JP7152966B2 - Reprogramming method for vehicle electronic control unit - Google Patents

Description

TECHNICAL FIELD The present invention relates to a method for reprogramming an electronic control unit for a vehicle, and more particularly, by issuing an authentication code when reprogramming a target electronic control unit and setting the authentication code to the electronic control unit, thereby achieving market authentication. The present invention relates to a reprogramming method for a vehicle electronic control unit that prevents illegal acquisition of codes.

Patent Literature 1 discloses an in-vehicle communication system that prevents unauthorized rewriting of software in an electronic control unit mounted in a vehicle. In the vehicle, a plurality of electronic control units are connected to communication lines provided in the vehicle and electronically control the vehicle while communicating with each other. In the electronic control unit, even after the vehicle has been supplied to the market, the software stored in the electronic control unit can be officially rewritten from the outside at a desired timing such as a recall. Board rewritable ones are in circulation.

When a worker rewrites the software of the electronic control unit, first, the rewriting tool is connected to the communication line of the vehicle via the external connection connector of the vehicle. After that, the operator operates the operation section of the rewriting tool to transmit a rewriting start notification to the electronic control unit to be rewritten via the communication line. On the other hand, in the vehicle, after the electronic control unit to be rewritten receives the rewrite start notification, it transmits its own part number request to the rewriting tool. Here, the product number of the electronic control unit is stored in a non-rewritable area in the storage area within the electronic control unit during the manufacturing process of the vehicle.

Thereafter, in the vehicle, a vehicle integrated electronic control unit or the like other than the electronic control unit to be rewritten is used to determine whether or not the electronic control unit to be rewritten is a target for which software can be officially rewritten by the rewriting tool. Repeat the judging process. In the vehicle, after clearing the repeated judgment work, in order to judge that the rewriting tool is a legitimate rewriting tool, the rewriting tool performs encrypted communication according to a predetermined rule several times, and all the encrypted communication is normal. is completed, the communication partner is determined to be a regular rewriting tool.

JP 2012-234437 A

As described above, in the conventional vehicle, determination work of the electronic control unit to be rewritten is performed in many ways, and when all of the determination work is successfully cleared, the electronic control unit to be rewritten is normal. It is determined that the software can be rewritten. In other words, during the manufacturing process before supplying the vehicle to the market, by pre-storing the product number and the authentication number required for the determination work in the non-rewritable area in the electronic control unit to be rewritten, It prevents unauthorized rewriting of the software in the electronic control unit.

However, since the vehicle is supplied to the market in a state in which the authentication number, etc. necessary for the determination work is stored in advance in the storage area of the electronic control unit, etc., the above authentication number, etc. may be stolen by a third party by some illegal means. is acquired, the software of the electronic control unit may be illegally rewritten.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances. To provide a reprogramming method for an electronic control unit for a vehicle that prevents illegal acquisition of

A reprogramming method for a vehicle electronic control unit according to the present invention is a method for reprogramming a plurality of electronic control units connected to a communication line provided in a vehicle and reprogramming a plurality of electronic control units for controlling the vehicle. After the vehicle is supplied to the market, the authentication code issued before the reprogramming is started is transmitted from the outside of the vehicle through the communication line only to the electronic control unit that performs the reprogramming. and, after storing, the authentication code is inputted from the outside of the vehicle, and the electronic control unit to be reprogrammed is discriminated through the communication line.

Further, in the reprogramming method for a vehicle electronic control unit of the present invention, the authentication code is erased in the electronic control unit to be reprogrammed after the reprogramming is completed.

Further, in the method for reprogramming a vehicle electronic control unit of the present invention, after storing the authentication code in a smart key for locking and unlocking the vehicle, the smart key is operated in conjunction with the operation of the smart key. to the electronic control unit that performs the reprogramming, and stores the authentication code.

Further, in the reprogramming method for a vehicle electronic control unit of the present invention, after storing the authentication code in a storage medium that is detachably connected to the vehicle, the storage medium is connected to the vehicle, and from the storage medium The authentication code is transmitted to and stored in the electronic control unit that performs the reprogramming.

Further, in the reprogramming method for a vehicle electronic control unit of the present invention, the authentication code is manually input into the vehicle from an external device connected to the communication line from outside the vehicle or from a display device of the vehicle. and

In the reprogramming method for a vehicle electronic control unit according to the present invention, after the vehicle is supplied to the market and before reprogramming is started, the issued authentication code is transmitted from outside the vehicle only to the electronic control unit to be reprogrammed. After storing the code, the authentication code is input from the outside of the vehicle to determine the electronic control unit to be reprogrammed. This reprogramming method can prevent a malicious third party from illegally obtaining the authentication code from the electronic control unit of the vehicle even after the vehicle has been supplied to the market. As a result, the software of the electronic control unit of the vehicle cannot be arbitrarily reprogrammed, thus enhancing the safety of the vehicle.

Further, in the reprogramming method for a vehicle electronic control unit of the present invention, in the electronic control unit to be reprogrammed, the authentication code is erased after the reprogramming is completed. According to this reprogramming method, the electronic control unit of the vehicle stores the authentication code only during the period of the reprogramming work, and does not store the authentication code except during the period of the reprogramming work. As a result, it is possible to prevent a malicious third party from illegally obtaining the authentication code from the electronic control unit of the vehicle.

Further, in the reprogramming method for the vehicle electronic control unit of the present invention, after storing the authentication code in the smart key for locking and unlocking the vehicle, reprogramming is performed from the smart key in conjunction with the operation of the smart key. Send the authentication code to the electronic control unit that performs the authentication and store it. With this reprogramming method, the authentication code can be stored in the electronic control unit in accordance with the timing of the reprogramming work, making it difficult for a malicious third party to illegally acquire the authentication code from the electronic control unit of the vehicle.

Further, in the reprogramming method for the vehicle electronic control unit of the present invention, after storing the authentication code in a storage medium detachably connected to the vehicle, the storage medium is connected to the vehicle, and reprogramming is performed from the storage medium. Send the authentication code to the control unit for storage. With this reprogramming method, the authentication code can be stored in the electronic control unit in accordance with the timing of the reprogramming work, making it difficult for a malicious third party to illegally acquire the authentication code from the electronic control unit of the vehicle.

Further, in the reprogramming method for the vehicle electronic control unit of the present invention, the authentication code is manually input into the vehicle from an external device connected to the communication line from the outside of the vehicle or from a display device of the vehicle. With this reprogramming method, it is possible to input the authentication code and perform the judgment work of the electronic control unit by a method different from the method of transmitting the authentication code to the electronic control unit and storing it. As a result, the possibility of the authentication code leaking to the outside can be reduced, and the safety of the vehicle can be enhanced.

1 is a block diagram illustrating a vehicle to which a method for reprogramming a vehicle electronic control unit according to an embodiment of the invention is applied; FIG. 1 is a conceptual diagram illustrating a reprogramming method for a vehicle electronic control unit according to an embodiment of the present invention; FIG. 4 is a flow chart illustrating a method for reprogramming a vehicle electronic control unit according to an embodiment of the present invention;

Hereinafter, a reprogramming method for a vehicle electronic control unit (hereinafter referred to as "electronic control unit") according to one embodiment of the present invention will be described in detail with reference to the drawings. In the description of this embodiment, in principle, the same reference numerals are used for the same components, and repeated descriptions are omitted.

FIG. 1 is a block diagram illustrating a vehicle 10 to which the method of reprogramming an electronic control unit 11 of this embodiment is applied. FIG. 2 is a conceptual diagram for explaining the reprogramming method of the electronic control unit 11 of this embodiment. FIG. 3 is a flow chart illustrating a reprogramming method for the electronic control unit 11 of this embodiment.

As shown in FIG. 1, a vehicle 10 includes a plurality of electronic control units 11, a communication line 12 to which the plurality of electronic control units 11 are connected for data communication, and a connector 13 to connect an external device 14 to the communication line 12. and have. The vehicle 10 is equipped with an electronic control unit 11 that performs various controls of the vehicle 10. For example, the electronic control unit 11 that controls the engine of the vehicle 10, the electronic control unit 11 that controls the transmission of the vehicle 10, the vehicle 10 An electronic control unit 11 for controlling the brake of the vehicle 10, an electronic control unit 11 for controlling the steering of the vehicle 10, and the like are mounted.

Each electronic control unit 11 includes, for example, a communication section 11A, a microprocessor 11B for performing various calculations, and a rewritable non-volatile memory 11C for storing software etc. for causing the microprocessor 11B to execute each process. ,have. The nonvolatile memory 11C is, for example, a flash memory or an EEPROM (Electrically Erasable Programmable Read-Only Memory). The nonvolatile memory 11C is provided with a storage area for storing at least the software and a storage area for storing an authentication code for authenticating the electronic control unit 11 . The software includes control programs, control data, control maps, and the like for controlling the vehicle 10 by the electronic control unit 11 .

Here, the authentication code of the present embodiment is used when reprogramming software stored in the electronic control unit 11 using an external device 14 outside the vehicle 10 at a desired timing such as a recall. This is a collation code for specifying the target electronic control unit 11 . For example, the authentication code may consist of only numbers, only alphabets, or a combination of numbers and alphabets. Although the details will be described later, the authentication code is issued for the first time by the automobile manufacturer 21 (see FIG. 2) when the vehicle 10 is supplied to the market and the reprogramming work is performed. It is written to unit 11 .

Further, the communication unit 11A transmits data to the communication line 12 and receives data from the communication line 12 according to the CAN (Controller Area Network) protocol of the communication line 12 .

The communication line 12 is an in-vehicle LAN (Local Area Network) that connects the plurality of electronic control units 11, such as a CAN. As described above, the communication line 12 is provided with the connector 13 for connecting the external device 14 to the communication line 12 . The connector 13 has an external device 14 used for reprogramming the software of the electronic control unit 11 and a storage medium for writing an authentication code to a desired electronic control unit 11, such as a USB (Universal Serial Bus) memory. etc. are connected as appropriate.

The external device 14 is a dedicated external tool used when reprogramming the software stored in the electronic control unit 11. For example, the communication section 14A, the operation section 14B, and a microprocessor for performing various calculations. 14C, and a rewritable non-volatile memory 14D for storing software, etc. for causing the microprocessor 14C to execute each process. In addition, new software used for reprogramming is stored in the nonvolatile memory 14D. The communication section 14A and microprocessor 14C have the same configuration as the communication section 11A and microprocessor 11B of the electronic control unit 11 described above.

As shown in FIG. 2, in the reprogramming method of the electronic control unit 11 of the present embodiment, for example, an automobile manufacturer 21 that manufactures the vehicle 10, a dealer 22 that sells and maintains the vehicle 10 manufactured by the automobile manufacturer 21, The vehicle 10 is purchased from the dealer 22 and realized by three-party cooperation with the user 23 who uses it.

In the present embodiment, the automobile manufacturer 21 stores the nonvolatile memory 11C (see FIG. 1) of the electronic control unit 11 of the vehicle 10 in a stage prior to supplying the vehicle 10 to the market, such as a manufacturing process of the vehicle 10. Then, the authentication code for specifying the electronic control unit 11 is not stored. In other words, the authentication code does not exist in the electronic control unit 11 of the vehicle 10 nor in the dealer 22 before a reprogramming operation such as a recall is required.

As a result, the software set in the electronic control unit 11 cannot be reprogrammed at all by the dealer 22 or by using the external device 14, which is a dedicated device for reprogramming. Furthermore, a malicious third party cannot illegally acquire the authentication code from the electronic control unit 11 of the vehicle 10 and illegally rewrite the software of the electronic control unit 11, so that the safety of the vehicle 10 is ensured. be.

Next, a reprogramming method for the electronic control unit 11 of this embodiment will be described with reference to FIG. 3, and FIG. 1 and FIG.

As shown in FIG. 3, first, in step S1, when a recall or the like occurs and it becomes necessary to reprogram a desired electronic control unit 11 of the vehicle 10, the automaker 21 does not perform the reprogramming. An authentication code for specifying the required electronic control unit 11 is determined and issued.

Next, in step S2, the automobile manufacturer 21 prepares a new smart key for the vehicle 10 to be recalled, and stores the authentication code issued in step S1 in the storage area of the smart key. After that, the automobile manufacturer 21 mails the smart key in which the authentication code is stored to the user 23 who owns the vehicle 10 to be recalled.

Next, in step S3, the automaker 21 sends an authentication code to the user 23 who mailed the smart key by e-mail, which is a means different from the mailing of the smart key in step S2. The means for notifying the user 23 of the authentication code is not limited to the above e-mail, and may be direct mail or content-certified mail containing the authentication code.

Next, in step S4, the automaker 21 notifies the user 23 of the authentication code, etc., and sends new software for reprogramming the desired electronic control unit 11 to the dealer 22. . The automobile manufacturer 21 may mail the storage medium in which the new software is stored to the dealer 22, or the dealer 22 may download the software from the web specified by the automobile manufacturer 21. FIG.

Next, in step S<b>5 , the user 23 unlocks the vehicle 10 using the new smart key sent from the automobile manufacturer 21 . At this time, communication is performed between the smart key and the vehicle 10 using RF (Radio Frequency) band signals and LF (Low Frequency) band signals. is transmitted to the vehicle 10 via the above-mentioned signal of time.

Next, in step S6, when the vehicle 10 receives the authentication code in conjunction with the unlocking operation of the vehicle 10 in step S5, the electronic control unit 11 to be reprogrammed is authenticated via the communication line 12. Submit your code. After that, in the electronic control unit 11 to be reprogrammed, the microprocessor 11B writes and stores the authentication code in a desired storage area of the nonvolatile memory 11C.

Next, in step S7, the user 23 drives the vehicle 10, in which the authentication code is written in the electronic control unit 11 in step S6, to the dealer 22. Bring the code to the dealer 22.

Next, in step S8, at the dealer 22, the reprogramming operator prepares the external device 14, which is a dedicated device for reprogramming, and writes data to the nonvolatile memory 14D of the external device 14 in step S4. New software sent from the automobile manufacturer 21 is stored. After that, the operator connects the external device 14 to the connector 13 of the vehicle 10, operates the operation section 14B of the external device 14, and manually inputs the authentication code received from the user 23 in step S7.

Next, in step S9, the vehicle 10 starts matching the authentication code via the communication line 12, and the external device 14 selects a desired electronic control unit from among the plurality of electronic control units 11 for reprogramming. 11 is determined. Specifically, in steps S5 to S6, the authorization code has already been written only to the electronic control unit 11 that executes reprogramming. Therefore, each electronic control unit 11 determines whether or not the authentication code sent from the external device 14 matches the authentication code stored in the predetermined storage area of the nonvolatile memory 11C. Here, as described above, the fact that the authentication code is not stored in the electronic control unit 11 not to be reprogrammed and the authentication code matching operation cannot be performed is determined as the authentication code mismatch.

Next, in step S10, when the external device 14 receives a signal that the authentication code matches from the electronic control unit 11 via the communication line 12, the operator operates the external device 14 to send a new signal to the vehicle 10. Submit your software. Then, in the electronic control unit 11 whose authentication code matches in step S9, the microprocessor 11B starts reprogramming new software to a desired storage area of the nonvolatile memory 11C.

Next, in step S11, in the electronic control unit 11 to be reprogrammed, the microprocessor 11B erases the authentication code stored in the nonvolatile memory 11C after the reprogramming work is finished. When the external device 14 receives a reprogramming end signal from the electronic control unit 11 via the communication line 12 , the worker removes the external device 14 from the vehicle 10 and hands over the vehicle 10 to the user 23 .

As described above, in the vehicle 10, the authentication code is not written to all the electronic control units 11 in the vehicle 10 until reprogramming of the electronic control units 11 is required due to a recall or the like. Then, at the stage of reprogramming a desired electronic control unit 11, an authentication code is issued for the first time by the automobile manufacturer 21, and only the electronic control unit 11 to be reprogrammed for the vehicle 10 is authenticated. code is written.

With the above reprogramming method, there is no way for a malicious third party to illegally acquire the authentication code from the electronic control unit 11 of the vehicle 10 except during the reprogramming work period. As a result, the software of the electronic control unit 11 of the vehicle 10 is not arbitrarily reprogrammed, and the safety of the vehicle 10 is improved.

Furthermore, when the authentication code is sent from the automobile manufacturer 21 to the user 23, two kinds of sending means are used, and the dealer 22 also acquires the authentication code for the first time when the reprogramming work is performed. As a result, there is no way for a malicious third party to illegally obtain the authorization code from the dealer 22 side either.

Furthermore, in the electronic control unit 11, after the reprogramming is completed, the authentication code issued by the automobile manufacturer 21 is erased, and again, all the electronic control units 11 of the vehicle 10 are in a state in which the authentication code is not written. becomes. When a recall or the like occurs in the future and reprogramming work becomes necessary again, the automobile manufacturer 21 issues a new authentication code at that time. As a result, as described above, it is possible to reliably prevent a malicious third party from illegally acquiring the authentication code.

In this embodiment, the user 23 brings the vehicle 10 to the dealer 22 and the dealer 22 uses the external device 14 to perform the reprogramming work. However, the present invention is not limited to this case. For example, the automobile manufacturer 21 transmits new software for reprogramming to the vehicle 10 and downloads the new software to the storage area within the vehicle 10 . The reprogramming work may be performed by the user 23 manually inputting the authentication code using the external device 14 or the display device in the vehicle 10 . In addition, various modifications are possible without departing from the gist of the present invention.

10 vehicle 11 electronic control unit 11A, 14A communication unit 11B, 14C microprocessor 11C, 14D non-volatile memory 12 communication line 13 connector 14 external device 14B operation unit 21 automobile manufacturer 22 dealer 23 user

Claims (5)

A reprogramming method for a vehicle electronic control unit that connects to a communication line provided in a vehicle and reprograms a plurality of electronic control units that control the vehicle,
After the vehicle is supplied to the market, the authentication code issued before the reprogramming is started is transmitted from the outside of the vehicle through the communication line only to the electronic control unit that performs the reprogramming, and is stored. After letting
A reprogramming method for an electronic control unit for a vehicle, characterized in that the authentication code is input from outside the vehicle, and the electronic control unit to be reprogrammed is discriminated through the communication line. 2. The method of reprogramming an electronic control unit for a vehicle according to claim 1, wherein in said electronic control unit which performs said reprogramming, said authentication code is erased after said reprogramming is completed. After the authentication code is stored in the smart key that locks and unlocks the vehicle, the authentication code is transferred from the smart key to the electronic control unit that performs the reprogramming in conjunction with the operation of the smart key. 3. The method of reprogramming an electronic control unit for a vehicle according to claim 1, further comprising the steps of transmitting and storing. After storing the authentication code in a storage medium that is detachably connected to the vehicle, the storage medium is connected to the vehicle, and the authentication code is transmitted from the storage medium to the electronic control unit that performs the reprogramming. 3. The method of reprogramming an electronic control unit for a vehicle according to claim 1, wherein the reprogramming method of a vehicle electronic control unit is stored. 5. The vehicle electronic control according to claim 3, wherein the authentication code is manually input to the vehicle from an external device connected to the communication line from the outside of the vehicle or from a display device of the vehicle. How to reprogram the unit.

Images