24 is valid or not, the second control unit 31 determines the validity of the setting of the register 24 based on this value. For example, if the determination value J4 is "1", the second control unit 31 determines that the setting of the register 24 is incorrect.

[0115] As described above, in the determination process (step ST106) of this modified example, the second control unit 31 does not execute calculations such as comparing the determination value J1 with the set value SV1, thereby reducing the processing load on the second control unit 31. Furthermore, the calculation process of the determination value J4 in the first control unit 23 can be executed in parallel with the verification process (step ST103) if it is executed after the setting process of the register 24. Therefore, even if the verification process takes a long time, the time that the switch device 20 is in a "waiting" state can be reduced, and the startup time can be shortened.

[0116] Here, in this modified example, the judgment value J4 is calculated based on the first program P1 that has not undergone the verification process, so depending on the type of tampering with the first program P1, there is a risk that an error in the setting of the register 24 cannot be detected.

[0117] For example, if a portion of the first program P1 other than the setting value SV1 of the register 24 is tampered with, a discrepancy will occur between the setting value SV1 of the register 24 in the first program P1 (valid value) and the actual value (invalid value) of the register 24, making it possible to detect an error in the setting of the register 24. On the other hand, if the setting value SV1 of the register 24 in the first program P1 is tampered with to a different value, the setting value SV1 of the register 24 in the first program P1 (invalid value) will match the actual value (invalid value) of the register 24, making it impossible to detect an error in the setting of the register 24.

[0118] As such, although there are some patterns in which errors in the settings of register 24 cannot be detected, this modified example allows the first control unit 23 to be responsible for part of the judgment process, thereby making it possible to shorten the startup time while ensuring a certain degree of security.

[0119] In this modified example, the first control unit 23 compares the value of the register 24 with the set value SV1 in the first program P1, but instead, the first control unit 23 may compare a hash value calculated based on the value of the register 24 with a hash value calculated based on the set value SV1 in the first program P1.

[0120] [Multiple register settings] In the above embodiment, the first program P1 and the second program P2 store one piece of data as the setting value SV1 of the register 24. However, a plurality of patterns of setting values ​​may be prepared for the setting of the register 24, and one pattern may be selected from the plurality of patterns of setting values ​​each time the information processing device 10 is started up.

[0121] FIG. 5 is a block diagram showing a first nonvolatile memory 22a according to a modified example. The first nonvolatile memory 22a of this modification stores a first setting C1, a second setting C2, and a third setting C3 as setting patterns for the register 24. These settings C1 to C3 are included in, for example, the first program P1. The first nonvolatile memory 22a also stores a designated value X1 that specifies a setting pattern to be referenced when starting up the switch device 20. For example, when the designated value X1=1, the first setting C1 is designated, when the designated value X1=2, the second setting C2 is designated, and when the designated value X1=3, the third setting C3 is designated.

[0122] In the setting process (step ST203) of this modified example, the first control unit 23 first reads out a setting pattern specified by the specified value X1 from the first nonvolatile memory 22a, and sets the register 24 based on the setting pattern. For example, when the specified value X1=1, the first control unit 23 reads out the first setting C1, and sets the register 24 based on the first setting C1.

[0123] The designated value X1 is rewritten, for example, after the link-up instruction (step ST107 or ST111), when the connection configuration of the plurality of processing devices 40 is changed while the information processing device 10 is executing the relay process. For example, the second control unit 31 determines the setting pattern to be designated at the next startup in accordance with the connection configuration of the plurality of processing devices 40, transmits a new designated value X1 to the switch device 20 based on the determination result, and updates the designated value X1 stored in the first nonvolatile memory 22a to the new designated value X1.

[0124] Although the above description has been given of the first nonvolatile memory 22a, the first setting C1, the second setting C2, and the third setting C3 are similarly stored in the second nonvolatile memory 32. In this case, these settings C1 to C3 are included in the second program P2, and the validity of these settings C1 to C3 is also verified in the verification process (step ST103).

[0125] By storing a plurality of setting patterns in advance in this way, it is possible to respond to changes in the network configuration of the in-vehicle system 1 without waiting for an update of the first program P1.

[0126] In this modification, when a hash value calculated in advance is used as the judgment value in the judgment process (step ST106), the hash value may be stored in advance in the first nonvolatile memory 22a for each of these settings C1 to C3.

[0127] For example, the first nonvolatile memory 22a stores a hash value H11 calculated in advance based on the first setting C1, a hash value H12 calculated in advance based on the second setting C2, and a hash value H13 calculated in advance based on the third setting C3. When the setting process of the register 24 is performed based on the first setting C1, the first control unit 23 outputs the hash value H11 to the external device 30 as a determination value.

[0128] With this configuration, even when a plurality of setting patterns are prepared, the validity of the setting of the register 24 can be determined based on a hash value calculated in advance.

[0129] [Additional Note] It should be noted that at least some of the above-described embodiments and various modifications may be combined with each other in any desired manner. Furthermore, the embodiments and modifications disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present disclosure is defined by the claims, and all modifications within the meaning and scope equivalent to the claims are intended to be included. [Explanation of symbols]

[0130] 1. In-vehicle systems 10. Information processing equipment 20 Switching device 21 Switch IC 22, 22a First non-volatile memory 23 First Control Section 24 registers 25 First Volatile Memory 26 Communication Interface 27 Input / Output Interface 28 Input / Output Interface 30 External device 31 Second Control Section 32 Second non-volatile memory 33 Secondary Volatile Memory 34 Input / Output Interface 35 Input / Output Interface 36 Input / Output Interface 37 Communication Interface 40 Processing equipment V1 vehicle L1 transmission line L2 transmission line L3 transmission line B1 Bus B2 Bus P1 1st Program P2 2nd Program P3 Validation Program SV1 setting value SV2 hash value H1 hash value H2 hash value H3 hash value H11 hash value H12 hash value H13 hash value M1 First mode M2 Second mode K1 Validation Key E1 Electronic Signature J1 judgment value J2 judgment value J3 judgment value J4 judgment value C1 First setting C2 Second setting C3 Third setting X1 specified value

Claims

1. a switch device that relays a plurality of processing devices; an external device attached to the switch device; Equipped with The switch device a first non-volatile memory that stores a first program; a first control unit that sets a register based on the first program when the switch device is started; Including, The external device is a second non-volatile memory that stores a second program; a second control unit that executes a verification process of the second program at the time of the startup and then controls the switch device based on the setting of the register and the second program; Equipped with Information processing device.

2. the first control unit sets the register without waiting for the start and end of the verification process; The information processing device according to claim 1 .

3. the first control unit provides a determination value regarding the setting of the register to the second control unit; the second control unit resets the register based on the second program when it determines based on the determination value that the setting of the register is incorrect.

3. The information processing device according to claim 1.

4. the determination value is a value of the register, the second control unit determines that the setting of the register is incorrect when the value stored in the second program does not match the value of the register; The information processing device according to claim 3 .

5. the determination value is a hash value calculated based on the value of the register, the second control unit determines that the setting of the register is incorrect when the value stored in the second program does not match the hash value; The information processing device according to claim 3 .

6. the determination value is a hash value that is stored in advance in the first program before the register is set and is calculated based on a predicted value that is predicted as the value of the register, the second control unit determines that the setting of the register is incorrect when the value stored in the second program does not match the hash value; The information processing device according to claim 3 .

7. the first control unit provides the second control unit with the determination value indicating that the setting of the register is incorrect when the value stored in the first program does not match the value of the register; The information processing method according to claim 3 .

8. the switch device includes a setting pin that sets the switch device to a first mode in response to an input of a first signal and sets the switch device to a second mode in response to an input of a second signal different from the first signal; the first mode is a mode in which the first control unit sets the register based on the first program, the second mode is a mode in which the second control unit sets the register based on the second program, the external device includes a signal pin connected to the setting pin; The second control unit is outputting the first signal from the signal pin at the time of startup; outputting the second signal from the signal pin when it is determined that the setting of the register is incorrect; The information processing device according to claim 3 .

9. an information processing device according to claim 1 or 2, which is mounted on a vehicle; the plurality of processing devices mounted on the vehicle; An in-vehicle system comprising:

10. a first step of setting a register of a switch device that relays a plurality of processing devices based on a first program stored in a first nonvolatile memory included in the switch device at the time of startup of the switch device; a second step of executing a verification process of a second program stored in a second nonvolatile memory included in an external device externally attached to the switch device at the time of the startup; a third step of controlling the switch device based on the setting of the register and the second program after the first step and the second step; Equipped with Information processing methods.

11. A computer program that causes a computer to function as an information processing device, The computer program causes the computer to: a first step of setting a register of a switch device that relays a plurality of processing devices based on a first program stored in a first nonvolatile memory included in the switch device at the time of startup of the switch device; a second step of executing a verification process of a second program stored in a second nonvolatile memory included in an external device externally attached to the switch device at the time of the startup; a third step of controlling the switch device based on the setting of the register and the second program after the first step and the second step; Execute Computer program.

Images