Electronic control unit and cryptographic key update program

Abstract

To suppress the increase in frequency of replacement of an electronic control apparatus while suppressing decrease in security of the electronic control apparatus.SOLUTION: A vehicle 10 includes a master ECU 20 and a slave ECU 30 that can communicate with each other over a network 12. The master ECU 20 and the slave ECU 30 includes processing circuits 21, 31, respectively. The processing circuits 21, 31 each count a failure count which is the number of failures in updating a cryptographic key, and disable a function of updating the cryptographic key when the failure count exceeds an upper limit of the failure count. When a power supply 13 stops supplying power while the updating function is disabled and thereafter the power supply 13 starts supplying power, the processing circuits 21, 31 enable the updating function.SELECTED DRAWING: Figure 1

Description

Technical Field

[0005] , , ,

[0001] The present invention relates to an electronic control device mounted on a vehicle and an encryption key update program.

Background Art

[0002] Patent Document 1 discloses an in-vehicle network system including one first node and a plurality of second nodes. In the system, the first node transmits an encrypted encryption key for message authentication between nodes to the plurality of second nodes. Further, the first node transmits verification data for verifying whether the encrypted encryption key can be correctly decrypted to the plurality of nodes.

[0003] The second node executes a process of decrypting the encryption key received from the first node. Further, when the second node receives the verification data, it verifies whether the decryption of the encryption key is successful or failed based on the decrypted encryption key data and the verification data. Then, when the decryption of the encryption key is successful, the second node updates the encryption key by storing the encryption key.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

[0006] Even if communication failures or procedural errors occur between nodes, decryption of the encryption key may still fail. As mentioned above, if there is a limit on the number of failures, the number of failures may exceed the limit if decryption fails multiple times due to communication failures or procedural errors. In this case, even though the encryption key has not been updated through hacking, a second node will need to be replaced in order to update the encryption key. [Means for solving the problem]

[0007] The electronic control device for solving the above problems is a device mounted in a vehicle and configured to communicate with other electronic control devices via an in-vehicle network. The electronic control device includes a processing circuit. The processing circuit counts the number of failures, which is the number of times the encryption key update for message authentication with the other electronic control devices has failed; disables the encryption key update function when the number of failures exceeds the upper limit of the number of failures; and enables the update function when the power supply from the vehicle's power supply to the electronic control device is stopped while the update function is disabled, and then power supply from the power supply to the electronic control device is started again.

[0008] The encryption key update program for solving the above problem is a program executed by an electronic control unit installed in a vehicle. The electronic control unit is configured to communicate with other electronic control units via an in-vehicle network. The encryption key update program causes the electronic control unit to perform the following actions: count the number of failures, which is the number of times the encryption key update for message authentication with the other electronic control units has failed to update; disable the encryption key update function when the number of failures exceeds the upper limit of the number of failures; and enable the update function when the power supply from the vehicle's power supply to the electronic control unit is stopped while the update function is disabled, and then power supply from the power supply to the electronic control unit is started again. [Effects of the Invention]

[0009] The above-mentioned electronic control unit and encryption key update programs have the effect of suppressing a decrease in the security of the electronic control unit while also suppressing an increase in the number of times the electronic control unit needs to be replaced. [Brief explanation of the drawing]

[0010] [Figure 1] Figure 1 is a schematic diagram showing a vehicle equipped with an electronic control device according to an embodiment. [Figure 2] Figure 2 is a flowchart showing a series of processes performed by a master ECU and a slave ECU, which are examples of electronic control devices according to the embodiment. [Figure 3] Figure 3 is a flowchart showing a series of processes performed by a master ECU, which is an example of an electronic control device according to the embodiment. [Figure 4] Figure 4 is a flowchart showing a series of processes performed by a slave ECU, which is an example of an electronic control unit according to the embodiment. [Figure 5] Figure 5 is a sequence diagram showing an example of the processing flow when the encryption key update fails. [Modes for carrying out the invention]

[0011] The following describes one embodiment of an electronic control unit and encryption key update program with reference to Figures 1 to 5. Hereafter, the electronic control unit will be referred to as "ECU". "ECU" is an abbreviation for "Electronic Control Unit". The "encryption key" referred to here is a key used for message authentication between multiple ECUs.

[0012] As shown in Figure 1, the vehicle 10 is equipped with a power supply 13 and multiple ECUs. The multiple ECUs correspond to the ECUs mounted on the vehicle 10. The ECUs operate by being powered by the power supply 13. On the other hand, if the power supply from the power supply 13 is stopped, the operation of the ECUs stops. The multiple ECUs include a master ECU 20 and multiple slave ECUs 30.

[0013] The master ECU 20 can communicate with multiple slave ECUs 30 via the in-vehicle network 12. An example of the in-vehicle network 12 is CAN. "CAN" is an abbreviation for "Controller Area Network".

[0014] The master ECU 20 is equipped with a processing circuit 21. For example, the processing circuit 21 includes a CPU 22, a first storage device 23, and a second storage device 24. For example, the first storage device 23 is a non-volatile memory, and the second storage device 24 is a volatile memory. The first storage device 23 stores the software executed by the CPU 22. Data transmitted and received via the in-vehicle network 12 is encrypted. Therefore, when the processing circuit 21 of the master ECU 20 receives data from the slave ECU 30 via the in-vehicle network 12, it decrypts the data using an encryption key that it has stored.

[0015] The plurality of slave ECUs 30 each include a processing circuit 31. For example, the processing circuit 31 has a CPU 32 and a storage device 33. The storage device 33 is a non-volatile memory. Various software executed by the CPU 32 is stored in the storage device 33. As described above, the data transmitted and received via the in-vehicle network 12 is encrypted. Therefore, when the processing circuit 31 of the slave ECU 30 receives data from another ECU via the in-vehicle network 12, it decrypts the data by using the encryption key stored in itself.

[0016] Referring to FIG. 2, a series of processes executed in both the master ECU 20 and the slave ECU 30 when power supply from the power supply 13 is started will be described. In the master ECU 20, the processing circuit 21 executes a series of processes by the CPU 22 executing the software of the first storage device 23. In the slave ECU 30, the processing circuit 31 executes a series of processes by the CPU 32 executing the software of the storage device 33.

[0017] In step S11, the processing circuits 21 and 31 determine whether the update function of their own encryption key is disabled. If the update function is disabled (S11: YES), the processing circuits 21 and 31 transfer the process to step S13. If the update function is enabled (S11: NO), the processing circuits 21 and 31 end the series of processes.

[0018] In step S13, the processing circuits 21 and 31 enable their own update function. That is, the process in step S13 corresponds to a process of enabling the update function when the power supply to the ECU from the power supply 13 is stopped in a state where the update function is disabled and then the power supply to the ECU from the power supply 13 is started. In the next step S15, the processing circuits 21 and 31 reset the failure count CNT managed by themselves to 0 (zero). As will be described in detail later, the failure count CNT is the number of times the decryption of the encryption key fails. Thereafter, the processing circuits **********21 and 31 end the series of processes.

[0019] Referring to FIG. 3, a series of processes executed by the master ECU 20 when an update of the encryption key is requested will be described. That is, the processing circuit 21 executes a series of processes by the CPU 22 executing the software of the first storage device 23.

[0020] In step S21, the processing circuit 21 determines whether the update function of its own encryption key is valid. If the update function is valid (S21: YES), the processing circuit 21 proceeds to step S23. On the other hand, if the update function is invalid (S21: NO), the processing circuit 21 ends the series of processes.

[0021] In step S23, the processing circuit 21 creates a new encryption key and encrypts the encryption key. Then, the processing circuit 21 stores the new encryption key. In the next step S25, the processing circuit 21 creates verification data. The verification data is data used to verify whether the encryption key has been successfully decrypted or failed to be decrypted by the slave ECU 30.

[0022] In the subsequent step S27, the processing circuit 21 transmits the encrypted encryption key data to a plurality of slave ECUs 30. In the next step S29, the processing circuit 21 transmits the verification data to a plurality of slave ECUs 30. In the subsequent step S31, the processing circuit 21 determines whether the elapsed time since the verification data was transmitted has reached a predetermined waiting time. If the elapsed time has reached the waiting time, it is considered that the decryption of the encryption key and the verification of whether the decryption of the encryption key has been successful have been completed by the slave ECU 30. Therefore, if the elapsed time has not reached the waiting time (S31: NO), the processing circuit 21 repeats the determination in step S31 until the elapsed time reaches the waiting time. On the other hand, if the elapsed time has reached the waiting time (S31: YES), the processing circuit 21 proceeds to step S33.

[0023] In step S33, the processing circuit 21 queries the multiple slave ECUs 30 for verification results. In the following step S35, the processing circuit 21 determines whether or not it has received information regarding the verification results from the multiple slave ECUs 30. If the processing circuit 21 has not received information regarding the verification results from at least one of the multiple slave ECUs 30 (S35: NO), it repeats the determination in step S35. On the other hand, if the processing circuit 21 has received information regarding the verification results from the multiple slave ECUs 30 (S35: YES), it proceeds to step S37.

[0024] In step S37, the processing circuit 21 determines whether there is a slave ECU 30 among the multiple slave ECUs 30 that failed to decrypt the encryption key. A slave ECU 30 that failed to decrypt the encryption key corresponds to a "device that failed to update the encryption key". If there is a slave ECU 30 that failed to decrypt (S37: YES), the processing circuit 21 proceeds to step S39. On the other hand, if there is no slave ECU 30 that failed to decrypt (S37: NO), the processing circuit 21 terminates the series of processes.

[0025] In step S39, the processing circuit 21 determines whether there is a slave ECU 30 among the multiple slave ECUs 30 that has successfully decrypted the encryption key. A slave ECU 30 that has successfully decrypted the encryption key corresponds to a "device that has successfully updated the encryption key". If there is a slave ECU 30 that has successfully decrypted the key (S39: YES), the processing circuit 21 proceeds to step S41. On the other hand, if there is no slave ECU 30 that has successfully decrypted the key (S39: NO), the processing circuit 21 proceeds to step S43.

[0026] In step S41, the processing circuit 21 requests the slave ECU 30, which has successfully decrypted the encryption key, to update the failure count CNT. Then, the processing circuit 21 proceeds to step S43.

[0027] In step S43, the processing circuit 21 updates the failure count CNT, which it manages, so that the failure count CNT increases by 1. In other words, the process in step S43 corresponds to the process of counting the failure count CNT, which is the number of times the encryption key update has failed.

[0028] In the following step S45, the processing circuit 21 determines whether the failure count CNT, which it manages, exceeds the count determination value CNTth. The count determination value CNTth is the upper limit of the failure count CNT. For example, an integer of 2 or more is set as the count determination value CNTth. If the failure count CNT exceeds the count determination value CNTth (S45: YES), the processing circuit 21 proceeds to step S47. On the other hand, if the failure count CNT is less than or equal to the count determination value CNTth (S45: NO), the processing circuit 21 terminates the series of processes.

[0029] In step S47, the processing circuit 21 disables its own encryption key update function. In other words, the process in step S47 corresponds to the process of disabling the encryption key update function when the number of failures CNT exceeds the upper limit of the number of failures CNT. After that, the processing circuit 21 terminates the series of processes.

[0030] Referring to Figure 4, a series of processes performed by the slave ECU 30 when an encryption key update is requested will be explained. In the slave ECU 30, the CPU 32 executes the software on the storage device 33, which in turn causes the processing circuit 31 to perform a series of processes.

[0031] In step S61, the processing circuit 31 determines whether its encryption key update function is enabled or not. If the update function is enabled (S61: YES), the processing circuit 31 proceeds to step S63. On the other hand, if the update function is disabled (S61: NO), the processing circuit 31 terminates the series of processes.

[0032] In step S63, the processing circuit 31 determines whether or not it has received new encrypted encryption key data from the master ECU 20. If the processing circuit 31 has received new encryption key data (S63: YES), it proceeds to step S65. On the other hand, if the processing circuit 31 has not received new encryption key data (S63: NO), it repeats the determination in step S63.

[0033] In step S65, the processing circuit 31 decrypts the new encryption key, which is currently encrypted. In this process, the processing circuit 31 uses the encryption key from before the update to decrypt the new encryption key. In the following step S67, the processing circuit 31 determines whether or not it has received verification data from the master ECU 20. If the processing circuit 31 has received verification data (S67: YES), it proceeds to step S69. On the other hand, if the processing circuit 31 has not received verification data (S67: NO), it repeats the determination in step S67.

[0034] In step S69, the processing circuit 31 uses verification data to verify whether the decryption of the new encryption key was successful. In the following step S71, the processing circuit 31 determines, based on the verification result, whether the decryption of the encryption key failed. If the decryption failed (S71: YES), the processing circuit 31 proceeds to step S73. On the other hand, if the decryption was successful (S71: NO), the processing circuit 31 proceeds to step S79.

[0035] In step S73, the processing circuit 31 updates the failure count CNT so that the failure count CNT it manages increases by 1. In the following step S75, the processing circuit 31 determines whether the failure count CNT has exceeded the count determination value CNTth. If the failure count CNT has exceeded the count determination value CNTth (S75: YES), the processing circuit 31 proceeds to step S77. On the other hand, if the failure count CNT is less than or equal to the count determination value CNTth (S75: NO), the processing circuit 31 proceeds to step S79.

[0036] In step S77, the processing circuit 31 disables the update function. The processing in step S77 corresponds to the process of disabling the encryption key update function when the number of failures CNT exceeds the upper limit of the number of failures CNT. Then, the processing circuit 31 moves on to step S79.

[0037] In step S79, the processing circuit 31 determines whether or not it has received an inquiry from the master ECU 20 regarding the verification result. If the processing circuit 31 has received an inquiry (S79: YES), it proceeds to step S81. On the other hand, if the processing circuit 31 has not received an inquiry (S79: NO), it repeats the determination in step S79.

[0038] In step S81, the processing circuit 31 transmits information regarding the verification result to the master ECU 20. In the following step S83, the processing circuit 31 determines whether or not it has received a request from the master ECU 20 to update the failure count CNT. If the processing circuit 31 has received the request (S83: YES), it proceeds to step S85. On the other hand, if the processing circuit 31 has not received the request (S83: NO), it terminates the series of processes.

[0039] In step S85, the processing circuit 31 updates the failure count CNT, similar to step S73. That is, the process in step S85 corresponds to the process of counting the failure count CNT, which is the number of times the encryption key update has failed. In the next step S87, the processing circuit 31 determines whether the failure count CNT exceeds the count determination value CNTth. If the failure count CNT exceeds the count determination value CNTth (S87: YES), the processing circuit 31 proceeds to step S89. On the other hand, if the failure count CNT is less than or equal to the count determination value CNTth (S87: NO), the processing circuit 31 terminates the series of processes.

[0040] In step S89, the processing circuit 31 disables the update function. The processing in step S89 corresponds to the process of disabling the encryption key update function when the failure count CNT exceeds the upper limit of the failure count CNT. After that, the processing circuit 31 terminates the series of processes.

[0041] <Operation and Effects of This Embodiment> Referring to Figure 5, the process of updating the encryption key will be explained. For the sake of clarity and ease of understanding, it is assumed that the control system of the vehicle 10 includes a first slave ECU 30 and a second slave ECU 30 as slave ECUs 30.

[0042] The tool is connected to the control system for communication. The tool then requests the master ECU 20 and the multiple slave ECUs 30 to update the encryption key (S100). The master ECU 20 then creates a new encryption key and encrypts it (S23). Verification data is then generated (S25). The master ECU 20 then sends the new encryption key data to the multiple slave ECUs 30 (S27). After that, the master ECU 20 sends the verification data to the multiple slave ECUs 30 (S29).

[0043] In each of the multiple slave ECUs 30, upon receiving new encryption key data, the encryption key is decrypted (S65). Additionally, upon receiving verification data, verification is performed to determine whether the encryption key decryption was successful or unsuccessful (S69). In the example shown in Figure 5, the first slave ECU 30 fails to decrypt the encryption key, while the second slave ECU 30 successfully decrypts it.

[0044] Therefore, the failure count CNT is updated in the first slave ECU 30 (S73). Then, as a result of comparing the failure count CNT with the count determination value CNTth, if the failure count CNT exceeds the count determination value CNTth (S75: YES), the encryption key update function of the first slave ECU 30 is disabled (S77).

[0045] The master ECU 20 sends a query for verification results to multiple slave ECUs 30 (S33). The first slave ECU 30 then sends a message to the master ECU 20 indicating that it failed to decrypt the encryption key as information regarding the verification results (S81). Meanwhile, the second slave ECU 30 sends a message to the master ECU 20 indicating that it succeeded in decrypting the encryption key as information regarding the verification results (S81). When the master ECU 20 receives information regarding the verification results from multiple slave ECUs 30 (S35:YES), it sends an update to the failure count CNT to the second slave ECU 30 (S41).

[0046] Then, the failure count CNT is updated in the master ECU20 and the second slave ECU30, respectively (S43, S85). If, as a result of comparing the failure count CNT with the count determination value CNTth, the failure count CNT exceeds the count determination value CNTth (S45:YES / S87:YES), the encryption key update function is disabled (S47, S89).

[0047] Power supply from power supply 13 to the master ECU 20 and the multiple slave ECUs 30 is stopped. Then, power supply from power supply 13 to the master ECU 20 and the multiple slave ECUs 30 is started again. At this point, the encryption key update function is enabled in the master ECU 20 and the multiple slave ECUs 30 (S13). Furthermore, the failure count CNT is reset to 0 (zero).

[0048] In this embodiment, the following effects can be obtained. (1) In either the master ECU20 or the multiple slave ECUs30, if the failure count CNT exceeds the count determination value CNTth, the encryption key update function is disabled. This prevents the encryption key from being illegally updated by external hacking. Furthermore, if power is stopped to the master ECU20 and the multiple slave ECUs30 while the update function is disabled, and then power is restored to the master ECU20 and the multiple slave ECUs30, the update function is re-enabled in the master ECU20 and the multiple slave ECUs30. Once the update function is enabled, the encryption key can be updated. In other words, it is not necessary to replace the master ECU20 and the multiple slave ECUs30 to update the encryption key. Therefore, the master ECU20 and the multiple slave ECUs30 can suppress an increase in the number of ECU replacements while suppressing a decrease in security.

[0049] (2) In the master ECU20 and the multiple slave ECUs30, if power is stopped to the master ECU20 and the multiple slave ECUs30 while the update function is disabled, and then power is started to the master ECU20 and the multiple slave ECUs30, the failure count CNT is reset to 0 (zero). This prevents the update function from being disabled again in the master ECU20 and the multiple slave ECUs30 due to a single failure in decrypting the encryption key.

[0050] (3) If decryption of the encryption key fails in only some of the multiple slave ECUs 30, the failure count CNT will be updated in the slave ECUs 30 that succeeded in decrypting the encryption key and in the master ECU 20. This allows the master ECU 20 and the multiple slave ECUs 30 to disable the update function at their own discretion.

[0051] <Example of changes> The above embodiment can be implemented with the following modifications. The above embodiment and the following modifications can be combined with each other to the extent that they do not contradict each other technically.

[0052] The processing circuit 21 of the master ECU 20 does not need to request the slave ECU 30 that successfully updated their encryption key to update the failure count CNT if the encryption key update fails in some of the multiple slave ECUs 30. In this case, the processing circuit 21 may not only disable its own update function when the failure count CNT it manages exceeds the count determination value CNTth, but may also instruct the slave ECU 30 to disable the update function.

[0053] The processing circuit 21 of the master ECU 20 does not need to update the failure count CNT that it manages if the encryption key update fails in at least one of the multiple slave ECUs 30. In this case, if the update function is disabled in at least one of the multiple slave ECUs 30, the processing circuit 21 of the master ECU 20 may disable its own update function if it obtains information that there is a slave ECU 30 whose update function has been disabled.

[0054] - If the update function is disabled and power is stopped from supplying power to the master ECU 20 and multiple slave ECUs 30, and then power is started again to the master ECU 20 and multiple slave ECUs 30, the processing circuits 21 and 31 do not need to reset the failure count CNT to 0 (zero).

[0055] The ECU that transmits and receives data from a data center located outside the vehicle may be configured to function as the master ECU. The processing circuits 21 and 31 are not limited to those that include a CPU and ROM and execute software processing. In other words, the processing circuits 21 and 31 may have any of the following configurations: (a), (b), and (c).

[0056] (a) The processing circuits 21 and 31 each include one or more processors that perform various processes according to a computer program. The processors include a CPU and memory such as RAM and ROM. The memory stores program code or instructions configured to cause the CPU to perform the processes. The memory, i.e., computer-readable media, includes any available media that can be accessed by a general-purpose or dedicated computer.

[0057] (b) The processing circuits 21 and 31 are equipped with one or more dedicated hardware circuits that perform various processes. Examples of dedicated hardware circuits include application-specific integrated circuits, i.e., ASICs or FPGAs. ASIC is an abbreviation for "Application Specific Integrated Circuit," and FPGA is an abbreviation for "Field Programmable Gate Array."

[0058] (c) Processing circuits 21 and 31 each include a processor that executes a portion of the various processes according to a computer program, and dedicated hardware circuits that execute the remaining processes among the various processes. [Explanation of Symbols]

[0059] 10...Vehicle, 12...In-vehicle network, 13...Power supply, 20...Master ECU, 21...Processing circuit, 30...Slave ECU, 31...Processing circuit.

Claims

1. An electronic control device that is mounted in a vehicle and configured to communicate with other electronic control devices via an in-vehicle network, Equipped with a processing circuit, The aforementioned processing circuit is The number of failures, which is the number of times the encryption key update for message authentication with the aforementioned other electronic control device has failed, If the number of failures exceeds the upper limit for the number of failures, the encryption key update function will be disabled. If the update function is disabled and power supply from the vehicle's power source to the electronic control unit is stopped, and then power supply from the power source to the electronic control unit is started again, the update function will be enabled. Electronic control unit.

2. The processing circuit performs the following action: when the update function is disabled, power supply from the power source to the electronic control unit is stopped, and then power supply from the power source to the electronic control unit is restarted, the failure count is reset to 0 (zero). The electronic control device according to claim 1.

3. The aforementioned processing circuit is By transmitting the encryption key data to a plurality of other electronic control devices, the plurality of other electronic control devices are instructed to update the encryption key. If there is a device among the aforementioned multiple other electronic control devices that has failed to update the encryption key, it will update the number of failures it manages and perform the following actions: The electronic control device according to claim 1 or claim 2.

4. The processing circuit, if among the plurality of other electronic control devices, includes both a device that failed to update the encryption key and a device that succeeded in updating the encryption key, requests the device that succeeded in updating the encryption key to update the number of failures it manages. The electronic control device according to claim 3.

5. An update program for cryptographic keys that is executed in an electronic control unit installed in a vehicle, The aforementioned electronic control unit is configured to communicate with other electronic control units via an in-vehicle network. The number of failures, which is the number of times the encryption key update for message authentication with the aforementioned other electronic control device has failed, If the number of failures exceeds the upper limit for the number of failures, the encryption key update function will be disabled. If the update function is disabled and power supply from the vehicle's power source to the electronic control unit is stopped, and then power supply from the power source to the electronic control unit is started again, the electronic control unit will be instructed to enable the update function. An update program for cryptographic keys.

Images