Electronic control unit

Abstract

To appropriately prevent an unauthorized program rewriting.SOLUTION: An electronic control device 1 performs multiple authentication processes in sequence when rewriting a program by transferring update data from outside. The electronic control device 1 includes: a plurality of authentication processing units 3 and 4, each of which performs the plurality of authentication processes; and an authentication method change determination unit 5 changes at least one authentication method among a plurality of authentication methods when it detects an unauthorized authentication request from the outside.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an electronic control device. [Background technology]

[0002] For example, in-vehicle electronic control units (hereinafter referred to as ECUs (Electronic Control Units)) are configured to be rewritable in order to improve functionality, resolve defects, etc. This type of ECU is configured to perform multiple authentication processes in sequence to prevent unauthorized program rewriting. For example, Patent Document 1 discloses a configuration that performs two authentication processes: entity authentication process and rewrite authentication process. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2017-11491 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the configuration disclosed in Patent Document 1, if entity authentication and rewrite authentication are breached in sequence, there is a risk that the program may be rewritten illegally.

[0005] The present invention has been made in view of the above circumstances, and an object of the present invention is to provide an electronic control device that can appropriately prevent unauthorized rewriting of a program. [Means for solving the problem]

[0006] According to the invention described in claim 1, when a program is rewritten by receiving update data from the outside, a plurality of authentication processes are executed in sequence. The system includes a plurality of authentication processing units (3, 4) that execute the plurality of authentication processes respectively, and an authentication method change determination unit (5) that changes at least one of the plurality of authentication methods when an unauthorized authentication request from the outside is detected. The plurality of authentication processing units include a first authentication processing unit (3) that performs a preceding first authentication processing and a second authentication processing unit (4) that performs a subsequent second authentication processing. When the first authentication processing unit determines that the authentication result of the first authentication is normal and the second authentication processing unit determines that the authentication result of the second authentication is abnormal, the authentication method change determination unit detects an unauthorized authentication request from outside and changes the authentication method of the first authentication. When an unauthorized authentication request from outside is detected, at least one of the authentication methods is changed, thereby appropriately preventing unauthorized program rewriting before it occurs. [Brief explanation of the drawings]

[0007] [Figure 1] Functional block diagram illustrating one embodiment. [Figure 2] A diagram showing how an unauthorized reprogramming tool is connected [Figure 3] flowchart [Figure 4] flowchart [Figure 5] flowchart DETAILED DESCRIPTION OF THE INVENTION

[0008] An embodiment will be described below with reference to the drawings. As shown in Fig. 1, an ECU 1 is, for example, an in-vehicle ECU, and is a device that controls a drive system, a device that controls an ADAS (Advanced Driving Assistant System), a device that controls a multimedia system, or the like.

[0009] The ECU 1 includes a control unit 2, which is mainly a microcomputer having a CPU, RAM, ROM, I / O, etc. The control unit 2 executes a computer program stored in a non-transitory physical storage medium to perform processing corresponding to the computer program and control the operation of the ECU 1. The ECU 1 is configured so that the program can be rewritten for the purpose of improving functionality, solving malfunctions, etc. The ECU 1 is connected to a reprogramming tool 6, which controls the rewriting of the program, via an in-vehicle network. The in-vehicle network may be, for example, CAN (Controller Area Network) (registered trademark), FLEXRAY (registered trademark), CXPI (Clock Extension Peripheral Interface) (registered trademark), etc.

[0010] The reprogramming tool 6 transfers the update data to the ECU 1 and notifies the ECU 1 of a rewrite instruction, causing the ECU 1 to rewrite the program. That is, the ECU 1 rewrites the program when the update data is transferred from the reprogramming tool 6 and the rewrite instruction is notified to the ECU 1.

[0011] The ECU 1 performs authentication processing as preprocessing before rewriting the program. Specifically, when the ECU 1 first receives an entity authentication request from the reprogramming tool 6, it performs the entity authentication processing. If the authentication result of the entity authentication processing is normal, the ECU 1 waits to receive a reprogramming authentication request from the reprogramming tool 6, and then performs the reprogramming authentication processing when it receives a reprogramming authentication request from the reprogramming tool 6. If the authentication result of the reprogramming authentication processing is normal, the ECU 1 allows the transfer of update data and notification of a reprogramming instruction from the reprogramming tool 6, and performs the program rewriting.

[0012] The control unit 2 is mainly composed of a microcomputer including a CPU, ROM, RAM, I / O, and bus lines connecting these components. The control unit 2 controls the operation of the ECU 1 by executing software processing by running pre-stored programs on the CPU and hardware processing by dedicated electronic circuits. The control unit 2 includes, for each function, an entity authentication processing unit 3 corresponding to a first authentication processing unit, a rewrite authentication processing unit 4 corresponding to a second authentication processing unit, and an authentication method change determination unit 5.

[0013] When the entity authentication processing unit 3 receives an entity authentication request from an external device, it performs entity authentication processing using key information for entity authentication and a cryptographic engine. In this case, a plurality of pieces of key information for entity authentication and a plurality of cryptographic engines are prepared. The entity authentication processing unit 3 selects one piece of key information for entity authentication from the plurality of pieces of key information and one piece of cryptographic engines to determine an authentication method, and performs entity authentication processing using the determined authentication method. After performing the entity authentication processing, the entity authentication processing unit 3 notifies the authentication method change determination unit 5 of the authentication result of the entity authentication.

[0014] When the entity authentication processing unit 3 receives an entity authentication request from outside, it compares the request pattern of the received entity authentication request with a predetermined normal request pattern and determines whether the entity authentication request has a normal request pattern. If the entity authentication processing unit 3 determines that the entity authentication request does not have a normal request pattern, it notifies the authentication method change determination unit 5 and the reprogramming tool 6 of an abnormality in the entity authentication result. The authentication method change determination unit 5 compares the number of entity authentication failures with a predetermined number and determines whether the number of entity authentication failures is equal to or greater than the predetermined number. If the authentication method change determination unit 5 determines that the number of entity authentication failures is equal to or greater than the predetermined number, it stores that the authentication result of the entity authentication is abnormal.

[0015] If the entity authentication processing unit 3 determines that the entity authentication request has a normal request pattern, it compares the data format of the received entity authentication request with a predetermined normal data format and determines whether the received entity authentication request has a normal data format. If the entity authentication processing unit 3 determines that the entity authentication request does not have a normal data format, it notifies the authentication method change determination unit 5 and the reprogramming tool 6 of an abnormality in the entity authentication result. The authentication method change determination unit 5 compares the number of entity authentication failures with a predetermined number and determines whether the number of entity authentication failures is equal to or greater than the predetermined number. If the authentication method change determination unit 5 determines that the number of entity authentication failures is equal to or greater than the predetermined number, it stores that the authentication result of the entity authentication is abnormal.

[0016] If the entity authentication processing unit 3 determines that the entity authentication request has a normal data format, it performs entity authentication processing. If the entity authentication processing unit 3 determines that the entity authentication has failed, it notifies the authentication method change determination unit 5 and the reprogramming tool 6 of an abnormality in the entity authentication result. The authentication method change determination unit 5 compares the number of entity authentication failures with a predetermined number and determines whether the number of entity authentication failures is equal to or greater than the predetermined number. If the authentication method change determination unit 5 determines that the number of entity authentication failures is equal to or greater than the predetermined number, it stores that the authentication result of the entity authentication is abnormal. If the entity authentication processing unit 3 determines that the entity authentication has been successful, it notifies the reprogramming tool 6 of a normal authentication result of the entity authentication.

[0017] When the rewrite authentication processing unit 4 receives a rewrite authentication request from an external device, it performs the rewrite authentication process using key information for rewrite authentication and a cryptographic engine. In this case, a plurality of pieces of key information for rewrite authentication and a plurality of cryptographic engines are prepared. The rewrite authentication processing unit 4 selects one piece of key information for rewrite authentication from the plurality of pieces of key information and one piece of cryptographic engines to determine the authentication method, and performs the rewrite authentication process using the determined authentication method. After performing the rewrite authentication process, if the rewrite authentication is successful, the rewrite authentication processing unit 4 notifies the reprogramming tool 6 of the authentication result of the rewrite authentication. If the rewrite authentication is unsuccessful, the rewrite authentication processing unit 4 notifies the authentication method change determination unit 5 and the reprogramming tool 6 of the authentication result of the rewrite authentication.

[0018] When the rewrite authentication processing unit 4 receives a rewrite authentication request from outside, it compares the request pattern of the received rewrite authentication request with a predetermined normal request pattern and determines whether the rewrite authentication request is a normal request pattern. If the rewrite authentication processing unit 4 determines that the rewrite authentication request is not a normal request pattern, and if the stored value of the authentication result of entity authentication is abnormal, it notifies the authentication method change determination unit 5 and the reprogramming tool 6 of the abnormality of the rewrite authentication result. If the rewrite authentication processing unit 4 determines that the rewrite authentication request is a normal request pattern, it compares the data format of the received rewrite authentication request with a predetermined normal data format and determines whether the received rewrite authentication request is a normal data format. If the rewrite authentication processing unit 4 determines that the rewrite authentication request is not a normal data format, and if the stored value of the authentication result of entity authentication is abnormal, it notifies the authentication method change determination unit 5 and the reprogramming tool 6 of the abnormality of the rewrite authentication result.

[0019] If the rewrite authentication processing unit 4 determines that the rewrite authentication request has a normal data format, it performs the rewrite authentication processing. If the rewrite authentication fails and the stored value of the authentication result of entity authentication is abnormal, the rewrite authentication processing unit 4 notifies the authentication method change determination unit 5 and the reprogramming tool 6 of the abnormality of the rewrite authentication result. If the stored value of the authentication result of entity authentication is normal, the authentication method change determination unit 5 compares the number of rewrite authentication failures with a predetermined number and determines whether the number of rewrite authentication failures is equal to or greater than the predetermined number. If the authentication method change determination unit 5 determines that the number of rewrite authentication failures is equal to or greater than the predetermined number, it confirms that the rewrite authentication result is abnormal. If the rewrite authentication is successful, the rewrite authentication processing unit 4 notifies the reprogramming tool 6 that the rewrite authentication result is normal.

[0020] The authentication method change determination unit 5 includes an entity authentication request history storage unit 5a that stores the history of entity authentication requests, and a rewrite authentication request history storage unit 5b that stores the history of rewrite authentication requests. The entity authentication request history storage unit 5a stores the occurrence of a predetermined number of failures in authentication of an external entity authentication request. The rewrite authentication request history storage unit 5b stores the occurrence of a predetermined number of failures in authentication of an external rewrite authentication request with a correct request pattern and a correct data format.

[0021] 2, even when an unauthorized reprogramming tool 7 is connected to the ECU 1, entity authentication processing is performed first. However, if the entity authentication is breached, reprogramming authentication processing is performed next. If the reprogramming authentication is also breached, unauthorized program reprogramming may be performed. In other words, if the preceding entity authentication and the subsequent reprogramming authentication are breached in sequence, unauthorized program reprogramming may be performed. In this case, when the entity authentication processing unit 3 receives an unauthorized entity authentication request from the unauthorized reprogramming tool 7, the entity authentication fails. However, the unauthorized reprogramming tool 7 changes parameters and repeatedly sends entity authentication requests to the ECU 1 until entity authentication is successful.

[0022] If a security vulnerability is exploited and entity authentication is successful, the authentication result of the entity authentication becomes normal, and the unauthorized reprogramming tool 7 sends an unauthorized reprogramming authentication request to the ECU 1. When the reprogramming authentication processing unit 4 receives an unauthorized reprogramming authentication request from the unauthorized reprogramming tool 7, the authentication result of the reprogramming authentication becomes abnormal. However, because the authentication result of the entity authentication is normal, it is highly likely that the key information, cryptographic engine information including the cryptographic algorithm, random number generation information including the random number generation algorithm, and the like used in the entity authentication have been decrypted. In other words, if the authentication result of the preceding entity authentication is normal and the authentication result of the subsequent reprogramming authentication is abnormal, it is highly likely that the key information, cryptographic engine information, random number generation information, and the like used in the entity authentication have been decrypted.

[0023] In such a situation, if the authentication result of the rewrite authentication is abnormal when the authentication result of the entity authentication is normal, the authentication method change determination unit 5 detects an invalid authentication request and changes the authentication method of the entity authentication. Specifically, the authentication method change determination unit 5 sends a request to change the key information, the encryption algorithm, and the random number generation algorithm to the entity authentication processing unit 3, and requests the entity authentication processing unit 3 to change the key information, the encryption algorithm, and the random number generation algorithm used in entity authentication. The entity authentication processing unit 3 then changes the authentication method of the entity authentication, and performs authentication using the changed authentication method from the next time an entity authentication request is made.

[0024] The authentication method change determination unit 5 may change the authentication method for rewrite authentication in addition to changing the authentication method for entity authentication. Specifically, the authentication method change determination unit 5 sends a request to change the key information, the encryption algorithm, and the random number generation algorithm to the rewrite authentication processing unit 4, and requests the rewrite authentication processing unit 4 to change the key information, the encryption algorithm, and the random number generation algorithm used in rewrite authentication. The rewrite authentication processing unit 4 then changes the authentication method, and performs authentication using the changed authentication method from the next time a rewrite authentication request is made.

[0025] In a configuration in which the key management server 8 manages key information for entity authentication and key information for rewrite authentication, an unauthorized reprogramming tool 7 cannot access the key management server 8. Therefore, even if entity authentication is breached, the ECU 1 can deal with the next unauthorized entity authentication request by changing the key information for entity authentication. The ECU 1 can also robustly deal with the next unauthorized entity authentication request by changing the encryption algorithm and random number generation algorithm for entity authentication. Furthermore, even if rewrite authentication is breached, the ECU 1 can deal with the next unauthorized rewrite authentication request by changing the key information for rewrite authentication. The ECU 1 can also robustly deal with the next unauthorized rewrite authentication request by changing the encryption algorithm and random number generation algorithm for rewrite authentication.

[0026] Note that it is not necessary to change the key information for entity authentication and the key information for rewrite authentication. That is, the authentication method change determination unit 5 may send at least one of a request to change the key information, a request to change the encryption algorithm, and a request to change the random number generation algorithm to the entity authentication processing unit 3 or the rewrite authentication processing unit 4, and request the entity authentication processing unit 3 or the rewrite authentication processing unit 4 to change at least one of the key information, the encryption algorithm, and the random number generation algorithm. Also, the authentication method may be changed by both or either one of the entity authentication processing unit 3 and the rewrite authentication processing unit 4.

[0027] Next, the operation of the above-described configuration will be described with reference to FIGS. When the control unit 2 starts the authentication process, it waits for reception of an entity authentication request from outside (S1). If the control unit 2 determines that an entity authentication request has been received from outside (S1: YES), it determines whether the received entity authentication request has a normal request pattern (S2). If the control unit 2 determines that the received entity authentication request does not have a normal request pattern (S2: NO), it determines that the entity authentication has failed, counts up the number of entity authentication failures (S3), and determines whether the counted number is equal to or greater than a predetermined number (S4).

[0028] If the control unit 2 determines that the number of entity authentication failures is less than the predetermined number (S4: NO), it transmits an authentication abnormality of the entity authentication to the sender of the authentication request (S6), returns to step S1, and waits for reception of an entity authentication request from outside.On the other hand, if the control unit 2 determines that the number of entity authentication failures is equal to or greater than the predetermined number (S4: YES), it stores that the authentication result of the entity authentication is abnormal (S5), transmits an authentication abnormality of the entity authentication to the sender of the authentication request (S6), returns to step S1, and waits for reception of an entity authentication request from outside.

[0029] If the control unit 2 determines that the received entity authentication request has a normal request pattern (S2: YES), it determines whether the received entity authentication request has a normal data format (S7).If the control unit 2 determines that the received entity authentication request does not have a normal data format (S7: NO), it determines that the entity authentication has failed, and in this case, it also performs the processing from step S3 onwards.

[0030] If the control unit 2 determines that the received entity authentication request has a normal data format (S7: YES), it performs entity authentication processing in the entity authentication processing unit 3 (S8) and determines whether the entity authentication is successful or unsuccessful (S9).If the control unit 2 determines that the entity authentication is unsuccessful (S9: NO), it also performs the processing from step S3 onwards.

[0031] When the control unit 2 determines that the entity authentication is successful (S9: YES), it transmits a successful entity authentication to the sender of the authentication request (S10) and waits to receive a rewrite authentication request from outside (S11). When the control unit 2 determines that a rewrite authentication request has been received from outside (S11: YES), it determines whether the received rewrite authentication request has a normal request pattern (S12). When the control unit 2 determines that the received rewrite authentication request does not have a normal request pattern (S12: NO), it determines that the rewrite authentication has failed and determines whether the stored value of the authentication result of the entity authentication is a value indicating an abnormality (S13).

[0032] When the control unit 2 determines that the stored value of the authentication result of entity authentication is a value indicating an abnormality (S13: YES), it issues a request to change the authentication method of entity authentication (S14) and changes the authentication method of entity authentication in the entity authentication processing unit 3 (S15). That is, the control unit 2 changes the key information, encryption algorithm, and random number generation algorithm used in entity authentication. The control unit 2 clears the stored value of the authentication result of entity authentication and the entity authentication failure count counter (S16), transmits an authentication abnormality of the rewrite authentication to the sender of the authentication request (S17), returns to step S1, and waits for reception of an entity authentication request from outside.

[0033] On the other hand, if the control unit 2 determines that the stored value of the authentication result of the entity authentication is a value indicating normal (S13: NO), it determines whether the number of failures of the rewrite authentication is equal to or greater than a predetermined number (S18).If the control unit 2 determines that the number of failures of the rewrite authentication is less than the predetermined number (S18: NO), it transmits an authentication abnormality of the rewrite authentication to the sender of the authentication request (S17), returns to step S1, and waits for reception of an entity authentication request from outside.

[0034] When the control unit 2 determines that the number of failures of the rewrite authentication is equal to or greater than a predetermined number (S18: YES), it stores that the authentication result of the rewrite authentication is abnormal (S19), initiates a request to change the authentication method of the rewrite authentication (S20), and changes the authentication method of the rewrite authentication in the rewrite authentication processing unit 4 (S21). That is, the control unit 2 changes the key information, encryption algorithm, and random number generation algorithm used in the rewrite authentication. The control unit 2 clears the stored value of the authentication result of the rewrite authentication and the rewrite authentication failure counter (S22), transmits an authentication abnormality of the rewrite authentication to the sender of the authentication request (S17), returns to step S1, and waits for reception of an entity authentication request from outside.

[0035] If the control unit 2 determines that the received rewrite authentication request has a normal request pattern (S12: YES), it determines whether the received rewrite authentication request has a normal data format (S23).If the control unit 2 determines that the received rewrite authentication request does not have a normal data format (S23: NO), it determines that the rewrite authentication has failed, and in this case too, it performs the processes from step S13 onwards.

[0036] If the control unit 2 determines that the received rewrite authentication request has a normal data format (S23: YES), it executes the rewrite authentication process in the rewrite authentication processing unit 4 (S24) and determines whether the rewrite authentication is successful or unsuccessful (S25). If the control unit 2 determines that the rewrite authentication has failed (S25: NO), it determines that the rewrite authentication has failed, increments the number of rewrite authentication failures (S26), and also in this case, it executes the processes from step S13 onwards.

[0037] On the other hand, if the control unit 2 determines that the rewrite authentication is successful (S25: YES), it clears the stored value of the authentication result of the entity authentication and the counter for the number of failures of the entity authentication (S27), clears the stored value of the authentication result of the rewrite authentication and the counter for the number of failures of the entity authentication (S28), transmits a successful rewrite authentication to the sender of the authentication request (S29), and terminates the authentication process.

[0038] As described above, according to the embodiment, the following advantageous effects can be obtained. When entity authentication and rewrite authentication are performed in sequence in the ECU 1, an unauthorized authentication request from outside is detected, and if the number of times entity authentication fails is equal to or exceeds a predetermined number and an unauthorized authentication request from outside is detected in the rewrite authentication, the authentication method of the entity authentication is changed. By changing the authentication method of the entity authentication, unauthorized program rewriting can be appropriately prevented in advance.

[0039] When an unauthorized authentication request from outside is detected, the authentication method for entity authentication is changed. In addition, if the number of times that rewrite authentication fails exceeds a predetermined number, the authentication method for rewrite authentication is also changed. This makes it possible to more reliably prevent unauthorized program rewrites.

[0040] If it is determined that the authentication request does not have a normal request pattern and that the number of authentication failures is equal to or exceeds a predetermined number, the authentication result is identified as abnormal and an unauthorized authentication request from outside is detected. By comparing the request pattern of the authentication request with a normal request pattern, an authentication request that does not have a normal request pattern can be identified as an unauthorized authentication request, and an unauthorized authentication request from outside can be detected.

[0041] If it is determined that the authentication request does not have a normal data format and that the number of authentication failures is equal to or exceeds a predetermined number, the authentication result is identified as abnormal and an unauthorized authentication request from outside is detected. By comparing the data format of the authentication request with the normal data format, an authentication request that does not have a normal data format can be identified as an unauthorized authentication request, and an unauthorized authentication request from outside can be detected.

[0042] When it is determined that the number of authentication failures due to the execution of the authentication process is equal to or exceeds a predetermined number, the authentication result is identified as abnormal and an unauthorized authentication request from outside is detected. By comparing the number of authentication failures due to the execution of the authentication process with the predetermined number, a rewrite authentication request with a failure count equal to or exceeds the predetermined number can be identified as an unauthorized authentication request, and an unauthorized authentication request from outside can be detected.

[0043] In the above embodiment, a configuration has been described in which the reprogramming tool 6 is connected to the ECU 1, so that update data is transferred from the reprogramming tool 6 to the ECU 1 and a rewrite instruction is notified to the ECU 1, but the present invention can also be applied to a configuration in which update data distributed from an OTA center is transferred to the ECU 1 via a communication network.

[0044] Although the present disclosure has been described with reference to the embodiments, it is understood that the present disclosure is not limited to the embodiments or structures. The present disclosure also encompasses various modifications and modifications within the scope of equivalents. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and spirit of the present disclosure.

[0045] The control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to perform one or more functions embodied in a computer program. Alternatively, the control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to perform one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible storage medium. [Explanation of symbols]

[0046] In the drawing, 1 is an electronic control device, 2 is a control unit, 3 is an entity authentication processing unit (first authentication processing unit), 4 is a rewrite authentication processing unit (second authentication processing unit), and 5 is an authentication method change determination unit.

Claims

1. An electronic control device that performs a plurality of authentication processes in sequence when a program is rewritten by receiving update data from an external device, a plurality of authentication processing units (3, 4) that respectively perform the plurality of authentication processes; an authentication method change determination unit (5) that changes at least one of the plurality of authentication methods when detecting an unauthorized authentication request from outside, the plurality of authentication processing units include a first authentication processing unit (3) that performs a preceding first authentication processing and a second authentication processing unit (4) that performs a subsequent second authentication processing, The authentication method change determination unit detects an external fraudulent authentication request and changes the authentication method of the first authentication when the authentication result of the first authentication is determined to be normal by the first authentication processing unit and the authentication result of the second authentication is determined to be abnormal by the second authentication processing unit.

2. An electronic control device as described in claim 1, wherein when the authentication result of the first authentication is identified as normal by the first authentication processing unit and the authentication result of the second authentication is identified as abnormal by the second authentication processing unit, the authentication method change determination unit detects an unauthorized authentication request from outside and changes the authentication method of the first authentication as well as the authentication method of the second authentication.

3. An electronic control device as described in claim 1 or 2, wherein the authentication processing unit determines that an external authentication request is not a normal request pattern and, if it determines that the number of authentication failures is greater than a predetermined number, identifies the authentication result as abnormal.

4. 3. The electronic control device according to claim 1, wherein the authentication processing unit determines that the authentication result is abnormal when it determines that the external authentication request is not in a normal data format and that the number of authentication failures is greater than or equal to a predetermined number.

5. 3. The electronic control device according to claim 1, wherein the authentication processing unit determines that the authentication result is abnormal when it determines that the number of times the authentication has failed due to the execution of the authentication process is equal to or greater than a predetermined number.

6. the first authentication processing unit is an entity authentication processing unit that performs entity authentication processing; 2. The electronic control unit according to claim 1, wherein the second authentication processing unit is a rewrite authentication processing unit that performs rewrite authentication processing.

Images