In-Vehicle Gateway Firmware Proxy for Secure ECU Updates

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing firmware update methods for electronic control units (ECUs) in in-vehicle networks face challenges when ECUs lack necessary functions for secure updates, potentially disrupting vehicle operations during the update process.

Innovation Solution

A gateway device is introduced to execute necessary processes such as signature verification and firmware caching on behalf of ECUs that do not possess these functions, ensuring safe and successful firmware updates by proxying these functions from other capable ECUs or itself.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If firmware update is performed during vehicle operation, then productivity is improved, but reliability deteriorates due to potential disruption of ECU message exchange

Engineering Contradiction:

Improvefirmware update timing flexibilityVSAvoidvehicle operation stability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The gateway device performs preliminary actions by storing received firmware data and verification keys in its storage unit before the ECU actually needs them. This allows the ECU to perform signature verification and firmware reception without interrupting its normal message exchange operations, as all necessary data is prepared in advance by the gateway.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The gateway device acts as an intermediary between the external firmware source and the ECU. It receives firmware data, stores it temporarily, and manages the data transfer process, allowing the ECU to perform updates without directly communicating with external sources and without interrupting its primary communication functions.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Device complexity

If ECU performs signature verification and firmware caching itself, then device complexity is reduced, but reliability deteriorates when ECU lacks these functions

Engineering Contradiction:

ImproveECU functional requirementsVSAvoidfirmware update security

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The gateway device is designed with multi-functionality, serving both as a communication router for normal ECU operations and as a firmware update management system. It performs multiple roles including receiving firmware data, storing it in its storage unit, verifying signatures, and transferring data to the ECU, thereby providing update capabilities to ECUs that lack these functions.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The gateway acts as an intermediary that provides missing functions to the ECU. When an ECU lacks signature verification or firmware caching capabilities, the gateway performs these functions on its behalf using its own cryptographic modules and storage unit, ensuring secure firmware updates for ECUs with limited functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If ECU exchanges messages during firmware update, then reliability is maintained, but manufacturing precision deteriorates due to update failures

Engineering Contradiction:

Improvemessage exchange continuityVSAvoidfirmware update success rate

Core Design Contradiction:

ReliabilityVSManufacturing precision

Solution Approach 1:

The gateway performs preliminary verification of the firmware data by checking the signature against the stored verification key before transferring the firmware to the ECU. This preliminary check ensures firmware integrity and prevents update failures, allowing the ECU to maintain message exchange operations without interruption or risk of update failure.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The gateway stores firmware data and verification keys in its storage unit in advance, creating a buffer that ensures data availability and integrity. This beforehand preparation cushions against potential update failures by ensuring that verified, complete firmware data is ready before the ECU begins the update process, even while maintaining normal operations.

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

Data Source

PatentEP4113287B1Gateway device, in-vehicle network system, and firmware update method

Publication Date: 2024.03.06 PANASONIC INTELLECTUAL PROPERTY CORP OF AMERICA

Figure 1
Figure 2
Figure 3

AI summary

A gateway device 300, connected to one or more buses used in communication by a plurality of ECUs 100a to 100d on-board a vehicle, is provided with: a receiving unit that receives, from a server 500 that acts as an external device external to the vehicle, firmware update information that includes updated firmware to be applied to one ECU from among the plurality of ECUs 100a to 100d; and a control unit that determines, based on certain information about the ECU on which to apply the updated firmware, whether or not the ECU satisfies a certain condition, and if the certain condition is satisfied, causes the ECU to execute a certain process related to updating firmware, whereas if the certain condition is not satisfied, causes equipment other than the ECU to execute the certain process.