In-vehicle system

Abstract

To complete authentication processing in a vehicle and increase the accuracy of authentication.SOLUTION: An in-vehicle system includes first operation devices 70, 80, a second operation device 60, and verification modules 31, 32. The verification modules 31, 32 cause the second operation device 60 to execute a test program and determine whether the second operation device is a regular item on the basis of the result of execution, the result of time, and the shift data of the power consumption of the second operation device 60 and / or the shift data of the temperature. A communication module 86 is set in a conductive state when the second operation device 60 is determined to be a regular item, and is set in a cut-off state when the second operation device 60 is determined to be a non-regular item so that power supply for the second operation device 60 is cut off.SELECTED DRAWING: Figure 4

Description

Technical Field

[0001] The technology disclosed herein belongs to the technical field of in-vehicle systems for vehicles.

Background Art

[0002] In recent years, as shown in Patent Document 1, in order to effectively utilize the computing resources mounted on a vehicle, it has been studied to utilize the computing resources as grid computing while the vehicle is parked or the like. In addition, in order to provide various services and a comfortable space for the passengers of the vehicle, a large number of ECUs are mounted on the vehicle and they are operated in cooperation with each other.

[0003] Patent Document 2 discloses a technique for performing an authentication process of a device that attempts to communicate with an in-vehicle ECU. Patent Document 2 exemplifies, as methods of the authentication process, a method of requesting input of a PIN code, a method of requesting input of a serial number or password distributed in advance to a legitimate user, and a method of cooperating with an external authentication server.

[0004] Patent Document 3 discloses a technique for authenticating the legitimacy of an electronic control device of a vehicle, detecting an illegal electronic control device, excluding the illegal electronic control device if detected, determining the remaining valid vehicle-mounted functions, and displaying the determination result to the user.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Patent Document 2

Patent Document 3

Summary of the Invention

Problems to be Solved by the Invention

[0006] As described above, when utilizing the computing resources mounted on a vehicle for grid computing operations (hereinafter referred to as grid operations) or providing new services, etc. to users, it is preferable to enable the addition of a computing device retroactively at a maintenance factory or the like after the vehicle is sold. By doing so, even after the vehicle is sold, it is possible to perform function expansions for improving the functions and services achievable by the vehicle, or to enhance the computing ability of grid operations.

[0007] On the other hand, when configured to enable the retroactive addition of a computing device, there is a possibility that an external ECU that is not an original part may be attached. When a non-genuine computing device is attached to the vehicle, from the perspective of ensuring safety and reliability, it is necessary to prevent the computing device from being connected to the ECU (especially the ECU related to driving control) originally mounted on the vehicle.

[0008] Here, in order to distinguish between genuine and non-genuine products, there is a method of using an authentication code or the like as in Patent Document 2. However, when the authentication code is leaked or is illegally analyzed and the authentication code becomes known, there is a risk that illegal access from the computing device to the ECU cannot be eliminated. Also, due to reasons such as being sold at a low price, the risk that a user intentionally attaches a non-genuine product to the vehicle cannot be eliminated.

[0009] Regarding the method of cooperating with an external authentication server, it can be expected that the authentication accuracy of genuine / non-genuine computing devices will be improved compared to the case of using an authentication code or the like. However, when the number of vehicles to be managed increases, there is a problem that the authentication process and the management of the authentication status become extremely complicated.

[0010] The technology disclosed herein has been made in view of such points, and its objective is to be able to complete the authentication process inside the vehicle and to improve the authentication accuracy compared to the prior art.

Means for Solving the Problem

[0011] In order to solve the above problems, in a first aspect of the technology disclosed herein, for an in-vehicle system mounted on a vehicle, a first arithmetic unit used for vehicle control, a second arithmetic unit installed at a location different from the first arithmetic unit within the vehicle, a communication module that conducts or cuts off communication between the first arithmetic unit and the second arithmetic unit based on a communication control signal, a storage unit storing a test program used for the second arithmetic unit, causing the second arithmetic unit to execute the test program, and based on the execution result of the test program received from the second arithmetic unit, the execution time of the test program, and the transition data of the power consumption and / or the temperature of the second arithmetic unit during the execution period of the test program, a verification module that determines whether the second arithmetic unit is a genuine product and outputs the communication control signal based on the determination result, wherein when the second arithmetic unit is determined to be a genuine product, the verification module controls the communication module to be in a conductive state, while when the second arithmetic unit is determined to be a non-genuine product, the verification module sets the communication module to a cut-off state and controls to cut off the power supply to the second arithmetic unit.

[0012] According to this configuration, in addition to the execution result of the test program, the execution time of the test program and the transition of power consumption and / or temperature change in the second arithmetic unit are also monitored to determine whether the second arithmetic unit is a genuine product. Thereby, the authentication accuracy can be improved compared to the prior art.

[0013] Also, a test format according to the so-called BIST method, in which the test program stored in the storage unit is executed and the genuine product and non-genuine product are determined based on the result, is adopted, and the transition data of power consumption and temperature during the test period are utilized. Thereby, while completing the authentication process within the vehicle, the authentication accuracy can be improved.

[0014] In a second aspect of the technology disclosed herein, for an in-vehicle system mounted on a vehicle, a first arithmetic unit used for vehicle control, a connection unit in which an external second arithmetic unit is detachably configured, a storage unit storing a test program used for the second arithmetic unit, and when the connection of the second arithmetic unit to the connection unit is confirmed, the test program is executed on the second arithmetic unit, and based on the execution result of the test program received from the second arithmetic unit, the execution time of the test program, and the transition data of the power consumption and / or the temperature of the second arithmetic unit during the execution period of the test program, it is determined whether the second arithmetic unit is a genuine product, and a collation module that outputs a communication control signal based on the determination result, and a communication module that conducts or blocks communication between the first arithmetic unit and the second arithmetic unit based on the communication control signal. The collation module controls the communication module to be in a conductive state when the second arithmetic unit is determined to be a genuine product, while when the second arithmetic unit is determined to be a non-genuine product, the communication module is set to a blocked state and control is performed to cut off the power supply to the second arithmetic unit.

[0015] According to this configuration, similar to the first aspect, in addition to the execution result of the test program, the execution time of the test program and the transition of power consumption and / or temperature change in the second arithmetic unit are also monitored, so that the authentication accuracy can be improved compared to the prior art. Also, the authentication accuracy can be improved while completing the authentication process inside the vehicle.

Advantages of the Invention

[0016] As described above, according to the technology disclosed herein, the authentication accuracy can be improved compared to the prior art, and the authentication process can be completed inside the vehicle.

Brief Description of the Drawings

[0017]

Figure 1

Figure 2

Figure 3A

Figure 3B

Figure 4

Figure 5

Figure 6

Mode for Carrying Out the Invention

[0018] Hereinafter, exemplary embodiments will be described in detail with reference to the drawings. The same or corresponding parts in the figures are denoted by the same reference numerals, and repeated explanations may be omitted. Also, in the following embodiments, the description will focus on the configurations highly relevant to the content of the present disclosure.

[0019] It should be noted that the following embodiments are exemplary, and there is no intention to limit the content of the present disclosure by the presence or absence of description, the exemplified numerical values, etc. Also, in the present disclosure, regardless of whether the terms "system", "module", "device" are used, part or all of the system / module / device can be realized by a dedicated circuit such as an application specific integrated circuit (ASIC) or a programmable logic array (PLA). Similarly, the system / module / device can be realized by a processor circuit that executes computer-readable instructions (for example, a program) to execute a predetermined processing step to execute a specific function.

[0020] (Grid Computing System) FIG. 1 illustrates the configuration of the grid computing system of the embodiment.

[0021] This grid computing system includes a plurality of vehicles 10 and a management server 50. These components can communicate with each other via a global network. Each of the plurality of vehicles 10 is equipped with computing resources 12. Note that the management server 50 may be implemented in the cloud.

[0022] In the present disclosure, resources that can be used for grid computing operations and processing, such as the processors and memories installed in the vehicle 10, are referred to as "computing resources 12" for convenience of explanation. Examples of processors include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), and the like. The memory stores programs for operating the processor, information and data indicating the processing results of the processor, and the like. Note that the computing resources 12 may also serve as resources used for controlling the vehicle 10, or dedicated CPUs, GPUs, and memories for grid computing that are not used for controlling the vehicle may be used.

[0023] 〔Grid Computing〕 As shown in FIG. 1, in the grid computing system, a grid computing G (hereinafter, also simply referred to as "grid G") is configured by a plurality of computing resources 12. And each computing resource 12 executes an application job (hereinafter, also simply referred to as "job") provided from the management server 50.

[0024] Note that when the vehicle 10 is running, the computing power of the computing resources 12 is required for the running control of the vehicle 10, and the computing resources 12 are in an operating state. On the other hand, for example, when the vehicle 10 stops and the power of the vehicle 10 is turned off, the computing power of the computing resources 12 for the running control of the vehicle becomes substantially unnecessary. Therefore, usually, grid computing operations (hereinafter, referred to as "grid operations") can be executed when the vehicle 10 is not in operation (for example, parked).

[0025] 〔In-Vehicle System〕 FIG. 2 shows a vehicle 10 equipped with the control device according to the present embodiment.

[0026] As shown in FIG. 2, the vehicle 10 is equipped with an in-vehicle computing system (hereinafter simply referred to as "in-vehicle system 11").

[0027] The in-vehicle system 11 includes a vehicle power supply system 13, a control device 20, an arithmetic unit 60, a first ECU (Electronic Control Unit) 70, and a second ECU (Electronic Control Unit) 80.

[0028] The first ECU 70 and the second ECU 80 are arithmetic units used for the running control of the vehicle 10. On the other hand, the arithmetic unit 60 is an arithmetic unit not used for the running control of the vehicle. Here, "used for the running control of the vehicle 10" means generating and / or outputting a signal that is directly or indirectly reflected in a signal for driving an actuator for realizing the running, braking, and steering of the vehicle.

[0029] Note that, for the arithmetic units used for the running control of the vehicle 10 (for example, the first ECU 70 and the second ECU 80), the ownership may be attributed to the owner of the vehicle, and for the arithmetic units not used for the running control of the vehicle (for example, the arithmetic unit 60), the ownership may be attributed to a third party other than the owner of the vehicle.

[0030] FIG. 3A schematically shows an example of the connection configuration of the control device 20, the arithmetic unit 60, the first ECU 70, and the second ECU 80. As shown in FIG. 3A, the arithmetic units used for the running control of the vehicle 10 (for example, the first ECU 70 and the second ECU 80) and the arithmetic unit not used for the running control of the vehicle (for example, the arithmetic unit 60) are provided at different positions in the vehicle. In this example, the first ECU 70 and the second ECU 80 are an example of the first arithmetic unit. Also, the arithmetic unit 60 is an example of the second arithmetic unit.

[0031] In FIG. 3A, for the sake of convenience, the first ECU 70 and the second ECU 80 are illustrated as rectangular parallelepipeds, but there is no intention to limit the specific configuration of the ECU. Although not shown, for example, a substrate on which devices for realizing respective functions are mounted may be called an ECU, or an object in which the substrate is built in a housing may be called an ECU. The same applies to the control device 20 and the arithmetic device 60.

[0032] In this example, the connection part 21 of the control device 20 and the connection part 61 of the arithmetic device 60 are connected by a signal line C1. The connection part 22 of the control device 20 and the connection part 72 of the first ECU 70 are connected by a signal line C2. The connection part 71 of the first ECU 70 and the connection part 81 of the second ECU 80 are connected by a signal line C3. Note that the specific configurations of the connection parts 21, 22, 61, 71, 72, 81 and the signal lines C1 to C3 are not particularly limited. For example, as the connection parts 21, 22, 61, 71, 72, 81, terminals provided in respective ECUs or arithmetic devices, sockets integrally attached to a substrate on which an ECU or an arithmetic device is mounted, or the like are used. Further, for example, as the signal lines C1 to C3, a wire harness or the like is used.

[0033] The control device 20, the first ECU 70, and the second ECU 80 are installed in places where passengers cannot easily access (for example, the back inside the dashboard, the chassis frame, the body frame, etc.). Note that the control device 20, the first ECU 70, and the second ECU 80 may be mounted in the same housing, or may be mounted in separate housings respectively. The arithmetic device 60 is installed in a place different from the control device 20, the first ECU 70, and the second ECU 80 (for example, a place where access is relatively easy, such as a trunk room, a glove box, a console, etc.). In other words, the arithmetic device 60 is installed in a place where external access is easier compared to the first ECU 70 and the second ECU 80. Similarly, the connection parts (for example, the connection part 61, the sockets 62, 63) are installed in places where external access is easier compared to the first ECU 70 and the second ECU 80.

[0034] In this way, by making the control device 20, the first ECU 70, and the second ECU 80 not easily accessible and providing them at positions different from each other, the safety and security can be enhanced. In FIG. 3A, the control device 20 is connected to the second ECU 80 via the first ECU 70, but the control device 20 and the second ECU 80 may be directly connected.

[0035] FIG. 3B is a schematic configuration diagram showing an implementation example of the arithmetic unit 60.

[0036] In this example, three arithmetic units 60 (60a, 60b, 60c) are provided inside the housing 15. A temperature sensor 17 is attached to the surface of the housing 15.

[0037] A plurality of arithmetic resources 12 are mounted on the arithmetic unit 60a, and a connection part 61 and a pair of sockets 62, 63 are provided. An arithmetic unit 60b on which a plurality of arithmetic resources 12 are mounted is attached to one socket 62. An arithmetic unit 60c on which a plurality of arithmetic units 60 are mounted is attached to the other socket 63. In this way, the in-vehicle system 11 of the present disclosure is characterized in that an external arithmetic unit 60 (for example, arithmetic units 60a, 60b, 60c) that is not necessary for vehicle control is incorporated in a form that can be attached to and detached from the vehicle so that an operation different from vehicle control can be performed.

[0038] Operations different from vehicle control include, for example, the aforementioned grid operation, recognition of environmental information inside and outside the company to improve the comfort of vehicle occupants, monitoring of the biometric information of the occupants, and / or content processing provided to the occupants.

[0039] As described above, when the arithmetic unit 60 can be attached to and detached from the vehicle 10, that is, when the arithmetic unit 60 can be retrofitted and added, there is a possibility that an arithmetic unit 60 that is not a genuine product (referred to as a "non-genuine product" or "non-genuine arithmetic unit") may be attached. For non-genuine products, there are problems such as inability to guarantee operation, or there is a risk of deterioration in the quality of service provided to passengers. Also, even when a non-genuine product is attached, the running control side of the vehicle 10 must be made to have no adverse effects.

[0040] Therefore, in the present disclosure, when it is confirmed that the arithmetic unit 60 is attached to a connection module provided in the vehicle 10 (for example, including the connection part 61 and the sockets 62, 63), power is supplied to the arithmetic unit 60 to execute a test program. The change in power consumption and / or the change in temperature of the arithmetic unit 60 during the execution of the test program are measured. Based on the calculation result of the test program, the turn-around time (TAT), the change in power consumption, and / or the change in temperature, it is determined whether the arithmetic unit 60 is a genuine product. And when it is determined to be a genuine product, access from the arithmetic unit 60 to other ECUs (for example, the first ECU 70 and / or the second ECU 80) mounted in the vehicle is permitted. Thereby, the authentication process can be completed in the vehicle, and the authentication accuracy can be improved as compared with the method of using a conventional authentication code or the like.

[0041] Here, the connection part 61 and / or the sockets 62, 63 are an example of a connection part. Note that the method for confirming the connection of the arithmetic unit 60 to the connection module (for example, including the connection part 61 and the sockets 62, 63) is not particularly limited, and conventionally known connection detection means can be used.

[0042] FIG. 4 shows a more detailed block diagram of the in-vehicle system 11.

[0043] - Control device - As shown in FIG. 4, the control device 20 includes a power supply control module 25, an authentication module 30, and a relay module 40.

[0044] <Power supply control module> The power supply control module 25 receives power supply from the vehicle power supply system 13. Then, it supplies power to the arithmetic unit 60 based on the power supply control signal received from the activation control module 35 described later.

[0045] <Authentication module> The authentication module 30 includes a first collation module 31, a second collation module 32, a first memory 33, a second memory 34, and an activation control module 35.

[0046] The first memory 33 stores a test program to be executed by the arithmetic unit 60, the correct result of the test program, the standard turnaround time (hereinafter referred to as "standard TAT") when the test program is executed, and register change information in the test program, etc. Note that a plurality of test programs may be stored in the first memory 33, and a test program randomly selected from the plurality of test programs may be executed. Also, when corresponding to the attachment and detachment of a plurality of types of arithmetic units 60 as genuine products, the first memory 33 stores, for example, the correct result of the test program and the standard TAT prepared for each arithmetic unit 60. The first memory 33 is an example of a storage unit.

[0047] The test program is preferably formed to operate almost all of the arithmetic resources 12 mounted on the arithmetic unit 60. Also, it is preferably configured so that the mounted memory capacity of the arithmetic unit 60 can be estimated. The test program may include a program that rewrites the registers of the arithmetic unit 60 (for example, the arithmetic resources 12) and executes test operations. By observing the difference in the register space and the difference in the operation of the arithmetic unit 60 when the register is changed, it may be a clue for discriminating between genuine and non-genuine arithmetic units 60.

[0048] Before transferring the test program, the first verification module 31 activates the communication channel used for testing the arithmetic unit 60. Then, it transfers the test program retrieved from the first memory 33 to the arithmetic unit 60 of the first memory.

[0049] Furthermore, when the arithmetic result of the test program is recovered from the arithmetic unit 60, the first verification module 31 verifies it with the correct result stored in the first memory 33. Also, it measures the TAT from the start to the end of the test program and determines whether it meets a predetermined judgment criterion (for example, whether the error from the standard TAT is within a predetermined time range). The verification result with the correct result and the comparison result with the standard TAT are transmitted to the startup control module 35.

[0050] The second memory 34 stores information on the standard power consumption change (hereinafter referred to as "standard power consumption data") and information on the standard temperature change (hereinafter referred to as "standard temperature data") when the test program is executed. When it is compatible with the attachment and detachment of multiple types of arithmetic units 60 (for example, arithmetic units 60a to 60c) as genuine products, the second memory 34 stores, for example, the standard power consumption data and the standard temperature data for each arithmetic unit 60.

[0051] The second verification module 32 measures the transition of the power consumption (consumption current / voltage) and the temperature transition of the arithmetic unit 60. For measuring the temperature transition, a temperature sensor (not shown) built into the arithmetic unit 60 or the aforementioned temperature sensor 17 can be used.

[0052] When the execution of the test program in the arithmetic unit 60 is completed, the second collation module 32 compares the transition of the power consumption of the arithmetic unit 60 during the execution of the test program with the standard power consumption data, and determines whether the determination criteria are satisfied (for example, whether the error between the two is within a predetermined power range). Similarly, when the execution of the test program in the arithmetic unit 60 is completed, the second collation module 32 compares the temperature transition of the arithmetic unit 60 during the execution of the test program with the standard temperature data, and determines whether the determination criteria are satisfied (for example, whether the error between the two is within a predetermined temperature range). The comparison result between the power consumption transition and the standard power consumption data and the comparison result between the temperature transition and the standard temperature data are transmitted to the startup control module 35.

[0053] The startup control module 35 generates and outputs an enable signal for starting functional blocks other than the arithmetic unit 60, such as the first ECU 70 and the second ECU 80.

[0054] The startup control module 35 generates a power supply control signal for controlling the power supply control module 25 and outputs it to the power supply control module 25.

[0055] The startup control module 35 receives the execution result of the test program from the first collation module 31 and the second collation module 32. Then, based on the received result, it generates a relay control signal for controlling the relay operation of the relay module 40 and outputs it to the relay module 40. The specific operation of the startup control module 35 will be described later.

[0056] 〈Relay Module〉 The relay module 40 is provided between the arithmetic unit 60 and the first ECU 70, and switches the conduction / interruption of the connection between the arithmetic unit 60 and the first ECU 70 based on the relay control signal received from the startup control module 35. The method for switching the conduction and interruption of the connection between the arithmetic unit 60 and the first ECU 70 is not particularly limited. For example, a switch (not shown) for switching conduction / interruption is provided between the arithmetic unit 60 and the first ECU 70, and there is a method of switching its on / off. Also, for example, the clock of the communication circuit connected to the arithmetic unit 60 may be stopped, or the power supply to the I / O circuit (not shown) connected to the arithmetic unit 60 may be stopped. The relay module is an example of a communication module.

[0057] The specific operation of the relay module 40 will be described later. In the initial state, the connection between the arithmetic unit 60 and the first ECU 70 is interrupted.

[0058] -Operation of the in-vehicle system- Next, with reference to FIG. 5, the operation of the in-vehicle system will be described. Note that the process (series of flows) in FIG. 5 is executed, for example, every time the power of the vehicle 10 is turned on.

[0059] 〈Step S1〉 In step S1, when the power of the vehicle (for example, the ignition switch) is turned on, power is supplied from the vehicle power supply system 13 to the power supply control module 25.

[0060] Also, the startup control module 35 releases the reset state of the hardware other than the arithmetic unit 60 and starts up the hardware other than the arithmetic unit 60. As a result, the first ECU 70 and the second ECU 80 start operating.

[0061] 〈Step S2〉 In the next step S2, the authentication module 30 checks whether the arithmetic unit 60 that is not used for the vehicle's driving control is connected via the connection part 61 and the sockets 62, 63. If the arithmetic unit 60 is not connected (NO in step S2), the authentication process in FIG. 5 ends.

[0062] On the other hand, when the arithmetic unit 60 is connected via the connection unit 61 and the sockets 62 and 63 (NO in step S2), the flow proceeds to step S3 and the test program is executed.

[0063] 〈Step S3〉 In step S3, first, the startup control module 35 transmits a power supply control signal to the power supply control module 25 to start power supply to the arithmetic unit 60. The first collation module 31 activates the communication channel used for testing the arithmetic unit 60.

[0064] Next, the first collation module 31 transfers the test program retrieved from the first memory 33 to the arithmetic unit 60 to cause the arithmetic unit 60 to execute the test program. The second collation module 32 starts measuring the transition of the power (current / voltage) and temperature transition of the arithmetic unit 60.

[0065] In the first collation module 31, when the calculation result of the test program is recovered from the arithmetic unit 60, it is collated with the correct result stored in the first memory 33. Also, it is confirmed whether the TAT from the start to the end of the test program satisfies the judgment criteria. The collation result with the correct result and the judgment result of the TAT are transmitted to the startup control module 35.

[0066] Also, in the second collation module 32, it is confirmed whether the power consumption transition (power consumption transition data) and temperature transition (temperature transition data) of the arithmetic unit 60 during the execution period of the test program satisfy the judgment criteria. For the judgment, as described above, for example, standard power consumption data and standard temperature data are used. The judgment results of the power transition and temperature transition are transmitted to the startup control module 35.

[0067] The startup control module 35 receives the execution result (judgment result) of the test program from the first collation module 31 and the second collation module 32, and based on the result, determines whether the arithmetic unit 60 is a genuine product or a non-genuine product.

[0068] Specifically, the startup control module 35 determines that the device is a genuine product when (1) the calculation result of the test program by the arithmetic unit 60 is the same as the correct result stored in the first memory 33, (2) the TAT from the start to the end of the test program meets a predetermined judgment criterion, (3) the power consumption transition of the arithmetic unit 60 during the execution period of the test program meets a predetermined judgment criterion, and (4) the temperature transition of the arithmetic unit 60 during the execution period of the test program meets a predetermined judgment criterion. In this case, the flow proceeds to step S5.

[0069] On the other hand, when there is at least one condition among the above (1) to (4) that is not satisfied, the startup control module 35 determines that the arithmetic unit 60 is a non-genuine product. In this case, the flow proceeds to step S6.

[0070] 〈Step S5〉 In step S5, the startup control module 35 transmits a relay control signal for activating the connection between the arithmetic unit 60 and the first ECU 70 to the relay module 40. The relay module 40 switches the connection between the arithmetic unit 60 and the first ECU 70 to conduction. As a result, information can be transmitted and received between the arithmetic unit 60 and the first ECU 70.

[0071] 〈Step S6〉 In step S6, the startup control module 35 transmits a power supply control signal to the power supply control module 25 to stop the power supply to the arithmetic unit 60. In other words, while the connection between the arithmetic unit 60 and the first ECU 70 is cut off, the power supply of the arithmetic unit 60 is turned off. As a result, the non-genuine arithmetic unit 60 cannot access the ECU used for vehicle control such as the first ECU 70, so the adverse effects caused by the connection of the non-genuine product can be eliminated. Also, since the power supply of the arithmetic unit 60 itself is turned off, it is possible to prevent unintended processing from being performed or unnecessary power consumption from occurring in the arithmetic unit 60.

[0072] Note that until the processing of step S5 or step S6 is completed, the vehicle may be prevented from being put into a state where it can move. This can more reliably prevent an adverse effect on the vehicle's driving control due to the connection of the arithmetic unit 60.

[0073] The above-described embodiments are merely examples, and the scope of the present disclosure should not be construed in a limiting manner. The scope of the present disclosure is defined by the claims, and all modifications and changes belonging to the equivalent scope of the claims are within the scope of the present disclosure.

[0074] For example, in the above embodiment, the power supply to the arithmetic unit 60 is assumed to be supplied from the vehicle power supply system 13, but it is not limited thereto. For example, a power supply board (not shown) different from the vehicle power supply system 13 may be prepared, and power may be supplied to the arithmetic unit 60 from that power supply board. And when the arithmetic unit 60 fails the authentication, that is, when it is determined to be a non-genuine product, it may be configured so that only the non-genuine arithmetic unit 60 can be powered off. This can save the waste of power caused by operating the non-genuine arithmetic unit 60.

[0075] In the above embodiment, it is not always necessary to measure both the power transition and the temperature transition of the arithmetic unit 60, and either one may be sufficient. For example, when the performance of the arithmetic unit 60 is relatively high and the power consumption or temperature changes significantly when a test program is run, sufficient accuracy in determining genuine / non-genuine products may be ensured by monitoring either the power transition or the temperature transition.

[0076] In the above-described embodiment, for example, a temperature adjustment device (not shown) for adjusting the temperature inside the housing 15 (the arithmetic unit) to a predetermined temperature may be provided, or a constant temperature device 68 (see FIG. 3B) for heating or cooling the substrate of the arithmetic unit 60 to adjust the temperature of the arithmetic unit 60 may be provided. Then, before executing the test program, the arithmetic unit 60 may be heated or cooled to a predetermined temperature, and the test program (step S3 in FIG. 5) may be executed in that state. Further, the test program may be executed under a plurality of temperature conditions. Thereby, it is possible to create an environment in which it is easy to monitor the power transition and / or temperature transition during the execution period of the test program.

[0077] In the above-described embodiment, the relay module 40 is interposed between the arithmetic unit 60 and the first ECU 70 to switch the conduction / non-conduction of the connection between the two, but the present invention is not limited to this. For example, in FIG. 4, the arithmetic unit 60 and the second ECU 80 are connected without passing through the relay module 40. In this example, the second ECU 80 includes a communication control module 85 and a communication module 86. The communication module 86 has a switching function for switching the conduction / non-conduction of the connection between the arithmetic unit 60 and the internal circuit or other hardware of the second ECU 80. The communication control module 85 receives the authentication information of the arithmetic unit 60 from the startup control module 35, and outputs a communication control signal for operating the switching function of the communication module 86 based on the authentication information. Specifically, when the arithmetic unit 60 is determined to be a genuine product, the communication control module 85 controls to conduct the switching function of the communication module 86, and when the arithmetic unit 60 is determined to be a non-genuine product, the communication control module 85 controls to cut off the switching function of the communication module 86. Thereby, the same effect as the above-described embodiment can be obtained.

[0078] In the above embodiment, FIG. 4 shows an example in which the control device 20 and the first ECU 70 are provided separately, but the present invention is not limited thereto. For example, as shown in FIG. 6, the functions of the control device 20 may be incorporated into the first ECU 70. In FIG. 6, blocks having functions corresponding to those in FIG. 4 are given common reference numerals. FIG. 6 differs from the configuration of FIG. 4 in that the relay module 40 is removed and the management module 28 is provided. In this example, the first ECU 70 functions as an authentication device.

[0079] The management module 28 has a function of controlling and managing the arithmetic unit 60 determined to be a genuine product after authentication (during normal operation). Specifically, as control and management of the arithmetic unit 60, the management module 28 performs, for example, (1) start / stop of the arithmetic unit 60, (2) setting of the operation mode of the arithmetic unit 60, (3) management of the operation status information of the arithmetic unit 60, and (4) management of the diagnostic result information of the arithmetic unit 60. The operation mode includes, for example, a low-power arithmetic mode, a high-performance arithmetic mode, and an idle mode (standby mode). The operation status includes the usage ratio / arithmetic efficiency of the internal arithmetic unit of the arithmetic unit 60. The management of the operation status includes confirmation of whether or not the device is in a runaway state.

[0080] Note that the functions (control and management) of the management module 28 in the configuration of FIG. 4 are realized by, for example, the relay module 40 (see FIG. 4).

[0081] Also in the configuration of FIG. 6, when the arithmetic unit 60 is determined to be a genuine product, control is performed to conduct the switching function of the communication module 86 provided between the arithmetic unit 60 and the internal circuit 72 of the first ECU 70 or other hardware HW3. On the other hand, when the arithmetic unit 60 is determined to be a non-genuine product, control is performed to cut off the switching function of the communication module 86. Thereby, the same effects as those of the above embodiment can be obtained.

[0082] In the above-described embodiment, the calculation result in the arithmetic unit 60 may be used for providing information to the driver or the like. Specifically, it is assumed that the arithmetic unit 60 performs calculations to recognize the external environment and the environment in the vehicle interior (the state of the occupant) in more detail, and uses this for alerting the driver. Even in such a case, the technical idea of the present disclosure can be applied. Specifically, when the arithmetic unit 60 is attached to the connection part 61 or the sockets 62, 63, it is made to be determined as YES in step S2 of FIG. 5, and a test program in step S3 may be executed on the substrate to which it is connected. In this case, the subsequently attached arithmetic unit 60 is recognized as a second arithmetic unit. Thereby, the same effect as in the above-described embodiment can be obtained. As described above, the connection part 61 and the sockets 62, 63 in this example are examples of connection parts. Although not shown, as the connection part, configurations other than sockets, for example, terminal blocks, connectors, connection terminals on the substrate, etc. may be used.

Industrial Applicability

[0083] The technology disclosed herein is useful for authenticating an arithmetic unit attached to a vehicle.

Explanation of Signs

[0084] 10 Vehicle 22, 23 Socket (connection part) 30 Authentication module 33 First memory (storage part) 40 Relay module (communication module) 60 Arithmetic unit (second arithmetic unit) 61 Connection part 62 Socket (connection part) 63 Socket (connection part) 70 First ECU (first arithmetic unit) 80 Second ECU (first arithmetic unit) 86 Communication module

Claims

1. An in-vehicle system mounted on a vehicle, comprising: a first arithmetic unit used for vehicle control; a second arithmetic unit installed at a location different from the first arithmetic unit within the vehicle; a communication module that conducts or cuts off communication between the first arithmetic unit and the second arithmetic unit based on a communication control signal; a storage unit storing a test program to be used for the second arithmetic unit; a collation module that causes the second arithmetic unit to execute the test program, and determines whether the second arithmetic unit is a genuine product based on the execution result of the test program received from the second arithmetic unit, the execution time of the test program, and the transition data of the power consumption and / or temperature of the second arithmetic unit during the execution period of the test program, and outputs the communication control signal based on the determination result; The in-vehicle system, wherein when the collation module determines that the second arithmetic unit is a genuine product, it controls the communication module to be in a conductive state, while when it determines that the second arithmetic unit is a non-genuine product, it sets the communication module to a cut-off state and controls to cut off the power supply to the second arithmetic unit.

2. An in-vehicle system mounted on a vehicle, comprising: a first arithmetic unit used for vehicle control; a connection part to which an external second arithmetic unit is detachably configured; a storage unit storing a test program to be used for the second arithmetic unit; a collation module that causes the second arithmetic unit to execute the test program when the connection of the second arithmetic unit to the connection part is confirmed, and determines whether the second arithmetic unit is a genuine product based on the execution result of the test program received from the second arithmetic unit, the execution time of the test program, and the transition data of the power consumption and / or temperature of the second arithmetic unit during the execution period of the test program, and outputs a communication control signal based on the determination result; a communication module that conducts or cuts off communication between the first arithmetic unit and the second arithmetic unit based on the communication control signal; The in-vehicle system, wherein when the collation module determines that the second arithmetic unit is a genuine product, it controls the communication module to be in a conductive state, while when it determines that the second arithmetic unit is a non-genuine product, it sets the communication module to a cut-off state and controls to cut off the power supply to the second arithmetic unit.

3. The in-vehicle system according to claim 1 or 2, wherein each time power is supplied to the vehicle, the verification module causes the second arithmetic unit to execute the test program to determine whether the second arithmetic unit is a genuine product.

4. The in-vehicle system according to claim 1 or 2, wherein the communication module is provided inside the first arithmetic unit.

5. The in-vehicle system according to claim 1, wherein the second arithmetic unit is installed in a location where external access is easier compared to the first arithmetic unit.

6. The in-vehicle system according to claim 2, wherein the connection part is installed in a location where external access is easier compared to the first arithmetic unit.

Images