JP7803121B2 - Electronic control unit - Google Patents

Description

The present invention relates to an electronic control device.

For example, electronic control devices installed in vehicles are configured to perform secure boot processing when the microcomputer (hereinafter referred to as "mc") is started up. For example, Patent Document 1 discloses technology that performs secure boot processing to determine whether data stored in a data storage unit has been tampered with, and if it is determined that the data has been tampered with, stops operation of the tampered area, thereby allowing only the intended software (hereinafter referred to as "software") to operate.

JP 2015-55898 A

There are two possible reasons why data is identified as having been tampered with: intentional tampering, or tampering due to a malfunction in the data storage unit. If data has been intentionally tampered with, the problem can be resolved by reprogramming the legitimate control software, but if data has been tampered with due to a malfunction in the data storage unit, the only way to resolve the problem is to replace the microcontroller. However, in the past, when data tampering was identified, the cause was not notified to the user, which meant that the user was unable to take appropriate action. This could result in unnecessary key updates or microcontroller replacements.

The present invention was made in consideration of the above-mentioned circumstances, and its purpose is to provide an electronic control device that allows the user to take appropriate measures when it is determined that data has been tampered with through secure boot processing.

According to the invention described in claim 1, an electronic control device (21) mounted on a vehicle includes a data storage unit (23) for storing data, and a control unit (24) that performs secure boot processing to determine whether the data stored in the data storage unit has been tampered with. The data storage unit includes a first storage area (26) and a second storage area (27). When the control unit determines that the data has been tampered with, it performs a fault diagnosis process for the data storage unit to determine whether the data storage unit is faulty. When the control unit determines that the data storage unit is not faulty, it notifies the control unit that the data has been intentionally tampered with, and when the control unit determines that the data storage unit is faulty, it notifies the control unit that the data has been tampered with due to a fault in the data storage unit. The control unit performs a fault diagnosis process on the second storage area in parallel with performing the secure boot process on the first storage area, and when it determines that the data stored in the first storage area has been tampered with, it performs the secure boot process on the second storage area in parallel with performing the fault diagnosis process on the first storage area, and when it determines that the data stored in the second storage area has not been tampered with, it launches control software with the second storage area as the area to be used.

When secure boot processing is performed and it is determined that data has been tampered with, a fault diagnosis process for the data storage unit is performed. If it is determined that the data storage unit is not faulty, a notification is sent that the data has been intentionally tampered with, allowing the user to recognize that the data has been intentionally tampered with and take appropriate action. On the other hand, if it is determined that the data storage unit is faulty, a notification is sent that the data has been tampered with due to a fault in the data storage unit, allowing the user to recognize that the data has been tampered with due to a fault in the data storage unit and take appropriate action. In this way, when secure boot processing determines that data has been tampered with, the user can be appropriately notified whether the tampering was intentional or due to a fault in the data storage unit, allowing the user to take appropriate action in either case.

Functional block diagram showing the first embodiment Diagram explaining the secure boot process Functional block diagram showing the configuration of the vehicle-side system Flowchart showing processing of a target ECU Flowchart showing processing of a target ECU Flowchart showing the processing of the OTA master ECU Functional block diagram showing a second embodiment Flowchart showing processing of a target ECU Flowchart showing processing of a target ECU Flowchart showing processing of a target ECU 10 is a flowchart illustrating a process of a target ECU according to a third embodiment. Flowchart showing processing of a target ECU Flowchart showing processing of a target ECU

Several embodiments will be described below with reference to the drawings. In subsequent embodiments, descriptions of parts that overlap with previous embodiments may be omitted.

(First embodiment)
A first embodiment will be described with reference to Figures 1 to 6. An electronic control unit (hereinafter referred to as an ECU (Electronic Control Unit)) 1 is, for example, an ECU mounted on a vehicle, and is a device that controls a drive system, a device that controls an ADAS (Advanced Driving Assistant System), a device that controls a multimedia system, etc. The ECU 1 is equipped with a secure boot function as a function for detecting intentional data tampering by a malicious third party. In this case, the data includes control software that realizes a specific application.

ECU1 includes a microcomputer 2. Microcomputer 2 includes a ROM 3 as a data storage unit, a CPU 4 as a control unit, and a hardware security module (hereinafter referred to as HSM (Hardware Security Module)) 5. Microcomputer 2 executes computer programs stored in a non-transient physical storage medium to perform processing corresponding to the computer programs and control the operation of ECU1.

ROM 3 includes a boot program area 3a, a code flash area 3b, and a data flash area 3c. As shown in FIG. 2, CPU 4 starts the boot program stored in boot program area 3a, reads data stored in code flash area 3b block by block, and outputs the read data to HSM 5 to perform secure boot processing.

The HSM 5 stores the encryption key required to generate a MAC (Message Authentication Code) value. When data for each block is input, the HSM 5 encrypts the input data for each block using the encryption key and calculates a MAC value. The HSM 5 compares and verifies the calculated MAC value against the verification MAC value stored in the data flash area 3c, and outputs the secure boot processing result to the boot program. If the CPU 4 determines that the calculated MAC value matches the verification MAC value, it determines that the data in ROM 3 has not been tampered with. On the other hand, if the CPU 4 determines that the calculated MAC value does not match the verification MAC value, it determines that the data in ROM 3 has been tampered with.

In addition to performing secure boot processing, CPU 4 also performs fault diagnosis processing on ROM 3. If microcomputer 2 has an ECC (Error-Correcting Code/Error-Correction Code) check function, it is possible to correct single-bit errors and detect double-bit errors when reading data, so fault diagnosis processing on ROM 3 is performed in parallel with performing secure boot processing. In this case, by storing the ECC check results, the time spent diagnosing ROM 3 after starting the control software can be reduced. On the other hand, if microcomputer 2 does not have an ECC check function, fault diagnosis processing on ROM 3 is performed by reading data from a specific range of RAM, for example, 1 kByte, erasing the data in that range and writing "1"s, reading the data from the same range and confirming that it is all "1"s, and then performing the same process with "0"s.

As shown in FIG. 3, as a vehicle-side system, ECU 1 is connected to an OTA master ECU 6 that manages multiple ECUs and a meter ECU 8 that controls a meter 7 via an in-vehicle network 9. The in-vehicle network 9 is, for example, a Controller Area Network (CAN) (registered trademark). ECU 1 can also be connected to a diagnostic tool 10 that can be operated by a dealer's technician via a communication cable 11. ECU 1 functions as a target ECU that can be reprogrammed from the OTA master ECU 6 or diagnostic tool 10.

The ECU 1 performs the secure boot process described above, and if it determines that data has been tampered with, it performs a fault diagnosis process on the ROM 3. If it determines that the ROM 3 is not faulty, it sends a tampering notification to the in-vehicle network 9 and communication cable 11. On the other hand, if the ECU 1 determines that the ROM 3 is faulty, it sends a ROM fault notification to the in-vehicle network 9 and communication cable 11.

When the meter ECU 8 receives a tampering notification from ECU 1 via the in-vehicle network 9, it displays notification information indicating data tampering on the meter 7, notifying the driver and other parties of the data tampering. When the notification information indicating data tampering is displayed on the meter 7, the driver and other parties can recognize that the data has been intentionally tampered with, and that reprogramming the control software is necessary as a countermeasure. For example, once the control software has been reprogrammed, the driver and other parties can take action, such as driving the vehicle to a dealer. Furthermore, when the meter ECU 8 receives a ROM failure notification from ECU 1 via the in-vehicle network 9, it displays notification information indicating a ROM 3 failure on the meter 7, notifying the driver and other parties of the ROM 3 failure. When the notification information indicating a ROM 3 failure is displayed on the meter 7, the driver and other parties can recognize that data tampering has occurred due to a ROM 3 failure, and that replacing the microcomputer 2 is necessary as a countermeasure.

When the diagnostic tool 10 receives a tampering notification from the ECU 1 via the communication cable 11, it displays notification information indicating data tampering and notifies the dealer's staff or other personnel of the data tampering. When the notification information indicating data tampering is displayed on the diagnostic tool 10, the dealer's staff or other personnel can recognize that data tampering has been intentional and that the corrective action is to reprogram the control software. When the notification information indicating a ROM 3 failure is displayed on the diagnostic tool 10, the dealer's staff or other personnel can recognize that data tampering has been caused by a ROM 3 failure and that the corrective action is to replace the microcomputer 2.

Next, the operation of the above-described configuration will be explained with reference to Figures 4 to 6. Here, we will explain the processing performed by the ECU 1 functioning as the target ECU and the processing performed by the OTA master ECU 6.

(1) Processing of the Target ECU In the ECU 1, when the CPU 4 starts the startup process of the microcomputer 2, it starts the microcomputer 2 (A1) and performs secure boot processing (A2). When the CPU 4 completes the secure boot process, it determines the result of the secure boot process (A3). When the CPU 4 determines that the MAC value matches the verification MAC value and that the data in the ROM 3 has not been tampered with, it determines that the result of the secure boot process is positive (A3: YES), starts the control software (A4), and ends the startup process of the microcomputer 2.

On the other hand, if the MAC value and the verification MAC value do not match and the CPU 4 determines that the data in ROM 3 has been tampered with, it determines that the secure boot processing result is negative (A3: NO) and performs fault diagnosis processing on ROM 3 (A5). After completing the fault diagnosis processing on ROM 3, the CPU 4 determines the result of the fault diagnosis processing (A6).

The CPU 4 confirms that ROM 3 is operating normally. If it determines that ROM 3 is not faulty, it determines that the fault diagnosis processing result is positive (A6: YES) and saves a DTC (Diagnostic Trouble Code) indicating intentional data tampering (A7). The CPU 4 then sends a tampering notification to the in-vehicle network 9 or communication cable 11 (A8), maintains secure boot without starting the control software (A9), and ends the startup processing of the microcomputer 2. In other words, the CPU 4 displays notification information indicating data tampering on the meter 7 or diagnostic tool 10, thereby making the driver, dealership staff, etc. aware of the intentional data tampering.

On the other hand, the CPU 4 verifies that ROM 3 is operating abnormally rather than normally and, upon determining that ROM 3 is faulty, determines that the fault diagnosis processing result is negative (A6: NO) and saves a DTC indicating data tampering due to a ROM 3 fault (A10). The CPU 4 then sends a ROM fault notification to the in-vehicle network 9 or communication cable 11 (A11), enables vehicle fixation processing (A12), maintains secure boot without launching the control software (A13), and terminates the startup processing of the microcomputer 2. That is, the CPU 4 displays notification information indicating a ROM 3 fault on the meter 7 or diagnostic tool 10, thereby making the driver, dealer personnel, and others aware of data tampering due to a ROM 3 fault. The vehicle fixation processing is a process that ensures safety and security. By enabling the vehicle fixation processing, the CPU 4 prevents malfunctions of other ECUs linked to the ECU 1 and prevents situations in which safety and security are threatened due to a ROM 3 fault.

In addition, the area on which the secure boot process and fault diagnosis process are performed may be divided, and the secure boot process and fault diagnosis process may be performed on each divided area. By performing the secure boot process and fault diagnosis process on each divided area, it is possible to start up the control software with the safety guaranteed by ensuring that the data has not been tampered with.

(2) Processing of the OTA Master ECU 6 When the CPU of the OTA master ECU 6 starts the tampering notification reception determination process, it determines (B1) whether or not it has received the tampering notification transmitted from the ECU 1. When the CPU determines that it has not received the tampering notification transmitted from the ECU 1 (B1: NO), it ends the tampering notification reception determination process.

When the CPU determines that it has received the tampering notification sent from ECU 1 (B1: YES), it sends a control software reprogramming request notification to meter ECU 8, displays a control software reprogramming request screen on meter 7 (B2), and waits for a choice of whether to reprogram the control software (B3). The reprogramming request screen displayed on meter 7 allows the driver or other user to choose whether to reprogram the control software. When the driver or other user chooses to reprogram the control software, meter ECU 8 sends a reprogramming notification to OTA master ECU 6.

When the CPU determines that it has received a reprogramming notification sent from the meter ECU 8 (B3: YES), it sends the legitimate control software to the ECU 1, reprograms the control software (B4), and terminates the tampering notification reception determination process. Specifically, the CPU sends an install instruction to the ECU 1 to have the ECU 1 install the control software, and sends an activate instruction to the ECU 1 to have the ECU 1 activate the control software, and reprograms the control software. Note that while the above describes a case in which the OTA master ECU 6 sends legitimate control software to the ECU 1, it is also possible for the diagnostic tool 10 to send legitimate control software to the ECU 1.

As described above, according to the first embodiment, the following advantageous effects can be obtained.
In the ECU 1, when secure boot processing is performed and it is determined that data has been tampered with, a fault diagnosis processing is performed on the ROM 3, and when it is determined that the ROM 3 is not faulty, a notification is sent that the data has been intentionally tampered with. If the data has been intentionally tampered with, the user can take appropriate measures. On the other hand, if it is determined that the ROM 3 is faulty, a notification is sent that the data has been tampered with due to a fault in the ROM 3. If the data has been tampered with due to a fault in the ROM 3, the user can take appropriate measures. As a result, when it is determined that data has been tampered with by secure boot processing, the user can be appropriately notified whether the tampering was intentional or due to a fault in the ROM 3, and the user can take appropriate measures in either case.

If intentional data tampering is identified, the system notifies the user of the intentional data tampering and prompts the user to reprogram the legitimate control software. Reprogramming the legitimate control software enables a swift return to normal operation. Furthermore, if data tampering due to a ROM3 failure is identified, the system notifies the user of the data tampering due to a ROM3 failure and prompts the user to replace the microcomputer 2. Replacing the microcomputer 2 enables a swift return to normal operation.

When intentional data tampering is identified, a DTC code indicating the intentional data tampering is saved. The details and cause of the intentional data tampering can be analyzed using the DTC code. Furthermore, when data tampering due to a ROM3 failure is identified, a DTC code indicating the data tampering due to a ROM3 failure is saved. The details and cause of the ROM3 failure can be analyzed using the DTC code.

Second Embodiment
The second embodiment will be described with reference to FIGS.
In the second embodiment, the ROM has two data storage areas. In the ECU 21, the microcomputer 22 includes a ROM 23 as a data storage unit, a CPU 24 as a control unit, and an HSM 25. The ROM 23 includes a first storage area 26 and a second storage area 27. The first storage area 26 includes a boot program area 26a, a code flash area 26b, and a data flash area 26c. The second storage area 27 includes a boot program area 27a, a code flash area 27b, and a data flash area 27c.

Next, the operation of the above-described configuration will be described with reference to Figures 8 to 10. Here, the processing performed by the ECU 21 functioning as the target ECU will be described.
In the ECU 21, the CPU 24 starts the microcomputer 22 when it starts the startup process (A21) and performs secure boot processing on the first storage area 26 (A22). When the CPU 24 completes the secure boot process on the first storage area 26, it determines the result of the secure boot process (A23). When the CPU 24 determines that the MAC value matches the verification MAC value and that the code flash area 26b of the first storage area 26 has not been tampered with, it determines that the result of the secure boot process is positive (A23: YES), starts control software in the first storage area 26 (A24), and ends the startup process of the microcomputer 22.

On the other hand, if the MAC value and the verification MAC value do not match and the CPU 24 determines that the code flash area 26b of the first storage area 26 has been tampered with, it determines that the secure boot processing result is negative (A23: NO) and performs fault diagnosis processing on the first storage area 26 (A25). Upon completing the fault diagnosis processing on the first storage area 26, the CPU 24 determines the result of the fault diagnosis processing (A26).

When the CPU 24 confirms that the first storage area 26 is operating normally and determines that the first storage area 26 is not faulty, it determines that the failure diagnosis processing result is positive (A26: YES) and saves a DTC indicating intentional data tampering (A27). On the other hand, when the CPU 24 confirms that the first storage area 26 is operating abnormally rather than normally and determines that the first storage area 26 is faulty, it determines that the failure diagnosis processing result is negative (A26: NO) and saves a DTC indicating data tampering due to a fault in the first storage area 26 (A28).

Next, the CPU 24 performs secure boot processing on the second storage area 27 (A29). Upon completing the secure boot processing on the second storage area 27, the CPU 24 determines the result of the secure boot processing (A30). If the MAC value matches the verification MAC value and the code flash area 27b of the second storage area 27 has not been tampered with, the CPU 24 determines that the secure boot processing result is positive (A30: YES), starts the control software in the second storage area 27 (A31), and ends the startup processing of the microcomputer 22.

On the other hand, if the MAC value and the verification MAC value do not match and the CPU 24 determines that the code flash area 27b of the second storage area 27 has been tampered with, it determines that the secure boot processing result is negative (A30 NO) and performs fault diagnosis processing on the second storage area 27 (A32). Upon completing the fault diagnosis processing on the second storage area 27, the CPU 24 determines the result of the fault diagnosis processing (A33).

When the CPU 24 confirms that the second storage area 27 is operating normally and determines that the second storage area 27 is not faulty, it determines that the result of the fault diagnosis process is positive (A33: YES) and saves a DTC indicating intentional data tampering (A34). On the other hand, when the CPU 24 confirms that the second storage area 27 is operating abnormally rather than normally and determines that the second storage area 27 is faulty, it determines that the result of the fault diagnosis process is negative (A33: NO) and saves a DTC indicating data tampering due to a fault in the second storage area 27 (A35).

The CPU 24 determines whether both the first storage area 26 and the second storage area 27 are faulty (A36). If the CPU 24 determines that at least one of the first storage area 26 and the second storage area 27 is not faulty (A36: NO), it sends a tampering notification to the in-vehicle network 9 or the communication cable 11 (A37), maintains secure boot without starting the control software (A38), and ends the startup processing of the microcomputer 22.

On the other hand, if the CPU 24 determines that both the first storage area 26 and the second storage area 27 are faulty (A36: YES), it sends a ROM fault notification to the in-vehicle network 9 or communication cable 11 (A39), enables the vehicle fixation process (A40), maintains secure boot without starting the control software (A41), and ends the startup process of the microcomputer 22.

As described above, according to the second embodiment, the following advantageous effects can be obtained.
In the ECU 21, a secure boot process is performed on the first storage area 26. If it is determined that data has been tampered with, a fault diagnosis process is performed on the first storage area 26. If it is determined that data has been tampered with, a secure boot process is performed on the second storage area 27. If it is determined that at least one of the first storage area 26 and the second storage area 27 is not faulty, a notification is sent of intentional data tampering. If intentional data tampering has occurred, the user can take appropriate measures. On the other hand, if it is determined that both the first storage area 26 and the second storage area 27 are faulty, a notification is sent of data tampering due to a fault in the ROM 23. If data tampering has occurred due to a fault in the ROM 23, the user can take appropriate measures. As a result, even in a configuration in which ROM 23 has two data storage areas, if it is determined that data has been tampered with by secure boot processing, the user can be appropriately notified as to whether the tampering was intentional or due to a malfunction of ROM 23, and the user can take appropriate action in either case.

If it is determined that the data in the first storage area 26 has not been tampered with, the control software can be launched using the first storage area 26 as the area in use without performing a fault diagnosis process on the first storage area 26. Even if it is determined that the data in the first storage area 26 has been tampered with, if it is determined that the data in the second storage area 27 has not been tampered with, the control software can be launched using the second storage area 27 as the area in use.

(Third embodiment)
The third embodiment will be described with reference to FIGS.
In the third embodiment, in a configuration in which a ROM has two data storage areas, secure boot processing for one data storage area and fault diagnosis processing for the other data storage area are performed in parallel.

In the ECU 21, when the CPU 24 starts the startup processing of the microcomputer 22, it starts the microcomputer 22 (A51), performs secure boot processing on the first storage area 26, and simultaneously performs fault diagnosis processing on the second storage area 27 (A52, A53).

When the CPU 24 completes the secure boot process for the first storage area 26 and the fault diagnosis process for the second storage area 27, it determines the result of the secure boot process (A54). If the MAC value matches the verification MAC value and the code flash area 26b of the first storage area 26 has not been tampered with, the CPU 24 determines that the secure boot process result is positive (A54: YES), starts the control software in the first storage area 26 (A55), and ends the startup process of the microcomputer 22.

On the other hand, if the CPU 24 determines that the MAC value and the verification MAC value do not match and that the code flash area 26b of the first storage area 26 has been tampered with, it determines that the secure boot processing result is negative (A54: NO) and performs fault diagnosis processing on the first storage area 26 while simultaneously performing secure boot processing on the second storage area 27 (A56, A57).

When the CPU 24 completes the fault diagnosis process for the first storage area 26 and the secure boot process for the second storage area 27, it determines the result of the fault diagnosis process (A58). If the CPU 24 confirms normal operation of the first storage area 26 and determines that the first storage area 26 is not faulty, it determines that the result of the fault diagnosis process is positive (A58: YES) and saves a DTC indicating intentional data tampering (A59). On the other hand, if the CPU 24 confirms abnormal operation rather than normal operation of the first storage area 26 and determines that the first storage area 26 is faulty, it determines that the result of the fault diagnosis process is negative (A58: NO) and saves a DTC indicating data tampering due to a fault in the first storage area 26 (A60).

The CPU 24 determines the results of the secure boot process (A61). If the MAC value matches the verification MAC value and the code flash area 27b of the second storage area 27 has not been tampered with, the CPU 24 determines that the results of the secure boot process are positive (A61: YES), starts the control software in the second storage area 27 (A62), and ends the startup process of the microcomputer 22.

On the other hand, if the CPU 24 determines that the MAC value and the verification MAC value do not match and that the code flash area 27b of the second storage area 27 has been tampered with, it determines that the secure boot processing result is negative (A61: NO) and determines the processing result of the fault diagnosis (A63). If the CPU 24 confirms that the second storage area 27 is operating normally and determines that the second storage area 27 is not faulty, it determines that the processing result of the fault diagnosis is positive (A63: YES) and saves a DTC indicating intentional data tampering (A64). On the other hand, if the CPU 24 confirms that the second storage area 27 is operating abnormally rather than normally and determines that the second storage area 27 is faulty, it determines that the processing result of the fault diagnosis is negative (A63: NO) and saves a DTC indicating tampering due to a fault in the second storage area 27 (A65).

The CPU 24 determines whether both the first storage area 26 and the second storage area 27 are faulty (A66). If the CPU 24 determines that at least one of the first storage area 26 and the second storage area 27 is not faulty (A66: NO), it sends a tampering notification to the in-vehicle network 9 or the communication cable 11 (A67), maintains secure boot without starting the control software (A68), and ends the startup processing of the microcomputer 22.

When the CPU 24 determines that both the first storage area 26 and the second storage area 27 are faulty (A66: YES), it sends a ROM fault notification to the in-vehicle network 9 or the communication cable 11 (A69), enables the vehicle fixation process (A70), maintains secure boot without starting the control software (A71), and ends the startup process of the microcomputer 22.

As described above, according to the third embodiment, the following advantageous effects can be obtained.
In the ECU 21, the secure boot process of the first storage area 26 and the fault diagnosis process of the second storage area 27 are performed in parallel, and the fault diagnosis process of the first storage area 26 and the secure boot process of the second storage area 27 are performed in parallel. Even if a fault occurs in either the first storage area 26 or the second storage area 27, the time required to start the control software can be reduced.

If it is determined that the data in the first storage area 26 has not been tampered with, the control software can be launched using the first storage area 26 as the area in use without performing fault diagnosis processing on the first storage area 26 or secure boot processing on the second storage area 27. Even if it is determined that the data in the first storage area 26 has been tampered with, if it is determined that the data in the second storage area 27 has not been tampered with, the control software can be launched using the second storage area 27 as the area in use.

(Other embodiments)
Although the present disclosure has been described with reference to the embodiments, it is understood that the present disclosure is not limited to the embodiments or structures. The present disclosure also encompasses various modifications and modifications within the scope of equivalents. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and spirit of the present disclosure.

The control unit and method described in this disclosure may be implemented by a special-purpose computer provided by configuring a processor and memory programmed to perform one or more functions embodied in a computer program. Alternatively, the control unit and method described in this disclosure may be implemented by a special-purpose computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and method described in this disclosure may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to perform one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored on a computer-readable non-transitory tangible recording medium as instructions executed by a computer.

In the drawing, 1 and 21 are electronic control devices, 2 and 22 are microcomputers, 3 and 23 are ROMs (data storage units), 4 and 24 are CPUs (control units), 26 is a first storage area, and 27 is a second storage area.

Claims (5)

An electronic control device ( 21) mounted on a vehicle,
a data storage unit ( 23) for storing data;
a control unit ( 24) that performs a secure boot process and determines whether or not the data stored in the data storage unit has been tampered with;
The data storage unit includes a first storage area (26) and a second storage area (27),
When the control unit determines that the data has been tampered with, it performs a fault diagnosis process on the data storage unit to determine whether the data storage unit is faulty, and when it determines that the data storage unit is not faulty, it notifies the user that the data has been intentionally tampered with, and when it determines that the data storage unit is faulty, it notifies the user that the data has been tampered with due to a fault in the data storage unit.The electronic control unit performs a fault diagnosis process on the second storage area in parallel with performing the secure boot process on the first storage area, and when it determines that the data stored in the first storage area has been tampered with, it performs the secure boot process on the second storage area in parallel with performing the fault diagnosis process on the first storage area, and when it determines that the data stored in the second storage area has not been tampered with, it launches control software using the second storage area as the area to be used . 2. The electronic control device according to claim 1, wherein when the control unit determines that the data stored in the first storage area has not been tampered with, the control unit launches control software using the first storage area as the used area without performing the fault diagnosis processing of the first storage area and the secure boot processing of the second storage area . 3. The electronic control device according to claim 1 , wherein the control unit notifies the user of any intentional data tampering and prompts the user to reprogram the correct control software . 4. The electronic control device according to claim 1 , wherein the control unit notifies the user of the data falsification caused by a malfunction of the data storage unit and urges the user to replace the microcomputer . 5. The electronic control device according to claim 1, wherein, when the control unit determines that the data has been intentionally tampered with, it stores a DTC code indicating intentional data tampering, and when the control unit determines that the data has been tampered with due to a failure of the data storage unit, it stores a DTC code indicating data tampering due to a failure of the data storage unit .