Method and apparatus for updating ECU software of vehicle

Abstract

Disclosed are a method and apparatus for updating ECU software of a vehicle. According to an aspect of the present disclosure, provided is the method performed by a gateway for managing an update of one or more pieces of software installed in one or more ECUs included in a vehicle, the method comprising the steps of: receiving an encoded update module from an update server; obtaining one or more update files by decoding the update module; transmitting the one or more update files to each of the one or more ECUs and requesting a software update; and receiving an update result report from the one or more ECUs in response to the request.

Description

Method and device for updating ECU software of a vehicle

[0001] The present disclosure relates to a method and device for updating ECU software in a vehicle. More specifically, the present disclosure relates to a method and device for preventing security issues that may arise during an update of ECU software in a vehicle by clearly specifying the creator and generation time of encryption and authentication codes, as well as the type of encryption key, during the process of the vehicle receiving an update module or update file from a server.

[0002] The content described below merely provides background information related to the present embodiment and does not constitute prior art.

[0003] To perform various autonomous driving functions such as driving safety, driver assistance, and autonomous driving, many electronic devices or electrical components driven by electronic control units (ECUs) are installed in vehicles.

[0004] The controller operates the vehicle's electrical components based on the software installed in the vehicle. The vehicle's system updates the software to operate the electrical components more efficiently.

[0005] OTA (Over The Air) is a feature that allows remote updates of in-vehicle software. Because OTA connects to wireless networks and the cloud, it can pose various security risks. Malfunctions in in-vehicle software due to external attacks can have devastating consequences for the vehicle and its occupants. Therefore, when remotely updating in-vehicle software, a method is needed to securely protect vehicle operating software and other components from external attacks.

[0006]

[0007] The main purpose of the present disclosure is to provide a method and device for protecting a vehicle connected to a network from external attacks.

[0008] The main purpose of the present disclosure is to provide a method and device for ensuring confidentiality and integrity of software transmitted from a network to a vehicle.

[0009] The main purpose of the present disclosure is to provide a method and device for preventing security issues that may occur during an update process that proceeds sequentially from an automotive component supplier, a vehicle mobile gateway, and an ECU (Electronic Control Unit).

[0010] The problems to be solved by the present invention are not limited to the problems mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the description below.

[0011] According to one aspect of the present disclosure, a method is provided, performed by a gateway for managing an update of one or more software installed in one or more ECUs included in a vehicle, comprising: receiving an encrypted update module from an update server; decrypting the update module to obtain one or more update files; transmitting the one or more update files to each of the one or more ECUs and requesting a software update; and receiving an update result report from the one or more ECUs in response to the request.

[0012] According to another aspect of the present disclosure, a method is provided, performed by an ECU for managing at least one software installed in a vehicle system, comprising: receiving an update request and an update file from a gateway; performing a software update using the update file; and transmitting an update result report including a message indicating whether the update was successful to the gateway.

[0013] According to another aspect of the present disclosure, a gateway for managing an update of one or more software installed in one or more ECUs included in a vehicle is provided, the gateway comprising: at least one memory for storing commands; and at least one processor, wherein the at least one processor executes the commands to receive an encrypted update module from an update server, decrypt the update module, obtain one or more update files, transmit the one or more update files to each of the one or more ECUs, request a software update, and in response to the request, receive an update result report from the one or more ECUs.

[0014] According to another aspect of the present disclosure, there is provided an ECU for managing at least one software installed in a vehicle system, the ECU comprising: at least one memory for storing commands; and at least one processor, wherein the at least one processor executes the commands to receive an update request and an update file from a gateway, perform a software update using the update file, and transmit an update result report including a message regarding whether the update was successful to the gateway.

[0015] According to one embodiment of the present disclosure, there is an effect of maintaining security by defending a vehicle from external attacks.

[0016] According to one embodiment of the present disclosure, there is an effect of maintaining security by protecting software transmitted to a vehicle from external attacks.

[0017] According to one embodiment of the present disclosure, there is an effect of ensuring the confidentiality and integrity of software transmitted to a vehicle.

[0018] According to one embodiment of the present disclosure, encrypted software is transmitted to the vehicle using the vehicle's public key, and the encrypted software is decrypted using the vehicle's private key, thereby enabling software to be updated without additional data exchange or procedures other than transmission of the encrypted software.

[0019] The effects of the present disclosure are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

[0020]

[0021] Figure 1 is a conceptual diagram illustrating a connection between a vehicle and a server using a network.

[0022] Figure 2 is a block diagram schematically showing the functional blocks that constitute a vehicle connected to an external network.

[0023] Figure 3 is a block diagram schematically showing the functional blocks that make up the gateway.

[0024] Figure 4 is a diagram showing the functions performed by the central control unit.

[0025] Figure 5 is a block diagram schematically showing the functional blocks that make up the server.

[0026] FIG. 6a and FIG. 6b are drawings for explaining a process of remotely updating ECU software according to the present disclosure.

[0027] Figure 7 is a diagram for explaining in detail the process in which the gateway transmits an update application request and an update file to each ECU and receives an update application result report from the ECU.

[0028] FIG. 8 is a block diagram schematically illustrating an exemplary computing device that can be used to implement a method or device according to the present disclosure.

[0029]

[0030] Hereinafter, some embodiments of the present disclosure will be described in detail using exemplary drawings. When designating components in each drawing, it should be noted that, where possible, identical components are given the same reference numerals, even if they appear in different drawings. Furthermore, when describing the present disclosure, detailed descriptions of related known structures or functions will be omitted if they are deemed to obscure the gist of the present disclosure.

[0031] In describing components of embodiments according to the present disclosure, symbols such as first, second, i), ii), a), b) may be used. These symbols are only for distinguishing the components from other components, and the nature, order, or sequence of the components are not limited by the symbols. When a part in the specification is said to "include" or "have" a component, this does not mean that other components are excluded, but rather that other components may be included, unless explicitly stated otherwise.

[0032] The detailed description set forth below, together with the accompanying drawings, is intended to explain exemplary embodiments of the present disclosure and is not intended to represent the only embodiments in which the present disclosure may be practiced.

[0033] Figure 1 is a conceptual diagram illustrating a connection between a vehicle (100) and a server (200) utilizing a network. The vehicle (100) can be connected to the server (200) using a mobile network or wireless network such as LTE, 5G, or Wi-Fi. The server (200) can provide functions or services related to the vehicle (100).

[0034] Figure 2 is a block diagram schematically illustrating the functional blocks that constitute a vehicle (100) connected to an external network. The vehicle (100) may include a gateway (110, GW) and subsystems.

[0035] A gateway (110), i.e., a vehicle mobile gateway (VMG), is connected to an external network and an internal network. Subsystems are connected to the internal network of the vehicle (100). The subsystems may include a powertrain subsystem, a body subsystem, a chassis subsystem, an infotainment subsystem, and the like.

[0036] A subsystem is a collection of components with similar functions connected via the same internal bus, containing one or more electrical components. Each electrical component can be controlled and driven by its own ECU (Electronic Control Unit).

[0037] The powertrain subsystem is a collection of components that generate the vehicle's driving force, and may include components such as an engine, motor, transmission, battery, and generator. The body subsystem is a collection of components that enhance passenger comfort and safety, and may include components such as seats, heating, ventilation, and air conditioning (HVAC), lighting, doors, windows, and interior and exterior lighting. The chassis subsystem is a collection of components necessary for vehicle operation, excluding the body, and may include components related to steering, brakes, suspension, and tire pressure measurement. The infotainment subsystem is a collection of components related to driving guidance or multimedia, and may include components such as navigation, multimedia systems, and head-up displays.

[0038] The internal network connecting the gateway (110) and the electrical components constituting the subsystems can utilize communication protocols such as LIN (Local Interconnect Network), CAN (Control Area Network), CAN-FD, FlexRay, MOST (Media Oriented Systems Transport), and Ethernet. Electrical components of other subsystems using different communication protocols can exchange data with each other by utilizing the gateway (110).

[0039] Figure 3 is a block diagram schematically showing the functional blocks that constitute a gateway (110). The gateway (110) may include a central control unit (111, CCU), a storage unit (113, storage), an external communication unit (115, COM1), and an internal communication unit (117, COM2).

[0040] The central control unit (111, CCU) can control the overall operation of the vehicle. The storage unit (113, storage) can store data received from external and internal networks, or data or information related to the operation of the vehicle. The external communication unit (115, COM1) can connect the server (200) and the gateway (110) using an external network. The internal communication unit (117, COM2) can connect the electrical components (ECUs) of the subsystem and the gateway (110) using an internal network.

[0041] The central control unit (111), internal communication unit (117) and separate storage unit may be configured as separate devices separated from the gateway (110).

[0042] Figure 4 is a drawing showing the functions performed by the central control unit (111).

[0043] The central control unit (111) can control various operations of the vehicle (100) by controlling the ECU (150) of at least one electrical component included in at least one subsystem according to a request from a passenger, a need due to a driving situation, etc.

[0044] The functions performed by the central control unit (111), particularly those performed based on data transmitted using an external network and / or an internal network, may include driving / parking management, remote diagnosis / control, subscription service management, software update, security management, etc.

[0045] Remote diagnosis / control is a function that transmits status information collected while the vehicle is in operation to a server (200) to diagnose the vehicle in real time, and changes the control conditions of the vehicle based on the diagnosis results received from the server (200) or supports remote control in an emergency.

[0046] Subscription service (FOD; Feature On Demand) management is a function that manages a type of subscription service, such as downloading and activating a new feature through a server (200) or a customer's terminal, or activating and using a feature that is already installed but deactivated.

[0047] The central control unit (111) performs the setup or cancellation of subscription services. The central control unit (111) verifies whether the service requested by the customer is a service activated by the customer's subscription selection or whether the subscription service was activated through fraudulent means. Based on the verification result, the central control unit may perform or not perform the service.

[0048] Software update (S / W update) is a service automatically performed by the central control unit (111) when software update conditions are met in a vehicle to which OTA is applied. Software update may include updating not only the software (operating system of the central control unit (111)) that manages the operation of the entire vehicle, but also the firmware installed in the ECU (150) of each electrical component.

[0049] Security management may include functions or services related to vehicle security or authentication of external devices connecting to the vehicle.

[0050] Security threats related to vehicles may include firmware tampering, remote vehicle control hacking, CAN tampering, vehicle tampering, and denial of service. Security threats related to external network communications may also include communication interception and message tampering.

[0051] Security management can perform functions such as detecting and responding to intrusions into the vehicle's internal network through an external network (IDS; Intrusion Detection System), and recording services for data related to security events (data immediately before a security incident) (EDR; Event Data Recorder).

[0052] Figure 5 is a block diagram schematically showing the functional blocks that constitute the server (200). The server (200) may include a management unit (210, manager), a database (220, database), a storage unit (230, storage), and a communication unit (240, COM).

[0053] The management unit (210, manager) can manage operations according to vehicle requests, such as software updates, data transmission related to FOD, vehicle security / authentication, etc. The database (220, database) can manage information related to each vehicle, such as software versions installed in each vehicle, activated subscription services, authentication-related information, etc. The storage unit (230, storage) can store various versions of software, data related to driving of multiple vehicles, etc. The communication unit (240, COM) can connect to the vehicle (100) using an external network and exchange data.

[0054] The server (200) may be composed of multiple different servers, each of which is distinguished according to the function or service performed by the central control unit (111) of the vehicle (100). The database (220) may also be installed separately from the server (200).

[0055] Figures 6a and 6b are diagrams illustrating a process for remotely updating ECU software according to the present disclosure. Communication between the server (200) and the gateway (110) can utilize a secure channel based on Transport Layer Security (TLS).

[0056] The server (200) can identify ECUs and vehicles equipped with relevant software to determine which vehicles and ECUs require software updates (S605). The server (200) can identify ECUs equipped with relevant software using the serial number (S / N) assigned to the ECU at the time of manufacturing. The server (200) can identify vehicles equipped with relevant software using the vehicle identification number (VIN).

[0057] The server (200) may request software information of the vehicle (100) from the gateway (110) of the vehicle (100) equipped with related software (S610). The software information may include information regarding the version of the software installed in each ECU.

[0058] The gateway (110) can transmit data including a list of software installed in each ECU and an update history of each software, particularly the version of the software, to the server (200) (S615).

[0059] The server (200) can check the update history of each software installed in the vehicle (100) based on the data received from the gateway (110) and determine which older versions of the software require an update (S620). If no software requires an update (S620-NO), the server (200) terminates the update process.

[0060] If there is software that requires an update (S620-NO), the server (200) can generate a message authentication code (MAC) using a symmetric key and an update module (S625). The symmetric key is a key already shared between the server (200) and the gateway (110). The update module includes an update file. The server (200) can append a MAC to the update module.

[0061] The server (200) can encrypt the binary file of the update module with the MAC added using the public key of the gateway (110) (S630). The server (200) can transmit the encrypted update module to the gateway (110) (S635).

[0062] The gateway (110) can decrypt the encrypted update module using the gateway's (110) private key (S640). The gateway (110) can decrypt the encrypted update module using a hardware security module (HSM) and the gateway's (110) private key.

[0063] If the update module decryption fails (S645-NO), the gateway (110) can transmit an update result report including an update failure message to the server (200) (S680). If the update module decryption succeeds (S645-YES), the gateway (110) can decrypt the MAC address added to the update module by the server (200) from the decrypted data. A can be obtained (S650).

[0064] The gateway (110) obtains the original update module from the decrypted data and uses the original update module and the symmetric key to generate a MAC Bcan be generated (S655). The symmetric key is a key already shared by the server (200) and the gateway (110), and is the key used by the server (200) when generating the MAC.

[0065] Gateway (110) is MAC A Wow MAC B can be compared (S660). MAC A Wow MAC B If different (S660-NO), the gateway (110) can transmit an update result report including an update failure message to the update server (200) (S680). MAC A Wow MAC B In the same case (S660-YES), the gateway (110) can transmit an update application request and an update file to each ECU (150) requiring an update, and then receive an update application result report from the ECU (150) (S665).

[0066] If the update application fails (S670-NO), the gateway (110) can transmit an update result report including an update failure message to the update server (200) (S680). If the update application succeeds (S670-YES), the gateway (110) can transmit an update result report including an update success message to the update server (200) (S675). The server (200) can receive the update result report from the gateway (110) and terminate the update process (S685).

[0067] FIG. 7 is a drawing for explaining in detail the process (S665) in which the gateway (110) transmits an update application request and an update file to each ECU (150) and receives an update application result report from the ECU (150).

[0068] The gateway (110) can identify the ECU (150) that needs to perform a software update (S710). The gateway (110) can transmit a decrypted update file along with a software update request to each ECU (150) that needs an update (S720).

[0069] The ECU (150) that receives the software update request can store the previously installed software in internal or external storage for rollback purposes (S730). The ECU (150) can temporarily store the existing software image in internal or external storage for rollback purposes. A software image is a single object consisting of files required for application execution.

[0070] The ECU (150) can perform a software update using an update file (S740). The ECU (150) can determine whether the update is successful (S750). If the update fails (S750-NO), the ECU (150) can restore the existing software using a software image stored in the storage (S760). The ECU (150) can transmit an update result report including an update failure message to the gateway (110) (S790). If the update is successful (S750-YES), the ECU (150) can transmit an update result report including an update success message to the gateway (110) (S780).

[0071] FIG. 8 is a block diagram schematically illustrating an exemplary computing device that can be used to implement a method or device according to the present disclosure.

[0072] The computing device (800) may include some or all of a memory (810), a processor (820), storage (830), an input / output interface (840), and a communication interface (850). The computing device (800) may structurally and / or functionally include at least a portion of a device according to the present disclosure. The computing device (800) may be a stationary computing device, such as a desktop computer or a server, as well as a mobile computing device, such as a laptop computer, a smart phone, or an automotive electronic device. The computing device (800) may also be implemented with any specialized hardware accelerator capable of efficiently processing operations for an artificial intelligence model. For example, the computing device (800) may include a graphic processing unit (GPU), a Tensor Processing Unit (TPU), or a neural processing unit (NPU).

[0073] The memory (810) may store a program that causes the processor (820) to perform a method or operation according to various embodiments of the present disclosure. For example, the program may include a plurality of instructions executable by the processor (820), and the above-described method or operation may be performed by executing the plurality of instructions by the processor (820). The memory (810) may be a single memory or a plurality of memories. In this case, information required to perform the method or operation according to various embodiments of the present disclosure may be stored in a single memory or may be divided and stored in a plurality of memories. When the memory (810) is composed of a plurality of memories, the plurality of memories may be physically separated. The memory (810) may include at least one of a volatile memory and a non-volatile memory. The volatile memory includes a static random access memory (SRAM) or a dynamic random access memory (DRAM), and the non-volatile memory includes a flash memory.

[0074] The processor (820) may include at least one core capable of executing at least one instruction. The processor (820) may execute instructions stored in the memory (810). The processor (820) may be a single processor or multiple processors.

[0075] Storage (830) maintains stored data even when power supplied to the computing device (800) is cut off. For example, storage (830) may include non-volatile memory, or may include storage media such as magnetic tape, optical disk, or magnetic disk. A program stored in storage (830) may be loaded into memory (810) before being executed by processor (820). Storage (830) may store a file written in a programming language, and a program generated from the file by a compiler or the like may be loaded into memory (810). Storage (830) may store data to be processed by processor (820) and / or data processed by processor (820).

[0076] The input / output interface (840) may provide an interface with an input device such as a keyboard, mouse, etc. and / or an output device such as a display device, printer, etc. A user may trigger the execution of a program by the processor (820) through the input device and / or check the processing result of the processor (820) through the output device.

[0077] The communication interface (850) may provide access to an external network. The computing device (800) may communicate with other devices via the communication interface (850).

[0078] At least some of the components described in the exemplary embodiments of the present disclosure may be implemented as hardware elements including at least one or a combination of a Digital Signal Processor (DSP), a processor, a controller, an Application-Specific Integrated Circuit (ASIC), a programmable logic device (FPGA, etc.), and other electronic devices. In addition, at least some of the functions or processes described in the exemplary embodiments may be implemented as software, and the software may be stored on a recording medium. At least some of the components, functions, and processes described in the exemplary embodiments of the present disclosure may be implemented as a combination of hardware and software.

[0079] The method according to exemplary embodiments of the present disclosure can be written as a program that can be executed on a computer, and can also be implemented in various recording media such as a magnetic storage medium, an optical readable medium, a digital storage medium, etc.

[0080] Implementations of the various technologies described herein may be implemented as digital electronic circuitry, or as computer hardware, firmware, software, or combinations thereof. Implementations may be implemented as a computer program product, i.e., a computer program tangibly embodied in an information carrier, e.g., a machine-readable storage medium (computer-readable medium) or a radio signal, for processing by the operation of a data processing device, e.g., a programmable processor, a computer, or multiple computers, or for controlling the operation thereof. A computer program, such as the computer program(s) described above, may be written in any form of programming language, including compiled or interpreted languages, and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program may be deployed to be processed on one computer or multiple computers at a single site, or to be distributed across multiple sites and interconnected by a communications network.

[0081] Processors suitable for processing a computer program include, for example, both general-purpose and special-purpose microprocessors, and any one or more processors of any type of digital computer. Typically, a processor will receive instructions and data from read-only memory or random-access memory, or both. Components of a computer may include at least one processor for executing instructions and one or more memory devices for storing instructions and data. Typically, a computer may include, or be coupled to receive data from, transmit data to, or both, one or more mass storage devices, such as magnetic, magneto-optical, or optical disks, for storing data. Information carriers suitable for embodying computer program instructions and data include, for example, semiconductor memory devices, magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as compact disk read only memory (CD-ROM), digital video disks (DVD), magneto-optical media such as floptical disks, read only memory (ROM), random access memory (RAM), flash memory, erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), etc. The processor and memory may be supplemented by, or included in, special purpose logic circuitry.

[0082] A processor can execute an operating system and software applications running on the operating system. Furthermore, the processor device can access, store, manipulate, process, and generate data in response to the execution of the software. For ease of understanding, the processor device is sometimes described as being used singly; however, those skilled in the art will appreciate that the processor device can include multiple processing elements and / or multiple types of processing elements. For example, the processor device can include multiple processors, or one processor and one controller. Other processing configurations, such as parallel processors, are also possible.

[0083] Additionally, non-transitory computer-readable media can be any available media that can be accessed by a computer, and can include both computer storage media and transmission media.

[0084] While this specification contains details of a number of specific implementations, these should not be construed as limitations on the scope of any invention or what may be claimed, but rather as descriptions of features that may be unique to particular embodiments of particular inventions. Certain features described herein in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented in multiple embodiments, either individually or in any suitable subcombination. Furthermore, although features may operate in a particular combination and may initially be described as being claimed as such, one or more features from a claimed combination may in some cases be excluded from that combination, and the claimed combination may be modified into a subcombination or variation of a subcombination.

[0085] Likewise, while operations are depicted in the drawings in a particular order, this should not be construed as requiring that those operations be performed in the particular or sequential order depicted to achieve desired results, or that all depicted operations be performed. In certain instances, multitasking and parallel processing may be advantageous. Furthermore, the separation of the various device components of the embodiments described above should not be construed as requiring such separation in all embodiments, and it should be understood that the program components and devices described may generally be integrated together in a single software product or packaged into multiple software products.

[0086] Meanwhile, the embodiments of the present invention disclosed in this specification and drawings are merely specific examples presented to aid understanding and are not intended to limit the scope of the present invention. It will be apparent to those skilled in the art that other modifications based on the technical concepts of the present invention are possible in addition to the embodiments disclosed herein.

[0087] The scope of protection of this embodiment should be interpreted by the claims below, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of rights of this embodiment.

[0088]

[0089] CROSS-REFERENCE TO RELATED APPLICATION

[0090] This patent application claims priority to Korean Patent Application No. 10-2023-0114868, filed in Korea on August 30, 2023, and Korean Patent Application No. 10-2024-0106219, filed in Korea on August 8, 2024, the entire contents of which are incorporated herein by reference.

Claims

1. A method performed by a gateway that manages updates of one or more software installed in one or more ECUs included in a vehicle, The process of receiving an encrypted update module from the update server; A process of decrypting the above update module to obtain one or more update files; A process of transmitting one or more update files to each of the one or more ECUs and requesting a software update; and In response to the above request, a process of receiving an update result report from one or more ECUs A method comprising:

2. In paragraph 1, The above update module is a method shared using an asymmetric key encryption method.

3. In paragraph 1 or 2, The process of receiving the above update module is: A method for receiving an encrypted update module using the public key of the above gateway.

4. In paragraph 1, A process of receiving a first message authentication code from the above update server; A process for generating a second message authentication code based on the above update module; and A process for determining whether to request the software update based on the result of comparing the first message authentication code and the second message authentication code. A method further comprising:

5. In paragraph 4, A method in which the above first message authentication code is transmitted in combination with the update module.

6. In paragraph 1, A method in which the above gateway is communicatively connected to the update server by utilizing a secure channel based on TLS.

7. A method performed by an ECU that manages at least one software installed in a vehicle system, The process of receiving update requests and update files from the gateway; A process of performing a software update using the above update file; and The process of sending an update result report containing a message about whether the update was successful to the above gateway. A method comprising:

8. In paragraph 7, The process of temporarily storing existing software; and If the above software update fails, the process of restoring the previously saved software A method further comprising:

9. As a gateway that manages updates of one or more software installed in one or more ECUs included in a vehicle, At least one memory for storing instructions; and Containing at least one processor, At least one processor executes the instructions, Receive encrypted update modules from the update server, Decrypt the above update module to obtain one or more update files, Requesting a software update by transmitting one or more update files to each of the one or more ECUs, A gateway that receives an update result report from one or more ECUs in response to said request.

10. In paragraph 9, A gateway that shares the update module with the update server using an asymmetric key encryption method.

11. In clause 9 or 10, The above update module is an encrypted update module using the public key of the gateway.

12. In paragraph 9, To determine whether to request the above software update, Receive the first message authentication code from the above update server, Generate a second message authentication code based on the above update module, A gateway that compares the first message authentication code and the second message authentication code.

13. In paragraph 12, The above first message authentication code is transmitted by being combined with the update module, the gateway.

14. In paragraph 9, The above gateway is a gateway that communicates with the update server by utilizing a secure channel based on TLS.

15. An ECU that manages at least one software installed in a vehicle system, At least one memory for storing instructions; and Containing at least one processor, At least one processor executes the instructions, Receive update requests and update files from the gateway, Perform software update using the above update file, An ECU that transmits an update result report containing a message indicating whether the update was successful to the gateway.

16. In paragraph 15, Before performing the above software update, temporarily save the existing software, If the above software update fails, ECU restores the existing software.

Images