Onboard electronic control unit

Abstract

To write the same electronic key in all microcomputers utilizing electronic keys even in a case where an ECU including a plurality of microcomputers internally includes a microcomputer having no external communication function.SOLUTION: An on-vehicle electronic control device comprises a first microcomputer and a second microcomputer. The first microcomputer includes a first processor, a first storage section, a first communication section, a first HSM including a first nonvolatile storage section, and a first inter-microcomputer communication section. The second microcomputer includes a second processor, a second storage section, a second inter-microcomputer communication section, and a second HSM including a second nonvolatile storage section. The first processor writes a received electronic key in the first HSM, and the electronic key is transferred to the second microcomputer by the first processor and written in the second nonvolatile storage section.SELECTED DRAWING: Figure 1

Description

[[TECHNICAL FIELD]]

[0001] The present invention relates to writing of an electronic key for an in-vehicle electronic control device. [[BACKGROUND ART]]

[0002] In-vehicle electronic control devices such as ECUs (Electronic Control Units) are controlled by a microcomputer (hereinafter referred to as a microcomputer). Various functions are assigned to the microcomputer, and external circuits corresponding to each function are further provided. The target device is controlled by control software stored in a flash ROM, which is a non-volatile memory. In automobiles, for example, the microcomputer controls fuel injection and ignition of an engine.

[0003] Depending on the safety goal defined in functional safety requirements, high redundancy may be required for the system configuration. There is a method of ensuring redundancy by mounting and controlling a plurality of microcomputers inside one ECU. Examples of such systems include electric power steering control ECUs, for example.

[0004] From the perspective of cybersecurity, in recent years, security threats from outside the vehicle have been increasing in connected-generation in-vehicle ECUs, and automotive standards related to cybersecurity have been formulated. In the forum called WP.29, which is a subsidiary body of the United Nations, discussions on the issuance of security regulations started around 2019, an agreement was reached in June 2020, and the regulations were issued in December 2020.

[0005] WP.29 requires, for example, message authentication for communication between in-vehicle ECUs, device authentication for software updates, verification of digital signatures, software encryption, and verification of secure boot when the system starts up, among other requirements.

[0006] In cryptography, a key technology for cybersecurity, information about the electronic key (encryption key) is crucial. This electronic key and data are used as input to the cryptographic algorithm to perform cryptographic operations. Candidate encryption methods include "symmetric-key cryptography" and "public-key cryptography."

[0007] In symmetric-key cryptography, a common key is used between the sender and receiver. If this key is leaked to a third party, they can decrypt the ciphertext into plaintext, thus revealing its contents. In other words, the symmetric key is as valuable as the plaintext that needs to be kept secret, and therefore must be securely managed within the vehicle's ECU.

[0008] In public-key cryptography, the data-transferring client, such as the electronic key transmission unit, holds the private key, while the in-vehicle ECU, which acts as the server, holds the public key. A characteristic of public-key cryptography is that the private key must be managed securely, just like the symmetric key, but the public key is not necessarily. However, to prevent the public key within the in-vehicle ECU from being overwritten by a third party, the public key may be managed in the same manner as the symmetric key.

[0009] The microcontroller is equipped with an HSM (Hardware Security Module), which can securely manage the ECU's electronic keys internally (see, for example, Patent Document 1). The slots for the keys to be registered are assigned according to the type of electronic key, and the initial writing and updating of electronic keys are performed in predefined slots.

[0010] The writing method involves connecting the electronic key transmitter to the ECU via a wired connection through the OBD (On-board Diagnostic) connector, and transmitting the electronic key to the ECU to be rewritten using a predetermined communication protocol such as CAN (Car Area Network), Ethernet, LIN (Local Interconnect Network), or FlexRay. After the electronic key has been written, the ECU must respond to the electronic key transmitter with a signal indicating the writing result.

[0011] Furthermore, after the microcontroller obtains an electronic key from an external source, it needs to retain the key until it performs the electronic key writing process to the HSM. However, security requirements may impose restrictions on the retention time, in which case the system configuration must be considered in light of these restrictions. [Prior art documents] [Patent Documents]

[0012] [Patent Document 1] Japanese Patent Publication No. 2022-107288 [Overview of the project] [Problems that the invention aims to solve]

[0013] When multiple microcontrollers are installed inside a single ECU, even if the same electronic key is used, the electronic key transmission unit can individually send the electronic key to each microcontroller. The microcontroller that receives the data can then write the electronic key to the HSM and respond individually with whether the writing was successful or not.

[0014] However, depending on the configuration of the redundant system, there may be microcontrollers within the ECU that do not have external communication capabilities. If an electronic key is used even with a microcontroller that does not have external communication capabilities, conventional technology has the problem that it is not possible to send the same electronic key and write result to all microcontrollers.

[0015] In microcontrollers without external communication capabilities, it may be impossible to send or receive signals such as CAN, or it may be possible to receive signals from external sources but not send them. Therefore, it is necessary to perform the same electronic key transmission and write result response using a method that does not involve direct communication with the electronic key transmission unit.

[0016] The present invention was made to solve the above problems, and aims to provide an in-vehicle electronic control device that can write the same electronic key to all microcontrollers that use an electronic key, even if the ECU system, which includes multiple microcontrollers, has a microcontroller internally that does not have an external communication function. [Means for solving the problem]

[0017] The present invention relates to an in-vehicle electronic control device having a first microcomputer and a second microcomputer, comprising: a first processor that performs arithmetic processing on the first microcomputer; a first storage unit connected to the first processor for storing information; a first communication unit connected to the first processor for communicating with the outside and receiving an electronic key; a first hardware security module that performs cryptographic processing and comprises a first non-volatile storage unit connected to the first processor for holding the electronic key; a first inter-microcomputer communication unit connected to the first processor for communicating with the second microcomputer; a second processor that performs arithmetic processing on the second microcomputer; a second storage unit connected to the second processor for storing information; a second inter-microcomputer communication unit connected to the second processor for communicating with the first microcomputer; and a second non-volatile storage unit connected to the second processor for holding the electronic key for performing cryptographic processing. The system comprises a first processor and a second hardware security module, wherein the first processor passes the electronic key received by the first communication unit to the first hardware security module for writing to the first non-volatile storage unit, the first processor transfers the electronic key to the second microcomputer via the first microcomputer-to-microcomputer communication unit, and obtains the first write result of the electronic key from the first hardware security module, the second processor passes the electronic key received via the second microcomputer-to-microcomputer communication unit to the second hardware security module for writing to the second non-volatile storage unit, obtains the second write result of the electronic key from the second hardware security module and transmits it to the first microcomputer via the second microcomputer-to-microcomputer communication unit, and the first processor integrates the write result of the electronic key from the first write result and the second write result and transmits it externally. [Effects of the Invention]

[0018] The vehicle-mounted electronic control device according to the present invention, even when internally including a microcomputer that does not have an external communication function, can write the same electronic key to all microcomputers that use the electronic key by receiving a single signal containing the electronic key from an electronic key transmission unit, and notify the electronic key transmission source of the writing result through a single signal transmission.

[0019] For writing the electronic key, it is only necessary to transmit the electronic key writing signal to the first microcomputer, so there is no need to issue individual instructions to each microcomputer. Even for a vehicle-mounted electronic control unit (ECU) having a plurality of microcomputers, a writing operator can acquire the writing success or failure at one time. Since the device appears as a single ECU from an external perspective, the degree of freedom in communication design and the configuration of microcomputers is also improved.

[0020] The second microcomputer starts writing by acquiring electronic key information from the first microcomputer via inter-microcomputer communication. Therefore, there is no problem that only the electronic key is acquired and a long period of time passes during which writing processing cannot be performed, and the security requirement regarding the time constraint for holding the electronic key can be satisfied.

[0021] Details of at least one implementation of the subject matter disclosed in the present specification are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the disclosed subject matter will become apparent from the following disclosure, the drawings, and the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] [Figure 1] FIG. 1 is a diagram showing the system configuration of an ECU equipped with two microcomputers according to Embodiment 1 of the present invention, in a case where the first microcomputer communication unit and the electronic key transmission unit are connected. [Figure 2] FIG. 2 is a flowchart showing the electronic key writing process according to Embodiment 1 of the present invention. [Figure 3] FIG. 3 is a flowchart detailing the process from the start to the completion of the electronic key writing process of the first microcomputer according to Embodiment 1 of the present invention. [Figure 4] It is a flowchart detailing the process from the start to the completion of electronic key transfer using inter-microcomputer communication from a first microcomputer to a second microcomputer according to Embodiment 1 of the present invention. [Figure 5] It is a flowchart detailing the process from the start to the completion of response waiting from the second microcomputer by the first microcomputer according to Embodiment 1 of the present invention. [Figure 6] It is a flowchart detailing the process from the start to the completion of electronic key writing processing by the second microcomputer according to Embodiment 1 of the present invention. [Figure 7] It is a flowchart detailing the process from the start to the completion of electronic key write result transfer processing using inter-microcomputer communication from the second microcomputer to the first microcomputer according to Embodiment 1 of the present invention. [Figure 8] It is a diagram showing the system configuration when a first microcomputer communication unit, a second microcomputer communication unit, and an electronic key transmission unit are connected in an ECU equipped with two microcomputers according to Embodiment 2 of the present invention. [Figure 9] It is a diagram showing the system configuration when a data relay ECU is connected between an ECU equipped with two microcomputers according to Embodiment 3 of the present invention and an electronic key transmission unit, and the first microcomputer communication unit and the electronic key transmission unit are connected. [Figure 10] It is a diagram showing the system configuration when a data relay ECU is connected between an ECU equipped with two microcomputers according to Embodiment 4 of the present invention and an electronic key transmission unit, and the first microcomputer communication unit, the second microcomputer communication unit, and the electronic key transmission unit are connected. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the accompanying drawings. EXAMPLES

[0024] Figure 1 shows the internal configuration of an ECU (automotive electronic control unit or in-vehicle electronic control unit) 1 according to Embodiment 1 of the present invention. The ECU 1 includes a first microcontroller 2 and a second microcontroller 2'. The first microcontroller 2 and the second microcontroller 2' include at least one host-side CPU (Central Processing Unit) 3, 3' and at least one secure CPU 8, 8' that perform software arithmetic processing.

[0025] The host CPUs 3 and 3' are, for example, CPUs that execute publicly known or well-known application programs (host programs). The secure CPUs 8 and 8' (which may be dedicated security CPUs) are, for example, CPUs that execute security programs and perform security calculations using keys (electronic keys). By these CPUs executing their respective programs, the first microcontroller 2 and the second microcontroller 2' realize the functions described herein.

[0026] The first microcontroller 2 and the second microcontroller 2' include a host-side memory area and a secure memory area as memory units. The host-side memory area includes at least one local RAM 4, 4' (host-side volatile memory) dedicated to each host-side CPU 3, 3'.

[0027] The secure storage area includes local RAM 9, 9' (secure volatile memory) dedicated to secure CPUs 8, 8'. These RAMs are configured to be accessible only from the corresponding CPUs.

[0028] The host-side memory area includes the first microcontroller host-side non-volatile memory 7 and 7' which store programs executed by the host-side CPUs 3 and 3' (host programs) and data used by the host programs, as well as shared RAM 5 and 5' (host-side volatile memory) that can be accessed by the host-side CPUs 3 and 3' and secure CPUs 8 and 8', respectively.

[0029] The secure storage area includes programs executed by the secure CPUs 8 and 8' (secure programs, HSM (Hardware Security Module) firmware) and secure non-volatile memories 10 and 10' for storing data used by the secure programs. The secure non-volatile memories 10 and 10' can store electronic keys used by the secure programs.

[0030] The host CPU is connected to data buses and peripheral buses 12 and 12'. In addition, there are dedicated data buses and peripheral buses 13 and 13' for the secure core (HSM), which are isolated from these buses and connected only to secure CPUs 8 and 8'.

[0031] The secure non-volatile memory 10 and 10' are configured to be inaccessible from cores other than the secure CPU 8 and 8' (host-side CPU 3 and 3'). In other words, the secure CPU 8 and 8' can access the secure storage area, but the host-side CPU 3 and 3' cannot.

[0032] Devices having a secure CPU and secure memory area are called HSM20 and 20', and can securely manage electronic keys within secure non-volatile memory and perform cryptographic calculations using those electronic keys. While the example shown places HSM20 and 20' inside the first microcontroller 2 and second microcontroller 2', this is not the only option; they can be placed outside the first microcontroller 2 and second microcontroller 2' and connected to their data bus / peripheral buses 12 and 12'.

[0033] The first microcontroller 2 and the second microcontroller 2' are equipped with at least one communication unit 6, 6'. This communication unit 6 is connected to an electronic key transmission unit 14 located outside the ECU 1, and communicates with the electronic key transmission unit 14 when writing an electronic key. The communication unit 6' of the second microcontroller 2' is not connected to the outside.

[0034] Figure 2 is a flowchart showing an example of the electronic key writing process. In the electronic key writing process, in step S1, an electronic key writing command is sent from the electronic key transmission unit (diagnostic device) 14. When the ECU to which the electronic key is to be written receives the command, the process starts and proceeds to step S2.

[0035] In step S2, the first microcontroller 2 determines whether the message identifiers defined by communication protocols such as CAN, among the instructions containing the electronic key writing data, are subject to reception permission. The second microcontroller 2' may also perform a similar determination if it is capable of external reception. If reception is permitted, the process proceeds to step S4; otherwise, the process proceeds to step S3.

[0036] In step S3, since the determination that reception is not permitted has been made, the first microcontroller 2 and the second microcontroller 2' discard the received electronic key write data and proceed to step S14.

[0037] In step S4, since the reception permission has been determined, the first microcontroller 2 starts the electronic key writing process, and proceeds to step S5 after the writing is complete.

[0038] In step S5, the first microcontroller 2 determines whether the writing in step S4 was completed successfully. If the writing was completed successfully, the process proceeds to step S6. If the writing failed, the process proceeds to step S13.

[0039] In step S6, since the writing of the electronic key on the first microcontroller 2 has been successfully completed, the first microcontroller 2 uses inter-microcontroller communication to begin transferring the electronic key to the second microcontroller 2' in order to proceed with writing the electronic key to the second microcontroller 2'.

[0040] In step S7, the first microcontroller 2 determines whether the transfer of the electronic key to the second microcontroller 2' has been successfully completed. If the transfer process is successfully completed, the process proceeds to step S8. If the transfer process fails or terminates abnormally, the process proceeds to step S13.

[0041] In step S8, since the transfer of the electronic key from the first microcontroller 2 to the second microcontroller 2' has been successfully completed, the first microcontroller 2 starts waiting for a response from the second microcontroller 2'.

[0042] In step S9, when the second microcontroller 2' receives the electronic key from the first microcontroller 2 via microcontroller-to-microcontroller communication, the second microcontroller 2' starts the electronic key writing process, and proceeds to step S10 after the writing is complete.

[0043] In step S10, the second microcontroller 2' starts transferring the success or failure result of the electronic key writing process to the first microcontroller 2 using inter-microcontroller communication, and then proceeds to step S11.

[0044] In step S11, the first microcontroller 2 receives the success or failure of the write result from the second microcontroller 2' via inter-microcontroller communication. If the write is successful on the second microcontroller 2', the process proceeds to step S12.

[0045] If writing to the second microcontroller 2' fails, the process proceeds to step S13. Furthermore, if the first microcontroller 2 fails to receive confirmation of the success or failure of the writing result from the second microcontroller 2' within a predetermined period of time for the response waiting process initiated in step S8, it is considered a writing failure in the second microcontroller 2' or a communication error between the microcontrollers, and the process proceeds to step S13.

[0046] In step S12, the first microcontroller 2 verifies that the write result information of the first microcontroller 2 and the second microcontroller 2' matches and that the write was successful. Then, it sends a signal to the diagnostic device indicating that the writing of the electronic key to the first microcontroller 2 and the second microcontroller 2' was successful, and proceeds to step S14.

[0047] In step S13, the first microcontroller 2 sends a signal to the diagnostic tool indicating a failure to write the electronic key to the first microcontroller 2 or the second microcontroller 2' within the ECU to which the electronic key is to be written, and proceeds to step S14.

[0048] In step S14, the electronic key writing process is completed. At this time, the programmer can simultaneously obtain the success or failure of the writing to the first microcontroller 2 and the second microcontroller 2'.

[0049] Figure 3 is a flowchart detailing the process from the start to the completion of the electronic key writing process in the first microcontroller 2 in step S4 of Figure 2.

[0050] In step S100, the first microcontroller host CPU 3 starts the electronic key writing process and proceeds to step S101. At this time, the electronic key is held in the host-side local RAM 4.

[0051] In step S101, the first microcontroller host CPU 3 determines whether the structure of the received electronic key is as defined in advance. If the determination is successful, the process proceeds to step S102. If the determination is unsuccessful, the process proceeds to step S107. At this time, the conditions that the first microcontroller host CPU 3 determines include, for example, whether the received data length is as defined, and whether the instruction identifier for writing the electronic key is as defined.

[0052] In step S102, the first microcontroller host CPU 3 determines whether it can execute a write command to the secure CPU 8, which is the target of the electronic key writing. If the determination is successful, the process proceeds to step S103. If the determination is unsuccessful, the process proceeds to step S107. The conditions that the first microcontroller host CPU 3 determines at this time include, for example, whether the secure CPU 8 is valid, whether the secure CPU 8 is not currently executing another process and is able to receive new commands, and whether the secure CPU 8 has left any fault information.

[0053] In step S103, the first microcontroller host CPU 3 executes a command to write the electronic key to the secure CPU 8 via the shared RAM 5. The secure CPU 8 receives the electronic key and the write command from the shared RAM 5, executes the process of writing the electronic key to the secure non-volatile memory 10, and returns information indicating the success or failure of the write result to the first microcontroller host CPU 3 via the shared RAM 5. After that, the process proceeds to step S104.

[0054] In step S104, the first microcontroller host CPU 3 executes an instruction to write the electronic key to the secure CPU 8, then starts sending a signal to the diagnostic device indicating that the electronic key is currently being written, and proceeds to step S105.

[0055] This signal is transmitted periodically (at predetermined intervals) until writing is completed in the first microcontroller 2 and the second microcontroller 2', and continues to be transmitted until the first microcontroller 2 stops transmitting periodically. This prevents the diagnostic device from determining a write failure based on the time elapsed since the write command was sent.

[0056] In step S105, the first microcontroller host CPU 3 determines whether the writing of the electronic key was successful or not, based on the information indicating the success or failure of the write result that was returned to the first microcontroller host CPU 3 via the shared RAM 5 from the secure CPU 8 when the processing in step S103 is completed. If successful, the process proceeds to step S106. If unsuccessful, the process proceeds to step S107.

[0057] In step S106, the first microcontroller host CPU 3 holds information indicating that the writing of the electronic key to the first microcontroller 2 has been successfully completed by its own program, and proceeds to step S108.

[0058] In step S107, the first microcontroller host CPU3 stores information about the abnormal completion of the electronic key writing process in the first microcontroller using its own program, and then proceeds to step S108.

[0059] In step S108, the first microcontroller 2 finishes the electronic key writing process.

[0060] Figure 4 is a flowchart detailing the process from the start to the completion of the transfer of the electronic key from the first microcontroller 2 to the second microcontroller 2' in step S6 of Figure 2.

[0061] In step S200, the first microcontroller 2 uses microcontroller-to-microcontroller communication to begin the process of transferring the electronic key received from the diagnostic device to the second microcontroller 2', and then proceeds to step S201.

[0062] In step S201, the first microcontroller 2 monitors the status of inter-microcontroller communication and determines whether the transfer of the electronic key to the second microcontroller 2' has been completed. If it has been completed, it terminates the monitoring of the inter-microcontroller communication status and proceeds to step S203. If it has not been completed, it continues to monitor the inter-microcontroller communication status.

[0063] In step S203, the first microcontroller 2 determines whether the transfer of the electronic key to the second microcontroller 2' is successful. If successful, the process proceeds to step S206. If unsuccessful, the process proceeds to step S204.

[0064] In step S204, the first microcontroller 2 determines whether the number of failures in the electronic key transfer process to the second microcontroller 2' is greater than a predetermined number. If it is greater than the predetermined number, the process proceeds to step S205. If it is less than or equal to the predetermined number, the process proceeds to step S202.

[0065] In step S202, the first microcontroller 2 performs a retry process for transferring the electronic key to the second microcontroller 2'. If a temporary communication error occurs between microcontrollers, this step and step S202 may allow for a normal recovery, so the first microcontroller 2 performs the retry process a predetermined number of times.

[0066] In step S205, the first microcontroller 2 saves a failure history indicating an abnormality in the inter-microcontroller communication with the second microcontroller 2' to the non-volatile memory 7 on the first microcontroller host side, and proceeds to step S207. At this time, the first microcontroller 2 can determine that, along with the abnormality in inter-microcontroller communication, the process of writing the electronic key to the second microcontroller 2' has failed.

[0067] In step S206, the first microcontroller host CPU 3 retains information indicating that the electronic key transfer process from the first microcontroller 2 to the second microcontroller 2' has been successfully completed by its own program, and then proceeds to step S208.

[0068] In step S207, the first microcontroller host CPU 3 holds completion information indicating that an error occurred in the electronic key transfer process from the first microcontroller 2 to the second microcontroller 2' due to its own program, and proceeds to step S208.

[0069] In step S208, the first microcontroller 2 completes the process of transferring the electronic key to the second microcontroller 2' using inter-microcontroller communication.

[0070] Figure 5 is a flowchart detailing the process from the start to the completion of the waiting process for the electronic key writing result response from the second microcontroller 2' in step S8 of Figure 2.

[0071] In step S300, the first microcontroller 2 starts a process of waiting for a response from the second microcontroller 2' indicating that the writing of the electronic key has been completed by monitoring the reception status of the inter-microcontroller communication, and then proceeds to step S301.

[0072] In step S301, the first microcontroller 2 monitors the communication between microcontrollers to determine if it has started receiving the write result data from the second microcontroller 2'. If reception has started, it proceeds to step S303. If reception has not started, it proceeds to step S302.

[0073] In step S302, the first microcontroller 2 determines that the completion of the transfer of the electronic key to the second microcontroller 2' marks the start of writing the electronic key in the second microcontroller 2', and determines whether the elapsed time is greater than a predetermined time.

[0074] If the first microcontroller 2 exceeds a predetermined time, it proceeds to step S304. If the elapsed time is within the predetermined period, it continues the judgment process in step S301. This step prevents the programmer from having to wait for a long time if the second microcontroller 2' is unable to provide a write failure response due to an abnormality.

[0075] In step S303, the first microcontroller 2 determines whether the checksum calculation result is normal in order to detect whether it has correctly received the electronic key write result transfer data from the second microcontroller 2' via inter-microcontroller communication. If the checksum calculation result is normal, the first microcontroller 2 proceeds to step S305. If it is abnormal, it proceeds to step S304.

[0076] In step S304, the first microcontroller 2 saves a failure history indicating an abnormality in the inter-microcontroller communication with the second microcontroller 2' to the first microcontroller host-side non-volatile memory 7, and proceeds to step S306. At this point, the first microcontroller 2 can determine that, along with the abnormality in inter-microcontroller communication, the process of writing the electronic key to the second microcontroller 2' has failed.

[0077] In step S305, the first microcontroller host CPU 3 holds information indicating that the data transfer process of the electronic key writing result from the second microcontroller 2' to the first microcontroller 2 has been successfully completed by its own program, and proceeds to step S308.

[0078] In step S306, the first microcontroller host CPU 3 holds completion information indicating that an error occurred in the data transfer process of the electronic key writing result from the second microcontroller 2' to the first microcontroller 2, and proceeds to step S307.

[0079] In step S307, the first microcontroller 2 stops transmitting the signal that indicates it is writing the electronic key to the diagnostic device, which was started in step S104 in Figure 3, and proceeds to step S308.

[0080] In step S308, the first microcontroller 2 finishes the process of waiting for a response from the second microcontroller 2' regarding the result of writing the electronic key.

[0081] Figure 6 is a flowchart detailing the process from the start to the completion of the electronic key writing process in the second microcontroller 2' in step S9 of Figure 2.

[0082] In step S400, the second microcontroller 2' receives an electronic key from the first microcontroller 2, which it deems to be permission to write the electronic key to the second microcontroller 2'. The host-side CPU 3' of the second microcontroller then starts the electronic key writing process, and the process proceeds to step S401. At this time, the electronic key is held in the host-side local RAM 4'. This step allows the second microcontroller 2' to start the writing process without having to send or receive a special write permission signal from the first microcontroller 2.

[0083] In step S401, the second microcontroller host CPU 3' determines whether the structure of the received electronic key is as defined in advance. If the determination is successful, the process proceeds to step S402. If the determination is unsuccessful, the process proceeds to step S406. The conditions that the second microcontroller host CPU 3' determines at this time include, for example, whether the received data length is as defined, and whether the instruction identifier for writing the electronic key is as defined.

[0084] In step S402, the second microcontroller host CPU 3' determines whether it can execute a write command to the secure CPU 8' which is the target of the electronic key writing. If the determination is successful, the process proceeds to step S403. If the determination is unsuccessful, the process proceeds to step S406. At this time, the conditions that the second microcontroller host CPU 3' determines include, for example, whether the secure CPU 8' is valid, whether the secure CPU 8' is not currently performing another process and is able to receive new commands, and whether the secure CPU 8' has left any fault information.

[0085] In step S403, the second microcontroller host CPU 3' executes an electronic key write command to the secure CPU 8' via the shared RAM 5'. The secure CPU 8' receives the electronic key and write command from the shared RAM 5', executes the electronic key write process to the secure non-volatile memory 10', and returns information indicating the success or failure of the write result to the second microcontroller host CPU 3' via the shared RAM 5'. The process then proceeds to step S404.

[0086] In step S404, the second microcontroller host CPU 3' determines whether the writing of the electronic key was successful or not, based on the information indicating the success or failure of the write result that was returned to the second microcontroller host CPU 3' from the secure CPU 8' via the shared RAM 5' at the completion of step S403. If successful, the process proceeds to step S405. If unsuccessful, the process proceeds to step S406.

[0087] In step S405, the second microcontroller host CPU 3' retains information indicating that the writing of the electronic key to the second microcontroller 2' has been successfully completed by its own program, and proceeds to step S407.

[0088] In step S406, the second microcontroller host CPU 3' holds completion information indicating that an error occurred in the writing of the electronic key to the second microcontroller 2' by its own program, and proceeds to step S407.

[0089] In step S407, the second microcontroller 2' terminates the electronic key writing process.

[0090] Figure 7 is a flowchart detailing the process from the start to the completion of the transfer of the electronic key writing result data from the second microcontroller 2' to the first microcontroller 2 in step S10 of Figure 2.

[0091] In step S500, the second microcontroller 2' starts the process of transferring the electronic key writing result data to the first microcontroller 2 using inter-microcontroller communication, and then proceeds to step S501.

[0092] In step S501, the second microcontroller 2' monitors the status of inter-microcontroller communication and determines whether the transfer of the electronic key writing result data to the first microcontroller 2 has been completed. If it has been completed, it terminates the monitoring of the inter-microcontroller communication status and proceeds to step S503. If it has not been completed, it continues to monitor the inter-microcontroller communication status.

[0093] In step S503, the second microcontroller 2' determines whether the transfer of the electronic key writing result data to the first microcontroller 2 was successful. If successful, the process proceeds to step S505. If unsuccessful, the process proceeds to step S504.

[0094] In step S504, the second microcontroller 2' determines whether the number of failures in the transfer process of the electronic key writing result data to the first microcontroller 2 is greater than a predetermined number. If the number of failures is greater than the predetermined number, the second microcontroller 2' proceeds to step S506. If the number of failures is less than or equal to the predetermined number, it proceeds to step S502.

[0095] In step S502, the second microcontroller 2' performs a retry process for transferring the electronic key to the first microcontroller 2. If a temporary communication error occurs between microcontrollers, this step and step S502 may allow for a normal recovery, so the retry process is performed up to a predetermined number of times.

[0096] In step S505, the second microcontroller host CPU 3' holds information indicating that the transfer process of the electronic key writing result data from the second microcontroller 2' to the first microcontroller 2 has been successfully completed by its own program, and proceeds to step S507.

[0097] In step S506, the second microcontroller host CPU 3' holds completion information indicating that an error occurred in the electronic key transfer process from the second microcontroller 2' to the first microcontroller 2 due to its own program, and proceeds to step S507.

[0098] In step S507, the second microcontroller 2' completes the process of transferring the electronic key writing result data to the first microcontroller 2 using inter-microcontroller communication.

[0099] In the configuration of this embodiment, the electronic key can be used, for example, for verifying digital signatures when the software of the first microcontroller 2 and the second microcontroller 2' is rewritten, and for performing secure boot calculations when the system starts up.

[0100] Thus, even when a second microcontroller 2' without external communication capabilities is present within the ECU1, by applying the present invention, it is possible to write an electronic key to the second microcontroller 2' via the first microcontroller 2, detect the success or failure of the result, and use the electronic key for cryptographic calculations. This concludes the first embodiment. [Examples]

[0101] In the first embodiment, the communication unit 6 was connected to the electronic key transmission unit 14 located outside the ECU 1, and the communication unit 6' was not connected to the outside. However, as shown in Figure 8, the communication unit 6' may also be connected to the electronic key transmission unit 14, and the second microcontroller 2' may be configured to be capable of receiving only.

[0102] During the writing of the electronic key, the communication unit 6 communicates with the electronic key transmission unit 14, and the electronic key received by the communication unit 6' is discarded within the second microcontroller 2'. This is to shorten the time the second microcontroller 2' holds the electronic key and satisfy the security condition (constraint on the electronic key holding time). In the configuration to which the present invention is applied, the second microcontroller 2' does not directly receive the electronic key from an external source, but rather the electronic key is transferred and written via inter-microcontroller communication from the first microcontroller 2.

[0103] The writing of the electronic key to the first microcontroller 2 and the second microcontroller 2' can be achieved in the same manner as the method for writing the electronic key in the first embodiment.

[0104] In the system configuration of this embodiment, a key feature is that the output values ​​from the control are allocated to the first microcontroller 2 and the second microcontroller 2' in a specific ratio to ensure redundancy. For example, in an ECU for controlling electric power steering, the torque control values ​​output by the ECU to the control motor are allocated to the first microcontroller 2 and the second microcontroller 2' in a ratio such as 50:50, ensuring that the vehicle can continue to run even if one of the microcontrollers fails.

[0105] In this case, the communication unit 6' of the second microcontroller 2' is only capable of receiving signals from external sources, similar to the communication unit 6. This is because it receives signals such as vehicle speed information from another on-board electronic control unit installed in the vehicle, enabling real-time control in the on-board electronic control unit. Signals such as vehicle speed information may be accompanied by message authenticators, and the electronic key is used not only for the purposes of the first embodiment but also for message authentication calculations and other purposes.

[0106] Thus, even in a system configuration where the communication unit 6' of the second microcontroller 2' only needs to receive signals, by applying the present invention, it is possible to write an electronic key to the second microcontroller 2' via the first microcontroller 2, detect the success or failure of the result, and use the electronic key for cryptographic calculations. The above constitutes the second embodiment. [Examples]

[0107] In the first embodiment, the communication unit 6 was connected to the electronic key transmission unit 14 located outside the ECU 1. However, as shown in Figure 9, a data relay ECU 15 may be provided between the electronic key transmission unit 14 and the communication unit 6.

[0108] In this case, the data for writing the electronic key transmitted from the electronic key transmission unit 14 is first stored in the data relay ECU 15 and then transferred to the communication unit 6 of the ECU 1. Writing the electronic key to the first microcontroller 2 and the second microcontroller 2' can be achieved in the same manner as the method for writing the electronic key in the first embodiment.

[0109] In the configuration of this embodiment, in addition to the features of the first embodiment, communication with the electronic key transmission unit is performed via a data relay ECU, which is a known or well-known component of the vehicle system configuration.

[0110] The data relay ECU 15 can be configured, for example, as a CGW (Central Gateway), and may act as a firewall for the vehicle system between the external environment and the target electronic control unit. Applications of the electronic key include, as in the first embodiment, digital signature verification calculations during software rewriting of the first microcontroller 2 and the second microcontroller 2', and secure boot calculations during system startup.

[0111] Even in such a vehicle system configuration, by applying the present invention, it is possible to write an electronic key to the second microcontroller 2' via the first microcontroller 2, detect the success or failure of the result, and use the electronic key for cryptographic calculations. This concludes the third embodiment. [Examples]

[0112] In the third embodiment, the communication unit 6 was connected to the electronic key transmission unit 14 via a data relay ECU 15 located outside the ECU 1, and the communication unit 6' was not connected to the outside. However, as shown in Figure 10, the communication unit 6' may also be connected to the data relay ECU 15, and the second microcontroller 2' may be configured to be capable of receiving only.

[0113] During the writing of the electronic key, the communication unit 6 communicates with the electronic key transmission unit 14, and the electronic key received by the communication unit 6' is discarded within the second microcontroller 2'. Writing the electronic key to the first microcontroller 2 and the second microcontroller 2' can be achieved in the same manner as the electronic key writing method in the first embodiment.

[0114] The system configuration of this embodiment combines the features of the first, second, and third embodiments. Even with such a vehicle system configuration, by applying the present invention, it is possible to write an electronic key to the second microcontroller 2' via the first microcontroller 2, detect the success or failure of the result, and use the electronic key for cryptographic calculations. This constitutes the fourth embodiment.

[0115] <Conclusion> It should be noted that the present invention is not limited to the above-described Examples 1 to 4, and includes various modifications. For example, the above-described examples are detailed explanations provided to make the present invention easier to understand, and are not necessarily limited to including all the described configurations. Furthermore, it is possible to replace parts of the configuration of one example with the configuration of another example, and it is also possible to add configurations from other examples to the configuration of one example. In addition, it is possible to add, delete, or replace parts of the configuration of each example with other configurations.

[0116] Furthermore, in the above-described embodiments 1 to 4, the electronic key was first written to the first microcontroller 2 of the control device, and only if the electronic writing result to the first microcontroller 2 was successful did the writing to the second microcontroller 2' be executed. However, it is also possible to implement the function by having the first microcontroller 2 receive the electronic key from the electronic key transmission unit, first transfer the electronic key to the second microcontroller 2', then write the electronic key in both the first microcontroller 2 and the second microcontroller 2', and then the first microcontroller 2 comprehensively evaluates the success or failure of the results and sends the result to the electronic key transmission unit.

[0117] Furthermore, while the above-described embodiments 1 to 4 describe a control device including a first microcontroller 2 and a second microcontroller 2', a configuration including multiple microcontrollers corresponding to the second microcontroller 2' is also possible. Even in this case, it is possible to use the present invention to configure the first microcontroller 2 to transfer an electronic key to the second microcontroller 2' or a third microcontroller using inter-microcontroller communication, and to perform the writing operation and integrate the success or failure of the result.

[0118] As described above, the in-vehicle electronic control unit (ECU1) of the above embodiments 1 to 4 can be configured as follows.

[0119] (1) An in-vehicle electronic control unit (ECU1) having a first microcomputer (first microcomputer 2) and a second microcomputer (second microcomputer 2'), comprising: a first processor (3) that performs calculation processing on the first microcomputer (2); a first storage unit (local RAM 4, non-volatile memory 7) connected to the first processor (3) for storing information; a first communication unit (6) connected to the first processor (3) for communicating with the outside and receiving an electronic key; and a unit connected to the first processor (3) for receiving the electronic key. A first hardware security module (first HSM20) that performs cryptographic processing and includes a first non-volatile memory unit (secure non-volatile memory 10) that holds the first non-volatile memory unit (secure non-volatile memory 10), a first microcomputer communication unit (11) connected to the first processor (3) that communicates with the second microcomputer (2'), a second processor (3') that performs arithmetic processing on the second microcomputer (2'), a second memory unit (local RAM4', non-volatile memory 7') connected to the second processor (3') that stores information, and The first processor (3) has a second microcomputer communication unit (11') connected to the second processor (3') and communicating with the first microcomputer (2), and a second hardware security module (20') connected to the second processor (3') and performing cryptographic processing, including a second non-volatile storage unit (10') that holds the electronic key, wherein the first processor (3) passes the electronic key received by the first communication unit (6) to the first hardware security module (20) and the first non-volatile storage unit (1 The first processor (3) writes the electronic key to (0), transfers the electronic key to the second microcomputer (2') via the first microcomputer-to-microcomputer communication unit (11), obtains the first write result of the electronic key from the first hardware security module (20), and the second processor (3') receives the electronic key via the second microcomputer-to-microcomputer communication unit (11') and passes it to the second hardware security module (20') to write it to the second non-volatile storage unit (10').An in-vehicle electronic control device characterized by obtaining the second write result of the electronic key from the second hardware security module (20') and transmitting it to the first microcomputer (2) via the second microcomputer-to-microcomputer communication unit (11'), and the first processor (3) integrating the electronic key write result from the first write result and the second write result and transmitting it externally.

[0120] With the above configuration, even if the in-vehicle electronic control device according to the present invention has an internal microcomputer that does not have an external communication function, it can write the same electronic key to all microcomputers that use the electronic key by receiving a signal including the electronic key once from the electronic key transmission unit, and notify the electronic key transmission source of the writing result by sending a signal once.

[0121] In writing the electronic key, it is only necessary to send a signal to the first microcomputer (2) to write the electronic key. Therefore, there is no need to individually instruct each microcomputer. The programmer can obtain the success or failure of the writing process at once, even if the in-vehicle electronic control unit (ECU) has multiple microcomputers. Furthermore, from an external perspective, it appears as a single ECU, which improves the flexibility of communication design and microcomputer configuration.

[0122] The second microcontroller begins writing after obtaining electronic key information from the first microcontroller (2) via inter-microcontroller communication. This eliminates the problem of long periods of time during which only the electronic key is obtained and writing cannot be performed, thus satisfying the security requirements regarding the time constraints for holding the electronic key.

[0123] (2) An in-vehicle electronic control device as described in (1) above, characterized in that the second microcomputer (2') causes the second hardware security module (20') to write an electronic key received from the first microcomputer (2) via the second microcomputer-to-microcomputer communication unit (11').

[0124] With the above configuration, the second microcontroller 2' can store only the electronic key received from the first microcontroller 2 via inter-microcontroller communication in its HSM20' and perform cryptographic calculations.

[0125] (3) An in-vehicle electronic control device as described in (1) above, wherein the second microcomputer (2') further comprises a second communication unit (6') connected to the second processor (3') for receiving information from the outside, the electronic key is transmitted to the first microcomputer (2) and the second microcomputer (2') in a predetermined communication protocol, and the second microcomputer (2') discards the electronic key received by the second communication unit.

[0126] With the above configuration, when writing an electronic key, the communication unit 6 communicates with the electronic key transmission unit 14, and the electronic key received by the communication unit 6' of the second microcontroller 2' is discarded within the second microcontroller 2'. This shortens the time the second microcontroller 2' holds the electronic key, thereby satisfying the security requirement (constraint on the electronic key holding time).

[0127] (4) An in-vehicle electronic control device as described in (1) above, wherein the first processor (3) verifies that the first write result and the second write result match, and transmits to the outside information indicating the success or failure of the electronic key write result according to the verification result.

[0128] With the above configuration, the programmer of the electronic key transmission unit 14 can obtain the success or failure of the writing to the first microcontroller 2 and the second microcontroller 2' at once, and can quickly verify the electronic key writing operation.

[0129] (5) An in-vehicle electronic control device as described in (4) above, characterized in that the information indicating the success or failure of the writing result of the electronic key is determined to be a success if the writing is successful in both the first microcomputer (2) and the second microcomputer (2'), and a failure if the writing fails in either of them.

[0130] With the above configuration, the person writing to the electronic key transmission unit 14 can easily determine whether the writing to the first microcontroller 2 and the second microcontroller 2' was successful.

[0131] (6) An in-vehicle electronic control device as described in (1) above, wherein the second microcomputer (2') considers the receipt of an electronic key from the first microcomputer (2) as permission to write the electronic key.

[0132] With the above configuration, the second microcontroller 2' can reduce the number of commands exchanged within the ECU1 and speed up processing by considering the receipt of an electronic key from the first microcontroller 2 as permission to write to the electronic key of the second microcontroller 2'.

[0133] (7) An in-vehicle electronic control device as described in (1) above, wherein the first microcomputer (2) considers that the writing of the electronic key by the second microcomputer (2') has failed if the result of writing the electronic key from the second microcomputer (2') is not returned within a predetermined time.

[0134] With the above configuration, the first microcontroller 2 can determine that a write operation has failed after a predetermined time has elapsed if it does not receive a response from the second microcontroller 2' regarding the write result.

[0135] (8) An in-vehicle electronic control device as described in (1) above, wherein the first microcomputer (2) receives the result of the checksum calculation process of the electronic key in microcomputer-to-microcomputer communication with the second microcomputer (2') and determines whether or not the communication was performed successfully.

[0136] With the above configuration, the first microcontroller 2 can determine whether the electronic key transfer process was successful or not based on the result of the checksum calculation process of the electronic key from the second microcontroller 2'.

[0137] (9) An in-vehicle electronic control device as described in (1) above, wherein the first microcomputer (2) stores a history of the abnormality in the communication between the microcomputers in the first storage unit when an abnormality occurs in the communication between the microcomputers with the second microcomputer (2').

[0138] With the above configuration, the first microcontroller 2 can identify the cause of the electronic key writing failure by saving the history of the abnormality in the non-volatile memory 7 when an abnormality occurs in the communication between microcontrollers.

[0139] (10) An in-vehicle electronic control device as described in (1) above, wherein the first microcomputer (2) re-executes microcomputer-to-microcomputer communication with the second microcomputer (2') up to a predetermined number of times if the microcomputer-to-microcomputer communication between the first microcomputer (2) fails.

[0140] With the above configuration, the first microcontroller 2 executes a predetermined number of retry processes because, if a temporary abnormality occurs in the communication between microcontrollers, it may be possible to recover to normal operation by retrying the communication.

[0141] (11) An in-vehicle electronic control device as described in (1) above, wherein the first microcomputer (2) transmits a signal to the outside at a predetermined interval indicating that the first microcomputer (2) and the second microcomputer (2') are in the process of writing an electronic key.

[0142] With the above configuration, the first microcontroller 2 transmits a signal at a predetermined interval while the ECU 1 is writing the electronic key, thereby preventing an external diagnostic device from determining that the writing has failed due to the elapsed time since the writing command was sent.

[0143] (12) An in-vehicle electronic control device as described in (1) above, wherein it has a plurality of second microcomputers (2'), and the first microcomputer (2) transfers an electronic key to the plurality of second microcomputers (2').

[0144] With the above configuration, even if there are multiple second microcontrollers 2' that do not have communication functions inside ECU1, it is possible to write electronic keys to multiple second microcontrollers 2' using inter-microcontroller communication.

[0145] (13) An in-vehicle electronic control device as described in (1) above, wherein the electronic key corresponds to a symmetric-key cryptographic scheme or an asymmetric-key cryptographic scheme.

[0146] With the above configuration, ECU1 can utilize electronic keys for either symmetric-key or asymmetric-key cryptography.

[0147] Furthermore, each of the above configurations, functions, processing units, and processing means may be implemented in hardware, in whole or in part, for example, by designing them as integrated circuits. Alternatively, each of the above configurations and functions may be implemented in software by having the processor interpret and execute programs that realize each function. Information such as programs, tables, and files that realize each function can be stored in memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0148] Furthermore, the control lines and information lines shown are those deemed necessary for explanatory purposes, and not all control lines and information lines are necessarily shown in the actual product. In practice, it is reasonable to assume that almost all components are interconnected. [Explanation of Symbols]

[0149] 1 ECU 2. First microcontroller 2' Second microcontroller 3. First microcontroller host CPU 3′ Second microcontroller host side CPU 4. First microcontroller host-side local RAM 4' Second microcontroller host-side local RAM 5. First microcontroller shared RAM 5′ Second microcontroller shared RAM 6. First Microcomputer Communication Section 6' Second Microcomputer Communication Section 7. First Microcontroller Non-Volatile Memory 7′ Second microcontroller non-volatile memory 8. First Microcontroller Secure CPU 8′ Second Microcontroller Secure CPU 9. First Microcontroller Secure Local RAM 9′ Second Microcontroller Secure Local RAM 10. First Microcontroller Secure Non-Volatile Memory 10′ Second Microcontroller Secure Non-Volatile Memory 11. Microcontroller-to-microcontroller communication section 12. First microcontroller host-side data bus and peripheral bus 12′ Second microcontroller host-side data bus and peripheral bus 13. First Microcontroller Secure Data Bus and Peripheral Bus 13′ Second Microcontroller Secure Data Bus and Peripheral Bus 14. Electronic key transmission unit 15 Data Relay ECU 20, 20' HSM

Claims

1. An in-vehicle electronic control device having a first microcomputer and a second microcomputer, A first processor that performs calculations on the first microcomputer, A first storage unit connected to the first processor and storing information, A first communication unit connected to the first processor and communicating with the outside to receive an electronic key, A first hardware security module that performs cryptographic processing and includes a first non-volatile storage unit connected to the first processor and holding the electronic key, A first microcomputer-to-microcomputer communication unit connected to the first processor and communicating with the second microcomputer, A second processor that performs calculations on the second microcomputer, A second storage unit connected to the second processor and storing information, A second microcomputer communication unit connected to the second processor and communicating with the first microcomputer, The system includes a second hardware security module that performs cryptographic processing and is connected to the second processor and includes a second non-volatile storage unit that holds the electronic key, The first processor passes the electronic key received by the first communication unit to the first hardware security module and has it written to the first non-volatile storage unit. The first processor transfers the electronic key to the second microcomputer via the first microcomputer-to-microcomputer communication unit, and obtains the first write result of the electronic key from the first hardware security module. The second processor receives the electronic key via the second microcomputer communication unit, passes it to the second hardware security module, has it written to the second non-volatile memory unit, obtains the second write result of the electronic key from the second hardware security module, and transmits it to the first microcomputer via the second microcomputer communication unit. The in-vehicle electronic control device is characterized in that the first processor integrates the writing result of the electronic key from the first writing result and the second writing result and transmits it to the outside.

2. An in-vehicle electronic control device according to claim 1, The second microcomputer is, An in-vehicle electronic control device characterized by causing the electronic key received from the first microcomputer via the second microcomputer-to-microcomputer communication unit to be written to the second hardware security module.

3. An in-vehicle electronic control device according to claim 1, The second microcomputer further includes a second communication unit connected to the second processor for receiving information from the outside, The electronic key is transmitted to the first microcomputer and the second microcomputer using a predetermined communication protocol. The second microcomputer is, An in-vehicle electronic control device characterized by discarding the electronic key received by the second communication unit.

4. An in-vehicle electronic control device according to claim 1, The first processor is, An in-vehicle electronic control device characterized by verifying that the first writing result and the second writing result match, and transmitting information indicating the success or failure of the electronic key writing result to an external source according to the verification result.

5. An in-vehicle electronic control device according to claim 4, The information indicating the success or failure of the electronic key writing result is: An in-vehicle electronic control device characterized in that it determines success if writing is successful on both the first microcomputer and the second microcomputer, and determines failure if writing fails on either of them.

6. An in-vehicle electronic control device according to claim 1, The second microcomputer is, An in-vehicle electronic control device characterized in that receiving an electronic key from the first microcomputer is considered as permission to write the electronic key.

7. An in-vehicle electronic control device according to claim 1, The first microcomputer is, An in-vehicle electronic control device characterized in that if the result of writing the electronic key from the second microcomputer is not returned within a predetermined time, the writing of the electronic key by the second microcomputer is considered to have failed.

8. An in-vehicle electronic control device according to claim 1, The first microcomputer is, An in-vehicle electronic control device characterized by receiving the result of the checksum calculation process of the electronic key in microcomputer-to-microcomputer communication with the second microcomputer and determining whether the communication was performed successfully.

9. An in-vehicle electronic control device according to claim 1, The first microcomputer is, An in-vehicle electronic control device characterized in that, if an abnormality occurs in the communication between the microcomputers with the second microcomputer, the history of the abnormality in the communication between the microcomputers is stored in the first storage unit.

10. An in-vehicle electronic control device according to claim 1, The first microcomputer is, An in-vehicle electronic control device characterized in that, if inter-microcomputer communication with the second microcomputer fails, the inter-microcomputer communication is retried up to a predetermined number of times.

11. An in-vehicle electronic control device according to claim 1, The first microcomputer is, An in-vehicle electronic control device characterized by transmitting a signal to the outside at a predetermined interval indicating that the first microcomputer and the second microcomputer are in the process of writing an electronic key.

12. An in-vehicle electronic control device according to claim 1, The system has multiple of the aforementioned second microcomputers, The first microcomputer is, An in-vehicle electronic control device characterized by transferring an electronic key to a plurality of the second microcomputers.

13. An in-vehicle electronic control device according to claim 1, The in-vehicle electronic control device is characterized in that the electronic key corresponds to a symmetric-key cryptography scheme or an asymmetric-key cryptography scheme.

Images