Method and apparatus for determining whether controller in vehicle is normal

Abstract

An embodiment of the present disclosure relates to a method and an apparatus for determining whether a controller in a vehicle is normal, and can prevent a user / attacker from arbitrarily changing or manipulating a device or a function mounted on the vehicle. The method for determining whether a controller in a vehicle is normal, of an embodiment of the present disclosure, comprises the steps of: generating a challenge signal in the current controller; determining whether the next controller is in the vehicle; transmitting the challenge signal to the next controller if the next controller is in the vehicle; receiving a response signal including an electronic signature from the next controller; verifying the electronic signature; and determining whether the next controller is normal on the basis of the verification result, wherein the current controller includes an identification number of the previous controller and an identification number of the next controller.

Description

Method and apparatus for determining whether a controller in a vehicle is normal

[0001] The present disclosure relates to a method and device for determining whether an in-vehicle controller is normal.

[0002] The electric vehicle market is steadily growing, driven by advancements in battery technology and the development of charging infrastructure. Furthermore, advancements in technologies like artificial intelligence, mobile / wireless communications, cloud computing, sensors, and precision positioning are advancing the level of autonomous driving applied to automobiles.

[0003] In this environment, many vehicles are equipped with electrified or electronic devices or components driven by electronic control units (ECUs) to perform various functions and services such as driving safety, driver assistance, and autonomous driving.

[0004] As autonomous driving levels increase and vehicle options increase, the proportion of electrical components in a vehicle increases, and the importance of software to efficiently operate these electrical components increases.

[0005] In addition, the electrical components mounted on these vehicles are connected to the external network of the vehicle through the internal network of the vehicle, and can exchange information related to driving inside the vehicle as well as information outside the vehicle with other electrical components inside the vehicle, other vehicles, or other devices outside the vehicle.

[0006] In these network-connected environments, vehicle security, which protects personal information, smart keys, and vehicle operation software registered in the vehicle from external attacks, becomes increasingly important. In particular, if users or attackers modify or remove devices installed in mass-produced vehicles, this can pose a serious threat to vehicle safety. Therefore, to prevent this, a method for determining the normal operation of devices or functions installed in the vehicle is required.

[0007] The present disclosure provides a method and device for determining whether a device or function mounted on a vehicle is normal.

[0008] And the present disclosure provides a method and device for preventing a device or function mounted on a vehicle from being arbitrarily changed or manipulated by a user or an attacker.

[0009] A method according to an embodiment of the present disclosure is characterized in that it comprises a process of generating a challenge signal in a current controller; a process of determining whether a next controller exists in the vehicle; a process of transmitting the challenge signal to the next controller when the next controller exists in the vehicle; a process of receiving a response signal including an electronic signature from the next controller; a process of verifying the electronic signature; and a process of verifying whether the next controller is normal based on a verification result.

[0010] According to an embodiment of the present disclosure, a device for determining whether a controller of a vehicle is normal includes a memory including a command; and a processor that generates a challenge signal from a current controller by executing the command, determines whether a next controller exists in the vehicle, transmits the challenge signal to the next controller if the next controller exists in the vehicle, receives a response signal including an electronic signature from the next controller, verifies the electronic signature, and determines whether the next controller is normal or abnormal based on the verification result.

[0011] Another method according to an embodiment of the present disclosure is a method for determining whether a controller in a vehicle is normal, comprising: a step of receiving a challenge signal from a current controller; a step of generating an electronic signature based on the challenge signal; and a step of transmitting a response signal including the electronic signature to the current controller, wherein the current controller generates the challenge signal, determines whether a next controller exists in the vehicle, and if the next controller exists in the vehicle, transmits the challenge signal to the next controller, receives a response signal including an electronic signature from the next controller, verifies the electronic signature, and determines whether the next controller is normal based on the verification result.

[0012] An embodiment of the present disclosure can determine whether a device or function mounted on a vehicle is normal.

[0013] And the embodiment of the present disclosure can prevent a user / attacker from arbitrarily changing or manipulating a device or function mounted on a vehicle.

[0014] Figure 1 conceptually illustrates a vehicle connecting to a server via a network.

[0015] Figure 2 illustrates the functional blocks that constitute a vehicle connected to an external network.

[0016] Figure 3 illustrates the functional blocks that constitute the gateway.

[0017] Figure 4 illustrates the functions performed by the CCU.

[0018] Figure 5 illustrates the functional blocks that constitute the server.

[0019] FIG. 6 is a schematic block diagram of a vehicle security system according to an embodiment of the present disclosure.

[0020] Figure 7 is an example diagram showing the connection relationship between the current controller and the next control period and the distribution operation of the identification number.

[0021] FIG. 8 is a flowchart illustrating a method for determining whether an in-vehicle controller is normal according to an embodiment of the present disclosure.

[0022] FIG. 9 is a block diagram schematically illustrating an exemplary computing device to which the present disclosure can be applied.

[0023] Hereinafter, some embodiments of the present disclosure will be described in detail using exemplary drawings. When designating components in each drawing, it should be noted that, where possible, identical components are given the same reference numerals, even if they appear in different drawings. Furthermore, when describing the present disclosure, detailed descriptions of related known structures or functions will be omitted if they are deemed to obscure the gist of the present disclosure.

[0024] In describing components of embodiments according to the present disclosure, symbols such as first, second, i), ii), a), b) may be used. These symbols are only for distinguishing the components from other components, and the nature, order, or sequence of the components are not limited by the symbols. When a part in the specification is said to "include" or "have" a component, this does not mean that other components are excluded, but rather that other components may be included, unless explicitly stated otherwise.

[0025] The detailed description set forth below, together with the accompanying drawings, is intended to explain exemplary embodiments of the present disclosure and is not intended to represent the only embodiments in which the present disclosure may be practiced.

[0026] Figure 1 conceptually illustrates a vehicle connecting to a server via a network.

[0027] The vehicle (100) can be connected to a server (200) that provides functions or services related to the vehicle (100) through a mobile or wireless network such as LTE, 5G, or Wi-Fi.

[0028] Figure 2 illustrates the functional blocks that constitute a vehicle connected to an external network.

[0029] A vehicle (100) may be configured to include a gateway (110, GW) connected to an external network and an internal network, and subsystems connected to the internal network, such as a powertrain subsystem, a body subsystem, a chassis subsystem, an infotainment subsystem, etc.

[0030] A subsystem includes one or more electrical components that have similar functions and are connected by the same type of internal bus, and each electrical component can be controlled and driven by an ECU (150).

[0031] The powertrain subsystem is a collection of components that generate the vehicle's driving force, and may include components such as an engine, motor, transmission, battery, and generator.

[0032] The body subsystem is a collection of components designed to enhance passenger comfort and safety, and may include components such as seats, heating / ventilation / air conditioning (HVAC), lighting, doors, windows, and interior / exterior lighting.

[0033] The chassis subsystem is a collection of components required for the operation of a vehicle, excluding the body, and may include components related to steering, braking, suspension, tire pressure measurement, etc.

[0034] The infotainment subsystem is a collection of components related to driving guidance or multimedia, and may include components such as navigation, multimedia systems, and head-up displays.

[0035] The internal network connecting the gateway (110) and the electrical components that constitute the subsystem can use communication protocols such as LIN (Local Interconnect Network), CAN (Control Area Network), CAN-FD, FlexRay, MOST (Media Oriented Systems Transport), and Ethernet.

[0036] Electrical components of different subsystems using different communication protocols can exchange data with each other through the gateway (110).

[0037] Figure 3 illustrates the functional blocks that constitute the gateway.

[0038] The gateway (110) may be configured to include a central control unit (111, CCU (Central Control Unit)) for controlling the overall operation of the vehicle, a storage unit (113, Storage) for storing data received from an external and internal network or data or information related to the operation of the vehicle, an external communication unit (115, COM1) for connecting to a server (200) via an external network, and an internal communication unit (117, COM2) for connecting to electrical components (ECUs) of a subsystem via an internal network.

[0039] The central control unit (111), internal communication unit (117) and separate storage unit may be configured as separate devices separated from the gateway (110).

[0040] Figure 4 illustrates the functions performed by the CCU.

[0041] The central control unit (111) can control various operations of the vehicle (100) by controlling the ECU (150) of at least one electric component included in at least one subsystem according to a request from a passenger, a need due to a driving situation, etc.

[0042] The functions performed by the central control unit (111), particularly those performed based on data transmitted through an external network and / or an internal network, may include driving / parking management, remote diagnosis / control, subscription service (FOD) management, software update, security management, etc.

[0043] Remote diagnosis / control is to transmit status information collected while the vehicle is in operation to a server (200) for real-time diagnosis, and to change the control conditions of the vehicle or support remote control in an emergency based on the diagnosis results received from the server (200).

[0044] Subscription service (FOD) management is a type of subscription service, FOD (Feature On Demand), that allows new features to be downloaded and activated through a server (200) or a customer's terminal, or features that are already installed but deactivated to be activated and used.

[0045] The central control unit (111) performs the setting or cancellation operation of the subscription service, and checks whether the service requested by the customer is a service activated by the customer by selecting a subscription or whether the activation of the driving service is by an illegal method, and may perform or not perform the service based on this.

[0046] Software update is a service that the central control unit (111) performs on its own when software update conditions are satisfied in a vehicle to which OTA is applied, and may include not only updating the software (operating system of the central control unit (111)) that manages the operation of the entire vehicle, but also updating the firmware installed in the ECU (150) of each electrical component.

[0047] Security management may include functions or services related to vehicle security or authentication of external devices that connect to the vehicle.

[0048] Security threats related to vehicles may include firmware tampering, remote vehicle control hacking, CAN tampering, vehicle tampering, and denial of service. Security threats related to external network communications may also include eavesdropping and message tampering.

[0049] Security management can perform functions such as detecting and responding to intrusions into the vehicle's internal network through an external network (IDS: Intrusion Detection System), and recording data related to security events (data immediately before a security incident) (EDR: Event Data Recorder).

[0050] Figure 5 illustrates the functional blocks that constitute the server.

[0051] The server (200) may be configured to include a management unit (210, Manager) for managing operations according to a request of a vehicle, such as software update, data transmission related to FOD, vehicle security / authentication, etc., a database (220, Database) for managing information related to each vehicle, such as software versions installed in each vehicle, activated subscription services, authentication-related information, etc., a storage unit (230, Storage) for storing multiple versions of software, data related to driving of multiple vehicles, etc., and a communication unit (240, COM) for exchanging data by connecting to a vehicle (100) through an external network.

[0052] The server (200) may be composed of multiple different servers, each of which is distinguished according to the function or service performed by the central control unit (111) of the vehicle (100).

[0053] The database (220) may be installed separately from the server (200).

[0054] FIG. 6 is a schematic block diagram of a vehicle security system according to an embodiment of the present disclosure.

[0055] The vehicle security system includes an authentication center (630) and a vehicle (600). In this specification, the vehicle (600) may be referred to as a vehicle security device (600, 700).

[0056] The authentication center (630) issues certificates in advance to controllers that will perform device identification during vehicle manufacturing. The certificates may be, for example, public key certificates from a Public Key Infrastructure (PKI) authentication system. The authentication center (630) may be referred to as a certificate authority (CA).

[0057] The vehicle (600) includes a plurality of ECUs (610, 620, 630, 640, …). In this specification, the ECUs may be referred to as controllers. If the ECU (620) is the current controller, the ECU (610) may be referred to as the previous controller, and the ECU (630) may be referred to as the next controller.

[0058] The ECU (610) includes a storage unit (611), a cryptographic operation unit (613), a processing unit (614), and a communication unit (615).

[0059] The storage unit (611) stores a certificate (612) issued by the authentication center (630), data received from another controller, or data related to the operation of the vehicle.

[0060] The encryption operation unit (613) generates a random number using an HSM (Hardware Security Module) (not shown).

[0061] The processing unit (614) controls the overall operation of the vehicle security device (600) according to an embodiment of the present disclosure. In other words, the processing unit (614) performs the operation of the embodiment of FIG. 8, which will be described later.

[0062] The communication unit (615) communicates with another controller (previous controller or next controller) within the vehicle security device (600). More specifically, the communication unit (615) transmits a challenge signal, which is a random number generated by the encryption operation unit (613), to the next controller (ECU (620)). Then, the communication unit (615) receives an electronic signature from the next controller (ECU (620)) or transmits a verification result for the electronic signature.

[0063] Figure 7 is an example diagram showing the connection relationship between the current controller and the next control period and the distribution operation of the identification number.

[0064] When a vehicle is first manufactured or when a change occurs, a device identification list is distributed to the target controller. The device identification list includes the identification numbers of the previous controller and the next controller.

[0065] Referring to Fig. 7, the frontmost controller (610) in the vehicle security device (700) is a CGW (Central Gateway), and the identification number of the previous controller is the identification number of the last controller (640). The identification number of the controller following the last controller (640) is the identification number of the CGW.

[0066] When the controller performing device identification is a CGW (710), a CCU (Central Communication Unit) (720), an AVN (Audio, Video, and Navigation) (730), or an ADAS (Advanced Driver Assistance System) (740), the identification numbers of the previous / next controller are distributed to each controller.

[0067] For example, if the controller to perform device identification is CGW (710), ADAS / CCU is deployed, if the controller to perform device identification is CCU (720), CGW / AVN is deployed, if the controller to perform device identification is AVN (730), CCU / ADAS is deployed, and if the controller to perform device identification is ADAS (740), AVN / CGW is deployed.

[0068] FIG. 8 is a flowchart illustrating a method for determining whether an in-vehicle controller is normal according to an embodiment of the present disclosure.

[0069] According to the embodiment of the present disclosure, it is assumed that the CGW has proven itself untampered through functions such as Secure Boot as a Trust Anchor. The embodiment of FIG. 8 is an example of a process in which the CGW verifies the CCU (a process for determining whether the CCU is normal), rather than verifying itself.

[0070] The current controller in the vehicle security device (600, 700) generates a challenge signal in step 801. The challenge signal represents a random number.

[0071] The current controller determines whether a next controller exists based on the identification number (identification number of the previous controller / identification number of the next controller mentioned in FIG. 7) stored in the current controller at step 802. Here, the identification number stored in the current controller may be distributed when the vehicle is first manufactured or when a change occurs in the vehicle, but is not limited thereto.

[0072] More specifically, the current controller determines whether the identification number of the next controller is stored, and if the identification number of the next controller is stored, it determines that the next controller exists after the current controller.

[0073] If there is no next controller within the vehicle security device (600, 700), the current controller proceeds to step 813 to report an error to the CGW. Here, the CGW is a central control tower, which collects and manages errors for each controller. For example, if the current controller is the CGW, the current controller reports an error to the CGW in step 813 to an arbitrary block that collects and manages errors for each controller. As another example, if the current controller is the CCU, the current controller reports an error to the CGW in step 813.

[0074] On the other hand, if there is a next controller within the vehicle security device (600, 700), the current controller proceeds to step 803 and transmits the challenge signal generated in step 801 to the next controller. The next controller receives the challenge signal in step 804. Here, steps 803 and 804 are the same operation with only the operating subject being different.

[0075] The next controller generates an electronic signature (s) by performing an electronic signature with its private key on the random number included in the challenge signal in step 805, and transmits a response signal including the electronic signature to the current controller.

[0076] The process of creating an electronic signature includes, but is not limited to, the following:

[0077] First, a message digest is calculated for the plaintext message using a hash function (e.g., Secure Hash Algorithm (SHA)-256). For example, the digest is calculated based on the protocol version, header, payload, and trailer length.

[0078] Afterwards, a signature of the message digest is generated using the current controller's private key. Here, the private key means a value consisting of a 256-bit random number.

[0079] The current controller receives a response signal including an electronic signature from the next controller at step 806.

[0080] The current controller verifies the electronic signature contained in the response signal in step 807.

[0081] The current controller determines whether the verification of the electronic signature included in the response signal was successful in step 808.

[0082] The verification process for electronic signatures includes, but is not limited to, the following:

[0083] The current controller calculates a message digest using the plaintext when it receives the plaintext, digital signature, and sender's (next controller's) certificate.

[0084] The current controller calculates a verification value using the computed message digest, the received digital signature, and the public key. If the verified value is identical to the signature value, the current controller determines that the received digital signature is valid. Conversely, if the verified value is different from the digital signature value, the current controller determines that the received digital signature is invalid.

[0085] Meanwhile, if the digital signature verification fails in step 808, the current controller proceeds to step 813 and reports an error to the CGW. The CGW, as a central control tower, collects and manages errors for each controller. For example, if the current controller is the CGW, the current controller reports the error to the CGW in step 813, to a random block that collects and manages errors for each controller. Alternatively, if the current controller is the CCU, the current controller reports the error to the CGW in step 813.

[0086] On the other hand, if the verification of the electronic signature is successful in step 808, the current controller proceeds to step 809 and transmits the verification result to the next controller.

[0087] The next controller receives the verification result at step 810.

[0088] Here, steps 809 and 810 are the same actions, only the action subject is different.

[0089] The next controller proceeds to step 811, generates a challenge signal, and transmits the challenge signal to the next controller of the next controller. The next controller of the next controller receives the challenge signal in step 812. At this time, the next controller becomes the current controller, and the next controller of the next controller becomes the next controller and performs the verification process (S801 to S810) again.

[0090] An embodiment of the present disclosure can prevent a user / attacker from arbitrarily changing or manipulating a device or function mounted on a vehicle by confirming that the device or function mounted on the vehicle is normal, as in the operation of FIG. 8.

[0091] FIG. 9 is a block diagram schematically illustrating an exemplary computing device to which the present disclosure can be applied.

[0092] Referring to FIG. 9, the computing device (11) may include some or all of a memory (900), a processor (920), storage (930), an input / output interface (940), and a communication interface (980). The computing device (11) may structurally and / or functionally include at least a portion of a vehicle security device (600, 700). The computing device (11) may be a stationary computing device such as a desktop computer, a server, and / or an intelligent camera, as well as a mobile computing device such as a smart phone and / or a laptop computer.

[0093] The memory (900) can store a program that causes the processor (920) to perform the method(s) according to an embodiment of the present invention. For example, the program can include a plurality of instructions executable by the processor (920), and the plurality of instructions can be executed by the processor (920) to perform the operations of the vehicle security device (600, 700) described above.

[0094] The memory (900) may be a single memory or multiple memories. Information required for the operation of the vehicle security device (600, 700) described above may be stored in a single memory or may be divided and stored in multiple memories. If the memory (900) is composed of multiple memories, the multiple memories may be physically separated. The memory (900) may include at least one of volatile memory and non-volatile memory. Volatile memory includes Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM), and non-volatile memory includes Flash memory.

[0095] The processor (920) may include at least one core capable of executing at least one instruction. The processor (920) may be a single processor or multiple processors. The processor (920) may execute instructions stored in the memory (900).

[0096] For example, the processor (920) may execute instructions stored in the memory (900) to generate a challenge signal in the current controller, determine whether a next controller exists in the vehicle, transmit the challenge signal to the next controller if the next controller exists in the vehicle, receive a response signal including an electronic signature from the next controller, verify the electronic signature, and determine whether the controller of the vehicle is normal or abnormal using the verification result. If the verification result of the electronic signature is a failure, the processor (920) determines that the next controller is a modified controller, and if the verification result of the electronic signature is a success, the processor determines that the next controller is normal.

[0097] Storage (940) can maintain stored data even when power supplied to the computing device (11) is cut off. For example, storage (940) may include non-volatile memory, or may include storage media such as magnetic tape, optical disk, or magnetic disk.

[0098] The storage (940) can store data to be processed by the processor (920) and data processed by the processor (920). For example, the storage (940) can store the identification number of the previous controller and the identification number of the next controller. As another example, the storage (940) can store a program that determines whether the controller of the vehicle is normal or abnormal using the verification result. The program or data stored in the storage (940) can be loaded into the memory (900) before being executed by the processor (920). The storage (940) can store a file written in a programming language, and a program generated from the file by a compiler or the like can be loaded into the memory (900).

[0099] The input / output interface (960) provides an interface for data input / output with an external device. The computing device (11) can obtain an electronic signature through the input / output interface (960). The input / output interface (960) may also provide an interface with an input device such as a keyboard, mouse, or touch interface, and an output device such as a display. A user can trigger the execution of a program by the processor (920) through the input device, and check the result processed by the processor (920) through the output device. For example, the computing device (11) can check the result for determining whether the controller of the vehicle is normal or abnormal by using the verification result through the input / output interface (960).

[0100] The communication interface (980) provides access to an external network. For example, the computing device (11) can receive an electronic signature via the communication interface (980). The computing device (11) can also transmit the verification result of verifying the electronic signature via the communication interface (980).

[0101] At least some of the components described in the exemplary embodiments of the present disclosure may be implemented as hardware elements including at least one or a combination of a Digital Signal Processor (DSP), a processor, a controller, an Application-Specific Integrated Circuit (ASIC), a programmable logic device (FPGA, etc.), and other electronic devices. In addition, at least some of the functions or processes described in the exemplary embodiments may be implemented as software, and the software may be stored on a recording medium. At least some of the components, functions, and processes described in the exemplary embodiments of the present disclosure may be implemented as a combination of hardware and software.

[0102] The method according to exemplary embodiments of the present disclosure can be written as a program that can be executed on a computer, and can also be implemented in various recording media such as a magnetic storage medium, an optical readable medium, a digital storage medium, etc.

[0103] Implementations of the various technologies described herein may be implemented as digital electronic circuitry, or as computer hardware, firmware, software, or combinations thereof. Implementations may be implemented as a computer program product, i.e., a computer program tangibly embodied in an information carrier, e.g., a machine-readable storage medium (computer-readable medium) or a radio signal, for processing by the operation of a data processing device, e.g., a programmable processor, a computer, or multiple computers, or for controlling the operation thereof. A computer program, such as the computer program(s) described above, may be written in any form of programming language, including compiled or interpreted languages, and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program may be deployed to be processed on one computer or multiple computers at a single site, or to be distributed across multiple sites and interconnected by a communications network.

[0104] Processors suitable for processing a computer program include, for example, both general-purpose and special-purpose microprocessors, and any one or more processors of any type of digital computer. Typically, a processor will receive instructions and data from read-only memory or random-access memory, or both. Components of a computer may include at least one processor for executing instructions and one or more memory devices for storing instructions and data. Typically, a computer may include, or be coupled to receive data from, transmit data to, or both, one or more mass storage devices, such as magnetic, magneto-optical, or optical disks, for storing data. Information carriers suitable for embodying computer program instructions and data include, for example, semiconductor memory devices, magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as compact disk read only memory (CD-ROM), digital video disks (DVD), magneto-optical media such as floptical disks, read only memory (ROM), random access memory (RAM), flash memory, erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), etc. The processor and memory may be supplemented by, or included in, special purpose logic circuitry.

[0105] A processor can execute an operating system and software applications running on the operating system. Furthermore, the processor device can access, store, manipulate, process, and generate data in response to the execution of the software. For ease of understanding, the processor device is sometimes described as being used singly; however, those skilled in the art will appreciate that the processor device can include multiple processing elements and / or multiple types of processing elements. For example, the processor device can include multiple processors, or one processor and one controller. Other processing configurations, such as parallel processors, are also possible.

[0106] Additionally, non-transitory computer-readable media can be any available media that can be accessed by a computer, and can include both computer storage media and transmission media.

[0107] While this specification contains details of a number of specific implementations, these should not be construed as limitations on the scope of any invention or what may be claimed, but rather as descriptions of features that may be unique to particular embodiments of particular inventions. Certain features described herein in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented in multiple embodiments, either individually or in any suitable subcombination. Furthermore, although features may operate in a particular combination and may initially be described as being claimed as such, one or more features from a claimed combination may in some cases be excluded from that combination, and the claimed combination may be modified into a subcombination or variation of a subcombination.

[0108] Likewise, while operations are depicted in the drawings in a particular order, this should not be construed as requiring that those operations be performed in the particular or sequential order depicted to achieve desired results, or that all depicted operations be performed. In certain instances, multitasking and parallel processing may be advantageous. Furthermore, the separation of the various device components of the embodiments described above should not be construed as requiring such separation in all embodiments, and it should be understood that the program components and devices described may generally be integrated together in a single software product or packaged into multiple software products.

[0109] Meanwhile, the embodiments of the present invention disclosed in this specification and drawings are merely specific examples presented to aid understanding and are not intended to limit the scope of the present invention. It will be apparent to those skilled in the art that other modifications based on the technical concepts of the present invention are possible in addition to the embodiments disclosed herein.

[0110] The scope of protection of this embodiment should be interpreted by the claims below, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of rights of this embodiment.

[0111] CROSS-REFERENCE TO RELATED APPLICATION

[0112] This patent application claims priority to Korean Patent Application No. 10-2023-0114871, filed in Korea on August 30, 2023, and Korean Patent Application No. 10-2024-0093680, filed in Korea on July 16, 2024, the entire contents of which are incorporated herein by reference.

Claims

1. A method for determining whether a vehicle controller is normal, In the current controller, the process of generating a challenge signal; A process for determining whether the following controllers exist within the above vehicle; A process of transmitting the challenge signal to the next controller when the next controller exists in the vehicle; A process of receiving a response signal including an electronic signature from the above controller; The process of verifying the above electronic signature; and It includes a process of determining whether the following controller is normal based on the verification result, How to determine whether the in-vehicle controller is normal.

2. In paragraph 1, The above current controller stores the identification number of the previous controller and the identification number of the next controller, If the current controller is the controller that exists most in front, the identification number of the previous controller is the identification number of the controller that exists most in front. How to determine whether the in-vehicle controller is normal.

3. In paragraph 1, The process of determining whether the following controllers exist within the above vehicle is as follows: A process for determining whether the identification number of the next controller is stored in the current controller; and If the identification code of the next controller is stored, a process for determining that the next controller exists in the vehicle is included. How to determine whether the in-vehicle controller is normal.

4. In paragraph 1, The process of verifying the above electronic signature is: If the verification result of the above electronic signature fails, a process for determining that the next controller is abnormal is included. How to determine whether the in-vehicle controller is normal.

5. In paragraph 1, The process of verifying the above electronic signature is: If the verification result of the above electronic signature is successful, the process of determining that the next controller is normal is included. How to determine whether the in-vehicle controller is normal.

6. In paragraph 1, The above challenge signal is a random number, The above random number is generated using HSM (Hardware Security Module). How to determine whether the in-vehicle controller is normal.

7. In paragraph 1, The identification number of the above previous controller and the identification number of the above next controller are, Granted when the above vehicle is manufactured or when changes are made to the above vehicle. How to determine whether the in-vehicle controller is normal.

8. In the device for determining whether the vehicle controller is normal, memory containing instructions; and A processor including a processor that generates a challenge signal in the current controller by executing the above command, determines whether a next controller exists in the vehicle, transmits the challenge signal to the next controller if the next controller exists in the vehicle, receives a response signal including an electronic signature from the next controller, verifies the electronic signature, and determines whether the next controller is normal or abnormal based on the verification result. A device that determines whether the vehicle's controller is functioning normally.

9. In paragraph 8, The above current controller stores the identification number of the previous controller and the identification number of the next controller, If the current controller is the controller that exists most in front, the identification number of the previous controller is the identification number of the controller that exists most in front. A device that determines whether the vehicle's controller is functioning normally.

10. In paragraph 8, The above processor, It determines whether the identification number of the next controller is stored in the current controller, and if the identification number of the next controller is stored, it determines that the next controller exists in the vehicle. A device that determines whether the vehicle's controller is functioning normally.

11. In paragraph 8, The above processor, If the verification result of the above electronic signature fails, the next controller is judged to be abnormal. A device that determines whether the vehicle's controller is functioning normally.

12. In paragraph 8, The above processor, If the verification result of the above electronic signature is successful, the next controller is judged to be normal. A device that determines whether the vehicle's controller is functioning normally.

13. In paragraph 8, The above challenge signal is a random number, The above random number is generated using HSM (Hardware Security Module). A device that determines whether the vehicle's controller is functioning normally.

14. In paragraph 8, The identification number of the above previous controller and the identification number of the above next controller are, Granted when the above vehicle is manufactured or when changes are made to the above vehicle. A device that determines whether the vehicle's controller is functioning normally.

15. A method for determining whether a vehicle controller is normal, The process of receiving a challenge signal from the current controller; A process of generating an electronic signature based on the above challenge signal; A process for transmitting a response signal including the electronic signature to the current controller, The above current controller is, Generating a challenge signal, determining whether a next controller exists in the vehicle, transmitting the challenge signal to the next controller if a next controller exists in the vehicle, receiving a response signal including an electronic signature from the next controller, verifying the electronic signature, and determining whether the next controller is normal based on the verification result. How to determine whether the in-vehicle controller is normal.

16. In paragraph 15, The above current controller stores the identification number of the previous controller and the identification number of the next controller, If the current controller is the controller that exists most in front, the identification number of the previous controller is the identification number of the controller that exists most in front. How to determine whether the in-vehicle controller is normal.

17. In paragraph 15, The above current controller is, It determines whether the identification number of the next controller is stored in the current controller, and if the identification number of the next controller is stored, it determines that the next controller exists in the vehicle. How to determine whether the in-vehicle controller is normal.

18. In paragraph 15, The above current controller determines that the next controller is abnormal if the verification result of the electronic signature fails. How to determine whether the in-vehicle controller is normal.

19. In paragraph 15, The above current controller determines that the next controller is normal if the verification result of the electronic signature is successful. How to determine whether the in-vehicle controller is normal.

20. In paragraph 15, The above challenge signal is a random number, The above random number is generated using HSM (Hardware Security Module). How to determine whether the in-vehicle controller is normal.

Images