IN-VEHICLE DEVICE AND SERVER

Provided is an in-vehicle device capable of switching as to whether to make a diagnosis or not when the identification number of the vehicle is not registered in the server. The in-vehicle device 1 includes an OTA center communicating unit 2 (first communication circuit) that establishes wireless communication with an OTA center 300 (server), a memory 1b (first memory) that stores therein diagnosis permission information 4 (first information) indicating diagnosis permitted or diagnosis not permitted, and a CPU 1a (first processor). When the VIN (identification number) of the vehicle 11 having the in-vehicle device 1 onboard is not registered in the OTA center 300 and the diagnosis permission information 4 indicates diagnosis permitted, the CPU 1a makes a diagnosis of the in-vehicle device 1 and stores the result. When the VIN of the vehicle 11 having the in-vehicle device 1 onboard is not registered in the OTA center 300 and the diagnosis permission information 4 indicates diagnosis not permitted, the CPU 1a does not make a diagnosis of the in-vehicle device 1.

TECHNICAL FIELD

The present invention relates to an in-vehicle device and a server.

BACKGROUND ART

In recent automobiles, accidents caused by security attacks are on the rise in the market, and there have been demands for security measures for vehicles. An example of such security measures includes detections of data frauds.

For example, a possible attack includes a case in which an unauthorized access to the in-vehicle network of a vehicle is made from the outside world, and vehicle identification number information (VIN) stored in the ECU of the vehicle is altered. This is an attack of unauthorized altering of the vehicle identification number information. A possible security countermeasure for a vehicle against such an attack is the use of an in-vehicle device for detecting unauthorized altering of the VIN, storing error information (hereinafter, a diagnostic trouble code (DTC)), and outputting a warning.

The purpose of this warning is to notify and to prompt a user and to visit the automotive dealer. Various methods have been disclosed as a technology for storing the error information in the in-vehicle device (see PTL 1, for example).

CITATION LIST

Patent Literature

SUMMARY OF INVENTION

Technical Problem

In recent years, there has been an increasing demand for a remote software updating technology for automobiles (hereinafter, OTA: over-the-air) for updating the ECU software in an automobile remotely by applying a wireless remote software update technology to the automobile. In such an OTA system, the information stored in the OTA center is updated regularly by sending a notification of the latest information, such as the part number, the software version, and the VIN of the ECU that is onboard the vehicle to the OTA center. The purpose of this is to prevent erroneous software updates by synchronizing information stored in the OTA center with that stored on the vehicle.

In addition, by synchronizing these pieces of information, it is possible to detect data discrepancy, in case there is any. In other words, it is possible to use the synchronization of the information also as a function by which the correctness of the data is diagnosed.

By applying such a diagnostic function to detect the presence or absence of unauthorized altering of the VIN described above, the VIN stored in the in-vehicle device can be synchronized to the correct VIN in the OTA center, and, in case when there is any discrepancy in the data, it can be considered that there has been unauthorized altering of the VIN on the in-vehicle device, to store a DTC in the in-vehicle device, and to output a warning.

However, assuming practical use, misdiagnoses described following can be made.

One of such misdiagnoses is that can occur when the power of a vehicle is turned ON and communication with the OTA center is established before a VIN is written to the vehicle in a vehicle assembly factory. A VIN mismatch will then be detected and a DTC will be stored.

The other case is a misdiagnosis that can occur even after a VIN is written to the vehicle. If the power of the vehicle is turned ON before the VIN is registered in the VIN information management in the OTA center, VIN unregistered will be detected and a DTC will be stored in the same manner.

An object of the present invention is to provide an in-vehicle device capable of detecting unauthorized altering of a VIN without making any erroneous diagnoses even before the VIN is written to the vehicle or even before the VIN of the vehicle is registered to the server, as described above.

Solution to Problem

In order to achieve the above object, according to an example of the present invention, an in-vehicle device includes: a first communication circuit that establishes wireless communication with a server; a first memory that stores therein first information indicating diagnosis permitted or diagnosis not permitted; and a first processor, wherein the first processor makes a diagnosis of the in-vehicle device and stores therein a result when an identification number of a vehicle having the in-vehicle device onboard is not registered in the server and the first information indicates diagnosis permitted, and does not make a diagnosis of the in-vehicle device when the identification number of the vehicle having the in-vehicle device onboard is not registered in the server and the first information indicates diagnosis not permitted.

Advantageous Effects of Invention

According to the present invention, it is possible to switch as to whether to make a diagnosis or not when the identification number of the vehicle is not registered in the server. Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

DESCRIPTION OF EMBODIMENTS

An in-vehicle device and an OTA system according to an embodiment of the present invention will now be explained with reference toFIGS.1to4, among the accompanying drawings.

General configurations of the in-vehicle device and an in-vehicle system according to the embodiment of the present invention will be now explained with reference toFIG.1.

An in-vehicle device1is a device capable of communicating with a VIN retaining ECU12, a navigation VIN screen display13, a diagnosing unit14, and an OTA center300, and includes, for example, an OTA center communicating unit2, a diagnosis processing unit3, a diagnosis permission information4, and a DTC area5. The in-vehicle device1transmits OTA synchronization information200to the OTA center300, and receives an OTA synchronization response201from the OTA center300. Such in-vehicle devices1are installed in vehicles11in a vehicle assembly factory (100) and a market (400).

Components in the vehicle assembly factory (100) include the vehicle11and the diagnosing unit14. Note that the diagnosing unit14is, for example, a laptop computer in which a tool (software) for displaying a result of a diagnosis of the in-vehicle device1is installed, for example. The diagnosing unit14is also installed in a car dealer420in the market (400).

The OTA center (300) is capable of communicating with the in-vehicle device1, and components of which include OTA information301, authorized VIN registration information302, diagnosis permission information303, and external fraud monitor304, for example. The OTA center (300) receives the OTA synchronization information200from the in-vehicle device1and transmits the OTA synchronization response201to the in-vehicle device1.

Components of the market (400) include, for example, the vehicle11, the car dealer420, and an unauthorized input410from the outside world.

The in-vehicle device1is, for example, an electronic control unit (ECU). As illustrated inFIG.5, the in-vehicle device1includes a CPU1a(first processor), a memory1b(first memory), a communication circuit1c(first communication circuit), an I/F1d(input/output circuit). The CPU1aillustrated inFIG.5functions as the diagnosis processing unit3illustrated inFIG.1, and the communication circuit1cillustrated inFIG.5functions as the OTA center communicating unit2illustrated inFIG.1.

The OTA center300is, for example, a server. As illustrated inFIG.6, the OTA center300includes a CPU300a(second processor), a memory300b(second memory), a communication circuit300c(second communication circuit), an I/F300d(second input/output circuit), a hard-disk drive (HDD), and the like. The CPU1aillustrated inFIG.5functions as the diagnosis processing unit3illustrated inFIG.1, and the communication circuit1cillustrated inFIG.5functions as an external fraud monitor304illustrated inFIG.1.

(Synchronization between Vehicle Assembly Factory and OTA Center)

In the vehicle assembly factory (100), as a process of assembling the vehicle11, the in-vehicle device1, the VIN retaining ECU12, and the navigation VIN screen display13are connected to one another. When the power of the vehicle11is turned ON after the assembly, the in-vehicle device1receives VIN absence202from the VIN retaining ECU12, puts the VIN absence202in the OTA synchronization information200, and transmits the result to the OTA center300via the OTA center communicating unit2. The VIN absence202herein is data indicating that VIN is empty or null, for example.

As illustrated inFIG.3, the OTA center300receives the VIN absence202in the OTA synchronization information200(S210), determines whether the information matches the authorized VIN registration information302(S220). If the information does not match the authorized VIN information (S220: NO), because the diagnosis permission information303is set to diagnosis not permitted (initial value) (S250: NO), the OTA center includes VIN unregistered203representing an error in the OTA synchronization response and sends the response (S270).

As illustrated inFIG.2, the in-vehicle device1in the vehicle assembly factory (100) receives the response with the VIN unregistered203(S110). Because the OTA synchronization response is an error response (VIN non-registration) (S120), and because the diagnosis permission information4is set to diagnosis not permitted (initial value) (S130: NO), a diagnosis of the VIN is not performed (S130: NO).

As illustrated inFIG.4, if the diagnosis permission information4is set to diagnosis not permitted (S310: NO), the in-vehicle device1in the vehicle assembly factory (100) does not make a diagnosis of the VIN, but responds with a normal diagnosis result to the navigation VIN screen display13and the diagnosing unit14(S320).

In other words, the in-vehicle device1includes the OTA center communicating unit2(first communication circuit) that establishes wireless communication with the OTA center300(server), the memory1b(first memory) that stores therein the diagnosis permission information4(first information) indicating diagnosis permitted or diagnosis not permitted, and the CPU1a(first processor). If no VIN (identification number) of the vehicle11having the in-vehicle device1onboard is not registered in the OTA center300(server) and if the diagnosis permission information4indicates diagnosis not permitted, the in-vehicle device1is not diagnosed.

In this embodiment, the memory1b(first memory) stores therein diagnosis permission information4(first information) indicating diagnosis not permitted as an initial value. As a result, for example, when the power of the in-vehicle device1is turned ON in the factory or the like, no diagnosis is performed even if the VIN (identification number) of the vehicle11is not registered in the OTA center300(server).

As illustrated inFIG.1, the in-vehicle device1in the market400receives the authorized VIN (010)204from the VIN retaining ECU12, and transmits the OTA synchronization information200including the authorized VIN (010)204to the OTA center300via the OTA center communicating unit2.

As illustrated inFIG.3, the OTA center300receives the authorized VIN (010)204in the OTA synchronization information200(S210), determines whether the information matches the authorized VIN registration information302(S220), rewrites the diagnosis permission information303to the diagnosis permitted (S230) because the information is the authorized VIN information (S220: YES), sets the OTA synchronization response201to normal, includes the diagnosis permitted205in the diagnosis permission information303, and sends the response (S240).

In other words, the OTA center300(server) includes the communication circuit300c(second communication circuit) that establishes wireless communication with the in-vehicle device1, and the CPU300a(second processor). The CPU300a(second processor) receives the VIN (identification number) of the vehicle11from the in-vehicle device1via the communication circuit300c(second communication circuit), determines whether the VIN of the vehicle11is registered in the HDD300or the like in the OTA center300(server), and, if it is determined that the VIN of the vehicle11is registered in the OTA center300, transmits diagnosis permission information303(second information) indicating diagnosis permitted, to the in-vehicle device1via the communication circuit300c(second communication circuit).

As a result, when it is determined that the VIN (identification number) of the vehicle11is registered in the OTA center300(server), the OTA center300can set diagnosis permission information4(initial value of the first information) having been indicating diagnosis not permitted to diagnosis permitted, via the diagnosis permission information303(second information).

In this embodiment, only the first time it is determined that the VIN (identification number) of the vehicle11is registered in the OTA center300(server), the CPU300a(second processor) transmits the diagnosis permission information303(second information) indicating diagnosis permitted to the in-vehicle device1via the communication circuit300c(second communication circuit).

As a result, only the first time it is determined that the VIN of the vehicle is registered in the OTA center300, the OTA center300can set the diagnosis permission information4(the initial value of the first information) indicating diagnosis not permitted to diagnosis permitted, via the diagnosis permission information303(the second information).

Specifically, the OTA center300(server) includes the memory300b(second memory) that stores therein the diagnosis permission information303(second information) indicating diagnosis not permitted as the initial value. When the VIN (identification number) of the vehicle11is determined to be registered in the OTA center300(server) and the diagnosis permission information303(second information) in the memory300b(second memory) indicates diagnosis not permitted, the CPU300a(second processor) rewrites the diagnosis permission information303in the memory300bso as to indicate diagnosis permitted, and transmits the diagnosis permission information303indicating diagnosis permitted to the in-vehicle device1via the communication circuit300c(second communication circuit).

As a result, only the first time it is determined that the VIN (identification number) of the vehicle11is registered in the OTA center300(server), the OTA center300(server) can set diagnosis permission information4(initial value of the first information) indicating diagnosis not permitted to diagnosis permitted, via the diagnosis permission information303(second information). It is also possible to synchronize the diagnosis permission information4(first information) in the memory1b(first memory) with the diagnosis permission information303(second information) in the memory300b(second memory).

The CPU300a(second processor) may count the number of times the VIN (identification number) of the vehicle11is determined to be registered in the OTA center300(server), and, when the count is incremented from 0 to 1, transmit the diagnosis permission information303(second information) indicating diagnosis permitted to the in-vehicle device1via the communication circuit300c(second communication circuit).

As a result, only the first time it is determined that the VIN (identification number) of the vehicle11is registered in the OTA center300(server), the OTA center300(server) can set diagnosis permission information4(initial value of the first information) indicating diagnosis not permitted to diagnosis permitted, via the diagnosis permission information303(second information).

As illustrated inFIG.2, the in-vehicle device1in the market400receives the diagnosis permitted205in the OTA synchronization response201(S110). Because the OTA synchronization response201is a normal response (VIN is registered in the center) (S120), the diagnosis processing unit3sets the diagnosis permission information4as diagnosis permitted (S140) to permit a diagnosis of the VIN.

In this embodiment, the CPU1a(first processor) in the in-vehicle device1transmits the VIN (identification number) of the vehicle11to the OTA center300(server) via the OTA center communicating unit2(first communication circuit). When it is determined that the VIN of the vehicle11is registered in the OTA center300, the CPU1areceives the diagnosis permission information303(second information) indicating diagnosis permitted, from the OTA center300via the OTA center communicating unit2, and rewrites the diagnosis permission information4(first information) in the memory1b(first memory) so as to match the diagnosis permission information303(second information).

With this, when it is determined that the VIN (identification number) of the vehicle11is registered in the OTA center300(server), it is possible to set the diagnosis permission information4(first information) to indicate diagnosis permitted, via the diagnosis permission information303(second information). As a result, a diagnosis is permitted when a VIN is assigned to the vehicle11and the VIN of the vehicle11is registered in the OTA center300, for example.

As illustrated inFIG.1, if VIN is altered by the unauthorized input410from the outside of the VIN retaining ECU12in the market400after the diagnosis is permitted, the in-vehicle device1receives, after the vehicle is powered ON, unauthorized VIN (444)411from the VIN retaining ECU12, and transmits the OTA synchronization information200including the unauthorized VIN (444)411to the OTA center300via the OTA center communicating unit2.

As illustrated inFIG.3, the OTA center300receives the unauthorized VIN (444)411in the OTA synchronization information200(S210), and determines whether the information matches the authorized VIN registration information302(S220). Because the diagnosis permission information303is set to diagnosis permitted (S250: YES), the OTA center300detects that it is the unauthorized VIN information (S260), and responds with the OTA synchronization response201including VIN unregistered203indicating an error (S270).

In other words, when it is determined that the VIN (identification number) of the vehicle11is not registered in the OTA center300(server) and the diagnosis permission information303(second information) in the memory300b(second memory) indicates diagnosis permitted, the CPU300a(second processor) determines that there has been unauthorized altering of the VIN on the vehicle11. In this manner, the OTA center300(server) can detect the unauthorized altering of the VIN (identification number) on the vehicle11.

As illustrated inFIG.2, the in-vehicle device1in the market400receives the VIN unregistered203in the OTA synchronization response201(S110). Because the OTA synchronization response201is an error response (VIN unregistered) (S120) and the diagnosis permission information4indicates diagnosis permitted in the diagnosis processing unit3(S130: YES), the DTC is stored as a detection of an unauthorized VIN (S150). As illustrated inFIG.4, because the diagnosis permission information4indicates diagnosis permitted (S310: YES), the VIN is diagnosed (S330), and the in-vehicle device1in the market400outputs an error diagnosis result to the navigation VIN screen display13and the diagnosing unit14.

In other words, when the VIN (identification number) of the vehicle11having the in-vehicle device1onboard is not registered in the OTA center300(server) and the diagnosis permission information4(first information) indicates diagnosis permitted, the CPU1a(first processor) makes a diagnosis of the in-vehicle device1, and stores the result in the memory, for example.

In this manner, it is possible to switch as to whether to perform a diagnosis or not based on the diagnosis permission information4(first information) when the VIN (identification number) of the vehicle11is not registered in the OTA center300(server). For example, when the VIN of the vehicle11is not registered in the OTA center300because the vehicle11has not been assigned with a VIN, by setting the diagnosis permission information4to indicate diagnosis not permitted, a diagnosis is avoided. By contrast, by setting the diagnosis permission information4to indicate diagnosis permitted, when the VIN of the vehicle11is not registered in the OTA center300due to the altering of the VIN on the vehicle11, a diagnosis is performed.

In this embodiment, when the VIN (identification number) of the vehicle11is not registered in the OTA center300(server) and the diagnosis permission information4(first information) indicates diagnosis permitted, the CPU1a(first processor) makes a diagnosis based on a standard of the in-vehicle device1(e.g., the On-Board Diagnosis Second Generation (OBD 2)) and stores a failure code (e.g., Diagnostic Trouble Code (DTC)) corresponding to the result in the memory, for example.

As a result, by setting the diagnosis permission information4(first information) to indicate diagnosis permitted, when the VIN of the vehicle11is not registered in the OTA center300(server) because the VIN (identification number) of the vehicle11has been altered, a diagnosis conforming to the standard of the in-vehicle device1is performed and a failure code corresponding to the result is stored.

Furthermore, when the VIN (identification number) of the vehicle11is not registered in the OTA center300(server) and the diagnosis permission information4(first information) indicates diagnosis permitted, the CPU1a(first processor) determines that there has been unauthorized altering of the VIN on the vehicle11. In this manner, the in-vehicle device1can detect that there has been unauthorized altering of the VIN on the vehicle.

In the manner described above, according to this embodiment, it is possible to switch as to whether to perform a diagnosis or not when the VIN (identification number) of the vehicle is not registered in the OTA center300(server).

Note that the present invention is not limited to the above-described embodiment and includes various modifications. For example, the embodiment has been described above in detail to facilitate understanding of the present invention, and is not necessarily limited to the configuration including all of the elements described above. Furthermore, a part of the configuration according to one embodiment can be replaced with a configuration according to another embodiment, and a configuration according to another embodiment can be added to the configuration of the one embodiment. In addition, another configuration may be added to, deleted from, and replaced with a part of the configuration according to each of the embodiments.

In the embodiment described above, the VIN retaining ECU12and the in-vehicle device1are separate units, but may be integrated.

In addition, some or all of the configurations, functions, and the like described above may be implemented as hardware, by designing with an integrated circuit, for example. In addition, each of the configurations, functions, and the like described above may be implemented as software by causing a processor to parse and to execute a computer program for implementing the corresponding function. Information such as a program, a table, and a file for implementing each of the functions may be stored in a recording device such as a memory, a hard disk, and a solid state drive (SSD), or a recording medium such as an IC card, an SD card, and a DVD.

The embodiment of the present invention may be configured in the following manner.

(1) An in-vehicle device comprising: an over-the-air (OTA) center that makes an operation on vehicle identification number information (VIN); an OTA center; and synchronization information, wherein appropriateness of a diagnosis of the VIN is determined from the synchronization information, based on diagnosis permission information.

(2) In (1), when synchronization with the OTA center does not succeed, the diagnosis permission information is set to not permitted based on a determination by the OTA center, so that the diagnosis is not performed. The in-vehicle device then causes the diagnosing unit to read the diagnosis permission information and to check a VIN operation performed by the OTA center.

(3) In (1), when synchronization with the OTA center succeeds, the in-vehicle device sets the diagnosis permission information to be permitted based on a determination of the OTA center, and after the synchronization with the OTA center is established, makes a diagnosis of the VIN based on the diagnosis permission information and on a determination of the OTA center.

(4) In (1), it is possible to detect an attack from the outside based on the diagnosis permission information, simultaneously with the OTA center.

(5) In (1), for the diagnosis permission information, a synchronization counter may be used to further increase the accuracy.

(6) In (1), the diagnosing unit is enabled to check a detection of an attack from the outside, and to check and to rewrite the diagnosis permission information.

(7) The OTA center is enabled to make an operation on the diagnostic information permission in the in-vehicle device based on the synchronization information.

(8) The OTA center is enabled to detect an attack from the outside of the in-vehicle device based on the synchronization information.

With the in-vehicle devices according to any one of (1) to (8), the in-vehicle device does not make a diagnosis in the vehicle assembly factory until the OTA center registers an authorized VIN. Because the in-vehicle device does not perform the diagnosis, the DTC for an unauthorized VIN is not stored.

By contrast, in the market, the in-vehicle device can make a diagnosis as to whether a VIN is an unauthorized VIN and the authorized VIN, based on content where the authorized VIN information is registered in the OTA center. Furthermore, because synchronous communication is periodically established with the OTA center, a failure diagnosis for a detection of an unauthorized VIN can be made at the stage at which a cyberattack from the outside world is received.

The OTA center can detect an attack from the outside world at the same timing as the in-vehicle device onboard a vehicle managed by the center, and can operate the diagnosis permission information of the vehicle remotely.

REFERENCE SIGNS LIST