Information processing device, on-vehicle system, information processing method, and computer program

Abstract

This information processing device comprises a switch device that relays a plurality of processing devices, and an external device externally attached to the switch device. The switch device includes a first nonvolatile memory that stores a first program, and a first control unit that sets a register on the basis of the first program when the switch device is started. The external device is provided with: a second nonvolatile memory that stores a second program; and a second control unit that executes a verification process on the second program at the time of start-up, and then controls the switch device on the basis of the setting of the register and the second program.

Description

Information processing device, in-vehicle system, information processing method, and computer program

[0001] This disclosure relates to an information processing device, an in-vehicle system, an information processing method, and a computer program. This application claims priority to Japanese Application No. 2024-100455 filed on June 21, 2024, and incorporates by reference all of the contents of that Japanese application.

[0002] In-vehicle networks are known in which multiple ECUs (Electronic Control Units) are connected. Patent Document 1 discloses a technology in which, in a network configured with multiple ECUs including a central ECU equipped with a control unit and an Ethernet switch, when network settings are changed in association with software downloads, the control unit and the Ethernet switch each perform a verification process of setting information.

[0003] Furthermore, a technology known as "secure boot" performs a program verification process (also called authentication process) when a device is started up in order to detect software tampering due to unauthorized access. However, when the secure boot technology is applied to a multi-core system including multiple central processing units (CPUs), the secure boot process is performed in each of these CPUs, which poses a problem of prolonged startup time.

[0004] To address this issue, Patent Document 2 describes an information processing device having multiple CPUs, in which only a specific CPU executes authentication processing (secure boot) for the programs of the other CPUs, and the other CPUs execute startup processing in parallel with the authentication processing. In this way, the technology of Patent Document 2 achieves a reduction in startup time while ensuring security by performing authentication of the specific CPU and startup of the other CPUs in parallel.

[0005] JP 2023-109114 A JP 2015-171008 A

[0006] An information processing device according to one example of the present disclosure is an information processing device comprising: a switch device that relays multiple processing devices; and an external device that is externally attached to the switch device; the switch device includes a first non-volatile memory that stores a first program; and a first control unit that sets a register based on the first program when the switch device is started; and the external device includes a second non-volatile memory that stores a second program; and a second control unit that, when started, executes a verification process for the second program and then controls the switch device based on the register setting and the second program.

[0007] Fig. 1 is a diagram showing an example of an in-vehicle system according to an embodiment. Fig. 2 is a diagram showing an example of register settings according to an embodiment. Fig. 3 is a diagram showing an example of register settings according to an embodiment. Fig. 4 is a sequence diagram showing an example of an information processing method according to an embodiment. Fig. 5 is a diagram showing a first nonvolatile memory according to a modified example.

[0008] [Problem to be Solved by the Present Disclosure] In the technology of Patent Document 2, for example, if the number of CPUs included in an information processing device increases or the amount of programs to be authenticated (for example, the number of lines of source code) increases, the time required for authentication processing in a specific CPU increases, and a "wait state" occurs after startup processing in multiple other CPUs. In other words, startup time is limited by the time required for authentication processing, making it difficult to further reduce startup time.

[0009] In view of the above problem, an object of the present disclosure is to provide an information processing device, an in-vehicle system, an information processing method, and a computer program that can further shorten the startup time while ensuring security.

[0010] Effect of the Present Disclosure According to the present disclosure, it is possible to further shorten the startup time while ensuring security.

[0011] [Description of Embodiments of the Present Disclosure] The gist of the embodiments of the present disclosure includes the following configurations.

[0012] (1) An information processing device according to an example of the present disclosure includes a switch device that relays multiple processing devices and an external device that is externally attached to the switch device, wherein the switch device includes a first non-volatile memory that stores a first program and a first control unit that sets a register based on the first program when the switch device is started up, and the external device includes a second non-volatile memory that stores a second program and a second control unit that, when the switch device is started up, executes a verification process for the second program and then controls the switch device based on the setting of the register and the second program.

[0013] In the present disclosure, the configuration process and verification process are shared between the switch device and the external device, and the verification process is omitted for the switch device, thereby shortening the startup time. Furthermore, after the configuration process, security is ensured by controlling the switch device based on the verified second program. As a result, the startup time of the information processing device can be further shortened while ensuring security.

[0014] (2) In the information processing device of (1) above, the first control unit may set the register without waiting for the start and end of the verification process.

[0015] By configuring it in this manner, the switch device can perform register setting processing while the external device is performing verification processing, thereby shortening the startup time of the information processing device compared to, for example, a case in which the switch device performs register setting processing after verification processing of the first program.

[0016] (3) In the information processing device of (1) or (2) above, the first control unit may provide a judgment value regarding the setting of the register to the second control unit, and if the second control unit judges based on the judgment value that the setting of the register is incorrect, it may reset the register based on the second program.

[0017] With this configuration, if the register settings are determined to be valid, the information processing device starts relay processing as is, thereby shortening the startup time, while if the register settings are determined to be incorrect, the registers are reset using the second program whose validity has been confirmed, thereby completing the startup process even if there is an abnormality in the first program. This makes it possible to shorten the startup time while ensuring security.

[0018] (4) In the information processing device of (3) above, the judgment value may be a value of the register, and the second control unit may determine that the setting of the register is incorrect if the value stored in the second program does not match the value of the register.

[0019] For example, if the first program is tampered with and a setting value included in the first program is rewritten with a different value, the register value included in the judgment value will not match the value stored in the second program (register setting value). Furthermore, even if the register setting value itself in the first program is not tampered with, if the program related to the setting process is tampered with, the setting value may not be correctly reflected in the register, and the register value included in the judgment value may not match the value stored in the second program. In such a case, the second control unit can detect tampering with the first program by determining that the register setting is incorrect. This ensures security.

[0020] (5) In the information processing device of (3) above, the judgment value may be a hash value calculated based on the value of the register, and the second control unit may determine that the setting of the register is incorrect if the value stored in the second program does not match the hash value.

[0021] Since the judgment value is a hash value (i.e., a summary value of the register values), the amount of processing required for judgment is reduced, and startup time can be shortened.

[0022] (6) In the information processing device of (3) above, the determination value is a hash value that is stored in advance in the first program before the register is set and is calculated based on a predicted value predicted as the value of the register, and the second control unit may determine that the setting of the register is incorrect if the value stored in the second program does not match the hash value.

[0023] Since the determination value is stored in the first nonvolatile memory before the setting process, calculation processing after the register setting process is not required, and the startup time can be further shortened.

[0024] (7) In the information processing device of (3) above, the first control unit may provide the second control unit with the determination value indicating that the setting of the register is incorrect when the value stored in the first program does not match the value of the register.

[0025] This configuration reduces the processing load on the second control unit. Furthermore, since the calculation process of the judgment value in the first control unit can be executed in parallel with the verification process after the register setting process, even if the verification process takes a long time, the time that the switch device is in a "waiting" state can be reduced, and the startup time can be shortened.

[0026] (8) In the information processing device of any one of (3) to (7) above, the switch device may include a setting pin that sets the switch device to a first mode upon input of a first signal and sets the switch device to a second mode upon input of a second signal different from the first signal, the first mode being a mode in which the first control unit sets the register based on the first program, and the second mode being a mode in which the second control unit sets the register based on the second program, the external device may include a signal pin connected to the setting pin, and the second control unit may output the first signal from the signal pin at the time of startup and, if it is determined that the register setting is incorrect, output the second signal from the signal pin.

[0027] With this configuration, the activation mode of the switch device 20 can be easily switched from the first mode M1 to the second mode M2 ​​based on the input signal to the setting pin.

[0028] (9) An in-vehicle system according to an example of the present disclosure is an in-vehicle system including the information processing device described above in (1) to (8) mounted on a vehicle and the plurality of processing devices mounted on the vehicle. Therefore, the in-vehicle system of the present disclosure achieves the same effects as the information processing device described above in (1) to (8).

[0029] (10) An information processing method according to an example of the present disclosure is an information processing method performed by the information processing devices described above in (1) to (8). Therefore, the information processing method according to the present disclosure achieves the same effects as the information processing devices described above in (1) to (8).

[0030] (11) A computer program according to an example of the present disclosure is a computer program for causing a computer to function as the information processing device described above in (1) to (8). Therefore, the computer program according to the present disclosure has the same effects as the information processing device described above in (1) to (8).

[0031] [Details of the Embodiments of the Present Disclosure] Hereinafter, details of the embodiments of the present disclosure will be described with reference to the drawings.

[0032] 1 is a diagram showing an example of the configuration of an in-vehicle system 1 according to an embodiment. The in-vehicle system 1 is a system mounted on a vehicle V1 such as an automobile. The in-vehicle system 1 includes an information processing device 10 and a plurality of processing devices 40.

[0033] The processing device 40 is, for example, an ECU (Electronic Control Unit). The number of processing devices 40 included in the in-vehicle system 1 is not particularly limited as long as it is two or more. The processing device 40 is, for example, a device (operation system ECU) that controls each part of the vehicle V1 (e.g., braking system, doors, battery, air conditioner, etc.). The function of the processing device 40 is not particularly limited, and the processing device 40 may be a device (cognition system ECU) that communicates with sensors and monitors the state of each part of the vehicle V1. The multiple processing devices 40 may have different functions or may have the same function.

[0034] The information processing device 10 functions as a relay device (also referred to as a gateway) that relays data transmitted and received among the plurality of processing devices 40. For example, the information processing device 10 is an integrated ECU (also referred to as a central ECU) that manages the plurality of processing devices 40. In this case, the information processing device 10 may distribute update data provided from outside the vehicle V1 to the plurality of processing devices 40.

[0035] The information processing device 10 is connected to a plurality of processing devices 40 via a transmission path L3. That is, the in-vehicle system 1 configures an in-vehicle network that connects the information processing device 10 and the plurality of processing devices 40 via the transmission path L3. The transmission path L3 is a communication line that complies with the Ethernet (registered trademark) communication protocol. Note that the transmission path L3 may be a communication line that complies with another communication protocol, such as CAN (Controller Area Network) or FlexRay (registered trademark).

[0036] [Internal Configuration of Information Processing Device 10] The information processing device 10 includes a switch device 20 and an external device 30. The switch device 20 is connected to the external device 30 via transmission lines L1 and L2.

[0037] The switch device 20 relays data between a plurality of processing devices 40. More specifically, the switch device 20 transfers data to the destination processing device 40 based on a destination address included in the data (packet) transmitted from the processing device 40. The switch device 20 is also called an "Ethernet switch" or a "switching hub." The external device 30 is an external calculation support device that assists the information processing in the switch device 20. The external device 30 is also called an "external microcomputer."

[0038] In the present disclosure, when starting up the information processing device 10, the switching device 20 and the external device 30 share various processes at the time of startup in order to shorten the startup time while ensuring security.

[0039] Specifically, the switch device 20 performs setting processing such as setting the register 24 described below, while in parallel with this, the external device 30 performs verification processing (secure boot) of the program stored therein. After the external device 30 performs its own verification processing, it determines whether the setting of the register 24 in the switch device 20 is correct, and if it is correct, it completes the startup of the information processing device 10. If it determines that the setting of the register 24 is incorrect, it resets the register 24 based on the program of the external device 30 that has been verified.

[0040] For example, when the setting process is executed after the verification process of the switch device 20 in the switch device 20, the processing time required to start the information processing device 10 is the sum of the verification process time and the setting process time. Similarly, when the setting process of the register 24 is executed in the switch device 20 after the verification process of the switch device 20 in the external device 30, the processing time required is the sum of the verification process time and the setting process time.

[0041] In contrast, in the present disclosure, the setting process and verification process are shared between the switch device 20 and the external device 30, and the verification process is omitted for the switch device 20, thereby shortening the startup time. Here, since the verification process is not executed for the switch device 20, the startup time can be shortened, but it is unclear whether the security of the switch device 20 is ensured as it is. Therefore, the external device 30 determines whether the settings in the register 24 are correct after the verification process, thereby ensuring the security of the switch device 20.

[0042] The configuration of each part of the information processing device 10 will be described in more detail below.

[0043] [Regarding the Switch Device 20] The switch device 20 includes a switch integrated circuit (IC) 21, a first nonvolatile memory 22, a plurality of communication interfaces 26, 26, and a plurality of input / output interfaces 27, 28. These components are electrically connected to each other via a bus B1.

[0044] The switch IC 21 includes a first control unit 23, a register 24, and a first volatile memory 25. The first control unit 23 includes a circuit configuration such as a processor. The first control unit 23 reads a first program P1 stored in the first non-volatile memory 22 and executes various calculations and controls described below.

[0045] Specifically, the first control unit 23 is one or more central processing units (CPUs). Since the first control unit 23 is provided inside the switch IC 21, it is also referred to as an "internal CPU" to distinguish it from the external device 30. Note that the processor included in the first control unit 23 may be a graphics processing unit (GPU).

[0046] The first control unit 23 shares various processes with the second control unit 31 (described later). Specifically, the first control unit 23 mainly executes the register 24 setting process, while the second control unit 31 executes the program verification process and the register 24 reset process when a problem occurs in the register 24 setting process performed by the first control unit 23. Because the first control unit 23 has a smaller processing load than the second control unit 31, a CPU that is less expensive and has lower performance than the second control unit 31 may be used. Lower performance means, for example, a smaller number of threads, a smaller cache memory capacity, or a lower clock frequency. This allows the manufacturing cost (material cost) of the information processing device 10 to be reduced.

[0047] The register 24 is a temporary storage device that holds instructions or settings related to the operation of the switch IC 21. The register 24 is a volatile memory that returns to its initial state (default) when power supply to the switch device 20 is stopped. Therefore, every time the switch device 20 is powered on, the first control unit 23 or a second control unit 31 (described later) writes settings to the register 24, and the switch IC 21 operates based on the settings.

[0048] 2 and 3 are diagrams showing examples of settings in the register 24. In the register 24, for example, port settings or MAC (Media Access Control) address settings of the switch device 20 are written.

[0049] 2 shows an example of the contents written to the register 24 when the register 24 is used to set the ports of the switch device 20. The communication standard and mode type for each port are written in each row of the register 24. In the example of FIG. 2, the communication standard for ports 1 and 2 is 100BASE-T1, and the ports are set to the master mode. Furthermore, the communication standard for port 3 is 1000BASE-T1, and the port is set to the slave mode.

[0050] 3 illustrates an example of the contents written to the register 24 when the register 24 sets a combination of MAC addresses of a plurality of processing devices 40 connected to the switch device 20. In each row of the register 24, a MAC address and a VLAN (Virtual Local Area Network) ID for each port are written.

[0051] 1 , the first volatile memory 25 includes, for example, a RAM (Random Access Memory). The first control unit 23 reads various data from the first nonvolatile memory 22 and temporarily stores the data and calculation results of the data in the first volatile memory 25, while executing various calculations and controls described below.

[0052] The first nonvolatile memory 22 is a memory that can retain data even when the switch device 20 is powered off. The first nonvolatile memory 22 is a flash memory, specifically an SPI (Serial Peripheral Interface) flash memory. The first nonvolatile memory 22 stores a first program P1 and a hash value H1. The first program P1 includes a computer program for setting the register 24 and a setting value SV1 of the register 24.

[0053] The communication interface 26 is connected to the processing device 40 via the transmission path L3. The communication interface 26 converts various signals in accordance with Ethernet. For example, the communication interface 26 converts an electrical signal output from the switch device 20 into a communication signal and transmits it to the transmission path L3. The communication interface 26 also converts a communication signal input from the transmission path L3 into an electrical signal and inputs it into the switch device 20.

[0054] The input / output interface 27 is connected to the external device 30 via a transmission path L1. The input / output interface 27 is, for example, a Media Independent Interface (MII). The input / output interface 27 connects the switch device 20 and the external device 30 in accordance with Ethernet. The transmission path L1 is a communication line in accordance with Ethernet.

[0055] The input / output interface 28 is connected to the external device 30 via a transmission line L2. The input / output interface 28 is a setting pin for setting the startup method of the switch device 20, and is also called a "configuration pin" or a "bootstrap pin."

[0056] The transmission path L2 is a signal line that transmits two-level signals, high and low. For example, when a low-level signal (hereinafter referred to as a "first signal") is input from the transmission path L2 to the input / output interface 28, the activation method of the switch device 20 is set to the first mode M1. Furthermore, when a high-level signal (hereinafter referred to as a "second signal") is input from the transmission path L2 to the input / output interface 28, the activation method of the switch device 20 is set to the second mode M2.

[0057] The first mode M1 is a mode in which the first control unit 23 sets the register 24 based on the first program P1 when starting up the switch device 20. The second mode M2 ​​is a mode in which the second control unit 31 sets the register 24 based on the second program P2 when starting up the switch device 20.

[0058] [Regarding the External Device 30] The external device 30 includes a second control unit 31, a second non-volatile memory 32, a second volatile memory 33, input / output interfaces 34, 35, and 36, and a communication interface 37. These components are electrically connected to each other via a bus B2.

[0059] The second control unit 31 includes a circuit configuration such as a processor. Specifically, the second control unit 31 is one or more CPUs. The processor included in the second control unit 31 may be a GPU. In this case, the second control unit 31 reads out a program stored in the second non-volatile memory 32 and executes various calculations and controls described below.

[0060] The second control unit 31 may include a processor in which a program is written in advance. For example, the second control unit 31 may be an integrated circuit such as a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), or an application-specific integrated circuit (ASIC). In this case, the second control unit 31 performs various calculations and controls based on the program written in advance.

[0061] The second nonvolatile memory 32 is a memory that can retain data even when the external device 30 is powered off. The second nonvolatile memory 32 includes, for example, a flash memory, a hard disk drive (HDD), a solid state drive (SSD), or a read-only memory (ROM). A part of the second nonvolatile memory 32 may be provided outside the external device 30 as a separate auxiliary storage device.

[0062] The second non-volatile memory 32 stores a second program P2, a verification program P3, and a verification key K1. The second program P2 includes a computer program for setting the register 24, a setting value SV1 of the register 24, and a computer program for controlling the switch device 20. The verification program P3 is a computer program for verifying whether the second program P2 is authentic. The verification key K1 is a key used during the verification process by the verification program P3, and is also referred to as a "public key."

[0063] The second volatile memory 33 includes, for example, a RAM. The second control unit 31 reads various data from the second nonvolatile memory 32 and temporarily stores the data and calculation results of the data in the second volatile memory 33 while executing various calculations and controls described below.

[0064] The input / output interface 34 is connected to the switch device 20 via a transmission line L1. The input / output interface 34 is, for example, an MII.

[0065] The input / output interface 35 is connected to the switch device 20 via a transmission line L2. The input / output interface 35 is a signal pin that outputs a two-level signal, High / Low, and is, for example, a general-purpose I / O (GPIO: General-purpose input / output).

[0066] The input / output interface 36 is, for example, a general-purpose I / O, and is a pin for inputting and outputting digital signals to and from devices other than the switch device 20 .

[0067] The communication interface 37 is a pin for communicating with devices other than the switch device 20 in accordance with a predetermined communication protocol (for example, Ethernet, CAN, or FlexRay).

[0068] [Regarding the Information Processing Method] Fig. 4 is a sequence diagram showing an example of an information processing method executed by the information processing device 10. In Fig. 4, the process executed by the external device 30 is shown on the left side, and the process executed by the switch device 20 is shown on the right side. The order of the processes shown in Fig. 4 may be changed as appropriate.

[0069] In the external device 30, the second control unit 31 reads various programs (e.g., the second program P2 and the verification program P3) from the second nonvolatile memory 32 and executes various processes. In the switch device 20, the first control unit 23 reads various programs (e.g., the first program P1) from the first nonvolatile memory 22 and executes various processes.

[0070] First, the outline of the information processing method will be explained. In the information processing method disclosed herein, when starting up the information processing device 10, the switch device 20 is responsible for setting the register 24, and the external device 30 is responsible for verifying the program, thereby ensuring security and shortening the startup time.

[0071] To ensure the security of the switch device 20 in which program verification is not performed, the external device 30 performs its own verification process and then determines whether the settings of the register 24 in the switch device 20 are correct (register setting confirmation process). If it determines that the settings of the register 24 are correct, it simply completes the startup of the information processing device 10. On the other hand, if it determines that the settings of the register 24 are incorrect, it resets the register 24 based on the program of the external device 30 that has undergone the verification process (register reset process).

[0072] Each step will be described in detail below.

[0073] First, the information processing device 10 is powered on, thereby starting the supply of power to the external device 30 and the switch device 20 (steps ST101 and ST201). For example, the driver turns on the ignition switch of the vehicle V1, thereby powering on the information processing device 10. This starts various startup processes described below.

[0074] When the power is turned on, the external device 30 outputs a first signal from the input / output interface 35 (signal pin) (step ST102). After this, the input / output interface 35 continues to output the first signal until it is determined that the register setting is incorrect in a determination process (step ST106) described below.

[0075] Next, the external device 30 executes a verification process for the second program P2 based on the verification program P3 (step ST103). First, the second control unit 31 reads the verification program P3 from the second non-volatile memory 32 and starts the verification process in accordance with the verification program P3. Specifically, the second control unit 31 reads the second program P2 to be verified from the second non-volatile memory 32. Then, the second control unit 31 generates a hash value H2 for verification from the code of the second program P2.

[0076] The second program P2 is previously assigned a digital signature E1 created by the creator of the second program P2 using a private key. The digital signature E1 is information generated by encrypting a hash value generated from the code of the second program P2 with the private key. The second control unit 31 obtains a legitimate hash value H3 by decrypting the digital signature E1 using a verification key K1 previously stored in the second nonvolatile memory 32.

[0077] Finally, if the verification hash value H2 matches the regular hash value H3, the second control unit 31 determines that the second program P2 is valid. This completes the process of verifying the validity of the second program P2.

[0078] If the verification hash value H2 does not match the legitimate hash value H3, the second control unit 31 determines that the second program P2 is unauthorized. In this case, the second program P2 may have been tampered with, and starting the second program P2 as is may cause a malfunction in the in-vehicle system 1. Therefore, the second control unit 31 stops the startup process from step ST104 onwards. The second control unit 31 also notifies the administrator of the in-vehicle system 1 of the abnormality by sending an error message indicating that the second program P2 is unauthorized to another device (e.g., a management device for the in-vehicle system 1) via the communication interface 37.

[0079] Next, the external device 30 executes its own initialization process (step ST104). For example, it initializes various flags included in the external device 30 and waits until the voltage in the circuit becomes stable. This initialization process is also called "initialization of the microcomputer" or "resetting the microcomputer."

[0080] Similarly, the switch device 20 also executes its own initialization process (step ST202). For example, it initializes various flags included in the switch device 20 and waits until the voltage in the circuit stabilizes. At this time, since the first signal is input to the input / output interface 28 (setting pin) of the switch device 20, the switch device 20 starts up in the first mode M1.

[0081] Next, the switch device 20 executes a setting process for the register 24 (step ST203). Because the register 24 is in an initial state when the switch device 20 is powered on, it is necessary to define the operation of the switch IC 21 by writing a value to the register 24. First, the first control unit 23 reads the first program P1 from the first nonvolatile memory 22 and writes a value to the register 24 in accordance with the first program P1. The first program P1 describes a setting value SV1 for the register 24, and the first control unit 23 writes a value to the register 24 based on the setting value SV1.

[0082] The first control unit 23 executes the setting process of the register 24 without waiting for the start and end of the verification process (step ST103) in the external device 30. Therefore, even if the verification process (step ST103) in the external device 30 takes time after the information processing device 10 is powered on, the setting process (step ST203) in the switch device 20 is executed in parallel with the verification process, thereby shortening the startup time.

[0083] Next, the information processing device 10 executes a register setting confirmation process to confirm whether the setting of the register 24 is valid. First, the external device 30 transmits a request signal to the switch device 20 requesting the determination value J1 (step ST105). Specifically, after the initialization process (step ST104), the second control unit 31 outputs the request signal to the switch device 20. The request signal is input to the switch device 20 from the input / output interface 34 via the transmission path L1.

[0084] In response to the request signal, the switch device 20 outputs a judgment value J1 to the external device 30 (step ST204). Here, the judgment value J1 is a value for judging whether the setting of the register 24 in the setting process (step ST203) is correct or incorrect, and is, for example, the value of the register 24. After the setting process, the first control unit 23 outputs the value of each row of the register 24 as the judgment value J1 from the input / output interface 27 to the external device 30 via the transmission path L1.

[0085] Instead of transmitting the request signal (step ST105) and outputting the judgment value J1 (step ST204), the external device 30 may directly read the register 24 of the switch device 20. In this case, the second control unit 31 refers to the register 24 via the input / output interfaces 34 and 27 without going through the processing of the first control unit 23.

[0086] Next, the external device 30 determines whether the setting of the register 24 is correct based on the determination value J1 (step ST106). Here, the setting value SV1 of the register 24 is stored in the second program P2. The legitimacy of the second program P2 (i.e., that the code has not been tampered with) has been confirmed by the verification process (step ST103), so the setting value SV1 of the register 24 stored in the second program P2 is considered to be a regular value.

[0087] Therefore, the second control unit 31 reads the value of the register 24 included in the judgment value J1 row by row and compares it with the corresponding part of the setting value SV1. If the value of the register 24 included in the judgment value J1 exactly matches the setting value SV1, the second control unit 31 determines that the setting of the register 24 is valid.

[0088] In this case, the second control unit 31 determines that there is no abnormality in the setting process by the switch device 20, and transmits a link-up instruction to the switch device 20 based on the second program P2 (step ST107). In response to the link-up instruction, the switch device 20 starts relay processing for the multiple processing devices 40. This completes the startup process of the information processing device 10.

[0089] On the other hand, if the value of register 24 included in judgment value J1 does not match set value SV1, second control unit 31 determines that the setting of register 24 is incorrect. For example, if first program P1 is tampered with and the set value SV1 included in first program P1 is rewritten to a different value, the value of register 24 included in judgment value J1 will not match set value SV1. Also, even if the set value SV1 itself in first program P1 is not tampered with, if a program related to the setting process is tampered with, the set value SV1 may not be correctly reflected in register 24, and the value of register 24 included in judgment value J1 may not match set value SV1. In such a case, second control unit 31 determines that there is an abnormality in the setting process by switch device 20 and executes register resetting processing.

[0090] Specifically, the external device 30 outputs the second signal from the input / output interface 35 (signal pin) (step ST108). After this, the second signal continues to be output from the input / output interface 35 until the startup process of the information processing device 10 is completed.

[0091] Next, the second control unit 31 transmits a reset request to the switch device 20 (step ST109). In response to the reset request, the switch device 20 executes a reset process (step ST205). In the reset process, the first control unit 23 initializes the switch IC 21 in the same manner as in the initialization process (step ST202), and also resets the value of the register 24 to its initial state. At this time, since the second signal is input to the input / output interface 28 (setting pin) of the switch device 20, the switch device 20 starts up in the second mode M2.

[0092] By using the input / output interface 28 as a setting pin in this manner, the startup mode of the switch device 20 can be easily switched from the first mode M1 to the second mode M2 ​​based on an input signal to the setting pin.

[0093] After the reset process is completed, the first control unit 23 transmits a reset completion notification to the external device 30 (step ST206). Because the switch device 20 is in the second mode M2, the switch device 20 is subsequently controlled by the second control unit 31, and the first control unit 23 is disabled and shut down. This ensures security by preventing the first control unit 23, which operates according to the first program P1 that may be subject to tampering, from participating in subsequent startup processes. Furthermore, by disabling the first control unit 23, the power consumption of the first control unit 23 can be reduced.

[0094] In response to the reset completion notification, the second control unit 31 resets the register 24 based on the setting value SV1 stored in the second program P2 (step ST110). As described above, the legitimacy of the second program P2 has been confirmed by undergoing the verification process (step ST103). Therefore, even if the setting of the register 24 by the first program P1 is invalid, security can be ensured by resetting the register 24 by the legitimate second program P2.

[0095] After the setting of the register 24 is completed, the switch device 20 transmits a setting completion notification to the external device 30 (step ST207). In response to the setting completion notification, the second control unit 31 transmits a link-up instruction to the switch device 20 based on the second program P2 (step ST111). In response to the link-up instruction, the switch device 20 starts relay processing of the multiple processing devices 40. This completes the startup processing of the information processing device 10.

[0096] According to the information processing method described above, the switch device 20 can execute the setting process of the register 24 while the external device 30 is executing the verification process, and therefore the startup time of the information processing device 10 can be shortened compared to, for example, when the switch device 20 executes the setting process of the register 24 after the verification process of the first program P1.

[0097] On the other hand, because verification processing is not performed on the first program P1, security is not ensured for the setting processing of the register 24 by the first program P1 as it is. For this reason, the switch device 20 transmits a determination value J1 regarding the setting of the register 24 to the external device 30, and after the verification processing, the external device 30 determines the validity of the setting of the register 24 based on the second program P2, the validity of which has been confirmed by the verification processing, and the determination value J1. Then, if it is determined that the setting of the register 24 is valid, the information processing device 10 starts the relay processing as is, thereby shortening the startup time.

[0098] Furthermore, if it is determined that the setting of the register 24 is invalid, the register 24 is reset by the second program P2 whose validity has been confirmed, so the startup process can be completed even if there is an abnormality in the first program P1. This makes it possible to shorten the startup time while ensuring security.

[0099] It is preferable to execute the determination process (step ST106) to ensure the security of the information processing device 10. However, if a request to shorten the startup time has a higher priority, the link-up instruction may be executed based on the setting of the register 24 and the second program P2 prior to the determination process. This allows the information processing device 10 to start the relay process more quickly. Even in this case, the link-up is performed by the second control unit 31 controlling the switch device 20 based on the second program P2, the legitimacy of which has been examined, so a certain degree of security can be ensured.

[0100] Furthermore, when the link-up instruction is executed before the determination process, the second control unit 31 may execute the determination process after the start of the relay process by the information processing device 10, and if the setting of the register 24 is valid, continue the relay process as is, or if there is an error in the setting of the register 24, interrupt the relay process and execute the register reset process as described above. This makes it possible to ensure the security of the information processing device 10.

[0101] [Modifications] Modifications of the embodiment will be described below. In the modifications, the same components as those in the above embodiment will be denoted by the same reference numerals and descriptions thereof will be omitted.

[0102] [Determination Value Variation 1: Hash Value Calculated from Register Value] In the above embodiment, the determination value J1 is the value of the register 24 set based on the first program P1. However, the determination value is not limited to this as long as it is a value that can confirm the validity of the setting of the register 24. For example, instead of the determination value J1, a hash value calculated based on the value of the register 24 (hereinafter referred to as "determination value J2") may be used.

[0103] In this case, in response to the judgment value request (step ST105), the first control unit 23 reads the value of the register 24 and calculates a judgment value J2 as a hash value based on a predetermined hash function from the value of the register 24. Then, the first control unit 23 outputs the judgment value J2 to the external device 30 (step ST204).

[0104] The second control unit 31 reads the setting value SV1 stored in the second program P2 and calculates a hash value SV2 from the setting value SV1 based on a predetermined hash function. If the judgment value J2 matches the hash value SV2, the second control unit 31 determines that the setting of the register 24 is valid, and if the judgment value J2 does not match the hash value SV2, the second control unit 31 determines that the setting of the register 24 is incorrect (step ST106).

[0105] Because the determination value J2 is a hash value (i.e., a summary value of the value of the register 24), the amount of data is smaller than the determination value J1, which is the actual value of the register 24. This reduces the amount of processing in the process of outputting the determination value J2 from the first control unit 23 to the external device 30 (step ST204) and in the determination process (step ST106), thereby enabling the startup time to be shortened.

[0106] [Variation 2 of the Judgment Value: Pre-Calculated Hash Value] A pre-calculated hash value (hereinafter referred to as "judgment value J3") may be used instead of the judgment value J1. The judgment value J2 described above is a hash value calculated by the first control unit 23 based on the value of the register 24 after the setting process (step ST203). In contrast, the judgment value J3 in this variation is a value that is pre-stored in the first non-volatile memory 22 before the register 24 is set. Specifically, the judgment value J3 is a hash value H1 (FIG. 1) calculated based on a predicted value that is predicted as the value of the register 24 when the register 24 is set based on the first program P1.

[0107] Since the setting value SV1 of the register 24 is stored in the first program P1, it is possible to predict the value of the register 24 after setting based on the first program P1 even before actually setting the register 24. Therefore, the hash value H1 (i.e., the judgment value J3) can be stored in advance in the first non-volatile memory 22 before the setting process.

[0108] In this case, in response to the judgment value request (step ST105), the first control unit 23 outputs the judgment value J3 stored in advance in the first non-volatile memory 22 to the external device 30 (step ST204). In the case of the judgment value J2, a step of calculating the judgment value J2 from the value of the register 24 is required after the setting process. In contrast, since the judgment value J3 is stored in the first non-volatile memory 22 before the setting process, the calculation process after the setting process is not required, and the startup time can be further shortened.

[0109] The second control unit 31 reads the setting value SV1 stored in the second program P2 and calculates a hash value SV2 from the setting value SV1 based on a predetermined hash function. If the judgment value J3 matches the hash value SV2, the second control unit 31 determines that the setting of the register 24 is valid, and if the judgment value J3 does not match the hash value SV2, the second control unit 31 determines that the setting of the register 24 is incorrect (step ST106).

[0110] Because the judgment value J3 is a hash value (i.e., a summary value of the predicted value of the register 24), the amount of data is smaller than the judgment value J1, which is the actual value of the register 24. This reduces the amount of processing in the process of outputting the judgment value J3 from the first control unit 23 to the external device 30 (step ST204) and the judgment process (step ST106), thereby enabling the startup time to be shortened.

[0111] [Variation 3 of Determination Value: Determination Process by First Control Unit 23] Instead of the determination value J1, a value indicating the determination result by the first control unit 23 (hereinafter referred to as "determination value J4") may be used. In the above embodiment, the second control unit 31 determines the validity of the value in the register 24 based on the determination value J1 and the set value SV1. However, in this variation, it is the first control unit 23, not the second control unit 31, that determines the validity of the value in the register 24.

[0112] For example, after the setting process of the register 24 (step ST203), the first control unit 23 reads the value of the register 24 and compares it with the setting value SV1 of the register 24 stored in the first program P1. If the value of the register 24 matches the setting value SV1 in the first program P1, the first control unit 23 outputs a determination value J4 (e.g., J4=0) indicating that the setting of the register 24 is valid to the external device 30 (step ST204).

[0113] On the other hand, if the value of register 24 does not match the setting value SV1 in the first program P1, the first control unit 23 outputs a judgment value J4 (e.g., J4 = 1) indicating that the setting of register 24 is incorrect to the external device 30 (step ST204).

[0114] The second control unit 31 determines the validity of the setting of the register 24 based on the determination value J4 (step ST106). Here, the determination value J4 already includes a value indicating whether the setting of the register 24 is valid or not, so the second control unit 31 determines the validity of the setting of the register 24 based on this value. For example, if the determination value J4 is "1", the second control unit 31 determines that the setting of the register 24 is incorrect.

[0115] As described above, in the determination process (step ST106) of this modified example, the second control unit 31 does not execute an arithmetic process such as a comparison between the determination value J1 and the set value SV1, thereby reducing the processing load on the second control unit 31. Furthermore, the calculation process of the determination value J4 in the first control unit 23 can be executed in parallel with the verification process (step ST103) if it is executed after the setting process of the register 24. Therefore, even if the verification process takes a long time, the time that the switch device 20 is in a "waiting" state can be reduced, and the startup time can be shortened.

[0116] Here, since this modified example calculates the judgment value J4 based on the first program P1 that has not executed the verification process, depending on the content of the tampering with the first program P1, there is a risk that errors in the settings of the register 24 cannot be detected.

[0117] For example, if a portion of the first program P1 other than the setting value SV1 of the register 24 is tampered with, a discrepancy will occur between the setting value SV1 of the register 24 in the first program P1 (valid value) and the actual value (invalid value) of the register 24, making it possible to detect an error in the setting of the register 24. On the other hand, if the setting value SV1 of the register 24 in the first program P1 is tampered with to a different value, the setting value SV1 of the register 24 in the first program P1 (invalid value) will match the actual value (invalid value) of the register 24, making it impossible to detect an error in the setting of the register 24.

[0118] As such, although there are some patterns in which errors in the settings of register 24 cannot be detected, this modified example allows the first control unit 23 to be responsible for part of the judgment process, thereby making it possible to shorten the startup time while maintaining a certain degree of security.

[0119] In this modified example, the first control unit 23 compares the value of the register 24 with the setting value SV1 in the first program P1, but instead, the first control unit 23 may compare a hash value calculated based on the value of the register 24 with a hash value calculated based on the setting value SV1 in the first program P1.

[0120] [Multiple Register Settings] In the above embodiment, the first program P1 and the second program P2 store one piece of data as the setting value SV1 of the register 24. However, multiple patterns of setting values ​​may be prepared for the setting of the register 24, and one pattern may be selected from the multiple patterns of setting values ​​each time the information processing device 10 is started.

[0121] 5 is a block diagram showing a first non-volatile memory 22a according to a modified example. The first non-volatile memory 22a according to this modified example stores a first setting C1, a second setting C2, and a third setting C3 as setting patterns for the register 24. These settings C1 to C3 are included in, for example, the first program P1. The first non-volatile memory 22a also stores a designated value X1 that specifies a setting pattern to be referenced when the switch device 20 is started. For example, when the designated value X1=1, the first setting C1 is designated; when the designated value X1=2, the second setting C2 is designated; and when the designated value X1=3, the third setting C3 is designated.

[0122] In the setting process (step ST203) of this modified example, the first control unit 23 first reads out a setting pattern specified by the specified value X1 from the first nonvolatile memory 22a, and sets the register 24 based on the setting pattern. For example, when the specified value X1=1, the first control unit 23 reads out the first setting C1, and sets the register 24 based on the first setting C1.

[0123] The designated value X1 is rewritten, for example, after the link-up instruction (step ST107 or ST111) while the information processing device 10 is executing the relay process, if the connection configuration of the plurality of processing devices 40 is changed. For example, the second control unit 31 determines the setting pattern to be specified at the next startup in accordance with the connection configuration of the plurality of processing devices 40, transmits a new designated value X1 to the switch device 20 based on the determination result, and updates the designated value X1 stored in the first non-volatile memory 22a to the new designated value X1.

[0124] Although the above description has been given of the first non-volatile memory 22a, the first setting C1, the second setting C2, and the third setting C3 are similarly stored in the second non-volatile memory 32. In this case, these settings C1 to C3 are included in the second program P2, and the validity of these settings C1 to C3 is also verified in the verification process (step ST103).

[0125] By storing a plurality of setting patterns in advance in this way, it is possible to respond to changes in the network configuration of the in-vehicle system 1 without waiting for an update of the first program P1.

[0126] In this modification, when a hash value calculated in advance is used as the determination value in the determination process (step ST106), the hash value may be stored in advance in the first nonvolatile memory 22a for each of these settings C1 to C3.

[0127] For example, the first nonvolatile memory 22a stores a hash value H11 calculated in advance based on the first setting C1, a hash value H12 calculated in advance based on the second setting C2, and a hash value H13 calculated in advance based on the third setting C3. When the setting process of the register 24 is performed based on the first setting C1, the first control unit 23 outputs the hash value H11 to the external device 30 as a determination value.

[0128] With this configuration, even when a plurality of setting patterns are prepared, the validity of the setting of the register 24 can be determined based on the hash value calculated in advance.

[0129] [Additional Note] At least some of the above-described embodiments and various modifications may be combined with each other in any desired manner. Furthermore, the embodiments and modifications disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present disclosure is defined by the claims, and it is intended to include all modifications within the meaning and scope of the claims.

[0130] REFERENCE SIGNS LIST 1 In-vehicle system 10 Information processing device 20 Switch device 21 Switch IC 22, 22a First non-volatile memory 23 First control unit 24 Register 25 First volatile memory 26 Communication interface 27 Input / output interface 28 Input / output interface 30 External device 31 Second control unit 32 Second non-volatile memory 33 Second volatile memory 34 Input / output interface 35 Input / output interface 36 Input / output interface 37 Communication interface 40 Processing device V1 Vehicle L1 Transmission path L2 Transmission path L3 Transmission path B1 Bus B2 Bus P1 First program P2 Second program P3 Verification program SV1 Setting value SV2 Hash value H1 Hash value H2 Hash value H3 Hash value H11 Hash value H12 Hash value H13 Hash value M1 First mode M2 ​​Second mode K1 Verification key E1 Digital signature J1 Judgment value J2 Judgment value J3 Judgment value J4 Judgment value C1 First setting C2 Second setting C3 Third setting X1 Designated value

Claims

1. An information processing device comprising: a switch device that relays multiple processing devices; and an external device externally attached to the switch device, wherein the switch device includes: a first non-volatile memory that stores a first program; and a first control unit that sets a register based on the first program when the switch device is started up; and the external device includes: a second non-volatile memory that stores a second program; and a second control unit that, when started up, executes a verification process for the second program and then controls the switch device based on the register settings and the second program.

2. The information processing device according to claim 1, wherein the first control unit sets the register without waiting for the start and end of the verification process.

3. An information processing device as described in claim 1 or claim 2, wherein the first control unit provides a judgment value regarding the setting of the register to the second control unit, and when the second control unit judges that the setting of the register is incorrect based on the judgment value, it reconfigures the register based on the second program.

4. The information processing device according to claim 3, wherein the judgment value is the value of the register, and the second control unit judges that the setting of the register is incorrect if the value stored in the second program does not match the value of the register.

5. The information processing device of claim 3, wherein the judgment value is a hash value calculated based on the value of the register, and the second control unit judges that the setting of the register is incorrect if the value stored in the second program does not match the hash value.

6. The information processing device of claim 3, wherein the judgment value is a hash value that is stored in advance in the first program before the register is set and is calculated based on a predicted value predicted as the value of the register, and the second control unit determines that the setting of the register is incorrect if the value stored in the second program does not match the hash value.

7. The information processing method according to claim 3, wherein the first control unit provides the second control unit with the judgment value indicating that the register setting is incorrect when the value stored in the first program does not match the value in the register.

8. An information processing device according to any one of claims 3 to 7, wherein the switch device includes a setting pin that sets the switch device to a first mode upon input of a first signal and sets the switch device to a second mode upon input of a second signal different from the first signal, the first mode being a mode in which the first control unit sets the register based on the first program, and the second mode being a mode in which the second control unit sets the register based on the second program, the external device includes a signal pin connected to the setting pin, and the second control unit causes the first signal to be output from the signal pin at the time of startup, and causes the second signal to be output from the signal pin when it is determined that the register setting is incorrect.

9. An in-vehicle system comprising: an information processing device according to any one of claims 1 to 8 mounted in a vehicle; and the plurality of processing devices mounted in the vehicle.

10. An information processing method comprising: a first step of setting a register of a switch device that relays multiple processing devices based on a first program stored in a first non-volatile memory included in the switch device when the switch device is started up; a second step of executing a verification process of a second program stored in a second non-volatile memory included in an external device externally attached to the switch device when the switch device is started up; and a third step of controlling the switch device based on the setting of the register and the second program after the first and second steps.

11. A computer program that causes a computer to function as an information processing device, the computer program executing the following steps: a first step of setting a register of a switch device that relays multiple processing devices based on a first program stored in a first non-volatile memory included in the switch device when the switch device is started up; a second step of executing a verification process for a second program stored in a second non-volatile memory included in an external device external to the switch device when the switch device is started up; and a third step of controlling the switch device based on the setting of the register and the second program after the first and second steps.

Images