Vehicle ECU Secure Boot Segmentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing vehicle control device secure boot methods are time-consuming due to the verification of all programs on the ECU before allowing start-up, and they are vulnerable to malicious tampering and errors during program updates.

Innovation Solution

A vehicle control device with a first verification section for higher-importance regions, such as BootLoader and Flash BootLoader, and a second verification section for lower-importance regions, where the integrity of higher-importance regions is verified before start-up, and lower-importance regions are verified post-start-up, using unique and common keys respectively to ensure swift and secure start-up.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If all programs on the ECU are verified before start-up, then security against malicious tampering is improved, but start-up time increases

Engineering Contradiction:

Improveprogram integrity verificationVSAvoidstart-up time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent divides the ECU program into multiple regions with different importance levels (first region with start-up programs and second region with other programs). Verification is performed segmentally: first region verification is completed before start-up, while second region verification occurs during operation. This segmentation resolves the contradiction by verifying only critical segments before start-up, reducing time loss while maintaining security for essential functions.

Inventive Principle:

Principle #1Segmentation

2Reliability

If program verification is performed before start-up, then security against fraudulent programs is improved, but the start-up process becomes more complex

Engineering Contradiction:

Improveprogram authenticityVSAvoidverification process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The verification process is segmented into two phases: pre-start-up verification of the first region containing start-up programs, and post-start-up verification of the second region. This segmentation simplifies the pre-start-up process by limiting verification scope to only critical programs, reducing process complexity while maintaining authenticity verification for essential functions.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary verification of the first region (start-up programs) before ECU operation begins. This preliminary action ensures that critical programs are verified in advance, simplifying the overall process by handling security-critical verification beforehand, while less critical verification is deferred to runtime.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If complete program verification is performed, then protection against errors during updates is improved, but productivity during start-up decreases

Engineering Contradiction:

Improveprogram correctnessVSAvoidstart-up speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent segments program verification into priority-based regions: the first region (containing start-up programs) is verified completely before start-up to ensure correctness, while the second region is verified during operation. This segmentation improves productivity by limiting pre-start-up verification to only the most critical programs, allowing faster start-up while maintaining reliability for essential functions.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS11620385B2Vehicle control device, vehicle control device start-up method, and recording medium

Publication Date: 2023.04.04 TOYOTA JIDOSHA KK

AI summary

A vehicle control device that verifies integrity of a program within a higher-importance region containing a start-up program; and that verifies integrity of a program within a lower-importance region in a state in which the program within the higher-importance region has been started up by the start-up program.