Abstract:
An information processing system made up of a plurality of controllers in a vehicle has a tamperproof configuration by including, in a specific controller among the plurality of controllers: a starter putting the specific controller among the plurality of controllers in a executable state which enables the specific controller among the plurality of controllers to execute a preset program; a determiner determining, before the specific controller among the plurality of controllers is put in the executable state, whether software that is memorized in a preset memory area and at least includes the preset program is tampered; and an outputter outputting, to one of processing devices outside the vehicle. In such manner, the tampering of the software is quickly detectable while preventing an increase of communication load of a communication network and/or the information processing system.

Description:
CROSS REFERENCE TO RELATED APPLICATION 
       [0001]    The present application is based on and claims the benefit of priority of Japanese Patent Application No. 2016-053920, filed on Mar. 17, 2016, the disclosure of which is incorporated herein by reference. 
       TECHNICAL FIELD 
       [0002]    The present disclosure generally relates to a verification technique for detecting abnormality in a controller of a vehicle. 
       BACKGROUND INFORMATION 
       [0003]    An in-vehicle electronic control unit (ECU) may be prone to hacking, or unauthorized overwriting of a control program, and therefore, needs to be protected, thereby requiring a verification technique for detecting abnormality in a controller of a vehicle. A patent document, JP 2014-138380 A, (patent document 1) discloses a technique for detecting an unjust state of a vehicle by the comparison of ECU verification messages in a verification center that is provided as an outside facility outside of the vehicle, with which a tampering of an ECU by the other ECU is detectable. 
         [0004]    However, the above-described technique checks/verifies each of many ECUS that exchange messages at the outside verification center, and therefore is incapable of detecting the unjust state at the moment of tampering. For an immediate detection of the tampering, in other words, the communication with the verification center needs to be more frequently performed, which may increase the communication load. 
       SUMMARY t is an object of the present disclosure to provide a technique for quickly detecting a tampering of software in a controller of a vehicle without increasing the communication load. 
       [0005]    In an aspect of the present disclosure, an information processing system includes a plurality of controllers in a vehicle, the plurality of controllers including a specific controller, the specific controller including a starter putting the specific controller in an executable state that enables the specific controller to execute a preset program, a preset memory area memorizing a software that includes at least the preset program, a determiner determining, before the specific controller is put in the executable state by the starter, whether the software has been tampered, and an outputter outputting, to at least one of the plurality of controllers other than the specific controller or one of a plurality of information processing devices disposed outside of the vehicle, a preset signal upon the determiner determines that the software has been tampered. 
         [0006]    In such configuration, when the tampering of the software of the specific controller is discovered, i.e., is determined, the preset signal is output to at least one of the outside controllers/devices from the specific controller, thereby enabling a detection of the tampering of the software of the specific controller when the specific controller is started. Further, there is no need to communicate with the outside controllers/devices of the specific controller in order to detect the tampering of the software, thereby preventing an increase of the communication load. 
         [0007]    Parenthesized numerals in the above simply show one example relationship between claim elements in the claims and concrete components in the embodiment, thereby not limiting a technical scope of the present disclosure. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0008]    Objects, features, and advantages of the present disclosure will become more apparent from the following detailed description made with reference to the accompanying drawings, in which; 
           [0009]      FIG. 1  is a block diagram of an information processing system in an embodiment of the present disclosure; 
           [0010]      FIG. 2  is a block diagram of an in-vehicle system in the embodiment of the present disclosure; 
           [0011]      FIG. 3  is a flowchart of a boot process; 
           [0012]      FIG. 4  is a flowchart of an abnormality display process; 
           [0013]      FIG. 5  is a flowchart of a mode set process; 
           [0014]      FIG. 6  is a flowchart of a travel control process; 
           [0015]      FIG. 7  is a block diagram of the information processing system in another embodiment of the present disclosure; and 
           [0016]      FIG. 8  is a block diagram of the information processing system in yet another embodiment of the present disclosure. 
       
    
    
     DETAILED DESCRIPTION 
       [0017]    Hereafter, one embodiment for implementing the present disclosure is described, with reference to the drawings. 
       1. Embodiment 
       [0018]    [1-1. Configuration] 
         [0019]    An information processing system  1  shown in  FIG. 1  is a system including an in-vehicle system  11  disposed in a vehicle  2 , that is, may include a center terminal  3  installed in an information process center outside of the vehicle  2 , a portable terminal  4 , and a stationary terminal  5  installed in a preset store. The information process center and the store are only an example of disposed/installed position of those devices, not necessarily limiting the disposed/installed position of the center terminal  3  and the stationary terminal  5 . 
         [0020]    The center terminal  3  is configured to be capable of communicating with a communication device  29  which is disposed in the in-vehicle system  11  that is mentioned later, the portable terminal  4 , and the stationary terminal  5 . 
         [0021]    The center terminal  3  and the stationary terminal  5  are, respectively, a computer system that has a Central Processing Unit (CPU), a memory, and the like, for providing various functions that are realized by executing a stored program in the memory. 
         [0022]    The portable terminal  4  includes a microcomputer, a wireless communication module, a display, a speaker, and the like, and is capable of performing communication with the center terminal  3  through a base station, of displaying image, and of outputting sound/voice. 
         [0023]    The center terminal  3  is an example of an information receiver in the claims, and the portable terminal  4  and the stationary terminal  5  are, respectively, an example of a wireless communication terminal in the claims. 
         [0024]    As shown in  FIG. 2 , the in-vehicle system  11  has two or more electronic control units (i.e., ECUS) having respectively different functions, and is connected with each other via a communication line  13 . 
         [0025]    As the ECUS described above may further be defined as a specific ECU  21 , a meter ECU  23 , an engine ECU  25 , an external communication ECU  27 , and the like, for example. The external communication ECU  27  serves as a part of the communication device  29 . 
         [0026]    Two or more ECUS mentioned above are equivalent to a plurality of controllers in the claims, and the specific ECU  21  is equivalent to a specific controller in the claims. 
         [0027]    The specific ECU  21  is provided with a micro-controller (henceforth, MCU)  31  and a transceiver  33 . 
         [0028]    The MCU  31  has, as its main component, a microcomputer that includes, for example, a CPU  41  and a semiconductor memory (i.e., a memory  42  hereafter) such as Random Access Memory (RAM), Read-Only Memory (ROM), and/or a flash memory, and also has a boot ROM  43  and a communication controller  44 . 
         [0029]    Each of the various functions of the MCU  31  is realized by executing a stored program in a non-transitive and substantive memory medium by the CPU  41 . In the present embodiment, the memory  42  is a non-transitive and substantive memory medium for storing a program. 
         [0030]    Further, according to the execution of the stored program, a method corresponding to the stored program is performed. The number of the microcomputers disposed in the MCU  31  may be only one or may be more than one. 
         [0031]    The function realized by the MCU  31  is not strictly limited. In other words, the specific ECU  21  of the present embodiment serves as an ECU for realizing each of the various functions. 
         [0032]    In the following description, a primary function, or primary functions, performed by the MCU  31  are designated as main function(s). The main function is equivalent to a preset function in the claims. 
         [0033]    A memory area implemented by the memory  42  may partially be configured as a security area  42   a,  in which the stored program, or “software”, is determined as being tampered or not by a boot process mentioned later. 
         [0034]    In the security area  42   a,  software, e.g., a program executed in order for the MCU  31  to realize the main function, is memorized. The security area  42   a  is equivalent to a preset memory area, 
         [0035]    The tampering of software may be defined as an unauthorized overwriting of data performed via/over the network by a third party, for example, In a memory area  43   a  that is implemented as the boot ROM  43 , a hash value is memorized, for a determination of the tampering of software, e.g., (i) the program or the like, that is first executed at the time of starting of the specific ECU  21 , and/or (ii) the software memorized in the security area  42   a.    
         [0036]    Note that the CPU  41  implements a function of each of a starter, a determiner, and an outputting, respectively recited in the claims, by executing the program read out from the boot ROM  43  at the time of starting of the specific ECU  21 . 
         [0037]    The starter puts the specific ECU  21  in an executable state, which may be defined as a state in which an execution of a preset program is enabled. The program stated above is a program memorized in the security area  42   a.    
         [0038]    The determiner determines whether the software that at least includes the above-mentioned program memorized in the security area  42   a  is tampered, before the starter puts the specific ECU  21  in the executable state. The details about the security area  42   a  are described later. 
         [0039]    The outputter is an abnormality notification frame for notifying at least one of the ECUS except the specific ECU  21  about the abnormality of the specific ECU  21 , when it is determined by the determiner that the software is tampered. The abnormality notification frame is equivalent to a preset signal in the claim. 
         [0040]    Note that the abnormality notification frame includes, for example, vehicle information, Identification (ID) information, version information of the software memorized in the security area  42   a,  time information, and position information. However, the abnormality notification frame does not have to include all of the above. Further, the version information is information of a version of the software before the tampering. 
         [0041]    The vehicle information is information for identifying the vehicle  2  in which the specific ECU  21  is disposed. Note that the vehicle information may include one or both of (i) vehicle type identification information for identifying a type of the vehicle  2  and (ii) vehicle identity information for identifying an identity of the vehicle  2 , i.e., for identifying an individual vehicle  2 . 
         [0042]    The ID information is information for identifying an identity of the specific ECU  21 , for identifying an individual specific ECU  21 . 
         [0043]    The time information is information indicative of time of performing a tampering determination by the determiner. 
         [0044]    The position information is information for identifying a position of the specific ECU  21 , i.e., a position of the vehicle  2 , and is, for example, Global Navigation Satellite System (GNSS) information or the like received by using a GNSS antenna (not illustrated). 
         [0045]    The communication controller  44  sends out, or transmits, a control signal generated by the CPU  41  to the communication line  13  according to a preset protocol, and receives the control signal from the other ECUS via the communication line  13 , and transmits the control signal to the CPU  41 . 
         [0046]    The transceiver  33  is connected to the communication controller  44  and to the communication line  13 , for transmitting an analog signal on the communication line  13  to the communication controller  44  as digital data after analog-digital conversion of the analog signal and for sending out an analog signal to the communication line  13  by converting the digital signal from the communication controller  44  to the analog signal. 
         [0047]    The meter ECU  23  controls a display device  24  including an image display area/portion of an instrument panel, an indicator lamp on the instrument panel, and the like, for letting an occupant of the vehicle to recognize a vehicle state, i.e., for notifying a state of the vehicle to an occupant of the vehicle. The display device  24  is equivalent to a warning device in the claims. 
         [0048]    The meter ECU  23  has, as its main component, a microcomputer of well-known type, which includes, for example, a CPU  23   a  and a semiconductor memory (i.e., a memory  23   b  hereafter) such as RAM, ROM, and/or a flash memory, and each of the above-described functions is realized by executing a stored program in a non-transitive and substantive memory medium by the CPU  23   a.  In the present embodiment, the memory  23   b  is a non-transitive and substantive memory medium for storing a program. 
         [0049]    The engine ECU  25  has a CPU  25   a,  a memory  25   b,  and the like, just like the meter ECU  23 , and, a drive control of an engine  26 , i.e., a drive device disposed in the vehicle, is realized by the execution of a program by the CPU  25   a.  The engine ECU  25  may be set to a safety control mode, which is a mode different from a normal mode, and, when being set to the safety control mode, the engine ECU  25  performs a different control different from a control in the normal mode. The above-mentioned engine  26  is equivalent to a drive device in the claims. 
         [0050]    Note that the vehicle  2  may use a drive device other than the engine, e.g., a motor, and, the engine ECU  25  may control the motor in such case. 
         [0051]    The external communication ECU  27  controls a communication module  27   c  in the communication device  29 , with which communication with the center terminal  3  is performed. The communication module  27   c  may be, for example, a module that is capable of performing wireless communication via a mobile communication network, or may also be a module capable of performing other type of communication. The external communication ECU  27  has a CPU  27   a,  a memory  27   b,  and the like, just like the meter ECU  23 , and each of the above-described function is realized by the execution of a program by the CPU  27   a.    
         [0052]    [1-2. Process] 
         [0053]    [1-2-1. Process in the Specific ECU  21 ] 
         [0054]    The boot process performed by the CPU  41  of the specific ECU  21  is described with reference to a flowchart in  FIG. 3 . The boot process is started when an accessary switch of a subject vehicle is turned ON and a power supply of the specific ECU  21  is turned ON. 
         [0055]    In S 1 , the CPU  41  initializes itself, i.e., the CPU  41 , first. More specifically, a cache, a register, and the like inside the CPU  41  are initialized. 
         [0056]    In S 2 , the CPU  41  initializes a program. That is, the CPU  41  performs setting of an input/output port and an initial output therefrom, and performs an initial value setting and the like. 
         [0057]    In S 3 , the CPU  41  performs a security check, and determines whether a check result is good, i.e., OK. The security check in such case means a check or a determination of whether the software memorized in the security area  42   a  has been tampered, and the security check is performed by the determiner mentioned above. 
         [0058]    The software checked by the security check includes the program and data that is used to execute the program, as well as other matter. 
         [0059]    More specifically, the CPU  41  reads a reference hash value from the memory area  43   a  of the boot ROM  43 . The reference hash value is a hash value computed when the program and data which are memorized in the security area  42   a  are not tampered. 
         [0060]    Then, the CPU  41  computes the hash value of the program and the data memorized in the security area  42   a,  and compares the computed hash value with the reference hash value. 
         [0061]    When the computed hash value and the reference hash value are in agreement, i.e., where both the program and data are matching with each other, it is determined that the check result is good/OK, and, when the computed hash value and the reference hash value are not matching with each other, i.e., where at least for one of the program and data do not match, it is determined that the security checked result is not good/OK, i.e., determining that the program or data has been tampered. 
         [0062]    When it is determined that the security check result is good/OK in S 3 , the process proceeds to S 4 . 
         [0063]    On the other hand, when it is not determined that the security check result is good/OK in S 3 , the process proceeds to S 6 . 
         [0064]    In S 4 , the CPU  41  performs other reset and/or initialization. In this case, initialization of the specific ECU  21  as a whole other than the CPU  41  is performed. 
         [0065]    In S 5 , the CPU  41  starts a main process for realizing the main function by the specific ECU  21 . More specifically, the program memorized in the security area  42   a  is read and executed. The boot process ends after S 5 . 
         [0066]    In S 6 , the CPU  41  initializes the transceiver  33 . Then, in S 7 , the CPU  41  initializes the communication controller  44 . 
         [0067]    By these processes, the specific ECU  21  is put in a communicable state in which communication between the specific ECU  21  and the other ECUS in the vehicle is enabled. 
         [0068]    In S 8 , the CPU  41  outputs the abnormality notification frame on the communication line  13 . Thereby, the abnormality notification frame is transmitted to the other ECUS. This process, i.e., an output of the abnormality notification frame, is a process by the outputter, which is recited in the claims. 
         [0069]    In S 9 , the CPU  41  resets the whole ECU, i.e., the specific ECU  21 . Then, the process returns to Si. That is, what is a so-called reboot is performed. 
         [0070]    [1-2-2. Process in the Meter ECU  23 ] 
         [0071]    An abnormality display process performed by the CPU  23   a  of the meter ECU  23  is described with reference to a flowchart in  FIG. 4 . 
         [0072]    The process is started when the abnormality notification frame outputted from the specific ECU  21  is firstly received. 
         [0073]    That is, in S 21 , the CPU  23   a  determines whether a preset time has lapsed after receiving the abnormality notification frame. The preset time in this case is a period of time to display abnormality on the display device  24 . 
         [0074]    When it is determined in S 21  that the preset time has lapsed, the process proceeds to S 23 . 
         [0075]    On the other hand, when it is not determined in S 21  that the preset time has lapsed, the process proceeds to S 22 . 
         [0076]    In S 22 , the CPU  23   a  performs, i.e., starts, a display process which controls the display device  24  to display abnormality. For example, the CPU  23   a  turns ON, lights or blinks, a lamp that indicates abnormality, or displays an image that indicates abnormality. 
         [0077]    In S 23 , the CPU  23   a  ends the display process. That is, the CPU  23   a  stops the lighting of the lamp of the displaying of the image. The abnormality display process ends after S 23 . 
         [0078]    [1-2-3. Process in the Engine ECU  25 ] 
         [0079]    A mode set process performed by the CPU  25   a  of the engine ECU  25  is described with reference to a flowchart in  FIG. 5 . 
         [0080]    The process is started when the abnormality notification frame outputted from the specific ECU  21  is received by the CPU  25   a.    
         [0081]    In the mode set process, the CPU  25   a  sets an operation mode of the engine ECU  25  to a safety control mode in S 31 . Then, the process ends. 
         [0082]    Next, a travel control process performed by the CPU  25   a  is described with reference to a flowchart in  FIG. 6 . 
         [0083]    The travel control process is started when the operation mode is set to the safety control mode in S 31 . 
         [0084]    In S 32 , the CPU  25   a  determines whether the vehicle is traveling. More practically, based on an output of a vehicle speed sensor disposed in the vehicle (not illustrated), it is determined that the vehicle is not traveling when a vehicle speed is 0 km/h, and it is determined that the vehicle is traveling when the vehicle speed is not 0 km/h. Whether or not the vehicle is traveling may also be determined by other method, i.e., based on other factors other than the output of the vehicle speed sensor. For example, it may be determined based on an engine driving state, a change of the position of the vehicle  2 , etc. 
         [0085]    When it is determined that the vehicle is traveling in S 32 , the process proceeds to S 34 . On the other hand, when it is determined that the vehicle is not traveling, the process proceeds to S 33 . 
         [0086]    In S 33 , the CPU  25   a  stops the engine. Further, it is set that the starting of the engine will not be performed even when the driver of the vehicle performs an engine start operation. 
         [0087]    The process ends after S 33 . 
         [0088]    In S 34 , the CPU  25   a  performs a travel at a reduced speed. The travel at a reduced speed means that the travel speed of the vehicle is gradually reduced, finally down to 0 km/h, without acceleration. The process proceeds to S 23  after the stop of the vehicle. 
         [0089]    The process ends after S 34 . 
         [0090]    Although the control of restricting the drive of the engine is shown in S 33  and S 34 , other control other than the above control may also be performed. 
         [0091]    For example, instead of controlling/reducing the travel speed in the above-described manner, the travel speed may be reduced in other manners. More practically, the travel speed of the vehicle may be reduced gradually down to a preset speed, e.g., down to 30 km/h, and then the travel speed thereafter may be set to accelerate only up to the preset speed. 
         [0092]    [1-2-4. Process in the External Communication ECU  27 ] 
         [0093]    The CPU  27   a  of the external communication ECU  27  that is disposed in the communication device  29  transmits a first signal A to the center terminal  3 , when the CPU  27   a  receives the abnormality notification frame outputted from the specific ECU  21 . 
         [0094]    The first signal A includes the vehicle information, the ID information, the version information of the software memorized in the security area  42   a,  the time information, and the position information, to be output to the center terminal  3 . The first signal A does not need to include all of the above information. 
         [0095]    [1-3. Process Performed Outside the Vehicle] 
         [0096]    The center terminal  3  perform notification to the portable terminal  4  and notification to the stationary terminal  5 , upon receiving the first signal A from the communication device  29 . 
         [0097]    [1-3-1. Notification to the Portable Terminal  4 ] 
         [0098]    The center terminal  3  transmits a second signal B to the portable terminal  4 , upon receiving the first signal A. The center terminal  3  memorizes association of information, i.e., associating identity information of the vehicle  2  with identity information of the portable terminal  4 . 
         [0099]    When the center terminal  3  receives the first signal A, the portable terminal  4  is identified based on the vehicle information included in the first signal A, and the second signal B mentioned above is transmitted to the portable terminal  4 . 
         [0100]    The portable terminal  4  displays the abnormality occurred in the specific ECU  21 , the need of inspection of the specific ECU  21 , and the like in its display area. The information displayed in the display area of the portable terminal  4  is not limited to a specific content. 
         [0101]    For example, the displayed information may be a contact address of a service station capable of repairing/fixing the abnormality of the vehicle, or a telephone number of a service center capable of providing a repair guidance. 
         [0102]    [1-3-2. Notification to the Stationary Terminal  5 ] 
         [0103]    The center terminal  3  transmits a third signal C to the stationary terminal  5 , upon receiving the first signal A. 
         [0104]    The stationary terminal  5  is, for example, a terminal disposed in a service facility/station of a vehicle maker, a vehicle sales dealer, a service factory, a road service company and the like. 
         [0105]    The center terminal  3  transmits, upon receiving the first signal A, a signal including information that indicates the ID information, the version of the software, etc. to the vehicle maker or to the vehicle sales dealer. 
         [0106]    The vehicle maker and/or the vehicle sales dealer may identify the other vehicle, by the individual ID or by type, for example, having the same specific ECU  21  or the same software as the informed one, and may inform/warn and prevent the next attack to the vehicles with the same vulnerability as the informed one. That is, the damage due to the same vulnerability of the ECU/software may be prevented from quickly spreading to the other vehicles. 
         [0107]    Further, the center terminal  3  transmits, upon receiving the first signal A, abnormality information about the sender of the first signal A, based on the information in the first signal A indicative of the position of the vehicle, to the nearby service facility of the vehicle sales dealer, of the service factory, or of the road service company. In such case, the stationary terminal  5  may be able to display the abnormality of the specific ECU  21  in the vehicle  2  and/or an inspection request in its display area. 
         [0108]    [1-4. Effects] 
         [0109]    According to the embodiment described in details above, the following effects are expected. 
         [0110]    (1a) When the tampering is discovered in the security check at the time of starting of the operation, the specific ECU  21  sends out the abnormality notification frame to the communication line  13 , before performing the reboot. 
         [0111]    Therefore, the abnormality of the specific ECU  21  is quickly notifiable to the outside of the specific ECU  21 . 
         [0112]    Further, upon discovering the abnormality, an abnormality notification is transmitted to the center terminal  3  from the communication device  29 , which makes it unnecessary to perform communication for the abnormality detection purposes, thereby reducing the communication load. 
         [0113]    (1b) The specific ECU  21  is enabled to perform an accurate security check at the time of starting itself and a tampering detection, by comparing (i) the reference hash value memorized in a non-rewritable ROM and (ii) the computed hash value computed by the software that is memorized in the security area  42   a.    
         [0114]    (1c) The external communication ECU  27  is enabled to notify the ID information, the version information of software, etc. to the center terminal  3  or to the stationary terminal  5 . Therefore, the vehicle having a problem and/or the software having a problem is easily identifiable. 
         [0115]    (1d) When the tampering of the specific ECU  21  is detected, the situation is quickly notifiable to the occupant of the vehicle or to the user of the portable terminal  4  from the display device  24  or from the portable terminal  4 , quickly making them aware of the situation. As a result, a danger caused by the abnormality of the specific ECU  21  is avoidable in case that the tampering situation is detected during the travel of the vehicle  2 , use of the vehicle having abnormality is also avoidable, and repair/inspection of such vehicle is quickly performable. 
       Other Embodiments 
       [0116]    Other embodiments other than the above-mentioned may also be devisable. 
         [0117]    (2a) According to the above-mentioned embodiment, when the tampering is discovered in the specific ECU  21 , the communication device  29  transmits the first signal A to the center terminal  3 , and the center terminal  3  transmits the second signal to the portable terminal  4  and/or to the stationary terminal  5 . 
         [0118]    However, as shown in  FIG. 7 , without using the center terminal  3 , the communication device  29  may be configured to directly transmit a signal to the portable terminal  4  or to the stationary terminal  5 . 
         [0119]    Further, when performing wireless communications with the portable terminal  4 , such wireless communication may be based on a wireless Local Area Network (LAN) standard or based on a short-range wireless communication or the like, instead of using the mobile communication network. Note that, in such configuration, the portable terminal  4  is equivalent to a wireless communication terminal in the claims, and the signal transmitted to the portable terminal  4  from the communication device  29  is equivalent to a specific signal in the claims. 
         [0120]    Further, as shown in  FIG. 8 , the specific ECU  21  may include a communication module  22  of itself, and the outputter may transmit the abnormality notification frame therefrom to the center terminal  3 , the portable terminal  4 , and the stationary terminal  5 , without transmitting information to the communication device  29  within the in-vehicle system  11 . Note that, in such configuration in  FIG. 8 , the center terminal  3 , the portable terminal  4 , and the stationary terminal  5  are equivalent to an information processing device outside of the vehicle. 
         [0121]    Further, note that the portable terminal  4  is configured to perform at least one of the abnormality notification to the user of the portable terminal  4  or an inspection warning, and performs at least one of the abnormality notification or the warning upon receiving the abnormality notification frame. 
         [0122]    (2b) According to the above-mentioned embodiment, the software for the MCU  31  that realizes the main function is memorized in the security area  42   a,  and whether the software has been tampered is determined in such configuration. 
         [0123]    However, the MCU  31  needs to perform multi-layered programs for realizing the main function, thereby security check may also be performed for each of the multiple layers of such program. 
         [0124]    For example, the starting of firmware and the security check of firmware may be performed by a program memorized by the boot ROM  43 , and the starting and the security check of an operating system may be performed by the started firmware. 
         [0125]    Further, in the configuration of executing the multi-layered programs, the abnormality notification frame may be output to the communication line  13  by the outputter (i) when the tampering is discovered at a time of starting a program in one of those layers, or (ii) when the tampering is discovered at a time of starting a program in a specific one of those layers. 
         [0126]    (2c) According to the above-mentioned embodiment, the abnormality notification frame is notified to the other ECUS of the in-vehicle system  11  by the communication line  13 . However, such notification may use a dedicated line dedicated for notification/transmission of the abnormality notification frame, or may be wirelessly transmitted. 
         [0127]    (2d) The external communication ECU  27  may be configured to interrupt external communication from outside of the vehicle, when the tampering is detected. 
         [0128]    By interrupting the external communication from outside of the vehicle, the attack from outside of the vehicle is prevented, and/or an output of an inappropriate signal from the abnormal ECU is prevented. 
         [0129]    (2e) According to the above-mentioned embodiment, when the abnormality notification frame is outputted to the communication line  13 , the meter ECU  23  displays the abnormality and the like on the display device  24 . However, the warning is provided for the user from a device other than the display device  24  that is under control of the meter ECU  23 . 
         [0130]    For example, the warning may be provided/output from an image-output device or from a sound-output device in a certain form of an image/sound/voice. 
         [0131]    (2f) The function of the specific ECU  21  is not specifically limited. That is, in various kinds of ECU, the above-described configuration is employable. That is, for example, the meter ECU  23 , the engine ECU  25 , and the external communication ECU  27  may also be configured to perform the same security check and to output the same abnormality notification frame as the specific ECU  21 . 
         [0132]    (2g) According to the above-mentioned embodiment, when the tampering is detected in the specific ECU  21 , the signal is either directly or indirectly transmitted to the other ECUS disposed in the vehicle, or to the center terminal  3 , the portable terminal  4 , and/or the stationary terminal  5 . However, the transmission destination of the signal from the specific ECU  21  is not limited to the above. That is, the signal may be transmitted to various devices and the like that are either in the in-vehicle system  11  or disposed outside of the vehicle  2 . 
         [0133]    (2h) According to the above-mentioned embodiment, the tampering is detected with reference to the hash values. However, the tampering may be detected by other methods. 
         [0134]    For example, the tampering may be determined by a method of comparing the checksums. 
         [0135]    (2i) A function or functions implemented by one component in the above-mentioned embodiments may be distributed to be implemented by plural components, or a function or functions implemented by plural components in the above-mentioned embodiments may be implemented by a single component. 
         [0136]    Further, plural functions owned by plural components may be owned/born by a single component, or a function implemented by using plural components may be borne by a single component. 
         [0137]    Further, a part of the configuration of the above-mentioned embodiment may be omitted. 
         [0138]    Further, at least a part of the configuration of the above-mentioned embodiment may be added to or replaced with the configuration of the other embodiments described above. 
         [0139]    All technical thoughts identified by the language of the claims are implemented by the various forms of the embodiment of the present disclosure. 
         [0140]    (2j) The present disclosure may be realizable and implementable as one component in the above-described information processing system  1 , i.e., as the specific ECU  21 , and as a program for controlling a computer as the specific ECU  21 , a non-transitive and substantive memory medium for storing such a program, a method of starting a control device or the like, i.e., in various forms of program/device/method, besides being realized as the specific ECU  21 . 
         [0141]    Although the present disclosure has been described in connection with preferred embodiment thereof with reference to the accompanying drawings, it is to be noted that various changes and modifications will become apparent to those skilled in the art, and such changes, modifications, and summarized scheme are to be understood as being within the scope of the present disclosure as defined by appended claims.