Electronic control unit
The ECU differentiates between intentional and malfunction-induced data tampering through secure boot and fault diagnosis, enabling users to take appropriate actions for timely system recovery.
Patent Information
- Application Number
- JP2021210816
- Authority / Receiving Office
- JP · JP
- Patent Type
- Patents
- Current Assignee / Owner
- Filing Date
- 2021-12-24
- Publication Date
- 2026-01-21
- Estimated Expiration
- 2041-12-24
AI Technical Summary
Existing electronic control units (ECUs) fail to distinguish between intentional data tampering and tampering due to malfunctions in the data storage unit, leading to unnecessary replacements or updates without user notification.
The ECU performs secure boot processing to determine data tampering, conducts fault diagnosis on the data storage unit, and notifies the user whether tampering is intentional or due to a malfunction, allowing appropriate measures to be taken.
Users can appropriately respond to intentional or malfunction-induced data tampering by reprogramming or replacing components, ensuring timely system recovery and safety.
Smart Images
Figure 0007803121000001 
Figure 0007803121000002 
Figure 0007803121000003
Abstract
Description
[Technical Field]
[0001] The present invention relates to an electronic control device. [Background technology]
[0002] For example, an electronic control unit mounted on a vehicle is configured to perform secure boot processing when a microcomputer (hereinafter referred to as "mc") is started. For example, Patent Document 1 discloses a technology in which secure boot processing is performed to determine whether data stored in a data storage unit has been tampered with, and if it is determined that the data has been tampered with, operation of the tampered area is stopped, thereby allowing only intended software (hereinafter referred to as "software") to operate. [Prior art documents] [Patent documents]
[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2015-55898 Summary of the Invention [Problem to be solved by the invention]
[0004] There are two possible causes for determining that data has been tampered with: intentional tampering and tampering due to a malfunction in the data storage unit. Intentional data tampering can be resolved by reprogramming the legitimate control software, but data tampering due to a malfunction in the data storage unit can only be resolved by replacing the microcontroller. However, in the past, when data tampering was determined to have been tampered with, the cause was not notified to the user, which meant that the user was unable to take appropriate action. This could result in unnecessary key updates or microcontroller replacements.
[0005] The present invention has been made in consideration of the above-mentioned circumstances, and its purpose is to provide an electronic control device that allows a user to take appropriate measures when it is determined that data has been tampered with by secure boot processing. [Means for solving the problem]
[0006] According to the invention described in claim 1, an electronic control device (21) mounted on a vehicle includes a data storage unit (23) that stores data, and a control unit (24) that performs secure boot processing and determines whether the data stored in the data storage unit has been tampered with. The data storage section includes a first storage area (26) and a second storage area (27). When the control unit determines that the data has been tampered with, it performs a fault diagnosis process on the data storage unit to determine whether the data storage unit is faulty, and when it determines that the data storage unit is not faulty, it notifies the control unit that the data has been intentionally tampered with, and when it determines that the data storage unit is faulty, it notifies the control unit that the data has been tampered with due to a fault in the data storage unit. The control unit performs a fault diagnosis process on the second storage area in parallel with performing the secure boot process on the first storage area, and when it determines that the data stored in the first storage area has been tampered with, it performs the secure boot process on the second storage area in parallel with performing the fault diagnosis process on the first storage area, and when it determines that the data stored in the second storage area has not been tampered with, it launches control software with the second storage area as the area to be used.
[0007] When secure boot processing is performed and it is determined that data has been tampered with, a fault diagnosis process for the data storage unit is performed. If it is determined that the data storage unit is not faulty, a notification is sent that the data has been intentionally tampered with, allowing the user to recognize that the data has been intentionally tampered with and take appropriate measures. On the other hand, when it is determined that the data storage unit is faulty, a notification is sent that the data has been tampered with due to a fault in the data storage unit, allowing the user to recognize that the data has been tampered with due to a fault in the data storage unit and take appropriate measures. In this way, when it is determined that data has been tampered with by secure boot processing, it is possible to appropriately notify the user whether the tampering was intentional or due to a fault in the data storage unit, and the user can take appropriate measures in either case. [Brief explanation of the drawings]
[0008] [Figure 1] Functional block diagram showing the first embodiment [Figure 2] Diagram explaining the secure boot process [Figure 3] Functional block diagram showing the configuration of the vehicle-side system [Figure 4] Flowchart showing the processing of the target ECU [Figure 5] Flowchart showing the processing of the target ECU [Figure 6] Flowchart showing the processing of the OTA master ECU [Figure 7] Functional block diagram showing a second embodiment [Figure 8] Flowchart showing the processing of the target ECU [Figure 9] Flowchart showing the processing of the target ECU [Figure 10] Flowchart showing the processing of the target ECU [Figure 11] 10 is a flowchart illustrating a process of a target ECU according to a third embodiment. [Figure 12] Flowchart showing the processing of the target ECU [Figure 13] Flowchart showing the processing of the target ECU DETAILED DESCRIPTION OF THE INVENTION
[0009] Hereinafter, several embodiments will be described with reference to the drawings. In the subsequent embodiments, the description of parts that overlap with the preceding embodiments may be omitted.
[0010] (First embodiment) A first embodiment will be described with reference to Figures 1 to 6. An electronic control unit (hereinafter referred to as ECU (Electronic Control Unit)) 1 is, for example, an ECU mounted on a vehicle, and is a device that controls a drive system, a device that controls an ADAS (Advanced Driving Assistant System), a device that controls a multimedia system, etc. The ECU 1 is equipped with a secure boot function as a function for detecting intentional data tampering by a malicious third party. In this case, the data includes control software that realizes a specific application.
[0011] The ECU 1 includes a microcomputer 2. The microcomputer 2 includes a ROM 3 as a data storage unit, a CPU 4 as a control unit, and a hardware security module (hereinafter referred to as an HSM (Hardware Security Module)) 5. The microcomputer 2 executes a computer program stored in a non-transitory physical storage medium to perform processing corresponding to the computer program and control the operation of the ECU 1.
[0012] 2, the CPU 4 starts the boot program stored in the boot program area 3a, reads data stored in the code flash area 3b for each block, and outputs the read data to the HSM 5 to perform secure boot processing.
[0013] The HSM 5 stores an encryption key required to generate a Message Authentication Code (MAC) value. When data for each block is input, the HSM 5 encrypts the input data for each block using the encryption key and calculates a MAC value. The HSM 5 compares and verifies the calculated MAC value against a verification MAC value stored in the data flash area 3c, and outputs the secure boot processing result to the boot program. If the CPU 4 determines that the calculated MAC value matches the verification MAC value, it determines that the data in the ROM 3 has not been tampered with. On the other hand, if the CPU 4 determines that the calculated MAC value does not match the verification MAC value, it determines that the data in the ROM 3 has been tampered with.
[0014] In addition to performing secure boot processing, the CPU 4 also performs fault diagnosis processing for the ROM 3. If the microcomputer 2 has an ECC (Error-Correcting Code / Error-Correction Code) check function, it can correct single-bit errors and detect double-bit errors when reading data, so it performs fault diagnosis processing for the ROM 3 in parallel with performing secure boot processing. In this case, by storing the ECC check results, it is possible to reduce the time required to diagnose the ROM 3 after the control software is started. On the other hand, if the microcomputer 2 does not have an ECC check function, it performs fault diagnosis processing for the ROM 3 by reading data from a specific range, for example, 1 kByte, in the RAM area, erasing the data in that area and writing "1" to it, reading the data from the same area to confirm that it is all "1", and then performing the same process with "0" to perform fault diagnosis processing for the ROM 3.
[0015] As shown in Fig. 3, as a vehicle-side system, ECU 1 is connected to an OTA master ECU 6 that manages multiple ECUs and a meter ECU 8 that controls a meter 7 via an in-vehicle network 9. The in-vehicle network 9 is, for example, a Controller Area Network (CAN) (registered trademark). Furthermore, ECU 1 can be connected to a diagnostic tool 10 that can be operated by, for example, a dealer's technician via a communication cable 11. ECU 1 functions as a target ECU to be reprogrammed by the OTA master ECU 6 and the diagnostic tool 10.
[0016] The ECU 1 performs the above-described secure boot process, and when it determines that data has been tampered with, it performs a fault diagnosis process on the ROM 3, and when it determines that the ROM 3 is not faulty, it transmits a tampering notification to the in-vehicle network 9 and the communication cable 11. On the other hand, when it determines that the ROM 3 is faulty, it transmits a ROM fault notification to the in-vehicle network 9 and the communication cable 11.
[0017] When the meter ECU 8 receives a tampering notification from the ECU 1 via the in-vehicle network 9, it displays notification information indicating data tampering on the meter 7, thereby notifying the driver or the like of the data tampering. When the notification information indicating data tampering is displayed on the meter 7, the driver or the like can recognize that the data has been intentionally tampered with, and can recognize that reprogramming the control software is necessary as a countermeasure in this case. For example, once the control software reprogramming is complete, the driver or the like can take countermeasures such as driving the vehicle to a dealer. Furthermore, when the meter ECU 8 receives a ROM failure notification from the ECU 1 via the in-vehicle network 9, it displays notification information indicating a ROM3 failure on the meter 7, thereby notifying the driver or the like of the ROM3 failure. When the notification information indicating a ROM3 failure is displayed on the meter 7, the driver or the like can recognize that data tampering has occurred due to a ROM3 failure, and can recognize that replacing the microcomputer 2 is necessary as a countermeasure in this case.
[0018] When the diagnostic tool 10 receives the tampering notification from the ECU 1 via the communication cable 11, it displays notification information indicating the data tampering and notifies the dealer's technician or the like of the data tampering. The dealer's technician or the like recognizes that the data has been intentionally tampered with by the notification information indicating the data tampering displayed on the diagnostic tool 10, and recognizes that the control software needs to be reprogrammed as a countermeasure in that case. The dealer's technician or the like recognizes that the data has been tampered with due to a ROM 3 failure by the notification information indicating a ROM 3 failure displayed on the diagnostic tool 10, and recognizes that the microcomputer 2 needs to be replaced as a countermeasure in that case.
[0019] Next, the operation of the above-described configuration will be described with reference to Figures 4 to 6. Here, the processing performed by the ECU 1 functioning as the target ECU and the processing performed by the OTA master ECU 6 will be described.
[0020] (1) Processing of the target ECU In ECU1, when the CPU 4 starts the startup process of the microcomputer 2, it starts the microcomputer 2 (A1) and performs secure boot processing (A2). When the CPU 4 completes the secure boot process, it determines the result of the secure boot process (A3). When the MAC value matches the verification MAC value and it is determined that the data in ROM 3 has not been tampered with, the CPU 4 determines that the result of the secure boot process is correct (A3: YES), starts the control software (A4), and ends the startup process of the microcomputer 2.
[0021] On the other hand, if the MAC value does not match the verification MAC value and the CPU 4 determines that the data in the ROM 3 has been tampered with, it determines that the secure boot processing result is negative (A3: NO) and performs fault diagnosis processing (A5) on the ROM 3. Upon completing the fault diagnosis processing on the ROM 3, the CPU 4 determines the processing result of the fault diagnosis (A6).
[0022] The CPU 4 confirms that the ROM 3 is operating normally, and upon determining that the ROM 3 is not faulty, determines that the failure diagnosis processing result is positive (A6: YES) and stores a DTC (Diagnostic Trouble Code) indicating intentional data tampering (A7). The CPU 4 sends a tampering notification to the in-vehicle network 9 or communication cable 11 (A8), maintains secure boot without starting the control software (A9), and ends the startup processing of the microcomputer 2. That is, the CPU 4 displays notification information indicating data tampering on the meter 7 or diagnostic tool 10, thereby making the driver, dealership staff, etc. aware of the intentional data tampering.
[0023] On the other hand, when the CPU 4 confirms that ROM 3 is not operating normally but is operating abnormally and determines that ROM 3 is faulty, it determines that the fault diagnosis processing result is negative (A6: NO) and stores a DTC indicating data tampering due to a ROM 3 fault (A10). The CPU 4 then sends a ROM fault notification to the in-vehicle network 9 or communication cable 11 (A11), enables vehicle fixation processing (A12), maintains secure boot without starting the control software (A13), and terminates the startup processing of the microcomputer 2. That is, the CPU 4 displays notification information indicating the ROM 3 fault on the meter 7 or diagnostic tool 10, thereby making the driver, dealer personnel, etc. aware of data tampering due to a ROM 3 fault. Note that the vehicle fixation processing is a process that ensures safety and security. By enabling the vehicle fixation processing, the CPU 4 prevents malfunctions of other ECUs linked to the ECU 1 and prevents situations in which safety and security are threatened due to a ROM 3 fault.
[0024] The area where the secure boot process and the fault diagnosis process are to be performed may be divided, and the secure boot process and the fault diagnosis process may be performed in units of divided areas. By performing the secure boot process and the fault diagnosis process in units of divided areas, it is possible to start the control software with safety guaranteed by ensuring that the data has not been tampered with.
[0025] (2) OTA Master ECU6 Processing In the OTA master ECU 6, when the CPU starts the tampering notification reception determination process, it determines (B1) whether or not the tampering notification transmitted from the ECU 1 has been received. When the CPU determines that the tampering notification transmitted from the ECU 1 has not been received (B1: NO), it ends the tampering notification reception determination process.
[0026] When the CPU determines that it has received the tampering notification sent from ECU1 (B1: YES), it sends a control software reprogramming request notification to the meter ECU8, causes a control software reprogramming request screen to be displayed on the meter 7 (B2), and waits for a selection of whether or not to reprogram the control software (B3). The reprogramming request screen displayed on the meter 7 allows the driver or the like to select whether or not to reprogram the control software. When the driver or the like selects to reprogram the control software, the meter ECU8 sends a reprogramming execution notification to the OTA master ECU6.
[0027] When the CPU determines that it has received the reprogramming notification sent from the meter ECU 8 (B3: YES), it sends the legitimate control software to the ECU 1, reprograms the control software (B4), and terminates the tampering notification reception determination process. Specifically, the CPU sends an install instruction to the ECU 1 to have the ECU 1 install the control software, and sends an activate instruction to the ECU 1 to have the ECU 1 activate the control software, and reprograms the control software. Note that although the above describes a case in which the OTA master ECU 6 sends legitimate control software to the ECU 1, it is also possible for the diagnostic tool 10 to send legitimate control software to the ECU 1.
[0028] As described above, according to the first embodiment, the following advantageous effects can be obtained. In the ECU1, when secure boot processing is performed and it is determined that data has been tampered with, a fault diagnosis process for ROM3 is performed, and when it is determined that ROM3 is not faulty, a notification is sent that data has been intentionally tampered with. If data has been intentionally tampered with, the user can take appropriate measures. On the other hand, if it is determined that ROM3 is faulty, a notification is sent that data has been tampered with due to a fault in ROM3. If data has been tampered with due to a fault in ROM3, the user can take appropriate measures. As a result, when it is determined that data has been tampered with through secure boot processing, the user can be appropriately notified whether the tampering was intentional or due to a fault in ROM3, and the user can take appropriate measures in either case.
[0029] If intentional data tampering is identified, the system notifies the user of the intentional data tampering and prompts the user to reprogram the legitimate control software. Reprogramming the legitimate control software will enable the system to quickly return to normal operation. Furthermore, if data tampering due to a ROM3 failure is identified, the system notifies the user of the data tampering due to a ROM3 failure and prompts the user to replace microcomputer 2. Replacing microcomputer 2 will enable the system to quickly return to normal operation.
[0030] If intentional data tampering is identified, a DTC code indicating the intentional data tampering is saved. The details and cause of the intentional data tampering can be analyzed using the DTC code. Also, if data tampering due to a ROM3 failure is identified, a DTC code indicating the data tampering due to a ROM3 failure is saved. The details and cause of the ROM3 failure can be analyzed using the DTC code.
[0031] (Second embodiment) The second embodiment will be described with reference to FIGS. In the second embodiment, the ROM has two data storage areas. In the ECU 21, the microcomputer 22 includes a ROM 23 as a data storage unit, a CPU 24 as a control unit, and an HSM 25. The ROM 23 includes a first storage area 26 and a second storage area 27. The first storage area 26 includes a boot program area 26a, a code flash area 26b, and a data flash area 26c. The second storage area 27 includes a boot program area 27a, a code flash area 27b, and a data flash area 27c.
[0032] Next, the operation of the above-described configuration will be described with reference to Figures 8 to 10. Here, the processing performed by the ECU 21 functioning as the target ECU will be described. In the ECU 21, when the CPU 24 starts the startup process of the microcomputer 22, it starts the microcomputer 22 (A21) and performs secure boot processing of the first storage area 26 (A22). When the CPU 24 completes the secure boot process of the first storage area 26, it determines the result of the secure boot process (A23). When the MAC value matches the verification MAC value and it is determined that the code flash area 26b of the first storage area 26 has not been tampered with, the CPU 24 determines that the result of the secure boot process is positive (A23: YES), starts the control software in the first storage area 26 (A24), and ends the startup process of the microcomputer 22.
[0033] On the other hand, if the MAC value does not match the verification MAC value and the CPU 24 determines that the code flash area 26b of the first storage area 26 has been tampered with, the CPU 24 determines that the secure boot processing result is negative (A23: NO) and performs fault diagnosis processing on the first storage area 26 (A25). Upon completing the fault diagnosis processing on the first storage area 26, the CPU 24 determines the processing result of the fault diagnosis (A26).
[0034] When the CPU 24 confirms that the first storage area 26 is operating normally and determines that the first storage area 26 is not malfunctioning, the CPU 24 determines that the failure diagnosis processing result is positive (A26: YES) and stores a DTC indicating intentional data tampering (A27).On the other hand, when the CPU 24 confirms that the first storage area 26 is operating abnormally rather than normally and determines that the first storage area 26 is malfunctioning, the CPU 24 determines that the failure diagnosis processing result is negative (A26: NO) and stores a DTC indicating data tampering due to a malfunction of the first storage area 26 (A28).
[0035] Next, the CPU 24 performs secure boot processing for the second storage area 27 (A29). Upon completing the secure boot processing for the second storage area 27, the CPU 24 determines the result of the secure boot processing (A30). If the MAC value matches the verification MAC value and the CPU 24 determines that the code flash area 27b of the second storage area 27 has not been tampered with, the CPU 24 determines that the result of the secure boot processing is positive (A30: YES), starts the control software in the second storage area 27 (A31), and ends the startup processing of the microcomputer 22.
[0036] On the other hand, if the MAC value does not match the verification MAC value and the CPU 24 determines that the code flash area 27b of the second storage area 27 has been tampered with, the CPU 24 determines that the secure boot processing result is negative (A30 NO) and performs fault diagnosis processing on the second storage area 27 (A32). Upon completing the fault diagnosis processing on the second storage area 27, the CPU 24 determines the processing result of the fault diagnosis (A33).
[0037] When the CPU 24 confirms that the second storage area 27 is operating normally and determines that the second storage area 27 is not malfunctioning, the CPU 24 determines that the failure diagnosis processing result is positive (A33: YES) and stores a DTC indicating intentional data tampering (A34).On the other hand, when the CPU 24 confirms that the second storage area 27 is operating abnormally rather than normally and determines that the second storage area 27 is malfunctioning, the CPU 24 determines that the failure diagnosis processing result is negative (A33: NO) and stores a DTC indicating data tampering due to a malfunction of the second storage area 27 (A35).
[0038] The CPU 24 determines whether both the first storage area 26 and the second storage area 27 are faulty (A36). If the CPU 24 determines that at least one of the first storage area 26 and the second storage area 27 is not faulty (A36: NO), it transmits a tampering notification to the in-vehicle network 9 or the communication cable 11 (A37), maintains secure boot without starting the control software (A38), and ends the startup process of the microcomputer 22.
[0039] On the other hand, when the CPU 24 determines that both the first storage area 26 and the second storage area 27 are faulty (A36: YES), it sends a ROM fault notification to the in-vehicle network 9 or the communication cable 11 (A39), enables the vehicle fixation process (A40), maintains the secure boot without starting the control software (A41), and ends the startup process of the microcontroller 22.
[0040] As described above, according to the second embodiment, the following advantageous effects can be obtained. In the ECU 21, secure boot processing is performed on the first storage area 26, and if it is determined that data has been tampered with, fault diagnosis processing is performed on the first storage area 26, secure boot processing is performed on the second storage area 27, and if it is determined that data has been tampered with, fault diagnosis processing is performed on the second storage area 27, and if it is determined that at least one of the first storage area 26 and the second storage area 27 is not faulty, a notification is given of intentional data tampering. If data has been intentionally tampered with, the user can take appropriate measures. On the other hand, if it is determined that both the first storage area 26 and the second storage area 27 are faulty, a notification is given of data tampering due to a fault in the ROM 23. If data has been tampered with due to a fault in the ROM 23, the user can take appropriate measures. As a result, even in a configuration in which ROM23 has two data storage areas, if it is determined that data has been tampered with by secure boot processing, the user can be properly notified whether the tampering was intentional or due to a malfunction of ROM23, and the user can take appropriate action in either case.
[0041] If it is determined that the data in the first storage area 26 has not been tampered with, the control software can be started using the first storage area 26 as the area in use without performing a fault diagnosis process on the first storage area 26. Even if it is determined that the data in the first storage area 26 has been tampered with, if it is determined that the data in the second storage area 27 has not been tampered with, the control software can be started using the second storage area 27 as the area in use.
[0042] (Third embodiment) The third embodiment will be described with reference to FIGS. In the third embodiment, in a configuration in which a ROM has two data storage areas, secure boot processing for one data storage area and fault diagnosis processing for the other data storage area are performed in parallel.
[0043] In the ECU 21, when the CPU 24 starts the startup processing of the microcomputer 22, it starts up the microcomputer 22 (A51), performs secure boot processing of the first storage area 26, and simultaneously performs fault diagnosis processing of the second storage area 27 (A52, A53).
[0044] Upon completing the secure boot process for the first storage area 26 and the fault diagnosis process for the second storage area 27, the CPU 24 determines the result of the secure boot process (A54). If the MAC value matches the verification MAC value and the CPU 24 determines that the code flash area 26b of the first storage area 26 has not been tampered with, the CPU 24 determines that the result of the secure boot process is positive (A54: YES), starts the control software in the first storage area 26 (A55), and ends the startup process of the microcomputer 22.
[0045] On the other hand, if the CPU 24 determines that the MAC value and the verification MAC value do not match and that the code flash area 26b of the first storage area 26 has been tampered with, it determines that the secure boot processing result is negative (A54: NO) and performs fault diagnosis processing on the first storage area 26 while simultaneously performing secure boot processing on the second storage area 27 (A56, A57).
[0046] Upon completing the fault diagnosis process for the first storage area 26 and the secure boot process for the second storage area 27, the CPU 24 determines the result of the fault diagnosis process (A58). If the CPU 24 confirms normal operation of the first storage area 26 and determines that the first storage area 26 is not faulty, the CPU 24 determines that the result of the fault diagnosis process is positive (A58: YES) and stores a DTC indicating intentional data tampering (A59). On the other hand, if the CPU 24 confirms abnormal operation rather than normal operation of the first storage area 26 and determines that the first storage area 26 is faulty, the CPU 24 determines that the result of the fault diagnosis process is negative (A58: NO) and stores a DTC indicating data tampering due to a fault in the first storage area 26 (A60).
[0047] The CPU 24 determines the result of the secure boot process (A61). If the MAC value matches the verification MAC value and the code flash area 27b of the second storage area 27 has not been tampered with, the CPU 24 determines that the result of the secure boot process is positive (A61: YES), starts the control software in the second storage area 27 (A62), and ends the startup process of the microcomputer 22.
[0048] On the other hand, if the MAC value and the verification MAC value do not match and the CPU 24 determines that the code flash area 27b of the second storage area 27 has been tampered with, the CPU 24 determines that the secure boot processing result is negative (A61: NO) and determines the processing result of the fault diagnosis (A63). If the CPU 24 confirms that the second storage area 27 is operating normally and determines that the second storage area 27 is not faulty, the CPU 24 determines that the processing result of the fault diagnosis is positive (A63: YES) and stores a DTC indicating intentional data tampering (A64). On the other hand, if the CPU 24 confirms that the second storage area 27 is operating abnormally rather than normally and determines that the second storage area 27 is faulty, the CPU 24 determines that the processing result of the fault diagnosis is negative (A63: NO) and stores a DTC indicating tampering due to a fault in the second storage area 27 (A65).
[0049] The CPU 24 determines whether or not both the first storage area 26 and the second storage area 27 are faulty (A66). If the CPU 24 determines that at least one of the first storage area 26 and the second storage area 27 is not faulty (A66: NO), it transmits a tampering notification to the in-vehicle network 9 or the communication cable 11 (A67), maintains the secure boot without starting the control software (A68), and ends the startup processing of the microcomputer 22.
[0050] When the CPU 24 determines that both the first storage area 26 and the second storage area 27 are faulty (A66: YES), it sends a ROM fault notification to the in-vehicle network 9 or the communication cable 11 (A69), enables the vehicle fixation process (A70), maintains secure boot without starting the control software (A71), and ends the startup process of the microcontroller 22.
[0051] As described above, according to the third embodiment, the following advantageous effects can be obtained. In the ECU 21, the secure boot process of the first storage area 26 and the fault diagnosis process of the second storage area 27 are performed in parallel, and the fault diagnosis process of the first storage area 26 and the secure boot process of the second storage area 27 are performed in parallel. Even if a fault occurs in either the first storage area 26 or the second storage area 27, the time required to start the control software can be shortened.
[0052] If it is determined that the data in the first storage area 26 has not been tampered with, the control software can be started using the first storage area 26 as the area in use without performing the fault diagnosis process for the first storage area 26 and the secure boot process for the second storage area 27. Even if it is determined that the data in the first storage area 26 has been tampered with, if it is determined that the data in the second storage area 27 has not been tampered with, the control software can be started using the second storage area 27 as the area in use.
[0053] (Other embodiments) Although the present disclosure has been described with reference to the embodiments, it is understood that the present disclosure is not limited to the embodiments or structures. The present disclosure also encompasses various modifications and modifications within the scope of equivalents. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and spirit of the present disclosure.
[0054] The control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to perform one or more functions embodied in a computer program. Alternatively, the control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to perform one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored on a computer-readable non-transitory tangible recording medium as instructions executed by a computer. [Explanation of symbols]
[0055] In the drawing, 1 and 21 are electronic control devices, 2 and 22 are microcomputers, 3 and 23 are ROMs (data storage units), 4 and 24 are CPUs (control units), 26 is a first storage area, and 27 is a second storage area.
Claims
1. An electronic control device (21) mounted on a vehicle, a data storage unit (23) for storing data; a control unit (24) that performs a secure boot process and determines whether or not the data stored in the data storage unit has been tampered with, The data storage unit includes a first storage area (26) and a second storage area (27), When the control unit determines that the data has been tampered with, it performs a fault diagnosis process on the data storage unit to determine whether the data storage unit is faulty, and when it determines that the data storage unit is not faulty, it notifies the user that the data has been intentionally tampered with, and when it determines that the data storage unit is faulty, it notifies the user that the data has been tampered with due to a fault in the data storage unit.The electronic control unit performs a fault diagnosis process on the second storage area in parallel with performing the secure boot process on the first storage area, and when it determines that the data stored in the first storage area has been tampered with, it performs the secure boot process on the second storage area in parallel with performing the fault diagnosis process on the first storage area, and when it determines that the data stored in the second storage area has not been tampered with, it launches control software using the second storage area as the area to be used.
2. 2. The electronic control device according to claim 1, wherein when the control unit determines that the data stored in the first storage area has not been tampered with, the control unit launches control software using the first storage area as the used area without performing the fault diagnosis processing of the first storage area and the secure boot processing of the second storage area.
3. 3. The electronic control device according to claim 1, wherein the control unit notifies the user of any intentional data tampering and prompts the user to reprogram the correct control software.
4. 4. The electronic control device according to claim 1, wherein the control unit notifies the user of the data falsification caused by a malfunction of the data storage unit and urges the user to replace the microcomputer.
5. 5. The electronic control device according to claim 1, wherein, when the control unit determines that the data has been intentionally tampered with, it stores a DTC code indicating intentional data tampering, and when the control unit determines that the data has been tampered with due to a failure of the data storage unit, it stores a DTC code indicating data tampering due to a failure of the data storage unit.