Time management device and time management method

Abstract

In the present invention, a controller (20): calculates a vehicle absolute time by clocking an elapsed time with reference to a reference absolute time which is stored in advance in a first memory (24); acquires an external absolute time transmitted from the outside of a vehicle; updates the vehicle absolute time to the external absolute time if the external absolute time is a time later than the vehicle absolute time at the time of acquiring the external absolute time; and maintains the vehicle absolute time without updating the vehicle absolute time to the external absolute time if the external absolute time is a time earlier than the vehicle absolute time at the time of acquiring the external absolute time.

Description

Time management device and time management method

[0001] The present invention relates to a time management device and a time management method.

[0002] In an in-vehicle system, a technology is known in which a zone ECU that manages one zone on a vehicle monitors communications, etc. with each of multiple downstream ECUs connected downstream via a downstream communication network to detect attacks (Patent Document 1).

[0003] JP 2022-160932 A

[0004] One method for detecting external attacks on in-vehicle systems is to detect data tampering by verifying the expiration date of a digital certificate. To verify the expiration date, it is necessary to manage time using absolute time. However, absolute time obtained from outside the vehicle may be subject to tampering. With the technology disclosed in Patent Document 1, if the obtained absolute time is tampered with to an earlier time than the actual time, time management may be performed using the tampered absolute time, which may result in inaccurate time management.

[0005] The problem to be solved by the present invention is to provide a time management device and a time management method that can manage time more accurately.

[0006] The present invention solves the above problem by calculating vehicle absolute time by measuring the elapsed time from a reference absolute time pre-stored in a first memory, acquiring external absolute time transmitted from outside the vehicle, and changing the vehicle absolute time to external absolute time if the external absolute time is later than the vehicle absolute time, and not changing the vehicle absolute time to external absolute time if the external absolute time is earlier than the vehicle absolute time.

[0007] According to the present invention, time can be managed more accurately.

[0008] FIG. 1 is a block diagram of a time management system according to this embodiment. FIG. 2 is a flowchart showing an example of verification processing executed by the time management device according to this embodiment. FIG. 3 is an example of a sequence chart showing the flow of control executed by the time management device according to this embodiment. FIG. 4 is a diagram showing an example of an embodiment in which time management is performed by the time management device according to this embodiment. FIG. 5 is an example of a sequence chart showing the flow of control executed by the time management device according to this embodiment. FIG. 6 is a diagram showing an example of an embodiment in which time management is performed by the time management device according to this embodiment. FIG. 7 is an example of a sequence chart showing the flow of control executed by the time management device according to this embodiment. FIG. 8 is a diagram showing an example of an embodiment in which time management is performed by the time management device according to this embodiment. FIG. 9 is an example of a sequence chart showing the flow of control executed by the time management device according to this embodiment. FIG. 10 is a diagram showing an example of an embodiment in which time management is performed by the time management device according to this embodiment.

[0009] An embodiment of a time management device and a time management method according to the present invention will be described with reference to the accompanying drawings. FIG. 1 is a block diagram showing an example of the configuration of a time management system according to the present embodiment. The time management system 100 is a system that manages time in a network within a vehicle 1. The time management system 100 includes a time management device 2, a GNSS 3, and a diagnostic device 4. The time management device 2 is a device mounted on the vehicle 1 and includes a TCU (Telematics Control Unit) 10, a CGW (Central GateWay) 20, a DM (Domain Master) 30, and an ECU 40. The TCU 10, CGW 20, DM 30, and ECU 40 are connected to each other via an in-vehicle network such as a Controller Area Network (CAN) so as to be able to communicate with each other. The vehicle 1 is physically divided into multiple zones, and a DM 30 is located in each zone. Each DM 30 is connected to multiple ECUs corresponding to the zone in which it is located. The CGW 20 is connected to each of the plurality of DMs 30 and performs overall management of the ECUs 40 in each zone via the DMs 30 .

[0010] In this embodiment, the time management system 100 includes a network within the vehicle 1 and a network external to the vehicle 1. A firewall is established between the network within the vehicle 1 and the network external to the vehicle 1. Specifically, the TCU 10 is a unit outside the firewall and is an external unit connected to the network external to the vehicle 1. The CGW 20 has a firewall function. The CGW 20, the DM 30, and the ECU 40 are units inside the firewall and are internal units connected to the network within the vehicle 1. Note that in this embodiment, as long as these devices are units inside the firewall, the CGW 20 is not limited to having a firewall function; other ECUs may also have a firewall function. The time management system 100 manages the time used within the network within the vehicle 1. The time managed by the time management system 100 is used to verify the expiration date of an electronic certificate used for authentication. For example, an authentication key is required when a diagnostic tool for electronic vehicle inspection is connected to the ECU 40 of the vehicle 1. Verifying the validity of the electronic certificate is an example of a method for confirming that the authentication key is correct. In this embodiment, the managed time is used for authentication, but the present invention is not limited to this, and the time may be used for other purposes.

[0011] Conventionally, absolute time has been required to verify the expiration date of an electronic certificate. The absolute time is acquired by the TCU 10 from an external device outside the vehicle 1. Because a network outside the vehicle 1 connected to the external device is susceptible to external attacks, absolute time information acquired from the external device may be tampered with. Methods for strengthening security against such time tampering include, for example, introducing a real-time clock (RTC) or attaching an electronic signature. However, such methods have the problem of being expensive. Therefore, in this embodiment, the CGW 20 calculates vehicle absolute time by measuring the elapsed time from a reference absolute time, compares the calculated vehicle absolute time with external absolute time transmitted from outside the vehicle 1, and manages the time based on the comparison result.

[0012] In particular, if the external absolute time acquired from outside the vehicle 1 has been tampered with to a time earlier than the actual time, conventional techniques may erroneously determine that the expiration date of the electronic certificate is still valid even if the expiration date has already expired. This embodiment makes it possible to prevent the expiration date of the electronic certificate from being verified based on the external absolute time that may have been tampered with to a time earlier than the actual time.

[0013] The TCU 10 is a controller configured by a computer having a processor (hardware and software) and has a function of receiving external absolute time from outside the vehicle 1. Specifically, as shown in FIG. 1 , the TCU 10 includes, as a functional block, an external communication unit 11 that exchanges information via a network external to the vehicle 1. The external communication unit 11 acquires external absolute time at regular intervals. The external absolute time is absolute time transmitted from outside the vehicle 1 and is acquired, for example, by receiving satellite signals from multiple satellite communications in a Global Navigation Satellite System (GNSS) 3 and calculating the absolute time. The external absolute time is expressed in Universal Coordinated Time (UTC). The GNSS 3 may be, for example, GPS. The TCU 10 outputs the external absolute time to the CGW 20 at regular intervals (for example, every 3 seconds). In this embodiment, a controller including the external communication unit 11 is also referred to as an external communication controller. That is, although the TCU 10 is an example of an external communication controller, the external communication controller is not limited to the TCU 10 and may be any other controller as long as it has the external communication unit 11. For example, the external communication controller may be an IVI. In addition to the external communication function, the IVI has an information provision function that controls the HMI to provide information to the user. The IVI provides information about vehicle driving, such as map information and traffic information, and entertainment information, such as music and video, to the user via the HMI, such as an in-vehicle display.

[0014] The CGW 20 includes a computer having a processor (hardware and software). The computer includes a ROM storing programs, a CPU for executing the programs, etc. The CGW 20 comprehensively controls the ECU 40 that realizes each function of the vehicle 1.

[0015] The CGW 20 also manages the time used in the network within the vehicle 1. The time managed by the CGW 20 is the vehicle absolute time and the reference absolute time. The vehicle absolute time and the reference absolute time will be described later. The CGW 20 includes functional blocks: a vehicle absolute time management unit 21, a reference time management unit 22, and an authentication processing unit 23. In this embodiment, the functions of the CGW 20 are divided into three blocks, and the functions of each functional block are described. However, the functions of the CGW 20 may be divided into two or less, or four or more, functional blocks. The CGW 20 is an example of a "controller" as defined in the claims. The "controller" as defined in the claims is also referred to as a time management controller. The time management controller is not limited to the CGW 20, but may be any other controller as long as it realizes the functions of the vehicle absolute time management unit 21, the reference time management unit 22, and the authentication processing unit 23. The firewall function and the time management function described above do not necessarily have to be provided in the same ECU (CGW 20), but may be provided in separate ECUs.

[0016] The CGW 20 has a first memory 24 and a second memory 25. The first memory 24 is a volatile memory such as a RAM (Random Access Memory). The first memory 24 stores the reference absolute time and the elapsed time while power is supplied, i.e., while the CGW 20 is in a wake-up state. The reference absolute time and the elapsed time will be described later. The reference absolute time stored in the first memory 24 is updated periodically (e.g., every one second) based on the elapsed time acquired from the DM 30. The elapsed time stored in the first memory 24 is updated periodically (e.g., every one second) based on the elapsed time acquired from the DM 30. The second memory 25 is a non-volatile memory such as a flash memory. The second memory 25 stores the reference absolute time and the elapsed time. When the CGW 20 detects that it is going to enter a sleep state, the reference absolute time and the elapsed time stored in the first memory 24 are written to the second memory 25 before entering the sleep state. The second memory 25 holds the written reference absolute time and elapsed time until the CGW 20 transitions from the sleep state to the wake-up state. After the CGW 20 transitions to the wake-up state, the held reference absolute time and elapsed time are read from the second memory 25 and stored in the first memory 24.

[0017] The vehicle absolute time management unit 21 manages vehicle absolute time. Vehicle absolute time is the time referenced when various processes are performed within the internal network of the vehicle 1. For example, vehicle absolute time is referenced when verifying the expiration date of an electronic certificate. Vehicle absolute time is an estimate of the current time. The vehicle absolute time management unit 21 calculates vehicle absolute time by measuring the elapsed time based on the reference absolute time. The vehicle absolute time is counted up at regular intervals (for example, one second intervals) according to the elapsed time. Furthermore, vehicle absolute time may be calculated by measuring the elapsed time up to the time a reference request for vehicle absolute time is obtained each time a reference request for vehicle absolute time is obtained, such as when an authentication request is obtained or when a verification process is executed.

[0018] When the CGW 20 transitions from a sleep state to a wake-up state, the vehicle absolute time management unit 21 receives the reference absolute time after transition to the wake-up state from the reference time management unit 22 and starts counting up the vehicle absolute time by measuring the elapsed time based on the received reference absolute time. Here, the processing when the CGW 20 transitions from a sleep state to a wake-up state will be described. First, when the CGW 20 transitions from a sleep state to a wake-up state, the vehicle absolute time management unit 21 executes initialization processing to initialize the vehicle absolute time. In the initialization processing, the vehicle absolute time is set to a predetermined initial time. The predetermined initial time is, for example, January 1, 1970, 00:00:00. After the initialization processing, the vehicle absolute time management unit 21 receives the reference absolute time from the reference time management unit 22 and sets the vehicle absolute time to the reference absolute time. In other words, the vehicle absolute time management unit 21 synchronizes the vehicle absolute time with the reference absolute time. The vehicle absolute time management unit 21 starts counting up from the set vehicle absolute time (reference absolute time). Then, the vehicle absolute time management unit 21 continuously counts up the vehicle absolute time while the CGW 20 is in the wake-up state.

[0019] Furthermore, in this embodiment, when a predetermined condition is satisfied, a vehicle absolute time synchronization process is executed. The predetermined condition is, for example, when the verification process determines that the external absolute time is later than the vehicle absolute time at the time the external absolute time was acquired. In this case, the vehicle absolute time management unit 21 synchronizes the vehicle absolute time with the external absolute time. The predetermined condition is also when server absolute time is acquired from the diagnostic device 4. In this case, the vehicle absolute time management unit 21 synchronizes the vehicle absolute time with the server absolute time. When the vehicle absolute time is synchronized with the external absolute time or the server absolute time, the vehicle absolute time management unit 21 resumes counting up the vehicle absolute time by measuring the elapsed time from the vehicle absolute time after synchronization. Server absolute time will be described later.

[0020] Here, a specific method of the verification process will be described. In the verification process, the vehicle absolute time management unit 21 verifies the external absolute time based on the vehicle absolute time. The verification process is executed at regular intervals (for example, every minute). The external absolute time is acquired via the TCU 10 at regular intervals (for example, every three seconds). In the verification process, the vehicle absolute time management unit 21 verifies whether the acquired external absolute time is later than the vehicle absolute time at the time the external absolute time was acquired, and updates the vehicle absolute time according to the verification result. For example, if the external absolute time is later than the vehicle absolute time at the time the external absolute time was acquired, the vehicle absolute time management unit 21 updates the vehicle absolute time to the external absolute time. In other words, the vehicle absolute time management unit 21 synchronizes the vehicle absolute time with the external absolute time. Furthermore, if the external absolute time is earlier than the vehicle absolute time at the time the external absolute time was acquired, the vehicle absolute time management unit 21 maintains the vehicle absolute time without updating it to the external absolute time. That is, the vehicle absolute time management unit 21 ends the verification process without updating the vehicle absolute time to the external absolute time.

[0021] As described above, in this embodiment, if there is a possibility that the external absolute time acquired from an external source has been tampered with to a time later than the actual time, the vehicle absolute time is not updated to the external absolute time. This prevents the expiration date of an electronic certificate from being verified based on the external absolute time that may have been updated to a time later than the actual time. Furthermore, if the external absolute time is a time that is earlier than the vehicle absolute time at the time the external absolute time was acquired, the vehicle absolute time management unit 21 may record a security log indicating that the external absolute time may have been tampered with to a time later than the actual time. Note that, in this embodiment, the external absolute time is determined to be later than the vehicle absolute time at the time the external absolute time was acquired. However, this is not limiting, and it may also be determined whether the external absolute time is later than a predetermined time range based on the vehicle absolute time. The predetermined time range is, for example, a range that is set to a range of several minutes before and after the vehicle absolute time.

[0022] When the vehicle absolute time management unit 21 executes the verification process, it resumes counting up from the vehicle absolute time after the verification process. For example, if the vehicle absolute time is updated to external absolute time during the verification process, the vehicle absolute time management unit 21 resumes counting up the vehicle absolute time by measuring the elapsed time based on the updated vehicle absolute time (i.e., external absolute time). Furthermore, if the verification process ends while the vehicle absolute time is maintained without being updated to external absolute time, the vehicle absolute time management unit 21 resumes counting up the vehicle absolute time after the verification process.

[0023] Next, the synchronization process of the vehicle absolute time based on the server absolute time will be described. When the vehicle absolute time management unit 21 acquires the server absolute time from the diagnostic device 4, it updates the vehicle absolute time to the server absolute time. That is, the vehicle absolute time management unit 21 synchronizes the vehicle absolute time with the server absolute time. For example, when the diagnostic device 4 and the CGW 20 are connected, the vehicle absolute time management unit 21 acquires the server absolute time from the diagnostic device 4. In this embodiment, the diagnostic device 4 and the CGW 20 are connected, for example, during vehicle manufacture or when a part such as a battery is replaced.

[0024] The reference time management unit 22 manages the reference absolute time. The reference absolute time is stored in advance in the first memory 24 and is used to calculate the vehicle absolute time. The reference time management unit 22 acquires the elapsed time from the timekeeping start point from the DM 30 and updates the reference absolute time based on the acquired elapsed time. The timekeeping start point is, for example, the point at which the ignition is turned on for the first time during vehicle manufacture and the CGW 20 transitions to a wake-up state, or the point at which the CGW 20 transitions to a wake-up state after a battery replacement. The elapsed time acquired from the DM 30 is continuously measured even while the CGW 20 is in a sleep state. Therefore, the vehicle absolute time management unit 21 uses the reference absolute time, updated based on the elapsed time, to calculate the vehicle absolute time, thereby enabling more accurate management of the vehicle absolute time even when the CGW 20 transitions to a sleep state. Furthermore, the reference time management unit 22 manages the elapsed time acquired from the DM 30 along with the reference absolute time. Specifically, the reference absolute time and the elapsed time are stored in the first memory 24 and are updated by an update process at regular intervals (for example, every minute).

[0025] Here, a specific method of the update process will be described. In the update process, the reference time management unit 22 acquires from the DM 30 the elapsed time from the start of timekeeping to the time when the update process is executed. The reference time management unit 22 reads the elapsed time acquired in the previous update process from the first memory 24. The elapsed time acquired in the previous update process is the elapsed time from the start of timekeeping to the time when the previous update process was executed. The reference time management unit 22 calculates the time difference between the elapsed time acquired in the current update process and the elapsed time acquired in the previous update process. In other words, this time difference is the elapsed time from the time of the previous update process to the time of the current update process. The reference time management unit 22 reads the reference absolute time at the time of the previous update process from the first memory 24. The reference time management unit 22 updates the reference absolute time by adding the time difference to the reference absolute time at the time of the previous update process, and then ends the update process. The updated reference absolute time is stored in the first memory 24 as the reference absolute time at the time of the current update process. Furthermore, the elapsed time acquired in this update process is stored in the first memory 24. The reference absolute time and elapsed time stored in the first memory 24 in this update process will be used in the next update process. As described above, the reference time management unit 22 executes the update process at regular intervals while the CGW 20 is in the wake-up state.

[0026] Next, the processing when the CGW 20 transitions to a sleep state and when the CGW 20 transitions to a wake-up state will be described. When the reference time management unit 22 detects that the CGW 20 is transitioning to a sleep state, it executes a write processing before the CGW 20 transitions to the sleep state. In the write processing, the reference time management unit 22 writes the reference absolute time stored in the first memory 24 to the second memory 25. At this time, the reference time management unit 22 may also write the elapsed time from the start of timekeeping to the time when the transition to the sleep state was detected (hereinafter also referred to as the first elapsed time) together with the reference absolute time to the second memory 25. When the CGW 20 transitions from the sleep state to the wake-up state after entering the sleep state, the reference time management unit 22 executes a read processing. In the read processing, the reference time management unit 22 reads the reference absolute time from the second memory 25 and stores it in the first memory 24. At this time, the reference time management unit 22 may also read the first elapsed time from the second memory 25 together with the reference absolute time.

[0027] After reading the reference absolute time and the first elapsed time, the reference time management unit 22 acquires from the DM 30 the elapsed time from the start of timekeeping to the time when the CGW 20 transitions to a wake-up state (hereinafter also referred to as the second elapsed time). The reference time management unit 22 calculates the time difference between the acquired second elapsed time and the read first elapsed time. The time difference is the time obtained by subtracting the first elapsed time from the second elapsed time. The reference time management unit 22 updates the reference absolute time by adding the calculated time difference to the read reference absolute time. The reference time management unit 22 stores the updated reference absolute time and second elapsed time in the first memory 24 and transmits the updated reference absolute time to the vehicle absolute time management unit 21. The vehicle absolute time management unit 21 starts counting up the vehicle absolute time by measuring the elapsed time based on the transmitted updated reference absolute time. As described above, even when CGW 20 has transitioned to a sleep state and the absolute times managed by CGW 20 are not updated, the reference time management unit 22 can update the reference absolute time based on the elapsed time managed by DM 30 after transitioning to a wake-up state.

[0028] Furthermore, in this embodiment, when a predetermined condition is satisfied, synchronization processing of the reference absolute time is executed. The predetermined condition is, for example, acquisition of vehicle absolute time from the vehicle absolute time management unit 21. When the vehicle absolute time is updated to external absolute time, the reference time management unit 22 acquires the updated vehicle absolute time (i.e., the external absolute time) from the vehicle absolute time management unit 21 and synchronizes the reference absolute time with the updated vehicle absolute time. The synchronized reference absolute time is stored in the first memory 24. At this time, the reference time management unit 22 acquires from the DM 30 the elapsed time from the start of timekeeping to the time when synchronization processing is executed, and stores the acquired elapsed time together with the synchronized reference absolute time in the first memory 24. In this case, in the next update processing, the reference time management unit 22 reads the reference absolute time and elapsed time after synchronization processing and executes the update processing.

[0029] Furthermore, the predetermined condition is, for example, acquisition of server absolute time from the vehicle absolute time management unit 21. When the reference time management unit 22 acquires the server absolute time from the vehicle absolute time management unit 21, it synchronizes the reference absolute time with the server absolute time. At this time, the reference time management unit 22 acquires from the DM 30 the elapsed time from the start of timekeeping to the time when synchronization processing is performed, and stores the acquired elapsed time together with the reference absolute time after synchronization in the first memory 24. In this case, in the next update processing, the reference time management unit 22 reads the reference absolute time and elapsed time after synchronization processing and performs the update processing.

[0030] The authentication processing unit 23 performs authentication processing for the diagnostic tool connected to the vehicle 1, and if authentication is successful, grants the diagnostic tool access authority to the vehicle 1. When an authentication request is received, the authentication processing unit 23 verifies whether the electronic certificate used for authentication has expired based on the vehicle absolute time at the time of authentication. This prohibits the diagnostic tool from accessing the vehicle 1 based on an expired certificate. In this embodiment, when a diagnostic tool is connected to the vehicle 1, an authentication request is sent to the CGW 20.

[0031] In this embodiment, the vehicle absolute time is calculated at a fixed cycle, so that the vehicle absolute time is continuously counted up. However, this is not limited to this, and the vehicle absolute time may be calculated each time an authentication request is obtained based on the elapsed time from the reference absolute time to the time when the authentication request is obtained.

[0032] The DM 30 is a controller including a computer having a processor (hardware and software) and relays communication between the CGW 20 and the ECU 40. In this embodiment, the vehicle 1 includes multiple DMs 30. Each DM is connected to multiple ECUs. In this embodiment, the DM 30 includes, as a functional block, a timer unit 31 that measures the elapsed time from a time measurement start point to the present time. The time measurement start point is the point at which the timer unit 31 starts measuring the elapsed time. For example, the time measurement start point is the point at which the ignition of the vehicle 1 is first turned on and the DM 30 transitions to a wake-up state, or the point at which the DM 30 transitions to a wake-up state after a battery replacement. The DM 30 continuously measures the elapsed time from the point at which the DM 30 first transitions to a wake-up state after the manufacture of the vehicle 1. When the battery is replaced, the DM 30 executes an initialization process to initialize the elapsed time, and after the initialization, resumes measuring the elapsed time. In the initialization process, the elapsed time is reset to zero. The elapsed time is measured in minutes. The measured elapsed time is output to the CGW 20 at regular intervals (for example, every 1 second).

[0033] The DM 30 is a controller different from the CGW 20, and remains awake even while the CGW 20 transitions to a sleep state, continuing to measure elapsed time. In this embodiment, the DM 30 manages the elapsed time from the manufacture of the vehicle 1 equipped with the time management device 2 to the present time. The management of this elapsed time is a conventional function, and by using this elapsed time to update the reference absolute time, more accurate time management can be performed at low cost. A controller equipped with the timing unit 31 is also referred to as a timing controller. The DM 30 is an example of a timing controller, but the timing controller is not limited to the DM 30 and may be any other controller equipped with the timing unit 31.

[0034] The diagnostic device 4 is a device that starts a diagnostic tool and connects to the CGW 20. The diagnostic device 4 executes security access to the CGW 20. If the access authority is authenticated in the security access, the diagnostic device 4 transmits server absolute time to the CGW 20. The server absolute time is absolute time acquired from a server that distributes absolute time. The server in question is, for example, an NTP (Network Time Protocol) server.

[0035] Next, an example of the procedure for the verification process executed by the time management device according to this embodiment will be described using Figure 2. Figure 2 is a flowchart showing an example of the verification process executed by the time management device according to this embodiment. In this embodiment, the CGW 20 repeatedly calculates the vehicle absolute time based on elapsed time and acquires the external absolute time transmitted from the TCU 10, and executes the verification process at regular intervals. Note that, as shown in Figure 2, the verification process may omit the determination process in step S22 and instead maintain the vehicle absolute time if it is determined in step S21 that the external absolute time is not later than the vehicle absolute time.

[0036] In step S21, the CGW 20 determines whether the external absolute time is later than the vehicle absolute time at the time the external absolute time was acquired. If it is determined that the external absolute time is later than the vehicle absolute time at the time the external absolute time was acquired, the CGW 20 proceeds to step S26. In step S26, the CGW 20 updates the vehicle absolute time to the external absolute time. That is, the vehicle absolute time is synchronized with the external absolute time. If it is determined that the external absolute time is not later than the vehicle absolute time at the time the external absolute time was acquired, the CGW 20 proceeds to step S22. In step S22, the CGW 20 determines whether the external absolute time is the same as the vehicle absolute time at the time the external absolute time was acquired. If it is determined that the external absolute time is the same as the vehicle absolute time at the time the external absolute time was acquired, the CGW 20 proceeds to step S25.

[0037] In step S25, the CGW 20 maintains the vehicle absolute time without updating it to the external absolute time. If it is determined that the external absolute time is not the same as the vehicle absolute time at the time the external absolute time was acquired, the CGW 20 proceeds to step S23. In step S23, the CGW 20 maintains the vehicle absolute time without updating it to the external absolute time. In step S24, the CGW 20 records a security log indicating that the external absolute time may have been tampered with to a time earlier than the actual time. Note that although the external absolute time may be tampered with to a time later than the actual time, when the external absolute time is used to verify the expiration date of an electronic certificate, there is a low possibility that an expired certificate will be erroneously determined to be valid. Therefore, in this embodiment, even if there is a possibility that the external absolute time has been tampered with to a time later than the actual time, the vehicle absolute time is synchronized with the external absolute time, and if there is a possibility that the external absolute time has been tampered with to a time earlier than the actual time, synchronization of the vehicle absolute time with the external absolute time is prohibited.

[0038] Here, we will explain the time management control process executed by the time management device 2. Figure 3 is an example of a sequence chart showing the control flow executed by the time management device according to this embodiment. Steps S101 to S109 show a series of control flows in which verification processing is executed. Steps S110 to S117 show a series of control flows in which reference absolute time update processing and synchronization processing are executed. Steps S118 to S127 show a series of control flows in which synchronization processing based on server absolute time is executed.

[0039] In step S101, the vehicle absolute time management unit 21 calculates the vehicle absolute time. In this embodiment, the vehicle absolute time management unit 21 calculates the vehicle absolute time by measuring the elapsed time from the reference absolute time at regular intervals. In step S102, the TCU 10 acquires the external absolute time. In this embodiment, the TCU 10 acquires the external absolute time transmitted from the GNSS 3 at regular intervals. In step S103, the TCU 10 transmits the external absolute time to the CGW 20. In step S104, the vehicle absolute time management unit 21 receives the external absolute time from the TCU 10. In this embodiment, under normal circumstances, the calculation of the vehicle absolute time, the acquisition of the external absolute time, and the transmission and reception of the external absolute time are each repeatedly executed.

[0040] The vehicle absolute time management unit 21 executes the verification process at regular intervals. The period for executing the verification process in the vehicle absolute time management unit 21 is longer than the period for receiving external absolute time. For example, external absolute time is received every three seconds, and the verification process is executed every one minute. In the example of FIG. 3 , the verification process includes steps S105 to S108. In step S105, the vehicle absolute time management unit 21 determines whether the external absolute time is later than the vehicle absolute time at the time the external absolute time was received. If it is determined that the external absolute time is not later than the vehicle absolute time at the time the external absolute time was received, the vehicle absolute time management unit 21 proceeds to step S106. In step S106, the vehicle absolute time management unit 21 maintains the vehicle absolute time as is without updating it to external absolute time. If external absolute time is not received or if the received external absolute time information is corrupted, the vehicle absolute time management unit 21 may maintain the vehicle absolute time without updating it.

[0041] If it is determined that the external absolute time is later than the vehicle absolute time at the time the external absolute time was received, the vehicle absolute time management unit 21 proceeds to step S107. In step S107, the vehicle absolute time management unit 21 updates the vehicle absolute time to the external absolute time. The vehicle absolute time is synchronized with the external absolute time. In step S108, the vehicle absolute time management unit 21 transmits the vehicle absolute time to the reference time management unit 22. In step S109, the vehicle absolute time management unit 21 calculates the vehicle absolute time. That is, after the verification process, the vehicle absolute time management unit 21 resumes calculating (counting up) the vehicle absolute time based on the results of the verification process. In this embodiment, the vehicle absolute time management unit 21 continuously counts up the vehicle absolute time, receives external absolute time, and performs verification process. As will be described later, when the vehicle absolute time management unit 21 receives server absolute time from the diagnostic device 4, it performs synchronization process of synchronizing the vehicle absolute time with the server absolute time and transmitting the server absolute time to the reference time management unit 22.

[0042] Next, the reference absolute time update process in the reference time management unit 22 will be described. The update process is performed at regular intervals, each time the elapsed time is obtained from the DM 30. In step S110, the DM 30 measures the elapsed time. The elapsed time is the time elapsed since the start of measurement. For example, the start of measurement is the time when the ignition is first turned on. The measurement of the elapsed time is performed at regular intervals (for example, one-minute intervals). In step S111, the DM 30 transmits the elapsed time to the CGW 20. The time interval at which the elapsed time is transmitted is shorter than the time interval at which the elapsed time is measured (for example, one-minute intervals), and is, for example, one second. In step S112, the reference time management unit 22 receives the elapsed time from the DM 30. In step S113, the reference time management unit 22 updates the reference absolute time and the elapsed time. The updated reference absolute time and the elapsed time are stored in the first memory 24. For example, the reference time management unit 22 calculates the time difference between the elapsed time received from the DM 30 and the elapsed time at the time of the previous update process, and adds the calculated time difference to the reference absolute time at the time of the previous update process to update the reference absolute time. The reference time management unit 22 updates the elapsed time acquired at the time of the previous update process to the elapsed time acquired at the time of the current update process. As described above, the reference time management unit 22 continuously performs the process of updating the reference absolute time based on the elapsed time acquired from the DM 30. As will be described later, when the reference time management unit 22 receives vehicle absolute time or server absolute time from the vehicle absolute time management unit 21, it synchronizes the reference absolute time with the vehicle absolute time or server absolute time.

[0043] Furthermore, when the reference time management unit 22 receives the vehicle absolute time, it executes synchronization processing to synchronize the reference absolute time with the vehicle absolute time. In step S114, the reference time management unit 22 receives the vehicle absolute time from the vehicle absolute time management unit 21. In step S115, the DM 30 transmits the elapsed time to the CGW 20. In step S116, the reference time management unit 22 receives the elapsed time from the DM 30. In step S117, the reference time management unit 22 updates the reference absolute time and the elapsed time. The reference absolute time is synchronized with the vehicle absolute time. The elapsed time is updated to the elapsed time received in step S116.

[0044] Next, synchronization processing based on the server absolute time acquired from the diagnostic device 4 will be described. In step S118, the diagnostic device 4 starts a diagnostic tool. In step S119, the diagnostic device 4 executes security access. During security access, the diagnostic device 4 is authenticated. In step S120, the diagnostic device 4 transmits the server absolute time to the CGW 20. In step S121, the vehicle absolute time management unit 21 receives the server absolute time. In step S122, the vehicle absolute time management unit 21 updates the vehicle absolute time to the server absolute time. That is, the vehicle absolute time is synchronized with the server absolute time. In step S123, the vehicle absolute time management unit 21 transmits the vehicle absolute time to the reference time management unit 22. In step S124, the reference time management unit 22 receives the vehicle absolute time from the vehicle absolute time management unit 21. In step S125, the DM 30 transmits the elapsed time to the CGW 20. In step S126, the reference time management unit 22 receives the elapsed time from the DM 30. In step S127, the reference time management unit 22 updates the reference absolute time and the elapsed time. The reference absolute time is synchronized with the server absolute time. The elapsed time is updated to the elapsed time received in step S126. The updated reference absolute time and elapsed time are stored in the first memory 24.

[0045] Next, a specific example of the verification process and update process executed by the time management device according to this embodiment will be described with reference to FIG. 4 . FIG. 4 is a diagram showing an example of time management performed by the time management device according to this embodiment. First, the verification process will be described. The TCU 10 acquires external absolute time from the GNSS 3 at regular intervals. In FIG. 4 , the external absolute time managed by the TCU 10 is updated every second since 14:01:09 on August 9, 2022. The TCU 10 then transmits the acquired external absolute time to the CGW 20 at regular intervals (e.g., every 3 seconds). In FIG. 4 , the external absolute time (14:01:10 on August 9, 2022) is transmitted to the CGW 20. In the CGW 20, the vehicle absolute time management unit 21 calculates the vehicle absolute time by measuring the elapsed time from the reference absolute time. In FIG. 4 , the vehicle absolute time is counted up every second since 14:01:02 on August 9, 2022.

[0046] Furthermore, the vehicle absolute time management unit 21 performs a verification process at regular intervals (e.g., every minute) to verify the acquired external absolute time using the vehicle absolute time. In the verification process, the vehicle absolute time management unit 21 compares the calculated vehicle absolute time with the acquired external absolute time. In FIG. 4 , the vehicle absolute time management unit 21 performs verification process VP1, and then performs verification process VP2 after a predetermined time interval (e.g., one minute). In verification process VP1, the external absolute time acquired from the TCU 10 (August 9, 2022, 14:01:10) is later than the vehicle absolute time at the time the external absolute time was acquired (August 9, 2022, 14:01:03). Therefore, the vehicle absolute time is updated to the external absolute time (August 9, 2022, 14:01:10). After the verification process, the vehicle absolute time management unit 21 resumes counting up the vehicle absolute time by measuring the elapsed time from the vehicle absolute time after the verification process (August 9, 2022, 14:01:10).

[0047] Furthermore, if the vehicle absolute time is synchronized with the external absolute time in the verification process, the reference time management unit 22 executes synchronization processing to synchronize the reference absolute time with the vehicle absolute time. In FIG. 4 , in update processing UP1 before synchronization processing SP, the reference absolute time is stored in the first memory 24 as 14:01:02 on August 9, 2022, and the elapsed time is 1 minute. Then, in synchronization processing SP, the reference time management unit 22 acquires the updated vehicle absolute time (14:01:10 on August 9, 2022) from the vehicle absolute time management unit 21 and synchronizes the reference absolute time with the acquired vehicle absolute time (14:01:10 on August 9, 2022). That is, the reference absolute time is rewritten from 14:01:02 on August 9, 2022 to 14:01:10 on August 9, 2022. At this time, the reference time management unit 22 acquires the elapsed time up to the time of synchronization processing from the DM 30. 4, the elapsed time is 1 minute. The reference absolute time after synchronization (August 9, 2022, 14:01:10) and the acquired elapsed time (1 minute) are stored in the first memory 24.

[0048] Next, an example of verification processing when the external absolute time acquired by the TCU 10 is tampered with will be described. As shown in Figure 4, assume that before verification processing VP2 is executed, the external absolute time is tampered with by tampering processing FD to a time earlier than the actual time (August 9, 1999, 14:02:09). In this case, the TCU 10 transmits the tampered external absolute time (August 9, 1999, 14:02:10) to the CGW 20. In verification processing VP2, the vehicle absolute time management unit 21 compares the external absolute time with the vehicle absolute time. Because the external absolute time (14:02:10, Aug. 9, 1999) is not later than the vehicle absolute time at the time the external absolute time was acquired (14:02:10, Aug. 9, 2022), the vehicle absolute time is not updated to the external absolute time, and remains at 14:02:10, Aug. 9, 2022. The vehicle absolute time management unit 21 records a security log indicating that the external absolute time has been tampered with. Furthermore, in this embodiment, even if the external absolute time and vehicle absolute time are the same, the vehicle absolute time management unit 21 does not update the vehicle absolute time.

[0049] Next, the update process of the reference time management unit 22 will be described. In the update process, the reference time management unit 22 acquires the elapsed time from the DM 30, updates the reference absolute time based on the elapsed time, and updates the elapsed time to the acquired elapsed time. The update process is executed at regular intervals (for example, every second). In the example of FIG. 4, update processes UP1, UP2, and UP3 are executed at regular intervals. In update process UP2, the reference time management unit 22 acquires the elapsed time (1 minute) from the DM 30. In update process UP2, the reference absolute time is stored in the first memory 24 as 14:01:10 on August 9, 2022, and the elapsed time remains at 1 minute. Next, in update process UP3, when the reference time management unit 22 acquires the elapsed time (2 minutes) from the DM 30, the elapsed time (2 minutes) acquired in update process UP3 is one minute different from the elapsed time (1 minute) of the previous update process (update process UP2). Therefore, the reference time management unit 22 adds the one minute difference to the reference absolute time of the previous update process (update process UP2) (August 9, 2022, 14:01:10) and updates the reference absolute time to August 9, 2022, 14:02:10. Note that a predetermined maximum value is set for the elapsed time. When the elapsed time reaches the predetermined maximum value, the elapsed time is reset to 0. In this case, the time difference between the elapsed time at the time of this update process and the elapsed time at the time of the previous update process may be a negative value. In that case, the reference absolute time is not updated in the update process.

[0050] Next, the control processing of time management executed by the time management device 2 will be described. FIG. 5 is an example of a sequence chart showing the flow of control executed by the time management device according to this embodiment. The processing (verification processing) from step S144 to step S149 in FIG. 5 is the same as the processing (verification processing) from step S102 to step S107 in FIG. 3, so a description thereof will be omitted and the description of FIG. 3 will be used as appropriate. FIG. 5 shows the control processing when the CGW 20 transitions to a sleep state and the control processing when the CGW 20 transitions to a wake-up state. In FIG. 5, when it is detected that the CGW 20 is transitioning to a sleep state, the CGW 20 starts the flow from step S131.

[0051] In step S131, the reference time management unit 22 writes the reference absolute time and the elapsed time to the second memory 25. The written reference absolute time and the elapsed time are the reference absolute time and the elapsed time stored in the first memory 24 at the time when it is detected that the CGW 20 is transitioning to the sleep state. In step S132, the CGW 20 transitions to the sleep state. In step S133, the CGW 20 transitions to the wake-up state. In step S134, the vehicle absolute time management unit 21 initializes the vehicle absolute time. In the initialization, the vehicle absolute time is set to a predetermined initial time. The predetermined initial time is, for example, January 1, 1970, 00:00:00. In step S135, the reference time management unit 22 initializes the reference absolute time. In the initialization, the reference absolute time is set to a predetermined initial time. The predetermined initial time is, for example, January 1, 1970, 00:00:00. In step S136 , the reference time management unit 22 reads the reference absolute time and the elapsed time from the second memory 25 .

[0052] In this embodiment, the DM 30 continues to measure the elapsed time even while the CGW 20 is in the sleep state. After the CGW 20 transitions to the wakeup state, the DM 30 resumes transmitting the elapsed time to the CGW 20. In step S137, the DM 30 measures the elapsed time. That is, the elapsed time at this time is the time that has elapsed since the CGW 20 transitioned to the wakeup state. In step S138, the DM 30 transmits the elapsed time to the CGW 20. In step S139, the reference time management unit 22 receives the elapsed time from the DM 30. In step S140, the reference time management unit 22 updates the reference absolute time and the elapsed time. In the update processing of step S140, the reference time management unit 22 calculates the time difference between the elapsed time received in step S139 and the elapsed time read out in step S136, and updates the reference absolute time by adding the time difference to the reference absolute time read out in step S136. The reference time management unit 22 updates the elapsed time to the elapsed time received in step S139. As described above, when the CGW 20 transitions to the wake-up state, the reference time management unit 22 reads the reference absolute time and the elapsed time, acquires the elapsed time from the DM 30, and then resumes the process of updating the reference absolute time and the elapsed time, and after resuming, continuously executes the update process at a fixed cycle.

[0053] In step S141, the reference time management unit 22 transmits the reference absolute time to the vehicle absolute time management unit 21. In step S142, the vehicle absolute time management unit 21 receives the reference absolute time from the reference time management unit 22. In step S143, the vehicle absolute time management unit 21 calculates the vehicle absolute time. Specifically, the vehicle absolute time management unit 21 calculates the vehicle absolute time by measuring elapsed time based on the reference absolute time received in step S142. In other words, when the CGW 20 transitions to the wake-up state, the vehicle absolute time management unit 21 receives the reference absolute time from the reference time management unit 22 and resumes counting up the vehicle absolute time based on the received reference absolute time.

[0054] Next, a specific example of the processing executed by the time management device according to this embodiment when transitioning to a sleep state and a wake-up state will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of time management performed by the time management device according to this embodiment.

[0055] First, the processing when transitioning to the sleep state will be described. When it is detected that the CGW 20 is transitioning to the sleep state, the reference time management unit 22 executes a write process. In the write process, the reference time management unit 22 writes the reference absolute time and elapsed time at the time when it is detected that the CGW 20 is transitioning to the sleep state to the second memory 25. In Fig. 6, in the write process WP, the reference time management unit 22 writes the reference absolute time of Aug. 9, 2022, 14:00:03 and the elapsed time of 1 minute to the second memory 25.

[0056] Next, the process when transitioning to the wakeup state will be described. When the CGW 20 transitions from the sleep state to the wakeup state, the vehicle absolute time management unit 21 and the reference time management unit 22 initialize the vehicle absolute time and the reference absolute time, respectively. In FIG. 6 , in an initialization process IP, the vehicle absolute time and the reference absolute time are set to the initial time (January 1, 1970, 0:00:00). In addition, in the initialization process, the reference time management unit 22 sets the elapsed time to the initial elapsed time (0 minutes). After the initialization process, the reference time management unit 22 executes a read process. In the read process, the reference absolute time and elapsed time written to the second memory 25 before transitioning to the sleep state are read. In FIG. 6 , in a read process RP, the reference time management unit 22 reads the reference absolute time of August 9, 2022, 14:00:03 and the elapsed time of 1 minute from the second memory 25. After the read process, the reference time management unit 22 executes an update process. In Figure 6, in update process UP1, the reference time management unit 22 obtains the elapsed time (31 minutes) from DM30 and adds the time difference (30 minutes) from the read elapsed time (1 minute) to the read reference absolute time (August 9, 2022, 14:00:03), thereby updating the reference absolute time to August 9, 2022, 14:30:03.

[0057] The reference time management unit 22 stores the updated reference absolute time (August 9, 2022, 14:30:03) and the acquired elapsed time (31 minutes) in the first memory 24. After the CGW 20 transitions to the wake-up state, the reference time management unit 22 executes the first update process and then transmits the reference absolute time after the first update (August 9, 2022, 14:30:03) to the vehicle absolute time management unit 21. When the vehicle absolute time management unit 21 receives the reference absolute time, it updates the vehicle absolute time to the received reference absolute time (August 9, 2022, 14:30:03). As described above, when the CGW 20 transitions to the wake-up state, the vehicle absolute time management unit 21 resumes counting up the vehicle absolute time by measuring the elapsed time based on the reference absolute time after the first update process (August 9, 2022, 14:30:03). Furthermore, after counting up the vehicle absolute time resumes, verification processing is executed at regular intervals, similar to the verification processing described in Fig. 4. In Fig. 6, in verification processing VP1, the vehicle absolute time management unit 21 maintains the vehicle absolute time at 14:30:05 on August 9, 2022, without updating it, because the external absolute time (14:30:05 on August 9, 2022) is not later than the vehicle absolute time at the time the external absolute time was acquired (14:30:05 on August 9, 2022).

[0058] Next, the control processing of time management executed by the time management device 2 will be described. FIG. 7 is an example of a sequence chart showing the flow of control executed by the time management device according to this embodiment. The processing (verification processing) from step S164 to step S169 in FIG. 7 is the same as the processing (verification processing) from step S102 to step S107 in FIG. 3, so a description thereof will be omitted and the description of FIG. 3 will be used as appropriate. FIG. 7 shows the control processing when the CGW 20 transitions to a sleep state and the battery is removed, and the control processing when the battery is attached and the CGW 20 transitions to a wake-up state. In FIG. 7, when it is detected that the CGW 20 is transitioning to a sleep state, the CGW 20 starts the flow from step S151.

[0059] In step S151, the reference time management unit 22 writes the reference absolute time and the elapsed time to the second memory 25. In step S152, the CGW 20 transitions to a sleep state and a battery detached state. In step S153, the CGW 20 has a battery attached and transitions to a wake-up state. In step S154, the vehicle absolute time management unit 21 initializes the vehicle absolute time. In step S155, the reference time management unit 22 initializes the reference absolute time and the elapsed time. In step S156, the DM 30 initializes the elapsed time. In step S157, the reference time management unit 22 reads the reference absolute time and the elapsed time from the second memory 25. In step S158, the DM 30 transmits the elapsed time to the CGW 20. The elapsed time transmitted at this time is the time elapsed since the initialization in step S156. In step S159, the reference time management unit 22 receives the elapsed time from the DM 30.

[0060] In step S160, the reference time management unit 22 updates the reference absolute time and the elapsed time. In step S161, the reference time management unit 22 transmits the reference absolute time to the vehicle absolute time management unit 21. In step S162, the vehicle absolute time management unit 21 receives the reference absolute time from the reference time management unit 22. In step S163, the vehicle absolute time management unit 21 calculates the vehicle absolute time. Specifically, the vehicle absolute time management unit 21 calculates the vehicle absolute time by measuring the elapsed time based on the reference absolute time received in step S162. In other words, when the CGW 20 transitions to the wake-up state, the vehicle absolute time management unit 21 receives the reference absolute time from the reference time management unit 22 and resumes counting up the vehicle absolute time based on the received reference absolute time. In the example of FIG. 7 , the DM 30 initializes the elapsed time after the battery is replaced, and therefore the elapsed time transmitted to the reference time management unit 22 does not include the time elapsed from the sleep state to the wake-up state. Therefore, since the elapsed time from the sleep state to the wake-up state is not added, the vehicle absolute time and the reference absolute time may be earlier than the actual time. When the battery is replaced, the vehicle absolute time and the reference absolute time may be synchronized with more accurate absolute times by obtaining the server absolute time from the diagnostic device 4 after the battery replacement.

[0061] Next, a specific example of the processing executed by the time management device according to this embodiment when the battery is removed and when the battery is attached will be described with reference to Fig. 8. Fig. 8 is a diagram showing an example of time management performed by the time management device according to this embodiment.

[0062] First, the processing when the CGW 20 transitions to a sleep state and the battery is removed will be described. When it is detected that the CGW 20 is transitioning to a sleep state, the reference time management unit 22 executes a write processing. In the write processing, the reference time management unit 22 writes the reference absolute time and elapsed time at the time when it is detected that the CGW 20 is transitioning to a sleep state to the second memory 25. In Fig. 8, in the write processing WP, the reference time management unit 22 writes the reference absolute time of Aug. 9, 2022, 14:00:03 and the elapsed time of 100 minutes to the second memory 25.

[0063] Next, the process when a battery is attached and the CGW 20 transitions to the wake-up state will be described. When the CGW 20 transitions to the wake-up state, the vehicle absolute time management unit 21, the reference time management unit 22, and the DM 30 initialize the vehicle absolute time, the reference absolute time, and the elapsed time, respectively. In FIG. 8 , in an initialization process IP, the vehicle absolute time and the reference absolute time are set to the initial time (0:00:00, January 1, 1970). Also in the initialization process, the reference time management unit 22 sets the elapsed time to the initial elapsed time (0 minutes). Also in the initialization process, the DM 30 sets the elapsed time to the initial elapsed time (0 minutes). After the initialization process, the reference time management unit 22 executes a read process. In the read process, the reference absolute time and the elapsed time written to the second memory 25 before transitioning to the sleep state are read. In FIG. 8, in the read process RP, the reference time management unit 22 reads the reference absolute time of Aug. 9, 2022, 14:00:03 and the elapsed time of 100 minutes from the second memory 25.

[0064] After the read process, the reference time management unit 22 executes an update process. In FIG. 8 , in update process UP1, the reference time management unit 22 acquires the elapsed time (0 minutes) from the DM 30. If the time difference obtained by subtracting the read elapsed time (100 minutes) from the acquired elapsed time (0 minutes) is a negative value, the reference time management unit 22 does not execute the process of adding the elapsed time to the reference absolute time, and maintains the reference absolute time as 14:00:03, Aug. 9, 2022. After update process UP1, the reference time management unit 22 transmits the reference absolute time to the vehicle absolute time management unit 21. The vehicle absolute time management unit 21 synchronizes the vehicle absolute time with the received reference absolute time (14:00:03, Aug. 9, 2022) and resumes counting up the vehicle absolute time by measuring the elapsed time from the synchronized vehicle absolute time.

[0065] Furthermore, after the count-up of the vehicle absolute time is resumed, verification processing is executed at regular intervals, similar to the verification processing described in Fig. 4. In Fig. 8, in verification processing VP1, the vehicle absolute time management unit 21 updates the vehicle absolute time to the external absolute time (August 9, 2022, 14:30:05) because the external absolute time (August 9, 2022, 14:00:05) is later than the vehicle absolute time at the time the external absolute time was acquired. Furthermore, the vehicle absolute time management unit 21 transmits the updated vehicle absolute time to the reference time management unit 22. The reference time management unit 22 synchronizes the reference absolute time with the received vehicle absolute time (14:30:05, August 9, 2022), obtains the elapsed time (0 minutes) from the DM30, and stores the synchronized reference absolute time (14:30:05, August 9, 2022) and elapsed time (0 minutes) in the first memory 24.

[0066] Next, the control processing of time management executed by the time management device 2 will be described. FIG. 9 is an example of a sequence chart showing the flow of control executed by the time management device 2 according to this embodiment. The processing (verification processing) from steps S190 to S195 in FIG. 9 is similar to the processing (verification processing) from steps S102 to S107 in FIG. 3, and therefore a description thereof will be omitted. Furthermore, the processing from steps S196 to S199 in FIG. 9 is similar to the processing from steps S110 to S113 in FIG. 3, and therefore a description thereof will be omitted, and the description of FIG. 3 will be used as appropriate. FIG. 9 shows the control processing when the CGW 20 transitions to a wake-up state during vehicle manufacture. In FIG. 9, when the vehicle 1 is started, the CGW 20 and DM 30 start the flow from step S171.

[0067] In step S171, the CGW 20 and the DM 30 transition to a wake-up state. In step S172, the vehicle absolute time management unit 21 initializes the vehicle absolute time. In the initialization, the vehicle absolute time is set to a predetermined initial time. The predetermined initial time is, for example, January 1, 1970, 00:00:00. In step S173, the reference time management unit 22 initializes the reference absolute time. In the initialization, the reference absolute time is set to a predetermined initial time. The predetermined initial time is, for example, January 1, 1970, 00:00:00. In step S174, the DM 30 initializes the elapsed time. In the initialization, the elapsed time is set to 0 (minutes). In step S175, the reference time management unit 22 transmits the reference absolute time to the vehicle absolute time management unit 21. In step S176, the vehicle absolute time management unit 21 receives the reference absolute time from the reference time management unit 22. In step S177, the vehicle absolute time management unit 21 updates the vehicle absolute time. Specifically, the vehicle absolute time management unit 21 synchronizes the vehicle absolute time with the reference absolute time received in step S176.

[0068] Next, the synchronization process based on the server absolute time acquired from the diagnostic device 4 will be described. In step S178, the diagnostic device 4 starts a diagnostic tool. In step S179, the diagnostic device 4 executes security access. In the security access, authentication of the diagnostic device 4 is performed. In step S180, the diagnostic device 4 transmits the server absolute time to the CGW 20. In step S181, the vehicle absolute time management unit 21 receives the server absolute time. In step S182, the vehicle absolute time management unit 21 updates the vehicle absolute time to the server absolute time. That is, the vehicle absolute time is synchronized with the server absolute time. The vehicle absolute time is synchronized with the server absolute time received in step S181. In step S183, the vehicle absolute time management unit 21 transmits the vehicle absolute time to the reference time management unit 22.

[0069] In step S184, the reference time management unit 22 receives the vehicle absolute time from the vehicle absolute time management unit 21. In step S185, the DM 30 transmits the elapsed time to the CGW 20. In step S186, the reference time management unit 22 receives the elapsed time from the DM 30. In step S187, the reference time management unit 22 updates the reference absolute time and the elapsed time. The reference absolute time is synchronized with the server absolute time received in step S184. The elapsed time is updated to the elapsed time received in step S186. In step S188, the vehicle 1 equipped with the time management device 2 is shipped from the factory. In step S189, the vehicle absolute time management unit 21 calculates the vehicle absolute time. That is, the vehicle absolute time management unit 21 calculates the vehicle absolute time by measuring the elapsed time based on the vehicle absolute time synchronized with the server absolute time in step S182.

[0070] Next, a specific example of the manufacturing process executed by the time management device according to this embodiment will be described with reference to Fig. 10. Fig. 10 is a diagram showing an example of the time management performed by the time management device according to this embodiment. Note that Fig. 10 shows the time management performed during the manufacturing of the vehicle 1, but time management may also be performed during parts replacement, not just during the manufacturing of the vehicle 1.

[0071] This section describes the processing that is executed when a vehicle 1 equipped with a time management device 2 is manufactured at a factory and before the vehicle 1 is shipped from the factory. When the CGW 20 transitions to a wake-up state, the vehicle absolute time management unit 21, the reference time management unit 22, and the DM 30 initialize the vehicle absolute time, the reference absolute time, and the elapsed time, respectively. In FIG. 10 , in an initialization process IP, the vehicle absolute time and the reference absolute time are set to the initial time (January 1, 1970, 0:00:00). Also in the initialization process, the reference time management unit 22 sets the elapsed time to the initial elapsed time (0 minutes). Also in the initialization process, the DM 30 sets the elapsed time to the initial elapsed time (0 minutes). After the initialization process, the reference time management unit 22 transmits the reference absolute time (January 1, 1970, 0:00:00) to the vehicle absolute time management unit 21. The vehicle absolute time management unit 21 synchronizes the vehicle absolute time with the received reference absolute time and starts counting up the vehicle absolute time by measuring the elapsed time from the synchronized vehicle absolute time. After the initialization process, the DM 30 measures the elapsed time from the point of initialization. After the initialization process, the reference time management unit 22 executes an update process at regular intervals. In Figure 10, in the update process UP, the reference time management unit 22 does not update the reference absolute time, because the elapsed time acquired from the DM 30 is 0 minutes, which is no time difference from the elapsed time (0 minutes) at the time of the initialization process, and so maintains it as 0:00:00, January 1, 1970.

[0072] In this embodiment, a write process of the vehicle absolute time and the reference absolute time is performed before the vehicle 1 is shipped from the factory. In the write process, the vehicle absolute time and the reference absolute time are synchronized with the server absolute time. Specifically, after the time management device 2 transitions to a wake-up state, the CGW 20 is connected to the diagnostic device 4 before the vehicle 1 is shipped from the factory. The diagnostic device 4 acquires the absolute time transmitted from the server that distributes the absolute time as the server absolute time and transmits the server absolute time to the CGW 20. In FIG. 10 , the diagnostic device 4 acquires the server absolute time (August 29, 2022, 13:00:00, August 29, 2022, 13:00:01). When the diagnostic device 4 is connected to the CGW 20, the diagnostic device 4 transmits the server absolute time (August 29, 2022, 13:00:01) to the CGW 20. When the vehicle absolute time management unit 21 receives the server absolute time from the diagnostic device 4, it updates the vehicle absolute time to the server absolute time (August 29, 2022, 13:00:01 second) and transmits the server absolute time (August 29, 2022, 13:00:01 second) to the reference time management unit 22. When the reference time management unit 22 receives the server absolute time (August 29, 2022, 13:00:01 second) from the vehicle absolute time management unit 21, it executes synchronization processing. In FIG. 10 , in synchronization processing SP, the vehicle absolute time management unit 21 updates the reference absolute time to the server absolute time (August 29, 2022, 13:00:01 second) and acquires the elapsed time (0 minutes) from the DM 30. The reference absolute time (August 29, 2022, 13:00:01 second) and the elapsed time (0 minutes) are stored in the first memory 24. As described above, the vehicle absolute time and the reference absolute time are synchronized with the server absolute time before the vehicle 1 is shipped from the factory. Note that the server absolute time may be written not only before the vehicle 1 is shipped from the factory, but also before the vehicle 1 is sold by a sales company such as a dealer.

[0073] Furthermore, after synchronization with the server absolute time has been performed, verification processing is executed at regular intervals, similar to the verification processing described in Fig. 4. In Fig. 10, in verification processing VP1, the vehicle absolute time management unit 21 does not update the vehicle absolute time to the external absolute time, but maintains it as 14:00:03 on August 29, 2022, because the external absolute time (14:00:03 on August 29, 2022) is not later than the vehicle absolute time at the time the external absolute time was acquired (14:00:03 on August 29, 2022).

[0074] As described above, in the time management device and time management method according to this embodiment, the controller calculates vehicle absolute time by measuring elapsed time based on a reference absolute time that is pre-stored in the first memory, acquires external absolute time transmitted from outside the vehicle, and if the external absolute time is later than the vehicle absolute time at the time the external absolute time was acquired, updates the vehicle absolute time to the external absolute time, but if the external absolute time is earlier than the vehicle absolute time at the time the external absolute time was acquired, maintains the vehicle absolute time without updating it to the external absolute time. This enables more accurate time management.

[0075] Furthermore, in the time management device and time management method according to this embodiment, when an authentication request is received, the controller verifies whether the electronic certificate used for authentication has expired based on the vehicle absolute time at the time of authentication, thereby enabling accurate authentication based on the electronic certificate.

[0076] Furthermore, in the time management device and time management method according to this embodiment, when the controller detects that the controller is going to sleep, it writes the reference absolute time stored in the first memory to the second memory, which is a non-volatile memory, before the controller goes to sleep, and when the controller goes to wakeup after going to sleep, it reads the reference absolute time from the second memory. This makes it possible to calculate vehicle absolute time based on the reference absolute time after going to wakeup, even when the controller goes to sleep.

[0077] Furthermore, in the time management device and time management method according to this embodiment, when the controller detects that the controller is going to sleep, it writes a first elapsed time from the start of timing to the time when it detects that the controller is going to sleep, together with the reference absolute time, to the second memory before the controller goes to sleep; when the controller goes to wakeup, it reads the first elapsed time from the second memory together with the reference absolute time to obtain a second elapsed time from the start of timing to the time when the controller goes to wakeup, and updates the reference absolute time by adding the time difference between the first elapsed time and the second elapsed time to the read reference absolute time. This allows the reference absolute time to be updated more accurately after the controller goes to wakeup, even when the controller goes to sleep.

[0078] Furthermore, in the time management device and time management method according to this embodiment, when updating the vehicle absolute time to external absolute time, the controller updates the reference absolute time to the updated vehicle absolute time and stores the elapsed time from the start of timekeeping to the point at which the reference absolute time was updated together with the updated reference absolute time in the first memory. This allows the reference absolute time and elapsed time to be updated in accordance with the synchronization of the vehicle absolute time with the external absolute time.

[0079] It should be noted that the above-described embodiments have been described to facilitate understanding of the present invention, and are not intended to limit the present invention. Therefore, each element disclosed in the above-described embodiments is intended to include all design modifications and equivalents that fall within the technical scope of the present invention.

[0080] REFERENCE SIGNS LIST 100... Time management system 1... Vehicle 2... Time management device 10... TCU 20... CGW 21... Vehicle absolute time management unit 22... Reference time management unit 23... Authentication processing unit 24... First memory 25... Second memory 30... DM 40... ECU 3... GNSS 4... Diagnostic equipment

Claims

1. A time management device having a controller that performs time management on a network inside a vehicle, wherein the controller calculates vehicle absolute time by measuring elapsed time based on a reference absolute time that is pre-stored in a first memory, acquires external absolute time transmitted from outside the vehicle, updates the vehicle absolute time to the external absolute time if the external absolute time is later than the vehicle absolute time at the time the external absolute time is acquired, and maintains the vehicle absolute time without updating it to the external absolute time if the external absolute time is earlier than the vehicle absolute time at the time the external absolute time is acquired.

2. A time management device as described in claim 1, wherein, when an authentication request is received, the controller verifies whether or not the electronic certificate used for authentication has expired based on the vehicle absolute time at the time of authentication.

3. A time management device as claimed in claim 1 or 2, wherein when the controller detects that the controller is going to a sleep state, the controller writes the reference absolute time stored in the first memory to a second memory which is a non-volatile memory before the controller goes to the sleep state, and when the controller goes to a wake-up state after the controller goes to the sleep state, the controller reads the reference absolute time from the second memory.

4. A time management device as described in claim 3, wherein when the controller detects that the controller is transitioning to a sleep state, it writes a first elapsed time from the start of timing to the time when it is detected that the controller is transitioning to the sleep state, together with the reference absolute time, into the second memory before the controller transitions to the sleep state; when the controller transitions to a wake-up state, it reads out the first elapsed time from the start of timing to the time when the controller transitions to the wake-up state from the second memory together with the reference absolute time, and obtains a second elapsed time from the start of timing to the time when the controller transitions to the wake-up state; and updates the reference absolute time by adding the time difference between the first elapsed time and the second elapsed time to the read reference absolute time.

5. A time management device as described in claim 1 or 2, wherein when the controller updates the vehicle absolute time to the external absolute time, it updates the reference absolute time to the updated vehicle absolute time, and stores in the first memory the elapsed time from the start of timekeeping to the point at which the reference absolute time is updated together with the updated reference absolute time.

6. A time management method executed by a controller that performs time management on a network inside a vehicle, wherein the controller calculates vehicle absolute time by measuring elapsed time based on a reference absolute time that is pre-stored in a first memory, acquires external absolute time transmitted from outside the vehicle, updates the vehicle absolute time to the external absolute time if the external absolute time is later than the vehicle absolute time at the time the external absolute time is acquired, and maintains the vehicle absolute time without updating it to the external absolute time if the external absolute time is earlier than the vehicle absolute time at the time the external absolute time is acquired.

Images