Control device and control method

Abstract

To provide a control device and a control method capable of increasing variations in random numbers.SOLUTION: A control device according to an embodiment includes a control unit. The control unit performs a buffer update process of updating a buffer for random number generation on the basis of a timer value every time a timer value is intermittently obtained, and a random number generation process of generating a random number used for authentication of an update control device that controls program update on the basis of the updated buffer. The control unit performs a transmission process of transmitting communication data to an external device and an interrupt process due to a response to the communication data received from the external device in a period during which the buffer update process is being performed, thereby changing buffer update timing.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a control device and a control method. [Background technology]

[0002] Conventionally, there is a technology for authenticating a device that updates a program executed by a control device using a random number generated by the control device. For example, this type of control device has a technology for intermittently acquiring a timer value and updating a buffer for generating random numbers (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-26290 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in conventional technology, when a high-precision timer is used, the variation in the generated random numbers decreases, which reduces authentication accuracy and may reduce security when updating programs.

[0005] The present invention has been made in view of the above, and has an object to provide a control device and a control method that can increase the variation in random numbers. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the object, a control device according to the present invention includes a control unit. The control unit performs a buffer update process that updates a buffer for random number generation based on a timer value each time the timer value is intermittently acquired, and a random number generation process that generates a random number used for authenticating an update control device that controls program updates based on the updated buffer. During the buffer update process, the control unit changes the update timing of the buffer by performing a transmission process that transmits communication data to an external device and an interrupt process in response to the communication data received from the external device. [Effects of the Invention]

[0007] According to the present invention, the variation in random numbers can be increased. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a functional block diagram showing an example of the configuration of a program update system including a control device according to an embodiment. [Figure 2] FIG. 2 is a functional block diagram illustrating an example of the configuration of the control device according to the embodiment. [Figure 3] FIG. 3 is a diagram for explaining a method for updating entropy by the random number generation unit. [Figure 4] FIG. 4 is a sequence diagram showing the procedure of the authentication process executed in the program update system according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of a control device and a control method disclosed in the present application will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described below.

[0010] 1 is a functional block diagram showing an example of the configuration of a program update system S including a control device 1 according to an embodiment. The program update system S shown in FIG. 1 updates a program executed by the control device 1 using an update control device 100 that has been authenticated by the control device 1.

[0011] As shown in FIG. 1, a program update system S according to the embodiment includes a control device 1, an engine 10, an external device 50, and an update control device 100.

[0012] The control device 1 is an ECU (Electronic Control Unit) mounted on the vehicle C, and executes a control method according to the embodiment. The control device 1 also performs control related to the vehicle C. In the present disclosure, the control device 1 controls the engine 10 mounted on the vehicle C by executing a control program for the engine 10.

[0013] The control device 1 also communicates with the update control device 100 to update the control program of the engine 10. The control device 1 also performs processing related to authentication of the update control device 100. Specifically, when the control device 1 receives a random number request from the update control device 100, the control device 1 generates a random number used to authenticate the update control device 100 and transmits it to the update control device 100.

[0014] Specifically, the control device 1 generates random numbers by performing a buffer update process and a random number generation process. The buffer update process is a process of updating a buffer for random number generation based on a timer value each time the timer value is intermittently acquired. The random number generation process is a process of generating a random number to be used for authenticating the update control device 100 based on the buffer updated by the buffer update process. Details of the buffer update process and the random number generation process will be described later.

[0015] Then, each of the control device 1 and the update control device 100 generates an authentication key using a random number. Then, the control device 1 acquires the authentication key generated by the update control device 100 and performs authentication by comparing it with the authentication key generated by itself.

[0016] Here, since the period for performing the buffer update process is conventionally fixed, when a high-precision timer is used, the difference in the timing of the buffer update becomes small, and there is a risk that the variation in the generated random numbers will become small. As a result, when such random numbers are used, the accuracy of authentication decreases, and there is a risk that security during program updates will be reduced.

[0017] Therefore, the control device 1 according to the embodiment changes the buffer update timing by performing an interrupt process during the period in which the buffer update process is being performed.

[0018] Specifically, during the period when the buffer update process is being performed, the control device 1 changes the buffer update timing by performing a transmission process to send communication data to the external device 50 and an interrupt process in response to the communication data received from the external device 50.

[0019] That is, the control device 1 according to the embodiment temporarily suspends the buffer update process that is performed at regular intervals and interrupts it with another process, thereby intentionally shifting the update timing of the buffer update process.

[0020] Furthermore, the time required from transmitting communication data to receiving a response is not constant each time, as it depends on the processing status of the external device 50. In other words, the timing of performing interrupt processing is not the same each time.

[0021] Therefore, the control device 1 performs interrupt processing at different timings each time, thereby changing the update timing at various times, and thus can vary the entropy of the buffer. In other words, the control device 1 according to the embodiment can increase the variation in the random numbers generated by the buffer.

[0022] The control device 1 according to the embodiment will be described in detail below with reference to FIG. 2 and subsequent figures.

[0023] Next, an example of the functional configuration of the control device 1 according to the embodiment will be described with reference to Fig. 2. Fig. 2 is a functional block diagram showing an example of the configuration of the control device 1 according to the embodiment. The control device 1 shown in Fig. 2 is connected to an engine 10, an external device 50, and an update control device 100.

[0024] The engine 10 is a power source for the vehicle C. The engine 10 generates power under the control of the control device 1, and applies the rotational force obtained from the generated power to the drive wheels of the vehicle C.

[0025] The external device 50 is, for example, an ECU that controls the vehicle C. Note that the external device 50 is not limited to an ECU, and may be an external server or the like. In other words, the external device 50 may be any device that is capable of two-way communication with the control device 1.

[0026] The update control device 100 is, for example, a terminal device owned by a worker who performs the update work, and is detachably connected to the control device 1. The update control device 100 can be any type of terminal device, such as a smartphone, a desktop PC, a notebook PC, or a tablet PC.

[0027] 2, the control device 1 includes a control unit 2 and a storage unit 3. The control unit 2 includes a vehicle control unit 21, an update control unit 22, and a clock generation unit 23. The storage unit 3 stores a first program 31, a second program 32, and a buffer 33.

[0028] The control unit 2 includes a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), etc., and various other circuits. The control unit 2 controls the operation of the control device 1 by having the CPU execute a program stored in the ROM using the RAM as a working area. The control unit 2 may be configured with hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The storage unit 3 is configured with a storage device such as a non-volatile memory, a flash memory, or a hard disk drive.

[0029] In the present disclosure, the first program 31 is a control program for the engine 10, and is a program to be updated by the update control device 100. The first program 31 is executed by the vehicle control unit 21.

[0030] The second program 32 is a program for updating the first program 31. The second program 32 is executed by the update control unit 22.

[0031] The buffer 33 stores entropy 331 for generating random numbers used for authenticating the update control device 100 .

[0032] Next, each function of the control unit 2 (vehicle control unit 21, update control unit 22, and clock generation unit 23) will be described.

[0033] The vehicle control unit 21 executes a first program 31 stored in the storage unit 3 to control the engine 10 .

[0034] The update control unit 22 executes the second program 32 stored in the storage unit 3 to update the first program 31 stored in the storage unit 3. The functional configuration of the update control unit 22 will be described later.

[0035] Clock generation unit 23 generates a plurality of clock signals with different frequencies. Clock generation unit 23 outputs the generated clock signals to vehicle control unit 21 and update control unit 22. Vehicle control unit 21 and update control unit 22 operate in synchronization with the clock signals. The clock signals are also used to generate timer values ​​in the buffer update process of update control unit 22.

[0036] Next, a specific description will be given of the functional configuration of the update control unit 22. As shown in Fig. 2, the update control unit 22 includes an authentication unit 221, a random number generation unit 222, an authentication key generation unit 223, and a timing change unit 224.

[0037] The authentication unit 221 communicates with the update control device 100 to authenticate the update control device 100. Specifically, when the authentication unit 221 receives a random number request from the update control device 100 to request transmission of a random number, the authentication unit 221 transmits a random number generated by a random number generation unit 222 (described later) to the update control device 100.

[0038] In addition, after transmitting the random number to the update control device 100, the authentication unit 221 obtains an authentication key generated based on the random number from the update control device 100, and also obtains an authentication key generated by the authentication key generation unit 223 described later.

[0039] Then, the authentication unit 221 authenticates the update control device 100 based on the authentication key generated by the update control device 100 and the authentication key generated by the authentication key generation unit 223, and transmits the authentication result to the update control device 100.

[0040] Specifically, if the authentication key generated by the update control device 100 matches the authentication key generated by the authentication key generation unit 223, the authentication unit 221 authenticates the update control device 100 and notifies the update control device 100 that it has been authenticated.

[0041] On the other hand, if the authentication key generated by the update control device 100 does not match the authentication key generated by the authentication key generating unit 223, the authentication unit 221 notifies the update control device 100 that it cannot authenticate the update control device 100. At this time, the authentication unit 221 may request the update control device 100 to regenerate (or retransmit) the authentication key.

[0042] The random number generation unit 222 executes the buffer update process and the random number generation process shown in Fig. 1. The random number generation unit 222 executes the buffer update process using the clock signal received from the clock generation unit 23.

[0043] First, in the buffer update process, the random number generation unit 222 counts each clock signal with a different frequency received from the clock generation unit 23. The random number generation unit 222 obtains each count value of the clock signal as a timer value, and updates each bit value of the entropy 331 stored in the buffer 33 based on each timer value. The method for updating the entropy 331 will be described later with reference to FIG. 3.

[0044] When the random number generation unit 222 receives a random number request from the update control device 100, it ends the buffer update process and performs random number generation process. Specifically, when the random number generation unit 222 receives a random number request from the update control device 100, it reads the entropy 331 from the buffer 33 and converts the read entropy 331 into a random number.

[0045] Note that there are no limitations on the algorithm for generating random numbers as long as the random numbers are generated based on entropy 331. Furthermore, the random numbers may be true random numbers or pseudo-random numbers.

[0046] In addition, when a transmission process or an interrupt process is performed by the timing change unit 224 described later, the random number generation unit 222 temporarily suspends the buffer update process and resumes the buffer update process after the transmission process or the interrupt process is completed.

[0047] Furthermore, it is preferable that the random number generation unit 222 sets the processing priority of the buffer update process lower than other processes other than the interrupt process executed by the control unit 2. This allows processes other than the interrupt process to have priority over the buffer update process, thereby making it possible to vary the entropy 331.

[0048] The random number generation unit 222 transmits the generated random number to the authentication key generation unit 223 and also to the update control device 100 via the authentication unit 221 .

[0049] The authentication key generation unit 223 generates an authentication key using the random number received from the random number generation unit 222. The authentication key generation unit 223 outputs the generated authentication key to the authentication unit 221. The algorithm used to generate the authentication key is not particularly limited. For example, the Advanced Encryption Standard (AES) is used to generate the authentication key. The encryption key used to generate the authentication key in the authentication key generation unit 223 may be the same as or different from the encryption key used to generate the authentication key in the update control device 100.

[0050] During the period when the random number generation unit 222 is performing the buffer update process, the timing change unit 224 performs a transmission process to send communication data to the external device 50 and an interrupt process in response to the communication data received from the external device 50, thereby changing the update timing of the buffer 33 in the buffer update process.

[0051] For example, the timing change unit 224 performs the transmission process at a predetermined timing during the period in which the buffer update process is being performed. The timing of the transmission process may be a fixed timing, such as a predetermined time (e.g., one second) after the start of the buffer update process, or may be a random timing.

[0052] Alternatively, the timing change unit 224 may perform the transmission process using a notification sent from the external device 50 as a trigger. The transmission process may be performed multiple times, not just once, and the number of times the transmission process is performed may vary each time.

[0053] Moreover, the communication data that is transmitted is dummy data that includes only a response request to the control device 1. In other words, when the external device 50 receives the communication data, it does not perform any processing other than responding to the control device 1. This makes it possible to minimize the processing that the external device 50 performs (only responding to the control device 1).

[0054] The communication data may be data that instructs the external device 50 to respond after performing a predetermined process. This causes variations in the timing of receiving a response to the communication data, which can further vary the entropy 331.

[0055] Then, after performing the transmission process, the timing change unit 224 performs an interrupt process to receive a response to the communication data transmitted from the external device 50. As a result, the buffer process by the random number generation unit 222 is temporarily suspended and the interrupt process by the timing change unit 224 is performed, so that the entropy 331 in the buffer 33 can be varied.

[0056] The interrupt process is a process for simply receiving a response to the communication data, and it is preferable that no other process be performed on the response to the communication data. This makes it possible to minimize the processing load on the update control unit 22 while varying the entropy 331.

[0057] Next, a method for updating entropy 331 by random number generation unit 222 will be described with reference to Fig. 3. Fig. 3 is a diagram for explaining a method for updating entropy 331 by random number generation unit 222. Fig. 3 describes an update method using three timer values ​​(first timer value to third timer value) obtained from three clock signals with different frequencies.

[0058] As shown in Fig. 3, the random number generation unit 222 first performs a logical operation on any two timer values ​​from the first timer value to the third timer value. In the example shown in Fig. 3, the random number generation unit 222 extracts the least significant bit values ​​(bold frames) of the first timer value and the third timer value, and calculates the exclusive OR 200. In Fig. 3, if the least significant bit value of the first timer value is "1" and the least significant bit value of the third timer value is "0", the output bit value of the exclusive OR 200 is "1".

[0059] Next, the random number generation unit 222 performs a logical operation on the output bit value of the obtained exclusive OR 200 and the least significant bit value of the second timer value. In the example shown in Fig. 3, the random number generation unit 222 obtains an exclusive OR 201 of the output bit value of the obtained exclusive OR 200 and the least significant bit value of the second timer value. In Fig. 3, when the output bit value is "1" and the least significant bit value of the second timer value is "0", the output bit value of the exclusive OR 201 is "1".

[0060] Next, the random number generation unit 222 performs a logical operation on the output bit value of the exclusive OR 201 and the least significant bit value of the entropy 331 before the update stored in the buffer 33 stored in the storage unit 3. In the example shown in Fig. 3, the random number generation unit 222 calculates the exclusive OR 202 between the output bit value of the exclusive OR 201 and the least significant bit value of the entropy 331 before the update. In Fig. 3, when the output bit value is "1" and the least significant bit value of the entropy 331 before the update is "1", the output bit value of the exclusive OR 202 is "0".

[0061] Then, the random number generation unit 222 updates the entropy 331 by replacing the least significant bit value of the entropy 331 before the update with the output bit value of the exclusive OR 202. In the example shown in Fig. 3, the least significant bit value "1" of the entropy 331 before the update is updated to the least significant bit value "0" after the update.

[0062] That is, the random number generation unit 222 updates the entropy 331 of the buffer 33 using the value resulting from the logical operation of the three timer values ​​and the entropy 331 before the update. In this way, by performing a buffer update process that includes elements of the three timer values ​​and the entropy 331 before the update, the entropy 331 can be varied.

[0063] Furthermore, by using three timer values ​​with different frequencies, the randomness of the logical operation results of the three timer values ​​can be increased, and therefore the entropy 331 can be varied.

[0064] 3 shows an example of updating the least significant bit value of entropy 331, but after updating the least significant bit value, the bit value one level higher is updated using the same update method as shown in Fig. 3. In other words, after updating the bit value at the current update position, the buffer update process is performed with the bit value one level higher as the new update position. Then, when updating of the most significant bit value is completed, the buffer update process is performed again, returning to the least significant bit value.

[0065] The buffer update process is not limited to exclusive OR, but may be logical OR, logical AND, etc., or may be a combination of multiple types of logical operations. Furthermore, the timer value used in the logical operation is not limited to the least significant bit value, but may be a bit value at any position.

[0066] Next, the procedure of the authentication process executed in the program update system S according to the embodiment will be described with reference to Fig. 4. Fig. 4 is a sequence diagram showing the processing procedure of the authentication process executed in the program update system S according to the embodiment. The authentication process shown in Fig. 4 is performed by the driver (owner) of the vehicle C when the vehicle C is brought to a dealer. At the dealer, an operator connects the update control device 100 to the control device 1 to start communication with the control device 1, thereby performing the authentication process.

[0067] 4, first, the update control device 100 transmits a repro mode transition request (step S1). Repro mode is a mode in which a second program that updates a program is executed, and the repro mode transition request is a message instructing the control device 1 to start the update control unit 22.

[0068] Next, when the control device 1 receives a reproductive mode transition request from the update control device 100, it transmits a reproductive mode transition response to the update control device 100 (step S2). The reproductive mode transition response is a message notifying that a transition to reproductive mode will begin.

[0069] When the update control device 100 receives a reproductive mode transition response from the control device 1, it waits until a preset waiting time has elapsed, and after the waiting time has elapsed, it executes step S10, which will be described later. The waiting time is determined based on the reproductive mode transition time required for the control device 1 to stop the vehicle control unit 21 and start the update control unit 22. Specifically, the waiting time should be longer than the reproductive mode transition time.

[0070] After transmitting the reproduction mode transition response, the control device 1 executes a reset process (step S3). Specifically, the reset process stops the vehicle control unit 21 (stops execution of the first program 31) and starts the update control unit 22 (starts execution of the second program 32).

[0071] Next, the control device 1 starts the update control unit 22 and then acquires the timer value (step S4). Next, the control device 1 updates the value of one bit among the bit values ​​in the entropy 331 of the buffer 33 based on the acquired timer value (step S5).

[0072] Next, the control device 1 executes a transmission process to transmit communication data to the external device 50 (step S6). The transmission process can be performed at any timing during the standby time (the time from step S2 to step S10). Although Fig. 4 shows an example in which the transmission process is performed once, it may be performed two or more times.

[0073] Next, the control device 1 executes interrupt processing in response to the communication data received from the external device 50 (step S7). Note that the control device 1 may wait for the buffer update processing (obtaining a timer value and updating the buffer) between steps S6 and S7, or may execute the buffer update processing until receiving the communication data response in step S7.

[0074] Next, the control device 1 acquires the timer value (step S8), and updates the value of one bit among the bit values ​​in the entropy 331 of the buffer 33 based on the acquired timer value (step S9).

[0075] Next, after the waiting time has elapsed, the update control device 100 transmits a random number request requesting transmission of a random number (step S10). The random number request is a message requesting transmission of a random number used for authentication of the update control device 100.

[0076] Next, when the control device 1 receives a random number request from the update control device 100, the control device 1 ends the buffer update process and acquires the buffer 33 after the update of the buffer update process (step S11).

[0077] Next, the control device 1 generates a random number using the acquired entropy 331 stored in the buffer 33 (step S12). Next, the control device 1 transmits a random number response including the generated random number to the update control device 100 (step S13).

[0078] Next, each of the control device 1 and the update control device 100 generates an authentication key using a random number (step S14). Next, the update control device 100 transmits the generated authentication key to the control device 1 (step S15).

[0079] Next, the control device 1 performs authentication processing for the update control device 100 by comparing the authentication key that it has generated with the authentication key received from the update control device 100 (step S16).

[0080] Next, the control device 1 transmits an authentication result response including an authentication result according to the comparison result of the authentication keys to the update control device 100 (step S17). For example, if both authentication keys match, the control device 1 transmits an authentication result response indicating that the update control device 100 has been authenticated, and if both authentication keys do not match, the control device 1 transmits an authentication result response indicating that the update control device 100 cannot be authenticated.

[0081] As described above, the control device 1 according to the embodiment includes the control unit 2. The control unit 2 performs a buffer update process that updates the random number generation buffer 33 based on the timer value each time the timer value is intermittently acquired, and a random number generation process that generates a random number used to authenticate the update control device 100 that controls the update of a program (first program 31) based on the updated buffer 33. During the period in which the buffer update process is being performed, the control unit 2 changes the update timing of the buffer 33 by performing a transmission process that transmits communication data to the external device 50 and an interrupt process in response to communication data received from the external device 50. This allows for greater variation in the random numbers.

[0082] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. [Explanation of symbols]

[0083] 1. Control device 2. Control Unit 3 Storage section 10 Engine 21 Vehicle control unit 22 Update control section 23 Clock generation unit 31 Program 1 32 Second Program 33 buffers 50 External device 100 Update control device 221 Authentication Department 222 Random Number Generation Unit 223 Authentication Key Generation Unit 224 Timing change section 331 Entropy C vehicle S Program Update System

Claims

1. a control unit that performs a buffer update process that updates a buffer for random number generation based on a timer value every time the timer value is intermittently acquired, and a random number generation process that generates a random number used for authenticating an update control device that controls program updates based on the updated buffer, The control unit During the period when the buffer update process is being performed, a transmission process for transmitting communication data to an external device and an interrupt process in response to the communication data received from the external device are performed, thereby changing the update timing of the buffer. A control device characterized by:

2. The control unit performing the buffer update process of updating the entropy stored in the buffer based on a result of a logical operation of a plurality of the timer values ​​generated based on clock signals having different frequencies; The control device according to claim 1 ,

3. The control unit updating the entropy before the update based on a result of a logical operation between the plurality of timer values ​​and the entropy before the update; The control device according to claim 2 ,

4. The control unit Setting the processing priority of the buffer update process lower than other processes executed by the control unit other than the interrupt process. The control device according to any one of claims 1 to 3,

5. The interrupt processing includes: A process of receiving a response to the communication data The control device according to any one of claims 1 to 4,

6. The communication data is The communication data includes only a response request that requests a response. The control device according to any one of claims 1 to 5,

7. a control step of performing a buffer update process for updating a buffer for random number generation based on a timer value every time the timer value is intermittently acquired, and a random number generation process for generating a random number to be used for authenticating an update control device that controls program updates based on the updated buffer, The control step includes: During the period when the buffer update process is being performed, a transmission process for transmitting communication data to an external device and an interrupt process in response to the communication data received from the external device are performed, thereby changing the update timing of the buffer. A control method characterized by:

Images