JP2008084120A - Electronic control device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic control device detecting a fraudulent act even when electronic control devices are illegally exchanged by preventing the identification of authentication data obtained by stealing an electronic control device, tapping communications between electronic control devices, etc. <P>SOLUTION: The device comprises an authentication means for authenticating reliability of data based on the authentication data transmitted and received through communication means 12, 22 and 32, and an authentication data update means 11d, 21d, and 31d for updating the authentication data upon termination of the communications by the communications means 12, 22 and 32. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention provides an electronic control provided with a communication means that starts when a system is started and ends when the system is stopped, and an authentication control means that authenticates the authenticity of data based on authentication data transmitted and received via the communication means. Relates to the device.

  As one of vehicle anti-theft measures, an immobilizer (anti-theft function) electronic control device is used that can start the engine only when specific authentication data matches. However, when such an immobilizer electronic control device itself is replaced, the anti-theft function is lost.

  In addition, the electronic fuel injection (EFI) electronic control device with a speed limiting function and the EFI electronic control device can be replaced by the user for the purpose of improving the acceleration performance of the vehicle, etc. There is also a problem that causes such problems.

  In order to prevent the above-described vehicle theft and unauthorized exchange of the electronic control device that controls various functions of the vehicle, the electronic control device stores authentication data and collates the authentication data to thereby perform the electronic control. Methods have been proposed for monitoring unauthorized replacement of devices. For example, in Patent Document 1 below, code verification is performed between a monitored electronic control device such as an immobilizer electronic control device and the monitored electronic control device, and if the verification is not established, the monitored electronic control device is illegal. An anti-theft device for a vehicle is disclosed that determines that there is a possibility that the vehicle has been replaced or removed, and disables normal operation by causing a bus failure.

  Further, in Patent Document 2 below, the authentication data stored in the memory of the vehicle component is checked against the authentication data stored in the memory of the in-vehicle control device, and the vehicle component is provided on condition that the authentication data matches. A theft monitoring system for a vehicle component that permits basic functional operation of the vehicle is disclosed.

Further, in Patent Document 3 below, each electronic control device of the vehicle has unique identification data, and the identification data is used to check whether each electronic control device is a valid combination. A vehicle electronic control device with an anti-theft function is disclosed.
JP 2003-212093 A JP 2003-196755 A JP 2004-42741 A

  However, in the case of the anti-theft device disclosed in Patent Document 1 or the anti-theft monitoring system disclosed in Patent Document 2, the authentication data used for verification is stored in the monitoring electronic control device as a fixed ID. Since the relationship between the monitored device and the monitoring electronic control device is also fixed, if the authentication data is specified and embedded in the unauthorized exchange electronic control device by a person who intends to steal or exchange illegally, When the control device itself is removed, there is a problem that the theft or unauthorized exchange prevention function is lost.

  Further, in the case of the vehicle electronic control device disclosed in Patent Document 3, in order to check the correctness of the combination of each electronic control device, simply replacing one electronic control device with an unauthorized exchange electronic control device, The unauthorized exchange prevention function will not be lost, but if communication between each electronic control unit is eavesdropped, the combination of each electronic control unit will be clarified, so the unauthorized exchange prevention function is provided. There was a problem of being lost.

  In view of the above-mentioned conventional drawbacks, an object of the present invention is to prevent unauthorized exchange of electronic control devices by avoiding identification of authentication data due to theft of electronic control devices or wiretapping of communication between electronic control devices. In this case, an electronic control device that can detect fraud is provided.

  In order to achieve the above-described object, the characteristic configuration of the electronic control device according to the present invention includes authentication means for authenticating data reliability based on authentication data transmitted and received via the communication means, and termination of communication by the communication means. The authentication data update means for updating the authentication data is sometimes provided.

  According to the configuration described above, the authentication data update processing means updates the authentication data at the end of communication by the communication means. Even if an unauthorized electronic control device is installed based on the authentication data wiretapped during the previous communication, the authentication control means identifies the authentication data as unauthorized.

  As described above, according to the present invention, even when the electronic control device is illegally exchanged by avoiding the identification of authentication data due to theft of the electronic control device or wiretapping of communication between the electronic control devices. An electronic control device capable of detecting fraud can be provided.

Hereinafter, an electronic control device (hereinafter referred to as ECU) according to the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram schematically showing a main part of a system configured to include a vehicle ECU according to a first embodiment of the present invention. In the figure, reference numeral 10 denotes an engine ECU for controlling the fuel injection and ignition timing of the vehicle engine, 20 denotes a handle ECU for controlling the vehicle handle, and 30 denotes a wiper ECU for controlling the vehicle wiper. Show.

  In the figure, reference numeral 40 denotes a battery, 41 denotes an ignition switch, and 43 denotes a power supply relay that switches whether or not power is supplied to the engine ECU 10.

  When the ignition switch 41 is switched from OFF to ON, electric power is supplied to each of the engine ECU 10, the handle ECU 20, and the wiper ECU 30, and the engine ECU 10 to which the electric power is supplied turns on the power relay 43.

  On the other hand, when the ignition switch 41 is switched from on to off, the engine ECU 10 transmits the off data indicating that the ignition switch 41 is turned off to each ECU, so that the predetermined ECU to be performed before stopping the power supply to each ECU. Prompt to execute the process. The engine ECU 10 receives a reply indicating that the predetermined process has been completed from all the ECUs, or the predetermined process has been completed in all the ECUs including the engine ECU 10 after a predetermined time has elapsed. Judgment is made and the state of the power supply relay 43 is switched from on to off. When the power supply relay 43 is switched to the off state, power supply to the engine ECU 10, the handle ECU 20, and the wiper ECU 30 is stopped.

  Hereinafter, each ECU will be described.

  The engine ECU 10 includes a microcomputer (hereinafter referred to as a microcomputer) 11 and communication means 12. The microcomputer 11 includes a main control unit 11a that controls engine fuel injection, ignition timing, and the like, and an authentication control unit 11b that serves as an authentication unit that creates, exchanges, and collates authentication information based on authentication data for identifying each ECU. (Hereinafter, the same applies to other authentication control means), a memory 11c that is a storage device for storing authentication information and the like, and an authentication data update processing means 11d for updating authentication data. Note that the memory 11c includes a writable EEPROM, a non-writable ROM, and the like.

  Each of the microcomputers 11, 21, 31 and the navigation device 71 is connected to each other via communication means 12, 22, 32, etc. configured by a CAN bus, and the navigation device 71 transmits and receives data to and from the vehicle service center 72. An antenna 62 of a wireless communication device that performs is connected. Therefore, each microcomputer 11, 21, 31 is configured to be able to communicate with an external vehicle service center 72 via the navigation device 71.

  In the present embodiment, the vehicle system is started after the ignition switch 41 of the vehicle is turned on and electric power is supplied to each ECU or the like. Thereafter, the communication unit 12 is activated, and the communication unit 12 starts communication operations between the microcomputers 11, 21, 31 and the like in the ECUs 10, 20, and 30. Further, when the ignition switch 41 of the vehicle is turned off, the communication end process is performed after the ignition switch 41 is turned off, and the vehicle system is stopped when the power supply relay 43 is turned off.

The main control unit 11a is connected to the sensor 51, the communication unit 12, the memory 11c, and the authentication control unit 11b. Based on various input signals input from the sensor 51, control signals such as engine fuel injection and ignition timing are provided. Are output to respective drive circuits (not shown).

  The authentication control unit 11b is connected to the communication unit 12, the memory 11c, the main control unit 11a, the start sensor 55, and the key sensor 56 (via the switch 14), and communicates with other ECUs and the like via the communication unit 12. After authenticating the authenticity of the data based on the transmitted / received authentication data, the authentication information is created and stored in the EEPROM of the memory 11c, the authentication information is exchanged with the outside via the communication means 12, or the start sensor 55 Authentication is performed at an authentication timing determined by an input signal from the key sensor 56.

If the authentication fails, the authentication control unit 11b gives a signal for temporarily stopping the control to the main control unit 11a, outputs a control signal (fuel cut signal) for implementing a crime prevention measure, and further via the communication unit 12 The authentication failure information is transmitted to the navigation device 71 and the vehicle service center 72. The switch 14 is a switch that can be operated from the outside. If the switch 14 is turned off using a dedicated tool, the authentication function of the engine ECU 10 can be canceled.

  The authentication data update processing unit 11d is connected to the authentication control unit 11b, and is configured to update the authentication data when communication by the communication unit 12 ends. The authentication data will be described later.

  The end of communication is when the vehicle ignition switch 41 is turned off and a request to cut off the supply of power to the communication means 12, 22, 32 is issued. In this case, when there is a request to cut off the supply of power, the power of the communication means 12, 22, 32 is cut off, and the authentication data by the main control units 11a, 21a, 31a, the memories 11c, 21c, 31c, etc. is updated. Configured to process. Alternatively, when there is a request to cut off the supply of power, the authentication data by the main control units 11a, 21a, 31a and the memories 11c, 21c, 31c, etc. is updated, and the power of the communication means 12, 22, 32 is cut off. Configured to process. Further, the end of communication may be a time when there is no communication for a predetermined time. In this case, it is configured to perform processing for updating authentication data by the main control units 11a, 21a, 31a, the memories 11c, 21c, 31c, etc. after a predetermined time has passed without communication.

  The end of communication is an arbitrary or end of each session, and at the end of an arbitrary session or end of each session, authentication data by the main control units 11a, 21a, 31a and the memories 11c, 21c, 31c, etc. It may be configured to perform a process of updating. Here, when the session ends, for example, there is a time when the vehicle is stopped, and when the vehicle is stopped, when the vehicle speed becomes zero due to a signal or the like, or when the vehicle speed is equal to or less than a predetermined speed (for example, 5 km / hour or less). There is a time.

  The handle ECU 20 includes a microcomputer 21 and a communication unit 22. The microcomputer 21 is a storage device that stores a main control unit 21a that controls handling, authentication control means 21b that performs creation, exchange, and verification of authentication information based on authentication data for identifying each ECU, and authentication information. It includes a certain memory 21c and authentication data update processing means 21d for updating authentication data. The memory 21c includes a writable EEPROM and a non-writable ROM.

  The main control unit 21a is connected to the sensor 52, the communication unit 22, the memory 21c, and the authentication control unit 21b. The main control unit 21a performs handling control based on various input signals input from the sensor 52 and drives the control signal to the handle. Output to the circuit.

  The authentication control unit 21b is connected to the communication unit 22, the memory 21c, the main control unit 21a, the start sensor 55, and the key sensor 56 (via the switch 24), and communicates with other ECUs and the like via the communication unit 12. After authenticating the authenticity of the data based on the transmitted / received authentication data, the authentication information is created and stored in the EEPROM of the memory 21c, the authentication information is exchanged with the outside via the communication means 22, or the start sensor 55 Authentication is performed at an authentication timing determined by an input signal from the key sensor 56.

When the authentication fails, the authentication control means 21b gives a signal for temporarily stopping the control to the main control section 21a, outputs a control signal (handle lock signal) for implementing the crime prevention measures, and further via the communication means 22 The authentication failure information is transmitted to the navigation device 71 and the vehicle service center 72. The switch 24 is a switch that can be operated from the outside. If the switch 24 is turned off using a dedicated tool, the authentication function of the handle ECU 20 can be canceled.

  The authentication data update processing unit 21d is connected to the authentication control unit 21b, and is configured to update the authentication data when communication by the communication unit 12 ends. The authentication data will be described later.

  The wiper ECU 30 includes a microcomputer 31 and communication means 32. The microcomputer 31 stores a main control unit 31a that controls the operation of the wiper, an authentication control unit 31b that creates, exchanges, and collates authentication information based on authentication data for identifying each ECU, and a memory that stores the authentication information. It includes a memory 31c, which is a device, and authentication data update processing means 31d for updating authentication data. Note that the memory 31c includes a writable EEPROM and a non-writable ROM.

  The main control unit 31a is connected to the sensor 53, the communication unit 32, the memory 31c, and the authentication control unit 31b, performs control based on the input signal from the sensor 53, and outputs the control signal to the drive circuit of the wiper. It is configured.

  The authentication control unit 31b is connected to the communication unit 32, the memory 31c, the main control unit 31a, the start sensor 55, and the key sensor 56 (via the switch 34), and communicates with other ECUs and the like via the communication unit 32. After authenticating the authenticity of the data based on the transmitted / received authentication data, the authentication information is created and stored in the EEPROM of the memory 31c, the authentication information is exchanged with the outside via the communication means 32, or the start sensor 55 Authentication is performed at an authentication timing determined by an input signal from the key sensor 56.

If the authentication fails, the authentication control means 31b gives a signal for temporarily stopping the control to the main control section 31a, outputs a control signal (wiper operation signal) for implementing a security measure, and further via the communication means 32 The authentication failure information is transmitted to the navigation device 71 and the vehicle service center 72. The switch 34 is a switch that can be operated from the outside. If the switch 34 is turned off using a dedicated tool, the authentication function can be canceled.

  The authentication data update processing unit 31d is connected to the authentication control unit 31b, and is configured to update the authentication data when communication by the communication unit 12 ends. The authentication data will be described later.

  The engine ECU 10, the handle ECU 20, and the wiper ECU 30 authenticate each other, the engine ECU 10 selects a monitoring destination from the handle ECU 20 and the wiper ECU 30, and the handle ECU 20 selects a monitoring destination from the engine ECU 10 and the wiper ECU 30. The wiper ECU 30 selects a monitoring destination from the engine ECU 10 and the handle ECU 20. Furthermore, the monitoring destination selection order in each ECU is set in advance so that the monitoring destination of each ECU does not overlap.

  When the ignition switch 41 is turned off and off data indicating that the ignition switch 41 is turned off is received from the engine ECU 10, each ECU executes predetermined processing, that is, authentication data update processing, to the authentication data update processing means 11d, 21d, 31d. Let The updated authentication data is stored in the memory, and the authentication data of the monitoring destination is acquired from the monitoring destination selected based on the set selection order via the CAN bus and stored in the memory, and then the communication is terminated.

When the engine ECU 10 recognizes that the update process has been completed in all the ECUs, the engine ECU 10 switches off the power supply relay 43 to stop the system.

The authentication is performed when the next authentication condition is satisfied (for example, when it is detected that the ignition switch is turned on).

  The authentication data is for identifying each ECU. Here, a variable code (for example, ABC) in which A, B, and C are combined in a random number method or a sequence method, and a fixed number (for example, for example) Authentication data (for example, “ABC10”) composed of a numeric number) is employed.

  For example, as shown in FIG. 2a, in the first authentication, the engine ECU 10 selects the handle ECU 20 as a monitoring destination, and stores its own authentication data (ABC10) and authentication data (BCA20) of the handle ECU 20. . The handle ECU 20 selects the wiper ECU 30 as a monitoring destination, and stores its own authentication data (BCA20) and authentication data (ABC30) of the wiper ECU 30. The wiper ECU 30 selects the engine ECU 10 as a monitoring destination, and stores its own authentication data (ABC30) and authentication data (ABC10) of the engine ECU 10.

  In the second authentication, as shown in FIG. 2b, the engine ECU 10 changes the wiper ECU 30 to a monitoring destination and stores the updated authentication data (BCA10) and the wiper ECU 30 authentication data (ACB30). Yes. The handle ECU 20 stores the updated authentication data (BAC20) and authentication data (BCA10) of the engine ECU 10 by changing the engine ECU 10 to a monitoring destination. The wiper ECU 30 changes the handle ECU 20 to a monitoring destination, and stores updated authentication data (ACB30) of itself and authentication data (BAC20) of the handle ECU 20.

  Next, based on the flowcharts shown in FIG. 3 to FIG. 5, authentication processing operations respectively performed by the engine ECU 10, the handle ECU 20, and the wiper ECU 30 will be described.

First, based on FIG. 3, a process for creating authentication information performed by the engine ECU 10, the handle ECU 20, and the wiper ECU 30 will be described.

Each of the ECUs starts a process for creating authentication information after the previous authentication is normally completed. First, in step S1, its own authentication data is updated and stored in its own EEPROM, and then the process proceeds to step S2. In step S2, a monitoring destination is selected according to a preset selection order (for example, the order shown in FIG. 2a), and then the process proceeds to step S3. In step S3, an authentication data transmission request is transmitted to the selected monitoring destination, and then the process proceeds to step S4.

In step S4, it is determined whether or not a request for transmitting own authentication data has been received from a monitor who has selected himself as the monitoring destination. If it is determined that the transmission request has not been received, the process jumps to step S6, If it is determined that the transmission request has been received, the process proceeds to step S5. In step S5, the self-authentication data is transmitted to the supervisor, and then the process jumps to step S7.

On the other hand, in step S6, it is determined whether or not a predetermined time T1 (for example, 1 second) has elapsed. If it is determined that 1 second has not elapsed, the process returns to step S4, and on the other hand, it is determined that 1 second has elapsed. If so, the process proceeds to step S7. In step S7, it is determined whether or not the monitoring destination authentication data has been received. If it is determined that the monitoring destination authentication data has not been received, the process jumps to step S9, and on the other hand, the monitoring destination authentication data has been received. If it is determined, the process proceeds to step S8.

In step S8, the address of the supervisor and the authentication data of the monitoring destination are stored in their own EEPROMs, and the processing operation is terminated. On the other hand, in step S9, it is determined whether or not a predetermined time T2 (for example, 5 seconds) has elapsed. When it is determined that 5 seconds have not elapsed, the process returns to step S7, and on the other hand, it is determined that 5 seconds have elapsed. If so, the process proceeds to step S10. In step S10, information that a communication failure has occurred with the monitoring destination is transmitted to the navigation device 71, and then the processing operation is terminated.

  Next, an authentication process performed in each of the engine ECU 10, the handle ECU 20, and the wiper ECU 30 will be described with reference to FIG.

When each ECU receives a key insertion signal from the key sensor 56, the ECU proceeds to step 22 (step 21). In step S22, the self-authentication data is transmitted to the supervisor, and then the process proceeds to step S23.

In step S23, it is determined whether the monitoring destination authentication data has been received. If it is determined that the monitoring destination authentication data has not been received, the process jumps to step S25, and on the other hand, the monitoring destination authentication data has been received. If so, the process proceeds to step S24. In step S24, the received authentication data of the monitoring destination is collated with the authentication data of the monitoring destination stored in the respective EEPROM, and then the process proceeds to step S27.

In step S27, it is determined whether or not the collation is matched. If it is determined that they match, the process jumps to step S29, and if it is determined that they do not match, the process proceeds to step S28. In step S28, the name of the monitoring destination is recorded in the array F2 in which the ECUs that have failed in authentication are recorded, and then the process proceeds to process C.

On the other hand, in step 25, it is determined whether or not a predetermined time T3 (for example, 1 second) has elapsed. If it is determined that 1 second has not elapsed, the process returns to step S23, and on the other hand, it is determined that 1 second has elapsed. If so, the process proceeds to step S26. In step S26, the name of the monitoring destination is recorded in the array F1 storing the ECUs in which the communication abnormality has occurred, and then the process proceeds to process C.

On the other hand, in step S29, normal control for controlling the vehicle is permitted (that is, control of each main control unit is started), and then the process proceeds to step S30. In step S30, after elapse of a predetermined time T2 (for example, 5 minutes), the process proceeds to process A (FIG. 3).

  Next, based on FIG. 5, the security process which engine ECU10, handle ECU20, and wiper ECU30 each perform is demonstrated.

First, in step S31, a crime prevention control signal is output (in the case of the engine ECU 10, a fuel cut signal is output, in the case of the handle ECU 20, a handle lock signal is output, and in the case of the wiper ECU 30, a wiper operation signal is output), Thereafter, the process proceeds to step S32.

In step S32, it is determined whether or not there is a record in the array F1. If it is determined that there is no record in the array F1, the process jumps to step S35, whereas if it is determined that there is a record in the array F1, the process proceeds to step S33. In step S33, the ECU communication abnormality information recorded in the array F1 is transmitted to the navigation device 71, and then the process proceeds to step S34. In step S34, the ECU communication abnormality information recorded in the array F1 is transmitted to the vehicle service center 72, and then the process proceeds to step S35.

In step S35, information that the ECU recorded in the array F2 has failed in authentication is transmitted to the navigation device 71, and then the process proceeds to step S36. In step S36, information that the ECU recorded in the array F2 has failed in authentication is transmitted to the vehicle service center 72, and then the process proceeds to step S37.

In step S37, it is determined whether or not a security release signal has been received from the vehicle service center 72. If it is determined that a security release signal has been received, the process proceeds to step S39. On the other hand, if it is determined that a security release signal has not been received, Proceed to step S38.

In step S38, it is determined whether or not a predetermined time T4 (for example, 5 minutes) has elapsed. If it is determined that 5 minutes have not elapsed, the process returns to step S37, and if it is determined that 5 minutes have elapsed. The processing operation is terminated.

On the other hand, in step S39, normal control for controlling the vehicle is permitted, and then the process proceeds to step S40. In step S40, the output of the security control signal is stopped, and then the processing operation is terminated.

  On the other hand, in the navigation device 71, when communication abnormality information or authentication failure information is received from any of the engine ECU 10, the handle ECU 20, and the wiper ECU 30, the ECU or authentication in which communication abnormality has occurred in the form of screen output and / or voice output. The information of the ECU that failed is output.

  Further, in the vehicle service center 72, when communication abnormality information or authentication failure information is received from any of the engine ECU 10, the handle ECU 20, and the wiper ECU 30, for example, the situation is confirmed by contacting the vehicle owner, and the crime prevention is canceled. Is approved, a security release signal is sent to the ECU that has sent the communication abnormality information or the authentication failure information.

  Further, the authentication data update processing means 11d, 21d, and 31d are configured to include initialization means 111d, 211d, and 311d for initializing the authentication data.

Specifically, each ECU is provided with a terminal for connecting an external diagnostic tool for diagnosing the ECU by transmitting a command from the outside, and initialization means 111d (or 211d, 311d) is connected from the connected external diagnostic tool. When the initialization command for the authentication data is transmitted, the initialization unit 111d (or 211d, 311d) that has received the initialization command changes the stored authentication data to the initial value at the time of shipment of each ECU.

  Providing the initialization means 111d, 211d, 311d has the following effects. In other words, the authentication data is caused by the fact that the authentication code has become a value different from the normal state due to a write error to the memory, a read error from the memory, or the like, even though the ECU has not been illegally replaced. Even if an unexpected situation occurs that makes it impossible to authenticate based on the vehicle, or when a vehicle that has been exchanged for an unauthorized ECU that differs only in the authentication code is to be operated normally without being replaced with the original ECU Since the authentication data can be returned to the initial value by the initialization means 111d, 211d, 311d, it is possible to quickly and easily escape from the unexpected situation.

  In the first embodiment, in order to reduce the number of communications, the monitoring destination selection order in each ECU is set in advance so that the monitoring destination of each ECU does not overlap. Then, you may make it make each ECU select the monitoring destination by a random number system.

  In the first embodiment, the engine ECU 10, the handle ECU 20, and the wiper ECU 30 are equipped with authentication control means. The control output in each ECU is stopped, the fuel cut by the engine ECU 10, the handle lock by the handle ECU 20, and the wiper ECU 30. Although the wiper operation is used as a security measure, in another embodiment, the other ECU of the vehicle is equipped with authentication control means, and the hazard lamp, tail lamp, fog lamp, room lamp lights or blinks, horn operation, throttle opening Restrictions or vehicle speed restrictions may be adopted as security measures.

  In the first embodiment, each ECU is set to select a monitoring destination. However, in another embodiment, each ECU may be set to select a monitor. .

  In the first embodiment, when it is determined that the authentication data of the monitoring destination received in advance matches the authentication data of the monitoring destination received at the time of authentication, it is set to determine that the authentication is successful. However, in another embodiment, conversion processing is performed on the monitoring destination authentication data received in advance, and the converted authentication data has a predetermined relationship with the monitoring destination authentication data received at the time of authentication. When it is determined, it may be set to determine that the authentication is successful. In another embodiment, if it is determined that the deviation is within a predetermined range even if the monitoring destination authentication data received in advance and the monitoring destination authentication data received at the time of authentication do not completely match, It may be set so that it is determined that the above has succeeded.

  FIG. 6 is a block diagram schematically showing a main part of a system including a vehicle ECU according to the second embodiment of the present invention. The description of the same components as the system configuration (FIG. 1) in the first embodiment described above is omitted here.

  Unlike the first embodiment, the navigation device 71 is connected to a start sensor 55 and a key sensor 56 (via a switch 44). The ECU of the navigation device 71 (not shown, hereinafter referred to as a navigation ECU). ) Is provided with an authentication control means. The switch 44 is a switch that can be operated from the outside. When the switch 44 is turned off using a dedicated tool, the authentication function of the navigation device 71 is canceled.

  In the present embodiment, when the key insertion signal is turned on, the first power relay 43a is turned on, power is supplied to each ECU to start the system, and when the key insertion signal is turned off, the engine ECU 10 The second power supply relay 43 for self-holding is turned off and the system is stopped. Similar to the previous embodiment, the communication means is configured to start when the system is started and to end when the system is stopped.

  FIG. 7 is a diagram showing a vehicle service center 72 according to the second embodiment of the present invention. As shown in FIG. 7, the vehicle service center 72 creates storage means 721 for storing information including the ECU regular program and ROMSUM in the registered vehicle 80 and ECU authentication information in the vehicle. Authentication management means 722 and communication means 723 for communicating with the vehicle.

  The authentication management means 722 periodically updates the ECU authentication information (authentication data of each ECU, authentication relationship) in the vehicle 80 and transmits it to each ECU via the communication means 723, while the vehicle 80 fails in authentication. When the information of the ECU is received, the ROMSUM of the ECU that has failed in authentication is obtained, and the ROMSUM of the ECU registered in advance is checked. If they match, a security release signal is transmitted to each ECU, If they do not match, the ECU is configured to send the ECU's registered regular control program to the ECU for installation.

  The term “upper period” means, for example, that the authentication information is updated once a week. In this case, the key insertion signal of the vehicle 80 is switched from on to off for the first time since one week has passed since the last update. The authentication information is updated when switched to.

  FIG. 8 is a diagram illustrating an example when the vehicle service center 72 transmits authentication information to each ECU. As shown in FIG. 8, the vehicle service center 72 uses authentication information (authentication data: ABC10, monitor: navigation ECU and ECU 30, monitor destination: ECU 20, monitor destination authentication data: BCA20 created for the engine ECU 10. ) Is transmitted to the engine ECU 10, and authentication information (authentication data: BCA20, monitoring person: ECU10, monitoring destination: navigation ECU, monitoring destination authentication data: ABC72) created for the steering wheel ECU 20 is transmitted to the steering wheel ECU 20, The authentication information (authentication data: ABC30, monitoring person: navigation ECU, monitoring destination: ECU10, monitoring destination authentication data: ABC10) created for the wiper ECU 30 is transmitted to the wiper ECU 30, and created for the navigation ECU. Authentication information (authentication data: ABC72, monitoring person: ECU20, monitoring destination: CU10 and ECU30, the monitoring destination of the authentication data: ABC10 and ABC30) and transmits to the navigation ECU.

  On the other hand, when the engine ECU 10, the handle ECU 20, the wiper ECU 30, and the navigation ECU receive new authentication information from the vehicle service center 72, the new authentication information is stored in their own EEPROMs.

  Next, based on the flowcharts shown in FIGS. 9 and 10, the authentication processing operation and the crime prevention processing operation performed by the engine ECU 10, the handle ECU 20, the wiper ECU 30, and the navigation ECU will be described.

As shown in FIG. 9, when a key insertion signal is received in step S61, the process proceeds to step S62. In step S62, the user's own authentication data stored in their own EEPROM is transmitted to the designated supervisor, and then the process proceeds to step S63.

In step S63, it is determined whether or not authentication data for the designated monitoring destination has been received. If it is determined that authentication data for the designated monitoring destination has not been received, the process returns to step S63, while the designated monitoring destination authentication data has not been received. If it is determined that the authentication data of the monitoring destination has been received, the process proceeds to step S64.

In step 64, the received authentication data of the monitoring destination is collated with the authentication data of the monitoring destination stored in the respective EEPROM, and then the process proceeds to step S65. In step S65, the collation result is transmitted to another ECU, and then the process proceeds to step S66.

In step S66, it is determined whether or not the verification results of all the ECUs have been received. If it is determined that the verification results of all the ECUs have been received, the process jumps to the process F, and on the other hand, the verification results of all the ECUs are received. If not, the process proceeds to step S67. In step S67, it is determined whether or not a predetermined time T2 (for example, 1 second) has elapsed, and when it is determined that 1 second has not elapsed, the process returns to step S66, while when it is determined that 1 second has elapsed The process proceeds to process F.

  Next, the process F is demonstrated based on FIG.

As shown in FIG. 10, in step S71, an authentication result for each ECU is determined based on a collation result received from another ECU. When there are a plurality of monitors at the same monitoring destination, it is determined that the monitoring destination has succeeded in authentication only when the collation results by a predetermined number (for example, half) or more of the monitoring targets match.

Subsequent to step S71, in step S72, it is determined whether there is an ECU that has failed in authentication. If it is determined that there is no ECU that has failed in authentication, the process proceeds to step S73, while the ECU that has failed in authentication. If it is determined that exists, the process proceeds to step S74.

In step S74, a crime prevention control signal is output (in the case of the engine ECU 10, a fuel cut signal is output, in the case of the handle ECU 20, a handle lock signal is output, in the case of the wiper ECU 30, a wiper operation signal is output, and the navigation ECU In this case, the authentication failure information is output on the display screen or by voice guidance), and then the process proceeds to step S75.

In step S75, it is determined whether the ECU that has failed in authentication is its own monitoring destination. If it is determined that the ECU that has failed in authentication is not its own monitoring destination, the process jumps to step S77, and on the other hand, the authentication fails. If the determined ECU determines that it is the monitoring destination of itself, the process proceeds to step S76.

In step S76, information of authentication failure is transmitted to the vehicle service center 72, and then the process proceeds to step S77. In step S77, it is determined whether or not a ROMSUM transmission request has been received from the vehicle service center 72. If it is determined that a ROMSUM transmission request has not been received, the process jumps to step S81 while receiving a ROMSUM transmission request. If it is determined that the process has been performed, the process proceeds to step S78.

In step S78, ROMSUM is transmitted to the vehicle service center 72, and then the process proceeds to step S79. In step S79, it is determined whether or not a control program has been received from the vehicle service center 72. If it is determined that the control program has not been received, the process jumps to step S81, whereas if it is determined that the control program has been received, Proceed to step S80. In step S80, the current control program is updated with the received control program, and then the processing operation is terminated.

On the other hand, in step S81, it is determined whether a security release signal has been received from the vehicle service center 72. If it is determined that a security release signal has not been received, the process returns to step S77, and on the other hand, it has been determined that a security release signal has been received. If so, the process proceeds to step S82.

In step S82, normal control for controlling the vehicle is permitted (that is, control of each main control unit is started), and then the process proceeds to step S83. In step S83, the output of the crime prevention control signal is stopped, and then the processing operation is ended. On the other hand, in step S73, normal control for controlling the vehicle is permitted, and then the processing operation is terminated.

  Note that in the ECU according to the second embodiment, the engine ECU 10, the handle ECU 20, the wiper ECU 30, and the navigation ECU are equipped with authentication control means 11b, 21b, 31b. Although it is a security measure to output authentication failure information by fuel cut, handle lock by the handle ECU 20, wiper operation by the wiper ECU 30, screen display of the navigation device or voice guidance, in another embodiment, it is authenticated to another ECU of the vehicle Control means may be provided, and hazard lamps, tail lamps, fog lamps, lighting or blinking of room lamps, horn operation, throttle opening restriction, or vehicle speed restriction may be employed as security measures.

  In the second embodiment, when it is determined that the monitoring destination authentication data received in advance matches the monitoring destination authentication data received at the time of authentication, the authentication is set to be determined as successful. However, in another embodiment, conversion processing is performed on the monitoring destination authentication data received in advance, and the converted authentication data has a predetermined relationship with the monitoring destination authentication data received at the time of authentication. When it is determined, it may be set to determine that the authentication is successful. In another embodiment, if it is determined that the deviation is within a predetermined range even if the monitoring destination authentication data received in advance and the monitoring destination authentication data received at the time of authentication do not completely match, It may be set so that it is determined that the above has succeeded.

  The block diagram schematically showing the main part of the system configured to include the vehicle ECU according to the third embodiment of the present invention is the configuration of the system in the first embodiment (FIG. 1). The authentication data is authenticated by the authentication control means 11b, 21b, 31b, and the contents of the authentication data updated in the authentication data update processing means 11d, 21d, 31d are different.

  That is, in the first embodiment, the authentication data is authentication data that can uniquely identify each ECU, whereas in the third embodiment, the authentication data is communication means 12, 22. , 32 is ID data indicating the attribute of data transmitted and received and the communication priority.

  The data attribute indicates the type of data such as the engine speed and water temperature required for the destination ECU to execute a predetermined process.

  The communication priority data indicates that when the ID data is represented by a numerical value, the priority is set higher as the ID data is smaller or larger. For example, data is transmitted simultaneously from a plurality of ECUs. When the data collides on the bus, the ID data is small (large), that is, data is transmitted with priority from the ECU set with a high priority, and the ID data is large (small), that is, The ECU with the lower priority set is data for arbitrating so that the transmission process is suspended until the transmission process of the ECU with the higher priority set is completed.

  Further, as shown in FIG. 11, the ID data is read from the EEPROM of each ECU at the start of communication, and the transmission ID storage means 121, 221 and 321 provided in the communication means 12, 22, and 32 and the reception ID storage. Each of the transmission IDs and reception IDs set in the means 122, 222, and 322 is configured, and the communication means 12, 22, and 32 receive data in the reception ID storage means 122, 222, and 322 when data is received. It is determined whether or not to receive the received data by collating the stored reception ID of the ECU with the transmission ID of the transmission source included in the received data.

  For example, the transmission ID (= 100) transmitted from the communication means 22 of the handle ECU 20 is received by the engine ECU 10 because it is included in the reception ID of the EEPROM of the engine ECU 10. On the contrary, the data transmitted from the communication unit 12 of the engine ECU 10 is not received by the handle ECU 20 because any transmission ID stored in the EEPROM of the engine ECU 10 is not included in the reception ID of the communication unit 22 of the handle ECU 20. .

  As described above, in the third embodiment, since the contents of the authentication data are different from those in the first embodiment, the authentication data update processing means 11d, 21d, 31d are authenticated at the end of communication by the communication means 12. Although updating the data is the same, the authentication data is updated by a method different from that of the first embodiment.

This will be described in detail below. In the following description, the authentication data update processing unit 11d will be described, but the other authentication data update processing units 21d and 31d have the same configuration.

  The authentication data update processing unit 11d is configured to update the authentication data before the update to new authentication data based on a predetermined authentication data generation function using variable data different from that at the time of updating the authentication data before the update as a variable. Has been.

The authentication data generation function is a predetermined hash function f () as shown in [Equation 1], and the authentication data update processing means 11d applies new data to the hash function f () by applying the fluctuation data. ID2 is calculated.

  Here, the fluctuation data is the current authentication data ID1, the vehicle position d1 represented by the latitude and longitude acquired by GPS, the cumulative travel distance d2, the time d3, etc. The data other than the authentication data ID1 is the previous data This is arbitrary data that has fluctuated since the generation of the authentication data ID1.

  Further, as an example of the hash function f (), MD5 that generates 128-bit arbitrary data using a value obtained by adding the vehicle position d1, the cumulative travel distance d2, the time d3, and the previous authentication data ID1 as a variable is used. A function can be used, and a predetermined number of bits from the LSB of the calculated hash value can be used as the next authentication data ID2.

  Further, all the ECUs are configured to acquire the same variation data. For example, the cumulative travel distance d2 is transmitted from a specific ECU counting the cumulative travel distance d2 to all other ECUs in the vehicle. Sent.

  Furthermore, the updated ID data is configured such that there is no change in the communication priority before and after the update.

  For example, the authentication data update processing means 11d, 21d, and 31d store the communication priority for all ID data before update in a temporary storage means (not shown) such as RAM, and update all the ID data. Is stored in the temporary storage means without corresponding to each ECU before update. Then, after the update ID data stored in the temporary storage means is rearranged based on the communication priority order stored in advance, the ID data having the same rank as before the update is sent to each ECU. Assign.

  As another example, the authentication data update processing means 11d, 21d, and 31d are configured to perform recalculation when the updated ID data does not maintain the same priority before update. In the calculation, different authentication data generation function, travel distance from the start of the previous communication, and data including only the longitude and / or the latitude of the current position are used.

  By applying different fluctuating data each time to the authentication data generation function that calculates irregular data such as a hash function, the authentication data is updated to new authentication data. It is possible to make it difficult to specify authentication data by eavesdropping on communication.

  Next, a transmission ID and reception ID update process performed by the engine ECU 10, the handle ECU 20, and the wiper ECU 30 at the end of communication will be described based on the flowchart of FIG.

First, in step S61, the authentication data update processing means 11d, 21d, 31d of each ECU acquires fluctuation data such as the vehicle position d1 and the cumulative travel distance d2 from any ECU of the vehicle.

In step S62, the authentication data update processing means 11d, 21d, 31d of each ECU reads out the reception ID used during the current communication operation from its own EEPROM or reception ID storage means 122, 222, 322.

  In step S63, the authentication data update processing means 11d, 21d, 31d of each ECU reads out the transmission ID used during the current communication operation from its own EEPROM or transmission ID storage means 121, 221 and 321.

In step S64, the authentication data update processing means 11d, 21d, 31d of each ECU reads the authentication data generation function f () used from the ROM of its own memory 11c, 21c, 31c.

In step S65, the authentication data update processing means 11d, 21d, 31d of each ECU applies the read fluctuation data and transmission ID to the authentication data generation function f () to perform calculation, so that it can be used from the start of the next communication. A new transmission ID to be used is calculated, and a new reception ID to be used from the start of the next communication is calculated by applying the read variation data and the reception ID to the authentication data generation function f () and calculating them. . In step S65, the transmission ID and the reception ID are applied to [Equation 1] as authentication data ID1, respectively.

In step S66, the new transmission ID and reception ID calculated by the authentication data update processing means 11d, 21d, 31d of each ECU are stored in their own EEPROM.

At the start of the next communication, the authentication data update processing means 11d, 21d, 31d of each ECU reads the transmission ID and the reception ID stored in step 65 of FIG. 221 and 321 and the reception ID storage means 122, 222 and 322.

  By using the third embodiment, when an unauthorized ECU is mounted on the vehicle, data transmission / reception between the unauthorized ECU and another ECU becomes impossible, so that the vehicle operates normally. Therefore, it is not necessary to separately provide a means for authenticating each ECU in each ECU.

  In the third embodiment, the configuration in which the transmission ID and the reception ID are updated at the end of communication has been described. However, the timing for updating the transmission ID and the reception ID is not limited to this. For example, the configuration may be such that the reception ID (transmission ID) is updated at the end of communication and the transmission ID (reception ID) is updated at the start of communication, or the transmission ID and reception ID are updated only at the start of communication.

  In the third embodiment, the ID data has been described with respect to the data attribute and the communication priority. However, the ID data may have only the data attribute or the communication priority. Good.

  In the third embodiment, the transmission ID storage means 121, 221 and 321 and the reception ID storage means 122, 222 and 322 have been described as updating all transmission IDs and reception IDs. Alternatively, only a part of the transmission ID and reception ID may be updated, and the other transmission ID and reception ID may be fixed values.

  At this time, it is desirable that the transmission ID and reception ID that are fixed values are configured such that the communication priority is the maximum or minimum order, and such a configuration is, for example, the maximum order (minimum order). By setting the ID data to be set to “1” or “0” (“0” or “1”) from the MSB to the LSB of each address in the memories 11c, 21, and 31c, or by setting these values in the vicinity. Realized.

  In the third embodiment, the authentication data update processing units 11d, 21d, and 31d have been described with reference to a configuration in which authentication data is updated to new authentication data based on a specific authentication data generation function. The update processing units 11d, 21d, and 31d include a plurality of authentication data generation functions that generate new authentication data using variable data different from the update time of the authentication data before update, and the update time of the authentication data before update. Includes a selection function for selecting any one of the plurality of authentication data generation functions using different variation data as a variable, and the authentication data is newly authenticated based on the authentication data generation function selected based on the selection function. It may be configured to update to data.

More specifically, a plurality of authentication data generation functions (f1 () to fn ()) are stored together with an identification number N in the ROMs of the memories 11c, 21c, and 31c of each ECU. Whether to use the authentication data generation function is selected by a selection function g () which is a hash function as shown in [Equation 2].

Here, the variation data is the current authentication data ID1, the vehicle position d1 represented by the latitude and longitude acquired by the GPS, the cumulative travel distance d2, the time d3, etc., as in the third embodiment. Data other than the data ID1 is arbitrary data that has fluctuated since the last generation of the authentication data ID1.

Also, as an example of the selection function g (), a hash value having a predetermined number of bits is calculated using the total value obtained by adding the vehicle position d1, the cumulative travel distance d2, the time d3, and the previous authentication data ID1 as a variable. A hash function or the like can be employed, and the last one digit of the obtained hash value can be obtained as the identification number N.

  Next, based on the flowcharts of FIGS. 13A and 13B, the transmission ID and reception ID update processing performed by the engine ECU 10, the handle ECU 20, and the wiper ECU 30 at the end and start of communication, respectively, will be described. FIG. 13A describes the reception ID update process at the end of communication, and FIG. 13B describes the transmission ID update process at the start of communication.

  The authentication data update process at the end of communication will be described below with reference to FIG.

First, in step S81, the authentication data update processing means 11d, 21d, 31d of each ECU acquires fluctuation data such as the vehicle position d1 and the cumulative travel distance d2 from any ECU of the vehicle. In step 82, the authentication data update processing means 11b, 21b, 31b of each ECU reads out the reception ID used during the current communication operation from its own EEPROM or reception ID storage means 122, 222, 322, and in step S83. By using the selection function g (), the authentication data update processing means 11d, 21d, 31d of each ECU uses a plurality of authentication data generation functions (f1 () stored in the ROMs of the respective memories 11c, 21c, 31c. ) To fn ()), one authentication data generation function is selected.

In step S84, the authentication data update processing means 11d, 21d, 31d of each ECU applies the fluctuation data and the reception ID to the authentication data generation function f () read out in step S83 to calculate the next communication. A new reception ID to be used from time is calculated. In step S84, the received ID is applied to [Equation 1] as authentication data ID1.

In step S85, one authentication data generation function selected in step S83 is stored in the EEPROM. In step S86, the new reception ID calculated by the authentication data update processing means 11d, 21d, 31d of each ECU is stored in its own EEPROM. In step S87, the transmission ID used during the current communication operation is stored. Store it in its own EEPROM.

  The authentication data update process at the start of communication will be described below with reference to FIG.

First, in step S91, the authentication data update processing means 11d, 21d, 31d of each ECU acquires fluctuation data such as the vehicle position d1 and the accumulated travel distance d2 from any ECU of the vehicle. In step S92, the authentication data update processing means 11d, 21d, 31d of each ECU reads out the reception ID used during the current communication operation stored in step S86 of FIG. 13A from its own EEPROM, and in step S93. The received reception ID is stored in the reception ID storage means 122, 222, 322.

In step S94, the authentication data update processing means 11d, 21d, 31d of each ECU reads the authentication data generation function f () stored in step S85 of FIG. 13A from its own EEPROM. In step S95, the authentication data update processing means 11d, 21d, 31d of each ECU reads the transmission ID used during the previous communication operation stored in step S87 of FIG. 13A from its own EEPROM.

In step S96, the authentication data update processing means 11d, 21d, 31d of each ECU applies the read fluctuation data and transmission ID to the authentication data generation function to calculate the new data to be used from the start of the current communication. A transmission ID is calculated. In step S96, the transmission ID is applied to [Equation 1] as authentication data ID1.

In step S97, the new transmission ID calculated by the authentication data update processing means 11d, 21d, 31d of each ECU is stored in the transmission ID storage means 121, 221 and 321.

  In the third embodiment, the ID data indicating the attribute of the data transmitted and received by the communication means 12, 22, and 32 and the communication priority is composed of the transmission ID and the reception ID, and the transmission ID and the reception ID. Are described in the transmission ID storage means 121, 221, 321 and the reception ID storage means 122, 222, 322, but are not limited thereto. In another example shown below, a different part from the said 3rd Embodiment is explained in full detail.

  In this example, as shown in FIG. 15, a list of ID data used in this vehicle is stored in the EEPROM of the memories 11c, 21c, and 31c in each ECU. Although the same list is stored in each ECU, the ID data assigned to the transmission ID and the reception ID among the ID data in the list is set to different ID data for each ECU, so that each ECU has a different ID. Configured to set data.

  The ID data update process in this example will be described in detail below. The ID data list is temporarily copied to the RAM (not shown) of the memories 11c, 21c, and 31c when the ID data is updated, and each ID data in the list copied to the RAM is exemplified as follows. An operation is performed to update the ID data.

  As described in the third embodiment, the calculation employs a method of calculating new ID data by applying variable data to a predetermined hash function. Specifically, as shown in FIG. 16A, the variation data is latitude, longitude, cumulative travel distance, previous ID data (transmission ID or reception ID), and the hash function is the variation data in bytes. The calculated hash value is used as new ID data as a function to be divided and added. And it is comprised so that new ID data may be stored in the position before calculation of the said ID data in a list | wrist. When overflow occurs due to the addition of the variation data, the overflow digits are added to the non-overflow as shown in FIG.

When the update of the ID data is completed, the calculated list of ID data is copied from the RAM to the EEPROM.

  In addition, in this example, it is determined whether or not the transmission data of the transmission source is received by checking the timing of performing the update process of the ID data, the matching of the transmission ID of the transmission source and the reception ID of the ECU itself. Similar to the third embodiment, the communication priority is not changed before and after the update of the ID data.

  By adopting the third embodiment, a plurality of authentication data generation functions are provided, and the authentication data generation function is selected after selecting one authentication data generation function by applying different variation data to the selection function each time. By applying different fluctuation data every time, it is updated to new authentication data, so the authentication data can be identified by theft of the electronic control device or wiretapping of communication between each electronic control device. Compared to a configuration having only a generation function, it can be made more difficult.

  In the first to third embodiments, the authentication data described in the first and second embodiments, that is, data for authenticating each ECU itself, and the third embodiment have been described. The configuration may be such that both authentication data, that is, data for identifying data transmitted and received between the ECUs are used. In other words, it is a double fraud that security measures are taken when each ECU itself cannot be authenticated, and that data transmission / reception becomes impossible when data cannot be identified by data transmission / reception between the ECUs. This is a configuration that can take preventive measures.

In the first to third embodiments, the configuration in which the authentication data update processing unit is mounted in all ECUs in the system has been described. However, the authentication data update processing unit is mounted only in some ECUs in the system. It may be a configuration. In this case, the ECU in which the authentication data update processing unit is not mounted is configured such that the authentication data transmitted from the ECU and the authentication data transmitted to the ECU all have fixed values.

  In the first to third embodiments, as shown in FIG. 14 (a), the ECUs have been described as communicating with each other via the CAN bus 61. However, the communication is performed on the CAN bus. Not limited to this, as shown in FIGS. 14B and 14C, a configuration in which the CAN bus 61 and the local signal line 63 are mixed (FIG. 14B), or a configuration having only the local signal line 63 (FIG. 14). (C)).

  In the first to third embodiments, the configuration in which the authentication control unit and the authentication data update processing unit are realized by software has been described. However, the configuration may be realized by hardware. As a configuration by hardware, for example, there is a configuration in which the functions of the authentication control unit and the authentication data update processing unit are realized by an application specific integrated circuit (ASIC).

  Note that the above-described embodiment is merely an example of the present invention, and it is needless to say that the specific configuration and the like of each block can be changed and designed as appropriate within the scope of the effects of the present invention.

The block diagram which showed roughly the principal part of the system comprised including ECU for vehicles which concerns on the 1st Embodiment of this invention. (A) shows the example of the mutual authentication relationship of each ECU which concerns on 1st Embodiment, (b) is explanatory drawing which shows the example of the mutual authentication relationship of each ECU which concerns on 1st Embodiment The flowchart which shows a part of process which each ECU which concerns on 1st Embodiment performs The flowchart which shows a part of process which each ECU which concerns on 1st Embodiment performs The flowchart which shows a part of process which each ECU which concerns on 1st Embodiment performs The block diagram which showed roughly the principal part of the system comprised including ECU for vehicles which concerns on the 2nd Embodiment of this invention. The block diagram which shows the vehicle service center which concerns on 2nd Embodiment Explanatory drawing which shows the example which the vehicle service center which concerns on 2nd Embodiment transmits authentication information to each ECU. The flowchart which shows a part of process which each ECU which concerns on 2nd Embodiment performs The flowchart which shows a part of process which each ECU which concerns on 2nd Embodiment performs Explanatory drawing which shows a transmission ID storage means and a reception ID storage means The flowchart which shows the update process of the authentication data at the time of completion | finish of the communication based on 3rd Embodiment (A) shows the update processing of authentication data at the end of communication according to a form having a plurality of authentication data generation functions and selection functions, and (b) has a plurality of authentication data generation functions and selection functions. The flowchart which shows the update process of the authentication data at the time of the start of the communication which concerns on a form (A) schematically shows a main part of a system configured such that each ECU communicates via a CAN bus, and (b) illustrates that each ECU communicates with the CAN bus via a local signal line. FIG. 2C is a block diagram schematically showing a main part of a system configured such that each ECU communicates via a local signal line. Explanatory diagram showing a list of ID data (A) shows calculation of ID data update processing, and (b) is an explanatory diagram showing processing when an overflow occurs in FIG.

Explanation of symbols

10: Engine ECU
20: Handle ECU
30: Wiper ECU
11, 21, 31: microcomputers 11a, 21a, 31a: main control units 11b, 21b, 31b: authentication control means 11c, 21c, 31c: memories 11d, 21d, 31d: authentication data update processing means 111d, 211d, 311d: initial Means 12, 22, 32, 723: communication means 14, 24, 34: switches 121, 221, 321: transmission ID storage means 122, 222, 322: reception ID storage means 40: battery 41: ignition switch 43: power relay 43a: first power relay 44: switches 51 to 53: sensor 55: start sensor 56: key sensor 61: CAN bus 62: antenna 63: local signal line 71: navigation device 72: vehicle service center 721: storage means 722: Authentication management means

Claims (5)

  An authentication unit that authenticates the authenticity of data based on authentication data transmitted and received via the communication unit; and an authentication data update unit that updates the authentication data when communication by the communication unit ends. Electronic control device.   The electronic control device according to claim 1, wherein the end of the communication is when there is a request to cut off the supply of power to the communication means.   The authentication data update processing means updates the authentication data to new authentication data based on a predetermined authentication data generation function using variable data different from that at the time of updating the authentication data before update as a variable. The electronic control device described.   The authentication data update processing means is different from a plurality of authentication data generation functions for generating new authentication data using variable data different from that at the time of updating the authentication data before the update, and at the time of updating the authentication data before the update. A selection function that selects any one of the plurality of authentication data generation functions using variable data as a variable is provided, and the authentication data is updated to new authentication data based on the authentication data generation function selected based on the selection function. The electronic control apparatus in any one of Claim 1 to 3.   The electronic control device according to claim 1, wherein the authentication data is ID data indicating an attribute of data transmitted or received by the communication unit or a communication priority.

Images