Electronic control unit and method for connection authentication

An electronic control unit mounted on a vehicle includes a processor configured to: detect a connection request from an outside device; determine, in response to the connection request, whether or not a start condition for starting a connection authentication process is satisfied, the connection authentication process being a process for determining propriety of the connection request from the outside device; control a communication state between the outside device and the electronic control unit such that the communication state becomes a linkup state when the start condition is satisfied; and start the connection authentication process when the communication state is the linkup state.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to Japanese Patent Application No. 2018-011661 filed on Jan. 26, 2018, which is incorporated herein by reference in its entirety including the specification, drawings and abstract.

BACKGROUND

1. Technical Field

The present disclosure relates to an electronic control unit and a method for connection authentication.

2. Description of Related Art

A vehicle is equipped with a plurality of electronic control units for controlling a powertrain system (such as an engine, a transmission, and an anti-lock brake system), body-related components (such as doors, seats, and mirrors), multi-media systems (such as a navigation system and an audio system), and various sensors. The electronic control units are connected with each other through an on-board network (such as a controller area network or an Ethernet network) to control each unit of the vehicle while sharing information with each other. A diagnostic tool is used as a tool for supporting a maintenance management operation. The maintenance management operation includes collecting information about failure diagnosis of the electronic control units or on-board components under the electronic control units, and rewriting programs in a flash memory mounted on each of the electronic control units. Japanese Patent Application Publication No. 2016-48848 (JP 2016-48848 A) proposes that all the following conditions are to be satisfied as a permission condition for permitting connection of the diagnostic tool to the on-board network. The conditions include: (a) an authentication code included in a communication frame that is transmitted from the diagnostic tool matches an authentication code stored in a corresponding electronic control unit; (b) a correspondence relation between the authentication code and a connection target code included in the communication frame that is transmitted from the diagnostic tool matches a correspondence relation between the authentication code and a connection target code stored in the corresponding electronic control unit; and (c) the connection target code included in the communication frame that is transmitted from the diagnostic tool is the connection target code supportable by the corresponding electronic control unit. When such a permission condition is satisfied, it can be estimated that a connection request received is the request sent from the diagnostic tool of an official operator (for example, a dealer). This makes it possible to disconnect connection requests sent from the diagnostic tools of unofficial operators.

SUMMARY

In the method for connection authentication disclosed in JP 2016-48848 A, the communication state between a diagnostic tool and an electronic control unit turns into a linkup state when an activation line transits from non-active to active. Accordingly, when a large amount of communication frames are transmitted from the diagnostic tool, the on-board electronic control unit may fall into a hang-up state. When the vehicle is in automatic driving in particular, hardware resources of the on-board electronic control unit are consumed in considerable amounts. Under such circumstances, it becomes difficult to determine propriety of a connection request appropriately. When the diagnostic tool makes a connection request to the on-board network while a signal with a high safety request level is being transmitted on the on-board network, or while the vehicle is traveling, it becomes difficult to determine the propriety of the connection request.

The present disclosure proposes an electronic control unit and a method for connection authentication reducing the possibility of permitting an illegal connection request from an outside device even when such an illegal connection request is made while the resource of the on-board electronic control unit is being consumed.

A first aspect of the disclosure provides an electronic control unit mounted on a vehicle. The electronic control unit includes a processor configured to: detect a connection request from an outside device; determine, in response to the connection request, whether or not a start condition for starting a connection authentication process is satisfied, the connection authentication process being a process for determining propriety of the connection request from the outside device; control a communication state between the outside device and the electronic control unit such that the communication state becomes a linkup state when the start condition is satisfied; and start the connection authentication process when the communication state is the linkup state.

A second aspect of the disclosure provides a method for connection authentication. The method for connection authentication includes: detecting a connection request from an outside device to an on-board network; determining, in response to the connection request, whether or not a start condition for starting a connection authentication process is satisfied, the connection authentication process being a process for determining propriety of the connection request from the outside device; controlling a communication state between the outside device and the on-board network such that the communication state becomes a linkup state when the start condition is satisfied; and starting the connection authentication process when the communication state is the linkup state.

According to the above embodiments, it is possible to determine the propriety of the connection request from an outside device appropriately even when the connection request is made while the resource of the on-board electronic control unit is being consumed.

DETAILED DESCRIPTION OF EMBODIMENTS

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. Here, like reference signs designate like component members, and redundant description is omitted.FIG. 1is an explanatory view showing the configuration of an on-board network100according to an embodiment of the present disclosure. The on-board communication network100includes a plurality of concentrators21,22that connects a plurality of electronic control units31to38mounted on a vehicle200. As a communication line connecting between the concentrators21,22and the electronic control units31to38, an Ethernet cable in conformity to 100Base-T1 standards may be used, for example. As the concentrators21,22, an Ethernet switch having a bridging function can be used, for example. For example, the electronic control units31to38controls a powertrain system of a vehicle (such as an engine, a transmission, and an anti-lock brake system), body-related components (such as doors, seats, and mirrors), multi-media systems (such as a navigation system, and an audio system), or various sensors.

The vehicle200includes a connector50for connecting an outside device40. The connector50conforms to, for example, International Organization for Standardization (ISO) 15031-3 standards, or United States Society of Automotive Engineers (SAE) J1962 standards. For example, the outside device40is a diagnostic tool that performs diagnosis communication for maintenance management of the vehicle200. The diagnosis communication includes communication for requesting transmission of self-diagnostic message information to the electronic control units31to38from the diagnostic tool, or for transmitting, in response to the request, the self-diagnostic message information to the diagnostic tool from the electronic control, units31to38. The self-diagnostic message information refers to the information related to failure diagnosis of the electronic control units31to38or the components (for example, sensors, actuators, and the like) under the electronic control units31to38. For example, the diagnosis communication also includes communication for rewriting programs in the flash memories mounted on the electronic control units31to38.

The vehicle200includes a communication line61for communication with the outside device40, and an activation line62for detecting a connection request from the outside device40. The activation line62is designed to conform to ISO 13400 standards. The activation line62transits from non-active to active when the outside device40is connected to the connector50. As the communication line61, an Ethernet cable in conformity to 100Base-TX standards can be used, for example.

The concentrator21includes an electronic control unit10that performs a connection authentication process for determining the propriety of a connection request from the outside device40. The electronic control unit10is a computer system including a communication interface (for example, an Ethernet transceiver, an Ethernet controller, or the like)11connected to the communication line61and the activation line62, a processor12, and a storage device13. The storage device13stores a computer program (hereinafter referred to as “connection authentication program”) describing a command for executing the connection authentication process. The processor12performs the connection authentication process by interpreting and executing the connection authentication program.

FIG. 2is a functional block diagram of the electronic control unit10according to the embodiment of the present disclosure. When the processor12interprets and executes the connection authentication program, various functions of a detection unit71, a determination unit72, a controller73, an authentication unit74, and a storage unit75are implemented. The various functions are implemented by collaboration between hardware resources of the electronic control unit10and the connection authentication program stored in the storage device13. The details of the functions will be described later. The connection authentication program may include, for example, a plurality of software modules that are invoked and executed in a main program. Such software modules are subprograms modularized for executing the processes that implement the various functions. The functions similar to the various functions may be implemented by using dedicated hardware resources (for example, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like) or firmware. The storage device13is a computer-readable storage medium, such as a semiconductor memory or a disc medium, for example.

The detection unit71determines that a connection request from the outside device40to the electronic control unit10is received, when the activation line62transits from non-active to active. In response to the connection request from the outside device40, the determination unit72determines whether or not a start condition for starting the connection authentication process of the outside device40is satisfied. The start condition refers to a condition for starting the connection authentication process of the outside device40without the possibility of the vehicle200permitting an illegal connection request even when the illegal connection request is made by the outside device40. For example, the start condition is to satisfy at least one condition out of: (i) the vehicle200is not in automatic driving; (ii) the travel speed of the vehicle200is less than a threshold speed (for example, 5 km/h); and (iii) a signal related to operation control of the vehicle200that is transmitted on the on-board network100has a safety request level less than a threshold level. As the safety request level, an automotive safety integrity level ASIL defined by ISO 26262 can be used, for example. As the threshold level, the level same as the ASIL that corresponds to the risk of severe or life-threatening failure may be used, for example. The controller73controls the communication state between the outside device40and the electronic control unit10to a link-down state, until the start condition is determined to be satisfied. With such configuration, connection authentication does not start when the vehicle200is in automatic driving, or when the travel speed of the vehicle200is faster than a threshold value, for example. Accordingly, safety and performance is further enhanced. When it is determined that the start condition is satisfied, the controller73controls the communication state between the outside device40and the electronic control unit10to a linkup state. When the communication state between the outside device40and the electronic control unit10is in the linkup state, the authentication unit74starts a connection authentication process for determining the propriety of the connection request from the outside device40. In the connection authentication process, the authentication unit74may authenticate whether or not the connection request is from the diagnostic tool of an official operator (for example, dealer) by a publicly-known method (for example, a method disclosed in JP2016-48848 A).

Whether or not the vehicle200is in automatic driving may be determined based on flag information (flag information indicating that the vehicle is in automatic driving) that is transmitted from an electronic control unit related to automatic driving control. Whether or not the travel speed of the vehicle200exceeds a threshold speed may be determined based on flag information (flag information indicating that the travel speed of the vehicle200exceeds the threshold value) that is transmitted from an electronic control unit related to measurement of the vehicle speed. Whether or not a signal, related to driving control of the vehicle200, transmitted on the on-board network100has a safety request level exceeding a threshold level may be determine based on flag information (flag information indicating that the safety request level of the signal related to the operation control of the vehicle200exceeds the threshold level) that is transmitted from an electronic control unit related to processing of the signal having a safety request level exceeding the threshold level. Such flag information is periodically transmitted from each of the electronic control units through the on-board network100. The storage unit75stores a history of such flag information in time series. The storage unit75stores a history of the state transition (transition from non-active to active, and transition from active to non-active) of the activation line62in time series. When a connection request is made by the outside device40, the storage unit75stores a history of information indicating whether or not the start condition is satisfied in time series. The start condition for starting the connection authentication process of the outside device40may also include (iv) when the start condition is not satisfied at the time of a connection request from the outside device40, a predetermined time has elapsed after the connection request, in addition to the aforementioned conditions (i) to (iii). The determination unit72can determine whether or not the condition (iv) is satisfied from various kinds of serial information stored in the storage unit75.

FIG. 3is a flowchart showing the process flow of a method for connection authentication according to the embodiment of the present disclosure. Since the outline of each process shown inFIG. 3is overlapped with the description ofFIG. 2, simple description will be given here.

In step301, the electronic control unit10determines whether or not a connection request from the outside device40to the on-board network100is received. When the activation line62transits from non-active to active, the electronic control unit10determines that the connection request from the outside device40to the electronic control unit10is received.

In step302, the electronic control unit10determines whether or not the start condition for starting the connection authentication process of the outside device40is satisfied. The electronic control unit10determines whether or not at least one of the conditions (i) to (iii) is satisfied, or whether or not at least one of the conditions (i) to (iv) satisfied based on the flag information transmitted on the on-board communication network100.

In step303, the electronic control unit10controls the communication state between to outside device40and the electronic control unit10from a link-down state to a linkup state. The communication state between the outside device40and the electronic control unit10is the link-down state, until the start condition is determined to be satisfied.

In step304, the electronic control unit10starts a connection authentication process for determining the propriety of the connection request from the outside device40. A publicly-known method can be used as the connection authentication process.

In step305, the electronic control unit performs communication (for example, diagnosis communication) with the outside devices40through the communication line61.

In step306, the electronic control unit10determines whether or not the communication with the outside devices40is ended.

In step307, the electronic control unit10controls the communication state between the outside device40and the electronic control unit10to the link-down state.

According to the embodiment of the present disclosure, in response to a connection request from the outside device40(step301; YES), the electronic control unit10determines whether or not the start condition for starting the connection authentication process of the outside device40is satisfied (step302). When the start condition is satisfied (step302: YES), the electronic control unit10controls the communication state between the outside device40and the electronic control unit10to the linkup state (step303), and starts the connection authentication process for determining the propriety of the connection request from the outside device40(step304). Hence, even when an illegal connection request is made by the outside device40, the possibility that the vehicle200permits the illegal connection request can be reduced.

In the above description, the electronic control unit10that performs the connection authentication process for determining the propriety of a connection request from the outside device40is incorporated in the concentrator21. However, any one electronic control unit out of the electronic control units31to34connected to the concentrator21(or any one electronic control unit out of the electronic control units35to38connected to the concentrator22) may perform the connection authentication process for determining the propriety of the connection request from the outside device40.

The embodiment described in the foregoing is presented for easy understanding of the present disclosure and is not presented for restrictive interpretation of the disclosure. Modifications and reformations of the present disclosure are possible without departing from the meaning thereof, and the equivalency thereof are also embraced in the present disclosure.