Vehicle ecu

Abstract

To provide an ECU for a vehicle which can be used for a long time.SOLUTION: The processor of the vehicular ECU verifies falsification of the program stored in the normal storage area of the nonvolatile memory, executes the program stored in the normal storage area when the program stored in the normal storage area is not falsified, verifies falsification of the program stored in the backup storage area when the program stored in the normal storage area is falsified, and executes the program stored in the backup storage area when the program stored in the backup storage area is not falsified. The check disk of the normal storage area is operated, and when any defective part is detected in the normal storage area, the defective part is disconnected, and the normal storage area is formatted.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present invention relates to the technical field of vehicle ECUs. [Background technology]

[0002] A vehicle ECU (Electronic Control Unit) has been proposed that is provided with two storage areas, and if a program stored in one storage area is tampered with, the program stored in the other storage area is executed (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-077803 Summary of the Invention [Problem to be solved by the invention]

[0004] However, if a defective section (bad sector) is found in the storage area of ​​a vehicle ECU, the defective section may cause the program to be determined as having been tampered with. In this case, even if a new, untampered program is written to the storage area, the program may still be determined as having been tampered with. In such a case, the vehicle ECU must be replaced.

[0005] The present invention has been made in view of the above circumstances, and has as its object to enable long-term use of a vehicle ECU. [Means for solving the problem]

[0006] A vehicle ECU according to one embodiment of the present invention includes a processor and a storage medium on which a program executed by the processor is stored. The storage medium has a first storage area and a second storage area in which the program can be stored. The processor verifies whether the program stored in the first storage area has been tampered with, and if the program stored in the first storage area has not been tampered with, executes the program stored in the first storage area. If the program stored in the first storage area has been tampered with, the processor verifies whether the program stored in the second storage area has been tampered with, and if the program stored in the second storage area has not been tampered with, executes the program stored in the second storage area. The processor also performs a check disk of the first storage area, and if a defect is detected in the first storage area, separates the defect and formats the first storage area. [Effects of the Invention]

[0007] According to the present invention, it is possible to use a vehicle ECU for a long period of time. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of a vehicle. [Figure 2] FIG. 2 is a block diagram showing the configuration of an ECU. [Figure 3] FIG. 10 is a diagram showing data stored in a ROM and a non-volatile memory. [Figure 4] FIG. 10 is a diagram illustrating verification of tampering of a normal boot image. [Figure 5] FIG. 10 is a diagram showing a process when a normal boot image has been tampered with. [Figure 6] FIG. 1 illustrates a copy of a backup boot image. [Figure 7] 4 is a flowchart showing a flow of processing by a CPU when a vehicle is started. [Figure 8] 10 is a flowchart showing the flow of a return process. [Figure 9]FIG. 10 is a diagram showing data stored in a ROM and a nonvolatile memory in a modified example. [Figure 10] 10 is a flowchart showing the flow of a return process in a modified example. DETAILED DESCRIPTION OF THE INVENTION

[0009] <1. Vehicle configuration> 1 is a block diagram showing an example of the configuration of a vehicle 1. As shown in FIG. 1, the vehicle 1 includes one or more ECUs (Electronic Control Units) 2 and a wireless communication unit 3.

[0010] The ECU 2 controls target devices mounted on the vehicle 1, and is provided for each target device. Therefore, a large number of ECUs 2 are provided in the vehicle 1. However, only one ECU 2 may be provided.

[0011] Examples of the ECU 2 include an engine ECU that controls an engine, a motor ECU that controls a motor generator, a car navigation system ECU that controls a car navigation system, and a power supply ECU that controls READY-ON and READY-OFF of the vehicle 1 based on a user's operation. Note that the wireless communication unit 3 that wirelessly communicates with an external device (e.g., a server) via a network is also an example of the ECU 2.

[0012] The wireless communication unit 3 communicates wirelessly with external devices via a network. For example, the wireless communication unit 3 can obtain data for updating programs from a server outside the vehicle using an OTA (Over the Air) method.

[0013] The ECU 2 and the wireless communication unit 3 are connected via a bus 4, allowing data to be transmitted and received between them.

[0014] Fig. 2 is a block diagram showing the configuration of the ECU 2. As shown in Fig. 2, the ECU 2 includes a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12, a RAM (Random Access Memory) 13, a non-volatile memory 14, and a communication circuit 15.

[0015] The CPU 11 loads a program stored in the ROM 12 or the nonvolatile memory 14 into the RAM 13 and executes the program, thereby performing operations in accordance with the program.

[0016] The ROM 12 allows the stored data to be read, but does not allow data to be written. The RAM 13 stores temporary data and the like that is required when the CPU 11 performs predetermined processing. The nonvolatile memory 14 is capable of reading out stored data and also capable of writing data. The communication circuit 15 communicates with other in-vehicle devices mounted on the vehicle 1 via the bus 4 .

[0017] The CPU 11, ROM 12, RAM 13, nonvolatile memory 14, and communication circuit 15 are connected via a bus 16, allowing data to be sent and received among them.

[0018] Incidentally, the ECU 2 also includes a component that controls the driving of the vehicle 1. If the program of the ECU 2 is tampered with, it may affect the driving of the vehicle 1. Therefore, the ECU 2 is provided with a program (hereinafter referred to as RoT (Root of Trust)) for verifying that the startup program has not been tampered with.

[0019] The RoT has a function to verify the integrity of startup programs (secure boot function) such as the OS (Operating System) and application programs that are executed when ECU 2 starts up. The startup programs that are loaded when ECU 2 starts up, such as the OS and applications, are referred to as boot images.

[0020] RoT verifies that the boot image has not been tampered with, and when updating the boot image, verifies that the update information has not been tampered with and is provided by a trusted source.

[0021] Conventionally, if tampering with the boot image is detected when the ECU 2 is started, the start of the ECU 2 is stopped, that is, the start of the vehicle 1 is stopped. In such a case, it is necessary to take the vehicle 1 to a dealer or the like and have the ECU 2 replaced.

[0022] Therefore, the ECU 2 of this embodiment stores boot images in two storage areas, and even if one boot image is tampered with, it executes the other boot image if the other boot image is not tampered with. Furthermore, the ECU 2 also takes measures against further tampering by deleting the tampered boot image and duplicating (copying) the untampered boot image.

[0023] 3 is a diagram showing data stored in the ROM 12 and the nonvolatile memory 14. As shown in FIG. 3, the nonvolatile memory 14 has two storage areas: a normal storage area 21 and a backup storage area 22. The normal storage area 21 and the backup storage area 22 are virtually formed inside one physical nonvolatile memory 14. However, the normal storage area 21 and the backup storage area 22 may be formed in different nonvolatile memories 14.

[0024] A boot image is stored in each of the normal storage area 21 and the backup storage area 22. Hereinafter, the boot image stored in the normal storage area 21 will be referred to as a normal boot image 31, and the boot image stored in the backup storage area 22 will be referred to as a backup boot image 32.

[0025] The backup boot image 32 is a copy of the normal boot image 31. Therefore, the normal boot image 31 and the backup boot image 32 are usually the same data.

[0026] The ROM 12 stores a RoT 41 and a check disk program 42 . The RoT 41 is an RoT for verifying tampering of the normal boot image 41 and the check disk program 42 when the ECU 2 starts up. The check disk program 42 is a program that performs a check disk to detect defective areas (bad sectors) in the normal storage areas 21 and 22.

[0027] In the vehicle 1, when the boot image of the ECU 2 is updated, the CPU 11 receives the update data from the server via the wireless communication unit 3. At this time, the CPU 11 verifies whether the update data received by the RoT 41 has been tampered with and whether it has been provided by a reliable developer. If the received update data is successfully verified, the CPU 11 stores the update data (new boot image) in the backup storage area 22.

[0028] As a result, the pre-update boot image is stored in the normal storage area 21 as the normal boot image 31, and the updated boot image is stored in the backup storage area 22. Thereafter, when the vehicle 1 is stopped (at READY-OFF), the CPU 11 sets a flag for switching the startup screen.

[0029] The flag set here is a flag for switching the normal storage area 21 and the backup storage area 22 the next time the vehicle 1 is started. In other words, the update data stored in the backup storage area 22 is read out as the normal boot image 31 the next time the vehicle 1 is started.

[0030] When the vehicle 1 is started (READY-ON), the CPU 11 changes the normal storage area 21 to the backup storage area 22 and also changes the backup storage area 22 to the normal storage area 21. As a result, the normal boot image 31 (the boot image before the update) stored in the original normal storage area 21 comes to be treated as the backup boot image 32, and the updated boot image stored in the original backup storage area 22 comes to be treated as the normal boot image 31.

[0031] Thereafter, the CPU 11 reads the RoT 41 from the ROM 12 into the RAM 13 and executes it to verify whether or not the updated boot image, which is now treated as the normal boot image 31, has been tampered with. If the new normal boot image 31 has not been tampered with, the CPU 11 loads the new normal boot image 31 into the RAM 13 and executes it, thereby starting to control the target device.

[0032] Furthermore, if the CPU 11 verifies that the new normal boot image 31 has not been tampered with, it stores a copy of the new normal boot image 31 in the backup memory area 22. That is, the CPU 11 deletes the pre-update boot image stored in the backup memory area 22 and stores the updated boot image. In this way, ECU2 can reduce the possibility of tampering with the updated boot image by installing a new boot image and duplicating the updated boot image when switching the boot surface.

[0033] Next, verification of whether or not the vehicle 1 has been tampered with when the vehicle 1 is started will be described. 4 is a diagram showing verification of tampering with the normal boot image 31. When the vehicle 1 is started (READY-ON), the CPU 11 loads the RoT 41 into the RAM 13 and executes it, as shown in FIG. 4, to verify whether the normal boot image 31 stored in the normal storage area 21 has been tampered with.

[0034] If the normal boot image 31 has not been tampered with, the CPU 11 starts controlling the target device by expanding the normal boot image 31 into the RAM 13 and executing it. At this time, since the normal boot image 31 has not been tampered with, it becomes possible to control the target device normally.

[0035] 5 is a diagram showing the processing when tampering has occurred in the normal boot image 31. On the other hand, when tampering of the normal boot image 31 is detected, the CPU 11 loads the RoT 41 into the RAM 13 and executes it, as shown in FIG. 5, to verify whether the backup boot image 32 stored in the backup memory area 22 has been tampered with.

[0036] If the backup boot image 32 has not been tampered with, the CPU 11 starts controlling the target device by expanding the backup boot image 32 into the RAM 13 and executing it. At this time, since the backup boot image 32 has not been tampered with, it becomes possible to control the target device normally.

[0037] Furthermore, if the normal boot image 31 has been tampered with, the CPU 11 notifies an external device (server) via the wireless communication unit 3 that the normal boot image 31 has been tampered with, and transmits the tampered normal boot image 31 to the external device (server). This allows the server to determine what kind of tampering has occurred and consider countermeasures against the tampering.

[0038] 5, the CPU 11 performs a check disk by loading a check disk program 42 into the RAM 13 and executing it to detect defective areas in the normal storage area 21. At this time, the CPU 11 transmits the detection result of the defective areas to the server.

[0039] 6 is a diagram showing the duplication of the backup boot image 32. Then, the CPU 11 separates the defective portion of the normal storage area 21 and formats (initializes) the normal storage area 21 excluding the separated defective portion. After that, the CPU 11 copies the backup boot image 32 to an area in the normal storage area 21 that is not defective, as shown in FIG. 6, and stores the copy as the normal boot image 31. As a result, the normal boot image 31 is stored in a non-defective area in the normal storage area 21. This reduces the likelihood that the normal boot image 31 will be determined to have been tampered with due to a defective area. This allows the timing of replacement of the ECU 2 to be delayed, enabling the ECU 2 to be used for a long period of time.

[0040] On the other hand, if both the normal boot image 31 and the backup boot image 32 have been tampered with, the CPU 11 stops the activation of the ECU 2.

[0041] 7 is a flowchart showing the flow of processing by the CPU 11 when starting up the vehicle 1. As shown in Fig. 7, in step S1, the CPU 11 loads the RoT 41 into the RAM 13 and executes it to verify whether the normal boot image 31 stored in the normal storage area 21 has been tampered with.

[0042] In step S2, the CPU 11 determines whether or not tampering with the normal boot image 31 was detected in step S1. If the normal boot image 31 has not been tampered with (No in step S2), in step S3 the CPU 11 loads the normal boot image 31 into the RAM 13 and executes it, thereby starting control of the target device.

[0043] On the other hand, if the normal boot image 31 has been tampered with (Yes in step S2), the CPU 11 verifies in step S4 whether the backup boot image 32 stored in the backup storage area 22 has been tampered with.

[0044] In step S5, the CPU 11 determines whether or not tampering has been detected in step S4 of the backup boot image 32. If the backup boot image 32 has been tampered with (Yes in step S5), the CPU 11 stops the startup of the ECU 2 in step S6.

[0045] On the other hand, if the backup boot image 32 has not been tampered with (No in step S5), the CPU 11 loads the backup boot image 32 into the RAM 13 and executes it in step S7, thereby starting control of the target device.

[0046] In the next step S8, the CPU 11 performs a restoration process. FIG. 8 is a flowchart showing the flow of the restoration process. When the restoration process starts, as shown in FIG. 8, in step S11, the CPU 11 notifies the server via the wireless communication unit 3 that the normal boot image 31 has been tampered with. In step S12, the CPU 11 transmits the tampered normal boot image 31 to the server. In step S13, the CPU 11 performs a check disk by loading the check disk program 42 into the RAM 13 and executing it to detect defective areas in the normal storage area 21. In step S14, the CPU 11 transmits the results of the check disk (detection results of defective areas) to the server. In step S15, the CPU 11 separates the defective areas from the normal storage area 21 and formats the areas other than the defective areas in the normal storage area 21. In step S16, the CPU 11 copies the backup boot image 32 to an area of ​​the normal storage area 21 that is not defective and stores the copy as the normal boot image 31.

[0047] <2. Modifications> Although the embodiments have been described above, the present invention is not limited to the specific examples described above and various configurations can be adopted.

[0048] In the above embodiment, a root of trust is used as the program (software) that verifies whether the normal boot image 31 and the backup boot image 32 have been tampered with. However, any other program may be used as long as it can verify whether the normal boot image 31 and the backup boot image 32 have been tampered with.

[0049] In the above embodiment, if the normal boot image 31 has been tampered with, it is transmitted to the server. However, for example, in a vehicle 1 that does not have a wireless communication unit 3, if the normal boot image 31 has been tampered with, it may be saved in another area of ​​the non-volatile memory 14. Fig. 9 is a diagram showing data stored in the ROM 12 and the nonvolatile memory 14 in the modified example. As shown in Fig. 9, the nonvolatile memory 14 is provided with a normal storage area 21, a backup storage area 22, and a tampering storage area 23. Normally, no boot image is stored in the tampering storage area 23. When the normal boot image 31 is tampered with, the CPU 11 saves the tampered normal boot image 31 in the tampering storage area 23 as a tampered boot image 33. This allows the tampered boot image 33 to be collected by the dealer when the vehicle 1 is taken to the dealer, for example.

[0050] 10 is a flowchart showing the flow of the return process in the modified example. Note that the process other than the return process is the same as that shown in FIG. As shown in FIG. 10, when the restoration process of the modified example is started, in step S21, the CPU 11 stores in the nonvolatile memory 14 a log indicating that the normal boot image 31 has been tampered with. In step S22, the CPU 11 stores the tampered normal boot image 31 in the tampered storage area 23 as a tampered boot image 33. In step S23, the CPU 11 loads the check disk program 42 in the RAM 13 and executes it to detect defective areas in the normal storage area 21. In step S24, the CPU 11 stores the check disk results (detection results of defective areas) in the nonvolatile memory 14. In step S25, the CPU 11 separates the defective areas from the normal storage area 21 and formats the rest. In step S26, the CPU 11 copies the backup boot image 32 to an area of ​​the normal storage area 21 that is not defective, and stores the copy as the normal boot image 31.

[0051] <3. Summary of the embodiment> As described above, the vehicle ECU (ECU 2) of the embodiment includes a processor (CPU 11) and a storage medium (non-volatile memory 14) that stores a program executed by the processor. The storage medium is provided with a first storage area (normal storage area 21) and a second storage area (backup storage area 22) that can store the program. The processor verifies whether the program (normal boot image 31) stored in the first storage area has been tampered with, and executes the program stored in the first storage area if the program has not been tampered with. Furthermore, if the program stored in the first storage area has been tampered with, the processor verifies whether the program stored in the second storage area (backup boot image 32) has been tampered with, and if the program stored in the second storage area has not been tampered with, executes the program stored in the second storage area. Furthermore, if the program stored in the first storage area has been tampered with, a check disk of the first storage area is performed, and if a defective part is detected in the first storage area, the defective part is separated and the first storage area is formatted. As a result, even if the normal boot image 31 has been tampered with, the CPU 11 can start up using the backup boot image 32 as long as the backup boot image 32 has not been tampered with. Furthermore, if the normal boot image 31 has been tampered with, a check disk is performed on the normal storage area 21, and the normal storage area 21 can be reused without the defective parts by formatting the normal storage area 21 and excluding the defective parts. This reduces the chance of the normal boot image 31 being mistakenly detected as having been tampered with due to a defective part in the normal storage area 21. Furthermore, it is not necessary to replace the ECU 2 every time the normal boot image 31 is tampered with, and the ECU 2 can be used for a long period of time. Thus, the ECU 2 can be used for a long period of time, and cost performance can be improved.

[0052] The processor copies the program stored in the second storage area to the formatted first storage area. This allows the normal boot image 31 to be stored without being tampered with in the normal storage area 21 from which the defective area has been excluded, and prevents the normal boot image 31 from being damaged by a defective area in the normal storage area 21. Therefore, the ECU 2 can be used for a long period of time.

[0053] The storage medium is provided with a third storage area (a storage area 23 for tampering) capable of storing a program, and if the program stored in the first storage area has been tampered with, the processor saves the tampered program in the third storage area. This allows the ECU 2 to retain the tampered program, which can be collected when the vehicle 1 is taken to a dealer or the like and used for future program development and anti-tampering measures.

[0054] If the program stored in the first storage area has been tampered with, the processor transmits the tampered program to the external device. This allows the external device (server) to use the transmitted program for future program development and anti-tampering measures.

[0055] When the program stored in the first storage area is updated, the processor stores the updated program in the second storage area at the timing when the updated program is executed. This allows the backup boot image 32 to be stored in the backup storage area 22 at a timing when it is least likely to be tampered with. [Explanation of symbols]

[0056] 1 vehicle 11 CPU 12 RAM 13 ROM 14 Non-volatile memory 21 Normal storage area 22 Backup storage area 23 Tampering storage area 31 Normal Boot Image 32 Backup Boot Images 33 Tampered Boot Image

Claims

1. a processor; a storage medium in which a program executed by the processor is stored; the storage medium is provided with a first storage area and a second storage area in which the program can be stored, The processor: verifying whether the program stored in the first storage area has been tampered with, and executing the program stored in the first storage area if the program stored in the first storage area has not been tampered with; If the program stored in the first storage area has been tampered with, the program stored in the second storage area is verified for tampering, and if the program stored in the second storage area has not been tampered with, the program stored in the second storage area is executed, and a check disk is performed on the first storage area, and if a defective portion is detected in the first storage area, the defective portion is separated and the first storage area is formatted. Vehicle ECU.

2. The processor: Copying the program stored in the second storage area to the formatted first storage area. The vehicle ECU according to claim 1 .

3. the storage medium is provided with a third storage area capable of storing the program, The processor: If the program stored in the first storage area has been tampered with, the tampered program is saved in the third storage area. The vehicle ECU according to claim 1 or 2.

4. The processor: If the program stored in the first storage area has been tampered with, the tampered program is transmitted to an external device. The vehicle ECU according to claim 1 or 2.

5. The processor: When the program stored in the first storage area is updated, the updated program is stored in the second storage area at the timing when the updated program is executed. The vehicle ECU according to claim 1 or 2.

Images