JP7423959B2 - vehicle reprogramming system - Google Patents

Description

The present disclosure relates to vehicle reprogramming systems.

Conventionally, various techniques for reprogramming electronic devices mounted on vehicles have been studied.

Japanese Patent Application Publication No. 2014-194688

In the conventional technology as described above, from the viewpoint of security, a computer program for reprogramming is generally provided to an electronic device in an encrypted state. Therefore, with the conventional techniques described above, it is necessary to perform decryption every time a computer program is used, for example, for the purpose of rewriting a computer program and verifying a rewritten computer program, which tends to increase the processing time. .

Therefore, one of the problems of the present disclosure is to provide a vehicle reprogramming system that can realize reprogramming in a shorter time.

A vehicle reprogramming system as an example of the present disclosure includes a plurality of in-vehicle electronic devices installed in a vehicle so as to be connected to an in-vehicle network, and controls communication between the in-vehicle network and external devices outside the vehicle. The second electronic device, which is different from the first electronic device among the plurality of in-vehicle electronic devices, receives information from an external device via the communication control device. decrypts the encrypted computer program for reprogramming the first electronic device, and transmits the decrypted computer program to the first electronic device via the in-vehicle network; When the device receives the decrypted computer program from the second electronic device, the device performs reprogramming based on the decrypted computer program.

According to the vehicle reprogramming system described above, when performing reprogramming, the decoded computer program is transmitted within the vehicle network in which communication between the vehicle network and the outside is controlled by the communication control device. To prevent the transmission of a computer program within a network from being secretly viewed from outside, that is, to transmit a computer program for reprogramming in a decrypted state over an in-vehicle network without compromising security. Therefore, it is not necessary to perform decoding every time a computer program is used for the purpose of rewriting the computer program and verifying the rewritten computer program, so reprogramming can be accomplished in a shorter time.

In the vehicle reprogramming system described above, the communication control device controls the communication path between the in-vehicle network and the external device when the second electronic device receives a reprogramming computer program from the external device via the communication control device. Cut off. According to this configuration, the communication control device blocks the communication path between the in-vehicle network and external devices during reprogramming, thereby preventing access to the in-vehicle network from outside the vehicle, and improving security during reprogramming. can be increased.

Further, in the vehicle reprogramming system described above, when a plurality of computer programs different from each other are received as reprogramming computer programs from an external device via the communication control device, the second electronic device is configured to initiating decryption of the programs, and upon completion of decryption of at least one of the plurality of computer programs, transmitting one of the decrypted computer programs to the first electronic device via the in-vehicle network; Thereafter, each time a predetermined condition is met, the remaining decrypted computer programs are transmitted one by one to the first electronic device via the in-vehicle network, and the first electronic device transmits the decrypted remaining computer programs one by one to the first electronic device. Reprogramming is performed each time a new computer program is received from the second electronic device. According to such a configuration, the first reprogramming is started when the decoding of at least one of the plurality of computer programs for reprogramming is completed, and the remaining computer programs are decoded for the first time (and thereafter). Since the reprogramming can be performed in parallel with the reprogramming, the time required for multiple reprogramming can be further shortened.

Further, in the vehicle reprogramming system described above, the second electronic device has a dedicated control mode for realizing reprogramming of the first electronic device, and another control mode for realizing other functions, It is configured so that it can be switched. According to such a configuration, the resources of the second electronic device can be used efficiently by switching the control mode.

FIG. 1 is an exemplary and schematic block diagram showing the overall configuration of a vehicle reprogramming system according to an embodiment. FIG. 2 is an exemplary and schematic block diagram showing functions realized in the vehicle reprogramming system according to the embodiment. FIG. 3 is an exemplary and schematic diagram showing, in a flow chart manner, the flow of processing that the vehicle reprogramming system according to the embodiment executes during one-time reprogramming. FIG. 4 is an exemplary and schematic diagram showing in a flowchart a part of the process flow that the vehicle reprogramming system according to the embodiment executes during continuous reprogramming. FIG. 5 is an exemplary and schematic diagram showing in a flowchart the flow of processing that the vehicle reprogramming system according to the embodiment executes subsequent to the processing shown in FIG. 4 during continuous reprogramming. . FIG. 6 is an exemplary and schematic block diagram showing the hardware configuration of a computer for realizing the electronic device of the vehicle reprogramming system according to the embodiment.

Hereinafter, some embodiments and modified examples of the present disclosure will be described based on the drawings. The configurations of the embodiments and modified examples described below, as well as the effects and effects brought about by the configurations, are merely examples, and are not limited to the contents described below.

<Embodiment>
FIG. 1 is an exemplary and schematic block diagram showing the overall configuration of a vehicle reprogramming system according to an embodiment.

As shown in FIG. 1, the vehicle reprogramming system according to the embodiment includes a plurality of electronic devices 100 mounted on a vehicle so as to be connected to an in-vehicle network 150. Note that the electronic device can also be expressed as an in-vehicle electronic device.

The plurality of electronic devices 100 include one gateway ECU (Electronic Control Unit) 110 and a plurality of ECUs 120. In the embodiment, it is assumed that the gateway ECU 110 is configured of hardware that has higher performance than the plurality of ECUs 120 in terms of storage capacity, calculation speed, and the like.

Gateway ECU 110 is a communication control device that has a function of controlling communication between in-vehicle network 150 and the outside of the vehicle. For example, the gateway ECU 110 has a reprogramming tool RT that is externally connected to the vehicle, and a function that controls communication between an external device such as a server on an external network N such as the Internet and the in-vehicle network 150. are doing. More specifically, the gateway ECU 110 monitors whether communication between the electronic device 100 connected to the in-vehicle network 150 and an external device outside the vehicle is being executed appropriately, and detects abnormal communication with the external device. It has a function of executing countermeasures when communication is detected, blocking the communication path 170, canceling the blocking, and the like.

Further, each of the plurality of ECUs 120 is a vehicle control device having a function of controlling various mechanisms provided in the vehicle. For example, the plurality of ECUs 120 include a brake control device having a function of controlling a brake mechanism provided in the vehicle. This brake control device includes a plurality of first electronic devices that have a function of individually controlling brake mechanisms of a plurality of wheels, and a second electronic device that collectively controls the first brake devices. It can be included. In such a configuration, the second electronic device is generally configured with hardware that has higher performance than the first electronic device in terms of storage capacity, calculation speed, and the like.

Although details will be described later, each of the plurality of electronic devices 100 including the gateway ECU 110 and the ECU 120 is configured as a computer 600 (see FIG. 6). Therefore, all of the plurality of electronic devices 100 operate according to computer programs created to implement their respective functions. Note that, below, for the sake of simplicity, a computer program may be simply expressed as a program.

Here, for example, when updating the functions of a vehicle on the market or developing functions of the vehicle, a technique for executing reprogramming to rewrite the program of the electronic device 100 may be required. In this case, the reprogramming program is provided from external devices such as the reprogramming tool RT and a server on the external network N.

Conventionally, various techniques for reprogramming the electronic device 100 have been studied. In such conventional technology, from the viewpoint of security, the reprogramming program is generally provided to the electronic device 100 in an encrypted state.

Therefore, with the conventional techniques described above, it is necessary to perform decryption each time a program is used, for example, for the purpose of rewriting the program and verifying the rewritten program, which tends to increase the time required for reprogramming. . In particular, as encryption methods are becoming more complex in order to improve security, the time required to decrypt an encrypted program tends to be longer, and the time required for reprogramming tends to be longer. .

Therefore, the embodiment makes it possible to realize reprogramming in a shorter time by using the functions and processing described below.

FIG. 2 is an exemplary and schematic block diagram showing functions realized in the vehicle reprogramming system according to the embodiment. Note that, hereinafter, the ECU 120 to be reprogrammed will be referred to as ECU 120a, and the other ECU 120 not to be reprogrammed will be referred to as ECU 120b.

As shown in FIG. 2, the gateway ECU 110 includes a communication processing section 111, a decoding section 112, and a mode switching section 113.

The communication processing unit 111 has a function of controlling communication performed by the gateway ECU 110 with other devices. Furthermore, the decryption unit 112 has a function of executing decryption processing for decrypting a program. Further, the mode switching unit 113 has a function of appropriately switching the control mode of the gateway ECU 110 (details will be described later).

Further, the ECU 120a includes a communication processing section 121a and a reprogramming execution section 122a, and the ECU 120b includes a communication processing section 121b, a notification section 122b, and a condition determination section 123b.

The communication processing units 121a and 121b each have a function of controlling communication executed by the ECUs 120a and 120b with other devices. Furthermore, the reprogramming execution unit 122a has a function of executing various processes for reprogramming the ECU 120a. Note that both the notification unit 122b and the condition determination unit 123b perform their functions during continuous reprogramming in which the program of the ECU 120a is continuously rewritten multiple times (details will be described later).

Based on the above functional module group, the vehicle reprogramming system according to the embodiment realizes reprogramming of the ECU 120a through processes executed in the flow shown in FIGS. 3 to 5 below.

First, one-off reprogramming in which the program of the ECU 120a is rewritten only once is executed in the flow shown in FIG. 3, as an example.

FIG. 3 is an exemplary and schematic diagram showing, in a flow chart manner, the flow of processing that the vehicle reprogramming system according to the embodiment executes during one-time reprogramming.

As shown in FIG. 3, in the embodiment, first, in step S310, the reprogramming tool RT issues a program erase instruction to instruct erasure of the program currently being used in the ECU 120a when reprogramming the ECU 120a. is transmitted to the gateway ECU 110. Note that in the embodiment, when executing the process of step S310, an authentication process may be executed between the reprogramming tool RT and the gateway ECU 110.

Then, in step S330, the communication processing unit 111 of the gateway ECU 110 transfers the program deletion instruction received from the reprogramming tool RT in step S310 to the ECU 120a via the in-vehicle network 150. Note that in the embodiment, when executing the process of step S330, an authentication process may be executed between the gateway ECU 110 and the ECU 120a.

Then, in step S350, the communication processing unit 121a of the ECU 120a receives the program deletion instruction transferred from the gateway ECU 110 in step S330.

Then, in step S351, the reprogramming execution unit 122a of the ECU 120a erases the program currently being used in the ECU 120a according to the program erase instruction received in step S350.

On the other hand, after transmitting the program deletion instruction in step S310, the reprogramming tool RT transmits a program for reprogramming the ECU 120a to the gateway ECU 110 in step S311. Since the program sent from the reprogramming tool RT to the gateway ECU 110 in step S311 is encrypted, it may be expressed as an encrypted program below.

Then, in step S331, the communication processing unit 111 of the gateway ECU 110 receives the encrypted program transmitted from the reprogramming tool RT in step S331.

Then, in step S332, the communication processing unit 111 of the gateway ECU 110 blocks the communication path 170 between the in-vehicle network 150 and the outside, and the mode switching unit 113 of the gateway ECU 110 changes the control mode of the gateway ECU 110 to the communication path 170 with the outside. The control mode is switched from a normal control mode for realizing a normal operation of controlling to a dedicated control mode for realizing one-time reprogramming of the ECU 120a.

Then, in step S333, the decryption unit 112 of the gateway ECU 110 decrypts the encrypted program received in step S331.

Then, in step S334, the communication processing unit 111 of the gateway ECU 110 transmits the program decoded in step S333 to the ECU 120a via the in-vehicle network 150. Note that hereinafter, the program that has been decrypted in step S333 may be expressed as a decryption program.

Then, in step S352, the communication processing unit 121a of the ECU 120a receives the decoding program transmitted from the gateway ECU 110 in step S334.

Then, in step S353, the reprogramming execution unit 122a of the ECU 120a writes the decoding program so that the decoding program received in step S352 will operate thereafter.

Then, in step S354, the reprogramming execution unit 122a of the ECU 120a transmits a write completion notification to the gateway ECU 110 via the in-vehicle network 150 in response to the completion of the write in step S353.

Then, in step S335, the communication processing unit 111 of the gateway ECU 110 receives the write completion notification transmitted from the ECU 120a in step S354.

Then, in step S336, the communication processing unit 111 of the gateway ECU 110 transmits the same decryption program to the in-vehicle network 150 as the decryption program transmitted in step S334 in order to have the ECU 120a verify the success or failure of the writing in step S353. It is transmitted to the ECU 120a via the ECU 120a.

Then, in step S355, the communication processing unit 121a of the ECU 120a receives the decoding program transmitted from the gateway ECU 110 in step S336.

Then, in step S356, the reprogramming execution unit 122a of the ECU 120a executes a verify process for verifying the success or failure of writing in step S353, based on the decryption program received in step S355.

Then, in step S357, the communication processing unit 121a of the ECU 120a transmits a verification completion notification including the result of the verification process to the gateway ECU 110 via the in-vehicle network 150 in response to the completion of the verify process in step S356. If the write in step S353 has failed, the ECU 120a may re-execute the series of processes from step S350 onwards; however, if the write in step S353 has been successful, the process of the ECU 120a will end in step S357. finish.

Then, in step S337, the communication processing unit 111 of the gateway ECU 110 receives the verification completion notification transmitted from the ECU 120a in step S357. If the received verification completion notification indicates a writing failure, the communication processing unit 111 of the gateway ECU 110 may send a program deletion instruction to the ECU 120a again, but the received verification completion notification indicates a writing success. In this case, the communication processing unit 111 of the gateway ECU 110 executes the process of the next step S338.

In step S338, the communication processing unit 111 of the gateway ECU 110 unblocks the communication path 170 between the in-vehicle network 150 and the outside, and the mode switching unit 113 of the gateway ECU 110 changes the control mode of the gateway ECU 110 to the one-off control mode of the ECU 120a. Switch from a dedicated control mode for realizing reprogramming to a normal control mode for realizing normal operation of controlling communication with the outside.

Then, in step S339, the communication processing unit 339 of the gateway ECU 110 transmits a rewriting completion notification to the reprogramming tool RT to notify that the reprogramming of the ECU 120a has been completed. Thereby, the processing of the gateway ECU 110 ends.

Then, in step S312, the programming tool RT receives the rewriting completion notification transmitted from the gateway ECU 110 in step S339. Then, the programming tool RT notifies a worker, such as an operator of the programming tool RT, that the reprogramming has been completed, and ends the process.

In this way, in the embodiment, the decryption of the encrypted program is executed not by the ECU 120a but by the gateway ECU 110, which is configured with hardware that has higher performance than the ECU 120a in terms of storage capacity, calculation speed, and the like. Therefore, according to the embodiment, the time required to decrypt an encrypted program can be shortened, and reprogramming can be accomplished in a shorter time.

Furthermore, in the embodiment, when performing reprogramming, the communication path 170 between the in-vehicle network 150 and the outside is cut off, so the reprogramming program can be used as a decrypted program on the in-vehicle network 150 without compromising security. can be transmitted. Therefore, according to the embodiment, there is no need to perform decryption every time a program is used for the purpose of rewriting the program and verifying the rewritten program, so reprogramming can be accomplished in a shorter time. .

On the other hand, continuous reprogramming in which the program of the ECU 120a is continuously rewritten a plurality of times is executed in the flow shown in FIGS. 4 and 5, as an example.

FIG. 4 is an exemplary and schematic diagram showing in a flowchart a part of the process flow that the vehicle reprogramming system according to the embodiment executes during continuous reprogramming. Further, FIG. 5 is an exemplary and schematic diagram showing in a flowchart the flow of processing that the vehicle reprogramming system according to the embodiment executes subsequent to the processing shown in FIG. 4 during continuous reprogramming. It is.

As shown in FIG. 4, in the embodiment, first, in step S410, the reprogramming tool RT transmits a plurality of encrypted programs for continuous reprogramming of the ECU 120a to the gateway ECU 110. Note that in the embodiment, when executing the process of step S410, an authentication process may be executed between the reprogramming tool RT and the gateway ECU 110.

The processing of the reprogramming tool RT after step S330 ends after outputting a notification in response to the completion of continuous reprogramming (detailed explanation will be omitted as it can be inferred from the above explanation based on FIG. 3). do).

Then, in step S430, the communication processing unit 111 of the gateway ECU 110 receives the plurality of encrypted programs received from the reprogramming tool RT in step S410.

Then, in step S431, the communication processing unit 111 of the gateway ECU 110 blocks the communication path 170 between the in-vehicle network 150 and the outside, and the mode switching unit 113 of the gateway ECU 110 blocks the communication path 170 between the in-vehicle network 150 and the outside. The control mode is switched from a normal control mode for realizing normal operation of controlling communication with the outside to a dedicated control mode for realizing continuous reprogramming of the ECU 120a.

Then, in step S432, the communication processing unit 111 of the gateway ECU 110 transmits a program deletion instruction to the ECU 120a via the in-vehicle network 150 to instruct deletion of the program currently being used in the ECU 120a. Note that in the embodiment, when executing the process of step S432, an authentication process may be executed between the gateway ECU 110 and the ECU 120a.

Then, in step S450, the communication processing unit 121a of the ECU 120a receives the program deletion instruction transmitted from the gateway ECU 110 in step S432.

Then, in step S451, the reprogramming execution unit 122a of the ECU 120a erases the program currently being used in the ECU 120a according to the program erase instruction received in step S450.

On the other hand, in step S433, the decryption unit 112 of the gateway ECU 110 decrypts the plurality of encrypted programs received in step S430. In step S433, it is sufficient that the decryption of at least one encrypted program is completed, and the decryption of the remaining encrypted programs can be executed in parallel with the subsequent processing.

After the decryption of at least one encrypted program is completed, in step S434, the communication processing unit 111 of the gateway ECU 110 transmits the one decrypted program to the ECU 120a via the in-vehicle network 150.

Then, in step S452, the communication processing unit 121a of the ECU 120a receives the decoding program transmitted from the gateway ECU 110 in step S434.

Then, in step S453, the reprogramming execution unit 122a of the ECU 120a writes the decoding program so that the decoding program received in step S452 will operate thereafter.

Then, in step S454, the reprogramming execution unit 122a of the ECU 120a transmits a write completion notification to the gateway ECU 110 via the in-vehicle network 150 in response to the completion of the write in step S453.

Then, in step S435, the communication processing unit 111 of the gateway ECU 110 receives the write completion notification transmitted from the ECU 120a in step S454.

Then, in step S436, the communication processing unit 111 of the gateway ECU 110 transmits the same decryption program to the in-vehicle network 150 as the decryption program transmitted in step S434 in order to have the ECU 120a verify the success or failure of the writing in step S453. It is transmitted to the ECU 120a via the ECU 120a.

Then, in step S455, the communication processing unit 121a of the ECU 120a receives the decoding program transmitted from the gateway ECU 110 in step S436.

Then, in step S456, the reprogramming execution unit 122a of the ECU 120a executes a verify process for verifying the success or failure of writing in step S453, based on the decryption program received in step S455.

Then, in step S457, the communication processing unit 121a of the ECU 120a transmits a verification completion notification including the result of the verification process to the gateway ECU 110 via the in-vehicle network 150 in response to the completion of the verify process in step S456. If the writing in step S453 has failed, the ECU 120a may re-execute the series of processes from step S450 onwards; however, if the writing in step S453 has succeeded, the ECU 120a may perform the first reprogramming is completed.

Then, in step S437, the communication processing unit 111 of the gateway ECU 110 receives the verification completion notification transmitted from the ECU 120a in step S457. If the received verification completion notification indicates a writing failure, the communication processing unit 111 of the gateway ECU 110 may re-execute the series of processes from step S432 onwards, but the received verification completion notification indicates that the writing was successful. If so, the communication processing unit 111 of the gateway ECU 110 executes the process of the next step S438.

In step S438, the communication processing unit 111 of the gateway ECU 110 transmits a rewriting completion notification to the ECU 120b via the in-vehicle network 150 to notify that the first reprogramming of the ECU 120a has been completed.

Then, in step S470, the communication processing unit 121b of the ECU 120b receives the rewriting completion notification transmitted from the gateway ECU 110 in step S438.

Then, in step S471, in response to receiving the rewriting completion notification in step S470, the notification unit 122b of the ECU 120b outputs a notification that the rewriting of the program of the ECU 120b has been completed in a manner that the operator can visually or audibly recognize. do. The reason why this notification is output from the ECU 120b rather than the reprogramming tool RT is that while the decryption program is being transmitted, it is not possible to do so in environments other than those where safety is ensured against unauthorized access from outside, such as a factory. This is because, from a security perspective, it is preferable to continue blocking communication with the outside in order to further enhance safety against unauthorized access from the outside. Additionally, after sending the reprogramming program, you can immediately disconnect the vehicle from the reprogramming tool RT, making it easier to drive the vehicle for compliance testing without waiting for reprogramming to complete. There is also.

Then, after the operator recognizes that the first reprogramming has been completed by the notification in step S471, the operator checks the functions of the ECU 120a after the reprogramming. This check includes, for example, examining the behavior of the vehicle in response to driving operations.

Then, as shown in FIG. 5, in step S570, the condition determination unit 123b of the ECU 120b executes condition determination to determine whether a predetermined condition for starting the next reprogramming is satisfied. The predetermined condition is, for example, that the operator performs a specific driving operation on the vehicle. More specifically, the condition determination unit 123b determines whether or not a predetermined operation has been performed, such as turning on a light and then repeatedly turning the brake ON/OFF a predetermined number of times within a predetermined time. Execute. The condition determination in step S570 is repeatedly executed, for example, until it is determined that a predetermined condition is satisfied.

If it is determined in step S570 that the predetermined condition is satisfied, the process proceeds to step S571. Then, in step S571, the communication processing unit 121b of the ECU 120b transmits a rewriting start instruction to the gateway ECU 110 via the in-vehicle network 150 to cause the ECU 120a to start the next reprogramming.

Then, in step S530, the communication processing unit 111 of the gateway ECU 110 receives the rewriting start instruction transmitted from the ECU 120b in step S571.

Then, in step S531, the communication processing unit 111 of the gateway ECU 110 transmits a program deletion instruction to the ECU 120a via the in-vehicle network 150 to instruct deletion of the program currently being used in the ECU 120a. In addition, in the embodiment, upon execution of the process of step S531, the authentication process may be executed again between the gateway ECU 110 and the ECU 120a.

Then, in step S550, the communication processing unit 121a of the ECU 120a receives the program deletion instruction transmitted from the gateway ECU 110 in step S531.

Then, in step S551, the reprogramming execution unit 122a of the ECU 120a erases the program currently being used in the ECU 120a according to the program erase instruction received in step S550.

On the other hand, in step S532, the decoding unit 112 of the gateway ECU 110 transmits the next decoding program for reprogramming to the ECU 120a via the in-vehicle network 150.

Then, in step S552, the communication processing unit 121a of the ECU 120a receives the decoding program transmitted from the gateway ECU 110 in step S532.

Then, in step S553, the reprogramming execution unit 122a of the ECU 120a writes the decoding program so that the decoding program received in step S552 will operate thereafter.

Then, in step S554, the reprogramming execution unit 122a of the ECU 120a transmits a write completion notification to the gateway ECU 110 via the in-vehicle network 150 in response to the completion of the write in step S553.

Then, in step S533, the communication processing unit 111 of the gateway ECU 110 receives the write completion notification transmitted from the ECU 120a in step S554.

Then, in step S534, the communication processing unit 111 of the gateway ECU 110 transmits the same decryption program to the in-vehicle network 150 as the decryption program transmitted in step S532 in order to have the ECU 120a verify the success or failure of the writing in step S553. It is transmitted to the ECU 120a via the ECU 120a.

Then, in step S555, the communication processing unit 121a of the ECU 120a receives the decoding program transmitted from the gateway ECU 110 in step S534.

Then, in step S556, the reprogramming execution unit 122a of the ECU 120a executes a verify process for verifying the success or failure of writing in step S553, based on the decryption program received in step S555.

Then, in step S557, the communication processing unit 121a of the ECU 120a transmits a verification completion notification including the result of the verification process to the gateway ECU 110 via the in-vehicle network 150 in response to the completion of the verify process in step S456. If the writing in step S553 has failed, the ECU 120a may re-execute the series of processes from step S550 onwards. However, if the writing in step S553 has been successful, the ECU 120a may perform the second process in step S557. reprogramming is completed.

Then, in step S535, the communication processing unit 111 of the gateway ECU 110 receives the verification completion notification transmitted from the ECU 120a in step S557. If the received verification completion notification indicates a writing failure, the communication processing unit 111 of the gateway ECU 110 may re-execute the series of processes from step S531 onwards, but the received verification completion notification indicates that the writing was successful. If so, the communication processing unit 111 of the gateway ECU 110 executes the process of the next step S536.

In step S536, the communication processing unit 111 of the gateway ECU 110 transmits a rewriting completion notification to the ECU 120b via the in-vehicle network 150 to notify that the second reprogramming of the ECU 120a has been completed.

Then, in step S572, the communication processing unit 121b of the ECU 120b receives the rewriting completion notification transmitted from the gateway ECU 110 in step S536.

Then, in step S573, in response to receiving the rewriting completion notification in step S572, the notification unit 122b of the ECU 120b outputs a notification that the rewriting of the program of the ECU 120b has been completed in a manner that the operator can visually or audibly recognize. do.

After the operator recognizes that the second reprogramming has been completed based on the notification in step S572, the operator checks the functions of the ECU 120a after the reprogramming.

Reprogramming for the third and subsequent times is also performed in the same manner as above. When all reprogramming is completed, the communication path 170 between the in-vehicle network 150 and the outside is unblocked, the control mode of the gateway ECU 110 is switched to the normal control mode, and then each Device processing ends.

In this way, in the embodiment, even when continuous reprogramming is performed, the decryption of the encrypted program is performed by the gateway ECU 110 instead of the ECU 120a, as in the case where the above-described one-off reprogramming is performed. At the same time, the communication path 170 between the in-vehicle network 150 and the outside is cut off, and the reprogramming program is transmitted over the in-vehicle network 150 as the decrypted program. Therefore, according to the embodiment, even when continuous reprogramming is performed, reprogramming can be achieved in a shorter time, as in the case where the above-described one-off reprogramming is performed.

Further, according to the embodiment, when continuous reprogramming is performed, the first reprogramming is started when decryption of at least one of the plurality of encrypted programs for reprogramming is completed, Since the remaining encrypted programs can be decrypted in parallel with the first reprogramming, the time required for all reprogramming can be further shortened.

Note that the electronic device 100 such as the gateway ECU 110 and the ECU 120 according to the embodiment is realized by, for example, a computer 600 as shown in FIG. 6 below.

FIG. 6 is an exemplary and schematic block diagram showing the hardware configuration of a computer 600 for realizing the electronic device 100 of the vehicle reprogramming system according to the embodiment.

As shown in FIG. 6, the computer 600 according to the embodiment includes a processor 610, a memory 620, a storage 630, an input/output interface (I/F) 640, and a communication interface (I/F) 650. We are prepared. These hardware are connected to bus 660.

Processor 610 is configured as, for example, a CPU (Central Processing Unit), and centrally controls the operations of each part of computer 600. The memory 620 includes, for example, a ROM (Read Only Memory) and a RAM (Random Access Memory), and has volatile or nonvolatile storage of various data such as programs executed by the processor 610, and programs executed by the processor 610. The goal is to provide work areas for

The storage 630 includes, for example, an HDD (Hard Disk Drive) or an SSD (Solid State Drive), and stores various data in a non-volatile manner. Input/output interface 640 controls inputting data to and outputting data from computer 600. Communication interface 650 allows computer 600 to communicate with other devices via a network, such as in-vehicle network 150 or external network N described above.

The functional module group shown in FIG. 2 described above is realized by the cooperation of hardware and software as a result of processor 610 executing a predetermined program stored in memory 620 or storage 630. However, in the embodiment, at least a part of the functional module group shown in FIG. 2 described above may be realized as dedicated hardware (circuit).

As described above, the vehicle reprogramming system according to the embodiment includes a plurality of electronic devices 100 mounted on the vehicle so as to be connected to the in-vehicle network 150. The plurality of electronic devices 100 include a gateway ECU 110 as a communication control device that controls communication between the in-vehicle network 150 and the outside of the vehicle.

When gateway ECU 110 receives from the outside an encrypted program for reprogramming ECU 120a, which is a first electronic device different from gateway ECU 110 among the plurality of electronic devices 100, gateway ECU 110 connects in-vehicle network 150 and the outside. Communication path 170 is cut off. The gateway ECU 110, which is a second electronic device different from the first electronic device among the plurality of electronic devices 100, decrypts the encrypted program received by the gateway ECU 110, and reads the decrypted program. , is transmitted to the ECU 120a as the first electronic device via the in-vehicle network 150. Then, when the ECU 120a serving as the first electronic device receives the decrypted program from the gateway ECU 110 serving as the second electronic device, the ECU 120a executes reprogramming based on the decrypted program.

According to the above configuration, when performing reprogramming, the decryption program is transmitted within the in-vehicle network 150 in which communication between the in-vehicle network 150 and the outside is controlled by the gateway ECU 110. The transmission of the decrypted program at the reprogramming program can be transmitted over the in-vehicle network 150 without being intercepted from outside, that is, without compromising security. Therefore, it is not necessary to perform decoding every time a program is used for the purpose of rewriting the program and verifying the rewritten program, so reprogramming can be realized in a shorter time. In particular, in the embodiment, the decryption of the program is executed not by the ECU 120a but by the gateway ECU 110, which is configured with hardware having higher performance than the ECU 120a in terms of storage capacity and calculation speed. It is possible to shorten the time required for decoding and realize reprogramming in a shorter time. Further, according to the above configuration, by blocking the communication path 170 between the in-vehicle network 150 and the outside by the gateway ECU 110 during reprogramming, access to the in-vehicle network 150 from outside the vehicle is prevented, and reprogramming is performed. Security during programming can be increased.

Furthermore, in the embodiment, when a plurality of different programs are received as reprogramming programs, the gateway ECU 110 as the second electronic device starts decoding the plurality of programs. Then, upon completion of the decoding of at least one of the plurality of programs, the gateway ECU 110 transmits one of the decoded programs to the ECU 120a as the first electronic device via the in-vehicle network 150. Thereafter, each time a predetermined condition is satisfied, the remaining decrypted programs are transmitted one by one to the ECU 120a via the in-vehicle network 150. The ECU 120a serving as the first electronic device executes reprogramming each time it receives one decrypted program from the gateway ECU 110 serving as the second electronic device.

According to the above configuration, the first reprogramming is started when at least one of the multiple programs for reprogramming has been decrypted, and the remaining programs are decrypted during the first (subsequent) decryption. Since it can be executed in parallel with reprogramming, it is possible to further shorten the time required for reprogramming multiple times.

Further, in the embodiment, the gateway ECU 110 as the second electronic device has a dedicated control mode for realizing reprogramming of the ECU 120a as the second electronic device, and a normal control mode, such as the above-mentioned normal control mode. It is configured to be switchable between other control modes for realizing other functions.

According to the above configuration, by switching the control mode, the resources of the gateway ECU 110 as the second electronic device can be used efficiently.

<Modified example>
Note that in the embodiment described above, a configuration is exemplified in which the gateway ECU 110 as a communication control device is set as a second electronic device that executes decryption of an encrypted program. In this way, even when the communication control device and the second electronic device are the same, it can be expressed that the second electronic device receives the program from the external device via the communication control device. However, in the embodiment described above, the ECU 120 may be set as the second electronic device. In this case, the ECU 120 set in the second electronic device is configured to receive the encrypted program from the gateway ECU 110 via the in-vehicle network 150, and execute decryption after the gateway ECU 110 blocks the communication path 170. Ru. Note that at this time, if the second electronic device is configured of hardware with higher performance than the first electronic device to be reprogrammed, the time required for reprogramming can be further reduced. Furthermore, in the embodiment described above, the gateway ECU 110 instead of the ECU 120 may be set as the first electronic device to be reprogrammed.

Furthermore, in the embodiment described above, the ECU 120a to be reprogrammed can be selectively switched between the plurality of ECUs 120 as appropriate. Therefore, each of the plurality of ECUs 120 can selectively realize the function of the ECU 120a to be reprogrammed and the function of another ECU 120b not to be reprogrammed.

Furthermore, "blocking the communication path 170 by the communication control device" means blocking the physical communication path, or even if the physical communication path is connected, reception from the outside is not accepted and transmission to the outside is not possible. This is not limited to processing that discontinues communication such as prohibition. "Blocking off the communication path 170 by the communication control device" may include, for example, a process of transmitting to the outside a predetermined response indicating that the communication is not in a normal communication state in response to communication from the outside.

Although the embodiments and modifications of the present disclosure have been described above, the embodiments and modifications described above are merely examples, and are not intended to limit the scope of the invention. The novel embodiments and modified examples described above can be implemented in various forms, and various omissions, substitutions, and changes can be made without departing from the gist of the invention. The above-described embodiments and modifications are included within the scope and gist of the invention, as well as within the scope of the invention described in the claims and its equivalents.

100 Electronic devices (vehicle electronic devices)
110 Gateway ECU (vehicle electronic device, communication control device, second electronic device)
120 ECU (vehicle electronic unit)
120a ECU (vehicle electronic device, first electronic device)
150 In-vehicle network

Claims (4)

A plurality of in-vehicle electronic devices mounted on a vehicle to be connected to an in-vehicle network, including a communication control device that is an in-vehicle electronic device that controls communication between the in-vehicle network and an external device outside the vehicle. Equipped with onboard electronic equipment,
A second electronic device different from the first electronic device among the plurality of in-vehicle electronic devices receives a code for reprogramming the first electronic device received from the external device via the communication control device. decoding the encoded computer program and transmitting the decoded computer program to the first electronic device via the in-vehicle network;
When the first electronic device receives the decrypted computer program from the second electronic device, the first electronic device executes the reprogramming based on the decrypted computer program,
When a plurality of different computer programs are received from the external device via the communication control device as the computer programs for reprogramming, the second electronic device decrypts the plurality of computer programs. and upon completion of decoding of at least one of the plurality of computer programs, transmitting one of the decrypted computer programs to the first electronic device via the in-vehicle network; Thereafter, each time a predetermined starting condition is satisfied, transmitting the remaining decrypted computer programs one by one to the first electronic device via the in-vehicle network;
The first electronic device performs the reprogramming each time it receives one of the decrypted computer programs from the second electronic device,
The starting condition is a specific driving operation for the vehicle;
Vehicle reprogramming system. The communication control device controls a communication path between the in-vehicle network and the external device when the second electronic device receives the computer program for reprogramming from the external device via the communication control device. Cut off,
The vehicle reprogramming system according to claim 1. The start condition is that the brake is turned on and off a predetermined number of times within a predetermined time after the light is turned on.
The vehicle reprogramming system according to claim 1 or 2. The second electronic device is configured to be switchable between a dedicated control mode for realizing reprogramming of the first electronic device and another control mode for realizing other functions. ,
The vehicle reprogramming system according to any one of claims 1 to 3.

Images